@piagent/platform 1.6.0 → 1.7.1

package/scripts/benchmark-runner-core.mjs

@@ -1,109 +1,93 @@
 #!/usr/bin/env node
+import { assertDiagnosticCandidateDerivation, assertDiagnosticBenchmarkMatrix, benchmarkAcceptancePolicyBinding, DIAGNOSTIC_TREATMENT } from "../packages/piagent-core/benchmark/benchmark-diagnostic-treatment.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-
-import { aggregateSessionUsage, benchmarkSurfaceLabel } from "../packages/piagent-core/benchmark/benchmark-core.js";
 import { benchmarkUsage, parseBenchmarkArgs } from "../packages/piagent-core/benchmark/benchmark-cli.js";
+import { benchmarkVerificationBinding, prepareBenchmarkVerification } from "./benchmark-independent-verification.mjs";
 import { codexModelName, codexThinkingEffort } from "../packages/piagent-core/benchmark/benchmark-codex.js";
-import { benchmarkEnvironment, benchmarkEnvironmentPolicy, comparisonSurfaces, createCodexRuntime, piagentTreatment } from "../packages/piagent-core/benchmark/benchmark-runtime.js";
+import { assertCodexRuntimeCredential, benchmarkEnvironment, comparisonSurfaces, createCodexRuntime, piagentTreatment } from "../packages/piagent-core/benchmark/benchmark-runtime.js";
 import { assertBenchmarkPiCredentialReady, assertBenchmarkPiCredentialWritebackPolicy, cleanupBenchmarkPiRuntimeHome, createBenchmarkPiRuntimeHome, resetBenchmarkPiRuntimeEphemeralState, withBenchmarkPiCredentialWriteback } from "../packages/piagent-core/benchmark/benchmark-pi-home.js";
 import { benchmarkPreflight, benchmarkPreflightReceipt } from "../packages/piagent-core/benchmark/benchmark-preflight.js";
-import { applyBenchmarkExecutionDefaults } from "../packages/piagent-core/benchmark/benchmark-runner-policy.js";
-import {
-  appendPrivateJsonl,
-  createBenchmarkCandidateGuard,
-  loadReplayFailurePlan,
-  retainWorkspaceForensics,
-  safeInfrastructureDiagnostic,
-  writeBenchmarkAbort,
-  writeBenchmarkRunManifest,
-  writePrivateAtomic
-} from "../packages/piagent-core/benchmark/benchmark-forensics.js";
+import { prepareProductionProviderFreeEvidence, productionProviderFreeConfigurationDigest, productionProviderFreeEvidenceError, productionProviderFreeEvidenceRequired } from "../packages/piagent-core/benchmark/benchmark-provider-free-evidence.js";
+import { applyBenchmarkExecutionDefaults, benchmarkInfrastructureFailureDisposition, benchmarkRunnerErrorRecord, recoveredBenchmarkAttemptDisposition } from "../packages/piagent-core/benchmark/benchmark-runner-policy.js";
+import { BENCHMARK_TRANSPORT_CIRCUIT_POLICY, appendPrivateJsonl, createBenchmarkTransportCircuit,
+  createBenchmarkCandidateGuard, loadReplayFailurePlan, retainWorkspaceForensics, safeInfrastructureDiagnostic,
+  validBenchmarkTransportCircuit, writeBenchmarkAbort, writeBenchmarkRunManifest,
+  writePrivateAtomic } from "../packages/piagent-core/benchmark/benchmark-forensics.js";
 import { benchmarkBootstrapCandidateIndex, benchmarkBootstrapMetadata } from "../packages/piagent-core/benchmark/benchmark-bootstrap.js";
 import { createBenchmarkExecutionGuard } from "../packages/piagent-core/benchmark/benchmark-execution-guard.js";
-import { benchmarkCommandIdentity } from "../packages/piagent-core/benchmark/benchmark-runtime-identity.js";
+import { readBenchmarkWireDefinitionPlan, validateBenchmarkWireManifest } from "../packages/piagent-core/benchmark/benchmark-provider-wire.js";
+export { projectBenchmarkWireState } from "../packages/piagent-core/benchmark/benchmark-provider-wire.js";
+import { openProductionBenchmarkCampaign } from "../packages/piagent-core/benchmark/benchmark-campaign.js";
 import { benchmarkTreeIdentity } from "../packages/piagent-core/benchmark/benchmark-tree-identity.js";
 import { completedBenchmarkRecord, expectedBenchmarkRecord } from "../packages/piagent-core/benchmark/benchmark-record-validation.js";
 import { pairedOutcomeFloorStop } from "../packages/piagent-core/benchmark/benchmark-stop-policy.js";
-import {
-  approveProductionStageControl,
-  buildBenchmarkStageDiagnostic,
+import { productionExecutionBindingMatches,
+  productionGuardBindingMatches } from "../packages/piagent-core/benchmark/benchmark-production-completion.js";
+import { approveProductionStageControl, buildBenchmarkStageDiagnostic,
   createProductionStageControl,
-  durablePairedOutcomeFloorStop,
-  productionSpendControlValidationErrors,
-  productionStageResumeDisposition
-} from "../packages/piagent-core/benchmark/benchmark-stage-diagnostic.js";
+  productionSpendControlValidationErrors, productionStageResumeDisposition } from "../packages/piagent-core/benchmark/benchmark-stage-diagnostic.js";
 import { loadBenchmarkAssuranceEvidence, loadBenchmarkSuite, resolveBenchmarkSuiteEntry, validateBenchmarkSuiteFiles } from "../packages/piagent-core/benchmark/benchmark-suite-runtime.js";
 import { appendBenchmarkLedger, assertBenchmarkLedgerBinding, emptyBenchmarkLedgerBinding, inspectBenchmarkLedger, validateBenchmarkLedgerPrefix } from "../packages/piagent-core/benchmark/benchmark-ledger.js";
 import { acquireBenchmarkRunLock } from "../packages/piagent-core/benchmark/benchmark-run-lock.js";
 import { createBenchmarkProcessController } from "../packages/piagent-core/benchmark/benchmark-process.js";
 import {
-  clearRecoveredBenchmarkAttempts,
-  persistUnacceptedBenchmarkAttempt,
-  promoteMeasuredBenchmarkRecord,
-  recoverOrphanedBenchmarkAttempts,
-  recoverPendingBenchmarkRecord,
-  stageMeasuredBenchmarkRecord
+  clearRecoveredBenchmarkAttempts, persistUnacceptedBenchmarkAttempt, promoteMeasuredBenchmarkRecord,
+  recoverOrphanedBenchmarkAttempts, recoverPendingBenchmarkRecord, stageMeasuredBenchmarkRecord
 } from "../packages/piagent-core/benchmark/benchmark-resume-recovery.js";
 import { finalizeBenchmarkRun } from "./benchmark-runner-finalization.mjs";
+import { applyProductionCampaignStopPolicy, assertProductionResumeCompletionState,
+  productionMeasurementInvalidatingOutcomeError,
+  productionReleaseMeasurementAbortEvidence, writeProductionResumeAbortIfNeeded,
+  writeProductionRunAbortIfNeeded } from "./benchmark-runner-completion.mjs";
 import {
+  applyBenchmarkResumeOptions,
+  bindBenchmarkTerminationSignals,
+  benchmarkExecutionPlan,
   benchmarkRunKey,
   confirmPlan,
