@blamejs/exceptd-skills 0.12.21 → 0.12.23

package/bin/exceptd.js

@@ -85,10 +85,21 @@ function assertExpectedFingerprint(pubKeyPem) {
   } catch (e) {
     return `EXPECTED_FINGERPRINT check: failed to derive live fingerprint: ${e.message}`;
   }
-  const raw = fs.readFileSync(pinPath, "utf8");
-  const firstLine = raw.split(/\r?\n/).map((l) => l.trim()).find((l) => l.length > 0) || "";
+  // Route through the shared lib/verify loader so a BOM-prefixed pin file
+  // (Notepad with files.encoding=utf8bom) is tolerated identically across
+  // every verify site. The helper strips leading U+FEFF + ignores comment
+  // lines.
+  const { loadExpectedFingerprintFirstLine } = require(path.join(PKG_ROOT, "lib", "verify.js"));
+  const firstLine = loadExpectedFingerprintFirstLine(pinPath) || "";
   if (firstLine === liveFp) return null;
-  if (process.env.KEYS_ROTATED === "1") return null;
+  if (process.env.KEYS_ROTATED === "1") {
+    process.emitWarning(
+      `EXPECTED_FINGERPRINT mismatch accepted via KEYS_ROTATED=1: live=${liveFp} pin=${firstLine}. ` +
+      `Update keys/EXPECTED_FINGERPRINT to lock the new pin.`,
+      { code: 'EXCEPTD_KEYS_ROTATED_OVERRIDE' }
+    );
+    return null;
+  }
   return (
     `EXPECTED_FINGERPRINT mismatch: live=${liveFp} pin=${firstLine}. ` +
     `If this is an intentional rotation, re-run with KEYS_ROTATED=1 and ` +
@@ -264,9 +275,11 @@ v0.12.0 canonical surface
                              --registry-check       (v0.11.14) opt-in: query npm registry
                                                     for latest published version + days behind
 
-  ci                         One-shot CI gate. Exit codes: 0 PASS, 2 detected/escalate,
-                             3 ran-but-no-evidence, 4 blocked (ok:false),
-                             5 jurisdiction clock started, 1 framework error.
+  ci                         One-shot CI gate. Exit codes: 0 PASS, 1 framework error,
+                             2 detected/escalate, 3 ran-but-no-evidence,
+                             4 blocked (ok:false), 5 jurisdiction clock started,
+                             6 TAMPERED (sidecar verification failed),
+                             8 LOCK_CONTENTION (concurrent playbook lock held).
                              --all | --scope <type> | (auto-detect)
                              --max-rwep <n>         cap below playbook default
                              --block-on-jurisdiction-clock
@@ -491,11 +504,9 @@ function main() {
   if (typeof resolver !== "function") {
     // Emit a structured JSON error matching the seven-phase verbs so operators
     // piping through `jq` get one consistent shape across the CLI surface.
-    // R-F8: pre-fix, the structured-JSON stderr write was followed by
-    // process.exit(2) — the v0.11.10 truncation class applied to stderr
-    // just as it does to stdout. Route through emitError() (which uses
-    // exitCode + return per v0.12.14) so the JSON drains, then promote
-    // the exit code to 2 (unknown-command remains a distinct exit class).
+    // emitError() sets exitCode + returns rather than calling process.exit()
+    // so the stderr JSON drains before teardown; promote the exit code to 2
+    // afterwards (unknown-command remains a distinct exit class).
     emitError(`unknown command "${cmd}"`, { hint: "Run `exceptd help` for the list of verbs.", verb: cmd });
     process.exitCode = 2;
     return;
@@ -503,7 +514,7 @@ function main() {
 
   const script = resolver();
   if (!fs.existsSync(script)) {
-    // R-F8: same class — emitError + exitCode rather than stderr + exit().
+    // emitError + exitCode rather than stderr + exit() so the JSON drains.
     emitError(
       `command "${cmd}" not available — expected ${path.relative(PKG_ROOT, script)} in the installed package.`,
       { verb: cmd }
@@ -517,7 +528,7 @@ function main() {
   const finalArgs = ORCHESTRATOR_PASSTHROUGH.has(effectiveCmd) ? [script, effectiveCmd, ...effectiveRest] : [script, ...effectiveRest];
   const res = spawnSync(process.execPath, finalArgs, { stdio: "inherit", cwd: PKG_ROOT });
   if (res.error) {
-    // R-F8: same class — emitError + exitCode.
+    // emitError + exitCode rather than stderr + exit() so the JSON drains.
     emitError(`failed to run ${cmd}: ${res.error.message}`, { verb: cmd });
     process.exitCode = 2;
     return;
@@ -620,7 +631,7 @@ function emitError(msg, extra, pretty) {
 }
 
 /**
- * EE P1-2: shared BOM-tolerant JSON file reader. Windows tools commonly emit
+ * Shared BOM-tolerant JSON file reader. Windows tools commonly emit
  * UTF-8-BOM (EF BB BF) or UTF-16 LE/BE (FF FE / FE FF). The default
  * `fs.readFileSync(path, "utf8")` chokes on the leading 0xFEFF (UTF-8-BOM
  * becomes a literal BOM codepoint that `JSON.parse` refuses) and decodes
@@ -644,7 +655,21 @@ function readJsonFile(filePath) {
     text = buf.slice(2).toString("utf16le");
   } else if (buf.length >= 2 && buf[0] === 0xFE && buf[1] === 0xFF) {
     // UTF-16 BE: Node has no native decoder. Swap byte pairs to LE, then decode.
-    const swapped = Buffer.allocUnsafe(buf.length - 2);
+    //
+    // refuse odd-length payloads up front rather than carry
+    // the trailing byte through a partial swap. A UTF-16BE payload by
+    // definition has an even byte count after the BOM; odd-length input is
+    // either truncated or not UTF-16BE at all.
+    //
+    // use Buffer.alloc (zero-initialised) instead of
+    // Buffer.allocUnsafe so an unexpected loop bound never lets uninitialised
+    // heap bytes leak into the decoded string and downstream JSON.parse
+    // error message.
+    const payloadLength = buf.length - 2;
+    if (payloadLength % 2 !== 0) {
+      throw new Error(`failed to read ${filePath}: UTF-16BE payload must have an even byte count after BOM; got ${payloadLength} bytes — file may be truncated.`);
+    }
+    const swapped = Buffer.alloc(payloadLength);
     for (let i = 2; i < buf.length - 1; i += 2) {
       swapped[i - 2] = buf[i + 1];
       swapped[i - 1] = buf[i];
@@ -681,7 +706,7 @@ function readEvidence(evidenceFlag) {
   if (stat.size > MAX_EVIDENCE_BYTES) {
     throw new Error(`evidence file too large: ${stat.size} bytes > ${MAX_EVIDENCE_BYTES} byte limit. Reduce the submission or split into multiple playbook runs.`);
   }
-  // EE P1-2: route through readJsonFile() for UTF-8-BOM / UTF-16 tolerance.
+  // Route through readJsonFile() for UTF-8-BOM / UTF-16 tolerance.
   // Windows-tool-emitted JSON commonly carries these markers; the raw "utf8"
   // decode in readFileSync chokes on the leading 0xFEFF.
   return readJsonFile(evidenceFlag);
@@ -692,7 +717,7 @@ function loadRunner() {
 }
 
 /**
- * EE P1-7: detect whether stdin actually has data without blocking.
+ * Detect whether stdin actually has data without blocking.
  *
  * `!process.stdin.isTTY` (the previous heuristic) fires when isTTY is
  * `false`, `undefined`, OR `null`. Test harnesses with custom stdin
@@ -704,15 +729,17 @@ function loadRunner() {
  * Strategy:
  *
  *   1. If isTTY is truthy → operator is at a terminal, never read stdin.
- *   2. Probe `fs.fstatSync(0)`:
- *      - On POSIX pipes / regular files, `stat.size` is reliable.
- *      - On Windows, fstat on a pipe returns size === 0 even when data
- *        is queued — so size === 0 alone cannot decide.
- *   3. When size > 0 → real data is queued; safe to read.
- *   4. When size === 0 AND isTTY is falsy:
- *      - On POSIX, treat as empty (wrapped duplexer / closed stdin).
- *      - On Windows, fall back to the legacy truthy check so we don't
- *        regress the MSYS-bash auto-detect (R-F3 in v0.12.16).
+ *   2. POSIX: trust isFIFO / isSocket / isCharacterDevice. Regular file
+ *      requires size > 0 (empty file redirection should not be treated
+ *      as piped input).
+ *   3. Windows: `isTTY === false` strict (filters out wrapped test
+ *      duplexers which leave isTTY === undefined). DO NOT gate on size
+ *      because Windows pipes report as regular files with size 0 even
+ *      when bytes are queued — gating would silently skip every
+ *      `echo {...} | exceptd run` invocation.
+ *   4. If a wrapped test harness on Windows does want stdin auto-read
+ *      to skip, the harness must set `process.stdin.isTTY = undefined`
+ *      explicitly (Mocha/Jest do this by default).
  *
  * Returns `true` if the caller may safely fs.readFileSync(0) without
  * risking an indefinite block on a wrapped empty stream.
@@ -721,7 +748,16 @@ function hasReadableStdin() {
   if (process.stdin.isTTY) return false;
   let st;
   try { st = fs.fstatSync(0); }
-  catch { return !process.stdin.isTTY; /* fstat failed — fall back */ }
+  catch {
+    // fstat failed — on Windows require `isTTY === false` STRICTLY (not
+    // falsy). A non-strict check returns true when isTTY is undefined (e.g.
+    // Mocha/Jest test harnesses with a wrapped duplexer on Windows), which
+    // causes fs.readFileSync(0) to block indefinitely waiting on an EOF
+    // that never arrives. MSYS-bash piping on win32 sets isTTY === false,
+    // so the strict check still admits genuine piped input.
+    if (process.platform === "win32") return process.stdin.isTTY === false;
+    return false;
+  }
   // POSIX pipes / FIFOs / sockets / character devices report size 0
   // even when bytes are queued (or about to be). Trust them — a real
   // `echo '{...}' | exceptd run` pipeline lands here, and readFileSync(0)
@@ -737,19 +773,22 @@ function hasReadableStdin() {
   if (typeof st.size === "number" && st.size > 0) return true;
   // Windows fallback: pipes don't surface as FIFOs via fstat on win32
   // (they appear as regular files with size 0 even when bytes queued).
-  // Preserve the legacy truthy check so MSYS-bash piping keeps working.
-  if (process.platform === "win32") return !process.stdin.isTTY;
+  // Trust isTTY === false strictly — that filters out wrapped test
+  // duplexers (which leave isTTY === undefined) while keeping cmd.exe /
+  // PowerShell / MSYS pipes working (isTTY === false when piped). Do NOT
+  // gate on size > 0 here: a Windows pipe with bytes queued reports as
+  // a regular file with size 0, and gating would silently skip every
+  // `echo {...} | exceptd run|ingest|ai-run` invocation.
+  if (process.platform === "win32" && process.stdin.isTTY === false) return true;
   return false;
 }
 
 /**
- * R-F10: ISO-8601 shape regex applied BEFORE Date.parse. Pre-fix, both
- * `attest list --since` and `reattest --since` accepted anything Date.parse
- * could chew on — including bare integers like "99", which JavaScript
- * happily resolves to 1999-12-01T00:00:00Z (Y2K-era millisecond / two-digit
- * year heuristic). Operators got a "valid timestamp" check that silently
- * filtered the wrong years. Now: require an explicit calendar-date shape
- * (YYYY-MM-DD with optional time component) BEFORE handing to Date.parse.
+ * ISO-8601 shape regex applied BEFORE Date.parse for --since flags. Without
+ * the regex check, bare integers like "99" coerce through Date.parse to
+ * 1999-12-01T00:00:00Z (two-digit-year heuristic), silently filtering the
+ * wrong years. Requires an explicit calendar-date shape (YYYY-MM-DD with
+ * optional time component) before handing to Date.parse.
  *
  * Returns null on success; returns the human-facing error message string
  * on failure so the caller can wrap it with its own verb prefix.
@@ -763,7 +802,7 @@ function validateIsoSince(raw) {
 }
 
