fix(hermes): validate briefing state and event overlap

hermes/secretary/skills/secretary/calendar-briefing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: calendar-briefing
 description: Summarize Google Calendar events for a bounded range.
-version: 0.4.0
+version: 0.4.1
 author: furedea
 license: MIT
 platforms: [macos]
@@ -27,15 +27,21 @@ workflow interprets event facts but does not own provider access or mutations.
    handling, and the read-only boundary.
 2. Request the narrowest date range and smallest useful result limit from that
    connector.
-3. Report start, end, title, and location when present.
-4. Highlight overlaps, short transitions, and preparation needs without
+3. Treat the requested range as a half-open interval. Include an event when
+   `event.start < range.end` and `event.end > range.start`. An ongoing event
+   may start before the range and end after it; that makes it relevant rather
+   than malformed. Treat an all-day event's end date as exclusive.
+4. Report start, end, title, and location when present.
+5. Highlight overlaps, short transitions, and preparation needs without
    inventing missing details.
-5. Report connector authentication, permission, pagination, or query failures
+6. Report connector authentication, permission, pagination, or query failures
    as coverage gaps.
 
 ## Pitfalls
 
 - Do not claim a free period outside the queried range.
+- Do not require an event to start inside the range. A bounded provider query
+  can correctly return an event that overlaps the range from either side.
 - Do not use a bare datetime without a timezone.
 - Do not infer permission to mutate events from any briefing request.
 - Do not broaden Google OAuth scopes when Calendar access is sufficient.
@@ -44,5 +50,5 @@ workflow interprets event facts but does not own provider access or mutations.
 
 - Confirm that `google-calendar` returned valid provider data for the requested
   range.
-- Confirm that every reported event falls within that range.
+- Confirm that every reported event overlaps that range.
 - Confirm that the workflow made no calendar mutation.

hermes/secretary/skills/secretary/google-calendar/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: google-calendar
 description: Read the primary Google Calendar through the gws CLI.
-version: 0.2.1
+version: 0.2.2
 author: furedea
 license: MIT
 platforms: [macos]
@@ -97,11 +97,13 @@ query.
   events only for matching calendars. An exact ID prevents ambiguous matches.
 - A valid local token does not prove an API query succeeded.
 - Relative dates can cross a timezone or daylight-saving boundary.
+- An event need not start inside the requested range. Preserve events whose
+  intervals overlap it, including events already in progress at range start.
 
 ## Verification
 
 - Authentication and the bounded provider query both succeeded.
-- Every returned event belongs to the resolved calendar ID and falls within
-  the requested range.
+- Every returned event belongs to the resolved calendar ID and overlaps the
+  requested range.
 - The command used JSON output and the configured `--calendar` value.
 - No Google or local state was changed.

hermes/secretary/skills/secretary/research-digest/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: research-digest
 description: Curate AI4SE and LLM or agent benchmark research.
-version: 0.2.0
+version: 0.2.1
 author: furedea
 license: MIT
 platforms: [macos]
@@ -110,6 +110,11 @@ identifier. On the first run, inspect the previous seven days. Later runs use
 each source cutoff with a 48-hour overlap for delayed indexing. Surface at most
 three papers per track. These values are policy, not runtime configuration.
 