   createRunId,
   defaultOutputRoot,
   ensureEmptyOutput,
   executionOrder,
-  fail,
-  formatDuration,
-  frozenRuntimeCommandsForFinalization,
-  invokedAsEntrypoint,
-  isLegacyInvocation,
-  loadResumeState,
-  pairedChunk,
-  privateDirectory,
-  readJsonFile,
+  fail, formatDuration, invokedAsEntrypoint, isLegacyInvocation,
+  loadResumeState, pairedChunk, privateDirectory,
+  readJsonFile, registeredBenchmarkCustodyRoot,
   samePairedBlock,
   sameStringList
 } from "./benchmark-runner-support.mjs";
-import { runBenchmarkSession } from "./benchmark-session.mjs";
-import {
-  assertBenchmarkHostReadinessStartReady,
-  assertExistingBenchmarkHostReadiness,
-  benchmarkHostReadinessPolicyDigest,
-  collectReadyBenchmarkHostReadiness
-} from "./benchmark-runner-host-readiness.mjs";
+import { runBenchmarkSchedule } from "./benchmark-runner-schedule.mjs";
+import { readBenchmarkBudgetControl, assertBenchmarkBudgetBinding, openBenchmarkBudgetCore, createBudgetProviderCallbacks } from "./benchmark-budget-runtime.mjs";
+import { createBenchmarkBudgetProcessHooks } from "./benchmark-budget-ipc.mjs";
+import { createRegisteredBenchmarkScopedSessionFactory, registeredBenchmarkScopedSessionRequired } from "./benchmark-scoped-session-factory.mjs";
+import { assertBenchmarkHostReadinessStartReady, assertExistingBenchmarkHostReadiness, benchmarkHostReadinessPolicyDigest, collectReadyBenchmarkHostReadiness } from "./benchmark-runner-host-readiness.mjs";
+import { applyRegisteredMeasurementOptions, benchmarkMeasurementConfiguration, benchmarkRuntimeCommands,
+  registeredMeasurementBinding as measurementBinding
+} from "./benchmark-runner-configuration.mjs";
+import { bindRegisteredRuntimeVerifiers, createBenchmarkProviderBoundaryGuard,
+  forceTokenUnavailableForPostSessionAssetError } from "./benchmark-runner-provider-boundary.mjs";
 export { parseBenchmarkArgs };
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const packageManifest = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
 const bootstrapMetadata = benchmarkBootstrapMetadata();
 const bootstrapCandidateIndex = bootstrapMetadata ? benchmarkBootstrapCandidateIndex(bootstrapMetadata) : undefined;
+const webUiAssetIdentity = bootstrapMetadata?.webUiAssets
+  ? Object.fromEntries(Object.entries(bootstrapMetadata.webUiAssets).filter(([key]) => key !== "root"))
+  : null;
 let interruptedSignal;
-const processController = createBenchmarkProcessController(() => Boolean(interruptedSignal));
+const processController = createBenchmarkProcessController(() => Boolean(interruptedSignal), createBenchmarkBudgetProcessHooks());
 const runCommand = processController.run;
-
 function installSignalForwarding() {
-  const handlers = new Map();
-  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
-    const handler = () => {
-      if (interruptedSignal) return;
-      interruptedSignal = signal;
-      processController.terminateAll(signal);
-    };
-    handlers.set(signal, handler);
-    process.on(signal, handler);
-  }
-  return () => {
-    for (const [signal, handler] of handlers) process.off(signal, handler);
-  };
+  return bindBenchmarkTerminationSignals({ interrupted: () => Boolean(interruptedSignal),
+    interrupt: (signal) => { interruptedSignal = signal; },
+    terminateAll: (signal) => processController.terminateAll(signal) });
 }
-
 async function runLegacy(argv) {
   const result = await runCommand("bash", [path.join(packageRoot, "scripts", "quality-benchmark.sh"), ...argv], { cwd: process.cwd(), inherit: true });
   process.exitCode = result.code;
 }
-
 async function main() {
   const argv = process.argv.slice(2);
   if (isLegacyInvocation(argv)) return runLegacy(argv);
@@ -111,41 +95,34 @@ async function main() {
     fail("Benchmark core must execute from the immutable candidate snapshot", 1);
   }
   const options = parseBenchmarkArgs(argv);
+  if (options.registeredMeasurement && !bootstrapMetadata?.registeredMeasurement) {
+    fail("Registered measurement must start through scripts/benchmark-runner.mjs with a trusted frozen registration", 1);
+  }
+  const registeredMeasurement = bootstrapMetadata?.registeredMeasurement ?? null;
+  applyRegisteredMeasurementOptions(options, registeredMeasurement);
   if (bootstrapMetadata?.replay?.snapshot) options.replayFailures = bootstrapMetadata.replay.snapshot;
   if (options.resume && options.replayFailures) fail("--resume cannot be combined with --replay-failures", 1);
   if (options.resume && options.output) fail("--resume uses the original report directory; do not pass --output", 1);
   const resumeState = options.resume ? loadResumeState(options.resume) : undefined;
+  if (resumeState?.manifest.failedAttemptsOnly === true) {
+    resumeState.releaseRunLock?.();
+    fail("A failed-attempt diagnostic is a single bounded replay; do not resume it as a full matrix", 1);
+  }
   let releaseRunLock = resumeState?.releaseRunLock;
-  let codexRuntime;
-  let piRuntimeHome;
+  let codexRuntime, productionCampaign, piRuntimeHome, budgetRuntime, productionAbortFallback = () => {};
   let preservePiRuntime = false;
   try {
-  if (resumeState) {
-    const manifest = resumeState.manifest;
-    options.suite = manifest.suite?.source ?? manifest.suite?.manifestPath ?? manifest.suite?.id ?? options.suite;
-    options.surfaces = manifest.surfaces;
-    options.model = manifest.model ?? undefined;
-    options.thinking = manifest.thinking ?? undefined;
-    options.codexMode = manifest.codexMode ?? "controlled";
-    options.piagentTreatment = manifest.piagentTreatment ?? "release-defaults";
-    options.allowPiAuthWriteback = manifest.allowPiAuthWriteback === true;
-    options.seed = manifest.rootSeed;
-    options.repeats = manifest.repeats;
-    options.scenarioIds = manifest.scenarioIds ?? undefined;
-    options.timeoutSeconds = manifest.timeoutSeconds;
-    options.infrastructureRetries = manifest.infrastructureRetries;
-    options.retryDelaySeconds = manifest.retryDelaySeconds;
-    options.stopAfterFailedPair = manifest.stopAfterFailedPair === true;
-    options.output = resumeState.runRoot;
-  }
+  applyBenchmarkResumeOptions(options, resumeState);
+  const budgetControl = readBenchmarkBudgetControl({ options, resumeManifest: resumeState?.manifest, sourceRoot: bootstrapMetadata?.liveRoot ?? packageRoot });
