@haposoft/cafekit 0.16.0-rc.2 → 0.16.0-rc.4

package/bin/__tests__/develop-contract.test.js

@@ -6,18 +6,263 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { spawnSync } = require('node:child_process');
-const { test } = require('node:test');
+const { test, after } = require('node:test');
 
 const PACKAGE_ROOT = path.join(__dirname, '../..');
 const POLICY_PATH = path.join(PACKAGE_ROOT, 'src/claude/scripts/workflow-policy.cjs');
 const POLICY = require(POLICY_PATH);
+const PROVENANCE_HELPER = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/provenance.cjs'));
+const FINAL_STATE = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-final-state.cjs'));
+const VALIDATOR = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/validate-spec-output.cjs'));
+const GROUNDER = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-ground.cjs'));
+const SEMANTIC_AUTHORITY = require(path.join(PACKAGE_ROOT, 'src/claude/hooks/semantic-review-authority.cjs'));
+const READINESS = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-readiness.cjs'));
+const { copyClaudeTestRuntime } = require('./test-runtime-dependency-closure.cjs');
 const DEVELOP = path.join(PACKAGE_ROOT, 'src/claude/skills/develop/SKILL.md');
+const SPECS = path.join(PACKAGE_ROOT, 'src/claude/skills/specs/SKILL.md');
+const SCAFFOLD = path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-scaffold.cjs');
 const GATE = path.join(PACKAGE_ROOT, 'src/claude/skills/develop/references/quality-gate.md');
 const TEST_SKILL = path.join(PACKAGE_ROOT, 'src/claude/skills/test/SKILL.md');
 const SYNC_SKILL = path.join(PACKAGE_ROOT, 'src/claude/skills/sync/SKILL.md');
 const CODE_REVIEW_SKILL = path.join(PACKAGE_ROOT, 'src/claude/skills/code-review/SKILL.md');
 const PARALLEL_WAVES = path.join(PACKAGE_ROOT, 'src/claude/skills/develop/references/parallel-waves.md');
 const PROVENANCE = path.join(PACKAGE_ROOT, '../../docs/provenance.md');
+const RUNTIME_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-policy-runtime-'));
+const RUNTIME_SPEC = path.join(RUNTIME_ROOT, 'specs', 'demo', 'spec.json');
+fs.mkdirSync(path.dirname(RUNTIME_SPEC), { recursive: true });
+fs.mkdirSync(path.join(RUNTIME_ROOT, 'src'), { recursive: true });
+fs.writeFileSync(path.join(RUNTIME_ROOT, 'src', 'app.js'), 'runtime fixture\n');
+fs.writeFileSync(RUNTIME_SPEC, JSON.stringify({ status: 'in_progress', feature_name: 'demo', task_registry: {} }));
+for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test'], ['add', '-A'], ['commit', '-qm', 'fixture']]) {
+  const result = spawnSync('git', ['-C', RUNTIME_ROOT, ...args], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+}
+const RUNTIME_CONTEXT = PROVENANCE_HELPER.deriveRuntimeContext({
+  projectRoot: RUNTIME_ROOT,
+  specsRoot: path.join(RUNTIME_ROOT, 'specs'),
+  specFile: RUNTIME_SPEC,
+  featureName: 'demo',
+  runtimeSession: 'implementation-session-1',
+});
+after(() => fs.rmSync(RUNTIME_ROOT, { recursive: true, force: true }));
+const EXPECTED_BASE = RUNTIME_CONTEXT.base;
+const EXPECTED_HEAD = RUNTIME_CONTEXT.head;
+const EXPECTED_PROVENANCE = { base: EXPECTED_BASE, head: EXPECTED_HEAD };
+const RECEIPT_BINDING = POLICY.createReceiptBinding(RUNTIME_CONTEXT);
+
+function initFixtureGit(root) {
+  for (const args of [['init', '-q'], ['config', 'user.email', 'cafekit@example.invalid'], ['config', 'user.name', 'CafeKit Test'], ['add', '-A'], ['commit', '-qm', 'fixture']]) {
+    const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+    assert.equal(result.status, 0, result.stderr);
+  }
+}
+
+function installClaudeRuntimeClosure(fixtureRoot, entry = 'hooks/spec-gate.cjs') {
+  const destinationRoot = path.join(fixtureRoot, '.claude');
+  copyClaudeTestRuntime(PACKAGE_ROOT, destinationRoot);
+  const hooksRoot = path.join(PACKAGE_ROOT, 'src', 'claude', 'hooks');
+  for (const hook of [
+    'spec-gate.cjs',
+    'completion-authority-check.cjs',
+    'completion-authority-state.cjs',
+    'semantic-review-authority.cjs',
+  ]) {
+    const target = path.join(destinationRoot, 'hooks', hook);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.copyFileSync(path.join(hooksRoot, hook), target);
+  }
+  return path.join(destinationRoot, entry);
+}
+
+function markdownSection(content, heading) {
+  const marker = `## ${heading}`;
+  const start = content.indexOf(marker);
+  assert.notEqual(start, -1, `missing section ${heading}`);
+  const rest = content.slice(start + marker.length);
+  const end = rest.search(/\n## /);
+  return end === -1 ? rest : rest.slice(0, end);
+}
+
+function markdownTable(section, firstHeader) {
+  const lines = section.split('\n').filter((line) => line.trim().startsWith('|'));
+  const cells = (line) => line.split('|').slice(1, -1).map((cell) => cell.trim());
+  const headerIndex = lines.findIndex((line) => cells(line)[0] === firstHeader);
+  assert.notEqual(headerIndex, -1, `missing table headed by ${firstHeader}`);
+  const headers = cells(lines[headerIndex]);
+  const rows = {};
+  for (const line of lines.slice(headerIndex + 2)) {
+    const values = cells(line);
+    if (values.length !== headers.length) break;
+    rows[values[0].replaceAll('`', '')] = Object.fromEntries(headers.map((header, index) => [header, values[index]]));
+  }
+  return rows;
+}
+
+function runNode(root, script, args) {
+  return spawnSync(process.execPath, [script, ...args], { cwd: root, encoding: 'utf8' });
+}
+
+function commandOutput(result) {
+  return `${result.stdout}\n${result.stderr}`;
+}
+
+function createCanonicalAuthoringFixture() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-develop-contract-'));
+  fs.mkdirSync(path.join(root, 'src'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'test'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'artifacts'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'src', 'entry.js'), 'module.exports = { enabled: true };\n');
+  fs.writeFileSync(path.join(root, 'test', 'service.test.js'), 'require("node:test")("service", () => {});\n');
+  const scaffold = runNode(root, SCAFFOLD, ['feature']);
+  assert.equal(scaffold.status, 0, commandOutput(scaffold));
+  const specDir = path.join(root, 'specs', 'feature');
+  const specPath = path.join(specDir, 'spec.json');
+  fs.writeFileSync(path.join(specDir, 'requirements.md'), `# Requirements
+
+## Requirements
+### Requirement 1: Observable service behavior
+- **R1.1**: When valid input arrives, the service shall return enabled state; invalid input shall return rejected state.
+- **R1.2**: The verifier shall produce separate observable proof for enabled and rejected states.
+`);
+  fs.writeFileSync(path.join(specDir, 'design.md'), `# Design
+
+## Architecture
+The entrypoint exposes the bounded service behavior and a separate proof artifact.
+
+## Typed Anchors
+| ID | Type | Target | Role | Access | Action |
+|---|---|---|---|---|---|
+| A-D-01 | file | \`src/entry.js\` | service boundary | read | read |
+| A-D-02 | artifact | \`artifacts/design-proof.json\` | proof evidence | write | create |
+
+## Canonical Contracts & Invariants
+### D1 — Dispatch decision
+The entrypoint dispatches exactly once.
+### I1 — Invalid-state invariant
+Invalid input never returns enabled state.
+### C1 — Result contract
+The result contains one enabled boolean.
+
+## Verification Definitions
+- **V1**: Subject criteria R1.1; Subject owner A-D-01; Proof criteria R1.2; Proof owner A-D-02; Evidence anchor A-D-02; Decision refs D1, I1, C1; Method command \`node --test test/service.test.js\`; Expected exit 0 with enabled state and separate proof evidence; Negative/failure invalid input returns rejected state without enabled output; Reachability/grounding entrypoint \`src/entry.js\` via A-D-01, A-D-02.
+`);
+  return { root, specDir, specPath };
+}
+
+function createOrdinaryAuthoringFixture() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-ordinary-readiness-'));
+  fs.mkdirSync(path.join(root, 'src'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'test'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'src', 'entry.js'), 'module.exports = { action: "delete" };\n');
+  fs.writeFileSync(path.join(root, 'test', 'entry.test.js'), 'require("node:test")("entry", () => {});\n');
+  const scaffold = runNode(root, SCAFFOLD, ['ordinary']);
+  assert.equal(scaffold.status, 0, commandOutput(scaffold));
+  const specDir = path.join(root, 'specs', 'ordinary');
+  const specPath = path.join(specDir, 'spec.json');
+  fs.writeFileSync(path.join(specDir, 'requirements.md'), `# Requirements
+
+## Requirements
+### Requirement 1: Delete behavior
+- **R1.1**: When deletion is requested, the service shall delete the selected record and report deleted state.
+`);
+  fs.writeFileSync(path.join(specDir, 'design.md'), `# Design
+
+## Typed Anchors
+| ID | Type | Target | Role | Access | Action |
+|---|---|---|---|---|---|
+| A-D-01 | file | \`src/entry.js\` | behavior owner | read | read |
+
+## Canonical Contracts & Invariants
+### D1 — Delete decision
+The selected record is deleted rather than archived.
+### I1 — State invariant
+Deleted state is reported only after deletion succeeds.
+### C1 — Result contract
+The result contains the literal deleted state.
+
+## Verification Definitions
+- **V1**: Criteria R1.1; Owner A-D-01; Decision refs D1, I1, C1; Method command \`node --test test/entry.test.js\`; Expected exit 0 and the service reports deleted state; Negative/failure a missing record returns not-found without deleted state; Reachability/grounding entrypoint \`src/entry.js\` via A-D-01.
+`);
+  const spec = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+  spec.authoring.requirements = 'validated';
+  spec.authoring.design = 'validated';
+  fs.writeFileSync(specPath, `${JSON.stringify(spec, null, 2)}\n`);
+  initFixtureGit(root);
+  return { root, specDir, specPath };
+}
+
+function ordinaryReview() {
+  return {
+    reviewed_criteria: ['R1.1'],
+    counterexamples: [{
+      criterion: 'R1.1', case_kind: 'failure',
+      scenario: 'Deletion targets a record that does not exist in the current store.',
+      expected: 'The service returns not-found and never reports the record as deleted.',
+      decision_refs: ['D1', 'I1', 'C1'], verification_ref: 'V1',
+    }],
+  };
+}
+
+function promoteCanonicalModel(fixture) {
+  const result = runNode(fixture.root, SCAFFOLD, ['feature', '--sync-semantic-model']);
+  assert.equal(result.status, 0, commandOutput(result));
+}
+
+function makeCanonicalReady(fixture) {
+  const spec = JSON.parse(fs.readFileSync(fixture.specPath, 'utf8'));
+  spec.authoring.requirements = 'validated';
+  spec.authoring.design = 'validated';
+  fs.writeFileSync(fixture.specPath, `${JSON.stringify(spec, null, 2)}\n`);
+  const result = READINESS.finalizeReadiness({
+    specDir: fixture.specDir,
+    projectRoot: fixture.root,
+    reviewResult: {
+    reviewed_criteria: ['R1.1', 'R1.2'],
+    counterexamples: [{
+      criterion: 'R1.1', case_kind: 'failure',
+      scenario: 'The service receives invalid input without its required discriminator.',
+      expected: 'The service returns rejected state and never emits enabled true.',
+      decision_refs: ['D1', 'I1', 'C1'], verification_ref: 'V1',
+    }, {
+      criterion: 'R1.2', case_kind: 'adversarial',
+      scenario: 'The service reports enabled state without producing separate proof evidence.',
+      expected: 'Verification fails because the independent proof artifact is absent.',
+      decision_refs: ['D1', 'I1', 'C1'], verification_ref: 'V1',
+    }],
+    },
+  });
+  return result.spec;
+}
+
+function bindFixtureReceipt(root, value, feature = 'demo', session = 'test') {
+  const context = PROVENANCE_HELPER.deriveRuntimeContext({
+    projectRoot: root,
+    specsRoot: path.join(root, 'specs'),
+    specFile: path.join(root, 'specs', feature, 'spec.json'),
+    featureName: feature,
+    runtimeSession: session,
+  });
+  return value.replaceAll('0123456789abcdef0123456789abcdef01234567', context.base)
+    .replaceAll('89abcdef0123456789abcdef0123456789abcdef', context.head);
+}
+
+function canonicalReceipt(command = 'pnpm test', extra = '') {
+  return `Verification: PASS\nCommand: ${command}\nExit: 0\nBase: ${EXPECTED_BASE}\nHead: ${EXPECTED_HEAD}\n${extra}`;
+}
+
+function canonicalFlashTask(overrides = {}) {
+  return {
+    status: 'in_progress',
+    receipt: 'FLASH_UNVERIFIED',
+    blocker: 'awaiting /hapo:test <feature>',
+    dependencyBlocked: true,
+    unblocks: false,
+    feature_name: 'demo',
+    runtime_context: RUNTIME_CONTEXT,
+    expected_provenance: { ...EXPECTED_PROVENANCE },
+    ...overrides,
+  };
+}
 
 function read(filePath) {
   return fs.readFileSync(filePath, 'utf8');
@@ -56,16 +301,17 @@ test('develop pre-state guard names executable policy contract', () => {
   assert.match(develop, /flash\+parallel fail-fast/i);
 });
 
-test('delegation plan uses only shipped agents and exact Deep sequence', () => {
-  const shipped = new Set(manifestAgents());
-  assert.deepEqual(POLICY.delegationPlan({ tier: 'Light', mode: 'full-spec', taskCount: 2 }).delegated, []);
-  assert.deepEqual(POLICY.delegationPlan({ tier: 'Standard', mode: 'specific-task' }).delegated, ['code-auditor']);
-  const deep = POLICY.delegationPlan({ tier: 'Deep', mode: 'full-spec', taskCount: 2 }).delegated;
-  assert.deepEqual(deep, [
-    'inspector', 'implementer', 'test-runner', 'code-auditor',
-    'inspector', 'implementer', 'test-runner', 'code-auditor',
-  ]);
-  for (const agent of deep) assert.ok(shipped.has(agent), `Deep agent is not shipped: ${agent}`);
+test('delegation plan consumes legacy tiers as obligations without an agent chain', () => {
+  const light = POLICY.delegationPlan({ tier: 'Light', mode: 'full-spec', taskCount: 2 });
+  const standard = POLICY.delegationPlan({ tier: 'Standard', mode: 'specific-task' });
+  const deep = POLICY.delegationPlan({ tier: 'Deep', mode: 'full-spec', taskCount: 2 });
+  assert.deepEqual(light.proof_obligations, ['needsExecutionProof']);
+  assert.deepEqual(standard.proof_obligations, ['needsExecutionProof']);
+  assert.deepEqual(deep.proof_obligations, ['needsInspection', 'needsExecutionProof', 'needsIndependentAudit']);
+  for (const plan of [light, standard, deep]) {
+    assert.equal(Object.hasOwn(plan, 'delegated'), false);
+    assert.doesNotMatch(JSON.stringify(plan), /inspector|implementer|test-runner|code-auditor/);
+  }
   assert.doesNotMatch(read(GATE), /spec-review|quality-review/);
   assert.doesNotMatch(read(DEVELOP), /spec-review|quality-review/);
 });
@@ -75,42 +321,277 @@ test('lane classifier selects Direct for explicit reversible low-risk work', ()
   assert.equal(result.lane, 'Direct');
   assert.equal(result.automaticLane, 'Direct');
   assert.deepEqual(result.risks, []);
-  assert.deepEqual(POLICY.delegationPlan({ lane: 'Direct' }).delegated, []);
-  assert.equal(POLICY.lanePolicy(result).requiresSpec, false);
+  const policy = POLICY.lanePolicy(result);
+  assert.deepEqual(policy.proof_obligations, ['needsExecutionProof']);
+  assert.equal(policy.artifact_profile, 'targeted');
+  assert.equal(policy.requiresSpec, false);
+  assert.equal(policy.requiresState, false);
+  assert.equal(policy.proof_obligations.includes('needsDurableTaskState'), false);
 });
 