 /**
- * F5: detect whether a parsed JSON document is plausibly CycloneDX VEX or
+ * Detect whether a parsed JSON document is plausibly CycloneDX VEX or
  * OpenVEX. The runner's vexFilterFromDoc returns Set(0) tolerantly for
  * anything else, which means an operator who passes SARIF / SBOM / CSAF /
  * advisory JSON by mistake gets zero filter + zero feedback. We pre-validate
@@ -785,12 +824,12 @@ function detectVexShape(doc) {
     const isBom = doc.bomFormat === "CycloneDX";
     const specStr = typeof doc.specVersion === "string" ? doc.specVersion : "";
     const hasCyclonedxMarker = isBom || specStr.startsWith("1.");
-    // R-F4: empty vulnerabilities arrays cannot vouch for CycloneDX shape
-    // on their own — `{"bomFormat":"NOT-CycloneDX","vulnerabilities":[]}`
-    // previously passed because `length === 0` always satisfied
+    // Empty vulnerabilities arrays cannot vouch for CycloneDX shape on their
+    // own — `{"bomFormat":"NOT-CycloneDX","vulnerabilities":[]}` would
+    // otherwise pass because `length === 0` trivially satisfies
     // `entriesLookVex`. Require a real CycloneDX marker (bomFormat or
-    // specVersion) when the array is empty; non-empty arrays still pass
-    // when any entry has vex-shaped fields (id / bom-ref / analysis).
+    // specVersion) when the array is empty; non-empty arrays still pass when
+    // any entry has vex-shaped fields (id / bom-ref / analysis).
     if (doc.vulnerabilities.length === 0) {
       if (hasCyclonedxMarker) {
         return { ok: true, detected: "cyclonedx-vex", top_level_keys: keys };
@@ -815,8 +854,8 @@ function detectVexShape(doc) {
   if (doc.document && doc.document.category && String(doc.document.category).startsWith("csaf_")) {
     return { ok: false, detected: "csaf-advisory-not-vex", top_level_keys: keys };
   }
-  // EE P1-1: a CycloneDX SBOM with no `vulnerabilities` key is a legitimate
-  // "0-CVE VEX filter" submission — the operator is asserting nothing here is
+  // A CycloneDX SBOM with no `vulnerabilities` key is a legitimate "0-CVE
+  // VEX filter" submission — the operator is asserting nothing here is
   // exploitable. Accept it as cyclonedx-vex with an empty filter set (the
   // runner's vexFilterFromDoc returns Set(0) for the same shape). Same logic
   // for documents that carry a CycloneDX-flavored specVersion ("1.x") without
@@ -893,6 +932,17 @@ function dispatchPlaybook(cmd, argv) {
         pretty
       );
     }
+    // The character-class regex accepts any all-dots string (`.`, `..`,
+    // `...`); each resolves into or above the attestation root. Refuse
+    // them explicitly so the attestation is never written outside the
+    // intended directory.
+    if (/^\.+$/.test(sid)) {
+      return emitError(
+        "run: --session-id cannot consist entirely of dots (rejected: '.', '..', etc.).",
+        { provided: sid },
+        pretty
+      );
+    }
     runOpts.session_id = sid;
   }
   if (args["attestation-root"]) {
@@ -938,12 +988,12 @@ function dispatchPlaybook(cmd, argv) {
   // service identity. --operator <name> persists into the attestation file
   // for audit-trail accountability.
   //
-  // F9: validate the input. Pre-fix the value flowed into runOpts unchanged,
-  // so an operator could inject newlines / control chars / arbitrary length
-  // into attestation export output (multi-line "operator:" key/value pairs
-  // are a forgery surface — a forged second line could look like a separate
-  // attestation field to a naive parser). Now: strip ASCII control chars
-  // (\x00-\x1F + \x7F), cap length at 256, reject if all-whitespace.
+  // Validate the input. Without this, a value flows into runOpts unchanged
+  // and an operator could inject newlines / control chars / arbitrary
+  // length into attestation export output (multi-line "operator:" key/value
+  // pairs are a forgery surface — a forged second line could look like a
+  // separate attestation field to a naive parser). Strip ASCII control
+  // chars (\x00-\x1F + \x7F), cap length at 256, reject if all-whitespace.
   if (args.operator !== undefined) {
     if (typeof args.operator !== "string") {
       return emitError("run: --operator must be a string.", { provided: typeof args.operator }, pretty);
@@ -970,8 +1020,8 @@ function dispatchPlaybook(cmd, argv) {
         pretty
       );
     }
-    // EE P1-3: the ASCII-only control-char regex above misses Unicode
-    // categories Cc / Cf / Co / Cn — bidi overrides (U+202E "RTL OVERRIDE"),
+    // The ASCII-only control-char regex above misses Unicode categories
+    // Cc / Cf / Co / Cn — bidi overrides (U+202E "RTL OVERRIDE"),
     // zero-width joiners (U+200B-D), invisible format chars, private-use
     // codepoints, unassigned codepoints. An operator string like
     // "alice‮evilbob" renders as "alicebobevila" in any UI that respects
@@ -1020,7 +1070,20 @@ function dispatchPlaybook(cmd, argv) {
     runOpts.operator = normalized;
   }
 
-  // audit CC P1-3: --publisher-namespace <url> threads into the CSAF
+  // --csaf-status and --publisher-namespace shape the CSAF bundle emitted by
+  // phases 5-7. Verbs that don't drive those phases (brief, plan, govern,
+  // direct, look, attest, list-attestations, discover, doctor, lint, ask,
+  // verify-attestation, reattest) never assemble a bundle, so silently
+  // consuming these flags is a UX trap. Refuse on those verbs so the
+  // operator knows the flag was discarded — same pattern as --ack. Error
+  // message templates and emitError prefixes use the in-scope `cmd` verb so
+  // a brief invocation says "brief:" rather than misattributing the flag
+  // to run.
+  const BUNDLE_FLAG_RELEVANT_VERBS = new Set([
+    "run", "ci", "run-all", "ai-run", "ingest",
+  ]);
+
+  // --publisher-namespace <url> threads into the CSAF
   // bundle's document.publisher.namespace field. CSAF §3.1.7.4 requires the
   // namespace to be the publisher's trust anchor — i.e. the OPERATOR
   // running the scan, not the tooling vendor. Pre-fix this was hard-coded
@@ -1028,28 +1091,35 @@ function dispatchPlaybook(cmd, argv) {
   // accuracy. Validation mirrors --operator (string, ≤256 chars, no
   // ASCII / Unicode control characters), plus a URL-shape check (`^https?:`).
   if (args["publisher-namespace"] !== undefined) {
+    if (!BUNDLE_FLAG_RELEVANT_VERBS.has(cmd)) {
+      return emitError(
+        `${cmd}: --publisher-namespace is irrelevant on this verb (no CSAF bundle is assembled). --publisher-namespace only applies to verbs that drive phases 5-7: ${[...BUNDLE_FLAG_RELEVANT_VERBS].sort().join(", ")}. Re-invoke without --publisher-namespace, or pass it on \`exceptd run ${cmd === "brief" ? args._[0] || "<playbook>" : "<playbook>"} --publisher-namespace <url>\` once you're past the briefing step.`,
+        { verb: cmd, flag: "publisher-namespace", error_class: "irrelevant-flag", accepted_verbs: [...BUNDLE_FLAG_RELEVANT_VERBS].sort() },
+        pretty
+      );
+    }
     const ns = args["publisher-namespace"];
     if (typeof ns !== "string") {
-      return emitError("run: --publisher-namespace must be a string.", { provided: typeof ns }, pretty);
+      return emitError(`${cmd}: --publisher-namespace must be a string.`, { provided: typeof ns }, pretty);
     }
     // eslint-disable-next-line no-control-regex
     if (/[\x00-\x1F\x7F]/.test(ns)) {
       return emitError(
-        "run: --publisher-namespace contains ASCII control characters. Refusing — these would corrupt CSAF rendering and break URL parsing in downstream consumers.",
+        `${cmd}: --publisher-namespace contains ASCII control characters. Refusing — these would corrupt CSAF rendering and break URL parsing in downstream consumers.`,
         { provided_length: ns.length },
         pretty
       );
     }
     if (ns.length === 0 || ns.length > 256) {
       return emitError(
-        `run: --publisher-namespace length ${ns.length} out of bounds (1–256).`,
+        `${cmd}: --publisher-namespace length ${ns.length} out of bounds (1–256).`,
         { provided_length: ns.length },
         pretty
       );
     }
     if (!/^https?:\/\//i.test(ns)) {
       return emitError(
-        "run: --publisher-namespace must be a URL starting with http:// or https:// (e.g. https://your-org.example). CSAF §3.1.7.4 requires the namespace to be the publisher's trust anchor.",
+        `${cmd}: --publisher-namespace must be a URL starting with http:// or https:// (e.g. https://your-org.example). CSAF §3.1.7.4 requires the namespace to be the publisher's trust anchor.`,
         { provided: ns.slice(0, 80) },
         pretty
       );
@@ -1057,18 +1127,25 @@ function dispatchPlaybook(cmd, argv) {
     runOpts.publisherNamespace = ns;
   }
 
-  // audit CC P1-1: --csaf-status promotes the CSAF tracking.status from the
+  // --csaf-status promotes the CSAF tracking.status from the
   // runtime default (`interim`) to `final` for operators who have reviewed
   // the advisory and accept the immutable-advisory contract of CSAF
   // §3.1.11.3.5.1. Accepts the three CSAF spec values; anything else is
   // rejected at input so an operator typo (`finel`) doesn't silently fall
   // back to interim and produce surprise.
   if (args["csaf-status"] !== undefined) {
+    if (!BUNDLE_FLAG_RELEVANT_VERBS.has(cmd)) {
+      return emitError(
+        `${cmd}: --csaf-status is irrelevant on this verb (no CSAF bundle is assembled). --csaf-status only applies to verbs that drive phases 5-7: ${[...BUNDLE_FLAG_RELEVANT_VERBS].sort().join(", ")}. Re-invoke without --csaf-status, or pass it on \`exceptd run ${cmd === "brief" ? args._[0] || "<playbook>" : "<playbook>"} --csaf-status <status>\` once you're past the briefing step.`,
+        { verb: cmd, flag: "csaf-status", error_class: "irrelevant-flag", accepted_verbs: [...BUNDLE_FLAG_RELEVANT_VERBS].sort() },
+        pretty
+      );
+    }
     const cs = args["csaf-status"];
     const allowed = ["draft", "interim", "final"];
     if (typeof cs !== "string" || !allowed.includes(cs)) {
       return emitError(
-        `run: --csaf-status must be one of ${JSON.stringify(allowed)}. Got: ${JSON.stringify(String(cs)).slice(0, 40)}`,
+        `${cmd}: --csaf-status must be one of ${JSON.stringify(allowed)}. Got: ${JSON.stringify(String(cs)).slice(0, 40)}`,
         { provided: cs },
         pretty
       );
@@ -1081,13 +1158,13 @@ function dispatchPlaybook(cmd, argv) {
   // consent was explicit vs. implicit. AGENTS.md says the AI should surface
   // and wait for ack — this is how the ack gets recorded.
   //
-  // EE P1-6: --ack only makes sense on verbs that drive phases 5-7 (run /
-  // ingest / ai-run / ci / run-all / reattest). Info-only verbs (brief,
-  // plan, govern, direct, look, attest, list-attestations, discover,
-  // doctor, lint, ask, verify-attestation) never consume an attestation
-  // clock — accepting --ack silently here was a UX trap where operators
-  // believed they had recorded consent. Refuse on those verbs so the
-  // operator knows the flag is irrelevant.
+  // --ack only makes sense on verbs that drive phases 5-7 (run / ingest /
+  // ai-run / ci / run-all / reattest). Info-only verbs (brief, plan,
+  // govern, direct, look, attest, list-attestations, discover, doctor,
+  // lint, ask, verify-attestation) never consume an attestation clock —
+  // accepting --ack silently is a UX trap where operators believe they have
+  // recorded consent. Refuse on those verbs so the operator knows the flag
+  // is irrelevant.
   const ACK_RELEVANT_VERBS = new Set([
     "run", "ingest", "ai-run", "ci", "run-all", "reattest",
   ]);
@@ -1305,6 +1382,15 @@ Flags:
   --ack                   Mark explicit operator consent to the jurisdiction
                           obligations surfaced by govern. Persisted under
                           attestation.operator_consent.
+  --csaf-status <s>       CSAF tracking.status for the close.evidence_package
+                          bundle. One of: draft | interim (default) | final.
+                          'final' commits to CSAF §3.1.11.3.5.1 immutability —
+                          set this only after operator review of the advisory.
+  --publisher-namespace <url>
+                          CSAF document.publisher.namespace (§3.1.7.4). The
+                          publisher trust anchor — i.e. the operator's
+                          organisation, NOT the tooling vendor. Must be an
+                          http://… or https://… URL, ≤256 chars.
   --diff-from-latest      Compare evidence_hash against the most recent prior
                           attestation for the same playbook in
                           .exceptd/attestations/. Emits status: unchanged | drifted.
@@ -1333,13 +1419,36 @@ Flags:
   --pretty                Indented JSON output.
 
