V48 Gate 3 (specification-implementation): deposit Implementation emits a measured patch via the code-edit tool

Each synthesized AssetPack is now a measured PATCH: the measured option fields plus a SOURCE-SAFE patch descriptor (fileChanges [path+op] + a natural-language patchSummary; never raw code). New AssetPackPatchWriteTool (ExecutionTool) records the descriptor (physical workspace fs-write is the delivery context, out of scope). The deposit synthesis agent reads the Discovery stores (codebase/depository/regurgitation comprehension) + the obfuscation comprehension, synthesizes the patch descriptor honoring obfuscations + exclusions, calls the tool per pack, and stores implementation:assetPacks (full measured-patch packs) + implementation:options (reviewable face; validateDepositSynthesisOptions reads the measured fields, ignores patch). Source-safety: no raw patch code in any schema/store/tool/telemetry — descriptor + measurements + summaries only. asset-pack 42/208 + typecheck green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: geraldarthurdavis

BITCODE_SPEC_V48_NOTES.md

@@ -260,6 +260,16 @@ The five phases (same agents in both modes, lens-varied — decided 2026-06-25):
     / references).
 - **Implementation**: synthesize the AssetPack patch(es) with their absolute
   measurements (read additionally computes the fit measurements and the BTD).
+  Each candidate is a measured patch — the measured option fields plus a
+  SOURCE-SAFE patch descriptor (`fileChanges` [path + change-op] and a
+  natural-language `patchSummary`), recorded via the `AssetPackPatchWriteTool`
+  (a formal `ExecutionTool`) which the synthesis agent reads from the Discovery
+  stores (`discovery:codebaseComprehension` / `:depositorySearch` /
+  `:inherentRegurgitation`) and the obfuscation comprehension. Pre-settlement the
+  RAW patch content is never produced — only the descriptor + measurements are
+  reviewable (stored at `implementation:assetPacks`; the reviewable face at
+  `implementation:options`). Physical materialization of the raw content into the
+  cloned workspace is the delivery/settlement context.
 - **Validation**: quality thresholds, coverage/corrections/fixes, and AssetPack
   smoke/sanity checks; the Discovery/Implementation/Validation loop iterates until
   complete or maxIterations.

packages/pipelines/asset-pack/src/agents/implementation/asset-pack-patch-write-tool.ts

@@ -0,0 +1,47 @@
+/**
+ * AssetPackPatchWriteTool — formal code-edit (patch) materialization tool (V48 Gate 3).
+ *
+ * Per spec, a completely synthesized AssetPack is a MEASURED PATCH:
+ * patch + measurements + metadata. This formal ExecutionTool is the code-edit
+ * primitive for the patch half of that artifact: it RECORDS the patch the
+ * AssetPack contributes as a tool-tracked materialization that renders on the
+ * SDIVF telemetry spine, exactly like AssetPackInventoryTool records the
+ * exclusion-filtered source inventory.
+ *
+ * Source-safety (the hard constraint): this tool records the SOURCE-SAFE patch
+ * DESCRIPTOR only — the set of file changes as (path + change op) — and NOTHING
+ * ELSE. It never accepts, holds, or returns raw patch code, file contents, diffs,
+ * or secrets. Because ExecutionTool persists both the call args and the return
+ * value into the tool's child execution (which streams to execution_events),
+ * keeping the descriptor path/op-only is what preserves the pre-settlement
+ * source-safety invariant.
+ *
+ * It RECORDS, it does not fs-write: the returned `materialized: false` marks that
+ * no physical workspace write happened here. Physical materialization of the
+ * patch into a workspace is the delivery/sandbox context and is explicitly OUT
+ * OF SCOPE. The descriptor recorded here is the artifact the depositor reviews
+ * before admission.
+ */
+
+import { ExecutionTool } from '@bitcode/agent-generics';
+
+export type AssetPackPatchWriteArgs = {
+  fileChanges: Array<{ path: string; op: 'create' | 'modify' | 'delete' }>;
+  assetPackTitle?: string;
+};
+
+export type AssetPackPatchWriteDescriptor = {
+  materialized: boolean;
+  fileChanges: Array<{ path: string; op: string }>;
+};
+
+export class AssetPackPatchWriteTool extends ExecutionTool<
+  (args: AssetPackPatchWriteArgs) => Promise<AssetPackPatchWriteDescriptor>
+> {
+  use = async (args: AssetPackPatchWriteArgs): Promise<AssetPackPatchWriteDescriptor> => ({
+    // Records, does not fs-write: physical workspace materialization is the
+    // delivery context (out of scope). Returns ONLY the source-safe descriptor.
+    materialized: false,
+    fileChanges: (args.fileChanges || []).map((fc) => ({ path: fc.path, op: fc.op })),
+  });
+}

packages/pipelines/asset-pack/src/agents/implementation/deposit-asset-pack-synthesis-agent.ts

