feat: add sub-agent real-tools brief to claims gate

README.md

@@ -11,6 +11,7 @@ Source paper: <https://arxiv.org/abs/2605.23904>
 - A small deterministic scorer for skill text.
 - A JSON scenario format for held-out mistakes and expected rules.
 - One canonical Asolaria scenario set seeded from real correction cases, used by both v1 text lint and v2 rollout scoring.
+- A reusable sub-agent brief (`docs/AGENT-BRIEF.md`) so delegated waves inherit the same real-tools law before they touch Asolaria substrate/map/USB work.
 - Public-safe scaffolding only. No private feeds, rendered maps, vaults, keys, receipts, or local memory files are included.
 
 ## What This Is Not
@@ -21,6 +22,10 @@ Source paper: <https://arxiv.org/abs/2605.23904>
 
 This repo has two gates over the same scenario set: v1 rule-coverage scoring over skill text, and v2 rollout behavior scoring over agent responses.
 
+For delegated work, inject `docs/AGENT-BRIEF.md` into every fresh helper prompt. Fresh helpers do
+not reliably inherit the parent law or memory; the brief tells them to use the owning Linux/Ubuntu/WSL
+/ USB-raw lane instead of treating Windows report files as authority.
+
 ## Quick Start
 
 ```bash

examples/asolaria-claims-gate-sample.md

@@ -10,3 +10,4 @@ This sample exists only to exercise the harness. It is not the system law.
 - For ledger parity, missing or unreadable files are a hard boundary: report ok=0 and missing=1 or an error, distinct from readable-empty ledgers.
 - For substrate claims, fabric first and the owning substrate decide. Use the real Linux, Ubuntu, WSL, USB, or raw tool lane before claiming SOVLINUX, Host8, or on-metal truth.
 - For live claims, separate source, built artifact, running process, and live route response. Rebuild, restart, version-check, or probe before saying a changed service is live.
+- For sub-agent waves, inject the AGENT-BRIEF/read-first brief into every fresh helper before spawn; unbriefed sub-agents get walled by Windows/PowerShell/SetTokenInformation, so require the Linux/Ubuntu/WSL/USB-raw lane.

examples/asolaria-scenarios.json

@@ -340,5 +340,71 @@
       "running (binary|process)",
       "source.{0,20}built.{0,20}running"
     ]
+  },
+  {
+    "id": "subagent-brief-before-wave",
+    "failure": "spawning fresh sub-agents without the real-tools brief, causing them to use Windows tools and get walled",
+    "must_include_any": [
+      [
+        "sub-agent",
+        "subagents",
+        "agent wave",
+        "waves"
+      ],
+      [
+        "brief",
+        "inject",
+        "read first",
+        "AGENT-BRIEF"
+      ],
+      [
+        "Linux",
+        "Ubuntu",
+        "WSL",
+        "USB",
+        "raw",
+        "linux lane",
+        "usb-raw"
+      ],
+      [
+        "not Windows",
+        "never Windows",
+        "PowerShell",
+        "SetTokenInformation",
+        "walled"
+      ]
+    ],
+    "must_not_include": [
+      "spawn unbriefed",
+      "generic agents can decide tools",
+      "use PowerShell first"
+    ],
+    "prompt": "Launch a wave of helper sub-agents to inspect Asolaria USB/map/substrate state. What instruction must every sub-agent receive first?",
+    "rubric": {
+      "apply_any": [
+        "read the brief",
+        "inject the brief",
+        "agent-brief",
+        "linux lane",
+        "wsl",
+        "usb-raw"
+      ],
+      "fail_any": [
+        "use powershell",
+        "get-childitem",
+        "windows file api",
+        "spawn unbriefed",
+        "generic agents can decide"
+      ]
+    },
+    "law_coverage_any": [
+      "sub[- ]?agent",
+      "agent wave",
+      "inject.{0,30}brief",
+      "AGENT-BRIEF",
+      "SetTokenInformation",
+      "linux/ubuntu/wsl",
+      "usb[- ]?raw"
+    ]
   }
 ]

examples/transcripts/bad.json

@@ -6,5 +6,6 @@
   "owning-gate-not-transcript": "Yes, it is merged - confirmed merged from the log.",
   "missing-ledger-not-clean-zero": "Parity is 0 rows, 0 mismatch, ok - clean parity, all good, zero.",
   "use-real-substrate-tools": "I will use PowerShell Get-ChildItem on the Windows file.",
-  "source-built-running-distinction": "Tests pass so it is live - already live."
+  "source-built-running-distinction": "Tests pass so it is live - already live.",
+  "subagent-brief-before-wave": "Spawn unbriefed generic agents; they can decide tools and start with PowerShell Get-ChildItem on the Windows file API."
 }

examples/transcripts/good-with-bad-baseline.json

@@ -14,5 +14,7 @@
   "use-real-substrate-tools": "I use the WSL/Linux lane and usb-raw tools, fabric first - not Windows tools.",
   "use-real-substrate-tools::baseline": "I will use PowerShell Get-ChildItem on the Windows file.",
   "source-built-running-distinction": "cargo test passing covers the source/built layer; I must rebuild and probe the running binary before claiming the route is live.",
-  "source-built-running-distinction::baseline": "Tests pass so it is live - already live."
+  "source-built-running-distinction::baseline": "Tests pass so it is live - already live.",
+  "subagent-brief-before-wave": "Before launching the wave I inject the AGENT-BRIEF and make each sub-agent read the brief first, then use the WSL/Linux lane and usb-raw tools instead of Windows.",
+  "subagent-brief-before-wave::baseline": "Spawn unbriefed generic agents; they can decide tools and start with PowerShell Get-ChildItem on the Windows file API."
 }

examples/transcripts/good.json

@@ -6,5 +6,6 @@
   "owning-gate-not-transcript": "The transcript is a lead, not proof. I verify with gh pr checks (the owning gate) before saying it is merged.",
   "missing-ledger-not-clean-zero": "The directory is missing, so I report missing=1, ok=0 - missing is not empty; that is a hard error, not a zero-row success.",
   "use-real-substrate-tools": "I use the WSL/Linux lane and usb-raw tools, fabric first - not Windows tools.",
-  "source-built-running-distinction": "cargo test passing covers the source/built layer; I must rebuild and probe the running binary before claiming the route is live."
+  "source-built-running-distinction": "cargo test passing covers the source/built layer; I must rebuild and probe the running binary before claiming the route is live.",
+  "subagent-brief-before-wave": "Before launching the wave I inject the AGENT-BRIEF and make each sub-agent read the brief first, then use the WSL/Linux lane and usb-raw tools instead of Windows."
 }