   if (options.replayFailures) {
-    const replay = loadReplayFailurePlan(options.replayFailures);
+    const replay = loadReplayFailurePlan(options.replayFailures, { failedAttemptsOnly: options.failedAttemptsOnly });
     if (bootstrapMetadata?.replay && replay.source.reportDigest !== bootstrapMetadata.replay.digest) fail("Frozen replay report digest does not match bootstrap metadata", 1);
     options.suite = replay.suite;
     options.seed = replay.seed;
     options.surfaces = replay.surfaces;
     options.model = options.model ?? replay.model;
     options.thinking = options.thinking ?? replay.thinking;
+    options.serviceTier = options.serviceTier ?? replay.serviceTier;
     options.piagentTreatment = replay.piagentTreatment ?? options.piagentTreatment;
     options.replayRuns = replay.replayRuns;
     options.replaySource = {
@@ -162,12 +139,13 @@ async function main() {
     return;
   }
   piagentTreatment(options.piagentTreatment);
+  options.acceptancePolicyBinding = benchmarkAcceptancePolicyBinding(packageRoot, options);
   const { suite, manifestPath, suiteRoot, builtInId } = loadBenchmarkSuite(options.suite, packageRoot);
   validateBenchmarkSuiteFiles(suite, suiteRoot);
   if (bootstrapMetadata && bootstrapMetadata.suite.builtInId !== builtInId) {
     fail("Frozen benchmark suite origin no longer matches its canonical built-in identity", 1);
   }
-  const canonicalProductionSuite = builtInId === "production-v1";
+  const canonicalProductionSuite = ["production-v1", "production-v2", "production-v3"].includes(builtInId);
   const productionSpendControlPath = path.join(suiteRoot, "spend-control.v1.json");
   const productionSpendControl = canonicalProductionSuite || fs.existsSync(productionSpendControlPath)
     ? readJsonFile(productionSpendControlPath, "production spend-control contract")
@@ -181,6 +159,7 @@ async function main() {
       ? productionSpendControlValidationErrors(productionSpendControl, {
           suiteId: suite.id,
           expectedSessions: productionExpectedSessions,
+          suite,
           requireHostReadiness: canonicalProductionSuite
             && suite.releaseGate?.requireHostReadinessForClaim === true
         })
@@ -188,12 +167,16 @@ async function main() {
   if (productionSpendControlErrors.length > 0) {
     fail(`Production spend-control contract is invalid (${productionSpendControlErrors.join(", ")})`, 1);
   }
+  const registeredMeasurementRun = Boolean(registeredMeasurement);
   const productionAllStageBoundaries = productionSpendControl
-    ? productionSpendControl.stages.map((stage) => stage.cumulativeSessions)
+    ? registeredMeasurementRun || (options.measurementOnly && builtInId === "production-v2")
+      ? [0, productionExpectedSessions]
+      : productionSpendControl.stages.map((stage) => stage.cumulativeSessions)
     : [];
   const productionStageBoundaries = productionAllStageBoundaries.slice(1);
   const assuranceEvidence = loadBenchmarkAssuranceEvidence(suite, suiteRoot);
   const declaredScenarioCount = suite.scenarios.length;
+  const declaredScenarios = [...suite.scenarios];
   if (options.scenarioIds) {
     const byId = new Map(suite.scenarios.map((scenario) => [scenario.id, scenario]));
     const missing = options.scenarioIds.filter((id) => !byId.has(id));
@@ -210,13 +193,26 @@ async function main() {
   const productionFullMatrixRequested = Boolean(productionSpendControl)
     && !options.replayRuns
     && suite.scenarios.length === declaredScenarioCount;
+  assertDiagnosticBenchmarkMatrix(options, { builtInId, fullMatrix: productionFullMatrixRequested,
+    expectedSessions: productionExpectedSessions });
+  // Buy one full observation window; graders, integrity and release thresholds stay unchanged.
+  const failedAttemptReplay = options.failedAttemptsOnly === true
+    && options.replaySource?.selection === "failed-attempts" && options.replaySource?.evidenceComplete === true
+    && options.replaySource.originalAttemptCount === 108;
+  if (options.measurementOnly && (!["production-v2", "production-v3"].includes(builtInId) || (!productionFullMatrixRequested && !failedAttemptReplay)
+    || productionExpectedSessions !== 108 || options.codexMode !== "controlled" || !["release-defaults", DIAGNOSTIC_TREATMENT].includes(options.piagentTreatment))) {
+    fail("--measurement-only requires a complete production-v2/v3 controlled matrix or a bound failed-attempt-only diagnostic replay", 1);
+  }
   if (productionFullMatrixRequested) {
     const spendExecution = productionSpendControl.execution;
+    applyProductionCampaignStopPolicy(options, spendExecution);
     if (options.seed === undefined) options.seed = productionSpendControl.rootSeed;
     if (options.seed !== productionSpendControl.rootSeed) fail("Production spend control requires its frozen root seed", 1);
     if (!sameStringList(options.surfaces, spendExecution.surfaces)) fail("Production spend control requires its frozen surface order", 1);
     if ((options.model ?? null) !== spendExecution.model) fail("Production spend control requires its frozen model", 1);
     if ((options.thinking ?? null) !== spendExecution.thinking) fail("Production spend control requires its frozen thinking level", 1);
+    if (spendExecution.serviceTier !== undefined
+      && (options.serviceTier ?? null) !== spendExecution.serviceTier) fail("Production spend control requires its frozen service tier", 1);
     if (options.repeats !== spendExecution.repeats) fail("Production spend control requires its frozen repeat count", 1);
     if (options.infrastructureRetries !== spendExecution.infrastructureRetries) fail("Production spend control requires zero infrastructure retries", 1);
   }
@@ -232,14 +228,29 @@ async function main() {
   let codexCommand = process.env.PIAGENT_BENCHMARK_CODEX_COMMAND || "codex";
   const suiteIdentity = benchmarkTreeIdentity(suiteRoot, { rejectSymlinks: true });
   const suiteDigest = suiteIdentity.contentDigest;
+  if (registeredMeasurementRun && suiteDigest !== registeredMeasurement.payload.baseSuiteDigest) {
+    fail("Registered measurement base suite digest does not match the frozen production-v2 suite", 1);
+  }