@@ -2,30 +2,56 @@
  * Deposit-mode AssetPack synthesis agent (V48 Gate 3).
  *
  * The deposit lens of the SynthesizeAssetPacks Implementation phase: synthesize
- * reviewable, MEASURED AssetPack candidate options from the DEPOSITOR's
- * repository source — bounded, source-safe slices of repository knowledge the
- * depositor reviews and uploads to the Depository as supply. Runs on the formal
- * PTRR machinery (factoryAgentWithPTRR → Plan/Try/Refine/Retry, each a Failsafe
- * × Thricified generation) so every call renders in the SDIVF telemetry.
+ * reviewable AssetPacks from the DEPOSITOR's repository. Per spec, each AssetPack
+ * is a completely synthesized artifact = a MEASURED PATCH (patch + measurements +
+ * metadata): the existing measured option fields PLUS a source-safe patch
+ * descriptor. The agent reasons over the Discovery comprehension stores (codebase
+ * comprehension, depository-fit search, inherent regurgitation) and obfuscation
+ * guidance — not raw source. Runs on the formal PTRR machinery
+ * (factoryAgentWithPTRR → Plan/Try/Refine/Retry, each a Failsafe × Thricified
+ * generation) so every call renders in the SDIVF telemetry. Each synthesized
+ * patch is then recorded through the formal AssetPackPatchWriteTool code-edit
+ * primitive (a tracked materialization, not an fs-write).
  *
- * Output is the candidate-options shape (options[] with per-pack measurements)
- * the /deposit review surface consumes; the surrounding pipeline (Setup clone,
- * Discovery exploration, Validation, Finish upload-for-review) wraps it.
+ * Output is the measured-patch AssetPacks (options[]); the same array is stored as
+ * both implementation:assetPacks and implementation:options. The /deposit review
+ * surface consumes the measured option fields and ignores the patch field; the
+ * surrounding pipeline (Setup clone, Discovery exploration, Validation, Finish
+ * upload-for-review) wraps it.
  *
- * Source-safety: candidates are source-safe metadata (knowledge + capability),
- * never raw source. Protected-IP exclusions are honored absolutely.
+ * Source-safety (hard constraint): NO raw patch code ever reaches telemetry or any
+ * store. AssetPacks carry source-safe metadata (knowledge + capability) and a
+ * source-safe patch DESCRIPTOR (file paths + change ops + a natural-language
+ * patchSummary) — never raw source, code, diffs, or contents. Depositor
+ * obfuscations and protected-IP exclusions are honored absolutely.
  */
 
 import { factoryAgentWithPTRR } from '@bitcode/agent-generics';
 import { Prompt } from '@bitcode/prompts/prompt';
 import type { PromptPart } from '@bitcode/prompts/parts/PromptPart';
 import { z } from 'zod';
 import { DEPOSIT_MEASUREMENT_CATALOG } from '../../asset-packs-synthesis';
+import { AssetPackPatchWriteTool } from './asset-pack-patch-write-tool';
 
 const part = (content: string): PromptPart => content as PromptPart;
 
 const DEPOSIT_OPTION_KINDS = ['capability-slice', 'implementation-pattern', 'proof-operations-slice'] as const;
 
