feat(linkedin-studio): SB-S1 wire voice-trainer to published-only + gate-enforce it [skip-docs]

voice-trainer's Gather step now reads ingest/published/ (provenance=published) as
the primary gold source, keeps voice-samples as a human tributary (not reshaped),
forbids learning from provenance=ai-draft, and fences the auto-append trap. New gate
Section 16c (Brain Published-Only Invariant) enforces the wiring with exact-literal
greps (grep -F 'ingest/published' + 'provenance=ai-draft') + a non-vacuity self-test
(rejects an 'AI-generated'-only probe), against voice-trainer.md + the new contract
doc docs/second-brain/ingest-manual-import.md. BRAIN_TESTS_FLOOR 34→63; assertion
floor 75→78 (+3 unconditional checks; not pinned to deps-present TOTAL to preserve the
warn-skip margin). Gate 90→93/0/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RigJBiRFNtFZKCz21qNbQ4

scripts/test-runner.sh

@@ -711,7 +711,7 @@ if [ -x "$BR_DIR/node_modules/.bin/tsx" ]; then
   BR_OUT=$( set +e; (cd "$BR_DIR" && npm test) 2>&1; echo "BR_EXIT:$?" )
   BR_EXIT=$(echo "$BR_OUT" | grep -oE 'BR_EXIT:[0-9]+' | grep -oE '[0-9]+' | head -1)
   BR_TESTS=$(echo "$BR_OUT" | grep -oE 'tests [0-9]+' | grep -oE '[0-9]+' | tail -1)
-  BRAIN_TESTS_FLOOR=34  # SB-S0: id(11) + profile(6) + fold(12) + scaffold(5)
+  BRAIN_TESTS_FLOOR=63  # SB-S0 34 [id(11)+profile(6)+fold(12)+scaffold(5)] + SB-S1 29 [ingest(14)+publish(9)+cli(6)]
   if [ "$BR_EXIT" = "0" ] && [ -n "$BR_TESTS" ] && [ "$BR_TESTS" -ge "$BRAIN_TESTS_FLOOR" ]; then
     pass "brain suite green: $BR_TESTS tests pass (floor $BRAIN_TESTS_FLOOR)"
   else
@@ -723,6 +723,62 @@ fi
 
 echo ""
 
+# --- Section 16c: Brain Published-Only Invariant (SB-S1) ---
+echo "--- Brain Published-Only Invariant ---"
+
+# SB-S1 wires voice-trainer to learn from the published gold signal ONLY: the agent
+# must (a) name ingest/published/ as a source AND (b) carry the explicit exclusion of
+# provenance=ai-draft (the model-collapse guard — never train voice on the engine's own
+# drafts). Both literals are required. voice-trainer.md ALREADY contains "AI-generated"
+# (a drift-cause description, line ~175), so a loose ai.?draft pattern would pass
+# vacuously — we grep the EXACT literals with grep -F. The contract doc must also state
+# the rule. Non-vacuity self-test mirrors Sections 8/13/17: a probe counts as "wired"
+# iff it carries BOTH literals; probes missing either (incl. one with "AI-generated" but
+# not "ai-draft") must NOT count as wired. The wiring is gate-enforced; the agent's
+# runtime OBEDIENCE is not provable here (stated honestly in the contract doc).
+PUB_LIT='ingest/published'
+DRAFT_LIT='provenance=ai-draft'
+
+pub_wired() {  # $1 = text; wired iff BOTH literals present (echo twice — grep consumes stdin)
+  echo "$1" | grep -qF "$PUB_LIT" && echo "$1" | grep -qF "$DRAFT_LIT"
+}
+
+PUB_SELFTEST_OK=1
+if ! pub_wired "reads from ingest/published/ and excludes provenance=ai-draft"; then
+  PUB_SELFTEST_OK=0; echo "  non-vacuity FAIL: a fully-wired probe was not detected"
+fi
+while IFS= read -r probe; do
+  [ -z "$probe" ] && continue
+  if pub_wired "$probe"; then
+    PUB_SELFTEST_OK=0; echo "  false-positive FAIL: under-wired probe accepted -> $probe"
+  fi
+done <<'NEGATIVE16C'
+reads from ingest/published/ but never states the draft exclusion
+excludes provenance=ai-draft but never names the published source
+flags AI-generated drift but carries neither required literal
+NEGATIVE16C
+if [ "$PUB_SELFTEST_OK" -eq 1 ]; then
+  pass "published-only self-test: full wiring detected; 3 under-wired forms rejected (incl. 'AI-generated'-only)"
+else
+  fail "published-only self-test failed — the invariant lint is vacuous or over-eager"
+fi
+
+VT="agents/voice-trainer.md"
+if grep -qF "$PUB_LIT" "$VT" && grep -qF "$DRAFT_LIT" "$VT"; then
+  pass "voice-trainer.md wired to published-only (names '$PUB_LIT', excludes '$DRAFT_LIT')"
+else
+  fail "voice-trainer.md missing published-only wiring — needs both '$PUB_LIT' and '$DRAFT_LIT'"
+fi
+
+PUB_DOC="docs/second-brain/ingest-manual-import.md"
+if grep -qF "$DRAFT_LIT" "$PUB_DOC"; then
+  pass "ingest-manual-import.md documents the published-only rule ('$DRAFT_LIT')"
+else
+  fail "ingest-manual-import.md missing the published-only rule literal '$DRAFT_LIT'"
+fi
+
+echo ""
+
 # --- Section 17: De-Niche Guard (B-S1 + B-S2) ---
 echo "--- De-Niche Guard ---"
 
@@ -794,8 +850,13 @@ echo ""
 # The lint self-modifies its own checks, so a green run could mask a silently dropped
 # assertion. Pin the total pass()+fail() invocations as a monotonic floor; the count
 # may only grow (brief-reviewer assumption 3). History: 74 pre-M0; +1 for the SB-S0
-# brain-suite floor (Section 16b) = 75. Runs last so TOTAL_CHECKS sees every prior check.
-ASSERT_BASELINE_FLOOR=75
+# brain-suite floor (Section 16b) = 75; +3 for SB-S1's three UNCONDITIONAL Section-16c
+# checks (published-only self-test + voice-trainer grep + contract-doc grep) = 78.
+# NB: the floor tracks the deps-absent MINIMUM (conditional TS suites warn-skip and drop
+# the count), so it is bumped only by UNCONDITIONAL new checks — NOT pinned to the
+# deps-present TOTAL_CHECKS (that would zero the warn-skip margin and false-fail a fresh
+# clone). Runs last so TOTAL_CHECKS sees every prior check.
+ASSERT_BASELINE_FLOOR=78
 TOTAL_CHECKS=$((PASS + FAIL))
 if [ "$TOTAL_CHECKS" -ge "$ASSERT_BASELINE_FLOOR" ]; then
   pass "assertion-count anti-erosion: $TOTAL_CHECKS checks >= baseline floor $ASSERT_BASELINE_FLOOR"