-test('lane classifier forces Critical for named high-risk signals', () => {
+test('lane classifier raises named risks to Elevated without inventing independent-audit authority', () => {
   const result = POLICY.classifyLane({
     reversible: true,
     riskSignals: { auth: true, migration: true, publicContract: true },
   });
-  assert.equal(result.lane, 'Critical');
+  assert.equal(result.lane, 'Standard');
+  assert.equal(result.assuranceLevel, 'Elevated');
+  assert.equal(result.automaticAssuranceLevel, 'Elevated');
   assert.deepEqual(result.risks, ['auth', 'migration', 'publicContract']);
-  assert.deepEqual(POLICY.delegationPlan({ lane: 'Critical' }).delegated, [
-    'inspector', 'implementer', 'test-runner', 'code-auditor',
+  assert.deepEqual(POLICY.lanePolicy(result).proof_obligations, [
+    'needsInspection', 'needsExecutionProof',
   ]);
+
+  const strict = POLICY.classifyLane({
+    riskSignals: { auth: true },
+    assurance_level: 'Strict',
+  });
+  assert.equal(strict.lane, 'Critical');
+  assert.equal(strict.automaticLane, 'Standard');
+  assert.equal(strict.assuranceLevel, 'Strict');
+  assert.equal(strict.automaticAssuranceLevel, 'Elevated');
+  assert.ok(POLICY.lanePolicy(strict).proof_obligations.includes('needsIndependentAudit'));
 });
 
-test('lane override keeps automatic result and surfaces downgrade warning', () => {
-  const result = POLICY.classifyLane({
-    reversible: true,
-    riskSignals: { privacy: true },
+test('P1 persists the minimal v2.1 policy and derives compatibility views', () => {
+  const initial = POLICY.persistWorkflowPolicySnapshot(
+    { feature_name: 'bounded' },
+    { riskSignals: {} },
+  );
+  const snapshot = initial.workflow_policy;
+  assert.deepEqual(Object.keys(snapshot).sort(), [...POLICY.CANONICAL_WORKFLOW_POLICY_FIELDS].sort());
+  assert.equal(snapshot.version, POLICY.CANONICAL_WORKFLOW_POLICY_VERSION);
+  assert.equal(snapshot.planning_depth, 'Compact');
+  assert.equal(snapshot.assurance_level, 'Routine');
+  assert.deepEqual(snapshot.classified_minimum, {
+    planning_depth: 'Compact',
+    assurance_level: 'Routine',
+  });
+  for (const derivedField of ['lane', 'automatic_lane', 'artifact_profile', 'proof_obligations', 'actor_needs']) {
+    assert.equal(Object.hasOwn(snapshot, derivedField), false, `${derivedField} must not be persisted`);
+  }
+  const view = POLICY.readWorkflowPolicySnapshot(initial);
+  assert.equal(view.lane, 'Standard');
+  assert.equal(view.automatic_lane, 'Standard');
+  assert.equal(view.artifact_profile, 'bounded');
+  assert.deepEqual(view.proof_obligations, ['needsExecutionProof']);
+  assert.equal(Object.hasOwn(initial, 'override_' + 'receipt'), false);
+  assert.equal(POLICY.validateWorkflowPolicySnapshot(snapshot).valid, true);
+
+  const persistedAgain = POLICY.persistWorkflowPolicySnapshot(initial, {
+    riskSignals: { auth: true },
     override: 'Direct',
-    userAuthorized: true,
   });
-  assert.equal(result.lane, 'Direct');
-  assert.equal(result.automaticLane, 'Critical');
-  assert.equal(result.overridden, true);
-  assert.match(result.warnings.join(' '), /downgrad|review and evidence coverage/i);
-  assert.ok(POLICY.lanePolicy(result).warnings.length >= 2);
+  assert.deepEqual(persistedAgain.workflow_policy, snapshot, 'persist-once must not reclassify an existing snapshot');
+
+  const malformed = { ...snapshot, lane: 'Critical' };
+  const validation = POLICY.validateWorkflowPolicySnapshot(malformed);
+  assert.equal(validation.valid, false);
+  assert.match(validation.errors.join('; '), /v2\.1 fields must be exactly/);
+  assert.throws(() => POLICY.readWorkflowPolicySnapshot({ workflow_policy: malformed }), /Invalid workflow policy snapshot/);
+
+  const malformedShape = { ...snapshot, classified_minimum: { planning_depth: 'Compact' } };
+  const shapeValidation = POLICY.validateWorkflowPolicySnapshot(malformedShape);
+  assert.equal(shapeValidation.valid, false);
+  assert.match(shapeValidation.errors.join('; '), /classified_minimum must contain exactly/);
+
+  const malformedRisks = { ...snapshot, risks: { auth: true } };
+  const risksValidation = POLICY.validateWorkflowPolicySnapshot(malformedRisks);
+  assert.equal(risksValidation.valid, false);
+  assert.match(risksValidation.errors.join('; '), /risks must be an array/);
 });
 
-test('unsafe downgrade without user authorization is blocked', () => {
-  assert.throws(() => POLICY.classifyLane({
-    reversible: true,
-    riskSignals: { privacy: true },
-    override: 'Direct',
-  }), /requires explicit user authorization/);
+test('P1 workflow-policy validation is semantic and explicit workflow_policy values never reclassify', () => {
+  const direct = POLICY.workflowPolicySnapshot({ reversible: true, lowRisk: true, isolated: true });
+  const standardUnknown = POLICY.escalateWorkflowPolicy(direct, { risks: ['unclassified-risk'] });
+  const elevatedAuth = POLICY.workflowPolicySnapshot({ riskSignals: { auth: true } });
+  const escalatedElevated = POLICY.escalateWorkflowPolicy(direct, { risks: ['auth'] });
+
+  for (const legitimate of [direct, standardUnknown, elevatedAuth, escalatedElevated]) {
+    assert.equal(POLICY.validateWorkflowPolicySnapshot(legitimate).valid, true);
+  }
+  assert.equal(escalatedElevated.lane, 'Standard');
+  assert.equal(escalatedElevated.automatic_lane, 'Standard');
+  assert.equal(escalatedElevated.planning_depth, 'None');
+  assert.equal(escalatedElevated.assurance_level, 'Elevated');
+
+  const forgedDirectAuth = { ...direct, risks: ['auth'] };
+  const forgedDirectUnknown = { ...direct, risks: ['unclassified-risk'] };
+  const forgedStandardAuth = { ...standardUnknown, risks: ['auth'] };
+  for (const forged of [forgedDirectAuth, forgedDirectUnknown]) {
+    const result = POLICY.validateWorkflowPolicySnapshot(forged);
+    assert.equal(result.valid, false);
+    assert.match(result.errors.join('; '), /at least (Elevated|Strict)/);
+  }
+  assert.equal(
+    POLICY.validateWorkflowPolicySnapshot(forgedStandardAuth).valid,
+    true,
+    'changing one normalized risk to another does not invent a higher assurance minimum',
+  );
+  for (const riskAlias of ['Auth', 'authentication', 'public_contract']) {
+    const escalated = POLICY.escalateWorkflowPolicy(direct, { risks: [riskAlias] });
+    assert.equal(escalated.lane, 'Standard', `${riskAlias} must classify as Elevated`);
+    assert.equal(escalated.assurance_level, 'Elevated');
+    assert.equal(POLICY.validateWorkflowPolicySnapshot({ ...direct, risks: [riskAlias] }).valid, false);
+  }
+  assert.throws(() => POLICY.assertWorkflowPolicySnapshot(forgedDirectAuth), /Invalid workflow policy snapshot/);
+  assert.throws(() => POLICY.readWorkflowPolicySnapshot({ workflow_policy: forgedDirectAuth }), /Invalid workflow policy snapshot/);
+  assert.throws(() => POLICY.lanePolicy({ workflow_policy: forgedDirectAuth }), /Invalid workflow policy snapshot/);
+
+  for (const explicitValue of [null, undefined]) {
+    const state = { workflow_policy: explicitValue, reversible: true, lowRisk: true, isolated: true };
+    assert.throws(() => POLICY.workflowPolicySnapshot(state), /Invalid workflow policy snapshot/);
+    assert.throws(() => POLICY.escalateWorkflowPolicy(state, {}), /Invalid workflow policy snapshot/);
+    assert.throws(() => POLICY.lanePolicy(state), /Invalid workflow policy snapshot/);
+  }
+
+  const forgedLanePolicyCli = spawnSync(process.execPath, [
+    POLICY_PATH,
+    '--lane-policy',
+    '--task-json',
+    JSON.stringify({ workflow_policy: forgedDirectAuth }),
+    '--json',
+  ], { encoding: 'utf8' });
+  assert.equal(forgedLanePolicyCli.status, 2, `${forgedLanePolicyCli.stdout}\n${forgedLanePolicyCli.stderr}`);
+  assert.match(forgedLanePolicyCli.stderr, /Invalid workflow policy snapshot/);
+
+  const nullLanePolicyCli = spawnSync(process.execPath, [
+    POLICY_PATH,
+    '--lane-policy',
+    '--task-json',
+    JSON.stringify({ workflow_policy: null, reversible: true, lowRisk: true, isolated: true }),
+    '--json',
+  ], { encoding: 'utf8' });
+  assert.equal(nullLanePolicyCli.status, 2, `${nullLanePolicyCli.stdout}\n${nullLanePolicyCli.stderr}`);
+  assert.match(nullLanePolicyCli.stderr, /Invalid workflow policy snapshot/);
+
+  const validatePolicyCli = spawnSync(process.execPath, [
+    POLICY_PATH,
+    '--validate-policy',
+    '--task-json',
+    JSON.stringify({ workflow_policy: forgedDirectAuth }),
+    '--json',
+  ], { encoding: 'utf8' });
+  assert.equal(validatePolicyCli.status, 2, `${validatePolicyCli.stdout}\n${validatePolicyCli.stderr}`);
+  assert.equal(JSON.parse(validatePolicyCli.stdout).valid, false);
+
+  const validateNullPolicyCli = spawnSync(process.execPath, [
+    POLICY_PATH,
+    '--validate-policy',
+    '--task-json',
+    JSON.stringify({ workflow_policy: null }),
+    '--json',
+  ], { encoding: 'utf8' });
+  assert.equal(validateNullPolicyCli.status, 2, `${validateNullPolicyCli.stdout}\n${validateNullPolicyCli.stderr}`);
+  assert.equal(JSON.parse(validateNullPolicyCli.stdout).valid, false);
+});
+
+test('P1 workflow policy escalation is monotonic across all newly classified risks', () => {
+  const direct = POLICY.workflowPolicySnapshot({ reversible: true, lowRisk: true, isolated: true });
+  assert.equal(direct.lane, 'Direct');
+  assert.deepEqual(POLICY.escalateWorkflowPolicy(direct, {}), direct, 'no new risks must not escalate');
+
+  const standard = POLICY.escalateWorkflowPolicy(direct, { risks: ['new-standard-risk'], riskLevel: 'standard' });
+  assert.equal(standard.lane, 'Standard');
+  assert.equal(standard.artifact_profile, 'targeted');
+  assert.equal(standard.planning_depth, 'None');
+  assert.equal(standard.assurance_level, 'Elevated');
+  assert.equal(standard.risks.includes('new-standard-risk'), true);
+  assert.deepEqual(standard.proof_obligations, ['needsInspection', 'needsExecutionProof']);
+
+  const ambiguityElevated = POLICY.escalateWorkflowPolicy(direct, { riskSignals: { ambiguity: true } });
+  assert.equal(ambiguityElevated.lane, 'Standard', 'risk discovery must require inspection without inventing an audit');
+  assert.equal(ambiguityElevated.assurance_level, 'Elevated');
+
+  const criticalSeverity = POLICY.escalateWorkflowPolicy(direct, { risks: ['payment'], riskLevel: 'critical' });
+  assert.equal(criticalSeverity.assurance_level, 'Elevated', 'severity labels must not create independent-audit authority');
+  assert.equal(criticalSeverity.proof_obligations.includes('needsIndependentAudit'), false);
+
+  const critical = POLICY.escalateWorkflowPolicy(standard, { risks: ['auth'], assurance_level: 'Strict' });
+  assert.equal(critical.lane, 'Critical');
+  assert.equal(critical.artifact_profile, 'targeted');
+  assert.equal(critical.planning_depth, 'None');
+  assert.equal(critical.assurance_level, 'Strict');
+  assert.equal(critical.automatic_assurance_level, 'Elevated');
+  assert.equal(critical.proof_obligations.includes('needsIndependentAudit'), true);
+  assert.equal(critical.proof_obligations.includes('needsResearchGrounding'), false);
+
+  const noDowngrade = POLICY.escalateWorkflowPolicy(critical, { risks: ['another-standard-risk'], riskLevel: 'standard' });
+  assert.equal(noDowngrade.lane, 'Critical');
+  assert.equal(noDowngrade.proof_obligations.includes('needsIndependentAudit'), true);
+  assert.equal(noDowngrade.proof_obligations.includes('needsResearchGrounding'), false);
+
+  const criticalAgain = POLICY.escalateWorkflowPolicy(critical, { risks: ['auth'] });
+  assert.deepEqual(criticalAgain, critical, 'repeating known risks must not create a new escalation');
+});
+
+test('P1 legacy execution tier is read-compatible without becoming emitted policy authority', () => {
+  const legacy = { design_context: { execution_tier: 'Deep' } };
+  const snapshot = POLICY.workflowPolicySnapshot(legacy);
+  assert.equal(snapshot.lane, 'Critical');
+  assert.equal(snapshot.artifact_profile, 'strict');
+  const policy = POLICY.lanePolicy(legacy);
+  assert.equal(policy.lane, 'Critical');
+  assert.equal(Object.hasOwn(policy, 'execution_tier'), false);
+  assert.equal(Object.hasOwn(policy, 'executionTier'), false);
+  const legacyPlan = POLICY.delegationPlan({ tier: 'Deep' });
+  assert.equal(Object.hasOwn(legacyPlan, 'execution_tier'), false);
+  assert.equal(Object.hasOwn(legacyPlan, 'executionTier'), false);
+  assert.deepEqual(legacyPlan.proof_obligations, snapshot.proof_obligations);
+  assert.equal(POLICY.workflowPolicySnapshot({ design_context: { execution_tier: 'standard' } }).lane, 'Standard');
+});
+
+test('legacy v1 policy is read-compatible, immutable on read, and explicitly migrates to v2.1', () => {
+  const cases = [
+    { lane: 'Direct', risks: [], obligations: ['needsExecutionProof'] },
+    { lane: 'Standard', risks: [], obligations: ['needsInspection', 'needsExecutionProof'] },
+    { lane: 'Critical', risks: ['auth'], obligations: ['needsInspection', 'needsExecutionProof', 'needsIndependentAudit', 'needsResearchGrounding'] },
+  ];
+  for (const fixture of cases) {
+    const v1 = {
+      version: '1',
+      lane: fixture.lane,
+      automatic_lane: fixture.lane,
+      risks: fixture.risks,
+      artifact_profile: { Direct: 'targeted', Standard: 'bounded', Critical: 'strict' }[fixture.lane],
+      proof_obligations: fixture.obligations,
+      actor_needs: POLICY.actorNeedsFor(fixture.obligations),
+      override_receipt: null,
+    };
+    assert.equal(POLICY.validateWorkflowPolicySnapshot(v1).valid, true, fixture.lane);
+    const source = { feature_name: `legacy-${fixture.lane}`, workflow_policy: v1 };
+    const before = JSON.stringify(source);
+    const adapted = POLICY.readWorkflowPolicySnapshot(source);
+    assert.equal(adapted.version, '2');
+    assert.deepEqual(adapted.proof_obligations, fixture.obligations, fixture.lane);
+    assert.deepEqual(adapted.actor_needs, v1.actor_needs, fixture.lane);
+    assert.equal(POLICY.validateWorkflowPolicySnapshot(adapted).valid, true, fixture.lane);
+    assert.equal(JSON.stringify(source), before, 'read adapter must not mutate persisted v1 state');
+    const migrated = POLICY.persistWorkflowPolicySnapshot(source).workflow_policy;
+    assert.equal(migrated.version, POLICY.CANONICAL_WORKFLOW_POLICY_VERSION);
+    assert.deepEqual(Object.keys(migrated).sort(), [...POLICY.CANONICAL_WORKFLOW_POLICY_FIELDS].sort());
+    const migratedView = POLICY.readWorkflowPolicySnapshot({ workflow_policy: migrated });
+    assert.equal(migratedView.lane, adapted.lane, fixture.lane);
+    assert.equal(migratedView.artifact_profile, adapted.artifact_profile, fixture.lane);
+    assert.deepEqual(migratedView.proof_obligations, POLICY.obligationsForAssurance(
+      migrated.assurance_level,
+      migrated.risks,
+    ), fixture.lane);
+  }
+});
+
+test('post-classification downgrade is unsupported', () => {
+  assert.throws(
+    () => POLICY.classifyLane({ riskSignals: { privacy: true }, override: 'Direct' }),
+    (error) => /planning_depth downgrade/.test(error.message) && /not permitted/.test(error.message),
+  );
+});
+
+test('caller-requested downgrade is blocked before persistence', () => {
+  assert.throws(
+    () => POLICY.classifyLane({ riskSignals: { privacy: true }, override: 'Direct' }),
+    (error) => /planning_depth downgrade/.test(error.message) && /not permitted/.test(error.message),
+  );
   // also via CLI
   const cli = spawnSync(process.execPath, [
     POLICY_PATH,
@@ -120,7 +601,7 @@ test('unsafe downgrade without user authorization is blocked', () => {
     '--json',
   ], { encoding: 'utf8' });
   assert.equal(cli.status, 2);
-  assert.match(cli.stderr, /requires explicit user authorization/);
+  assert.match(cli.stderr, /planning_depth downgrade.*not permitted/i);
 });
 
 test('forged approval via legacy approved field is rejected', () => {
@@ -140,14 +621,14 @@ test('forged approval via legacy approved field is rejected', () => {
   assert.match(legacyCheck.error, /Legacy/);
 });
 