 Attestation is persisted to .exceptd/attestations/<session_id>/ on every
-successful run (single: attestation.json; multi: <playbook_id>.json).`,
+successful run (single: attestation.json; multi: <playbook_id>.json).
+
+Exit codes (per-verb, post-run):
+  0  PASS                  Run completed; classification clean, RWEP under cap.
+  1  Framework error       Runner threw, unreadable evidence, etc.
+  2  FAIL (detected)       classification=detected OR rwep ≥ escalate cap.
+  3  Ran-but-no-evidence   All inconclusive AND no --evidence supplied.
+  4  Blocked               Result returned ok:false (preflight halt).
+  5  CLOCK_STARTED         --block-on-jurisdiction-clock fired.
+  8  LOCK_CONTENTION       persistAttestation could not acquire the per-slot
+                           attestation lock after the bounded retry budget
+                           (~1-2s). Distinct from 1 so callers can retry the
+                           operation rather than treat it as a hard failure.
+                           Surfaces as body.lock_contention=true,
+                           body.exit_code=8.
+  6-7 — reserved (6=TAMPERED on attest verifier; 7 unused)`,
     ingest: `ingest — alias for 'run' matching AGENTS.md terminology.
 
 Flags:
   --domain <id>           Playbook ID (overrides submission.playbook_id).
   --directive <id>        Directive ID (overrides submission.directive_id).
   --evidence <file|->     Submission JSON. May include playbook_id/directive_id.
+  --csaf-status <s>       CSAF tracking.status for the close.evidence_package
+                          bundle. One of: draft | interim (default) | final.
+                          'final' commits to CSAF §3.1.11.3.5.1 immutability —
+                          set this only after operator review of the advisory.
+  --publisher-namespace <url>
+                          CSAF document.publisher.namespace (§3.1.7.4). The
+                          operator's organisation URL, NOT the tooling vendor.
+                          Must be an http://… or https://… URL, ≤256 chars.
   --pretty                Indented JSON output.`,
     reattest: `reattest [<session-id> | --latest] — replay a prior session and diff the evidence_hash.
 
@@ -1350,7 +1459,12 @@ Args / flags:
   --since <ISO>           Restrict --latest to attestations after this ISO 8601 timestamp.
   --pretty                Indented JSON output.
 
-Reports: unchanged | drifted | resolved from evidence_hash + classification deltas.`,
+Reports: unchanged | drifted | resolved from evidence_hash + classification deltas.
+
+Exit codes:
+  0  verification succeeded
+  1  generic failure
+  6  TAMPERED (sidecar or signature mismatch on the prior attestation)`,
     "list-attestations": `list-attestations [--playbook <id>] — enumerate prior attestations.
 
 Args / flags:
@@ -1380,7 +1494,12 @@ Subverbs:
                           for an explicit pair. Reports unchanged | drifted |
                           resolved per evidence_hash + classification deltas.
 
-All subverbs honor --pretty for indented JSON output.`,
+All subverbs honor --pretty for indented JSON output.
+
+Exit codes (attest verify):
+  0  verification succeeded
+  1  generic failure
+  6  TAMPERED (sidecar or signature mismatch)`,
     discover: `discover — context-aware playbook recommender (v0.11.0).
 
 Replaces: scan + dispatch + recommend.
@@ -1435,6 +1554,14 @@ Flags:
   --directive <id>        Specific directive (default: first one).
   --no-stream             Single-shot mode: emit all phases as one JSON doc
                           without reading stdin (uses runner.run directly).
+  --csaf-status <s>       CSAF tracking.status for the close.evidence_package
+                          bundle. One of: draft | interim (default) | final.
+                          'final' commits to CSAF §3.1.11.3.5.1 immutability —
+                          set this only after operator review of the advisory.
+  --publisher-namespace <url>
+                          CSAF document.publisher.namespace (§3.1.7.4). The
+                          operator's organisation URL, NOT the tooling vendor.
+                          Must be an http://… or https://… URL, ≤256 chars.
   --pretty                Indented JSON output (single-shot only).
 
 Stdin event grammar (one JSON object per line):
@@ -1493,6 +1620,11 @@ Flags:
                           summary (5-field digest), markdown (human digest).
                           Bundles (csaf-2.0/sarif/openvex) live on per-run
                           attestations, not the aggregate ci verdict.
+  --csaf-status <s>       CSAF tracking.status threaded into per-run bundles.
+                          One of: draft | interim (default) | final.
+  --publisher-namespace <url>
+                          CSAF document.publisher.namespace (§3.1.7.4). The
+                          operator's organisation URL, NOT the tooling vendor.
   --json                  Force single-line JSON (overrides any TTY heuristics).
   --pretty                Indented JSON output (implies --json).
 
@@ -1510,6 +1642,13 @@ Exit codes:
                            close.notification_actions entry started a
                            regulatory clock (NIS2 24h, GDPR 72h, DORA 4h,
                            etc.) and the operator has not acked.
+  6  TAMPERED              Attestation sidecar verification failed (Ed25519
+                           signature mismatch on a prior session referenced
+                           by the run, or the replay record's sidecar did
+                           not verify against keys/public.pem).
+  8  LOCK_CONTENTION       Concurrent run holds the per-playbook attestation
+                           lock; the bounded retry budget (~1-2s) elapsed
+                           without acquiring it. Retry the operation.
 
 Output: verb, session_id, playbooks_run, summary{total, detected,
 max_rwep_observed, jurisdiction_clocks_started, verdict, fail_reasons[]},
@@ -1562,7 +1701,15 @@ Flags: --pretty.`,
 Identical exit-code and output contract as \`run --all\`. Maintained for
 operators who script the verb form rather than the flag.
 
-See \`exceptd run --help\` for the full flag list.`,
+Flags (selected — see \`exceptd run --help\` for the full list):
+  --csaf-status <s>       CSAF tracking.status for per-run close.evidence_package
+                          bundles. One of: draft | interim (default) | final.
+                          'final' commits to CSAF §3.1.11.3.5.1 immutability —
+                          set this only after operator review of the advisory.
+  --publisher-namespace <url>
+                          CSAF document.publisher.namespace (§3.1.7.4). The
+                          operator's organisation URL, NOT the tooling vendor.
+                          Must be an http://… or https://… URL, ≤256 chars.`,
   };
   process.stdout.write((cmds[verb] || `${verb} — no per-verb help available; see \`exceptd help\` for the full list.`) + "\n");
 }
@@ -1964,13 +2111,12 @@ function cmdRun(runner, args, runOpts, pretty) {
   // Multi-playbook dispatch path. Triggered by --all, --scope <type>, or by
   // a bare `exceptd run` (no positional, no flags) which auto-detects scopes
   // from the cwd.
-  // R-F9: gate on `args.scope !== undefined` rather than `args.scope`
-  // truthy. Pre-fix, `--scope ""` parsed to `args.scope === ""`, which
-  // is falsy — the dispatcher fell through to the auto-detect path and
-  // silently ran whatever scopes happened to match the cwd, masking the
-  // operator's explicit (if malformed) intent. Now: an empty string
-  // reaches validateScopeOrThrow which rejects with the accepted-set
-  // message, matching the rest of the v0.12.15 scope-validation contract.
+  // Gate on `args.scope !== undefined` rather than truthy `args.scope`.
+  // `--scope ""` parses to `args.scope === ""`, which is falsy; a truthy
+  // gate would silently fall through to auto-detect and run whatever
+  // scopes happened to match the cwd, masking the operator's explicit
+  // (if malformed) intent. An empty string reaches validateScopeOrThrow
+  // which rejects with the accepted-set message.
   if (!positional && (args.all || args.scope !== undefined)) {
     let ids;
     if (args.all) {
@@ -2048,20 +2194,14 @@ function cmdRun(runner, args, runOpts, pretty) {
   // v0.11.1: auto-detect piped stdin. If no --evidence flag and stdin is a
   // pipe, assume `--evidence -`. Operators forgetting the flag previously
   // got a confusing precondition halt; now the common case "just works."
-  // R-F3: use truthy `!process.stdin.isTTY` instead of `=== false`. On
-  // Windows MSYS bash, process.stdin.isTTY is `undefined` for a piped
-  // stream — the strict `=== false` check failed and auto-detect never
-  // fired, making `echo '{...}' | exceptd run <pb>` silently behave like
-  // no-evidence on Windows. cmdAiRun's path (below) already uses the
-  // truthy form, so this brings cmdRun + cmdIngest to parity.
-  //
-  // EE P1-7: use the fstat-probing hasReadableStdin() helper instead of
-  // the raw `!process.stdin.isTTY` truthy check. Test harnesses with
-  // wrapped stdin duplexers (Mocha/Jest, Docker stdin-passthrough) leave
-  // isTTY === undefined but have no data — the raw check fell into
-  // readFileSync(0) and BLOCKED waiting for an EOF that never arrived.
-  // hasReadableStdin() does an fstat() probe first, then falls back to
-  // the truthy check only on Windows (where fstat on a pipe is unreliable).
+  // Use the fstat-probing hasReadableStdin() helper. A raw `!isTTY` check
+  // fires when isTTY is undefined (test harnesses with wrapped duplexers —
+  // Mocha/Jest, Docker stdin-passthrough — leave isTTY === undefined but
+  // never write any bytes), which causes readFileSync(0) to block waiting
+  // on an EOF that never arrives. hasReadableStdin() does an fstat() probe
+  // first, then falls back to a strict isTTY===false check only on Windows
+  // (where fstat on a pipe is unreliable). MSYS-bash on win32 reports
+  // isTTY === false for genuine piped input, so that path still works.
   if (!args.evidence && hasReadableStdin()) {
     args.evidence = "-";
   }
@@ -2097,11 +2237,10 @@ function cmdRun(runner, args, runOpts, pretty) {
   // CVE ID set through to analyze() so matched_cves drops them.
   if (args.vex) {
     let vexDoc;
-    // R-F5: cap --vex file size the same way readEvidence() caps --evidence
-    // (32 MiB — binary mebibytes, i.e. 32 * 1024 * 1024 = 33,554,432 bytes).
-    // Pre-fix, --vex did a raw readFileSync with no size check — an operator
-    // passing a multi-GB file (binary log, JSON bomb, or accident) blocked
-    // the event loop for minutes / OOM'd the process. 32 MiB is well beyond
+    // Cap --vex file size at 32 MiB (binary mebibytes, i.e. 32 * 1024 * 1024
+    // = 33,554,432 bytes), matching readEvidence()'s --evidence cap. Without
+    // the cap, a multi-GB file (binary log, JSON bomb, or accident) blocks
+    // the event loop for minutes / OOM's the process. 32 MiB is well beyond
     // any legitimate VEX submission.
     const MAX_VEX_BYTES = 32 * 1024 * 1024;
     let vstat;
@@ -2110,7 +2249,7 @@ function cmdRun(runner, args, runOpts, pretty) {
       return emitError(`run: failed to stat --vex ${args.vex}: ${e.message}`, null, pretty);
     }
     if (vstat.size > MAX_VEX_BYTES) {
-      // EE P1-4: error message names the binary mebi convention explicitly so
+      // Error message names the binary mebi convention explicitly so
       // operators don't mistake the cap for 32 * 10^6 = 32,000,000 bytes (MB).
       return emitError(
         `run: --vex file too large: ${vstat.size} bytes exceeds 32 MiB limit (${MAX_VEX_BYTES.toLocaleString("en-US")} bytes). Reduce the document or split into multiple passes.`,
@@ -2119,14 +2258,14 @@ function cmdRun(runner, args, runOpts, pretty) {
       );
     }
     try {
-      // EE P1-2: BOM-tolerant read. Windows-tool-emitted CycloneDX commonly
-      // carries UTF-8-BOM or UTF-16 LE/BE markers; the raw "utf8" decode in
+      // BOM-tolerant read. Windows-tool-emitted CycloneDX commonly carries
+      // UTF-8-BOM or UTF-16 LE/BE markers; the raw "utf8" decode in
       // readFileSync chokes on the leading 0xFEFF.
       vexDoc = readJsonFile(args.vex);
     } catch (e) {
       return emitError(`run: failed to load --vex ${args.vex}: ${e.message}`, null, pretty);
     }
-    // F5: validate the VEX shape BEFORE handing to runner.vexFilterFromDoc.
+    // Validate the VEX shape BEFORE handing to runner.vexFilterFromDoc.
     // The runner tolerantly returns Set(0) for anything that's not CycloneDX
     // or OpenVEX shape, so an operator who passes a SARIF / SBOM / CSAF
     // advisory by mistake got ZERO filter applied and ZERO feedback. Now:
@@ -2144,15 +2283,13 @@ function cmdRun(runner, args, runOpts, pretty) {
       const vexSet = runner.vexFilterFromDoc(vexDoc);
       submission.signals = submission.signals || {};
       submission.signals.vex_filter = [...vexSet];
-      // BB P1-3: vexFilterFromDoc attaches a `.fixed` Set as an own property
-      // on the returned filter Set (CycloneDX `analysis.state: 'resolved'`
-      // + OpenVEX `status: 'fixed'` go into this set). Without forwarding it
-      // through to signals.vex_fixed, analyze() never receives the fixed-
-      // disposition CVE ids — `vexFixed` stays null, `vex_status: 'fixed'`
-      // never gets annotated onto matched_cves entries, and CSAF
-      // product_status.fixed + OpenVEX status:'fixed' are unreachable from
-      // the CLI. The bundle-correctness tests only exercised the analyze()
-      // direct-call path with vex_fixed pre-injected, hiding this regression.
+      // vexFilterFromDoc attaches a `.fixed` Set as an own property on the
+      // returned filter Set (CycloneDX `analysis.state: 'resolved'` + OpenVEX
+      // `status: 'fixed'` populate it). Forward it through to
+      // signals.vex_fixed so analyze() receives the fixed-disposition CVE
+      // ids, `vex_status: 'fixed'` annotates matched_cves entries, and CSAF
+      // product_status.fixed + OpenVEX status:'fixed' propagate into the
+      // bundle.
       submission.signals.vex_fixed = vexSet.fixed ? [...vexSet.fixed] : [];
     } catch (e) {
       return emitError(`run: failed to apply --vex ${args.vex}: ${e.message}`, null, pretty);
@@ -2191,14 +2328,14 @@ function cmdRun(runner, args, runOpts, pretty) {
   // ack state by that name (`result.ack` is shorter + matches the CLI flag).
   if (result && runOpts.operator) result.operator = runOpts.operator;
 
