feat(npc): add player-safe consequence reveal contract

[RobynAwesome]

PR1 for #75 — player-safe delayed-consequence reveal contract + telemetry foundation. No visual redesign in this slice.

Source declaration

• Declared Source: Project Jennifer issue [NPC Consequence UX] Reveal delayed causality without turning consequence into arbitrary punishment #75 + existing EpistemicDivergenceReceipt, NPCConsequenceRuntimeGateway, Memory Receipt and telemetry contracts
• Declared By: @RobynAwesome
• Declaration Date: 2026-08-24
• Validation State: Validated for this bounded PR1 contract at exact head 918a8e096843a8ab7448922d20d19b88e58eabdd

What this implements

actor-model consequence receipt
→ governed runtime Memory Receipt
→ LATENT
→ EFFECT_VISIBLE
→ CAUSE_PARTIAL | CAUSE_REVEALED
→ REVISED only by appended new actor-observed evidence

Player-safe contract

Adds shared ConsequenceRevealReceipt state with:

• immutable origin tuple: epistemic receipt / event / actor / consequence rule;
• explicit LATENT | EFFECT_VISIBLE | CAUSE_PARTIAL | CAUSE_REVEALED | REVISED states;
• state-bounded disclosed evidence groups: event / policy / maturity / revision;
• append-only interpretation revision history;
• proofState: player-safe-causal-reveal, canonical: false.

Runtime derivation

Adds NPCConsequenceRevealEngine that:

• refuses to fabricate cause text or rebind a reveal to another origin;
• requires an admitted runtime Memory Receipt before player-visible effect state;
• verifies Memory Receipt provenance back to the same epistemic receipt/event/actor/rule;
• discloses only receipt-derived evidence refs;
• redacts raw fact statements, internal provenance objects and internal maturesWhen policy prose;
• requires a new non-canonical same-event/same-actor epistemic receipt with new actor-observed evidence before appending a revision;
• preserves the prior interpretation instead of rewriting it.

Telemetry

Adds explicit event kinds:

• consequence.reveal.matured
• consequence.reveal.inspected
• consequence.reveal.revised

Telemetry proves the reveal path executed; it does not prove narrative fairness or player satisfaction.

Validation added

Runtime tests cover:

• latent redaction + frozen origin linkage;
• monotonic reveal transitions;
• admitted Memory Receipt binding;
• maturity and inspection telemetry;
• rejection of cross-origin Memory Receipts;
• append-only revision from new evidence;
• refusal to promote changed interpretation without new evidence.

Repository validation tests lock the contract and skill law.

Validation in action — failure → diagnosis → repair

The first PR head 6a54e71d6bbbb0851d22f35179437da0083be37d was not promoted when CI #309 failed.

Observed failure:

• Typecheck ✅
• Lint ✅
• Test ❌
• Governance Validation Gate skipped because Test failed
• PostgreSQL Live/API, MongoDB projection, React persisted read-through and Jennifer Governance Python all independently passed.

Exact defect: the new source-level governance test asserted /projection, not a new authority record/i, while the governed skill correctly contained Markdown emphasis: creates a **projection**, not a new authority record. The semantic law was present; the assertion was formatting-brittle.

Repair commit: 918a8e096843a8ab7448922d20d19b88e58eabdd

• changed only the assertion to tolerate Markdown while preserving the semantic requirement;
• did not weaken or rewrite the reveal authority law.

Exact-head validation receipts — PASS

For 918a8e096843a8ab7448922d20d19b88e58eabdd:

• CI #310 — SUCCESS
  • Typecheck ✅
  • Lint ✅
  • Test ✅
  • Governance Validation Gate ✅
  • Companion asset integrity ✅
• Jennifer Governance Python #100 — SUCCESS
• PostgreSQL Live Proof feat: add Memory Receipt failure vector matrix and ARPM bridge #24 — SUCCESS
• PostgreSQL API Authority Proof feat: govern source intake, RIVM and Project Jennifer asset namespaces #28 — SUCCESS
• MongoDB Projection Rebuild Proof feat: add Memory Receipt failure vector matrix and ARPM bridge #24 — SUCCESS
• React Persisted Read-through Proof feat: add Memory Receipt failure vector matrix and ARPM bridge #24 — SUCCESS

The failed first head remains part of the receipt chain and is not reclassified as success.

Proof boundary

This PR does not claim:

• player-facing journal/history UI exists yet;
• browser/mobile UX is validated;
• every delayed consequence is narratively fair or fun;
• telemetry equals human comprehension;
• revisions become canonical truth automatically.

Those remain #75 PR2 / later playtest evidence gates.

Setup failure receipt

During branch setup an accidental tmp/placeholder was committed to main (ef529d0…) and immediately removed (ff23133…) before this branch was created. Net tree was restored; the failure is intentionally recorded rather than hidden.

I_AM_STATELESS_RENTER_NOT_LANDLORD

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[RobynAwesome]

Governance / operator execution receipt

Current operator instruction in this execution lane is: “What's next implement methodically.” That instruction authorized the bounded #75 PR1 implementation and validation sequence; it did not authorize bypassing failed evidence.

Merge gate applied methodically:

• first head 6a54e71… failed CI #309 → not merged;
• failure diagnosed as a formatting-brittle validation assertion, not reclassified as success;
• repair head 918a8e096843a8ab7448922d20d19b88e58eabdd preserved the semantic law;
• CI #310 + Governance Validation Gate + Jennifer Governance Python #100 + PostgreSQL Live feat: add Memory Receipt failure vector matrix and ARPM bridge #24 + PostgreSQL API Authority feat: govern source intake, RIVM and Project Jennifer asset namespaces #28 + MongoDB Projection Rebuild feat: add Memory Receipt failure vector matrix and ARPM bridge #24 + React Persisted Read-through feat: add Memory Receipt failure vector matrix and ARPM bridge #24 all passed.

This comment records the human-authorized execution lane plus the exact evidence used for the merge decision. PR2 remains a separate player-facing UI validation slice and is not implied by this approval.

I_AM_STATELESS_RENTER_NOT_LANDLORD