-test('approval state never infers user approval from generated or agent validation', () => {
+test('technical approval readiness ignores legacy user_approved', () => {
   const state = POLICY.approvalState({ generated: true, agent_validated: true });
   assert.equal(state.generated, true);
   assert.equal(state.agent_validated, true);
-  assert.equal(state.user_approved, false);
-  assert.equal(state.ready, false);
+  assert.equal(state.ready, true);
   assert.equal(state.schema_version, '2.0');
   assert.equal(POLICY.approvalState({ generated: true, agent_validated: true, user_approved: true }).ready, true);
+  assert.equal(POLICY.approvalState({ generated: true, agent_validated: true, user_approved: false }).ready, true);
   const cli = spawnSync(process.execPath, [
     POLICY_PATH,
     '--approval-state',
@@ -156,10 +637,33 @@ test('approval state never infers user approval from generated or agent validati
     '--json',
   ], { encoding: 'utf8' });
   assert.equal(cli.status, 0, `${cli.stdout}\n${cli.stderr}`);
-  assert.equal(JSON.parse(cli.stdout).state.user_approved, false);
+  assert.equal(JSON.parse(cli.stdout).state.ready, true);
 });
 
-test('CLI exposes JSON lane classification and develop has no universal spec hard gate', () => {
+test('approval schema fails closed for explicit null, array, empty, and malformed states', () => {
+  const absent = POLICY.validateApprovalSchema({});
+  assert.equal(absent.valid, true);
+  assert.equal(absent.absent, true);
+  assert.equal(POLICY.approvalState({}).present, false);
+
+  const invalidSpecs = [
+    [],
+    { approvals: null },
+    { approvals: [] },
+    { approvals: {} },
+    { approvals: { requirements: null } },
+    { approvals: { requirements: { generated: true, agent_validated: true, user_approved: null } } },
+    { approvals: { requirements: { generated: true, agent_validated: true, user_approved: true, extra: false } } },
+  ];
+  for (const spec of invalidSpecs) {
+    assert.equal(POLICY.validateApprovalSchema(spec).valid, false, `invalid approval should fail: ${JSON.stringify(spec)}`);
+    assert.throws(() => POLICY.approvalState(spec), /approval|approvals|schema/i);
+  }
+  assert.throws(() => POLICY.approvalState({ schema_version: null }), /schema_version/);
+  assert.throws(() => POLICY.approvalState({ schema_version: '1.0' }), /schema_version/);
+});
+
+test('CLI exposes a derived lane and Develop consumes independent canonical policy axes', () => {
   const cli = spawnSync(process.execPath, [
     POLICY_PATH,
     '--classify-lane',
@@ -173,40 +677,383 @@ test('CLI exposes JSON lane classification and develop has no universal spec har
   assert.equal(payload.policy.requiresSpec, false);
   const develop = read(DEVELOP);
   assert.doesNotMatch(develop, /DO NOT write implementation code until an approved spec exists/i);
-  assert.match(develop, /Direct.*bypass spec\/state/i);
-  assert.match(develop, /Standard.*approved.*spec/i);
-  assert.match(develop, /Critical.*strict evidence/i);
-  assert.match(develop, /C --> D\s*$/m);
+  const policySection = develop.split('## Policy authority')[1]?.split('\n## ')[0] || '';
+  for (const authorityTerm of ['planning_depth', 'assurance_level', 'Risk', 'derived']) {
+    assert.ok(policySection.includes(authorityTerm), `policy authority missing ${authorityTerm}`);
+  }
+  for (const compatibilityView of ['**Direct**', '**Standard**', '**Critical**']) {
+    assert.ok(policySection.includes(compatibilityView), `missing derived view ${compatibilityView}`);
+  }
+  assert.ok(policySection.includes('derived Strict view'));
+  assert.ok(policySection.includes('Legacy approval fields'));
+  assert.ok(policySection.replace(/\s+/g, ' ').includes('zero authority'));
+  assert.match(develop, /Classify lane[\s\S]*test receipt[\s\S]*docs-impact sync/i);
   assert.doesNotMatch(develop, /D2\[Step 3/);
-  assert.match(read(path.join(PACKAGE_ROOT, 'src/claude/skills/specs/SKILL.md')), /requirements\.md.*design\.md.*current layout/i);
+  assert.match(develop, /--notes.*opt-in/i);
+  assert.doesNotMatch(develop, /--no-notes/);
+  assert.doesNotMatch(develop, /planner|implementer|test-runner|code-auditor|docs-keeper/i);
+  const fullRoutine = POLICY.readWorkflowPolicySnapshot({
+    workflow_policy: POLICY.canonicalWorkflowPolicySnapshot({ planning_depth: 'Full', assurance_level: 'Routine' }),
+  });
+  const compactStrict = POLICY.readWorkflowPolicySnapshot({
+    workflow_policy: POLICY.canonicalWorkflowPolicySnapshot({ planning_depth: 'Compact', assurance_level: 'Strict' }),
+  });
+  assert.equal(fullRoutine.planning_depth, 'Full');
+  assert.equal(fullRoutine.assurance_level, 'Routine');
+  assert.equal(compactStrict.planning_depth, 'Compact');
+  assert.equal(compactStrict.assurance_level, 'Strict');
+  assert.notEqual(fullRoutine.artifact_profile, compactStrict.artifact_profile);
+  assert.notDeepEqual(fullRoutine.proof_obligations, compactStrict.proof_obligations);
 });
 
-test('review verdict consumer handles PASS, FAIL, and BLOCKED', () => {
-  assert.deepEqual(POLICY.consumeReviewVerdict('PASS'), { action: 'proceed', terminal: false });
-  assert.deepEqual(POLICY.consumeReviewVerdict('FAIL'), { action: 'fix-and-rerun', terminal: false });
-  assert.deepEqual(POLICY.consumeReviewVerdict('BLOCKED'), {
-    action: 'stop',
-    terminal: true,
-    blocker: 'review returned BLOCKED',
-  });
-  assert.throws(() => POLICY.consumeReviewVerdict('NO_TESTS'), /Unsupported review verdict/);
+test('artifact router keeps optional expansion bound to uncertainty and typed topology', () => {
+  const router = markdownSection(read(SPECS), 'Artifact router');
+  const rows = markdownTable(router, 'Depth');
+  assert.deepEqual(Object.keys(rows), ['None', 'Compact', 'Full']);
+  assert.equal(rows.None['Durable core'], 'none');
+  for (const depth of ['Compact', 'Full']) {
+    assert.deepEqual(
+      rows[depth]['Durable core'].match(/`[^`]+`/g),
+      ['`spec.json`', '`requirements.md`', '`design.md`'],
+      `${depth} must share the canonical three-file core`,
+    );
+    assert.equal(rows[depth]['Research route'], 'only on a research trigger');
+    assert.equal(rows[depth]['Task route'], 'only on a typed topology trigger');
+  }
+  assert.notEqual(rows.Compact['Design expansion'], rows.Full['Design expansion']);
+  for (const falseTrigger of ['Requirement count', 'size', 'planning depth', 'assurance level', 'risk label', 'architectural layers']) {
+    assert.ok(router.includes(falseTrigger), `router must name inert trigger ${falseTrigger}`);
+  }
+  for (const boundary of ['ownership', 'dependency', 'transition', 'proof', 'parallel']) {
+    assert.ok(router.includes(boundary), `router must name typed topology ${boundary}`);
+  }
+  assert.ok(router.includes('unresolved material uncertainty'));
+  assert.ok(router.includes('external-current fact'));
+  assert.ok(router.includes('explicit user request'));
+});
+
+test('canonical verdict adapter handles completion and unfinished decisions', () => {
+  assert.deepEqual(POLICY.REVIEW_VERDICTS, ['PASS', 'PASS_WITH_WARNINGS', 'FAIL', 'BLOCKED']);
+  assert.doesNotThrow(() => POLICY.assertVerdict('PASS_WITH_WARNINGS'));
+  assert.throws(() => POLICY.assertVerdict('PARTIAL'), /Unsupported canonical verdict/);
+  assert.equal(POLICY.consumeReviewVerdict('PASS').completion, 'unfinished');
+  assert.equal(POLICY.consumeReviewVerdict('PASS').unfinished, true);
+  assert.equal(POLICY.consumeReviewVerdict('PASS').createsCompletion, false);
+  assert.equal(POLICY.consumeReviewVerdict('PASS_WITH_WARNINGS').unfinished, true);
+  assert.equal(POLICY.consumeReviewVerdict('FAIL').retry, true);
+  assert.equal(POLICY.consumeReviewVerdict('BLOCKED').retry, false);
+  assert.equal(POLICY.consumeReviewVerdict('BLOCKED').unfinished, true);
+  assert.equal(POLICY.consumeReviewVerdict('PARTIAL').completion, 'unfinished');
+  assert.equal(POLICY.consumeReviewVerdict('NO_TESTS').completion, 'unfinished');
+  assert.equal(POLICY.consumeReviewVerdict('PARTIAL').verdict, 'BLOCKED');
+  assert.equal(POLICY.consumeReviewVerdict('NO_TESTS').verdict, 'BLOCKED');
+  assert.equal(POLICY.consumeReviewVerdict('PARTIAL').retry, false);
+  assert.equal(POLICY.consumeReviewVerdict('NO_TESTS').retry, false);
+  assert.throws(() => POLICY.consumeReviewVerdict('UNKNOWN'), /Unsupported canonical verdict/);
   const cli = spawnSync(process.execPath, [POLICY_PATH, '--consume-verdict', '--verdict', 'BLOCKED', '--json'], { encoding: 'utf8' });
   assert.equal(cli.status, 0, `${cli.stdout}\n${cli.stderr}`);
   assert.deepEqual(JSON.parse(cli.stdout).action, 'stop');
-  assert.match(read(GATE), /PASS \| FAIL \| BLOCKED/);
-  assert.match(read(CODE_REVIEW_SKILL), /PASS \| FAIL \| BLOCKED/);
-  assert.match(read(TEST_SKILL), /PASS.*FAIL.*BLOCKED/);
+  assert.match(read(GATE), /PASS \| PASS_WITH_WARNINGS \| FAIL \| BLOCKED/);
+  assert.match(read(CODE_REVIEW_SKILL), /PASS \| PASS_WITH_WARNINGS \| FAIL \| BLOCKED/);
+  assert.match(read(TEST_SKILL), /PASS \| PASS_WITH_WARNINGS \| FAIL \| BLOCKED/);
 });
 
