feat(voyage): add machine-verifiable completion gate to trekexecute

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

commands/trekexecute.md

@@ -1228,6 +1228,30 @@ Record in progress file:
 - `manifest_audit.status = "pass" | "drift"`
 - `manifest_audit.drift_details = [{check, expected, actual}, ...]`
 
+### Machine-verifiable completion gate (stop-signal contract)
+
+> **Sealed inline so the termination rule survives even when the executor
+> model is the very thing it constrains.**
+>
+> This is the `machine-verifiable completion gate` (the `stop-signal
+> contract`): the executor may emit `result: completed` ONLY when BOTH hold —
+>
+> 1. **Objective predicate** — the **Phase 7.5** manifest audit (above) PASSED,
+>    re-verified directly from the filesystem + git log, ignoring the executor's
+>    own per-step bookkeeping. "The audit wins"; a self-reported `completed` over
+>    a drifting audit is OVERRIDDEN to `partial` (Phase 7.5, `:1221`).
+> 2. **Explicit stop-signal** — a signal *distinct from the executor's
+>    self-assessment* is satisfied: the plan's Verify command(s) **passed (exit
+>    0)** / lint clean / an explicit **DONE token emitted AFTER the Phase 7.5
+>    audit ran** (never before, never in place of it). A transcript that merely
+>    "feels done" is NOT a stop-signal — victory-declaration bias is the exact
+>    failure mode this gate exists to defeat.
+>
+> Termination authority therefore rests on the deterministic audit + an
+> objective stop-signal, never on the model's narrative. Native `/goal` (when
+> capability-probed and wired) is an OPTIONAL accelerator only: transcript-only,
+> it cannot run the real check, so it can never be the sole gate.
+
 ## Phase 7.6 — Recovery dispatch (multi-session parent context only)
 
 **Preconditions:**
@@ -1657,12 +1681,16 @@ code-path.
     v1.6 plans: synthesized manifests apply with the same force, but
     `legacy_plan: true` is logged in progress.
 
-18. **Last-activity rule.** The executor's final tool call before writing
-    Phase 8 must be a manifest check (Phase 7.5 audit), never an arbitrary
+18. **Last-activity rule + stop-signal.** The executor's final tool call before
+    writing Phase 8 must be a manifest check (Phase 7.5 audit), never an arbitrary
     file review. This prevents the "hallucinated completion" failure mode
     where a transcript ends on an unrelated Read and the agent self-reports
     `completed` without verifying. If Phase 7.5 has not run, the executor
-    may not emit `result: completed` under any circumstances.
+    may not emit `result: completed` under any circumstances. Beyond that:
+    `result: completed` requires the **machine-verifiable completion gate**
+    (the **stop-signal contract**, Phase 7.5) satisfied in full — Phase 7.5
+    audit PASS **and** an objective stop-signal (Verify exit 0 / DONE token
+    emitted AFTER the audit), never executor self-assessment alone.
 
 19. **push-before-cleanup.** After successful `git merge --no-ff` of a wave
     branch, run `git push origin <branch>` BEFORE `git worktree remove` and

tests/commands/trekexecute.test.mjs

@@ -73,3 +73,23 @@ test('trekexecute — SC7: brief_version 2.1 + no phase_signals + no partial →
     `sequencing gate must fire; errors=${JSON.stringify(r.errors)}`,
   );
 });
+
+// --- S38 loop-discipline hardening: completion gate (Step 2) ---
+
+test('trekexecute — machine-verifiable completion gate + stop-signal contract literals present (SC a)', () => {
+  const text = read();
+  assert.ok(text.includes('machine-verifiable completion gate'),
+    'completion-gate literal must be grep-able');
+  assert.ok(text.includes('stop-signal contract'),
+    'stop-signal contract literal must be grep-able');
+});
+
+test('trekexecute — completion gate anchors result:completed to Phase 7.5 audit + DONE-after-check (SC a)', () => {
+  const text = read();
+  const gateIdx = text.indexOf('machine-verifiable completion gate');
+  assert.ok(gateIdx >= 0, 'gate literal missing');
+  const section = text.slice(gateIdx, gateIdx + 1400);
+  assert.match(section, /Phase 7\.5/, 'gate must name Phase 7.5 as the objective predicate');
+  assert.match(section, /DONE/, 'gate must reference the DONE stop-signal token');
+  assert.match(section, /emitted AFTER/, 'gate must require DONE emitted AFTER the audit ran');
+});