+  const verificationPlan = prepareBenchmarkVerification({ options, resumeState, registeredMeasurement,
+    installedRoot: packageRoot, suiteDigest,
+    scenarios: declaredScenarios, suiteRoot, resolveSuiteEntry: resolveBenchmarkSuiteEntry });
   const rootSeed = options.seed ?? crypto.randomBytes(32).toString("hex");
   const rootSeedDigest = crypto.createHash("sha256").update(rootSeed).digest("hex");
+  if (registeredMeasurementRun && rootSeedDigest !== registeredMeasurement.payload.unchangedSeedDigest) {
+    fail("Registered measurement root seed digest does not match the unchanged production seed", 1);
+  }
+  const registeredMeasurementBinding = measurementBinding(registeredMeasurement);
   const candidateGuard = createBenchmarkCandidateGuard(packageRoot, resumeState?.manifest.candidateProvenance, {
     immutableSnapshot: Boolean(bootstrapMetadata),
     observedProvenance: bootstrapMetadata?.candidateProvenance,
     snapshotIndex: bootstrapCandidateIndex
   });
   candidateGuard.freeze();
+  assertDiagnosticCandidateDerivation(options.acceptancePolicyBinding, bootstrapMetadata?.treatmentDerivation, candidateGuard.provenance);
+  const providerWirePlan = readBenchmarkWireDefinitionPlan({ file: process.env.PIAGENT_WIRE_MANIFEST_PATH, sha256: process.env.PIAGENT_WIRE_MANIFEST_SHA256 });
+  if (providerWirePlan) validateBenchmarkWireManifest(providerWirePlan.manifest, { template: true, candidateDigest: candidateGuard.provenance.contentDigest,
+    model: options.model, thinking: options.thinking, requestedTier: options.serviceTier });
+  if (resumeState && (resumeState.manifest.providerWirePlanDigest ?? null) !== (providerWirePlan?.planDigest ?? null)) fail("Cannot resume benchmark: provider-wire definition plan changed", 1);
   const fullOrder = options.replayRuns
     ? options.replayRuns.map((run) => ({
         scenario: suite.scenarios.find((scenario) => scenario.id === run.scenarioId),
@@ -248,6 +259,10 @@ async function main() {
       }))
     : executionOrder(suite, options.repeats, options.surfaces, rootSeed);
   const productionSpendControlled = productionFullMatrixRequested;
+  assertBenchmarkBudgetBinding(budgetControl, { options, candidateDigest: candidateGuard.provenance.contentDigest, suiteDigest, fullOrder });
+  const productionCampaignRequired = productionSpendControlled && suite.releaseGate?.requireCampaignAccounting === true;
+  const providerFreeEvidenceRequired = productionProviderFreeEvidenceRequired({ productionSpendControlled,
+    spendControl: productionSpendControl });
   const productionHostReadinessRequired = productionSpendControlled
     && canonicalProductionSuite
     && suite.releaseGate?.requireHostReadinessForClaim === true;
@@ -257,7 +272,10 @@ async function main() {
   const productionHostReadinessPolicyDigest = productionHostReadinessRequired
     ? benchmarkHostReadinessPolicyDigest(productionHostReadinessPolicy)
     : null;
-  const productionReleaseClaimRun = productionSpendControlled
+  const productionReleaseClaimRun = productionSpendControlled && !registeredMeasurementRun
+    && !options.measurementOnly
+    && !options.acceptancePolicyBinding
+    && options.piagentTreatment !== "acceptance-diagnostic"
     && suite.schemaVersion === 2
     && suite.releaseGate?.requireEfficiencyClaim === true
     && suite.releaseGate?.requireFullSuiteForClaim === true;
@@ -267,7 +285,12 @@ async function main() {
   let deferredProductionStageApproval;
   if (resumeState) {
     const manifest = resumeState.manifest;
+    if (JSON.stringify(manifest.registeredMeasurement ?? null) !== JSON.stringify(registeredMeasurementBinding)) {
+      fail("Cannot resume benchmark: registered measurement identity changed or is missing", 1);
+    }
     if (manifest.suiteDigest !== suiteDigest) fail("Cannot resume benchmark: suite files changed since the original run", 1);
+    if (productionSpendControlled && !productionGuardBindingMatches(manifest, productionSpendControl)) fail("Cannot resume production benchmark: frozen production guard binding is missing or changed", 1);
+    if (productionSpendControlled && !productionExecutionBindingMatches(manifest, productionSpendControl)) fail("Cannot resume production benchmark: frozen execution and campaign stop policy binding is missing or changed", 1);
     if (manifest.rootSeed !== rootSeed) fail("Cannot resume benchmark: root seed mismatch", 1);
     if (manifest.repeats !== options.repeats) fail("Cannot resume benchmark: repeat count mismatch", 1);
     if (!sameStringList(manifest.surfaces, options.surfaces)) fail("Cannot resume benchmark: surface list mismatch", 1);
@@ -301,40 +324,26 @@ async function main() {
         runId: manifest.runId,
         completedRuns: resumeState.completedRuns.length,
         expectedRuns: fullOrder.length
-      }, error, { ledger: resumeState.ledgerBinding, provenanceStamp: candidateGuard.stamp("resume-ledger") });
+      }, error, { ledger: resumeState.ledgerBinding, provenanceStamp: candidateGuard.stamp("resume-ledger"),
+        ...productionReleaseMeasurementAbortEvidence(options, suite, error) });
       throw error;
     }
     const provenanceError = candidateGuard.check("resume");
     if (provenanceError) {
       writeBenchmarkAbort(resumeState.runRoot, { runId: manifest.runId, completedRuns: resumeState.completedRuns.length, expectedRuns: fullOrder.length }, provenanceError, {
         ledger: resumeState.ledgerBinding,
-        provenanceStamp: candidateGuard.stamp("resume")
+        provenanceStamp: candidateGuard.stamp("resume"),
+        ...productionReleaseMeasurementAbortEvidence(options, suite, provenanceError)
       });
       throw provenanceError;
     }
-    const recoveredTerminalStop = durablePairedOutcomeFloorStop({
-      enabled: options.stopAfterFailedPair,
-      suite,
-      runs: resumeState.completedRuns,
-      fullOrder
+    assertProductionResumeCompletionState({
+      candidateGuard,
+      fullOrder,
+      options,
+      resumeState,
+      suite
     });
-    if (recoveredTerminalStop) {
-      for (const marker of ["paused.json", "stage-diagnostic.json", "interrupted.json", "aborted.json"]) {
-        fs.rmSync(path.join(resumeState.runRoot, marker), { force: true });
-      }