-  // EE P1-6: --ack consent only counts when a jurisdiction clock is actually
-  // at stake — i.e. the run produced classification=detected (a real finding
+  // --ack consent only counts when a jurisdiction clock is actually at
+  // stake — i.e. the run produced classification=detected (a real finding
   // that may trigger NIS2 24h / DORA 4h / GDPR 72h obligations). On a
-  // not-detected or inconclusive run, persisting the consent silently was
-  // misleading: the attestation file recorded operator acknowledgement of
-  // a clock that never started. Now: surface the ack state in the run body
-  // either way so operators see what happened, but only persist
-  // `operator_consent` into the attestation when classification === detected.
+  // not-detected or inconclusive run, persisting the consent would record
+  // operator acknowledgement of a clock that never started. Surface the
+  // ack state in the run body either way so operators see what happened,
+  // but only persist `operator_consent` into the attestation when
+  // classification === detected.
   const detectClassification = result && result.phases && result.phases.detect
     ? result.phases.detect.classification
     : null;
@@ -2223,7 +2360,7 @@ function cmdRun(runner, args, runOpts, pretty) {
       directiveId: result.directive_id,
       evidenceHash: result.evidence_hash,
       operator: runOpts.operator,
-      // EE P1-6: gate consent persistence on classification=detected.
+      // Gate consent persistence on classification=detected.
       operatorConsent: consentApplies ? runOpts.operator_consent : null,
       submission,
       runOpts,
@@ -2231,10 +2368,17 @@ function cmdRun(runner, args, runOpts, pretty) {
       filename: "attestation.json",
     });
     if (!persistResult.ok) {
-      // Session-id collision without --force-overwrite. Refuse, surface the
-      // existing path so the operator can decide, and emit JSON to stderr
-      // matching the unified error shape. Exit non-zero — a silent overwrite
-      // is a tamper-evidence violation.
+      // Session-id collision without --force-overwrite, OR --force-overwrite
+      // lost the lockfile race. Refuse, surface the existing path so the
+      // operator can decide, emit JSON to stderr matching the unified error
+      // shape. Exit non-zero — a silent overwrite is a tamper-evidence
+      // violation. v0.12.14: exitCode + return instead of process.exit so
+      // the stderr line drains under piped CI consumers.
+      //
+      // When persistAttestation lost the lockfile race it pinned
+      // process.exitCode = 8 (LOCK_CONTENTION) before returning. Don't
+      // overwrite that with 3 — preserve the exit-8 contract callers depend
+      // on to distinguish lock-busy from collision.
       const err = {
         ok: false,
         error: persistResult.error,
@@ -2242,10 +2386,14 @@ function cmdRun(runner, args, runOpts, pretty) {
         hint: "Pass --force-overwrite to replace, or supply a fresh --session-id (omit the flag for an auto-generated hex).",
         verb: "run",
       };
-      // v0.12.14: exitCode + return instead of process.exit
-      // so the stderr line drains under piped CI consumers.
+      if (persistResult.lock_contention) {
+        err.lock_contention = true;
+        err.exit_code = 8;
+      }
       process.stderr.write(JSON.stringify(err) + "\n");
-      process.exitCode = 3;
+      if (!persistResult.lock_contention) {
+        process.exitCode = 3;
+      }
       return;
     }
     if (persistResult.prior_session_id) {
@@ -2259,12 +2407,11 @@ function cmdRun(runner, args, runOpts, pretty) {
   }
 
   if (result && result.ok === false) {
-    // F19: align preflight-halt exit code between `run --ci` and `ci`.
-    // Pre-fix `run --ci` exited 1 (FRAMEWORK_ERROR) while `ci` on the same
-    // halt exited 4 (BLOCKED). Now both use 4 when --ci is in effect, so
-    // operators can wire one set of exit-code expectations regardless of
-    // which verb they call. Without --ci the legacy exit 1 is preserved
-    // (ok:false bodies are framework signals when no CI gating is asked for).
+    // Align preflight-halt exit code between `run --ci` and `ci`: both use
+    // 4 (BLOCKED) when --ci is in effect so operators can wire one set of
+    // exit-code expectations regardless of which verb they call. Without
+    // --ci the legacy exit 1 is preserved (ok:false bodies are framework
+    // signals when no CI gating is requested).
     process.stderr.write((pretty ? JSON.stringify(result, null, 2) : JSON.stringify(result)) + "\n");
     process.exitCode = args.ci ? 4 : 1;
     return;
@@ -2472,9 +2619,10 @@ function cmdRun(runner, args, runOpts, pretty) {
     const top = rwep?.threshold?.escalate ?? "n/a";
     const verdictIcon = cls === "detected" ? "[!! DETECTED]" : cls === "inconclusive" ? "[i  INCONCLUSIVE]" : "[ok]";
     lines.push(`\n${verdictIcon}  classification=${cls}  RWEP ${adj}/${top}${adj !== base ? ` (Δ${adj - base} from operator evidence)` : " (catalog baseline)"}  blast_radius=${obj.phases?.analyze?.blast_radius_score ?? "n/a"}/5`);
-    // F11: surface --diff-from-latest verdict in the human renderer. Pre-fix
-    // operators had to add --json to see whether the run drifted from the
-    // previous attestation. Now one summary line follows the classification.
+    // F11: surface --diff-from-latest verdict in the human renderer so
+    // operators see whether the run drifted from the previous attestation
+    // without adding --json. One summary line follows the classification.
+    // Marker text is grep-matched by tests/audit-i-l-m-fixes.test.js F11.
     // - unchanged: same evidence_hash as prior → reassuring single line.
     // - drifted: evidence differs → loud DRIFTED marker.
     // - no_prior_attestation_for_playbook: no line — don't clutter the
@@ -2552,7 +2700,7 @@ function cmdRun(runner, args, runOpts, pretty) {
  * inconclusive findings + visibility gaps) when no --evidence is given.
  */
 /**
- * F13: collapse per-playbook notification_actions into a deduped rollup.
+ * Collapse per-playbook notification_actions into a deduped rollup.
  * Multi-playbook runs frequently surface the same jurisdiction clock from
  * 5-10 contributing playbooks (every EU-touching playbook starts a fresh
  * NIS2 Art.23 24h clock). Operators were drafting one notification per
@@ -2587,12 +2735,11 @@ function buildJurisdictionClockRollup(results) {
           existing.deadline = n.deadline;
         }
       } else {
-        // R-F11: emit `obligation` (the field name the CHANGELOG v0.12.16
-        // entry promised) AND retain `obligation_ref` as a kept-name alias
+        // Emit `obligation` and retain `obligation_ref` as a kept-name alias
         // for any consumer that already parses the older shape. The dedupe
         // key still keys on n.obligation_ref since that's the field
         // notification-action stubs carry; the rollup body just exposes
-        // both names so the documented contract is truthful.
+        // both names.
         const obligation = n.obligation_ref || null;
         m.set(key, {
           jurisdiction: n.jurisdiction || null,
@@ -2646,13 +2793,13 @@ function cmdRunMulti(runner, ids, args, runOpts, pretty, meta) {
       if (!entryPath.startsWith(resolvedDir + path.sep)) {
         return emitError(`run: --evidence-dir entry ${f} resolves outside the directory; refusing.`, null, pretty);
       }
-      // R-F12: the path.resolve check above only catches `..` traversal in
-      // the joined path; fs.readFileSync(entryPath) still follows symlinks,
-      // so a `<pb-id>.json -> /etc/shadow` symlink inside the dir would
-      // happily slurp the target. lstat is symlink-aware (it does NOT
-      // follow); refuse anything that's not a regular file. Defense in
-      // depth on top of the readdir filter — a junction (Windows) or
-      // bind-mount can shape-shift in between filter and read.
+      // The path.resolve check above only catches `..` traversal in the
+      // joined path; fs.readFileSync(entryPath) still follows symlinks, so
+      // a `<pb-id>.json -> /etc/shadow` symlink inside the dir would happily
+      // slurp the target. lstat is symlink-aware (it does NOT follow);
+      // refuse anything that's not a regular file. Defense in depth on top
+      // of the readdir filter — a junction (Windows) or bind-mount can
+      // shape-shift in between filter and read.
       let lst;
       try { lst = fs.lstatSync(entryPath); }
       catch (e) {
@@ -2664,9 +2811,9 @@ function cmdRunMulti(runner, ids, args, runOpts, pretty, meta) {
       if (!lst.isFile()) {
         return emitError(`run: --evidence-dir entry ${f} is not a regular file; refusing.`, { entry: f }, pretty);
       }
-      // EE P1-5: Windows directory junctions are reparse-point dirs that
+      // Windows directory junctions are reparse-point dirs that
       // `lstat().isSymbolicLink()` returns FALSE for (Node treats them as
-      // ordinary directories). They bypass the symlink refusal above. Use
+      // ordinary directories), bypassing the symlink refusal above. Use
       // realpathSync to resolve the entry and confirm it still lives under
       // the resolved evidence-dir — the realpath approach is portable
       // (catches POSIX symlinks too, defense in depth) and works regardless
@@ -2683,10 +2830,10 @@ function cmdRunMulti(runner, ids, args, runOpts, pretty, meta) {
           pretty
         );
       }
-      // EE P1-5 (hardlink defense in depth): no clean cross-platform refusal
-      // exists — hardlinks are indistinguishable from regular files at the
-      // inode level. Surface a stderr warning when nlink > 1 so the operator
-      // is aware a second name may point at the same file. Not a refusal —
+      // Hardlink defense in depth: no clean cross-platform refusal exists —
+      // hardlinks are indistinguishable from regular files at the inode
+      // level. Surface a stderr warning when nlink > 1 so the operator is
+      // aware a second name may point at the same file. Not a refusal —
       // legitimate use cases (atomic rename, package-manager dedup) produce
       // nlink > 1 without malicious intent.
       if (lst.nlink > 1) {
@@ -2714,6 +2861,29 @@ function cmdRunMulti(runner, ids, args, runOpts, pretty, meta) {
 
     const result = runner.run(id, directiveId, submission, perRunOpts);
 