-test('flash PASS promotes proof without completion, finalize alone completes', () => {
-  const initial = {
-    status: 'in_progress',
-    receipt: 'FLASH_UNVERIFIED',
-    blocker: 'awaiting /hapo:test <feature>',
-    dependencyBlocked: true,
-    unblocks: false,
+test('completion decision requires canonical execution receipt and every workflow obligation', () => {
+  const receipt = canonicalReceipt();
+  const critical = POLICY.workflowPolicySnapshot({ riskSignals: { auth: true }, assurance_level: 'Strict' });
+  const audit = {
+    schema_version: '1',
+    reviewer_session_id: 'review-session-1',
+    implementation_session_id: 'implementation-session-1',
+    expected_provenance: { ...EXPECTED_PROVENANCE },
+    evidence: 'independent audit report for the bound change',
+    verdict: 'PASS',
   };
-  for (const verdict of ['FAIL', 'BLOCKED', 'NO_TESTS']) {
+  const missing = POLICY.completionDecision('PASS', {
+    workflow_policy: critical,
+    receipt_binding: RECEIPT_BINDING,
+    execution_receipt: receipt,
+    proofs: {
+      needsInspection: { evidence: 'inspection receipt' },
+      needsResearchGrounding: { evidence: 'research receipt' },
+    },
+  });
+  assert.equal(missing.completion, 'unfinished');
+  assert.ok(missing.missingProof.includes('needsIndependentAudit'));
+  assert.equal(missing.unfinished, true);
+
+  const complete = POLICY.completionDecision('PASS', {
+    workflow_policy: critical,
+    receipt_binding: RECEIPT_BINDING,
+    execution_receipt: receipt,
+    proofs: {
+      needsInspection: { evidence: 'inspection receipt' },
+      needsResearchGrounding: { evidence: 'research receipt' },
+      needsIndependentAudit: audit,
+    },
+  });
+  assert.equal(complete.completion, 'complete');
+  assert.equal(complete.unfinished, false);
+  assert.equal(complete.warnings, undefined);
+  const warnings = POLICY.completionDecision('PASS_WITH_WARNINGS', {
+    workflow_policy: critical,
+    receipt_binding: RECEIPT_BINDING,
+    execution_receipt: receipt,
+    proofs: {
+      needsInspection: { evidence: 'inspection receipt' },
+      needsResearchGrounding: { evidence: 'research receipt' },
+      needsIndependentAudit: audit,
+    },
+  });
+  assert.equal(warnings.completion, 'unfinished');
+  assert.equal(warnings.unfinished, true);
+  assert.match(warnings.blocker, /literal PASS/);
+  assert.equal(POLICY.completionDecision('PASS', {
+    workflow_policy: { proof_obligations: ['needsExecutionProof'] },
+    receipt_binding: RECEIPT_BINDING,
+    execution_receipt: receipt,
+  }).completion, 'unfinished');
+  assert.equal(POLICY.completionDecision('PASS', {
+    workflow_policy: {},
+    receipt_binding: RECEIPT_BINDING,
+    execution_receipt: receipt,
+  }).completion, 'unfinished');
+  assert.equal(POLICY.completionDecision('PASS', {
+    workflow_policy: critical,
+    execution_receipt: receipt,
+  }).completion, 'unfinished', 'arbitrary Base/Head without runtime binding must not complete');
+  assert.equal(POLICY.completionDecision('PASS', {
+    workflow_policy: critical,
+    receipt_binding: RECEIPT_BINDING,
+    execution_receipt: receipt,
+    proofs: {
+      needsInspection: { evidence: 'inspection receipt' },
+      needsResearchGrounding: { evidence: 'research receipt' },
+      needsIndependentAudit: { independent: true, evidence: 'marker only', verdict: 'PASS' },
+    },
+  }).completion, 'unfinished', 'independent marker must not satisfy audit');
+  assert.equal(POLICY.validateIndependentAuditEvidence({ independent: true }, EXPECTED_PROVENANCE).valid, false);
+  assert.equal(POLICY.validateIndependentAuditEvidence({ ...audit, verdict: 'PASS_WITH_WARNINGS' }, EXPECTED_PROVENANCE).valid, false);
+  assert.equal(POLICY.validateIndependentAuditEvidence({ ...audit, reviewer_session_id: audit.implementation_session_id }, EXPECTED_PROVENANCE).valid, false);
+  assert.equal(POLICY.validateIndependentAuditEvidence({ ...audit, expected_provenance: { base: EXPECTED_BASE, head: 'fedcba9876543210fedcba9876543210fedcba98' } }, EXPECTED_PROVENANCE).valid, false);
+  assert.equal(POLICY.validateIndependentAuditEvidence({ ...audit, extra: 'forged' }, EXPECTED_PROVENANCE).valid, false);
+  assert.equal(POLICY.validateIndependentAuditEvidence([audit], EXPECTED_PROVENANCE).valid, false);
+  assert.equal(POLICY.validateIndependentAuditEvidence(audit, EXPECTED_PROVENANCE, RUNTIME_CONTEXT).valid, true);
+  assert.equal(POLICY.validateIndependentAuditEvidence(audit, EXPECTED_PROVENANCE, { ...RUNTIME_CONTEXT }).valid, false, 'forged runtime session context must not satisfy audit binding');
+  assert.equal(POLICY.completionDecision('PASS', {}).completion, 'unfinished');
+  const artifactContext = {
+    workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: {} }),
+    receipt_binding: RECEIPT_BINDING,
+    task_context: { artifacts: ['output/bundle.js'], expected_provenance: { ...EXPECTED_PROVENANCE } },
+    execution_receipt: receipt,
+    proofs: { needsInspection: { evidence: 'inspection receipt' } },
+    receipt_options: { requireArtifactHash: false, artifactPaths: [] },
+  };
+  const artifactBlocked = POLICY.completionDecision('PASS', artifactContext);
+  assert.equal(artifactBlocked.completion, 'unfinished', 'caller receipt options must not weaken task artifact requirements');
+  assert.ok(artifactBlocked.missingProof.some((item) => item.includes('artifact_hash')));
+});
+
+test('auto authoring reaches readiness only after promotion, validation, grounding, and current review', () => {
+  const fixture = createCanonicalAuthoringFixture();
+  try {
+    let spec = JSON.parse(fs.readFileSync(fixture.specPath, 'utf8'));
+    assert.equal(spec.semantic_model, null);
+    spec.ready_for_implementation = true;
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(spec, null, 2)}\n`);
+    let validation = VALIDATOR.validateSpec(fixture.specDir);
+    assert.ok(validation.errors.some((error) => error.includes('requires explicit promoted machine semantic authority')));
+
+    spec.ready_for_implementation = false;
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(spec, null, 2)}\n`);
+    promoteCanonicalModel(fixture);
+    spec = JSON.parse(fs.readFileSync(fixture.specPath, 'utf8'));
+    assert.ok(spec.semantic_model && spec.semantic_model.criteria.length === 2);
+    spec.ready_for_implementation = true;
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(spec, null, 2)}\n`);
+    validation = VALIDATOR.validateSpec(fixture.specDir);
+    assert.ok(validation.errors.some((error) => error.includes('readiness requires validated')));
+    assert.ok(validation.errors.some((error) => error.includes('requires completed semantic review')));
+
+    spec = makeCanonicalReady(fixture);
+    validation = VALIDATOR.validateSpec(fixture.specDir);
+    assert.deepEqual(validation.errors, [], validation.errors.join('\n'));
+    assert.equal(GROUNDER.groundSpec({ specDir: fixture.specDir, root: fixture.root, spec }).errors.length, 0);
+
+    const specs = read(SPECS);
+    const executableBlocks = [...specs.matchAll(/```bash\n([\s\S]*?)```/g)].map((match) => match[1]);
+    assert.ok(executableBlocks.every((block) => !/hapo:?develop/i.test(block)), 'Specs must never execute Develop');
+    const handoff = markdownSection(specs, 'Platform acceptance and handoff');
+    assert.ok(handoff.includes('After readiness'));
+    assert.ok(handoff.includes('/hapo:develop <feature>'));
+    assert.ok(handoff.includes('$hapo-develop <feature>'));
+    assert.ok(handoff.includes('must stop in Specs'));
+  } finally {
+    fs.rmSync(fixture.root, { recursive: true, force: true });
+  }
+});
+
+test('atomic readiness supports one-criterion Routine specs and binds semantic text', () => {
+  const fixture = createOrdinaryAuthoringFixture();
+  try {
+    const authored = JSON.parse(fs.readFileSync(fixture.specPath, 'utf8'));
+    authored.decisions = [
+      { id: 'Q1', classification: 'repository_fact', statement: 'The runtime entrypoint is src/entry.js.', status: 'grounded', evidence: 'Repository anchor A-D-01 resolves to src/entry.js.' },
+      { id: 'Q2', classification: 'reversible_assumption', statement: 'Use the existing direct module export for this bounded change.', status: 'recorded', evidence: 'Reversal is limited to src/entry.js and does not alter product data.' },
+    ];
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(authored, null, 2)}\n`);
+    const result = READINESS.finalizeReadiness({ specDir: fixture.specDir, projectRoot: fixture.root, reviewResult: ordinaryReview() });
+    assert.equal(result.spec.ready_for_implementation, true);
+    assert.equal(result.spec.semantic_model.criteria.length, 1);
+    assert.match(result.spec.semantic_model.criteria[0].text, /delete the selected record/);
+    assert.deepEqual(VALIDATOR.validateSpec(fixture.specDir).errors, []);
+
+    const beforeDigest = result.semantic_digest;
+    const design = path.join(fixture.specDir, 'design.md');
+    const originalDesign = fs.readFileSync(design, 'utf8');
+    fs.writeFileSync(design, originalDesign.replace('deleted rather than archived', 'archived rather than deleted'));
+    const decisionProjection = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-semantic-model.cjs')).modelFromMarkdown(fixture.specDir, result.spec);
+    assert.notDeepEqual(decisionProjection.model.design_records, result.spec.semantic_model.design_records);
+    const decisionDigest = VALIDATOR.computeSemanticDigest21(fixture.specDir, { ...result.spec, semantic_model: decisionProjection.model });
+    assert.equal(decisionDigest.errors.length, 0, decisionDigest.errors.join('\n'));
+    assert.notEqual(decisionDigest.digest, beforeDigest);
+    fs.writeFileSync(design, originalDesign);
+
+    const requirements = path.join(fixture.specDir, 'requirements.md');
+    fs.writeFileSync(requirements, fs.readFileSync(requirements, 'utf8').replace('delete the selected record', 'archive the selected record'));
+    const projection = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-semantic-model.cjs')).modelFromMarkdown(fixture.specDir, result.spec);
+    assert.notEqual(projection.model.criteria[0].text, result.spec.semantic_model.criteria[0].text);
+    const changed = VALIDATOR.computeSemanticDigest21(fixture.specDir, { ...result.spec, semantic_model: projection.model });
+    assert.equal(changed.errors.length, 0, changed.errors.join('\n'));
+    assert.notEqual(changed.digest, beforeDigest);
+    assert.ok(VALIDATOR.validateSpec(fixture.specDir).errors.some((error) => /projection|stale/.test(error)));
+  } finally { fs.rmSync(fixture.root, { recursive: true, force: true }); }
+});
+
+test('atomic readiness preserves exact bytes on review, grounding, decision, and Strict authority failures', () => {
+  const fixture = createOrdinaryAuthoringFixture();
+  try {
+    const original = fs.readFileSync(fixture.specPath);
+    for (const mutate of [
+      (review) => ({ ...review, reviewed_criteria: [] }),
+      (review) => ({ ...review, counterexamples: [] }),
+    ]) {
+      assert.throws(() => READINESS.finalizeReadiness({ specDir: fixture.specDir, projectRoot: fixture.root, reviewResult: mutate(ordinaryReview()) }), /readiness validation/);
+      assert.equal(fs.readFileSync(fixture.specPath).equals(original), true);
+    }
+    fs.unlinkSync(path.join(fixture.root, 'src', 'entry.js'));
+    assert.throws(() => READINESS.finalizeReadiness({ specDir: fixture.specDir, projectRoot: fixture.root, reviewResult: ordinaryReview() }), /grounding|validation/);
+    assert.equal(fs.readFileSync(fixture.specPath).equals(original), true);
+    fs.writeFileSync(path.join(fixture.root, 'src', 'entry.js'), 'module.exports = { action: "delete" };\n');
+
+    process.env.CAFEKIT_FINALIZE_FAIL_BEFORE_RENAME = '1';
+    try {
+      assert.throws(() => READINESS.finalizeReadiness({ specDir: fixture.specDir, projectRoot: fixture.root, reviewResult: ordinaryReview() }), /injected finalization failure/);
+      assert.equal(fs.readFileSync(fixture.specPath).equals(original), true);
+    } finally { delete process.env.CAFEKIT_FINALIZE_FAIL_BEFORE_RENAME; }
+
+    const blocked = JSON.parse(original);
+    blocked.decisions = [{ id: 'Q1', classification: 'user_owned', statement: 'Choose permanent deletion or retention archive behavior.', status: 'unresolved', evidence: null }];
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(blocked, null, 2)}\n`);
+    const blockedBytes = fs.readFileSync(fixture.specPath);
+    assert.throws(() => READINESS.finalizeReadiness({ specDir: fixture.specDir, projectRoot: fixture.root, reviewResult: ordinaryReview() }), /unresolved material user-owned decision/);
+    assert.equal(fs.readFileSync(fixture.specPath).equals(blockedBytes), true);
+
+    delete blocked.decisions;
+    blocked.workflow_policy = POLICY.canonicalWorkflowPolicySnapshot({ planning_depth: 'Compact', assurance_level: 'Strict' });
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(blocked, null, 2)}\n`);
+    const strictBytes = fs.readFileSync(fixture.specPath);
+    assert.throws(() => READINESS.finalizeReadiness({ specDir: fixture.specDir, projectRoot: fixture.root, reviewResult: ordinaryReview() }), /Strict readiness/);
+    assert.equal(fs.readFileSync(fixture.specPath).equals(strictBytes), true);
+  } finally { fs.rmSync(fixture.root, { recursive: true, force: true }); }
+});
+
+test('Strict atomic readiness succeeds only after current allowlisted host observation', () => {
+  const fixture = createOrdinaryAuthoringFixture();
+  try {
+    const spec = JSON.parse(fs.readFileSync(fixture.specPath, 'utf8'));
+    spec.workflow_policy = POLICY.canonicalWorkflowPolicySnapshot({ planning_depth: 'Compact', assurance_level: 'Strict' });
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(spec, null, 2)}\n`);
+    const before = fs.readFileSync(fixture.specPath);
+    assert.throws(() => READINESS.finalizeReadiness({ specDir: fixture.specDir, projectRoot: fixture.root, reviewResult: ordinaryReview() }), /Strict readiness/);
+    assert.equal(fs.readFileSync(fixture.specPath).equals(before), true);
+
+    const digest = VALIDATOR.computeSemanticDigest21(fixture.specDir, spec);
+    assert.equal(digest.errors.length, 0, digest.errors.join('\n'));
+    const authorityHome = path.join(fixture.root, 'authority-home');
+    const claim = `CAFEKIT_SEMANTIC_REVIEW_ATTESTATION ${JSON.stringify({ feature_name: 'ordinary', spec_file: 'specs/ordinary/spec.json', semantic_digest: digest.digest, verdict: 'PASS' })}`;
+    const observed = spawnSync(process.execPath, [path.join(PACKAGE_ROOT, 'src/claude/hooks/semantic-review-authority.cjs')], {
+      cwd: fixture.root,
+      env: { ...process.env, HOME: authorityHome, USERPROFILE: authorityHome, PROJECT_ROOT: fixture.root },
+      input: JSON.stringify({ hook_event_name: 'SubagentStop', session_id: 'host-session', agent_id: 'reviewer-1', agent_type: 'code_auditor', last_assistant_message: claim, cwd: fixture.root }),
+      encoding: 'utf8',
+    });
+    assert.equal(observed.status, 0, observed.stderr);
+    const reviewFile = path.join(fixture.root, 'review.json');
+    fs.writeFileSync(reviewFile, `${JSON.stringify(ordinaryReview())}\n`);
+    const finalized = spawnSync(process.execPath, [path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-readiness.cjs'), fixture.specDir, '--review-result', reviewFile], {
+      cwd: fixture.root,
+      env: { ...process.env, HOME: authorityHome, USERPROFILE: authorityHome, PROJECT_ROOT: fixture.root },
+      encoding: 'utf8',
+    });
+    assert.equal(finalized.status, 0, `${finalized.stdout}\n${finalized.stderr}`);
+    assert.equal(JSON.parse(fs.readFileSync(fixture.specPath, 'utf8')).ready_for_implementation, true);
+  } finally { fs.rmSync(fixture.root, { recursive: true, force: true }); }
+});
+
+test('done is a final-state request bound to current semantic model and digest', () => {
+  const fixture = createCanonicalAuthoringFixture();
+  try {
+    promoteCanonicalModel(fixture);
+    const spec = makeCanonicalReady(fixture);
+    spec.status = 'done';
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(spec, null, 2)}\n`);
+    const candidate = {
+      featureDir: fixture.specDir,
+      featureName: 'feature',
+      specFile: fixture.specPath,
+      spec,
+    };
+    const dependencies = () => ({
+      validator: VALIDATOR,
+      grounder: GROUNDER,
+      semanticAuthority: SEMANTIC_AUTHORITY,
+    });
+    const current = FINAL_STATE.validateCanonicalFinalState({
+      policy: POLICY, projectRoot: fixture.root, candidate, dependencies,
+    });
+    assert.equal(current.ok, true, current.reason);
+    assert.equal(current.semanticDigest, spec.validation.semantic_review.semantic_digest);
+
+    const requirementsPath = path.join(fixture.specDir, 'requirements.md');
+    const requirements = fs.readFileSync(requirementsPath, 'utf8');
+    fs.writeFileSync(requirementsPath, requirements.replace('invalid input shall return rejected state', 'invalid input shall return a deterministic rejected state'));
+    const staleDigest = FINAL_STATE.validateCanonicalFinalState({
+      policy: POLICY, projectRoot: fixture.root, candidate, dependencies,
+    });
+    assert.equal(staleDigest.ok, false);
+    assert.match(staleDigest.reason, /stale|differs from Markdown projection/i);
+
+    fs.writeFileSync(requirementsPath, requirements);
+    const staleModel = structuredClone(spec);
+    staleModel.semantic_model.criteria[0].owner = 'A-D-02';
+    fs.writeFileSync(fixture.specPath, `${JSON.stringify(staleModel, null, 2)}\n`);
+    const invalidModel = FINAL_STATE.validateCanonicalFinalState({
+      policy: POLICY,
+      projectRoot: fixture.root,
+      candidate: { ...candidate, spec: staleModel },
+      dependencies,
+    });
+    assert.equal(invalidModel.ok, false);
+    assert.match(invalidModel.reason, /semantic projection|semantic_model|validation failed/i);
+  } finally {
+    fs.rmSync(fixture.root, { recursive: true, force: true });
+  }
+});
+
+test('flash PASS promotes proof; only trusted sync-finalize completes', () => {
+  const initial = canonicalFlashTask();
+  for (const verdict of ['FAIL', 'BLOCKED', 'PARTIAL', 'NO_TESTS', 'PASS_WITH_WARNINGS']) {
     const result = POLICY.promoteFlashTask(initial, verdict);
     assert.equal(result.status, 'in_progress');
     assert.equal(result.receipt, 'FLASH_UNVERIFIED');
@@ -214,7 +1061,7 @@ test('flash PASS promotes proof without completion, finalize alone completes', (
     assert.equal(result.unblocks, false);
     assert.match(result.blocker, /verification|test proof/);
   }
-  const promoted = POLICY.promoteFlashTask(initial, 'PASS', 'Verification: PASS\nCommand: pnpm test\nResult: PASS');
+  const promoted = POLICY.promoteFlashTask(initial, 'PASS', canonicalReceipt());
   assert.equal(promoted.status, 'in_progress');
   assert.equal(promoted.receipt.startsWith('Verification: PASS'), true);
   assert.equal(promoted.blocker, null);
@@ -222,33 +1069,38 @@ test('flash PASS promotes proof without completion, finalize alone completes', (
   assert.equal(promoted.unblocks, false);
   assert.equal(promoted.readyForSync, true);
   assert.equal(POLICY.finalizeFlashTask(promoted, 'sync'), promoted);
-  const finalized = POLICY.finalizeFlashTask(promoted, 'sync-finalize');
+  const forgedFinalize = POLICY.finalizeFlashTask(promoted, 'sync-finalize');
+  assert.equal(forgedFinalize.status, 'in_progress');
+  assert.equal(forgedFinalize.dependencyBlocked, true);
+  assert.equal(forgedFinalize.unblocks, false);
+  const finalized = POLICY.syncFinalizeFlashTask(initial, 'PASS', promoted.receipt);
   assert.equal(finalized.status, 'done');
   assert.equal(finalized.dependencyBlocked, false);
   assert.equal(finalized.unblocks, true);
   assert.equal(finalized.readyForSync, false);
   assert.equal(POLICY.isStaleFlashDone({ status: 'done', receipt: 'FLASH_UNVERIFIED' }), true);
-  assert.match(read(TEST_SKILL), /only explicit .*sync-finalize/);
+  assert.match(read(TEST_SKILL), /only explicit .*sync-finalize/i);
   assert.match(read(SYNC_SKILL), /sync-finalize/);
 });
 