-      writePrivateAtomic(path.join(resumeState.runRoot, "stopped.json"), `${JSON.stringify({
-        ...recoveredTerminalStop,
-        runId: manifest.runId,
-        completedRuns: resumeState.completedRuns.length,
-        expectedRuns: fullOrder.length,
-        stoppedAt: new Date().toISOString(),
-        resumeAllowed: false,
-        recoveredFromAcceptedLedger: true,
-        ledger: resumeState.ledgerBinding,
-        provenanceStamp: candidateGuard.stamp("resume-terminal-floor")
-      }, null, 2)}\n`);
-      fail("Cannot resume benchmark: the accepted ledger already contains a terminal paired outcome-floor failure", 1);
-    }
     if (productionSpendControlled) {
       if (productionHostReadinessRequired) {
         if (manifest.hostReadinessPolicyDigest !== productionHostReadinessPolicyDigest
@@ -372,6 +381,7 @@ async function main() {
           baselineSurface: comparison.baselineSurface,
           requestedModel: options.model,
           requestedThinking: options.thinking,
+          requestedServiceTier: options.serviceTier,
           suite,
           manifest,
           hostReadinessPolicy: productionHostReadinessPolicy,
@@ -416,44 +426,34 @@ async function main() {
   let recoveredAttemptsByKey = new Map();
   const order = pairedChunk(pendingOrder, options.maxSessions);
   const lifecycles = [...new Set(suite.scenarios.map((scenario) => scenario.lifecycle ?? "steady-state"))];
-  const plan = [
-    "Piagent automatic benchmark",
-    `  platform:  v${packageManifest.version}`,
-    `  suite:     ${suite.id} (${suite.scenarios.length}${suite.scenarios.length !== declaredScenarioCount ? `/${declaredScenarioCount}` : ""} scenarios)`,
-    `  digest:    ${suiteDigest.slice(0, 16)}`,
-    `  surfaces:  ${options.surfaces.join(", ")}`,
-    `  compare:   ${benchmarkSurfaceLabel(comparison.candidateSurface)} vs ${benchmarkSurfaceLabel(comparison.baselineSurface)}`,
-    `  repeats:   ${options.repeats}`,
-    `  retries:   ${options.infrastructureRetries} infrastructure-only · ${options.retryDelaySeconds}s backoff`,
-    `  sessions:  ${fullOrder.length}`,
-    ...(resumeState ? [`  completed: ${resumeState.completedRuns.length}`, `  remaining: ${pendingOrder.length}`] : []),
-    ...(options.maxSessions !== undefined ? [`  chunk:    up to ${order.length}/${pendingOrder.length} remaining sessions`] : []),
-    ...(options.maxRuntimeMinutes !== undefined ? [`  budget:   ${options.maxRuntimeMinutes} minute runtime chunk`] : []),
-    ...(options.stopAfterFailedPair ? ["  stop:     terminal after a completed pair falls below the outcome floor"] : []),
-    `  model:     ${options.model ?? "Pi default"}`,
-    `  thinking:  ${options.thinking ?? "Pi default"}`,
-    `  treatment: ${options.piagentTreatment}`,
-    `  lifecycle: ${lifecycles.join(", ")}`,
-    ...(options.replaySource ? [`  replay:    ${options.replaySource.runId ?? "prior-report"} · ${options.replayRuns.length} sessions`] : []),
-    ...(resumeState ? [`  resume:    ${resumeState.manifest.runId}`] : []),
-    `  variants:  ${suite.scenarios.some((scenario) => scenario.variantGenerator) ? `generated · seed ${rootSeedDigest.slice(0, 16)}` : "static"}`,
-    `  ordering:  ${suite.schemaVersion === 2 ? "seeded paired blocks" : "paired alternating"}`,
-    `  timeout:   ${options.timeoutSeconds}s per session`,
-    "  grading:   hidden verifier + scope + output safety + Pi task evidence"
-  ].join("\n");
-  const codexPlan = options.surfaces.includes("codex-cli")
-    ? `\n  codex:     ${options.codexMode} mode · model ${codexModelName(options.model)} · effort ${codexThinkingEffort(options.thinking)}${options.codexMode === "controlled" ? " · isolated home" : ""}`
-    : "";
-  const nativeWarning = options.surfaces.includes("codex-cli") && options.codexMode === "native"
-    ? "\nNative Codex mode loads the operator's global AGENTS.md, configuration, rules, hooks, MCP servers, and plugins."
-    : "";
+  const { plan, codexPlan, nativeWarning } = benchmarkExecutionPlan({
+    packageVersion: packageManifest.version,
+    suite,
+    declaredScenarioCount,
+    suiteDigest,
+    options,
+    comparison,
+    fullOrder,
+    resumeState,
+    pendingOrder,
+    order,
+    lifecycles,
+    rootSeedDigest
+  });
   if (options.dryRun) {
+    if (options.acceptancePolicyBinding) process.stdout.write(`Diagnostic acceptance binding: ${JSON.stringify({ policy: options.acceptancePolicyBinding, derivation: bootstrapMetadata?.treatmentDerivation })}\n`);
+    process.stdout.write(`Frozen verification binding: ${JSON.stringify(benchmarkVerificationBinding({ installedRoot: packageRoot, suiteDigest }))}\n`);
+    if (verificationPlan) process.stdout.write(`Independent verification: ${JSON.stringify(verificationPlan.identity)} (preview only)\n`);
     process.stdout.write(`${plan}${codexPlan}\n  manifest:  ${manifestPath}\nDRY RUN: no model session started.\n`);
     return;
   }
+  if (!options.preflightOnly) budgetRuntime = openBenchmarkBudgetCore(budgetControl);
   if (productionSpendControlled) {
-    if (options.stopAfterFailedPair !== productionSpendControl.execution.stopAfterFailedPair) {
-      fail("Production spend control requires --stop-after-failed-pair before any provider session", 1);
+    if (!options.measurementOnly && !registeredMeasurementRun
+      && options.stopAfterFailedPair !== productionSpendControl.execution.stopAfterFailedPair) {
+      fail(productionSpendControl.execution.stopAfterFailedPair
+        ? "Production spend control requires --stop-after-failed-pair before any provider session"
+        : "Production spend control requires paired-outcome quality stopping to remain disabled before any provider session", 1);
     }
     const completedRuns = resumeState?.completedRuns.length ?? 0;
     const authorizedThroughRuns = deferredProductionStageApproval?.authorizedThroughRuns
@@ -484,50 +484,22 @@ async function main() {
     }
   }
   const runId = resumeState?.manifest.runId ?? createRunId(suite.id);
-  const runtimeCommands = productionFinalizationOnly
-    ? frozenRuntimeCommandsForFinalization(resumeState.manifest, options.surfaces)
-    : {
-        pi: benchmarkCommandIdentity(piCommand, { cwd: bootstrapMetadata?.originalCwd ?? process.cwd() }),