+    // Per-playbook --ack gating: consent only counts when a jurisdiction
+    // clock is actually at stake on THIS playbook's verdict — i.e. its
+    // detect.classification === 'detected'. Without this gate, a single
+    // --ack on a run-all invocation would persist explicit consent into
+    // every playbook's attestation regardless of whether that playbook's
+    // run started a clock. The `ack_skipped_reason` surface mirrors cmdRun
+    // so consumers see exactly which playbooks consumed the ack.
+    const perDetectClassification = result && result.phases && result.phases.detect
+      ? result.phases.detect.classification
+      : null;
+    const perConsentApplies =
+      !!perRunOpts.operator_consent && perDetectClassification === "detected";
+    if (result && perRunOpts.operator_consent) {
+      result.operator_consent = perRunOpts.operator_consent;
+      result.ack = !!perRunOpts.operator_consent.explicit;
+      result.ack_applied = perConsentApplies;
+      if (!perConsentApplies) {
+        result.ack_skipped_reason = `classification=${perDetectClassification || "unknown"}; consent only persisted when classification=detected (jurisdiction clock at stake).`;
+      }
+    } else if (result) {
+      result.ack = false;
+    }
+
     // Persist per-playbook attestation under the shared session.
     if (result && result.ok) {
       const persisted = persistAttestation({
@@ -2722,7 +2892,9 @@ function cmdRunMulti(runner, ids, args, runOpts, pretty, meta) {
         directiveId,
         evidenceHash: result.evidence_hash,
         operator: perRunOpts.operator,
-        operatorConsent: perRunOpts.operator_consent,
+        // Gate consent persistence on this playbook's classification, not
+        // on the aggregate run's --ack presence.
+        operatorConsent: perConsentApplies ? perRunOpts.operator_consent : null,
         submission,
         runOpts: perRunOpts,
         forceOverwrite: !!args["force-overwrite"],
@@ -2740,12 +2912,12 @@ function cmdRunMulti(runner, ids, args, runOpts, pretty, meta) {
     results.push(result);
   }
 
-  // F13: dedupe jurisdiction-clock notification actions across all playbook
-  // results into a single rollup. Pre-fix a 13-playbook multi-run with 8
-  // contributors of "EU NIS2 Art.23 24h" produced 8 separate entries, so
-  // operators drafted 8 NIS2 notifications when one was sufficient. Per-
-  // playbook entries are preserved on individual results; this rollup is
-  // additive — keyed on (jurisdiction, regulation, obligation_ref,
+  // Dedupe jurisdiction-clock notification actions across all playbook
+  // results into a single rollup. Without this, a 13-playbook multi-run
+  // with 8 contributors of "EU NIS2 Art.23 24h" produces 8 separate
+  // entries and operators draft 8 NIS2 notifications when one suffices.
+  // Per-playbook entries are preserved on individual results; this rollup
+  // is additive — keyed on (jurisdiction, regulation, obligation_ref,
   // window_hours) — with a triggered_by_playbooks[] list so operators see
   // which playbooks contributed.
   const jurisdictionClockRollup = buildJurisdictionClockRollup(results);
@@ -2779,19 +2951,14 @@ function cmdIngest(runner, args, runOpts, pretty) {
   // `ingest` matches the AGENTS.md ingest contract. The submission JSON may
   // carry playbook_id + directive_id; --domain/--directive flags override.
   let submission = {};
-  // F4: auto-detect piped stdin (parity with cmdRun). Without this,
-  // `echo '{...}' | exceptd ingest` failed with "no playbook resolved"
-  // because args.evidence stayed undefined and the routing JSON never got
-  // read. Mirrors the cmdRun behavior at line 1614.
-  // R-F3: use truthy `!process.stdin.isTTY` rather than `=== false`. On
-  // Windows MSYS bash, isTTY is `undefined` for piped streams — the
-  // strict `=== false` check failed and ingest silently treated the
-  // routing JSON as absent. CHANGELOG v0.12.16 F4 ("cmdIngest auto-
-  // detects piped stdin") was a no-op on Windows pre-fix.
-  //
-  // EE P1-7: route through hasReadableStdin() — see cmdRun for rationale.
-  // Wrapped-stdin test harnesses (Mocha/Jest, Docker stdin-passthrough)
-  // would otherwise block here forever on the readFileSync(0) call.
+  // Auto-detect piped stdin (parity with cmdRun) so
+  // `echo '{...}' | exceptd ingest` reads the routing JSON instead of
+  // failing with "no playbook resolved" because args.evidence stays
+  // undefined.
+  // Route stdin auto-detection through hasReadableStdin() (see cmdRun for
+  // rationale). Wrapped-stdin test harnesses (Mocha/Jest, Docker
+  // stdin-passthrough) would otherwise block here forever on the
+  // readFileSync(0) call when isTTY === undefined.
   if (!args.evidence && hasReadableStdin()) {
     args.evidence = "-";
   }
@@ -2830,21 +2997,42 @@ function cmdIngest(runner, args, runOpts, pretty) {
   // calls with the same session-id silently clobbered the audit trail and no
   // .sig sidecar was written.
   if (result && result.ok && result.session_id) {
+    // Mirror cmdRun / cmdRunMulti: gate operator_consent persistence on
+    // classification === 'detected'. --ack is meaningful only when a
+    // jurisdiction clock is at stake; persisting consent on a
+    // not-detected ingest forges audit-trail consent for a clock that
+    // never started.
+    const ingestClassification = result.phases && result.phases.detect ? result.phases.detect.classification : null;
+    const ingestConsentApplies = ingestClassification === "detected";
+    if (runOpts.operator_consent && !ingestConsentApplies) {
+      result.ack = true;
+      result.ack_applied = false;
+      result.ack_skipped_reason = `classification=${ingestClassification || "unknown"}; consent only persisted when classification=detected (jurisdiction clock at stake).`;
+    }
     const persisted = persistAttestation({
       sessionId: result.session_id,
       playbookId: result.playbook_id,
       directiveId: result.directive_id,
       evidenceHash: result.evidence_hash,
       operator: runOpts.operator,
-      operatorConsent: runOpts.operator_consent,
+      operatorConsent: ingestConsentApplies ? runOpts.operator_consent : null,
       submission: cleanedSubmission,
       runOpts,
       forceOverwrite: !!args["force-overwrite"],
       filename: "attestation.json",
     });
     if (!persisted.ok) {
-      // Surface the collision; do not silently clobber.
-      return emitError(persisted.error, { session_id: result.session_id, existing_path: persisted.existingPath }, pretty);
+      // Surface the collision; do not silently clobber. Preserve
+      // LOCK_CONTENTION exit 8 set by persistAttestation when
+      // --force-overwrite hit the lockfile race.
+      const ctx = { session_id: result.session_id, existing_path: persisted.existingPath };
+      if (persisted.lock_contention) {
+        ctx.lock_contention = true;
+        ctx.exit_code = 8;
+        process.stderr.write(JSON.stringify({ ok: false, error: persisted.error, ...ctx }) + "\n");
+        return;
+      }
+      return emitError(persisted.error, ctx, pretty);
     }
     if (persisted.prior_session_id) {
       result.attestation_persist = { ok: true, prior_session_id: persisted.prior_session_id, overwrote_at: persisted.overwrote_at };
@@ -2991,21 +3179,21 @@ function persistAttestation(args) {
           existingPath: path.relative(process.cwd(), filePath),
         };
       }
-      // T P1-2: serialize the read-prior + write-new sequence behind a
-      // lockfile so concurrent --force-overwrite invocations against the
-      // same session-id slot do not degrade to last-write-wins. Pattern
-      // matches withCatalogLock + withIndexLock: O_EXCL 'wx' on a sibling
-      // .lock file with bounded retry, PID-liveness check on contention,
-      // mtime fallback for orphaned lockfiles.
-      // DD P1-2: MAX_RETRIES capped at 10 (was 50). persistAttestation is a
-      // sync function called from sync callers throughout the CLI, so the
-      // wait loop must busy-spin (no event-loop yield available). At 50
-      // retries × ~200ms backoff per spin the worst case was ~10s of pegged-
-      // CPU + frozen-event-loop stall under attestation contention. Capping
-      // at 10 bounds the freeze at ~1-2s; beyond that callers receive the
-      // LOCK_CONTENTION sentinel on the result object and can retry from the
-      // outside without holding the CPU. Async refactor of persistAttestation
-      // + every caller is a v0.13.0 candidate.
+      // Serialize the read-prior + write-new sequence behind a lockfile so
+      // concurrent --force-overwrite invocations against the same session-id
+      // slot do not degrade to last-write-wins. Pattern matches
+      // withCatalogLock + withIndexLock: O_EXCL 'wx' on a sibling .lock file
+      // with bounded retry, PID-liveness check on contention, mtime fallback
+      // for orphaned lockfiles.
+      // DD P1-2: MAX_RETRIES is capped at 10. persistAttestation is sync and
+      // called from sync callers, so the wait loop must busy-spin (no
+      // event-loop yield available). A larger bound would peg the CPU and
+      // freeze the event loop for multiple seconds under attestation
+      // contention. Capping at 10 bounds the freeze at ~1-2s; beyond that
+      // callers receive the LOCK_CONTENTION sentinel on the result object
+      // and can retry from the outside without holding the CPU. Async
+      // refactor of persistAttestation + every caller is a v0.13.0
+      // candidate.
       const lockPath = filePath + ".lock";
       const MAX_RETRIES = 10;
       const STALE_LOCK_MS = 30_000;
@@ -3044,16 +3232,25 @@ function persistAttestation(args) {
         }
       }
       if (!acquired) {
-        // DD P1-2: lock_contention sentinel so callers can distinguish a
-        // genuine lock-busy condition (retry-from-outside is the right move)
-        // from a hard failure (write error, permission denial). The sync
-        // spin budget was bounded above so we hit this return after ~1-2s
-        // of contention rather than the prior ~10s.
+        // Surface lock_contention as a distinct sentinel so callers can
+        // distinguish a genuine lock-busy condition (retry-from-outside is
+        // the right move) from a hard failure (write error, permission
+        // denial). The sync spin budget is bounded above so this return
+        // fires after ~1-2s of contention.
+        //
+        // emit() auto-maps any ok:false body to process.exitCode = 1 (only
+        // when the current value is still 0). Pin process.exitCode = 8 HERE
+        // before the caller hands the body to emit(); emit() preserves the
+        // already-non-zero value. Exit code 8 is reserved exclusively for
+        // LOCK_CONTENTION (attestation persist); see the exit-code table in
+        // printGlobalHelp().
+        process.exitCode = 8;
         return {
           ok: false,
           error: `LOCK_CONTENTION: Failed to acquire attestation lock at ${path.relative(process.cwd(), lockPath)} after ${MAX_RETRIES} attempts (~1-2s of contention). Retry the operation; if it persists, inspect the lockfile for a stale holder.`,
           existingPath: path.relative(process.cwd(), filePath),
           lock_contention: true,
+          exit_code: 8,
         };
       }
       try {
@@ -3091,7 +3288,7 @@ function persistAttestation(args) {
  * from "the .sig file was deleted by an attacker."
  */
 /**
- * C: byte-stability normalize() for the attestation pipeline.
+ * Byte-stability normalize() for the attestation pipeline.
  * Strips a leading UTF-8 BOM and collapses CRLF → LF. Mirrors the
  * normalize() implementations in lib/sign.js, lib/verify.js,
  * lib/refresh-network.js, and scripts/verify-shipped-tarball.js. Five
@@ -3117,13 +3314,13 @@ function maybeSignAttestation(filePath) {
   // (reporting only PKG_ROOT now), not by making `run` follow a cwd key the
   // verifier doesn't trust.
   const privKeyPath = path.join(PKG_ROOT, ".keys", "private.pem");
-  // C: normalize attestation bytes before sign — strip leading
-  // UTF-8 BOM + collapse CRLF to LF. Mirrors lib/sign.js / lib/verify.js /
+  // Normalize attestation bytes before sign — strip leading UTF-8 BOM +
+  // collapse CRLF to LF. Mirrors lib/sign.js / lib/verify.js /
   // lib/refresh-network.js / scripts/verify-shipped-tarball.js. The
   // attestation file lives on disk under .exceptd/ and can pick up CRLF
   // through git-attribute / editor round-trips on Windows; without
   // normalization the sign/verify pair diverges on the same logical content.
-  // The byte-stability contract is now five sites; tests/normalize-contract
+  // The byte-stability contract spans five sites; tests/normalize-contract
   // .test.js enforces byte-identical output across all of them.
   const rawContent = fs.readFileSync(filePath, "utf8");
   const content = normalizeAttestationBytes(rawContent);
@@ -3147,20 +3344,24 @@ function maybeSignAttestation(filePath) {
         key: privateKey,
         dsaEncoding: "ieee-p1363",
       });
+      // The sidecar's Ed25519 signature covers ONLY the attestation file
+      // bytes. Fields that travel inside the .sig but are NOT in the signed
+      // message are replay-rewrite trivial: an attacker who can write the
+      // directory can mutate them without invalidating the signature. The
+      // sidecar therefore carries only the algorithm tag, the Ed25519
+      // signature payload, and an explanatory note — no `signed_at`,
+      // `signs_path`, or `signs_sha256`. Operators reading freshness use
+      // filesystem mtime; the attestation file's `captured_at` field is
+      // what's signed.
       fs.writeFileSync(sigPath, JSON.stringify({
         algorithm: "Ed25519",
         signature_base64: sig.toString("base64"),
-        signed_at: new Date().toISOString(),
-        signs_path: path.basename(filePath),
-        signs_sha256: crypto.createHash("sha256").update(content).digest("base64"),
+        note: "Ed25519 signature covers the attestation file bytes only. Use filesystem mtime for freshness; use the attestation's `captured_at` for the signed timestamp.",
       }, null, 2));
     } else {
       fs.writeFileSync(sigPath, JSON.stringify({
         algorithm: "unsigned",
         signed: false,
-        signed_at: null,
-        signs_path: path.basename(filePath),
-        signs_sha256: crypto.createHash("sha256").update(content).digest("base64"),
         note: "No private key at .keys/private.pem — attestation is hash-stable but unsigned. Run `node lib/sign.js generate-keypair` to enable signing.",
       }, null, 2));
     }
@@ -3244,6 +3445,12 @@ function walkAttestationDir(root, opts, candidates) {
       try {
         const p = path.join(sdir, f);
         const j = JSON.parse(fs.readFileSync(p, "utf8"));
+        // Replay records (kind: 'replay') are an audit trail of force-replay
+        // overrides, not a separate attestation. They have no captured_at /
+        // evidence_hash and must not surface as candidates for --latest.
+        // Gate on the parsed kind so a renamed file cannot smuggle a replay
+        // record into the listing.
+        if (j && j.kind === "replay") continue;
         if (opts.playbookId && j.playbook_id !== opts.playbookId) continue;
         if (opts.since && (j.captured_at || "") < opts.since) continue;
         if (opts.excludeSessionId && sid === opts.excludeSessionId) continue;
@@ -3254,14 +3461,14 @@ function walkAttestationDir(root, opts, candidates) {
 }
 