+// The SOURCE-SAFE patch descriptor: which files the AssetPack creates/modifies as
+// code edits (path + change op), plus a source-safe natural-language summary of
+// the synthesized knowledge. NEVER raw code, file contents, or diffs.
+const patchSchema = z.object({
+  fileChanges: z
+    .array(
+      z.object({
+        path: z.string(),
+        op: z.enum(['create', 'modify', 'delete']),
+      }),
+    )
+    .min(1),
+  patchSummary: z.string(),
+});
+
 const candidateSchema = z.object({
   kind: z.string().min(1),
   title: z.string().min(8).max(160),
@@ -34,6 +60,9 @@ const candidateSchema = z.object({
   measurements: z.record(z.string(), z.coerce.number().min(0).max(1)),
   measurementRationale: z.string().min(20).max(700),
   confidence: z.coerce.number().min(0).max(1),
+  // Each AssetPack is a MEASURED PATCH: the measured option fields above PLUS the
+  // source-safe patch descriptor below (patch + measurements + metadata).
+  patch: patchSchema,
 });
 
 const candidateSetSchema = z.object({
@@ -46,40 +75,58 @@ const DEPOSIT_IDENTITY = part(
   'You are SynthesizeAssetPacks in DEPOSIT mode. A depositor supplies their ' +
     'repository knowledge as AssetPacks — bounded, source-safe slices the ' +
     'Depository holds as supply, where future readers find Need-fitting packs. ' +
-    'Synthesize 2-4 DISTINCT, measured AssetPack candidate options from the ' +
-    'explored repository the depositor can review and admit. Describe knowledge ' +
-    'and capability — never quote raw source, secrets, or file contents. Honor ' +
-    'protected-IP exclusions absolutely.',
+    'Each AssetPack is a completely synthesized artifact = a MEASURED PATCH ' +
+    '(patch + measurements + metadata). Synthesize 2-4 DISTINCT, measured ' +
+    'AssetPack patches from the explored repository the depositor can review and ' +
+    'admit, reasoning over the Discovery comprehension (codebase comprehension, ' +
+    'depository-fit search, inherent regurgitation) and obfuscation guidance you ' +
+    'are given. Describe knowledge and capability and the SHAPE of the patch — ' +
+    'never quote raw source, code, secrets, or file contents. Honor the depositor ' +
+    'obfuscations and protected-IP exclusions absolutely.',
 );
 
 const DEPOSIT_REQUIREMENTS = part(
   [
-    'Each candidate is a distinct, commercially-legible knowledge slice:',
+    'Ground every candidate in the provided Discovery comprehension — the codebase',
+    'comprehension, the depository-fit search, and the inherent regurgitation — and',
+    'honor the obfuscation guidance and protected-IP exclusions absolutely.',
+    'Each candidate is a distinct, commercially-legible knowledge slice — a MEASURED',
+    'PATCH (measured option fields + a source-safe patch descriptor):',
     `- kind: one of ${DEPOSIT_OPTION_KINDS.join(', ')}.`,
     '- title + source-safe summary (knowledge/capability, never raw text).',
     '- coveredSourcePaths: chosen ONLY from the provided inventory paths, exactly as written.',
     '- measurements: an object with EXACTLY these 0..1 keys, each an honest volume:',
     ...DEPOSIT_MEASUREMENT_CATALOG.map((spec) => `    ${spec.measurementKind}: ${spec.guidance}`),
     '- measurementRationale justifying every measurement; confidence 0..1.',
+    '- patch: the SOURCE-SAFE patch DESCRIPTOR for this AssetPack — the code edits it',
+    '  contributes, derived from your Discovery comprehension:',
+    '    - fileChanges: a non-empty list of { path, op } where op is create | modify | delete,',
+    '      naming which files the AssetPack creates/modifies/deletes (paths from the inventory,',
+    '      honoring obfuscations + exclusions). Provide ONLY path + op — NEVER code, diffs, or contents.',
+    '    - patchSummary: a source-safe natural-language summary of the synthesized knowledge the',
+    '      patch encodes (what it does and why it is legible to a buyer) — NEVER raw source or code.',
     'Return ONLY {"options":[ ... ]} — the top-level key MUST be "options".',
   ].join('\n'),
 );
 