-        codex: options.surfaces.includes("codex-cli")
-          ? benchmarkCommandIdentity(codexCommand, { cwd: bootstrapMetadata?.originalCwd ?? process.cwd() })
-          : null,
-        node: benchmarkCommandIdentity(process.execPath),
-        git: benchmarkCommandIdentity("git"),
-        bash: benchmarkCommandIdentity("bash")
-      };
-  const environmentPolicy = benchmarkEnvironmentPolicy();
-  const configurationPiAgentHome = productionFinalizationOnly
-    ? resumeState.manifest.piAgentHome?.identity
-    : bootstrapMetadata.piAgentHome.identity;
-  const configurationCodexCredential = productionFinalizationOnly
-    ? resumeState.manifest.codexCredentialIdentity ?? null
-    : bootstrapMetadata.codexCredential?.identity ?? null;
-  const configuration = {
-    schemaVersion: 1,
-    source: bootstrapMetadata.sourceIdentity,
-    candidateDigest: candidateGuard.provenance.contentDigest,
-    suiteDigest,
-    runtimeDependencyDigest: bootstrapMetadata.runtimeDependencies?.digest ?? null,
-    runtimeCommands,
-    environmentPolicy,
-    ...(productionHostReadinessRequired ? { hostReadinessPolicyDigest: productionHostReadinessPolicyDigest } : {}),
-    piAgentHome: configurationPiAgentHome,
-    codexCredential: configurationCodexCredential,
-    rootSeedDigest,
-    surfaces: options.surfaces,
-    model: options.model ?? null,
-    thinking: options.thinking ?? null,
-    codexMode: options.codexMode,
-    piagentTreatment: options.piagentTreatment,
-    allowPiAuthWriteback: options.allowPiAuthWriteback,
-    piCredentialVaultId: bootstrapMetadata.piAgentHome.vaultId,
-    timeoutSeconds: options.timeoutSeconds,
-    infrastructureRetries: options.infrastructureRetries,
-    retryDelaySeconds: options.retryDelaySeconds,
-    stopAfterFailedPair: options.stopAfterFailedPair,
-    order: fullOrder.map((item) => ({ scenarioId: item.scenario.id, surface: item.surface, repeat: item.repeat }))
-  };
-  const configurationDigest = crypto.createHash("sha256").update(JSON.stringify(configuration)).digest("hex");
+  const runtimeCommands = benchmarkRuntimeCommands({ productionFinalizationOnly,
+    resumeManifest: resumeState?.manifest, surfaces: options.surfaces, piCommand, codexCommand, codexBaseline: options.codexBaseline,
+    dockerCommand: registeredMeasurementRun ? verificationPlan?.dockerCommand?.path : undefined,
+    cwd: bootstrapMetadata?.originalCwd ?? process.cwd() });
+  const registeredRuntimeVerifiers = bindRegisteredRuntimeVerifiers({ registeredMeasurement,
+    registeredMeasurementRun, bootstrapMetadata, runtimeCommands, verificationPlan });
+  const { configuration, configurationDigest, environmentPolicy } = benchmarkMeasurementConfiguration({
+    bootstrapMetadata, candidateDigest: candidateGuard.provenance.contentDigest, suiteDigest, runtimeCommands,
+    verificationIdentity: verificationPlan?.identity, providerWirePlan, productionHostReadinessRequired,
+    productionHostReadinessPolicyDigest, productionFinalizationOnly, resumeManifest: resumeState?.manifest,
+    rootSeedDigest, options, fullOrder });
+  const providerFreeConfigurationDigest = providerFreeEvidenceRequired ? productionProviderFreeConfigurationDigest(configuration) : null;
+  const source = bootstrapMetadata?.sourceIdentity; if (!source) fail("Modern benchmark is missing its frozen Git source identity", 1);
+  if (resumeState && providerFreeEvidenceRequired && resumeState.manifest.providerFreeConfigurationDigest !== providerFreeConfigurationDigest) fail("Cannot resume benchmark: provider-free configuration changed since the original run", 1);
+  const { receipt: providerFreeEvidence, binding: providerFreeEvidenceBinding } = await prepareProductionProviderFreeEvidence({
+    required: providerFreeEvidenceRequired, packageRoot, bootstrapMetadata, candidateProvenance: candidateGuard.provenance, providerFreeConfigurationDigest, runCommand, resumedReceipt: resumeState ? resumeState.manifest.providerFreeEvidence ?? null : undefined });
   piCommand = runtimeCommands.pi.resolvedPath;
   if (runtimeCommands.codex) codexCommand = runtimeCommands.codex.resolvedPath;
   if (resumeState && JSON.stringify(resumeState.manifest.runtimeCommands ?? null) !== JSON.stringify(runtimeCommands)) {
@@ -572,6 +544,8 @@ async function main() {
     piAgentHome: productionFinalizationOnly ? null : bootstrapMetadata?.piAgentHome,
     codexCredential: productionFinalizationOnly ? null : bootstrapMetadata?.codexCredential,
     runtimeDependencies: bootstrapMetadata?.runtimeDependencies,
+    webUiAssets: bootstrapMetadata?.webUiAssets,
+    registeredAssets: bootstrapMetadata?.registeredMeasurement,
     commands: runtimeCommands,
     verifyCommandAssets: !productionFinalizationOnly
   });
@@ -594,8 +568,10 @@ async function main() {
     const preflightAssetError = executionGuard.check("before-preflight", [piRuntimeHome]);
     if (preflightAssetError) throw preflightAssetError;
     codexRuntime = createCodexRuntime(options);
-    try { runtime = await withBenchmarkPiCredentialWriteback(bootstrapMetadata.piAgentHome, piRuntimeHome, () => benchmarkPreflight({ runCommand, packageRoot, piCommand, piEnvironment: benchmarkEnvironment({ PI_CODING_AGENT_DIR: piRuntimeHome.path }), codexCommand, gitCommand: runtimeCommands.git.resolvedPath, surfaces: options.surfaces, codexMode: options.codexMode, codexRuntime })); }
+    assertCodexRuntimeCredential(codexRuntime, { required: registeredMeasurementRun });
+    try { runtime = await withBenchmarkPiCredentialWriteback(bootstrapMetadata.piAgentHome, piRuntimeHome, () => benchmarkPreflight({ runCommand, packageRoot, piCommand, piEnvironment: benchmarkEnvironment({ PI_CODING_AGENT_DIR: piRuntimeHome.path, PIAGENT_FAST_MODE: options.serviceTier === "fast" ? "1" : "0" }), codexCommand, codexCommandIdentity: runtimeCommands.codex, gitCommand: runtimeCommands.git.resolvedPath, surfaces: options.surfaces, codexBaseline: options.codexBaseline, codexMode: options.codexMode, codexRuntime, model: options.model, serviceTier: options.serviceTier })); }
     catch (error) { preservePiRuntime ||= error.code === "BENCHMARK_PI_CREDENTIAL_RECONCILIATION_FAILED"; throw error; }
+    assertCodexRuntimeCredential(codexRuntime, { required: registeredMeasurementRun });