 /**
- * F10: factored Ed25519-sidecar verification used by both `attest verify`
- * and `reattest`. Returns { file, signed, verified, reason } for a given
+ * Factored Ed25519-sidecar verification used by both `attest verify` and
+ * `reattest`. Returns { file, signed, verified, reason } for a given
  * attestation file path.
  *
- * Pre-fix, cmdReattest read attestation.json via JSON.parse with no
- * authenticity check. A tampered attestation was silently consumed and the
- * drift verdict was computed against forged input. Now cmdReattest calls
- * this and refuses on verify-fail unless --force-replay is set.
+ * Callers must check `signed && verified` before consuming the
+ * attestation. cmdReattest refuses to replay on verify-fail unless
+ * --force-replay is set, so a tampered attestation cannot silently feed
+ * forged input into the drift verdict.
  */
 function verifyAttestationSidecar(attFile) {
   const crypto = require("crypto");
@@ -3287,7 +3494,7 @@ function verifyAttestationSidecar(attFile) {
   let sigDoc;
   try { sigDoc = JSON.parse(fs.readFileSync(sigPath, "utf8")); }
   catch (e) {
-    // Audit AA P1-2: a corrupt-JSON sidecar is observationally indistinguishable
+    // a corrupt-JSON sidecar is observationally indistinguishable
     // from sidecar tamper — an attacker who can rewrite attestation.json can
     // also truncate / mangle the .sig file. Surface as a distinct
     // tamper-class reason so callers can require --force-replay. Pre-fix,
@@ -3303,7 +3510,7 @@ function verifyAttestationSidecar(attFile) {
     };
   }
   if (sigDoc.algorithm === "unsigned") {
-    // Audit AA P1-1: `algorithm: "unsigned"` is only legitimate when written
+    // `algorithm: "unsigned"` is only legitimate when written
     // by maybeSignAttestation() at attestation-creation time on a host
     // WITHOUT .keys/private.pem. If the verifying host HAS a private key,
     // an "unsigned" sidecar is a substitution attack: tamper attestation.json
@@ -3321,15 +3528,33 @@ function verifyAttestationSidecar(attFile) {
     }
     return { file: attFile, signed: false, verified: false, reason: "attestation explicitly unsigned (no private key when written)" };
   }
+  // Strict algorithm check. A branch on `=== "unsigned"` alone would let
+  // null, undefined, "RSA-PSS", arrays, etc. fall through to crypto.verify
+  // with default Ed25519 args — which can either succeed against
+  // wrong-algorithm signature bytes accidentally (an attacker who can
+  // write the sidecar replays an existing Ed25519 signature under a
+  // downgrade-bait algorithm tag) or throw a generic verify error.
+  // Refuse anything that isn't exactly "Ed25519" or "unsigned" with a
+  // structured tamper class so callers can route the refusal through the
+  // same exit-6 path as other tamper events.
+  if (sigDoc.algorithm !== "Ed25519") {
+    return {
+      file: attFile,
+      signed: false,
+      verified: false,
+      reason: "unsupported algorithm: " + JSON.stringify(sigDoc.algorithm),
+      tamper_class: "algorithm-unsupported",
+    };
+  }
   if (!pubKey) {
     return { file: attFile, signed: true, verified: false, reason: "no public key at keys/public.pem to verify against" };
   }
   let content;
   try {
     const raw = fs.readFileSync(attFile, "utf8");
-    // C: apply the same normalize() used by the signer so the
-    // verify path is byte-stable across CRLF / BOM churn (Windows checkout
-    // with core.autocrlf=true, editor round-trips, git-attributes flips).
+    // Apply the same normalize() used by the signer so the verify path is
+    // byte-stable across CRLF / BOM churn (Windows checkout with
+    // core.autocrlf=true, editor round-trips, git-attributes flips).
     content = normalizeAttestationBytes(raw);
   }
   catch (e) { return { file: attFile, signed: true, verified: false, reason: `attestation read error: ${e.message}` }; }
@@ -3349,13 +3574,14 @@ function verifyAttestationSidecar(attFile) {
 }
 
 function cmdReattest(runner, args, runOpts, pretty) {
-  // F29: --since ISO-8601 validation parity with `attest list --since`
-  // (already fixed in v0.12.12). Pre-fix, an invalid date silently passed
-  // through to walkAttestationDir, where the lexical comparison either
-  // matched all or none unpredictably.
+  const crypto = require("crypto");
+  // Validate --since as ISO-8601, mirroring `attest list --since`. An
+  // invalid date would otherwise pass through to walkAttestationDir, where
+  // the lexical comparison either matches all or none unpredictably.
   if (args.since != null) {
-    // R-F10: regex BEFORE Date.parse — bare integers like "99" would
-    // otherwise parse as the year 1999 and silently filter wrong eras.
+    // ISO-8601 shape regex BEFORE Date.parse — bare integers like "99"
+    // would otherwise parse as the year 1999 and silently filter wrong
+    // eras.
     const sinceErr = validateIsoSince(args.since);
     if (sinceErr) return emitError(`reattest: ${sinceErr}`, null, pretty);
   }
@@ -3379,24 +3605,33 @@ function cmdReattest(runner, args, runOpts, pretty) {
     return emitError(`reattest: no attestation found at ${attFile}`, { session_id: sessionId }, pretty);
   }
 
-  // F10: verify the .sig sidecar BEFORE consuming the prior attestation.
-  // Pre-fix, a tampered attestation.json was silently parsed and the drift
-  // verdict was computed against forged input. Now: refuse on verify-fail
+  // Verify the .sig sidecar BEFORE consuming the prior attestation. A
+  // tampered attestation.json would otherwise be silently parsed and the
+  // drift verdict computed against forged input. Refuse on verify-fail
   // with exit 6 (TAMPERED) unless --force-replay is explicitly set.
   // Unsigned attestations (no private key was available at run time) emit
   // a stderr warning but proceed — that's an operator config issue, not
   // tampering. `verified === false && signed === true` is the real tamper
   // signal.
   const verify = verifyAttestationSidecar(attFile);
-  // Audit AA P1-1 + P1-2: collapse tamper-class detection. Any non-benign
-  // sidecar state (signed-but-invalid, sidecar-corrupt, unsigned-substitution)
-  // refuses replay unless --force-replay is set. The pre-fix shape only
-  // refused on `verify.signed && !verify.verified` (signed-tamper) and on
-  // `no .sig sidecar` (missing); corrupt-JSON sidecars and substituted
-  // "unsigned" sidecars on a host WITH a private key fell into the benign
-  // NOTE branch and replay proceeded against forged input.
+  // Collapse tamper-class detection. Any non-benign sidecar state
+  // (signed-but-invalid, sidecar-corrupt, unsigned-substitution) refuses
+  // replay unless --force-replay is set. A predicate of only
+  // `verify.signed && !verify.verified` would miss corrupt-JSON sidecars
+  // and substituted "unsigned" sidecars on a host WITH a private key —
+  // both of which let replay proceed against forged input.
   const isSignedTamper = verify.signed && !verify.verified;
-  const isClassTamper = !verify.signed && (verify.tamper_class === "sidecar-corrupt" || verify.tamper_class === "unsigned-substitution");
+  const isClassTamper = !verify.signed && (
+    verify.tamper_class === "sidecar-corrupt"
+    || verify.tamper_class === "unsigned-substitution"
+    // Extend tamper-class refusal to algorithm-unsupported sidecars —
+    // anything other than "Ed25519" or "unsigned". Without explicit
+    // refusal, a sidecar that throws inside crypto.verify (e.g.
+    // signature_base64 missing on a downgrade-bait shape) emerges as
+    // signed:true + verified:false through the catch block by accident.
+    // The strict pre-check surfaces the class directly; refuse on it too.
+    || verify.tamper_class === "algorithm-unsupported"
+  );
   if ((isSignedTamper || isClassTamper) && !args["force-replay"]) {
     process.stderr.write(`[exceptd reattest] TAMPERED: attestation at ${attFile} failed Ed25519 verification (${verify.reason}). Refusing to replay against forged input. Pass --force-replay to override (the replay output records sidecar_verify so the audit trail captures the override).\n`);
     const body = {
@@ -3441,7 +3676,7 @@ function cmdReattest(runner, args, runOpts, pretty) {
   } else if (!verify.signed && verify.reason && verify.reason.includes("no .sig sidecar") && args["force-replay"]) {
     process.stderr.write(`[exceptd reattest] WARNING: --force-replay overriding missing .sig sidecar on ${attFile}. The replay output records sidecar_verify so the override is audit-visible.\n`);
   } else if (!verify.signed && verify.reason && verify.reason.startsWith("attestation explicitly unsigned") && !args["force-replay"]) {
-    // Audit AA P1-1: legitimately-unsigned attestations (written when the
+    // legitimately-unsigned attestations (written when the
     // attesting host had no private key) require --force-replay to consume.
     // Pre-fix, the NOTE branch accepted them silently — which let an
     // attacker swap a valid .sig with the unsigned stub on a host that
@@ -3520,6 +3755,85 @@ function cmdReattest(runner, args, runOpts, pretty) {
     }
   }
 
