feat(agent): close knowledge loop — refuse complete_task without writeback (D.1+D.2)

D.1 — complete_task structural gate:
- hadDiscovery(ctx, session) reports whether the session ran `run` successfully
  against a live target (NOT get_entity/list_lxcs — those are DB lookups, not
  new facts). A trivial Q&A that only calls get_entity is a degenerate case
  and must NOT be blocked.
- complete_task with outcome=success is REFUSED when hadDiscovery && !
  hadEntityWriteback. The refusal fires BEFORE completeTask runs, so the
  session stays in 'executing' state and the agent must call
  update_entity_attributes/create_relationship then retry complete_task.
  An explicit failure/partial is allowed through (the agent is acknowledging
  it didn't finish — no reason to force writeback).
- Replaces the prior advisory warning (5.5) which the agent consistently
  ignored. The agent saw the warning and ended the task anyway; this gate
  makes the writeback a hard prerequisite for success.

D.2 — propose_plan auto-append writeback step:
- When the agent proposes a plan whose steps don't mention
  update_entity_attributes or create_relationship, D.2 appends a final
  'Write back: update_entity_attributes + create_relationship +
  upsert_knowledge' step before persisting. The result string tells the
  agent it was appended.
- With the seq-order enforcement (5.6) and D.1's complete_task gate, the
  agent must complete the writeback step (and actually call the tools) to
  finish. Neither relies on the agent reading SOUL.md.
- Removed the old advisory writeback nudge from propose_plan's result
  string — D.2 makes it structural.
- Updated the propose_plan tool description to state both gates crisply.

Verification:
- TestHadDiscoveryAndWriteback: hadDiscovery true only after a successful
  `run`; false after failed run, get_entity, or no calls. hadEntityWriteback
  true only after update_entity_attributes/create_relationship.
- e2e against the live agent (oikos-nomos-1, v0.5.1):
  - D.2: agent proposed 3 steps (no writeback); D.2 auto-appended step 4
    'Write back: update_entity_attributes + ...'. Result string said
    '(appended a writeback step — your plan didn't include one; step 4)'.
  - D.1: agent ran `run` (uptime on lxc:gitea), called complete_task, was
    REFUSED ('Refused: this session ran run against live targets (discovery)
    but did not call update_entity_attributes...'). Agent self-corrected:
    called update_entity_attributes, retried complete_task, succeeded.
    Knowledge loop closed end-to-end.

Version 0.5.0 -> 0.5.1 (patch: structural enforcement of existing intent).

cmd/nomos/store_test.go

@@ -18,6 +18,7 @@ import (
 	"testing"
 
 	"github.com/dtoro/oikos/internal/db"
+	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 )
 
@@ -238,3 +239,75 @@ func TestProposePlan_RefuseInFlight(t *testing.T) {
 		t.Fatalf("revised step generation = %d, want 1 (fresh-start after DELETE resets generation)", revisedSteps[0].Generation)
 	}
 }
+
+// TestHadDiscoveryAndWriteback is the store-level proof for D.1 (refuse
+// complete_task when discovery ran without writeback). hadDiscovery must
+// report true only after a successful `run` call; hadEntityWriteback must
+// report true only after a successful update_entity_attributes or
+// create_relationship call. The D.1 gate in tasks.go combines these: refuse
+// success when hadDiscovery && !hadEntityWriteback.
+func TestHadDiscoveryAndWriteback(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+
+	sess, err := s.createSession(ctx, "discovery test")
+	if err != nil {
+		t.Fatalf("createSession: %v", err)
+	}
+
+	// Before any tool calls: no discovery, no writeback.
+	if s.hadDiscovery(ctx, sess.ID) {
+		t.Fatal("hadDiscovery = true before any tool calls, want false")
+	}
+	if s.hadEntityWriteback(ctx, sess.ID) {
+		t.Fatal("hadEntityWriteback = true before any tool calls, want false")
+	}
+
+	// A `run` call (discovery) — should set hadDiscovery, not hadEntityWriteback.
+	agentID := uuid.New()
+	s.logActivity(ctx, agentID, sess.ID, "run", nil, "", "uptime output", 100, true, "corr-1")
+	if !s.hadDiscovery(ctx, sess.ID) {
+		t.Fatal("hadDiscovery = false after a successful run call, want true")
+	}
+	if s.hadEntityWriteback(ctx, sess.ID) {
+		t.Fatal("hadEntityWriteback = true after only a run call, want false")
+	}
+
+	// A failed run call should NOT count as discovery (no facts learned).
+	sess2, err := s.createSession(ctx, "failed discovery test")
+	if err != nil {
+		t.Fatalf("createSession: %v", err)
+	}
+	s.logActivity(ctx, agentID, sess2.ID, "run", nil, "", "ssh timeout", 100, false, "corr-2")
+	if s.hadDiscovery(ctx, sess2.ID) {
+		t.Fatal("hadDiscovery = true after a failed run call, want false (no facts learned)")
+	}
+
+	// A get_entity call should NOT count as discovery (DB lookup, not live state).
+	sess3, err := s.createSession(ctx, "lookup test")
+	if err != nil {
+		t.Fatalf("createSession: %v", err)
+	}
+	s.logActivity(ctx, agentID, sess3.ID, "get_entity", nil, "", "entity row", 10, true, "corr-3")
+	if s.hadDiscovery(ctx, sess3.ID) {
+		t.Fatal("hadDiscovery = true after get_entity, want false (DB lookups are not discovery)")
+	}
+
+	// update_entity_attributes sets hadEntityWriteback.
+	sess4, err := s.createSession(ctx, "writeback test")
+	if err != nil {
+		t.Fatalf("createSession: %v", err)
+	}
+	s.logActivity(ctx, agentID, sess4.ID, "update_entity_attributes", nil, "", "ok", 10, true, "corr-4")
+	if !s.hadEntityWriteback(ctx, sess4.ID) {
+		t.Fatal("hadEntityWriteback = false after update_entity_attributes, want true")
+	}
+	// And the discovery+writeback combination (the conv3 scenario).
+	s.logActivity(ctx, agentID, sess4.ID, "run", nil, "", "apt-get update output", 100, true, "corr-5")
+	if !s.hadDiscovery(ctx, sess4.ID) {
+		t.Fatal("hadDiscovery = false after run+writeback, want true")
+	}
+	if !s.hadEntityWriteback(ctx, sess4.ID) {
+		t.Fatal("hadEntityWriteback = false after run+writeback, want true")
+	}
+}