 const DEPOSIT_PLAN = part(
-  'Plan: from the explored repository inventory + depositor steering, identify the ' +
-    'distinct, buyer-legible AssetPack slices the repository supports.',
+  'Plan: from the explored repository inventory, the Discovery comprehension, and ' +
+    'depositor steering, identify the distinct, buyer-legible AssetPack patches the ' +
+    'repository supports.',
 );
 const DEPOSIT_TRY = part(
-  'Try: synthesize each candidate option with kind, title, source-safe summary, ' +
-    'covered source paths, honest measurements, and a measurement rationale.',
+  'Try: synthesize each candidate as a measured patch — kind, title, source-safe ' +
+    'summary, covered source paths, honest measurements, a measurement rationale, ' +
+    'and the source-safe patch descriptor (fileChanges path+op + patchSummary).',
 );
 const DEPOSIT_REFINE = part(
-  'Refine: ensure each option is distinct, source-safe, exclusion-honoring, and ' +
-    'legible to a future buyer; verify measurements are honest 0..1 volumes.',
+  'Refine: ensure each option is distinct, source-safe, obfuscation- and ' +
+    'exclusion-honoring, and legible to a future buyer; verify the patch descriptor ' +
+    'names only inventory paths (no code/contents) and measurements are honest 0..1 volumes.',
 );
 const DEPOSIT_RETRY = part(
-  'Retry: complete any missing option as a minimal valid source-safe candidate ' +
-    'rather than failing the synthesis.',
+  'Retry: complete any missing option as a minimal valid source-safe measured patch ' +
+    '(at least one fileChange + a patchSummary) rather than failing the synthesis.',
 );
 
 function createDepositSynthesisPrompt(): Prompt {
@@ -131,6 +178,14 @@ export default async function runDepositAssetPackSynthesisAgent(input: any, exec
   const inventory = input?.inventory ?? findValue(execution, 'deposit', 'inventory');
   const demandContext = input?.demandContext ?? findValue(execution, 'deposit', 'demandContext') ?? [];
 
+  // Read the Discovery + obfuscation comprehension stores: each AssetPack is a
+  // measured PATCH synthesized FROM this comprehension (not from raw source).
+  const codebaseComprehension = findValue(execution, 'discovery', 'codebaseComprehension');
+  const depositorySearch = findValue(execution, 'discovery', 'depositorySearch');
+  const inherentRegurgitation = findValue(execution, 'discovery', 'inherentRegurgitation');
+  const obfuscationGuidance =
+    input?.obfuscationGuidance ?? findValue(execution, 'setup', 'inputComprehension');
+
   const result = await DepositAssetPackSynthesisAgent(
     {
       ...input,
@@ -141,24 +196,56 @@ export default async function runDepositAssetPackSynthesisAgent(input: any, exec
       inventory,
       inventoryPaths: inventory?.paths,
       excerpts: inventory?.samples,
+      obfuscationGuidance,
       discovery: {
         context: execution?.get?.('discovery', 'context'),
         plan: execution?.get?.('discovery', 'plan'),
+        codebase: codebaseComprehension,
+        depository: depositorySearch,
+        regurgitation: inherentRegurgitation,
       },
     },
     execution,
   );
 
   const options = Array.isArray((result as any)?.options) ? (result as any).options : [];
+
+  // Record each AssetPack's patch through the formal code-edit tool. The tool is a
+  // tracked materialization: it RECORDS the SOURCE-SAFE descriptor (path + op) and
+  // returns it — it does not fs-write (physical workspace materialization is the
+  // delivery context). Both the tool args and result are path/op-only, so the
+  // tool's telemetry stays source-safe.
+  try {
+    (execution as any)?.tools?.registerTool?.('asset-pack-patch-write', new AssetPackPatchWriteTool());
+  } catch {}
+  for (const option of options) {
+    const fileChanges = (option as any)?.patch?.fileChanges;
+    if (!Array.isArray(fileChanges)) continue;
+    try {
+      const tool = (execution as any)?.tools?.getTool?.('asset-pack-patch-write');
+      if (tool) {
+        const descriptor = await tool.execute({
+          fileChanges,
+          assetPackTitle: (option as any)?.title,
+        });
+        (option as any).patch.fileChanges = descriptor.fileChanges;
+      }
+    } catch {}
+  }
+
   const output = {
     success: true,
     semanticKind: 'asset-pack-written-asset' as const,
     options,
-    summary: `Synthesized ${options.length} measured deposit AssetPack option(s).`,
+    summary: `Synthesized ${options.length} measured deposit AssetPack patch(es).`,
     assetPack: { repository },
   };
 
   try {
+    // Full measured-patch AssetPacks (each option = measured fields + source-safe patch).
+    execution.store('implementation', 'assetPacks', options);
+    // Reviewable options — the SAME array; the route's validateDepositSynthesisOptions
+    // reads only the measured fields and ignores the extra patch field.
     execution.store('implementation', 'options', options);
     execution.store('implementation', 'assetPack', output.assetPack);
     execution.store('implementation', 'summary', output.summary);