feat(goal): prove the journals this module ships, and repair the one it rejected

[rldyourmnd]

agent-runtime distributed a Goal journal its own CLI refuses to load.

$ agent-runtime goal status --journal .agent-runtime/goals/first-v0-release.json
{"error":"invalid_goal","message":"invalid receipt for phase recovery_cycle_verification_orient"}

22 of its 24 receipt keys were invented recovery-cycle labels rather than phases. The file is tracked, so it travelled inside the published v0.1.3 source archive and was listed in its SPDX inventory.

Why nothing caught it

Tightening the schema so receipt keys must be phases made an existing tracked file invalid, and nothing compared the two — because the Goal contract was the only contract here without an executable checker over its tracked artifacts. CI, governance, release, provenance, fuzz and cold compile all had one. The product itself did not.

That is the same failure class as the P1: a control that cannot fail for the reason it claims. Here there was no control at all.

cmd/check-goal-journals

Holds every tracked journal to both the Go contract and the published schema — they are one vocabulary stated twice, and Go alone would let the schema drift while the schema alone would skip the durable invariants the type enforces.

• refuses an empty directory: a gate that succeeds by finding nothing to inspect cannot be told from one that inspected everything
• requires the file to be the canonical encoding of what it decodes to, so a journal cannot drift each time the runtime rewrites it
• registered in the CI contract as well as ci.yml, so it cannot be dropped from the workflow while the contract stays green
• recorded in .gds/repository.yaml alongside the other verification commands

Five damaged shapes are refused in tests, including the exact one that shipped.

The repair

Migrated by replaying the history through goal.New and Advance — the product's own API — so the result is legitimate by construction rather than by hand.

Lossless in substance: all 24 evidence records survive on the phase receipts (1, 6, 5, 2, 2, 3, 5), and every cycle summary is retained and labelled. Each recovery receipt already named its real phase in its own phase field, so the fold is that mapping and nothing more. One record used a source type that was never in the contracted vocabulary and is recorded as a link. The pre-migration form is in Git history.

It also now says what happened

It had stood at state: active with all seven acceptance criteria pending since 13 August — claiming the first release never happened — while v0.1.2 and v0.1.3 were published and issue #9 was closed. Its closure records both the outcome and the migration, and keeps as declared debt that v0.1.0 and v0.1.1 remain tagged and unpublished.

Verification

$ go run ./cmd/check-goal-journals
goal journals valid: 9 tracked under .agent-runtime/goals, accepted by the Goal contract and the published schema

And the consequence that mattered — a source archive built from this commit, every journal extracted and fed back to the CLI: all accepted. Built from the previous commit, first-v0-release.json is still rejected.

gofmt, go vet, staticcheck v0.7.0, full suite under umask 002, all seven contract checkers. All green.