Kenya legal grounding contract: 8-rule retrieval gate replaces open-ended knowledge fallback

The system-prompt change (7244c0be) is explicit about intent. Before: one line saying to answer from legal knowledge when no documents exist. After: 8 rules stating the model must call search_kenya_law or search_legal_authority_web before any legal authority claim, may only cite what retrieval returns, must surface corpus-vs-web conflicts, must explicitly admit when both tools return nothing, and must never invent or paraphrase a citation. The "violating this is worse than admitting you don't know" framing is pointed - it's there because hallucinated legal citations are the product's single worst failure mode. The contract was written before the tools existed, so the model would refuse rather than hallucinate during the gap.

The tool implementation (07e1243e) adds two tools. search_kenya_law uses ChromaDB with @xenova/transformers v2 (Xenova/all-MiniLM-L6-v2, 384-dim, mean-pool, normalized), a lazy-cached embedder and collection, and returns 400-char snippets with a distance > 0.6 weak-result note. The east_africa jurisdiction filter applies via a ChromaDB where clause; the narrower kenya filter is intentionally skipped to avoid silently dropping chunks that predate the metadata field. search_legal_authority_web is Tavily search restricted to 12 trusted Kenyan/East African legal domains; it never throws. New deps: chromadb ^3.4.3, @xenova/transformers ^2.17.2, CHROMA_DB_PATH and TAVILY_API_KEY in .env.example.

83f72e57 upgrades NormalizedResult from three fields to eleven. The honesty contract requires the model to distinguish binding from persuasive authority and prefer newer law - the original { text, source?, jurisdiction? } shape couldn't support that. The new shape adds title, url, source_archive, type, court, year, binding_in_kenya, citation, and snippet. Year falls back to regex extraction from date if the year field is absent. The trusted-domain allowlist expands from 12 domains to roughly 25, organized into tiers: primary authority, major regulators with published decisions, and specialist oversight bodies.

One caveat: the Node-local ChromaDB + ONNX stack introduced here gets replaced by a Python sidecar in a later commit cluster. Pulling these commits means taking a dependency that Davemaina1 themselves abandoned. The honesty contract and the domain allowlist are the portable pieces; the retrieval implementation is not.