fix(events,tools,toolintent): failure attribution, one path normalization rule, file_copy (#713)

Three generic harness fixes from the web-ui postmortem dataset. Nothing here keys
on a language, framework, build tool or task type.

1. Failure attribution. WorkflowFailedEvent carries one primary FailureAttribution
   (AGENT | HARNESS | WORKFLOW | ENVIRONMENT | PROVIDER | OPERATOR | UNKNOWN),
   defaulted to UNKNOWN so pre-field events replay unchanged. FailureAttributor is
   the deterministic reason->layer mapping, used both at emission and when
   classifying history, so the baseline and the live metric are one measurement.
   Emission sites set it: failWorkflow derives from the reason unless the caller
   knows the layer, cancellation is OPERATOR, the server catch-all falls back to
   HARNESS, a grounding-rejected plan is AGENT. Multi-cause chains stay on
   FailureTicketOpened — no second causal structure.

   GET /metrics/failure-attribution (FailureAttributionInspectionService, mirroring
   ToolReliabilityInspectionService) reports counts, share, UNKNOWN share, the
   preserved reasons and the ticket categories from the same sessions. Read-only:
   historical events are classified at READ time and reported as `inferred`, never
   written back over an append-only log.

   Baseline over the local log, 122 terminal failures: AGENT 51 (41.8%),
   OPERATOR 28 (23.0%), WORKFLOW 19 (15.6%), PROVIDER 15 (12.3%), HARNESS 6 (4.9%),
   ENVIRONMENT 3 (2.5%), UNKNOWN 0.

2. The `~` guard bug. ToolPath is now the ONE canonical normalization rule
   (expand a leading `~`/`~/`, keep absolutes, anchor relatives on the session
   working dir). Every filesystem tool, all six plane-2 path rules and the approval
   preview resolve through it, so policy and existence checks inspect the path the
   tool will operate on. `~/.gradle/init.d/offline.gradle` used to resolve to
   `<workspace>/~/.gradle/...`: reported non-existent AND in-workspace, so the
   reference gate called a real file a hallucination and the out-of-workspace prompt
   never fired. Containment and external-read approval behaviour are unchanged —
   the expanded path is simply outside the workspace, where it always belonged.

3. file_copy (#713). A first-class tool with the writer's jail, tier, receipt,
   replay and CAS pre/post images; static and binary assets no longer move through
   the model's token stream. Needed one generic split: ParamRole.SOURCE_PATH marks a
   path a call reads FROM, so containment gates judge both params while write-target
   gates (read-before-write, stale-write, write scope, write manifest) judge the
   mutated one. ReadBeforeWriteRule exempts any call declaring a SOURCE_PATH: its
   content comes from disk, not from memory, and requiring a read of a binary is
   unsatisfiable. Existing tools declare no SOURCE_PATH, so their behaviour is
   byte-identical.

Tests: ToolPathTest (9), FailureAttributionTest (10), PathNormalizationRuleTest (6),
FileCopyToolTest (10), plus a home-relative FileReadTool read. ./gradlew check green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/kernel/src/main/kotlin/com/correx/core/kernel/orchestration/SessionOrchestratorPreview.kt

@@ -1,4 +1,5 @@
 package com.correx.core.kernel.orchestration
+import com.correx.core.tools.contract.ToolPath
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.json.Json
@@ -46,8 +47,7 @@ internal suspend fun readFileIfExists(path: String, workspaceRoot: java.nio.file
             // Resolve relative paths against the session's workspace root, same as the tools do —
             // resolving against the daemon CWD showed the operator the wrong file (or nothing) when
             // server CWD ≠ workspace_root.
-            val raw = java.nio.file.Paths.get(path)
-            val filePath = if (raw.isAbsolute || workspaceRoot == null) raw else workspaceRoot.resolve(raw)
+            val filePath = ToolPath.resolve(path, workspaceRoot)
             if (java.nio.file.Files.exists(filePath)) {
                 java.nio.file.Files.readString(filePath)
             } else null

core/kernel/src/main/kotlin/com/correx/core/kernel/orchestration/SessionOrchestratorWorkflow.kt

@@ -5,6 +5,8 @@ import com.correx.core.events.events.CritiqueFindingsRecordedEvent
 import com.correx.core.events.events.CritiqueOutcomeCorrelatedEvent
 import com.correx.core.events.events.EventMetadata
 import com.correx.core.events.events.EventPayload
+import com.correx.core.events.events.FailureAttribution
+import com.correx.core.events.events.FailureAttributor
 import com.correx.core.events.events.NewEvent
 import com.correx.core.events.events.TransitionExecutedEvent
 import com.correx.core.events.events.WorkflowCompletedEvent
@@ -108,6 +110,9 @@ internal suspend fun SessionOrchestrator.failWorkflow(
     stageId: StageId,
     reason: String,
     retryExhausted: Boolean,
+    // Null ⇒ derive the attribution from [reason] (FailureAttributor). A caller that knows the layer
+    // from its own position passes it explicitly instead of relying on the reason text.
+    attribution: FailureAttribution? = null,
 ): WorkflowResult.Failed {
     log.warn(
         "[Orchestrator] FAILED session={} stage={} reason={} retryExhausted={}",
@@ -134,7 +139,16 @@ internal suspend fun SessionOrchestrator.failWorkflow(
     // (e.g. a serialization edge), we cannot record the failure at all — log it loudly with the
     // full throwable so it is never silent, then still return a clean Failed result.
     runCatching {
-        emit(sessionId, WorkflowFailedEvent(sessionId, stageId, reason, retryExhausted))
+        emit(
+            sessionId,
+            WorkflowFailedEvent(
+                sessionId,
+                stageId,
+                reason,
+                retryExhausted,
+                attribution ?: FailureAttributor.classify(reason),
+            ),
+        )
     }.onFailure { e ->
         log.error(
             "[Orchestrator] failWorkflow: FAILED to record terminal WorkflowFailedEvent — event " +

core/kernel/src/main/kotlin/com/correx/core/kernel/orchestration/SessionOrchestratorWorkspace.kt

@@ -1,5 +1,6 @@
 package com.correx.core.kernel.orchestration
 
+import com.correx.core.events.events.FailureAttribution
 import com.correx.core.events.events.ToolCallAssessedEvent
 import com.correx.core.events.events.RepoMapComputedEvent
 import com.correx.core.events.events.OutsidePathAccessGrantedEvent
@@ -212,7 +213,16 @@ internal suspend fun SessionOrchestrator.handleCancellation(
     stageId: StageId,
 ): WorkflowResult.Cancelled {
     log.warn("[Orchestrator] CANCELLED session={} stage={}", sessionId.value, stageId.value)
-    emit(sessionId, WorkflowFailedEvent(sessionId, stageId, "CANCELLED", retryExhausted = false))
+    emit(
+        sessionId,
+        WorkflowFailedEvent(
+            sessionId,
+            stageId,
+            "CANCELLED",
+            retryExhausted = false,
+            attribution = FailureAttribution.OPERATOR,
+        ),
+    )
     cancellations.remove(sessionId)
     return WorkflowResult.Cancelled(sessionId)
 }