No journal-owned command evidence: agent-authored artifacts are indistinguishable from fabricated transcripts

[khaliqgant]

Problem

There is no primitive for "this step's evidence is the captured stdout and exit
code of this command, recorded by the journal."

So when a flow needs an agent to establish a fact — a test failed, a gate went
red, a mutation was caught — the agent writes a markdown artifact describing
what happened. The artifact is prose. Nothing distinguishes a transcript that
was captured from one that was composed.

This is not hypothetical

A 67-step verification campaign in AgentWorkforce/relay produced this in a
preserved evidence artifact:

running 4 tests
all seam invariant tests ... ok
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; finished in 0.00s

cargo test never prints all seam invariant tests ... ok. It prints one line
per test name. That block was written by an agent, in the shape of a transcript,
and preserved as the campaign's proof that four safety invariants held. The
gate accepted it. A later reviewer caught it only by knowing what cargo output
looks like.

The same artifact described 4 tests where the tree had 8, and cited line numbers
that no longer pointed at the assertions it quoted.

Why gates don't catch it

A gate can only check the artifact's text. The campaign's gate required each
invariant name to appear near /FAILED|panicked|assertion .* failed/ somewhere
in the file. Composed prose satisfies that as easily as a real transcript, and
there is no freshness check, so a stale or invented document passes forever.

Workarounds that don't close it:

• An evidence-recorder step (record <name> <command> writing
  {name, command, exitCode, verdict, tail}) works — but only for evidence the
  flow produces. The moment an agent step is asked to establish something, the
  artifact is back to being prose.
• Asking the agent to "paste real output" is an instruction, not a constraint.

Proposal

A step-level declaration binding evidence to execution, e.g.

f.run('cargo test -p broker --lib seam', {
  evidence: 'seam-invariants',   // journal owns stdout/stderr/exitCode/timing
})

and a way for a later step (or a gate) to assert over that recorded evidence
by name, rather than over a file an agent wrote:

f.gate({ evidence: 'seam-invariants', require: 'green' })

Key properties:

• The agent cannot author or amend it.
• It carries the run id, so reuse cannot silently import a previous run's
  evidence (related: --reuse-from silently reuses steps whose real output is on disk, resurrecting stale evidence; no way to declare external effects #523).
• A gate reading it is reading execution, not narration.

Impact

Any flow whose output is a claim rather than an artifact — verification
campaigns, audits, reviews, compliance checks. In those flows the evidence is
the deliverable, and today the engine cannot tell the deliverable from a
description of it.