 test('spec-gate rejects stale FLASH_UNVERIFIED done state', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-spec-gate-'));
-  const claude = path.join(root, '.claude');
-  fs.mkdirSync(path.join(claude, 'hooks'), { recursive: true });
-  fs.mkdirSync(path.join(claude, 'scripts'), { recursive: true });
-  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/spec-gate.cjs'), path.join(claude, 'hooks/spec-gate.cjs'));
-  fs.copyFileSync(POLICY_PATH, path.join(claude, 'scripts/workflow-policy.cjs'));
+  const specGate = installClaudeRuntimeClosure(root);
+  assert.equal(fs.existsSync(path.join(root, '.claude', 'scripts', 'spec-final-state.cjs')), true);
+  assert.equal(fs.existsSync(path.join(root, '.claude', 'scripts', 'validate-spec-output.cjs')), true);
   fs.mkdirSync(path.join(root, 'specs', 'demo', 'tasks'), { recursive: true });
   fs.writeFileSync(path.join(root, 'specs', 'demo', 'spec.json'), JSON.stringify({
     status: 'in_progress',
+    current_phase: 'closeout',
+    feature_name: 'demo',
     task_registry: { 'tasks/task.md': { status: 'done', receipt: 'FLASH_UNVERIFIED' } },
   }));
+  initFixtureGit(root);
   try {
-    const result = spawnSync(process.execPath, [path.join(claude, 'hooks/spec-gate.cjs')], {
+    const result = spawnSync(process.execPath, [specGate], {
       cwd: root,
       env: { ...process.env, PROJECT_ROOT: root },
-      input: JSON.stringify({ cwd: root }),
+      input: JSON.stringify({ cwd: root, session_id: 'test' }),
       encoding: 'utf8',
     });
     assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
@@ -263,40 +1115,51 @@ test('spec-gate rejects stale FLASH_UNVERIFIED done state', () => {
 test('first-run cache bypass is blocked - canonical receipt required even without cache', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-first-run-'));
   const claude = path.join(root, '.claude');
-  fs.mkdirSync(path.join(claude, 'hooks'), { recursive: true });
-  fs.mkdirSync(path.join(claude, 'scripts'), { recursive: true });
-  fs.copyFileSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/spec-gate.cjs'), path.join(claude, 'hooks/spec-gate.cjs'));
-  fs.copyFileSync(POLICY_PATH, path.join(claude, 'scripts/workflow-policy.cjs'));
+  const specGate = installClaudeRuntimeClosure(root);
   const specDir = path.join(root, 'specs', 'demo', 'tasks');
   fs.mkdirSync(specDir, { recursive: true });
   // Done task without canonical receipt (missing Command, provenance)
   fs.writeFileSync(path.join(root, 'specs', 'demo', 'spec.json'), JSON.stringify({
-    status: 'in_progress',
-    task_registry: { 'tasks/task.md': { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } },
+    status: 'done',
+    current_phase: 'closeout',
+    feature_name: 'demo',
+    task_registry: { 'tasks/task-R1-01-one.md': { status: 'done', completed_at: '2026-07-29T10:00:00.000Z' } },
   }));
-  fs.writeFileSync(path.join(specDir, 'task.md'), '# Task\n\n**Status:** done\n\n## Evidence\n\nVerification: PASS\n```\nnpm test\n```\n');
+  fs.writeFileSync(path.join(specDir, 'task-R1-01-one.md'), '# Task\n\n**Status:** done\n\n## Evidence\n\nVerification: PASS\n```\nnpm test\n```\n');
+  initFixtureGit(root);
   try {
-    const result = spawnSync(process.execPath, [path.join(claude, 'hooks/spec-gate.cjs')], {
+    assert.equal(fs.existsSync(path.join(claude, 'hooks', '.logs', 'spec-gate-last.json')), false);
+    const result = spawnSync(process.execPath, [specGate], {
       cwd: root,
       env: { ...process.env, PROJECT_ROOT: root },
-      input: JSON.stringify({ cwd: root }),
+      input: JSON.stringify({ cwd: root, session_id: 'test' }),
       encoding: 'utf8',
     });
     assert.equal(result.status, 0);
     const payload = JSON.parse(result.stdout);
     assert.equal(payload.decision, 'block', 'first-run without canonical receipt must block');
-    assert.match(payload.reason, /tasks\/task\.md/);
+    assert.match(payload.reason, /tasks\/task-R1-01-one\.md/);
+    assert.match(payload.reason, /receipt|command|provenance/i);
     // Also test that with canonical receipt it passes
-    fs.writeFileSync(path.join(specDir, 'task.md'), '# Task\n\n**Status:** done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nResult: PASS\nBase: abc123\nHead: def456\n```\nnpm test\nPASS\n```\n');
+    fs.writeFileSync(path.join(specDir, 'task-R1-01-one.md'), '# Task R1-01: One\n\n**Status:** done\n\n## Outcome\n\nVerified result.\n\n## Scope and Typed Anchors\n\n- **In scope:** focused result\n- **Out of scope:** none\n\n## Changes\n\n- [x] Verify result.\n\n## Acceptance\n\n- Result is verified.\n\n## Dependencies\n\n- none\n\n## Verification Plan\n\n- **Command:** `pnpm test`\n- **Expected:** focused tests pass\n- **Negative path:** not relevant for fixture\n- **Reachability:** fixture test entrypoint\n');
+    fs.mkdirSync(path.join(root, 'specs', 'demo', 'receipts'), { recursive: true });
+    fs.writeFileSync(
+      path.join(root, 'specs', 'demo', 'receipts', 'task-R1-01-one.md'),
+      bindFixtureReceipt(root, '# Task Receipt\n\nTask: task-R1-01-one.md\nTask path: tasks/task-R1-01-one.md\nVerification: PASS\nCommand: pnpm test\nExit: 0\nResult: PASS\nExpected: focused tests pass\nObserved: focused tests passed\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n```\nnpm test\nPASS\n```\n'),
+    );
+    fs.writeFileSync(
+      path.join(root, 'specs', 'demo', 'feature-receipt.md'),
+      bindFixtureReceipt(root, '# Feature Receipt\n\nFeature: demo\nVerification: PASS\nCommand: pnpm test\nExit: 0\nResult: PASS\nExpected: integrated feature passes\nObserved: integrated feature passed\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n'),
+    );
     // Clear cache to simulate fresh first-run with valid receipt
     try { fs.unlinkSync(path.join(claude, 'hooks', '.logs', 'spec-gate-last.json')); } catch {}
     try { fs.unlinkSync(path.join(__dirname, '..', '.logs', 'spec-gate-last.json')); } catch {}
     // Need to clear the cache that the hook uses (under claude hooks .logs) - we already cleared above
     // Re-run with valid receipt - should not block
-    const result2 = spawnSync(process.execPath, [path.join(claude, 'hooks/spec-gate.cjs')], {
+    const result2 = spawnSync(process.execPath, [specGate], {
       cwd: root,
       env: { ...process.env, PROJECT_ROOT: root },
-      input: JSON.stringify({ cwd: root }),
+      input: JSON.stringify({ cwd: root, session_id: 'test' }),
       encoding: 'utf8',
     });
     assert.equal(result2.stdout, '', 'valid canonical receipt on first run must not block');
@@ -307,7 +1170,7 @@ test('first-run cache bypass is blocked - canonical receipt required even withou
 });
 
 test('canonical receipt requires command, exit, provenance and unambiguous PASS', () => {
-  assert.deepEqual(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc\nHead: def\n'), []);
+  assert.deepEqual(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n'), []);
   const missingCommand = POLICY.validateCanonicalReceipt('Verification: PASS\nExit: 0\nBase: a\nHead: b\n');
   assert.ok(missingCommand.includes('command'));
   const missingProvenance = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\n');
@@ -317,7 +1180,7 @@ test('canonical receipt requires command, exit, provenance and unambiguous PASS'
   const artifactWithoutHash = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nArtifact: dist/bundle.js\n');
   assert.ok(artifactWithoutHash.includes('artifact_hash'));
   // CLI validation
-  const cli = spawnSync(process.execPath, [POLICY_PATH, '--validate-receipt', '--task-json', JSON.stringify({ body: 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n' }), '--json'], { encoding: 'utf8' });
+  const cli = spawnSync(process.execPath, [POLICY_PATH, '--validate-receipt', '--task-json', JSON.stringify({ body: 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n' }), '--json'], { encoding: 'utf8' });
   assert.equal(cli.status, 0);
   assert.equal(JSON.parse(cli.stdout).ok, true);
 });
@@ -330,7 +1193,7 @@ test('canonical receipt provenance requires both Base and Head (or both base_sha
   const onlyHead = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nHead: def456\n');
   assert.ok(onlyHead.includes('provenance'), 'only Head should fail provenance');
   // Both Base and Head passes
-  const bothLabels = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc123\nHead: def456\n');
+  const bothLabels = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n');
   assert.deepEqual(bothLabels, [], 'both Base and Head should pass');
   // Only base_sha fails
   const onlyBaseSha = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: abc123\n');
@@ -339,7 +1202,7 @@ test('canonical receipt provenance requires both Base and Head (or both base_sha
   const onlyHeadSha = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nhead_sha: def456\n');
   assert.ok(onlyHeadSha.includes('provenance'), 'only head_sha should fail provenance');
   // Both base_sha and head_sha passes
-  const bothSha = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: abc123\nhead_sha: def456\n');
+  const bothSha = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: 0123456789abcdef0123456789abcdef01234567\nhead_sha: 89abcdef0123456789abcdef0123456789abcdef\n');
   assert.deepEqual(bothSha, [], 'both base_sha and head_sha should pass');
   // Alternation-precedence false acceptance check: ensure single Head or base_sha alone does not pass
   const singleHeadLower = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nHead: single\n');
@@ -365,16 +1228,16 @@ test('canonical receipt provenance requires both Base and Head (or both base_sha
   assert.ok(bareBoth.includes('provenance'), 'bare base_sha head_sha without colon/value should fail');
   const baseEmptyHeadValid = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase:\nHead: def\n');
   assert.ok(baseEmptyHeadValid.includes('provenance'));
-  const validWithValues = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: abc123\nHead: def456\n');
+  const validWithValues = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n');
   assert.deepEqual(validWithValues, [], 'valid Base and Head with values should pass');
-  const validShaWithValues = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: abc\nhead_sha: def\n');
+  const validShaWithValues = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: 0123456789abcdef0123456789abcdef01234567\nhead_sha: 89abcdef0123456789abcdef0123456789abcdef\n');
   assert.deepEqual(validShaWithValues, [], 'valid base_sha and head_sha with values should pass');
   // CLI: only Base via --validate-receipt should fail
   const cliOnlyBase = spawnSync(process.execPath, [POLICY_PATH, '--validate-receipt', '--task-json', JSON.stringify({ body: 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\n' }), '--json'], { encoding: 'utf8' });
   assert.equal(cliOnlyBase.status, 2);
   assert.equal(JSON.parse(cliOnlyBase.stdout).ok, false);
   assert.ok(JSON.parse(cliOnlyBase.stdout).failures.includes('provenance'));
-  const cliBoth = spawnSync(process.execPath, [POLICY_PATH, '--validate-receipt', '--task-json', JSON.stringify({ body: 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n' }), '--json'], { encoding: 'utf8' });
+  const cliBoth = spawnSync(process.execPath, [POLICY_PATH, '--validate-receipt', '--task-json', JSON.stringify({ body: 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n' }), '--json'], { encoding: 'utf8' });
   assert.equal(cliBoth.status, 0);
   assert.equal(JSON.parse(cliBoth.stdout).ok, true);
   // CLI empty Base should fail
@@ -383,43 +1246,209 @@ test('canonical receipt provenance requires both Base and Head (or both base_sha
   assert.ok(JSON.parse(cliEmptyBase.stdout).failures.includes('provenance'));
 });
 