     const postPreflightAssetError = executionGuard.check("after-preflight", [piRuntimeHome]);
     if (postPreflightAssetError) throw postPreflightAssetError;
     resetBenchmarkPiRuntimeEphemeralState(piRuntimeHome);
@@ -610,10 +586,8 @@ async function main() {
     }
   }
   assertHostReadinessStartReady();
-  const source = bootstrapMetadata?.sourceIdentity;
-  if (!source) fail("Modern benchmark is missing its frozen Git source identity", 1);
   if (options.preflightOnly) {
-    const receipt = benchmarkPreflightReceipt({ packageVersion: packageManifest.version, source, candidateProvenance: candidateGuard.report(), suite, suiteDigest, runtimeDependencies: bootstrapMetadata.runtimeDependencies, runtimeCommands, environmentPolicy, configurationDigest, rootSeedDigest, options, runtime, hostReadinessPolicyDigest: productionHostReadinessPolicyDigest, hostReadiness: hostReadinessReceipt });
+    const receipt = benchmarkPreflightReceipt({ packageVersion: packageManifest.version, source, candidateProvenance: candidateGuard.report(), suite, suiteDigest, runtimeDependencies: bootstrapMetadata.runtimeDependencies, webUiAssets: bootstrapMetadata.webUiAssets, runtimeCommands, environmentPolicy, configurationDigest, providerFreeConfigurationDigest, rootSeedDigest, options, runtime, hostReadinessPolicyDigest: productionHostReadinessPolicyDigest, hostReadiness: hostReadinessReceipt, providerFreeEvidence, independentVerification: verificationPlan?.identity, registeredRuntimeVerifiers });
     process.stdout.write(options.json ? `${JSON.stringify(receipt, null, 2)}\n` : `${plan}${codexPlan}\nPREFLIGHT READY: no model session started.\n${JSON.stringify(receipt, null, 2)}\n`);
     return;
   }
@@ -622,6 +596,16 @@ async function main() {
   const runRoot = resumeState ? privateDirectory(output) : ensureEmptyOutput(output);
   releaseRunLock ??= acquireBenchmarkRunLock(runRoot, runId);
   privateDirectory(path.join(runRoot, "workspaces"));
+  const registeredScopedSessionFactory = registeredMeasurementRun
+    ? createRegisteredBenchmarkScopedSessionFactory({ installedRoot: packageRoot, registeredMeasurement,
+      custodyRoot: registeredBenchmarkCustodyRoot(runRoot), nodeCommand: runtimeCommands.node.resolvedPath,
+      codexRuntimePath: runtimeCommands.codex?.resolvedPath ?? null, qualification: {
+        version: 4, candidateRoot: bootstrapMetadata.snapshotRoot,
+        assetsRoot: bootstrapMetadata.webUiAssets.root,
+        sdkRoot: runtimeCommands.pi.packageClosure.root,
+        candidateIndexPath: bootstrapMetadata.candidateIndex.path,
+        candidateIndexSha256: bootstrapMetadata.candidateIndex.digest } })
+    : null;
   const removeSignalHandlers = installSignalForwarding();
   const startedAt = resumeState?.manifest.startedAt ?? new Date().toISOString();
   const runs = resumeState ? [...resumeState.completedRuns] : [];
@@ -642,14 +626,20 @@ async function main() {
     },
     suiteDigest,
     suiteIdentity,
+    ...(registeredMeasurementBinding ? { registeredMeasurement: registeredMeasurementBinding } : {}),
+    ...(registeredRuntimeVerifiers ? { registeredRuntimeVerifiers } : {}),
     candidateProvenance: candidateGuard.provenance,
     runtimeDependencies: bootstrapMetadata?.runtimeDependencies ?? null,
+    webUiAssets: webUiAssetIdentity,
     runtimeCommands,
     preflightRuntime: runtime,
     codexCredentialIdentity: bootstrapMetadata.codexCredential?.identity ?? null,
     codexCredentialBridge,
     configurationDigest,
+    ...(budgetControl ? { budgetControl: budgetControl.identity } : {}),
     environmentPolicy,
+    ...(verificationPlan ? { verificationPlan: { file: options.verificationPlan, identity: verificationPlan.identity } } : {}),
+    ...(providerWirePlan ? { providerWirePlanDigest: providerWirePlan.planDigest } : {}),
     piAgentHome: {
       copied: bootstrapMetadata.piAgentHome.copied,
       globalInstructions: bootstrapMetadata.piAgentHome.globalInstructions,
@@ -667,15 +657,26 @@ async function main() {
     repeats: options.repeats,
     model: options.model ?? null,
     thinking: options.thinking ?? null,
+    serviceTier: options.serviceTier ?? null,
     codexMode: options.codexMode,
+    codexBaseline: options.codexBaseline,
     piagentTreatment: options.piagentTreatment,
+    ...(options.acceptancePolicyBinding ? { acceptancePolicyBinding: options.acceptancePolicyBinding } : {}),
+    ...(bootstrapMetadata?.treatmentDerivation ? { treatmentDerivation: bootstrapMetadata.treatmentDerivation } : {}),
     allowPiAuthWriteback: options.allowPiAuthWriteback,
     timeoutSeconds: options.timeoutSeconds,
     infrastructureRetries: options.infrastructureRetries,
     retryDelaySeconds: options.retryDelaySeconds,
+    transportCircuitBreaker: createBenchmarkTransportCircuit(),
     stopAfterFailedPair: options.stopAfterFailedPair,
+    ...(options.campaignStopPolicy ? { campaignStopPolicy: options.campaignStopPolicy } : {}),
+    ...(options.measurementOnly ? { measurementOnly: true } : {}),
+    ...(options.failedAttemptsOnly ? { failedAttemptsOnly: true } : {}),
     scenarioIds: options.scenarioIds ?? null,
     ...(productionSpendControlled ? {
+      productionGuards: productionSpendControl.productionGuards,
+      providerFreeConfigurationDigest,
+      providerFreeEvidence,
       stageControl: createProductionStageControl({
         authorizedThroughRuns: productionStageBoundaries[0],
         generatedAt: startedAt
@@ -691,6 +692,17 @@ async function main() {
       repeat: item.repeat
     }))
   };
+  productionAbortFallback = (error) => writeProductionRunAbortIfNeeded({ fullOrder, ledgerBinding, manifest, options, productionSpendControlled, runRoot, runs, suite }, error);
+  if (productionCampaignRequired) {
+    productionCampaign = openProductionBenchmarkCampaign({
+      registryBase: path.join(bootstrapMetadata.defaultOutputRoot, ".production-campaigns"), suiteId: suite.id,
+      runId, runRoot, configurationDigest, candidateDigest: candidateGuard.provenance.contentDigest, suiteDigest, existingBinding: resumeState?.manifest.campaign
+    });
+    manifest.campaign = productionCampaign.binding;
+  }
+  if (!validBenchmarkTransportCircuit(manifest.transportCircuitBreaker)) {
