Enforce orchestration evidence and add evaluation benchmarks

.gitignore

@@ -5,3 +5,4 @@ task_plan.md
 node_modules/
 findings.md
 node-compile-cache
+.DS_Store

AGENTS.md

@@ -29,7 +29,7 @@ There is no markdown frontmatter rewrite step.
 - `src/runtime/loop-catalog.ts`: Legion Loop prompt section formatting
 - `src/runtime/domain-usage-contract.ts`: Task Context Envelope parsing, warn-only domain validation, and JSONL trace evidence
 - `docs/academic-papers-summary.md`: paper references and claim boundaries behind domain routing and runtime evidence
-- `docs/adr/0001-plugin-first-domain-aware-orchestration.md`: accepted architecture direction for plugin-first, domain-aware orchestration
+- `docs/adr/*.md`: accepted architecture decisions and their rationale
 - `docs/ROADMAP.md`: current product plan for the OpenCode multi-agent, Legion Loop, Domain Pack, trace/doctor, and benchmark roadmap
 - `docs/LEGION_LOOPS.md`: user-facing Legion Loop guide
 - `docs/DOMAIN_PACK_AUTHORING.md`: user-facing Domain Pack authoring guide

README.md

@@ -223,7 +223,9 @@ Your Legion uses direct specialist routing along two orthogonal axes: **agents a
 - `bunx @whchi/your-legion doctor [--worktree <path>] [--config-dir <path>] [--scenarios]`: troubleshoots domain and loop setup. By default it validates `DOMAIN.md` declarations, loop catalogs, runtime trace evidence, and usage stats; `--scenarios` verifies the fixed domain scenario set.
 - `bunx @whchi/your-legion trace [--worktree <path>] [--config-dir <path>] [--limit <n>] [--summary]`: prints recent domain usage evidence for a workspace/project path; `--summary` groups declared refs, matching reads, and warnings by delegation.
 - `bunx @whchi/your-legion trace-check [--worktree <path>] [--config-dir <path>] [--require-evidence]`: low-level trace validation for contract warnings, declared domain refs or skills that were not read, and maker/checker ledger integrity (unverified file changes without a following verifier pass fail). `--require-evidence` additionally fails when no delegation or loop-run-report evidence exists at all.
-- `bunx @whchi/your-legion benchmark-summarize --metrics <path>`: summarizes an exported benchmark metrics file (JSON array or JSONL of session metrics) into the quality-plus-token outcome taxonomy. See [`ORCHESTRATOR_BENCHMARK.md`](./docs/ORCHESTRATOR_BENCHMARK.md).
+- `bunx @whchi/your-legion routing-contract-eval --fixtures <path> [--config <path>]`: evaluates labeled orchestrator envelopes offline against the domain contract and expected agent/loop/domain fields.
+- `bunx @whchi/your-legion checker-recall-eval --fixtures <path>`: scores isolated verifier decisions over planted-defect and clean maker-output fixtures.
+- `bunx @whchi/your-legion benchmark-summarize --metrics <path>`: summarizes an exported benchmark metrics file with cost/time economics first, k≥5 repetition statistics, and token detail second. See [`ORCHESTRATOR_BENCHMARK.md`](./docs/ORCHESTRATOR_BENCHMARK.md).
 - `bunx @whchi/your-legion domain-scenarios`: prints the fixed domain scenario prompts.
 - `bunx @whchi/your-legion domain-scenario-check [--worktree <path>] [--config-dir <path>]`: low-level fixed scenario validation; `doctor --scenarios` is the preferred entrypoint.
 

docs/CONFIGURATION.md

@@ -152,9 +152,13 @@ Post-execution verification controls whether the orchestrator routes an independ
 ```yaml
 verification:
   default_check: true
+  enforcement: warn
+  allowed_commands: []
 ```
 
 - `default_check` (boolean, default `true`): when `true`, the orchestrator routes a `verifier` pass before reporting completion for any `builder` deliverable that reports `Files changed: yes` with `Status: unverified`. Set it to `false` to keep verification opt-in (the previous behavior): the orchestrator then verifies only for loops or when the user explicitly asks.
+- `enforcement` (`warn` or `block`, default `warn`): controls malformed Task Context Envelope handling at delegation time. `block` rejects the task call and returns the malformed field plus the expected shape so the router can repair it; evidence-completeness diagnostics remain warn-only.
+- `allowed_commands` (string array, default `[]`): additional command prefixes the verifier may execute. Loop `verification.commands` are added automatically. Commands remain deny-by-default unless declared by the operator.
 
 `builder` always returns a Verification status ledger (files changed; verifier pass ran or not-run; `verified` / `unverified` / `verification-skipped` with a reason), so the maker/checker split stays visible even when `default_check` is off. See [ADR 0003](./adr/0003-enforced-verification-and-maker-checker-integrity.md).
 

docs/DEVELOPMENT.md

@@ -1,6 +1,6 @@
 # Development
 
-This document covers repository development for `your-legion`. User-facing installation and configuration instructions live in [`README.md`](../README.md). Architecture direction lives in [`ADR 0001`](./adr/0001-plugin-first-domain-aware-orchestration.md) and [`ADR 0002`](./adr/0002-legion-loop-contract.md), the current product plan lives in [`ROADMAP.md`](./ROADMAP.md), and user-facing domain/loop guidance lives in [`DOMAIN_PACK_AUTHORING.md`](./DOMAIN_PACK_AUTHORING.md) and [`LEGION_LOOPS.md`](./LEGION_LOOPS.md).
+This document covers repository development for `your-legion`. User-facing installation and configuration instructions live in [`README.md`](../README.md). Architecture direction lives in the [ADR set](./adr/), the current product plan lives in [`ROADMAP.md`](./ROADMAP.md), and user-facing domain/loop guidance lives in [`DOMAIN_PACK_AUTHORING.md`](./DOMAIN_PACK_AUTHORING.md) and [`LEGION_LOOPS.md`](./LEGION_LOOPS.md).
 
 ## Plugin-First Runtime