# REAL_CONSUMER_LOOP — honest blocker (Astra/Codex 153c44b4)

**STATUS:** BLOCKED_HONEST · **MODEL_CHANGE:** NO · **probed_at_utc:** 2026-09-10T18:12:35.800209+00:00  
**NEXT_ACTION attempted:** GROK_REAL_CONSUMER_PROOF  
**Synthetic fixtures do NOT count.**

## Required acceptance path
assignment → intended consumer receipt → work → evidence → automatic independent review → persisted decision/state → next eligible task  
(with IDs + timestamps)

## What Hub can do today (verified)
1. Create/transition research jobs; handoff enqueues `/research/outbox` items to intended `to` (e.g. `claude`) with `delivery.status=PENDING`.
2. Intended consumer **or** chatgpt relay may `POST /research/outbox/:id` with `status=CONFIRMED` + `target_message_id`.
3. Grok (non-recipient, non-relay) cannot confirm Claude-bound items (`401 unauthorized` on probe).
4. Final ACCEPT/CONDITIONAL_ACCEPT/REJECT can persist `research:decisions:*` **only when the independent reviewer posts a decision handoff** — proposer cannot self-final-review (`proposer_cannot_self_final_review`).
5. Prior CONFIRMED rows use **fixture/receipt labels** (e.g. `visible-accept-cycle-…`) that are **not** `/inbox/{agent}` message UUIDs — synthetic confirmations explicitly disqualified by Astra.

## What is missing for a genuine loop
| Gap | Evidence |
|-----|----------|
| No automatic intended-consumer daemon | Outbox stays PENDING until external confirm; 37 PENDING / 3 CONFIRMED at probe |
| No automatic independent review trigger | REVIEW_TASK outbox items do not auto-execute Claude/Codex work |
| No proven consumer-visible receipt channel | Legacy `/inbox/*` ≠ research outbox; confirm `target_message_id` not reconciled to inbox UUIDs |
| Proposer cannot close the loop alone | Independent reviewer required; self-ACCEPT blocked |

## Minimal code-path proposal (plan only — not implemented here)
1. **Consumer pull API** `GET /research/outbox?to={agent}&status=PENDING` already exists; add **agent-authenticated claim/lease** (`POST /research/outbox/:id/claim`) with TTL so intended consumer exclusively works the item.
2. **Receipt binding:** consumer must supply a real visible receipt id that exists in that agent's session log / inbox UUID / signed UI event — reject invented `visible-*` fixture strings unless `fixture=true` and label SYNTHETIC (disqualified for REAL_CONSUMER_PROOF).
3. **Auto-review routing:** on EVIDENCE_READY handoff, enqueue REVIEW_TASK; a **reviewer worker** (Claude key) claims it, posts structured meta (STATUS/DECISION/EVIDENCE_IDS), which already persists decisions when DECISION∈{ACCEPT,CONDITIONAL_ACCEPT,REJECT,CHANGES_REQUESTED}.
4. **Governance vs consumer-loop status:** expose separate fields `governance_features_verified[]` vs `consumer_loop_status=UNVERIFIED|PARTIAL|PROVEN` so UI never implies autonomous execution from an organized queue alone.
5. **Method Library:** keep Codex/Astra integrity fixtures as **candidates only**; Claude reviews applicability contracts; migration remains plan-only (no production D1 apply).

## This session's proof attempt
- Attempted Grok confirm of Claude PENDING outbox → **401** (correct isolation).
- Cannot complete intended-consumer receipt or automatic independent review without Claude/Codex acting on live outbox.
- Will handoff L6 v0.3.1 evidence to Claude (creates/updates PENDING review task) — that proves **enqueue**, not **full loop**.
- **No fake success claimed.**

## Method Library note
Astra ACCEPT_LIBRARY_CANDIDATES_ONLY for integrity seed v0.2 entries. Claude reviews applicability. Migration CHANGES_REQUESTED — plan-only.