feat(loki): ground every answer in typed records instead of prose

[catomean]

The failure this fixes

Loki answered a five-part "plan my day" prompt with three fabricated answers, then produced an unverified correction when challenged. Every claim traced:

Loki said	Ground truth
"rotate the expired GROQ_API_KEY, it blocks truthseeker"	The key returns HTTP 200. Both cited .env paths were invented.
"Ilya Druzhnikov (UZH)"	The record has no org field. UZH appears nowhere in the operator's data — it is the substring inside drUZHnikov. Loki's own retraction ("an internal keyword search grouping error") was literally true.
"Elena Weber — Accelerator & Bridge Program Manager, University of Liechtenstein alumna, START Summit jury"	The record is a display name and a phone number. The operator asked for LinkedIn research; no search was performed.

Root cause is architectural

buildLokiFleetContext injected projects + RAG only. People, goals, habits, commitments and events were never in context — though FleetCrown could already answer every one of those questions exactly (getStuckGoals, getGoalsDueSoon, listUpcomingCommitments, getEventsDueSoon have existed for months, unwired).

So a prompt demanding five items met a context supporting one. The model filled the rest. That is the ordinary failure mode of a small model under format pressure — precisely who will be running this.

The fix: make unsupported claims hard to express

• agent/core/facts.ts — records with a declared field set. Unstored fields render as an explicit <not recorded>, turning absence into a stated negative the model must actively contradict.
• agent/core/contract.ts — rules generated from this turn's facts: enumerated citation ids, named concrete gaps, a verbatim refusal phrase. Plus Directive, for answers computed in SQL that the model may only phrase.
• agent/core/verify.ts — deterministic post-generation check. No extra model call, so it runs on free-tier turns too — where fabrication is most likely and a frontier-cost verifier would be disabled.

loki-core now verifies and gives the model one repair pass to delete unsupported claims. Surviving violations ride back as grounding metadata rather than being swallowed: the original failure wasn't that Loki was wrong, it's that wrong looked exactly like right.

Verification

scripts/test/agent-grounding.ts — 12 adversarial checks built from the real transcript. All four fabrications above are caught; a clean grounded answer still passes (the check is not a DoS on itself). 60/60 unit files pass, tsc clean, 0 lint errors.

core/ is mirrored byte-for-byte into OrangeCat with a SHA-256 drift gate in both repos (orangecat#feat/cat-grounding-harness). Exit is extraction to @fleet/agent-core.

Removes loki-fleet-context/-index — superseded; a second definition of the fleet index would be the SSOT violation this replaces.

🤖 Generated with Claude Code