feat(agent): add online verification and governing-answer citations

Claim-bound online verification observations with URL provenance, exact
answer-basis references for citation-free governing-rule answers, and an
explicit operator identity handoff before source transfer. Bounds resumed
work by learning unit and refreshes pack manifest/contracts.

AGENTS.md

@@ -18,14 +18,17 @@ Choose a focused skill; load only its applicable protocol and pipeline files:
 ## Shared protocols
 
 - Evidence and support: [EVIDENCE.md](protocols/EVIDENCE.md).
+- Online claim checks: [ONLINE_VERIFICATION.md](protocols/ONLINE_VERIFICATION.md); use only when enabled for the task or project.
 - Project and data boundaries: [SCOPE.md](protocols/SCOPE.md).
 - Tools, proposals and resume: [CONTRIBUTIONS.md](protocols/CONTRIBUTIONS.md).
 
 ## Availability and reporting
 
+Before any source transfer or proposal work, require the operator-supplied authenticated principal ID, explicit project/scope, and a source/turn budget. The principal ID is a non-secret identifier used for proposal and assessment attribution; diagnostics does not return it. If it is missing, stop with a concise request for that identifier. Never discover identity or credentials by reading environment variables, credential files, host MCP configuration, service databases, or files outside the selected research workspace.
+
 For a connected workflow, use MCP discovery and `diagnostics` to confirm the available tools, their advertised input schemas, role, capabilities and scope. Those discovered schemas are authoritative for this session. Routine ingestion does not require reading `manifest.json`, `service-v1.json`, record schemas, README sections or helper-script source to rediscover tools. If a required tool is absent or an advertised schema produces a concrete mismatch, stop before mutation; inspect only the relevant pinned contract entry to diagnose that mismatch, then report it if unresolved. Use the host's native file listing and viewing tools for workspace inventory and pack instructions; do not invoke shell commands just to list files. This pack is bound to the local GEWU v1 contract, but native host workflows are NOT RUN. Do not invent commands or assume another host's custom tools exist. If required tools are unavailable, identify the blocked stage; prepare local drafts only when requested and label them unaccepted.
 
-For Antigravity, call MCP tools using the schemas attached to discovered tools and the host-specific argument reminders in [CONTRIBUTIONS.md](protocols/CONTRIBUTIONS.md). Follow this order once per run: `diagnostics`, `get_project_context`, then `run_create`; do not repeat a successful stage or inspect local run files. A staged source candidate is not readable through `get_source`; use its exact candidate in the proposal's `register_source` operation and cite its owned extraction with `source_extraction_block`. Do not use `run_command` or other shell tools for routine ingestion, pack-pin inspection, or schema lookup. Do not read generated per-tool JSON files from `~/.gemini/antigravity-cli/mcp`; after a concrete argument error, inspect only the relevant pinned entry in the pack's `contracts/service-v1.json`, then correct the call once. GEWU's proposal parser tolerates exactly one omitted final outer `}` when the repaired text is valid and contract-conforming; evaluation or submit responses report this as `input_repaired=true`. Other malformed payloads stay invalid. GEWU's Jev assessment runs inside `ingest_review_create`; do not call a separate Jev MCP server. Do not inspect installer state or helper-script implementation during routine ingestion.
+For Antigravity, call MCP tools using the schemas attached to discovered tools and the host-specific argument reminders in [CONTRIBUTIONS.md](protocols/CONTRIBUTIONS.md). Follow this order once per run: `diagnostics`, `get_project_context`, then `run_create`; do not repeat a successful stage or inspect local run files. A staged source candidate is not readable through `get_source`; use its exact candidate in the proposal's `register_source` operation and cite its owned extraction with `source_extraction_block`. Do not use `run_command` or other shell tools for routine ingestion, pack-pin inspection, or schema lookup. Do not read generated per-tool JSON files from `~/.gemini/antigravity-cli/mcp`; after a concrete argument error, inspect only the relevant pinned entry in the pack's `contracts/service-v1.json`, then correct the call once. GEWU's proposal parser tolerates exactly one omitted final outer `}` when the repaired text is valid and contract-conforming; evaluation or submit responses report this as `input_repaired=true`. Other malformed payloads stay invalid. GEWU's Jev assessment runs inside `ingest_review_create`; do not call a separate Jev MCP server. Read only the compact run_pins object from .agents/gewu-install.json when creating a new run; do not inspect other installer state or helper-script implementation during routine ingestion.
 
 Knowledge changes go through typed MCP proposals. Local artifacts under `Drafts/` and `Runs/` support work but are not accepted knowledge. Only a service acceptance receipt establishes acceptance. Keep credentials and source bodies out of status summaries; do not claim a cloud-backed host keeps all content local.