fix(agentic): prepared pack + effective Flash views

[innocarpe]

Summary

• Flash triage/extract now receive prepared effective views (triage_view_text / extract_view_text) from a once-scrubbed pack — never raw capture signal (closes H0b / H0e / QD0).
• Empty capture signals drop at admit with empty_signal (no (empty capture …) placeholder that used to admit and spend).
• Soft-scrub path roots broadened (/opt, /private, /Volumes, /mnt, /srv); policy_version bumped to agentic_v1.1 for later bulk-retract selection (QD10).

Why

Dogfood and dual review of the agentic quality ultragoal (v2.1) showed substrate defects before prompt work: the runner sent raw signal text to Flash while E5 verified quotes against scrubbed pack_text, and flash.ts silently sliced to 12k without a declared view contract. Empty captures were substituted with a synthetic admit-worthy string. Quality work on extract prompts cannot fix cite/privacy mismatches if the model and verifier see different strings.

This is Q1′ of the quality ultragoal (first code PR after merged Q0 plan). Later gates: do not start Q3′ until Q1.5′ + Q2.5′ green; do not start Q5′ until Q4.5′ green.

Scope and changes

• In scope:
  • packages/agentic/src/pack.ts — deriveAgenticEffectiveViews, head+tail triage bound (8k), prefix extract bound (12k), broader scrub, digests on prepared pack
  • packages/agentic/src/flash.ts — view_text path, request-body builders, same-view assert (no second slice)
  • packages/agentic/src/pipeline.ts — stages + verify bind to prepared views; surface view digests on result
  • packages/agentic/src/runner.ts — prepare pack before Flash; empty signal no placeholder
  • packages/agentic/src/types.ts (+ materialize/human-review/index) — AGENTIC_POLICY_VERSION = agentic_v1.1
  • fixtures golden/licensing manifests policy pin; unit/integration regressions
• Key behavior:
  • Before: Flash body = raw signal (sliced); verify = scrubbed pack; empty → fake admit body
  • After: Flash body = declared scrubbed view; verify = same extract view; empty → drop
• Intentionally not changed: transcript recovery (Q3′), report redaction (Q1.5′), admit line-scope (Q2.5′), fake-in-live (Q7′), provenance filter (Q5′)

Labels

• Kind: fix
• Area (optional): None — agentic plane cross-cutting substrate

Architecture/data-contract impact

• Policy identity: new dispositions/proposals stamp agentic_v1.1 (and formation:agentic_v1.1 on materialize reason codes). Historical agentic_v1 holds remain addressable by explicit policy_version on human-review paths.
• Pipeline result: adds optional prepared-view fields (triage_view_text, extract_view_text, effective_view_digest, policy_version). Default operator report still must not dump statements (full redaction is Q1.5′).
• Flash API: prefers view_text; pack_text kept as deprecated alias for the same prepared view only.
• No MCP/schema migrations; no store schema change.

Validation

Command	Result
pnpm --filter @carpeos/agentic test	PASS (81 tests)
make preflight-fix / make preflight	PREFLIGHT PASS mode=pr
Linux bubblewrap Product 4 / Gitleaks	Not run — Linux GHA only

Public-data/security boundary

• Synthetic fixtures/examples only
• No credentials, private paths, private knowledge, production logs, or runtime exports
• Private issues reduced to public-safe repros when applicable

Compatibility/migrations/deployment

• Compatibility: local policy_version stamp changes for new agentic materializations (agentic_v1 → agentic_v1.1). Gate semantics unchanged (promote-when-verified allowlist).
• Migrations: None (no SQLite/D1 schema)
• Deployment: Not applicable (library path; ships with next package release)

Risks and rollback

• Risks: historical human-review of held units must pass policy_version: "agentic_v1" when targeting pre-bump holds; long packs truncate extract to 12k prefix (same as prior Flash slice intent, now declared).
• Rollback: revert this PR; operators can keep working under previous policy stamps already written.

Review guide

• Start with: packages/agentic/src/pack.ts (views + scrub) and packages/agentic/src/flash.ts (fetch-body bind)
• Pay attention to: runner.ts empty-signal path; pipeline verify on extract_view_text not raw signal
• Suggested local check: pnpm --filter @carpeos/agentic test

Out of scope/follow-ups

• Q1.5′ redact statements/quotes from default report/CLI/timer
• Q7′ no fake side effects in live mode
• Q2′ / Q2.5′ quality corpus + admit line/SECRETISH scoping
• Q3′ agentic transcript recovery (blocked until Q1.5′ + Q2.5′)
• Residual scrub classes still documented: emails, bare IPs, hostnames

Checklist

• Title is Conventional Commit English
• One coherent milestone / change (quality ultragoal Q1′)
• Labels from .github/labels.json only
• Validation table honest
• Deploy/migration status explicit