feat(progress-review): close the drift loop with typed receipts and a recorded differential

[songoow]

What this PR does

Closes the progress-review loop that #4854 started, on top of the existing LoopX contracts, and ships a reproducible differential.

• Core capability progress-review-sentinel (default off). A per-goal policy control_plane.progress_review with modes off / shadow / assist, a strict progress_review_receipt_v0 contract, and a pure trigger that counts consecutive completed drift receipts joined to run rows by turn identity. In assist, the trigger raises the existing autonomous_replan_obligation (kind: external_progress_review_drift) after the typed repeat fuse; unknown, abstained, failed or missing receipts break the streak; an acknowledged replan re-arms it; a changed goal contract invalidates earlier receipts. The refresh-state writeback judges an acknowledgement against the same obligation that loopx status shows.
• Policy surfaces. configure-goal --progress-review-mode|--progress-review-signal|--progress-review-drift-threshold|--clear-progress-review-configuration, the configuration catalog, the Dashboard capability editor, the chat configuration API and dashboard localization. Malformed blocks fail closed to off.
• Observer (packages/loopx-jev). Three Noul questions next to the two Choice questions; typed drift signals derived with the label threshold; drift init --runtime-root writes one receipt per evaluated event under the goal runtime; drift label records private human truth and drift status reports agreement. The core imports nothing from the package.
• Differential harness. loopx-jev sentinel compare replays a frozen 16-sequence matrix (6 constructed cosmetic-drift sequences, 3 mixed sequences that drift after genuine work, 7 real upstream commits labelled on-goal) against committed provider recordings; --live records fresh answers. examples/progress-review-sentinel-smoke.py replays it without a credential.
• Closed-loop test. packages/loopx-jev/tests/test_closed_loop.py drives one real refresh-state sequence three ways: off sees nothing (the typed fuse cannot fire on self-declared advanced), shadow shows receipts and no obligation, assist raises the obligation, loopx status publishes it, a real acknowledged replan re-arms it, and one more drift round is not enough.

Why

typed_progress_repeat_trigger needs identical fingerprints plus a self-declared unchanged/blocked. An Agent that keeps declaring advanced with a fresh hypothesis_id while only renaming identifiers is invisible to it, and the periodic review looks at that Goal only after 20 durable runs.

Recorded differential (committed live run, jev-1.13.0, 35 rounds, all completed)

	Typed repeat fuse	noul receipts	choice receipts
Drift sequences flagged at or after their gold round	0/9 (invisible by construction)	6/9	4/9
Reaching the assist obligation at threshold 2	0/9	6/9	1/9
Real on-goal upstream commits falsely flagged	0/7	0/7	0/7
Premature flags inside mixed sequences	0	1	0

All six purely cosmetic sequences, including an 18 KB rename sweep, were flagged at round 1 and would raise the obligation at round 2. Client-measured assessment latency: 807 ms median, 1.5 s p95; 1879 median input tokens.

What it misses. Once a real implementation exists in the scoped file, later cosmetic churn on that file kept serves_acceptance at 0.62–0.90, so none of the three mixed sequences was flagged at its drift round. One executed negative probe was flagged as drift in two of three live runs. Across three live runs noul flagged 6, 7 and 6 of 9; one of 35 answers in one run was rejected by the strict decoder (selected label ≠ argmax) and failed closed.

Verification

• Package: 73 tests (real Git, real refresh-state, injected answers, receipts, labels, matrix strictness, replay determinism, closed loop).
• Core: new tests/control_plane/test_external_progress_review.py and tests/capabilities/test_progress_review.py; regression on obligation, refresh gate, configuration UI, chat API and capability registry suites (115 + 76 passing locally).
• ruff check on the CI scope, strict mypy on the new modules, docs-governance-smoke, repository-hygiene-smoke, progress-review-sentinel-smoke.
• Three live recordings (each ~35 provider calls); the committed one is the last.

Boundaries and what is not claimed

• No pause, user gate, Turn settlement or Goal acceptance authority. Escalation legs are future work.
• The core never calls a model, never reads a raw delta, never overwrites progress_observation.
• Gold labels for constructed cases come from their author; real commits are labelled on-goal by having merged upstream. Injected answers prove plumbing, not model quality.
• No claim of reduced wasted work or task-completion improvement; that needs a separately authorized intervention study.

Still a Draft: maintainers decide whether this bounded closed loop and its recorded differential are worth adopting.