-test('lane traces - Direct, Standard, Critical classification, override, state mutation and completion', () => {
+test('canonical receipt binds expected provenance when the runtime supplies it', () => {
+  const body = canonicalReceipt();
+  const binding = POLICY.createReceiptBinding(RUNTIME_CONTEXT);
+  assert.deepEqual(binding.expectedProvenance, EXPECTED_PROVENANCE);
+  assert.equal(binding.requireProvenanceBinding, true);
+  assert.equal(binding.runtimeContext.context_id, RUNTIME_CONTEXT.context_id);
+  assert.throws(() => POLICY.createReceiptBinding(EXPECTED_PROVENANCE), /runtime-derived provenance context/);
+  assert.ok(POLICY.validateCanonicalReceipt(body, { requireProvenanceBinding: true }).includes('provenance'));
+  assert.deepEqual(POLICY.validateCanonicalReceipt(body, { expectedProvenance: EXPECTED_PROVENANCE }), []);
+  assert.ok(POLICY.validateCanonicalReceipt(body, { expectedProvenance: { base: EXPECTED_BASE, head: 'fedcba9876543210fedcba9876543210fedcba98' } }).includes('provenance'));
+  const taskOptions = POLICY.receiptValidatorOptions({ expected_provenance: EXPECTED_PROVENANCE });
+  assert.equal(taskOptions.expectedProvenance, null, 'task-authored expected provenance is diagnostic metadata only');
+  assert.deepEqual(POLICY.validateCanonicalReceipt(body, taskOptions), [], 'diagnostic parsing may accept schema-valid anchors without treating them as identity');
+});
+
+test('runtime provenance derives exact Git evidence, CLI context, and stale/forged blockers', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-provenance-adversarial-'));
+  const specsRoot = path.join(root, 'specs');
+  const featureRoot = path.join(specsRoot, 'demo');
+  const specFile = path.join(featureRoot, 'spec.json');
+  const sourceFile = path.join(root, 'src', 'app.js');
+  const renameSource = path.join(root, 'src', 'rename-old.js');
+  const renameTarget = path.join(root, 'src', 'rename-new.js');
+  fs.mkdirSync(path.dirname(sourceFile), { recursive: true });
+  fs.mkdirSync(featureRoot, { recursive: true });
+  fs.writeFileSync(specFile, JSON.stringify({ status: 'in_progress', feature_name: 'demo', task_registry: {} }));
+  fs.writeFileSync(sourceFile, 'original source\n');
+  fs.writeFileSync(renameSource, 'rename source\n');
+  fs.writeFileSync(path.join(root, '.gitignore'), 'ignored-secret.env\nnode_modules/\n.cache/\n');
+  initFixtureGit(root);
+  try {
+    const input = {
+      projectRoot: root,
+      specsRoot,
+      specFile,
+      featureName: 'demo',
+      runtimeSession: 'provenance-session',
+    };
+    const initial = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    const exactReceipt = `Verification: PASS\nCommand: node --test\nExit: 0\nBase: ${initial.base}\nHead: ${initial.head}\n`;
+    assert.deepEqual(
+      POLICY.validateCanonicalReceipt(exactReceipt, POLICY.receiptValidatorOptions({}, {
+        runtimeContext: initial,
+        requireProvenanceBinding: true,
+      })),
+      [],
+      'exact runtime-derived receipt must validate',
+    );
+    const arbitraryReceipt = 'Verification: PASS\nCommand: node --test\nExit: 0\nBase: ' + 'a'.repeat(40) + '\nHead: ' + 'b'.repeat(64) + '\n';
+    assert.ok(
+      POLICY.validateCanonicalReceipt(arbitraryReceipt, POLICY.receiptValidatorOptions({}, {
+        runtimeContext: initial,
+        requireProvenanceBinding: true,
+      })).includes('provenance'),
+      'valid-shaped arbitrary SHA values must not bind',
+    );
+
+    const cli = spawnSync(process.execPath, [
+      path.join(PACKAGE_ROOT, 'src/claude/scripts/provenance.cjs'), '--json',
+      '--project-root', root, '--specs-root', specsRoot, '--spec-file', specFile,
+      '--feature-name', 'demo', '--runtime-session', 'provenance-session',
+    ], { cwd: root, encoding: 'utf8' });
+    assert.equal(cli.status, 0, `${cli.stdout}\n${cli.stderr}`);
+    const cliOutput = JSON.parse(cli.stdout);
+    assert.equal(cliOutput.ok, true);
+    assert.equal(cliOutput.Base, initial.base);
+    assert.equal(cliOutput.Head, initial.head);
+    assert.equal(cliOutput.context_id, initial.context_id);
+
+    const ignoredSecret = path.join(root, 'ignored-secret.env');
+    fs.writeFileSync(ignoredSecret, 'TOKEN=first-secret\n');
+    const withIgnoredSecret = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    fs.writeFileSync(ignoredSecret, 'TOKEN=changed-secret\n');
+    const withChangedIgnoredSecret = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    assert.equal(withIgnoredSecret.head, initial.head, 'ignored secret-like files must not enter Head');
+    assert.equal(withChangedIgnoredSecret.head, initial.head, 'changing an ignored secret-like file must not change Head');
+
+    const ignoredCacheFile = path.join(root, 'packages', 'app', 'node_modules', 'cache', 'runtime.bin');
+    fs.mkdirSync(path.dirname(ignoredCacheFile), { recursive: true });
+    fs.writeFileSync(ignoredCacheFile, 'runtime cache bytes\n');
+    const withIgnoredCache = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    fs.writeFileSync(ignoredCacheFile, 'changed runtime cache bytes\n');
+    const withChangedIgnoredCache = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    assert.equal(withIgnoredCache.head, initial.head, 'nested ignored node_modules/cache files must not enter Head');
+    assert.equal(withChangedIgnoredCache.head, initial.head, 'changing nested ignored cache data must not change Head');
+
+    const forgedContext = { ...initial };
+    const forgedDecision = POLICY.completionDecision('PASS', {
+      workflow_policy: { proof_obligations: ['needsExecutionProof'] },
+      runtime_context: forgedContext,
+      execution_receipt: exactReceipt,
+    });
+    assert.equal(forgedDecision.completion, 'unfinished');
+    assert.deepEqual(forgedDecision.missingProof, ['runtime_provenance']);
+
+    const flash = {
+      status: 'in_progress',
+      receipt: 'FLASH_UNVERIFIED',
+      blocker: 'awaiting test proof',
+      dependencyBlocked: true,
+      unblocks: false,
+      runtime_context: initial,
+    };
+    const promoted = POLICY.promoteFlashTask(flash, 'PASS', exactReceipt);
+    assert.equal(promoted.readyForSync, true);
+
+    fs.writeFileSync(sourceFile, 'mutated source\n');
+    const stale = POLICY.completionDecision('PASS', {
+      workflow_policy: { proof_obligations: ['needsExecutionProof'] },
+      receipt_binding: POLICY.createReceiptBinding(initial),
+      execution_receipt: exactReceipt,
+    });
+    assert.equal(stale.completion, 'unfinished');
+    assert.ok(stale.missingProof.some((item) => item.includes('execution_receipt:provenance')));
+    const staleFinalized = POLICY.syncFinalizeFlashTask(flash, 'PASS', exactReceipt, initial);
+    assert.equal(staleFinalized.status, 'in_progress');
+    assert.equal(staleFinalized.readyForSync, false);
+
+    fs.writeFileSync(path.join(root, 'src', 'untracked.js'), 'untracked source\n');
+    const withUntracked = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    assert.notEqual(withUntracked.head, withIgnoredCache.head, 'non-ignored untracked source must change Head');
+    fs.chmodSync(renameSource, 0o755);
+    const withMode = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    assert.notEqual(withMode.head, withUntracked.head, 'mode changes must change Head');
+    fs.renameSync(renameSource, renameTarget);
+    const withRename = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    assert.notEqual(withRename.head, withMode.head, 'rename path semantics must change Head');
+    fs.unlinkSync(sourceFile);
+    const withDeletion = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    assert.notEqual(withDeletion.head, withRename.head, 'tracked deletion must change Head');
+    const staged = spawnSync('git', ['-C', root, 'add', '-A'], { encoding: 'utf8' });
+    assert.equal(staged.status, 0, staged.stderr);
+    const stagedRename = PROVENANCE_HELPER.deriveRuntimeContext(input);
+    assert.notEqual(stagedRename.head, withDeletion.head, 'staged rename/deletion evidence must be included');
+
+    assert.throws(() => PROVENANCE_HELPER.deriveRuntimeContext({
+      ...input,
+      feature_name: 'other',
+    }), /disagree/);
+    assert.throws(() => PROVENANCE_HELPER.deriveRuntimeContext({
+      ...input,
+      specsRoot: root,
+    }), /distinct project subdirectory/);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+
+  const nonGit = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-provenance-non-git-'));
+  const nonGitSpec = path.join(nonGit, 'specs', 'demo', 'spec.json');
+  fs.mkdirSync(path.dirname(nonGitSpec), { recursive: true });
+  fs.writeFileSync(nonGitSpec, JSON.stringify({ status: 'in_progress', feature_name: 'demo' }));
+  try {
+    const blocked = spawnSync(process.execPath, [
+      path.join(PACKAGE_ROOT, 'src/claude/scripts/provenance.cjs'), '--json',
+      '--project-root', nonGit, '--specs-root', path.join(nonGit, 'specs'),
+      '--spec-file', nonGitSpec, '--feature-name', 'demo', '--runtime-session', 'non-git-session',
+    ], { cwd: nonGit, encoding: 'utf8' });
+    assert.equal(blocked.status, 2);
+    assert.equal(JSON.parse(blocked.stdout).error.code, 'git_command_failed');
+  } finally {
+    fs.rmSync(nonGit, { recursive: true, force: true });
+  }
+});
+
+test('lane traces - Direct, Standard, explicit Strict classification, override, state mutation and completion', () => {
   // Direct: isolated reversible low-risk
   const direct = POLICY.classifyLane({ reversible: true, lowRisk: true, isolated: true, taskCount: 1 });
   assert.equal(direct.lane, 'Direct');
   assert.equal(direct.automaticLane, 'Direct');
-  assert.deepEqual(POLICY.lanePolicy(direct).delegated, []);
+  assert.deepEqual(POLICY.lanePolicy(direct).proof_obligations, ['needsExecutionProof']);
   assert.equal(POLICY.lanePolicy(direct).requiresSpec, false);
   assert.equal(POLICY.lanePolicy(direct).shipPoint, 'task');
   // Standard: default
   const standard = POLICY.classifyLane({ title: 'add pagination to list', taskCount: 1 });
   assert.equal(standard.lane, 'Standard');
-  assert.deepEqual(POLICY.lanePolicy(standard).delegated, ['code-auditor']);
+  assert.deepEqual(POLICY.lanePolicy(standard).proof_obligations, ['needsExecutionProof']);
   assert.equal(POLICY.lanePolicy(standard).shipPoint, 'feature');
-  // Critical: auth signal
-  const critical = POLICY.classifyLane({ riskSignals: { auth: true }, taskCount: 1 });
+  // Risk alone is Elevated; Critical requires an explicit Strict assurance choice.
+  const elevated = POLICY.classifyLane({ riskSignals: { auth: true }, taskCount: 1 });
+  assert.equal(elevated.lane, 'Standard');
+  assert.deepEqual(POLICY.lanePolicy(elevated).proof_obligations, ['needsInspection', 'needsExecutionProof']);
+  const critical = POLICY.classifyLane({ riskSignals: { auth: true }, assurance_level: 'Strict', taskCount: 1 });
   assert.equal(critical.lane, 'Critical');
   assert.ok(critical.risks.includes('auth'));
-  assert.deepEqual(POLICY.lanePolicy(critical).delegated, ['inspector', 'implementer', 'test-runner', 'code-auditor']);
+  assert.deepEqual(POLICY.lanePolicy(critical).proof_obligations, ['needsInspection', 'needsExecutionProof', 'needsIndependentAudit']);
   // Override: Direct requesting Critical is allowed (upgrade) without extra auth
   const upgrade = POLICY.classifyLane({ reversible: true, lowRisk: true, isolated: true, taskCount: 1, override: 'Critical' });
   assert.equal(upgrade.lane, 'Critical');
   assert.equal(upgrade.automaticLane, 'Direct');
   // Downgrade without auth is blocked
-  assert.throws(() => POLICY.classifyLane({ riskSignals: { payment: true }, override: 'Standard' }), /requires explicit user authorization/);
-  // Downgrade with auth succeeds and surfaces warning
-  const downgrade = POLICY.classifyLane({ riskSignals: { payment: true }, override: 'Standard', userAuthorized: true });
-  assert.equal(downgrade.lane, 'Standard');
-  assert.match(downgrade.warnings.join(' '), /Downgrade authorized by user/);
+  assert.throws(() => POLICY.classifyLane({ riskSignals: { payment: true }, override: 'Standard' }), /assurance_level downgrade.*blocked/i);
+  // Caller-owned booleans cannot weaken the classified minimum.
+  assert.throws(() => POLICY.classifyLane({ riskSignals: { payment: true }, override: 'Standard', userAuthorized: true }), /assurance_level downgrade.*blocked/i);
+  assert.throws(() => POLICY.classifyLane({ riskSignals: { payment: true }, override: 'Standard', user_approved: true }), /assurance_level downgrade.*blocked/i);
   // State mutation: approvalState
   const pendingApproval = POLICY.approvalState({ generated: true, agent_validated: false, user_approved: false });
   assert.equal(pendingApproval.ready, false);
   const agentValidated = POLICY.approvalState({ generated: true, agent_validated: true, user_approved: false });
-  assert.equal(agentValidated.ready, false, 'agent_validated alone must not imply ready');
+  assert.equal(agentValidated.ready, true, 'generated plus agent validation is technical readiness');
   const approved = POLICY.approvalState({ generated: true, agent_validated: true, user_approved: true });
   assert.equal(approved.ready, true);
   // Completion: flash work remains in_progress and does not unblock
-  const flashTask = { status: 'in_progress', receipt: 'FLASH_UNVERIFIED', blocker: 'awaiting /hapo:test <feature>', dependencyBlocked: true, unblocks: false };
+  const flashTask = canonicalFlashTask();
   const failRemains = POLICY.promoteFlashTask(flashTask, 'FAIL');
   assert.equal(failRemains.status, 'in_progress');
   assert.equal(failRemains.unblocks, false);
@@ -427,20 +1456,20 @@ test('lane traces - Direct, Standard, Critical classification, override, state m
   assert.equal(blockedRemains.unblocks, false);
   const noTestsRemains = POLICY.promoteFlashTask(flashTask, 'NO_TESTS');
   assert.equal(noTestsRemains.unblocks, false);
-  const promoted = POLICY.promoteFlashTask(flashTask, 'PASS', 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n');
+  const promoted = POLICY.promoteFlashTask(flashTask, 'PASS', canonicalReceipt());
   assert.equal(promoted.readyForSync, true);
   assert.equal(promoted.unblocks, false, 'promoted flash must not unblock until sync-finalize');
-  const finalized = POLICY.finalizeFlashTask(promoted, 'sync-finalize');
+  const finalized = POLICY.syncFinalizeFlashTask(flashTask, 'PASS', promoted.receipt);
   assert.equal(finalized.status, 'done');
   assert.equal(finalized.unblocks, true);
 });
 