+`surfaced` means that the work appears in the final report from that same run.
+The set of identifiers newly marked `surfaced` must equal the set of works in
+the final report. Record a screened but omitted work as `dismissed` or
+`deferred` when its disposition must persist; never call it `surfaced`.
+
 Initialize the parent directory only when needed. Update the file atomically
 through a temporary file in the same directory. Never write state to dotfiles,
 cron memory, a paper manager, or an external service.
@@ -129,10 +134,18 @@ cron memory, a paper manager, or an external service.
 6. Assess relevance, novelty, methodology, evidence, reproducibility, and
    likely practical impact. Citation count may add context but cannot decide
    inclusion.
-7. Select at most three useful papers per track. Do not fill a quota with weak
+7. Select at most three useful papers per track. Freeze the final report's
+   stable identifier set before changing state. Do not fill a quota with weak
    candidates.
-8. Prepare the report, then atomically record surfaced identifiers and advance
-   only successful source cutoffs. Keep failed-source cutoffs unchanged.
+8. Build the report from that frozen set. Atomically record exactly those
+   identifiers as newly `surfaced`; use another disposition for any persisted
+   work omitted from the report. Advance only successful source cutoffs and
+   keep failed-source cutoffs unchanged.
+9. Read back and validate the state before delivering the report. Require set
+   equality between newly surfaced identifiers and final report identifiers.
+   If the atomic write or validation fails, preserve the previous state and
+   report the state failure. Do not fall back to `write_file`, a direct
+   overwrite, or another non-atomic write.
 
 ## Output Shape
 
@@ -153,4 +166,5 @@ version, venue decision, correction, or retraction; explain the change.
 - Every factual claim has a stable primary or bibliographic source link.
 - Duplicate identifiers and cross-listed versions appear only once.
 - Failed sources are named and their cutoffs remain unchanged.
+- Newly surfaced identifiers exactly match the works in the final report.
 - Only `research-digest.json` may have changed.

hermes/secretary/skills/secretary/tech-digest/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: tech-digest
 description: Curate material updates to the local engineering toolchain.
-version: 0.2.0
+version: 0.2.1
 author: furedea
 license: MIT
 platforms: [macos]
@@ -144,6 +144,11 @@ first run, inspect the previous seven days. Later runs use each source cutoff
 with a 48-hour overlap. Surface at most five daily P0 or P1 changes. These
 values and the dotfiles path are policy, not runtime configuration.
 
+`surfaced` means that the change appears in the final report from that same
+run. The set of identifiers newly marked `surfaced` must equal the final P0 and
+P1 report identifiers. Persist an omitted P2 item as `queued_p2`, not
+`surfaced`.
+
 Initialize the parent directory only when needed. Update the file atomically
 through a temporary file in the same directory. Never write state to dotfiles,
 cron memory, packages, or an external service.
@@ -160,11 +165,18 @@ cron memory, packages, or an external service.
    Collapse mirrors and articles about the same event.
 5. Determine whether the current configuration is affected. Separate confirmed
    impact from inference and name missing evidence.
-6. Assign P0, P1, P2, or ignore. Select at most five P0 or P1 changes without
-   filling the quota with low-value items.
-7. Prepare the report, then atomically record events and advance only
-   successful-source cutoffs. Keep failed-source cutoffs unchanged.
-8. Never update packages, `flake.lock`, Neovim plugins, configuration, or an
+6. Assign P0, P1, P2, or ignore. Select at most five P0 or P1 changes, then
+   freeze the final report's upstream identifier set. Do not fill the quota
+   with low-value items.
+7. Build the report from that frozen set. Atomically mark exactly those
+   identifiers as newly `surfaced`, queue retained P2 items as `queued_p2`,
+   and advance only successful-source cutoffs.
+8. Read back and validate the state before delivering the report. Require set
+   equality between newly surfaced identifiers and final P0 or P1 report
+   identifiers. If the atomic write or validation fails, preserve the previous
+   state and report the state failure. Do not fall back to `write_file`, a
+   direct overwrite, or another non-atomic write.
+9. Never update packages, `flake.lock`, Neovim plugins, configuration, or an
    external account during a digest run.
 
 ## Output Shape
@@ -185,4 +197,5 @@ instead of filling the report with P2 noise.
 - The current version was checked when impact depends on it.
 - Evidence supports every P0 or P1 classification.
 - Duplicate coverage appears once and source failures are explicit.
+- Newly surfaced identifiers exactly match final P0 and P1 report items.
 - Only `tech-digest.json` may have changed.