feat(foreman): flag unverifiable facts instead of inventing them (slicer anti-confabulation)

[Defilan]

What

Teach the slicer's coder and planner to flag facts they cannot verify instead of inventing them, and recognize the resulting NEEDS-VERIFICATION outcome as a terminal non-failure that is never escalated.

Why

Fixes #1061. On the first live slicer run on #700, the coder invented AMD GPU metric names for a Grafana dashboard and reached for a community exporter that does not enumerate the target gfx1151 iGPU (confirmed by a contributor on the actual box). The output was plausible, complete-looking, and wrong on facts only hardware can settle. GO means "compiles and looks plausible," not "verified against reality," and there was no honesty layer between GO and a capability-failure NO-GO. Two distinct failures: a grounding gap (the fact lives outside the repo) and confabulation under that gap (the model invented rather than flagged).

How

• Coder contract (config/foreman/system-prompts/coder.md, re-synced into both coder Agent CRs):
  • A "ground every external fact" rule in Step 2: never present a guess about another component's metric names, an API shape, or an image's hardware behavior as fact.
  • A NEEDS-VERIFICATION outcome in Step 3: NO-GO + extra.outcome="NEEDS-VERIFICATION" + extra.unverified listing each ungroundable fact and how to settle it, instead of guessing.
• Planner (pkg/cli/slice_planner.go): a premise-classification step (settled-in-repo / repo-verifiable / externally-empirical), treating issue hedging as an unverified signal; UNSLICEABLE when the whole issue hinges on an empirical premise, verify-first or NEEDS-VERIFICATION for the affected slices otherwise.
• Controller (internal/foreman/controller/workload_coder_escalation.go): NEEDS-VERIFICATION recognized as a terminal non-failure NO-GO and explicitly excluded from escalation, because a larger model cannot reach the ground truth (hardware, a live system's output) either. Mirrors the ALREADY-RESOLVED handling ([FEATURE] Foreman: distinct ALREADY-RESOLVED coder outcome (don't escalate the honest 'already done' bail) #970).

Testing

• go build ./..., go vet, golangci-lint on the changed packages: clean.
• go test ./pkg/cli/... ./internal/foreman/controller/... ./pkg/foreman/slicer/...: pass, including new TestShouldEscalateCoder case and TestIsNeedsVerificationCoder.
• Empirical regression to follow: re-run [FEATURE] AMD GPU observability: rocm-smi exporter + llama.cpp /metrics + Grafana panel #700 through the slicer with these prompts deployed and confirm the coder returns NEEDS-VERIFICATION (naming the unverifiable metric names / the iGPU-enumeration premise) instead of inventing.

Deferred follow-up

Rollup surfacing: a dedicated classifyChildren bucket, a CoderNeedsVerification Workload condition, and cascade-skip so a needs-verification slice does not cascade-fail integrate/reconcile. Best designed after observing a real NEEDS-VERIFICATION run (the #700 re-validation), so the terminal-state semantics match reality rather than a guess.

Checklist

• Tests added/updated
• go build ./... passes
• Lint passes
• Commits are DCO signed-off
• Coder prompt change re-synced into the Agent CR inline copies

Assisted-by: Claude (Anthropic) — analysis, prompt/contract design, controller guard, and tests; reviewed by the maintainer.

[codecov]

Codecov Report

❌ Patch coverage is 71.42857% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...al/foreman/controller/workload_coder_escalation.go	71.42%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!