test(harness): WD-5/WD-6 live transcript capture, and the four defects it caught

Layer 3, plan item 6. Claude Code headless (the one harness with attested
flags) through the LiteLLM gateway — no vendor credential; the key is read
from the proxy's own config at call time, enters the child env only, and is
never printed or passed in argv. Opt in with ....F.                                                                   [100%]
=================================== FAILURES ===================================
_______________ test_s3_offer_once_then_decline_then_silence[3] ________________
packages/studyloop/tests/live/test_wind_down_transcripts.py:500: in test_s3_offer_once_then_decline_then_silence
    assert not after_decline_hits, (
E   AssertionError: second brains came back after the decline: ['turn 1: xtiles']
E   assert not ['turn 1: xtiles']
=========================== short test summary info ============================
FAILED packages/studyloop/tests/live/test_wind_down_transcripts.py::test_s3_offer_once_then_decline_then_silence[3]
1 failed, 5 passed in 88.32s (0:01:28); artefacts
(per-state transcripts, summary.json, tool-routing.json) land under
gitignored reviews/.

The three gate checks, graded on real transcripts with the arbitrated
assertions and nothing stronger: sentence at most once across the whole
transcript; silence = no pinned sentence and no second-brain vocabulary in
assistant prose WHILE the D4 positive control holds (the transcript must
show channel: none
offer: False
sentence:
reason: provider is 'xtiles' but no 'xtiles' connector is attached this session actually ran, or a crashed run would pass
by absence); a declined offer leaves the stub log empty — with the xtiles
tools ALLOWED, so declining was a choice, not an inability. 3/3 for the
offer-once-then-decline state; one pre-response infra retry, flakes counted
in the artefact, never smoothed.

Capturing found four real defects; each is fixed here and visible in the
transcript evidence:
1. Protocol violation — the harness narrated the step ('Running the second
   brain check now'). The protocol now opens step 5 with the silence rule
   and names narration a violation.
2. Fabricated connector flag — given a literal '--connector xtiles' example,
   the model passed it with NO server attached, manufacturing an offer. The
   protocol now grounds the flag in the mcp__<server>__ tool names the
   session can actually see, and calls it a statement of fact.
3. D2 exactly as the council predicted — the hermetic HOME hid the skill and
   'Unknown skill: studyloop-xtiles-wind-down' killed an offer turn. The
   world now runs the REAL Updated agent definitions.
  shared: 0
  kiro: 1
  claude: 1
  opencode: 0
  codex: 0
  pi: 0 into the isolated
   home, which also exercises the installer for free.
4. A gateway bug — LiteLLM's anthropic-passthrough adapter (Bedrock invoke
   path) dies on extended-thinking blocks ('Content block is not a text
   block'), deterministic on thinking-length prompts. Worked around with
   MAX_THINKING_TOKENS=0 in the harness env; proxy upgrade is the real fix.

Final capture: 6/6 pass, 0 flakes. WD-6's observation (records, never
gates): the P1b planner wording selected
xtiles_create_tiles_from_markdown_in_my_planner — matching the owner's hand
run. Spend recorded in the ledger: est $1.50, actual $4.45; the overrun is
Claude Code's ~30k-token own system prompt per call plus five debug
re-runs, both now named in the estimate file so the next one models them.

Author: NetDevAutomate

Justfile

@@ -148,6 +148,15 @@ smoke-extras:
 build-release:
     ./scripts/build-release.sh
 
+# WD-5/WD-6: the live wind-down gate checks, captured through Claude Code
+# headless against the LiteLLM gateway (no vendor credential; the key is read
+# from the proxy's own config at runtime). Opt-in — burns gateway spend
+# (estimate: reviews/2026-09-04-gate-checks/ESTIMATE.md). Writes transcripts
+# and the pass/fail summary under reviews/…/evidence/gate-checks/.
+gate-checks:
+    STUDYLOOP_EVIDENCE_DIR={{justfile_directory()}}/reviews/2026-09-04-gate-checks/evidence/gate-checks \
+        uv run --group dev pytest packages/studyloop/tests/live/test_wind_down_transcripts.py -m live_provider -q
+
 release-consistency:
     uv run python scripts/check-release-consistency.py --skip-wheel
 

agents/manifest.json

@@ -50,7 +50,7 @@
       "updated": "2026-09-04"
     },
     "shared/wind-down-protocol.md": {
-      "hash": "486c2e70b07e5b0c",
+      "hash": "31bf9bc1f569923b",
       "updated": "2026-09-04"
     },
     "skills/studyloop-xtiles-wind-down/SKILL.md": {

agents/shared/wind-down-protocol.md

@@ -48,15 +48,26 @@ Standard end-of-session tasks from session-protocol.md:
 
 4. Set next review dates via spaced repetition schedule.
 
-5. Offer the second brain — **only if the decision command says to, and only once**:
+5. Offer the second brain — **only if the decision command says to, and only
+   once**. Run this step silently: never announce, name or narrate it in any
+   state — the learner hears either the offer sentence or nothing at all.
 
    ```bash
    studyloop brain wind-down --json --connector <name>
    ```
 
-   Pass one `--connector NAME` for each MCP server connected in this session
-   (only `xtiles` affects the decision; omit the flag when none are). The
-   command answers with `channel`, `offer`, `sentence` and `reason`.
+   ```bash
+   studyloop brain wind-down --json
+   ```
+
+   That is the whole command when no MCP tools are visible to you. Add
+   `--connector <server>` for each MCP server whose tools you can actually
+   see in this session — MCP tools are named `mcp__<server>__…`, so the
+   server name is read off the tools themselves, and only `xtiles` affects
+   the decision. The flag is a statement of fact about this session, not part
+   of the command's syntax: **naming a connector whose tools you cannot see
+   fabricates an offer for a service the session cannot reach.** The command
+   answers with `channel`, `offer`, `sentence` and `reason`.
 
    If `offer` is `true`, say `sentence` **verbatim, exactly once**. For the
    `publish` channel that sentence is:
@@ -76,7 +87,8 @@ Standard end-of-session tasks from session-protocol.md:
 
    If `offer` is `false`, or on **no**, **say nothing about second brains at
    all** and continue the wind-down. Do not repeat the offer later in the
-   session.
+   session. "No second brain is configured, so nothing to offer" and "running
+   the second brain check now" are violations, not courtesies.
 
    The command computes two separate rules — not one conjunction. `configured`
    plus `supports_publish` (both from `studyloop brain status --json`) selects