batch: repair, safety, teaching agents and evidence (#1375 #1360 #1359 #1354 #1335 #1357 #1298 #1291 #1346)

[abrichr]

Batch merge of nine reviewed PRs, so CI runs once instead of nine times. Merging this marks each one merged, because their commits land on main.

Included:

• verify-run: a changed non-target record is collateral, not only a vanished one (#1373) #1375: verify-run catches an edit to a non-target record (collateral change)
• feat(flow): repair every stop that wrote nothing by default, and measure it #1360: repair every stop that wrote nothing, by default
• flow: threat model and prompt-injection controls for teach and repair #1359: threat model and prompt-injection controls for teaching agents
• feat(flow): encrypt every PHI file at rest under one sealed index #1354: encrypt every file that can hold patient data at rest
• feat(agent): teach a workflow over MCP, then call it with no model calls #1335, then feat(flow): guard an agent you already run (CDP commit guard, run 2 as a taught tool) #1357: teach a workflow over MCP, and guard an agent you already run
• flow: keep the server's answer to a save, labelled same_screen #1298: keep the server's answer to a save as evidence
• feat: narration proposes branch rules; recordings, a probe or a person certify them #1291: narration proposes branch rules
• undo propose: verified undo steps for each save, approved once by a person #1346: propose and verify undo steps

Conflicts resolved while batching:

• .gitleaksignore and CAPABILITIES.md rows: both sides kept, no duplicate rows.
• Generated files (inventory, verification report, command list, llms-full): regenerated.

Public copy now lists only shipped work: "In review" and "In progress" rows read "On main", and the status words in README, llms.txt and the agent README are gone. #1338 makes the same edits to main's copy.

Locally:

• the capability map and release consistency checks pass;
• llms-full is current;
• gitleaks finds nothing in the new commits;
• the name guard is clean.

If CI fails here, the failing PR is taken out of the batch and the rest merge.

🤖 Generated with Claude Code