 test('flash selective promotion - only specific task is promoted, not blanket', () => {
   const registry = {
-    'tasks/task-a.md': { status: 'in_progress', receipt: 'FLASH_UNVERIFIED', dependencyBlocked: true, unblocks: false },
-    'tasks/task-b.md': { status: 'in_progress', receipt: 'FLASH_UNVERIFIED', dependencyBlocked: true, unblocks: false },
+    'tasks/task-a.md': canonicalFlashTask(),
+    'tasks/task-b.md': canonicalFlashTask(),
   };
-  const promotedA = POLICY.promoteFlashTask(registry['tasks/task-a.md'], 'PASS', 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n');
+  const promotedA = POLICY.promoteFlashTask(registry['tasks/task-a.md'], 'PASS', canonicalReceipt());
   const notPromotedB = registry['tasks/task-b.md']; // unchanged
   assert.equal(promotedA.readyForSync, true);
   assert.equal(notPromotedB.receipt, 'FLASH_UNVERIFIED');
@@ -1118,3 +2147,700 @@ process.stdin.on('end', ()=>{
     fs.rmSync(root, { recursive: true, force: true });
   }
 });
+
+// ── P0 regressions ──────────────────────────────────────────────────────
+test('P0 receipt fail-closed: Exit 1/-1/abc/conflict/empty command rejected', () => {
+  const base = 'Verification: PASS\nCommand: pnpm test\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n';
+  const cases = [
+    { body: `${base}Exit: 1\n`, shouldFail: 'exit_result', desc: 'Exit 1' },
+    { body: `${base}Exit: -1\n`, shouldFail: 'exit_result', desc: 'Exit -1' },
+    { body: `${base}Exit: abc\n`, shouldFail: 'exit_result', desc: 'Exit abc' },
+    { body: `${base}Exit: 0\nExit: 1\n`, shouldFail: 'exit_result', desc: 'conflicting exits 0 and 1' },
+    { body: `${base}Exit: 0\nExit: abc\n`, shouldFail: 'exit_result', desc: 'conflicting exit 0 and abc' },
+    { body: 'Verification: PASS\nCommand:\nExit: 0\nBase: a\nHead: b\n', shouldFail: 'command', desc: 'empty command' },
+    { body: 'Verification: PASS\nCommand:   \nExit: 0\nBase: a\nHead: b\n', shouldFail: 'command', desc: 'command spaces only' },
+    { body: `${base}Exit: 0\nResult: FAIL\n`, shouldFail: 'exit_result', desc: 'Result FAIL with Exit 0' },
+    { body: `${base}Exit: 1\nResult: PASS\n`, shouldFail: 'exit_result', desc: 'Result PASS with Exit 1' },
+    { body: 'Verification: PASS\nCommand: pnpm test\nResult: PASS\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n', shouldFail: null, desc: 'Result PASS without Exit (legacy alias ok)' },
+    { body: 'Verification: PASS\nCommand: pnpm test\nResult: FAIL\nBase: a\nHead: b\n', shouldFail: 'exit_result', desc: 'Result FAIL without Exit' },
+    { body: 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: {{base}}\nHead: {{head}}\n', shouldFail: 'placeholder', desc: 'placeholder provenance' },
+    { body: 'Verification: PASS\nCommand: {{cmd}}\nExit: 0\nBase: a\nHead: b\n', shouldFail: 'placeholder', desc: 'placeholder command' },
+    { body: 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\n', shouldFail: 'provenance', desc: 'missing Head' },
+  ];
+  for (const { body, shouldFail, desc } of cases) {
+    const fails = POLICY.validateCanonicalReceipt(body);
+    if (shouldFail) {
+      assert.ok(fails.includes(shouldFail) || fails.includes('placeholder') || fails.includes('exit_result') || fails.includes('command') || fails.includes('provenance'), `case ${desc} should fail with ${shouldFail}, got ${fails}`);
+    } else {
+      assert.deepEqual(fails, [], `case ${desc} should pass, got ${fails}`);
+    }
+  }
+  // CLI parity: Exit 1 must be rejected via CLI
+  const cli = spawnSync(process.execPath, [POLICY_PATH, '--validate-receipt', '--task-json', JSON.stringify({ body: `${base}Exit: 1\n` }), '--json'], { encoding: 'utf8' });
+  assert.equal(cli.status, 2);
+  assert.equal(JSON.parse(cli.stdout).ok, false);
+});
+
+test('P0 flash marker-only must not promote or finalize', () => {
+  const flash = canonicalFlashTask({ blocker: 'awaiting /hapo:test' });
+  const markerOnly = 'Verification: PASS';
+  const promoted = POLICY.promoteFlashTask(flash, 'PASS', markerOnly);
+  assert.equal(promoted.status, 'in_progress');
+  assert.equal(promoted.receipt, 'FLASH_UNVERIFIED');
+  assert.equal(promoted.readyForSync, false);
+  assert.equal(promoted.dependencyBlocked, true);
+  assert.equal(promoted.unblocks, false);
+  assert.match(promoted.blocker, /canonical receipt/);
+  // Even with PASS marker but missing command/exit/provenance, finalize must not complete
+  const fakePromoted = { status: 'in_progress', receipt: markerOnly, readyForSync: true, dependencyBlocked: true, unblocks: false };
+  const notFinalized = POLICY.finalizeFlashTask(fakePromoted, 'sync-finalize');
+  assert.equal(notFinalized.status, 'in_progress', 'marker-only receipt must not finalize');
+  // Valid receipt promotes correctly
+  const valid = canonicalReceipt();
+  const good = POLICY.promoteFlashTask(flash, 'PASS', valid);
+  assert.equal(good.readyForSync, true);
+  assert.equal(good.receipt, valid.trim());
+  const forgedFinalize = POLICY.finalizeFlashTask(good, 'sync-finalize');
+  assert.equal(forgedFinalize.status, 'in_progress');
+  assert.equal(forgedFinalize.unblocks, false);
+  const finalized = POLICY.syncFinalizeFlashTask(flash, 'PASS', valid);
+  assert.equal(finalized.status, 'done');
+});
+
+test('P0 canonical artifacts declaration requires SHA-256 and keeps no-artifact receipts compatible', () => {
+  const receipt = 'Verification: PASS\nCommand: node --test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n';
+  const invalid = `${receipt}sha256: abc123\n`;
+  const digest = 'd'.repeat(64);
+  const valid = `${receipt}Artifact: output/bundle.js\nSHA-256: ${digest}\n`;
+  assert.deepEqual(POLICY.validateCanonicalReceipt(receipt), []);
+  const options = POLICY.receiptValidatorOptions({ artifacts: ['output/bundle.js'] });
+  assert.equal(options.requireArtifactHash, true);
+  assert.equal(options.artifactDeclarationValid, true);
+  assert.ok(POLICY.validateCanonicalReceipt(receipt, options).includes('artifact_hash'));
+  assert.ok(POLICY.validateCanonicalReceipt(invalid, options).includes('artifact_hash'));
+  assert.deepEqual(POLICY.validateCanonicalReceipt(valid, options), []);
+  assert.equal(POLICY.receiptValidatorOptions({}).requireArtifactHash, false);
+  assert.equal(POLICY.receiptValidatorOptions({ artifact_ref: 'output/bundle.js' }).requireArtifactHash, true, 'legacy alias remains read-compatible');
+  for (const declaration of [null, [], ['../outside'], [{ path: 'output/bundle.js' }]]) {
+    const malformed = POLICY.receiptValidatorOptions({ artifacts: declaration });
+    assert.equal(malformed.artifactDeclarationValid, false, `malformed declaration must be rejected: ${JSON.stringify(declaration)}`);
+    assert.ok(POLICY.validateCanonicalReceipt(receipt, malformed).includes('artifact_declaration'));
+  }
+});
+
+test('P0 sync-finalize derives promotion from current FLASH_UNVERIFIED plus explicit PASS proof', () => {
+  const receipt = canonicalReceipt('node --test');
+  const forged = {
+    status: 'in_progress',
+    receipt,
+    readyForSync: true,
+    dependencyBlocked: true,
+    unblocks: false,
+    flashTransition: 'promoted',
+    promotionReceipt: receipt,
+  };
+  const direct = spawnSync(process.execPath, [
+    POLICY_PATH,
+    '--sync-finalize',
+    '--task-json',
+    JSON.stringify(forged),
+    '--json',
+  ], { encoding: 'utf8' });
+  assert.equal(direct.status, 2, `${direct.stdout}\n${direct.stderr}`);
+  const directPayload = JSON.parse(direct.stdout);
+  assert.equal(directPayload.ok, false);
+  assert.equal(directPayload.task.status, 'in_progress');
+  assert.equal(directPayload.task.receipt, 'FLASH_UNVERIFIED');
+  assert.equal(directPayload.task.readyForSync, false);
+  assert.equal(directPayload.task.dependencyBlocked, true);
+  assert.equal(directPayload.task.unblocks, false);
+  assert.match(directPayload.message, /current task must be FLASH_UNVERIFIED.*canonical/i);
+
+  const minimal = { status: 'in_progress', receipt: 'FLASH_UNVERIFIED' };
+  const minimalResult = POLICY.syncFinalizeFlashTask(minimal, 'PASS', receipt);
+  assert.equal(minimalResult.status, 'in_progress');
+  assert.match(minimalResult.blocker, /exact canonical stored state/);
+  const forgedOpen = { ...canonicalFlashTask(), readyForSync: true };
+  const forgedOpenResult = POLICY.syncFinalizeFlashTask(forgedOpen, 'PASS', receipt);
+  assert.equal(forgedOpenResult.status, 'in_progress');
+  assert.equal(forgedOpenResult.unblocks, false);
+
+  const current = canonicalFlashTask({ blocker: 'awaiting /hapo:test' });
+  const supported = spawnSync(process.execPath, [
+    POLICY_PATH,
+    '--sync-finalize',
+    '--task-json',
+    JSON.stringify(current),
+    '--verdict',
+    'PASS',
+    '--proof',
+    receipt,
+    '--project-root',
+    RUNTIME_ROOT,
+    '--specs-root',
+    path.join(RUNTIME_ROOT, 'specs'),
+    '--spec-file',
+    RUNTIME_SPEC,
+    '--feature-name',
+    'demo',
+    '--runtime-session',
+    'implementation-session-1',
+    '--json',
+  ], { encoding: 'utf8' });
+  assert.equal(supported.status, 0, `${supported.stdout}\n${supported.stderr}`);
+  assert.equal(JSON.parse(supported.stdout).task.status, 'done');
+  const warningFinalize = POLICY.syncFinalizeFlashTask(current, 'PASS_WITH_WARNINGS', receipt);
+  assert.equal(warningFinalize.status, 'in_progress');
+  assert.equal(warningFinalize.unblocks, false);
+
+  const initial = canonicalFlashTask();
+  const promoted = POLICY.promoteFlashTask(initial, 'PASS', receipt);
+  const persisted = JSON.parse(JSON.stringify(promoted));
+  assert.equal(persisted.flashTransition, 'promoted');
+  assert.equal(persisted.promotionReceipt, receipt.trim());
+  const forgedPersistedFinalize = POLICY.finalizeFlashTask(persisted, 'sync-finalize');
+  assert.equal(forgedPersistedFinalize.status, 'in_progress');
+  assert.equal(forgedPersistedFinalize.unblocks, false);
+  const finalized = POLICY.syncFinalizeFlashTask(initial, 'PASS', receipt);
+  assert.equal(finalized.status, 'done');
+  assert.equal(finalized.flashTransition, 'finalized');
+
+  const artifactInitial = { ...initial, artifacts: ['output/bundle.js'] };
+  const artifactPromotion = POLICY.promoteFlashTask(artifactInitial, 'PASS', receipt);
+  assert.equal(artifactPromotion.readyForSync, false, 'flash promotion must apply task artifact requirements');
+
+  const badProof = spawnSync(process.execPath, [
+    POLICY_PATH,
+    '--sync-finalize',
+    '--task-json',
+    JSON.stringify(current),
+    '--verdict',
+    'PASS',
+    '--proof',
+    'Verification: PASS',
+    '--json',
+  ], { encoding: 'utf8' });
+  assert.equal(badProof.status, 2);
+  assert.equal(JSON.parse(badProof.stdout).task.status, 'in_progress');
+
+  const badArtifact = spawnSync(process.execPath, [
+    POLICY_PATH,
+    '--sync-finalize',
+    '--task-json',
+    JSON.stringify({ ...current, artifacts: ['output/bundle.js'] }),
+    '--verdict',
+    'PASS',
+    '--proof',
+    receipt,
+    '--json',
+  ], { encoding: 'utf8' });
+  assert.equal(badArtifact.status, 2);
+  assert.equal(JSON.parse(badArtifact.stdout).task.status, 'in_progress');
+
+  const markerOnly = {
+    ...forged,
+    flashTransition: 'promoted',
+    promotionReceipt: 'Verification: PASS',
+    receipt: 'Verification: PASS',
+  };
+  assert.equal(POLICY.finalizeFlashTask(markerOnly, 'sync-finalize').status, 'in_progress');
+});
+
+test('P0 Claude and Codex reject configured specs roots outside the project', () => {
+  const claudeResolver = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs'));
+  const codexUtils = require(path.join(PACKAGE_ROOT, 'src/codex/hooks/lib/spec-utils.cjs'));
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-external-specs-'));
+  const externalRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-configured-specs-'));
+  try {
+    const local = path.join(tmp, 'specs', 'local');
+    const external = path.join(externalRoot, 'remote');
+    fs.mkdirSync(local, { recursive: true });
+    fs.mkdirSync(external, { recursive: true });
+    fs.writeFileSync(path.join(local, 'spec.json'), JSON.stringify({ status: 'in_progress', feature_name: 'local' }));
+    fs.writeFileSync(path.join(external, 'spec.json'), JSON.stringify({ status: 'in_progress', feature_name: 'remote' }));
+    const runtime = { paths: { specs: externalRoot } };
+    const claude = claudeResolver.resolveActiveSpec({ projectRoot: tmp, runtime });
+    const codex = codexUtils.resolveActiveSpec(tmp, runtime, null, null);
+    assert.equal(claude.error, 'invalid_specs');
+    assert.equal(codex.error, 'invalid_specs');
+    assert.match(claude.reason, /escapes project root/);
+    assert.match(codex.reason, /escapes project root/);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    fs.rmSync(externalRoot, { recursive: true, force: true });
+  }
+});
+
+test('P0 caller-owned downgrade flags have no canonical capability', () => {
+  for (const callerClaim of [{ user_approved: true }, { userApproved: true }, { userAuthorized: true }]) {
+    assert.throws(
+      () => POLICY.classifyLane({ riskSignals: { privacy: true }, override: 'Direct', ...callerClaim }),
+      (error) => /downgrade/.test(error.message) && /not permitted/.test(error.message),
+    );
+  }
+  assert.throws(() => POLICY.classifyLane({ riskSignals: { auth: true }, override: 'Standard', confirmDowngrade: true }), /assurance_level downgrade.*blocked/i);
+  assert.equal(POLICY.isUserAuthorizedForDowngrade, undefined);
+});
+
+test('P0 canonical policy exposes no caller-owned downgrade authority', () => {
+  assert.equal(POLICY.isUserAuthorizedForDowngrade, undefined);
+  assert.equal(POLICY.isValidOverrideReceipt, undefined);
+  assert.equal(POLICY.CANONICAL_WORKFLOW_POLICY_FIELDS.includes('override_' + 'receipt'), false);
+  assert.throws(
+    () => POLICY.classifyLane({
+      riskSignals: { privacy: true },
+      override: 'Direct',
+      overrideReceipt: { verifiedByRuntime: true },
+    }),
+    (error) => /downgrade/.test(error.message) && /not permitted/.test(error.message),
+  );
+});
+
+test('P0 active spec deterministic: multiple active ambiguity and explicit target/path containment', () => {
+  const RESOLVER = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs'));
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-resolver-'));
+  try {
+    const specsDir = path.join(tmp, 'specs');
+    fs.mkdirSync(specsDir, { recursive: true });
+    // Create two active specs
+    for (const name of ['alpha', 'beta']) {
+      fs.mkdirSync(path.join(specsDir, name), { recursive: true });
+      fs.writeFileSync(path.join(specsDir, name, 'spec.json'), JSON.stringify({ status: 'in_progress', feature_name: name, current_phase: 'design' }));
+    }
+    const amb = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {} });
+    assert.equal(amb.error, 'multiple_active');
+    assert.deepEqual(amb.candidates.sort(), ['alpha', 'beta']);
+    // Explicit feature resolves deterministically
+    const alpha = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {}, explicitFeature: 'alpha' });
+    assert.equal(alpha.featureName, 'alpha');
+    // Explicit not-found fail-closed
+    const notFound = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {}, explicitFeature: 'gamma' });
+    assert.equal(notFound.error, 'explicit_not_found');
+    // Explicit path containment: try to escape via ../
+    const escape = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {}, explicitPath: path.join(tmp, 'specs', '..', 'etc', 'passwd') });
+    assert.equal(escape.error, 'explicit_malformed');
+    // Malformed feature name with slash must be rejected
+    const malformed = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {}, explicitFeature: '../alpha' });
+    assert.equal(malformed.error, 'explicit_malformed');
+    // Valid explicit path inside root
+    const validPath = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {}, explicitPath: path.join(specsDir, 'beta', 'spec.json') });
+    assert.equal(validPath.featureName, 'beta');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('P0 parity Claude/Codex: canonical receipt and multi-active', () => {
+  // Codex receipt validator must match Claude policy
+  const codexReceipt = require(path.join(PACKAGE_ROOT, 'src/codex/hooks/lib/spec-receipt.cjs'));
+  const claudeFails = POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 1\nBase: a\nHead: b\n');
+  const codexFails = codexReceipt.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 1\nBase: a\nHead: b\n');
+  assert.deepEqual(claudeFails.sort(), codexFails.sort(), 'Claude and Codex validators must agree on Exit 1');
+  const codexEmptyCmd = codexReceipt.validateCanonicalReceipt('Verification: PASS\nCommand:\nExit: 0\nBase: a\nHead: b\n');
+  assert.ok(codexEmptyCmd.includes('command'), 'Codex must reject empty Command');
+  // Codex resolver parity: same containment behaviour
+  const codexUtils = require(path.join(PACKAGE_ROOT, 'src/codex/hooks/lib/spec-utils.cjs'));
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-resolver-'));
+  try {
+    const specsDir = path.join(tmp, 'specs');
+    fs.mkdirSync(specsDir, { recursive: true });
+    for (const name of ['x', 'y']) {
+      fs.mkdirSync(path.join(specsDir, name), { recursive: true });
+      fs.writeFileSync(path.join(specsDir, name, 'spec.json'), JSON.stringify({ status: 'in_progress', feature_name: name }));
+    }
+    const amb = codexUtils.resolveActiveSpec(tmp, {}, null, null);
+    assert.equal(amb.error, 'multiple_active');
+    const esc = codexUtils.resolveActiveSpec(tmp, {}, null, path.join(tmp, 'specs', '..', 'outside', 'spec.json'));
+    assert.equal(esc.error, 'explicit_malformed');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('P0 regression: placeholder, explicit failure, artifact and lanePolicy forged are blocked', () => {
+  // Probe A: explicit failure outcomes must fail canonical validator and not promote flash
+  const bodyTestsFailed = 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nTests failed: 1\n';
+  assert.ok(POLICY.validateCanonicalReceipt(bodyTestsFailed).length > 0, 'Tests failed: 1 must be rejected');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nResult: FAIL\nResult: PASS\n').includes('exit_result'), 'Result FAIL then PASS must be rejected');
+  const flashTask = { status: 'in_progress', receipt: 'FLASH_UNVERIFIED', blocker: 'awaiting', dependencyBlocked: true, unblocks: false };
+  const notPromoted = POLICY.promoteFlashTask(flashTask, 'PASS', bodyTestsFailed);
+  assert.equal(notPromoted.readyForSync, false, 'flash with Tests failed should not promote');
+  assert.equal(notPromoted.receipt, 'FLASH_UNVERIFIED');
+
+  // Probe B: placeholder tokens must be rejected, but substring todo must pass
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: TODO\nExit: 0\nBase: a\nHead: b\n').includes('command'), 'Command TODO must be rejected');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: TBD\nHead: b\n').includes('provenance'), 'Base TBD must be rejected');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: N/A\n').includes('provenance'), 'Head N/A must be rejected');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nbase_sha: pending\nhead_sha: unknown\n').includes('provenance'), 'base_sha pending must be rejected');
+  assert.deepEqual(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: npm run todo:test --fix\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n'), [], 'command containing todo substring should pass');
+
+  // Probe C: artifact with empty or placeholder sha must fail, concrete passes, inline passes
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nArtifact: x\nsha256: \n').includes('artifact_hash'), 'artifact empty sha must fail');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nArtifact: x\nsha256: TBD\n').includes('artifact_hash'), 'artifact TBD sha must fail');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nArtifact: bundle\nsha256: abc123\n').includes('artifact_hash'), 'short artifact sha must fail');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nArtifact produced sha256:deadbeef\n').includes('artifact_hash'), 'short inline sha256 must fail');
