Preserve Klaud baseline preflight and report failure reasons / 保留 Klaud 基线预检并报告失败原因

.github/klaud-candidate-prompt.md

@@ -58,9 +58,12 @@ Freeze the COMPLETE original public baseline point roster before attempts, using
 candidate.source.date, verified old-image producer IDs/SHAs and full recipe/workload/topology/
 concurrency/dataset identities. Use the reporting guide's prepare-baseline/report commands;
 candidate.json provides the planner-verified exact `baseline-model`; use that value unchanged.
-The planner's preflight proves that a full roster can be reconstructed but does not freeze or
-publish it. Prepare the candidate's own baseline after resolving the exact old/new image goal;
-the helper recovers original points from producer revisions. Supplement verified public
+The planner supplies `baseline-preflight.json` beside candidate.json. It contains the verified
+benchmark roster bound to the selected candidate, base SHA, source observation and model.
+After resolving the exact old/new image goal, prepare-baseline checks this binding and uses
+that roster without refetching it. If candidate.json requires the preflight and it is absent
+or invalid, stop with `baseline-preflight-mismatch`; only legacy candidates may reconstruct.
+The preflight is not a published or final baseline. Supplement verified public
 eval/dataset evidence before freezing; never replace a failed lookup with a partial roster.
 Never reduce the baseline to overlapping points, displayed rows or a smaller current family. Never dispatch the old
 image. Unproven deltas are N/A with a reason; N/A never excuses missing updated-image results.
@@ -123,6 +126,16 @@ On terminal resolve/baseline evidence, stop investigating. Finalize attempts, wr
 CandidateOutcome to $KLAUD_EVIDENCE/requested-outcome.json and run `finish --outcome-file
 "$KLAUD_EVIDENCE/requested-outcome.json"`. Only finish may mark ready after verifying complete
 artifacts and publishing the final report BEFORE reviews begin.
+For `failed` in phase `baseline`, include one fixed `reason-code` in CandidateOutcome:
+`baseline-preflight-mismatch` (candidate/base/source/model binding differs),
+`baseline-provenance-unverified` (old-image point producer or SHA cannot be proven),
+`baseline-point-mismatch` (roster identity, topology or coverage is ambiguous),
+`baseline-eval-unverified` (required published eval or dataset evidence cannot be proven),
+`baseline-api-unavailable` (public evidence read failed), or `baseline-other` (none of these
+can be established). Select the first actual blocker, not a guessed cause. A failure before
+baseline work belongs in `resolve`, and a failed updated-image run belongs in `targeted` or
+`final-sweep`. Do not put free text, raw responses, private telemetry or transcripts in the
+code. The fixed code appears in sanitized diagnostics and the completion report.
 After finish returns a verified `validated` outcome, check for an existing exact `/use
 <verified-final-run-id>` comment, then post it once on this PR. Never post `/use` for any
 other outcome or any run except the verified final sweep.

.github/workflows/klaud-plan.yml

@@ -163,6 +163,7 @@ jobs:
             ${{ runner.temp }}/klaud/selection.json
             ${{ runner.temp }}/klaud/review-diagnostics.json
             ${{ runner.temp }}/klaud/*/candidate.json
+            ${{ runner.temp }}/klaud/*/baseline-preflight.json
           retention-days: 14
 
   candidates:

KLAUD_DEBUG.md

@@ -402,3 +402,21 @@ are skipped, and registry `/` and enroot `#` image spellings are normalized for
 historical identity matching and point backfill. A transient or malformed baseline for
 one candidate defers that candidate and continues through the reviewed pool; it does
 not consume or block later candidate slots.
+
+### 7.8 Selected candidates can still stop in the baseline phase
+
+**Symptom:** a parent workflow and candidate wrapper jobs succeed, but sanitized
+candidate outcomes say `failed` / `baseline`, with no validation runs. A draft PR
+may have been created and then closed. The wrapper status only means the agent
+reported and cleaned up; it does not mean the image update worked.
+
+**Diagnosis:** planner preflight already reconstructed the public benchmark roster.
+The selected candidate now receives that typed roster in `baseline-preflight.json`.
+`prepare-baseline` verifies its candidate/base/source/model binding and reuses it,
+then the agent still verifies additional eval/dataset evidence before publication.
+Read the fixed `reason-code` in `candidate-diagnostics.json`, the job summary or
+the completion receipt to identify the first verified blocker. An absent code on
+an older run means the exact cause was not recorded; do not infer one from the phase.
+Never publish raw API responses, agent transcripts or private telemetry to fill
+that gap. A preflight mismatch must stop rather than silently refetching another
+roster or shrinking coverage.