+  const replayedAt = new Date().toISOString();
+  const sidecarVerifyClass = classifySidecarVerify(verify);
+  const forceReplay = !!args["force-replay"];
+
+  // Persist a `replay-<isoZ>.json` record under the session directory for
+  // every cmdReattest replay verdict. Without disk persistence, a
+  // force-replay override emitted to stdout becomes invisible to any
+  // subsequent auditor once the operator's shell closes. Each replay
+  // writes a new file alongside the original attestation.json, signed via
+  // the standard maybeSignAttestation path so the audit chain remains
+  // tamper-evident. The file is picked up automatically by
+  // `attest verify <sid>` (which iterates every *.json under the session
+  // dir).
+  //
+  // Filename shape: ISO-8601 uses ':' which the persistAttestation regex
+  // refuses; substitute ':' with '-' and keep millisecond precision so
+  // multiple replays in the same second do not collide on EEXIST. The
+  // resulting filename satisfies /^[A-Za-z0-9._-]{1,64}\.json$/.
+  const replayBaseName = "replay-" + replayedAt.replace(/:/g, "-");
+  const replayBody = {
+    kind: "replay",
+    session_id: sessionId,
+    playbook_id: prior.playbook_id,
+    directive_id: prior.directive_id,
+    status,
+    prior_evidence_hash: priorHash,
+    replay_evidence_hash: newHash,
+    prior_captured_at: prior.captured_at,
+    replayed_at: replayedAt,
+    replay_classification: replay.phases && replay.phases.detect && replay.phases.detect.classification,
+    replay_rwep_adjusted: replay.phases && replay.phases.analyze && replay.phases.analyze.rwep && replay.phases.analyze.rwep.adjusted,
+    sidecar_verify: verify,
+    sidecar_verify_class: sidecarVerifyClass,
+    force_replay: forceReplay,
+  };
+  let replayPersisted = null;
+  let replayPath = null;
+  try {
+    // Retry on EEXIST: two concurrent reattests sharing the same
+    // millisecond timestamp would collide on the base name. Append a short
+    // random suffix until O_EXCL accepts the write or the cap is exhausted.
+    const dir = path.dirname(attFile);
+    const MAX_SUFFIX_TRIES = 8;
+    let written = false;
+    let lastErr = null;
+    for (let i = 0; i < MAX_SUFFIX_TRIES; i++) {
+      const suffix = i === 0 ? "" : "-" + crypto.randomBytes(3).toString("hex");
+      const candidate = path.join(dir, replayBaseName + suffix + ".json");
+      try {
+        fs.writeFileSync(candidate, JSON.stringify(replayBody, null, 2), { flag: "wx" });
+        replayPath = candidate;
+        written = true;
+        break;
+      } catch (e) {
+        lastErr = e;
+        if (!e || e.code !== "EEXIST") throw e;
+      }
+    }
+    if (!written) throw lastErr || new Error("replay-record write: EEXIST after " + MAX_SUFFIX_TRIES + " attempts");
+    replayPersisted = { ok: true, path: replayPath, sidecar_signed: true };
+  } catch (e) {
+    // Non-fatal — stdout emit is the operator's primary surface; a
+    // disk-persistence failure shouldn't mask the verdict. Surface the
+    // condition in the response body so an operator-side audit pipeline
+    // can re-run the persist later.
+    replayPersisted = { ok: false, error: String((e && e.message) || e) };
+  }
+  if (replayPersisted && replayPersisted.ok && replayPath) {
+    // Sidecar signing is best-effort: the unsigned replay record on disk
+    // is still a valid audit-trail entry. Split from the write try{} so a
+    // sign-time failure doesn't mask a successful write.
+    try {
+      maybeSignAttestation(replayPath);
+    } catch (e) {
+      replayPersisted.sidecar_signed = false;
+      replayPersisted.sidecar_sign_error = String((e && e.message) || e);
+    }
+  }
+
   emit({
     ok: true,
     verb: "reattest",
@@ -3530,13 +3844,13 @@ function cmdReattest(runner, args, runOpts, pretty) {
     prior_evidence_hash: priorHash,
     replay_evidence_hash: newHash,
     prior_captured_at: prior.captured_at,
-    replayed_at: new Date().toISOString(),
+    replayed_at: replayedAt,
     replay_classification: replay.phases && replay.phases.detect && replay.phases.detect.classification,
     replay_rwep_adjusted: replay.phases && replay.phases.analyze && replay.phases.analyze.rwep && replay.phases.analyze.rwep.adjusted,
-    // F10: persist the sidecar verify result + the force-replay flag so the
+    // Persist the sidecar verify result + the force-replay flag so the
     // audit trail records whether the replay was authenticated input.
     sidecar_verify: verify,
-    // Audit AA P1-1: emit a one-token classification label alongside the
+    // emit a one-token classification label alongside the
     // full sidecar_verify object so log scrapers / dashboards can filter on
     // override events without parsing reason strings. Values:
     //   'verified'             — Ed25519 sidecar verified
@@ -3544,16 +3858,22 @@ function cmdReattest(runner, args, runOpts, pretty) {
     //   'sidecar-corrupt'      — sidecar JSON parse failure (tamper class)
     //   'unsigned-substitution'— "unsigned" sidecar on a host with private key
     //                            (substitution attack signal)
+    //   'algorithm-unsupported'— sidecar algorithm field is neither "Ed25519"
+    //                            nor "unsigned" (downgrade-bait substitution)
     //   'explicitly-unsigned'  — legitimately-unsigned attestation
     //   'no-sidecar'           — sidecar file absent
     //   'no-public-key'        — infra-missing (operator-side keys/public.pem absent)
-    sidecar_verify_class: classifySidecarVerify(verify),
-    force_replay: !!args["force-replay"],
+    sidecar_verify_class: sidecarVerifyClass,
+    force_replay: forceReplay,
+    // Surface the persisted replay-record path (or persistence failure
+    // reason) so an auditor reading the CLI response can locate the
+    // on-disk artifact without re-deriving the filename.
+    replay_persisted: replayPersisted,
   }, pretty);
 }
 
 /**
- * Audit AA P1-1: map a verifyAttestationSidecar() result to a one-token
+ * map a verifyAttestationSidecar() result to a one-token
  * classification label. The label is persisted alongside the full
  * sidecar_verify object so auditors can filter override events by class
  * without regexing the human-readable reason string.
@@ -3564,6 +3884,9 @@ function classifySidecarVerify(verify) {
   if (verify.signed && !verify.verified) return "tampered";
   if (verify.tamper_class === "sidecar-corrupt") return "sidecar-corrupt";
   if (verify.tamper_class === "unsigned-substitution") return "unsigned-substitution";
+  // `algorithm-unsupported` is its own class label so log scrapers /
+  // dashboards can filter downgrade-bait events without parsing the reason.
+  if (verify.tamper_class === "algorithm-unsupported") return "algorithm-unsupported";
   if (typeof verify.reason === "string" && verify.reason.startsWith("attestation explicitly unsigned")) return "explicitly-unsigned";
   if (typeof verify.reason === "string" && verify.reason.includes("no .sig sidecar")) return "no-sidecar";
   if (typeof verify.reason === "string" && verify.reason.includes("no public key")) return "no-public-key";
@@ -3595,12 +3918,12 @@ function cmdAttest(runner, args, runOpts, pretty) {
   if (!sessionId) {
     return emitError(`attest ${subverb}: missing <session-id> positional argument.`, null, pretty);
   }
-  // R-F7: distinguish "validation rejected" from "valid format but not
-  // found". findSessionDir() returns null for BOTH (regex-rejected ids
-  // collapse to the "no session dir" message), which gives operators a
-  // misleading error — a string with `..` or `/` looks to them like an
-  // existing-session lookup that failed, not a refusal. Call the same
-  // validator up front; emit its specific message when it throws.
+  // Distinguish "validation rejected" from "valid format but not found".
+  // findSessionDir() returns null for BOTH (regex-rejected ids collapse to
+  // the "no session dir" message), which gives operators a misleading
+  // error — a string with `..` or `/` looks to them like an existing-
+  // session lookup that failed, not a refusal. Call the same validator
+  // up front; emit its specific message when it throws.
   try { validateSessionIdForRead(sessionId); }
   catch (e) {
     return emitError(`attest ${subverb}: ${e.message}`, { session_id_input: typeof sessionId === "string" ? sessionId.slice(0, 80) : typeof sessionId }, pretty);
@@ -3611,13 +3934,24 @@ function cmdAttest(runner, args, runOpts, pretty) {
   }
 
   const files = fs.readdirSync(dir).filter(f => f.endsWith(".json") && !f.endsWith(".sig"));
-  const attestations = files.map(f => {
-    try { return JSON.parse(fs.readFileSync(path.join(dir, f), "utf8")); }
-    catch { return null; }
-  }).filter(Boolean);
+  // Partition session-dir JSON files by parsed `kind` field. Replay records
+  // (written by `cmdReattest`) live alongside attestations under the same
+  // session directory but represent audit-trail entries, not separate
+  // sessions. Gate on the parsed payload — not filename prefix — so a
+  // renamed file cannot smuggle a replay into the attestations[] list.
+  const attestations = [];
+  const replays = [];
+  for (const f of files) {
+    let parsed;
+    try { parsed = JSON.parse(fs.readFileSync(path.join(dir, f), "utf8")); }
+    catch { continue; }
+    if (!parsed) continue;
+    if (parsed.kind === "replay") replays.push(parsed);
+    else attestations.push(parsed);
+  }
 
   if (subverb === "show") {
-    emit({ session_id: sessionId, attestations }, pretty);
+    emit({ session_id: sessionId, attestations, attestation_replays: replays }, pretty);
     return;
   }
 