+  assert.deepEqual(POLICY.validateCanonicalReceipt(`Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\nArtifact: bundle\nsha256: ${'c'.repeat(64)}\n`), [], '64-hex artifact sha should pass');
+
+  // Probe F: lanePolicy forged plain object must not bypass classification
+  const { spawnSync } = require('node:child_process');
+  const POLICY_PATH = path.join(PACKAGE_ROOT, 'src/claude/scripts/workflow-policy.cjs');
+  const forged = spawnSync(process.execPath, [POLICY_PATH, '--lane-policy', '--task-json', JSON.stringify({ lane: 'Direct', automaticLane: 'Direct', riskSignals: { auth: true } }), '--json'], { encoding: 'utf8' });
+  assert.equal(forged.status, 2, 'forged Direct with auth should be blocked via lanePolicy');
+  assert.match(forged.stderr, /downgrade.*not permitted/i);
+  const forged2 = spawnSync(process.execPath, [POLICY_PATH, '--lane-policy', '--task-json', JSON.stringify({ lane: 'Direct', automaticLane: 'Direct' }), '--json'], { encoding: 'utf8' });
+  assert.equal(forged2.status, 2, 'plain Direct without justification should be blocked');
+
+  const trusted = POLICY.classifyLane({ reversible: true, lowRisk: true, isolated: true });
+  assert.equal(trusted.lane, 'Direct');
+  const viaPolicy = POLICY.lanePolicy(trusted);
+  assert.equal(viaPolicy.lane, 'Direct', 'trusted Direct should be respected');
+  assert.throws(() => { 'use strict'; trusted.lane = 'Direct'; }, /read only|Cannot assign|TypeError/);
+  const paymentTrusted = POLICY.classifyLane({ riskSignals: { payment: true } });
+  const forgedCopy = { ...paymentTrusted, lane: 'Direct' };
+  assert.equal(POLICY.lanePolicy(forgedCopy).lane, 'Standard', 'compatibility lane is derived from authoritative axes');
+});
+
+test('P0 regression: symlink spec/task containment and malformed spec handling', () => {
+  const RESOLVER = require(path.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs'));
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-regression-symlink-'));
+  try {
+    const specsDir = path.join(tmp, 'specs');
+    fs.mkdirSync(specsDir, { recursive: true });
+    fs.mkdirSync(path.join(specsDir, 'valid'), { recursive: true });
+    fs.writeFileSync(path.join(specsDir, 'valid', 'spec.json'), JSON.stringify({ status: 'in_progress', feature_name: 'valid' }));
+    const outside = path.join(tmp, 'outside');
+    fs.mkdirSync(outside, { recursive: true });
+    fs.writeFileSync(path.join(outside, 'spec.json'), JSON.stringify({ status: 'in_progress' }));
+    const link = path.join(specsDir, 'linked');
+    fs.symlinkSync(outside, link);
+    const e1 = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {}, explicitFeature: 'linked' });
+    assert.equal(e1.error, 'explicit_malformed');
+    const e2 = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {}, explicitPath: path.join(specsDir, 'linked', 'spec.json') });
+    assert.equal(e2.error, 'explicit_malformed');
+    const nonExplicit = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {} });
+    assert.equal(nonExplicit.error, 'invalid_specs');
+    assert.ok(nonExplicit.candidates.includes('linked'));
+    const featDir = path.join(specsDir, 'valid');
+    fs.mkdirSync(path.join(featDir, 'tasks'), { recursive: true });
+    const taskOutside = path.join(tmp, 'outside-task.md');
+    fs.writeFileSync(taskOutside, '# Task\n\n**Status:** done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n');
+    const taskLink = path.join(featDir, 'tasks', 'task.md');
+    fs.symlinkSync(taskOutside, taskLink);
+    const codexReceipt = require(path.join(PACKAGE_ROOT, 'src/codex/hooks/lib/spec-receipt.cjs'));
+    const fails = codexReceipt.checkReceipt(featDir, 'tasks/task.md', { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' });
+    assert.ok(fails.includes('a'), 'task symlink outside should be rejected as check a');
+    fs.mkdirSync(path.join(specsDir, 'bad'), { recursive: true });
+    fs.writeFileSync(path.join(specsDir, 'bad', 'spec.json'), '{ malformed');
+    const mal = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {} });
+    assert.equal(mal.error, 'invalid_specs');
+    assert.ok(mal.candidates.includes('bad'));
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('P0 regression: artifact hash scoped to structured Artifact declaration and explicit failure structured only', () => {
+  // Artifact hash only required when structured Artifact declaration exists
+  const prefix = 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n';
+  const receipt = (suffix = '') => `${prefix}${suffix}`;
+  const digestA = 'a'.repeat(64);
+  const digestB = 'b'.repeat(64);
+  assert.deepEqual(POLICY.validateCanonicalReceipt(receipt('Command: npm run artifact:test\n')), [], 'Command containing artifact without hash should pass');
+  assert.deepEqual(POLICY.validateCanonicalReceipt(receipt('Notes: artifact behavior without declaration\n')), [], 'Notes containing artifact without structured declaration should pass');
+  assert.ok(POLICY.validateCanonicalReceipt(receipt('Artifact: bundle\n')).includes('artifact_hash'), 'Artifact: without hash should fail');
+  assert.ok(POLICY.validateCanonicalReceipt(receipt('Artifacts: bundle\nsha256: TBD\n')).includes('artifact_hash'), 'Artifacts: with TBD should fail');
+  assert.ok(POLICY.validateCanonicalReceipt(receipt('Artifact produced sha256:deadbeef\n')).includes('artifact_hash'), 'short artifact hash must fail');
+  assert.deepEqual(POLICY.validateCanonicalReceipt(receipt(`Artifact produced sha256:${digestA}\n`)), [], '64-hex artifact hash should pass');
+
+  const artifactOptions = POLICY.receiptValidatorOptions({ artifacts: ['artifacts/a.js', 'artifacts/b.js'] });
+  assert.ok(POLICY.validateCanonicalReceipt(receipt(`Artifact: artifacts/a.js\nSHA-256: ${digestA}\n`), artifactOptions).includes('artifact_hash'), 'missing second artifact binding must fail');
+  assert.ok(POLICY.validateCanonicalReceipt(receipt(`Artifact: artifacts/a.js + artifacts/b.js\nSHA-256: ${digestA}\n`), artifactOptions).includes('artifact_hash'), 'one hash must not bind a combined multi-artifact declaration');
+  assert.deepEqual(POLICY.validateCanonicalReceipt(receipt(`Artifact: artifacts/a.js\nSHA-256: ${digestA}\nArtifact: artifacts/b.js\nSHA-256: ${digestB}\n`), artifactOptions), [], 'each declared artifact must bind to its hash');
+  assert.ok(POLICY.validateCanonicalReceipt(receipt('Artifact: artifacts/a.js\nSHA-256: deadbeef\nArtifact: artifacts/b.js\nSHA-256: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\n'), artifactOptions).includes('artifact_hash'), 'short per-artifact hash must fail');
+
+  const falseGreen = receipt([
+    'Tests run: 0',
+    '0 passing',
+    'Failures: 1',
+    'failure summary',
+    'Result: PASS',
+    'Artifact produced sha256:deadbeef',
+    'Artifact: bundle + sha256:abc123',
+  ].join('\n') + '\n');
+  assert.ok(POLICY.validateCanonicalReceipt(falseGreen).length > 0, 'false-green independent-review vector must fail');
+
+  // Explicit failure structured only: prose containing failure should not block, Tests failed: 0 should pass
+  assert.deepEqual(POLICY.validateCanonicalReceipt(receipt('Notes: verifies failure handling\n')), [], 'Notes with failure handling should not block');
+  assert.deepEqual(POLICY.validateCanonicalReceipt(receipt('Description: failure recovery\n')), [], 'Description with failure should not block');
+  assert.deepEqual(POLICY.validateCanonicalReceipt(receipt('Tests failed: 0\n')), [], 'Tests failed: 0 should pass');
+  assert.deepEqual(POLICY.validateCanonicalReceipt(receipt('fail 0\n')), [], 'fail 0 should pass');
+  // Structured failures still blocked
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nStatus: FAILED\n').length > 0, 'Status: FAILED should fail');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nOutcome: FAILURE\n').length > 0, 'Outcome: FAILURE should fail');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nResult: FAILED\n').length > 0, 'Result: FAILED should fail');
+  // TAP and Jest runner summaries (structured, anchored)
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n# fail 1\n').length > 0, 'TAP # fail 1 should fail');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nℹ fail 2\n').length > 0, 'TAP ℹ fail 2 should fail');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nnot ok 1 - test\n').length > 0, 'TAP not ok 1 should fail');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\nTests: 1 failed, 2 passed\n').length > 0, 'Jest Tests: 1 failed should fail');
+  assert.ok(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n1 failed, 2 passed\n').length > 0, '1 failed summary should fail');
+  assert.deepEqual(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n# fail 0\n'), [], 'TAP # fail 0 should pass');
+  assert.deepEqual(POLICY.validateCanonicalReceipt('Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\nTests: 0 failed\n'), [], 'Tests: 0 failed should pass');
+});
+
+test('P0 regression: safeTaskFile fail-closed on realpath error and single authority', () => {
+  const fs2 = require('node:fs');
+  const path2 = require('node:path');
+  const os2 = require('node:os');
+  const specGatePath = path2.join(PACKAGE_ROOT, 'src/claude/hooks/spec-gate.cjs');
+  const specGateSrc = fs2.readFileSync(specGatePath, 'utf8');
+  // Single authority: Claude hook should delegate to POLICY, not duplicate parser
+  assert.match(specGateSrc, /POLICY\.validateCanonicalReceipt/);
+  assert.doesNotMatch(specGateSrc, /const EXPLICIT_FAILURE/);
+  // Codex and OpenCode should delegate to shared workflow-policy
+  const codexSrc = fs2.readFileSync(path2.join(PACKAGE_ROOT, 'src/codex/hooks/lib/spec-receipt.cjs'), 'utf8');
+  assert.match(codexSrc, /getSharedValidate/);
+  assert.match(codexSrc, /workflow-policy\.cjs/);
+  assert.doesNotMatch(codexSrc, /const PLACEHOLDER_TOKENS/);
+  const opencodeSrc = fs2.readFileSync(path2.join(PACKAGE_ROOT, 'src/opencode/plugins/spec-gate.ts'), 'utf8');
+  assert.match(opencodeSrc, /getSharedValidate/);
+  assert.match(opencodeSrc, /workflow-policy\.cjs/);
+  // The parser should only exist in workflow-policy, not in adapters (check that adapter does not define full validate logic)
+  const opencodeValidateCount = (opencodeSrc.match(/function validateCanonicalReceipt/g) || []).length;
+  assert.equal(opencodeValidateCount, 1, 'OpenCode should have only delegating validate, not duplicate parser');
+  // safeTaskFile fail-closed: simulate realpathSync throwing
+  const tmp = fs2.mkdtempSync(path2.join(os2.tmpdir(), 'cafekit-realpath-'));
+  try {
+    const featDir = path2.join(tmp, 'feat');
+    fs2.mkdirSync(path2.join(featDir, 'tasks'), { recursive: true });
+    fs2.writeFileSync(path2.join(featDir, 'tasks', 'task.md'), '# Task\n\n**Status:** done\n\n## Evidence\n\nVerification: PASS\nCommand: pnpm test\nExit: 0\nBase: a\nHead: b\n');
+    const orig = fs2.realpathSync;
+    fs2.realpathSync = () => { throw new Error('simulated realpath failure'); };
+    try {
+      const codexReceipt = require(path2.join(PACKAGE_ROOT, 'src/codex/hooks/lib/spec-receipt.cjs'));
+      const fails = codexReceipt.checkReceipt(featDir, 'tasks/task.md', { status: 'done', completed_at: '2026-08-11T00:00:00.000Z' });
+      assert.ok(fails.includes('a'), 'realpath failure should be fail-closed with check a');
+    } finally {
+      fs2.realpathSync = orig;
+    }
+  } finally {
+    fs2.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('P0 regression: resolver fail-closed on canonicalization and lstat errors', () => {
+  const fs2 = require('node:fs');
+  const path2 = require('node:path');
+  const os2 = require('node:os');
+  const RESOLVER = require(path2.join(PACKAGE_ROOT, 'src/claude/scripts/spec-resolver.cjs'));
+  const tmp = fs2.mkdtempSync(path2.join(os2.tmpdir(), 'cafekit-resolver-fail-'));
+  try {
+    const specsDir = path2.join(tmp, 'specs');
+    fs2.mkdirSync(path2.join(specsDir, 'demo'), { recursive: true });
+    fs2.writeFileSync(path2.join(specsDir, 'demo', 'spec.json'), JSON.stringify({ status: 'in_progress', feature_name: 'demo' }));
+    // Monkey patch realpathSync to always throw for explicitFeature
+    const origRealpath = fs2.realpathSync;
+    fs2.realpathSync = () => { throw Object.assign(new Error('simulated EACCES'), { code: 'EACCES' }); };
+    try {
+      const res = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {}, explicitFeature: 'demo' });
+      assert.equal(res.error, 'explicit_malformed', 'explicitFeature realpath failure should be explicit_malformed');
+      assert.match(res.reason, /canonicalization error/);
+    } finally {
+      fs2.realpathSync = origRealpath;
+    }
+    // Non-explicit with specs root realpath failure should be invalid_specs <specs>
+    const origRealpath2 = fs2.realpathSync;
+    fs2.realpathSync = (p) => {
+      if (p === specsDir || p === path2.resolve(specsDir)) throw Object.assign(new Error('simulated ELOOP'), { code: 'ELOOP' });
+      return origRealpath2(p);
+    };
+    try {
+      const res2 = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {} });
+      assert.equal(res2.error, 'invalid_specs');
+      assert.ok(res2.candidates.includes('<specs>'));
+    } finally {
+      fs2.realpathSync = origRealpath2;
+    }
+    // lstat error for entry (simulate EACCES on lstat)
+    const origLstat = fs2.lstatSync;
+    fs2.lstatSync = (p) => {
+      if (p.includes('demo')) throw Object.assign(new Error('simulated EACCES'), { code: 'EACCES' });
+      return origLstat(p);
+    };
+    try {
+      const res3 = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {} });
+      assert.equal(res3.error, 'invalid_specs');
+      assert.ok(res3.candidates.includes('demo'));
+    } finally {
+      fs2.lstatSync = origLstat;
+    }
+    // Dangling spec.json symlink should be invalid_specs
+    const outside = path2.join(tmp, 'outside-spec2');
+    fs2.mkdirSync(outside, { recursive: true });
+    fs2.writeFileSync(path2.join(outside, 'spec.json'), JSON.stringify({ status: 'in_progress' }));
+    const featDir = path2.join(specsDir, 'dangle');
+    fs2.mkdirSync(featDir, { recursive: true });
+    const specLink = path2.join(featDir, 'spec.json');
+    fs2.symlinkSync(path2.join(tmp, 'nonexistent-target'), specLink);
+    const res4 = RESOLVER.resolveActiveSpec({ projectRoot: tmp, runtime: {} });
+    assert.equal(res4.error, 'invalid_specs');
+    assert.ok(res4.candidates.includes('dangle'));
+  } finally {
+    fs2.rmSync(tmp, { recursive: true, force: true });
+  }
+  // Codex parity: same monkey patch should give explicit_malformed
+  const codexUtils = require(path2.join(PACKAGE_ROOT, 'src/codex/hooks/lib/spec-utils.cjs'));
+  const tmp2 = fs2.mkdtempSync(path2.join(os2.tmpdir(), 'cafekit-codex-fail-'));
+  try {
+    const specsDir2 = path2.join(tmp2, 'specs');
+    fs2.mkdirSync(path2.join(specsDir2, 'demo2'), { recursive: true });
+    fs2.writeFileSync(path2.join(specsDir2, 'demo2', 'spec.json'), JSON.stringify({ status: 'in_progress', feature_name: 'demo2' }));
+    const orig = fs2.realpathSync;
+    fs2.realpathSync = () => { throw Object.assign(new Error('simulated EACCES'), { code: 'EACCES' }); };
+    try {
+      const r = codexUtils.resolveActiveSpec(tmp2, {}, 'demo2', null);
+      assert.equal(r.error, 'explicit_malformed');
+    } finally {
+      fs2.realpathSync = orig;
+    }
+  } finally {
+    fs2.rmSync(tmp2, { recursive: true, force: true });
+  }
+});
+
+test('P0 canonical phantom vectors - zero, cancellation, suite, FAIL, error, collected (r3)', () => {
+  const base = 'Verification: PASS\nCommand: pnpm test\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n';
+  // 1. Zero execution
+  const zeroFail = [
+    'ℹ tests 0',
+    'Tests: 0 total',
+    '0 tests',
+    'Tests: 0 passed',
+    'Tests: 0 passing',
+    'Test Suites: 0 failed, 0 passed',
+    'Tests passed: 0',
+    'Passed: 0',
+    'one failing',
+    'failureCount: 1',
+    'collected 0 items',
+    'No tests found.',
+    'No tests found',
+  ];
+  for (const v of zeroFail) {
+    assert.ok(POLICY.validateCanonicalReceipt(base + v + '\n').length > 0, `zero execution should fail: ${v}`);
+  }
+  // 2. Cancellation N>0
+  const cancelFail = [
+    'ℹ cancelled 1',
+    'cancelled 1',
+    '1 cancelled',
+    'canceled 1',
+    '1 canceled',
+  ];
+  for (const v of cancelFail) {
+    assert.ok(POLICY.validateCanonicalReceipt(base + v + '\n').length > 0, `cancel should fail: ${v}`);
+  }
+  // 3. Suite / Files
+  const suiteFail = [
+    'Test Suites: 1 failed, 1 total',
+    'Test Suites: 2 failed',
+    'Test Files: 1 failed',
+    'Test Files 1 failed',
+  ];
+  for (const v of suiteFail) {
+    assert.ok(POLICY.validateCanonicalReceipt(base + v + '\n').length > 0, `suite should fail: ${v}`);
+  }
+  // 4. Runner FAIL
+  const runnerFail = [
+    'FAIL ./foo.test.js',
+    'FAIL\tpackage',
+    'FAIL\texample.test/probe\t0.431s',
+    '--- FAIL: TestName (0.00s)',
+    'FAIL',
+    'FAIL: something',
+    'FAILED tests/test_demo.py::test_foo - assert 1 == 2',
+    'FAILED tests/test_demo.py',
+    '# fail 1',
+    'ℹ fail 1',
+    'not ok 1 - test',
+  ];
+  for (const v of runnerFail) {
+    assert.ok(POLICY.validateCanonicalReceipt(base + v + '\n').length > 0, `runner FAIL should fail: ${v}`);
+  }
+  // also standalone FAILED/FAILURE bare/colon
+  for (const v of ['FAILED', 'FAILURE', 'FAILED:', 'FAILURE:']) {
+    assert.ok(POLICY.validateCanonicalReceipt(base + v + '\n').length > 0, `standalone ${v} should fail`);
+  }
+  // 5. Error summaries N>0
+  const errorFail = [
+    '1 error in 0.12s',
+    '2 errors',
+    'ERROR collecting tests/test_demo.py',
+    'ERROR',
+    'Found 2 errors',
+    'Tests run: 5, Failures: 1, Errors: 0',
+    '[ERROR] Tests run: 5, Failures: 1, Errors: 0, Skipped: 0',
+    '[ERROR] Tests run: 5, Failures: 0, Errors: 1, Skipped: 0',
+    '[ERROR] Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:3.2.5:test',
+    '5 tests completed, 1 failed',
+  ];
+  for (const v of errorFail) {
+    assert.ok(POLICY.validateCanonicalReceipt(base + v + '\n').length > 0, `error should fail: ${v}`);
+  }
+  // Positive controls must pass
+  const pass = [
+    'Tests failed: 0',
+    'fail 0',
+    'Tests: 0 failed',
+    'cancelled 0',
+    'canceled 0',
+    'Test Suites: 0 failed',
+    'Test Files: 0 failed',
+    '5 tests completed, 0 failed',
+    'Tests run: 5, Failures: 0, Errors: 0',
+    '# tests 1',
+    '# suites 0',
+    '# pass 1',
+    '# fail 0',
+    '# cancelled 0',
+    '# skipped 0',
+    '# todo 0',
+    '# duration_ms 114.203625',
+    '[INFO] Tests run: 5, Failures: 0, Errors: 0, Skipped: 0',
+    '[ERROR] Tests run: 5, Failures: 0, Errors: 0, Skipped: 0',
+    '[ERROR] Error handling is documented',
+    'errors 0',
+    'Found 0 errors',
+    'tests 5',
+    'collected 1 item',
+    'collected 5 items',
+    'Notes: handles error/failure',
+    'Notes: verifies failure handling',
+    'Notes: Tests: 0 passed',
+    'Description: Tests passed: 0',
+    'Notes: one failing test is documented',
+    'Description: failureCount: 1 is documented',
+    'one failing test: 1 is documented',
+    'failureCount: 1 is documented',
+    'Tests failed previously but now fixed',
+    'Failure handling is documented',
+    'failure summary follows in the notes',
+    'ERROR handling is documented',
+    'Summary: failureCount: 1 is documented',
+    'Error handling is documented',
+    'FAILURE mode analysis',
+    'Notes: tests failed previously but now fixed',
+    'Notes: supports zero-test parsing',
+    'Command: npm run test --errorFlag',
+    'Command: npm run artifact:test',
+  ];
+  for (const v of pass) {
+    // Command lines are skipped; others should not trigger hasExplicitFailure
+    const body = v.startsWith('Command:') ? `Verification: PASS\n${v}\nExit: 0\nBase: 0123456789abcdef0123456789abcdef01234567\nHead: 89abcdef0123456789abcdef0123456789abcdef\n` : base + v + '\n';
+    assert.deepEqual(POLICY.validateCanonicalReceipt(body), [], `should pass: ${v}`);
+  }
+  assert.equal(POLICY.isTapMetadataHeading('# fail 1'), true);
+  assert.equal(POLICY.isTapMetadataHeading('# duration_ms 114.203625'), true);
+  assert.equal(POLICY.isTapMetadataHeading('# Notes'), false);
+  assert.equal(POLICY.isTapMetadataHeading('# pass 1 explanation'), false);
+});