docs/klaud-reporting.md

@@ -29,7 +29,7 @@ KLAUD=(uv run --no-project --exclude-newer PT12H --python 3.12 \
 "${KLAUD[@]}" report --kind attempt --file "$KLAUD_EVIDENCE/attempt.json"
 ```
 
-`prepare-baseline` queries public `benchmarks` with the selected date, `exact=true`, and no calculator view; `workflow-info` establishes producer IDs, heads and attempts. It reconstructs the selected family from each producer's YAML with trusted local generator code, including the historical `.github/configs` layout and flat runner-label format. Only that family is validated, so retired sibling schemas cannot break reconstruction. Matching requires the old image and full public workload/topology/concurrency identity; supplied recipe fingerprints must also match. Legacy rows without fingerprints require a unique match and a producer changelog selecting the family. Rows outside the reconstructed family are ignored even when their producer metadata is incomplete. Missing provenance on a matching current or historical point, ambiguous identities and duplicate points stop preparation instead of publishing an incomplete baseline. Before the first publication, supplement verified published evals and dataset provenance using [the public API routes](./klaud.md#public-api-investigation). `BenchmarkRow` has no dataset identity; unproven AgentX datasets still produce N/A deltas. Never run the old image to fill a gap.
+`prepare-baseline` verifies the candidate/base/source/model binding in the planner-produced `baseline-preflight.json` and reuses its public benchmark roster. A selected candidate marked `baseline-preflight-required` stops if this file is missing or invalid. A legacy candidate without this file queries public `benchmarks` with the selected date, `exact=true`, and no calculator view; `workflow-info` establishes producer IDs, heads and attempts. It reconstructs the selected family from each producer's YAML with trusted local generator code, including the historical `.github/configs` layout and flat runner-label format. Only that family is validated, so retired sibling schemas cannot break reconstruction. Matching requires the old image and full public workload/topology/concurrency identity; supplied recipe fingerprints must also match. Legacy rows without fingerprints require a unique match and a producer changelog selecting the family. Rows outside the reconstructed family are ignored even when their producer metadata is incomplete. Missing provenance on a matching current or historical point, ambiguous identities and duplicate points stop preparation instead of publishing an incomplete baseline. Before the first publication, supplement verified published evals and dataset provenance using [the public API routes](./klaud.md#public-api-investigation). `BenchmarkRow` has no dataset identity; unproven AgentX datasets still produce N/A deltas. Never run the old image to fill a gap.
 
 The baseline file is created once; retries do not refetch it. The PR body freezes the complete typed record in a compressed hidden marker and renders the complete baseline once. Conflicting replacement records are rejected. Existing PRs with the older baseline-comment format remain readable for recovery. A correction requires a maintainer to review the evidence and make the correction explicit; do not silently revise the baseline during repairs.
 

docs/klaud-reporting_zh.md

@@ -29,7 +29,7 @@ KLAUD=(uv run --no-project --exclude-newer PT12H --python 3.12 \
 "${KLAUD[@]}" report --kind attempt --file "$KLAUD_EVIDENCE/attempt.json"
 ```
 
-`prepare-baseline` 使用候选日期、`exact=true` 查询公开 `benchmarks`，不使用 calculator view；通过 `workflow-info` 核实产出运行 ID、head 和运行次数。它用受信任的本地生成器，从各产出提交的 YAML 重建所选配置族，支持历史 `.github/configs` 路径和平铺 runner 标签格式。只校验所选配置族，避免已退役兄弟配置的旧 schema 阻断重建。匹配要求旧镜像及完整公开工作负载、拓扑、并发身份一致；存在 recipe fingerprint 时也必须匹配。没有指纹的旧数据必须唯一匹配，且产出运行的 changelog 必须选择该配置族。不属于重建配置族的数据行会被忽略，即使其产出运行元数据不完整。匹配当前或历史测试点的数据行若来源缺失，或存在身份歧义、重复点，会阻止准备，不发布不完整基线。首次发布前，按[公开 API 路由](./klaud_zh.md#公开-api-调查)补充已验证的历史评测和数据集来源。`BenchmarkRow` 本身不含数据集身份；AgentX 数据集无法核实时，差值仍为 N/A。绝不通过运行旧镜像补齐基线。
+`prepare-baseline` 核对规划阶段 `baseline-preflight.json` 中候选、基准 SHA、来源和模型的绑定，并复用其公开 benchmark 测试点清单。标记 `baseline-preflight-required` 的所选候选在文件缺失或无效时停止。没有该文件的旧候选使用候选日期、`exact=true` 查询公开 `benchmarks`，不使用 calculator view；通过 `workflow-info` 核实产出运行 ID、head 和运行次数。它用受信任的本地生成器，从各产出提交的 YAML 重建所选配置族，支持历史 `.github/configs` 路径和平铺 runner 标签格式。只校验所选配置族，避免已退役兄弟配置的旧 schema 阻断重建。匹配要求旧镜像及完整公开工作负载、拓扑、并发身份一致；存在 recipe fingerprint 时也必须匹配。没有指纹的旧数据必须唯一匹配，且产出运行的 changelog 必须选择该配置族。不属于重建配置族的数据行会被忽略，即使其产出运行元数据不完整。匹配当前或历史测试点的数据行若来源缺失，或存在身份歧义、重复点，会阻止准备，不发布不完整基线。首次发布前，按[公开 API 路由](./klaud_zh.md#公开-api-调查)补充已验证的历史评测和数据集来源。`BenchmarkRow` 本身不含数据集身份；AgentX 数据集无法核实时，差值仍为 N/A。绝不通过运行旧镜像补齐基线。
 
 基线文件仅创建一次，重试不重新获取。PR 正文通过压缩的隐藏标记冻结完整类型化记录，并只渲染一次完整基线；冲突替换会被拒绝。旧 PR 使用的基线评论格式仍可供恢复流程读取。确需修正时，由维护者检查证据并明确记录更正，不能在修复期间静默改变基线。