@@ -3632,10 +3966,22 @@ function cmdAttest(runner, args, runOpts, pretty) {
         return emitError(`attest diff --against ${args.against}: no session dir found.`, null, pretty);
       }
       const otherFiles = fs.readdirSync(otherDir).filter(f => f.endsWith(".json") && !f.endsWith(".sig"));
-      if (otherFiles.length === 0) {
+      // Skip replay-record files: those carry `kind: 'replay'` and are
+      // audit-trail entries rather than attestations. Without this gate
+      // a replay file sorted ahead of attestation.json would shadow the
+      // real attestation in the diff.
+      let other = null;
+      for (const f of otherFiles) {
+        try {
+          const parsed = JSON.parse(fs.readFileSync(path.join(otherDir, f), "utf8"));
+          if (parsed && parsed.kind === "replay") continue;
+          other = parsed;
+          break;
+        } catch { /* skip malformed */ }
+      }
+      if (!other) {
         return emitError(`attest diff --against ${args.against}: no attestations under that session id.`, null, pretty);
       }
-      const other = JSON.parse(fs.readFileSync(path.join(otherDir, otherFiles[0]), "utf8"));
       const self = attestations[0];
       emit({
         verb: "attest diff",
@@ -3689,7 +4035,7 @@ function cmdAttest(runner, args, runOpts, pretty) {
         pretty
       );
     }
-    // Audit AA P1-1: on the verifying host, detect "unsigned" sidecar
+    // on the verifying host, detect "unsigned" sidecar
     // substitution by checking whether .keys/private.pem is present. A
     // legitimately-unsigned attestation cannot coexist with a private key on
     // the same host — that combination is sidecar substitution (attacker
@@ -3699,7 +4045,7 @@ function cmdAttest(runner, args, runOpts, pretty) {
     const results = files.map(f => {
       const sigPath = path.join(dir, f + ".sig");
       if (!fs.existsSync(sigPath)) return { file: f, signed: false, verified: false, reason: "no .sig sidecar" };
-      // Audit AA P1-2: wrap JSON.parse so a corrupt sidecar surfaces as a
+      // wrap JSON.parse so a corrupt sidecar surfaces as a
       // structured tamper-class result (signed:false, verified:false,
       // tamper_class:"sidecar-corrupt") rather than throwing into the outer
       // dispatcher catch → exit 1. Pre-fix, a corrupt .sig produced a
@@ -3717,7 +4063,7 @@ function cmdAttest(runner, args, runOpts, pretty) {
         };
       }
       if (sigDoc.algorithm === "unsigned") {
-        // Audit AA P1-1: substitution detection.
+        // substitution detection.
         if (hasPrivKey) {
           return {
             file: f,
@@ -3729,9 +4075,23 @@ function cmdAttest(runner, args, runOpts, pretty) {
         }
         return { file: f, signed: false, verified: false, reason: "attestation explicitly unsigned (no private key when written)" };
       }
+      // Strict algorithm check (mirrors verifyAttestationSidecar). Anything
+      // that isn't exactly "Ed25519" or "unsigned" is refused as
+      // tamper-class; null / "RSA-PSS" / arrays would otherwise fall through
+      // to crypto.verify with Ed25519 defaults, producing either an opaque
+      // verify-throw or a downgrade-bait acceptance path.
+      if (sigDoc.algorithm !== "Ed25519") {
+        return {
+          file: f,
+          signed: false,
+          verified: false,
+          reason: "unsupported algorithm: " + JSON.stringify(sigDoc.algorithm),
+          tamper_class: "algorithm-unsupported",
+        };
+      }
       if (!pubKey) return { file: f, signed: true, verified: false, reason: "no public key at keys/public.pem to verify against" };
-      // C: normalize before crypto.verify — mirrors the signer
-      // path so the verify pair is byte-stable across CRLF / BOM churn.
+      // Normalize before crypto.verify — mirrors the signer path so the
+      // verify pair is byte-stable across CRLF / BOM churn.
       const rawContent = fs.readFileSync(path.join(dir, f), "utf8");
       const content = normalizeAttestationBytes(rawContent);
       try {
@@ -3743,23 +4103,23 @@ function cmdAttest(runner, args, runOpts, pretty) {
         return { file: f, signed: true, verified: false, reason: `verify error: ${e.message}` };
       }
     });
-    // R-F1: when ANY result is signed-but-failed-verify, surface ok:false
-    // AND set exit 6 for parity with cmdReattest's TAMPERED code. Pre-fix,
-    // `attest verify` emitted {verb, session_id, results} without ok:false
-    // and exited 0 — operators piping through `set -e` saw no failure
-    // signal even when an attestation had been forged. emit()'s ok:false
-    // → exitCode = 1 auto-promotion would stop at 1; tamper is distinct
-    // from generic failure, so explicitly raise to 6 (cmdReattest's code).
+    // When ANY result is signed-but-failed-verify, surface ok:false AND
+    // set exit 6 for parity with cmdReattest's TAMPERED code. The
+    // ok:false → exitCode = 1 auto-promotion would stop at 1; tamper is
+    // distinct from generic failure, so explicitly raise to 6.
     //
-    // Audit AA P1-1 + P1-2: extend the tamper predicate to cover the new
-    // tamper_class variants. Pre-fix the predicate was `r.signed && !r.verified`
-    // which missed (a) corrupt-JSON sidecars (signed:false) and (b) "unsigned"
-    // sidecar substitution on hosts with a private key (signed:false). Both
-    // are tamper-class events and must promote to exit 6.
+    // The tamper predicate covers every tamper_class variant — bare
+    // `r.signed && !r.verified` would miss (a) corrupt-JSON sidecars
+    // (signed:false) and (b) "unsigned" sidecar substitution on hosts with
+    // a private key (signed:false). Both are tamper-class events and must
+    // promote to exit 6.
     const tampered = results.some(r =>
       (r.signed && !r.verified)
       || r.tamper_class === "sidecar-corrupt"
       || r.tamper_class === "unsigned-substitution"
+      // A sidecar whose algorithm field is not "Ed25519" or "unsigned" is
+      // a downgrade-bait substitution; promote to exit 6.
+      || r.tamper_class === "algorithm-unsupported"
     );
     const body = { verb: "attest verify", session_id: sessionId, results };
     if (tampered) {
@@ -4561,8 +4921,9 @@ function cmdListAttestations(runner, args, runOpts, pretty) {
   // Prior behavior silently accepted any string and lexically compared to
   // captured_at, producing 0-result or full-result depending on the string.
   if (args.since != null) {
-    // R-F10: regex BEFORE Date.parse — bare integers like "99" would
-    // otherwise parse as the year 1999 and silently filter wrong eras.
+    // ISO-8601 shape regex BEFORE Date.parse — bare integers like "99"
+    // would otherwise parse as the year 1999 and silently filter wrong
+    // eras.
     const sinceErr = validateIsoSince(args.since);
     if (sinceErr) return emitError(`attest list: ${sinceErr}`, null, pretty);
   }
@@ -4583,6 +4944,11 @@ function cmdListAttestations(runner, args, runOpts, pretty) {
       for (const f of files) {
         try {
           const j = JSON.parse(fs.readFileSync(path.join(sdir, f), "utf8"));
+          // replay-<isoZ>.json records share the session dir with
+          // attestation.json but are not separate sessions. Gate on the
+          // parsed `kind` field rather than filename so a rename cannot
+          // smuggle a replay record into the listing.
+          if (j && j.kind === "replay") continue;
           // v0.12.14: normalized array-set filter (see top of fn).
           if (playbookFilter && !playbookFilter.has(j.playbook_id)) continue;
           if (args.since && (j.captured_at || "") < args.since) continue;
@@ -4660,7 +5026,7 @@ function cmdAiRun(runner, args, runOpts, pretty) {
     directPhase = runner.direct(playbookId, directiveId);
     lookPhase = runner.look(playbookId, directiveId, runOpts);
   } catch (e) {
-    // v0.12.12 (T8): process.exit(1) immediately after a stdout write can
+    // process.exit(1) immediately after a stdout write can
     // truncate buffered output under piped consumers (same class as v0.11.10
     // #100). Use exitCode+return so the JSONL error frame drains. Also write
     // the framed error event so the stdout-only JSONL contract holds — host
@@ -4709,7 +5075,7 @@ function cmdAiRun(runner, args, runOpts, pretty) {
       try { payload = readEvidence(args.evidence); }
       catch (e) { return emitError(`ai-run: failed to read --evidence: ${e.message}`, null, pretty); }
     } else if (hasReadableStdin()) {
-      // EE P1-7: hasReadableStdin() probes via fstat before falling into
+      // hasReadableStdin() probes via fstat before falling into
       // readFileSync(0). Wrapped-stdin test harnesses (isTTY===undefined,
       // size===0) would otherwise hang here.
       // Drain stdin for any evidence event.
@@ -4758,13 +5124,21 @@ function cmdAiRun(runner, args, runOpts, pretty) {
     // or `reattest` with the returned id. Now: same persistAttestation
     // shape as cmdRun, so AI-facing flow round-trips cleanly.
     if (result.session_id) {
+      // Mirror cmdRun: gate operator_consent on classification === 'detected'.
+      const aiClassification = result.phases && result.phases.detect ? result.phases.detect.classification : null;
+      const aiConsentApplies = aiClassification === "detected";
+      if (runOpts.operator_consent && !aiConsentApplies) {
+        result.ack = true;
+        result.ack_applied = false;
+        result.ack_skipped_reason = `classification=${aiClassification || "unknown"}; consent only persisted when classification=detected (jurisdiction clock at stake).`;
+      }
       const persistResult = persistAttestation({
         sessionId: result.session_id,
         playbookId: result.playbook_id || playbookId,
         directiveId: result.directive_id || directiveId,
         evidenceHash: result.evidence_hash,
         operator: runOpts.operator,
-        operatorConsent: runOpts.operator_consent,
+        operatorConsent: aiConsentApplies ? runOpts.operator_consent : null,
         submission,
         runOpts,
         forceOverwrite: !!args["force-overwrite"],
@@ -4773,12 +5147,21 @@ function cmdAiRun(runner, args, runOpts, pretty) {
       if (!persistResult.ok && !args["force-overwrite"]) {
         // Collision without --force-overwrite. AI agents typically pass
         // unique session ids each run, so this path is rare but surface
-        // it cleanly via the same JSONL contract.
-        process.stdout.write(JSON.stringify({
+        // it cleanly via the same JSONL contract. Preserve LOCK_CONTENTION
+        // exit 8 set by persistAttestation when --force-overwrite hit the
+        // lockfile race — don't clobber with exit 3.
+        const eventBody = {
           event: "error", reason: persistResult.error,
           existing_attestation: persistResult.existingPath,
-        }) + "\n");
-        process.exitCode = 3;
+        };
+        if (persistResult.lock_contention) {
+          eventBody.lock_contention = true;
+          eventBody.exit_code = 8;
+        }
+        process.stdout.write(JSON.stringify(eventBody) + "\n");
+        if (!persistResult.lock_contention) {
+          process.exitCode = 3;
+        }
         return;
       }
     }
@@ -4862,21 +5245,31 @@ function cmdAiRun(runner, args, runOpts, pretty) {
     // too. Without this, the session_id emitted in the `done` frame
     // can't be resolved by `attest show / verify / diff` or `reattest`.
     if (result.session_id) {
+      // Mirror cmdRun: gate operator_consent on classification === 'detected'.
+      const aiClassification = result.phases && result.phases.detect ? result.phases.detect.classification : null;
+      const aiConsentApplies = aiClassification === "detected";
       const persistResult = persistAttestation({
         sessionId: result.session_id,
         playbookId: result.playbook_id || playbookId,
         directiveId: result.directive_id || directiveId,
         evidenceHash: result.evidence_hash,
         operator: runOpts.operator,
-        operatorConsent: runOpts.operator_consent,
+        operatorConsent: aiConsentApplies ? runOpts.operator_consent : null,
         submission,
         runOpts,
         forceOverwrite: !!args["force-overwrite"],
         filename: "attestation.json",
       });
       if (!persistResult.ok && !args["force-overwrite"]) {
-        writeLine({ event: "error", reason: persistResult.error,
-                    existing_attestation: persistResult.existingPath });
+        const eventBody = { event: "error", reason: persistResult.error,
+                            existing_attestation: persistResult.existingPath };
+        if (persistResult.lock_contention) {
+          eventBody.lock_contention = true;
+          eventBody.exit_code = 8;
+          writeLine(eventBody);
+          return finish(8);
+        }
+        writeLine(eventBody);
         return finish(3);
       }
     }
@@ -5176,9 +5569,9 @@ function cmdCi(runner, args, runOpts, pretty) {
   const results = [];
   let fail = false;
   let failReasons = [];
-  // F18: track jurisdiction-clock signals separately from generic FAIL so the
-  // exit code can distinguish "detected/escalated" (2) from "regulatory clock
-  // running, operator must notify" (5). Pre-fix the two collapsed into exit 2.
+  // Track jurisdiction-clock signals separately from generic FAIL so the
+  // exit code can distinguish "detected/escalated" (2) from "regulatory
+  // clock running, operator must notify" (5).
   let clockStartedFail = false;
   let clockStartedReasons = [];
 
@@ -5232,11 +5625,10 @@ function cmdCi(runner, args, runOpts, pretty) {
       failReasons.push(`${id}: rwep_delta=${rwepAdj - rwepBase} >= cap=${cap} (classification=inconclusive; operator evidence raised the score)`);
     }
     if (blockOnClock && clockStarted) {
-      // F18: separate "clock started" from generic FAIL. Pre-fix this collapsed
-      // into exit 2 (FAIL), so operators couldn't distinguish "playbook
-      // detected" from "regulatory clock running." Tracked separately and
-      // exit 5 (CLOCK_STARTED) is selected below, taking precedence over
-      // FAIL but not BLOCKED.
+      // Separate "clock started" from generic FAIL: exit 5 (CLOCK_STARTED)
+      // is selected below, taking precedence over FAIL but not BLOCKED, so
+      // operators can distinguish "playbook detected" from "regulatory
+      // clock running."
       clockStartedFail = true;
       clockStartedReasons.push(`${id}: jurisdiction clock started`);
     }
@@ -5256,7 +5648,7 @@ function cmdCi(runner, args, runOpts, pretty) {
   const inconclusiveCount = results.filter(r => r.phases?.detect?.classification === "inconclusive").length;
   const totalForVerdict = results.length;
   const noEvidenceAllInconclusive = !suppliedEvidenceForVerdict && totalForVerdict > 0 && inconclusiveCount === totalForVerdict;
-  // F18: precedence — BLOCKED > CLOCK_STARTED > FAIL > NO_EVIDENCE > PASS.
+  // Precedence: BLOCKED > CLOCK_STARTED > FAIL > NO_EVIDENCE > PASS.
   // CLOCK_STARTED outranks FAIL because the operator explicitly opted into
   // the clock gate (--block-on-jurisdiction-clock); when that gate fires,
   // they want the regulatory-deadline signal even if a detected finding
@@ -5312,11 +5704,11 @@ function cmdCi(runner, args, runOpts, pretty) {
       .filter(n => n && n.clock_started_at != null).length,
     framework_gap_rollup: frameworkGapRollup,
     framework_gap_count: frameworkGapRollup.length,
-    // F13: dedupe jurisdiction-clock notifications across playbooks; see
-    // buildJurisdictionClockRollup. Multi-playbook ci runs were producing
-    // one notification entry per contributing playbook (often 8+) when a
-    // single notification per (jurisdiction, regulation, obligation,
-    // window) was the right shape.
+    // Dedupe jurisdiction-clock notifications across playbooks; see
+    // buildJurisdictionClockRollup. Without this, multi-playbook ci runs
+    // produce one notification entry per contributing playbook (often 8+)
+    // when a single notification per (jurisdiction, regulation,
+    // obligation, window) is the right shape.
     jurisdiction_clock_rollup: buildJurisdictionClockRollup(results),
     verdict: computedVerdict,
     fail_reasons: failReasons,
@@ -5380,7 +5772,7 @@ function cmdCi(runner, args, runOpts, pretty) {
     process.exitCode = 4;
     return;
   }
-  // F18: precedence BLOCKED > CLOCK_STARTED > FAIL. The operator opted into
+  // Precedence: BLOCKED > CLOCK_STARTED > FAIL. The operator opted into
   // --block-on-jurisdiction-clock; when a clock fires, that's the gate
   // result they want to see at the exit-code layer. Per-playbook detected
   // findings remain in the body for them to investigate.