+    fail("Cannot run benchmark: transport circuit-breaker state is missing or malformed", 1);
+  }
   assertHostReadinessStartReady();
   if (productionSpendControlled && deferredProductionStageApproval) {
     manifest.stageControl = approveProductionStageControl(manifest.stageControl, deferredProductionStageApproval);
@@ -706,214 +718,37 @@ async function main() {
       fs.rmSync(path.join(runRoot, "paused.json"), { force: true });
     }
   }
-  const fullIndexByKey = new Map(fullOrder.map((item, index) => [benchmarkRunKey(item), index + 1]));
-  const wallStartedAt = Date.now();
-  const runtimeDeadline = options.maxRuntimeMinutes === undefined
-    ? undefined
-    : wallStartedAt + options.maxRuntimeMinutes * 60_000;
-  let newRuns = 0;
+  const scheduleState = { fatalRunError, pauseReason, preservePiRuntime, fatalExecutionReceipt, ledgerBinding, terminalStop };
   try {
-    for (const [index, item] of order.entries()) {
-      if (interruptedSignal) break;
-      if (runtimeDeadline !== undefined && newRuns > 0 && !samePairedBlock(order[index - 1], item) && Date.now() >= runtimeDeadline) {
-        pauseReason = `max-runtime-minutes:${options.maxRuntimeMinutes}`;
-        break;
-      }
-      const completedBefore = runs.filter(completedBenchmarkRecord).length;
-      const remainingIncludingThis = fullOrder.length - completedBefore;
-      const averageMs = newRuns > 0 ? (Date.now() - wallStartedAt) / newRuns : undefined;
-      const eta = averageMs === undefined ? "" : ` · ETA ${formatDuration(averageMs * remainingIncludingThis)}`;
-      const fullIndex = fullIndexByKey.get(benchmarkRunKey(item)) ?? index + 1;
-      process.stdout.write(`[${fullIndex}/${fullOrder.length}] ${item.scenario.id} · ${item.surface} · repeat ${item.repeat}/${options.repeats} · remaining ${remainingIncludingThis} · elapsed ${formatDuration(Date.now() - wallStartedAt)}${eta}\n`);
-      let record;
-      let sessionEvidence;
-      const infrastructureFailures = [...(recoveredAttemptsByKey.get(benchmarkRunKey(item)) ?? [])];
-      const firstInfrastructureAttempt = infrastructureFailures.reduce((maximum, attempt) => Math.max(maximum, attempt.attempt ?? 0), 0) + 1;
-      if (firstInfrastructureAttempt > options.infrastructureRetries + 1) {
-        fatalRunError = new Error(`No infrastructure retry remains after recovering an interrupted provider attempt for ${item.scenario.id}/${item.surface}/r${item.repeat}`);
-        break;
-      }
-      for (let infrastructureAttempt = firstInfrastructureAttempt; infrastructureAttempt <= options.infrastructureRetries + 1; infrastructureAttempt += 1) {
-        record = undefined;
-        fatalRunError = executionGuard.check(`before-session:${item.scenario.id}:${item.surface}:r${item.repeat}:attempt${infrastructureAttempt}`, [piRuntimeHome]);
-        if (fatalRunError) break;
-        let attemptError;
-        let attemptCodexRuntime = codexRuntime;
-        try {
-          if (item.surface === "codex-cli") attemptCodexRuntime = createCodexRuntime(options);
-          sessionEvidence = await withBenchmarkPiCredentialWriteback(bootstrapMetadata.piAgentHome, piRuntimeHome, () => runBenchmarkSession({
-            packageRoot,
-            runCommand,
-            resolveSuiteEntry: resolveBenchmarkSuiteEntry,
-            interrupted: () => Boolean(interruptedSignal),
-            suite,
-            suiteRoot,
-            ...item,
-            orderIndex: fullIndex,
-            infrastructureAttempt,
-            runId,
-            runRoot,
-            options,
-            piCommand,
-            codexCommand,
-            codexDisabledFeatures: runtime.codexDisabledFeatures,
-            codexRuntime: attemptCodexRuntime,
-            piRuntimeHome,
-            systemCommands: {
-              node: runtimeCommands.node.resolvedPath,
-              git: runtimeCommands.git.resolvedPath,
-              bash: runtimeCommands.bash.resolvedPath
-            },
-            suiteDigest,
-            configurationDigest,
-            persistCompletedRecord: (candidate) => stageMeasuredBenchmarkRecord({ runRoot, manifest, ledgerBinding, record: candidate, infrastructureFailures, index: fullIndex - 1, expected: item, runId, suite, configurationDigest, runs }),
-            rootSeed
-          }));
-          record = sessionEvidence.record;
-        } catch (error) {
-          preservePiRuntime ||= error.code === "BENCHMARK_PI_CREDENTIAL_RECONCILIATION_FAILED";
-          attemptError = error;
-          const safeError = safeInfrastructureDiagnostic(error.message, [piRuntimeHome?.path, bootstrapMetadata.piAgentHome.configRoot, bootstrapMetadata.piAgentHome.runtimeParent].filter(Boolean));
-          record = {
-            schemaVersion: 1,
-            runId,
-            orderIndex: fullIndex,
-            scenarioId: item.scenario.id,
-            scenarioTitle: item.scenario.title,
-            scenarioKind: item.scenario.kind,
-            category: item.scenario.category ?? "unspecified",
-            difficulty: item.scenario.difficulty ?? "unspecified",
-            profile: item.scenario.profile ?? suite.profile,
-            lifecycle: item.scenario.lifecycle ?? "steady-state",
-            surface: item.surface,
-            repeat: item.repeat,
-            infrastructureAttempt,
-            abortSuite: true,
-            infrastructureFailure: `runner-error:${safeError}`,
-            resolved: false,
-            failure: `runner-error:${safeError}`,
-            grade: { passed: false, score: 0, checks: [] },
-            graderIntegrity: { passed: false },
-            scope: { passed: false, changedFiles: [], outsideScope: [] },
-            outputSafety: { passed: false, forbiddenHits: [] },
-            outputEvidence: { passed: false, requiredCount: 0, observedCount: 0, missingHashes: [] },
-            workflow: null,
-            usage: aggregateSessionUsage([]),
-            durationSeconds: 0
-          };
-        } finally {
-          if (attemptCodexRuntime !== codexRuntime) attemptCodexRuntime.cleanup();
-        }
-        const guardStage = `after-session:${item.scenario.id}:${item.surface}:r${item.repeat}:attempt${infrastructureAttempt}`;
-        const postSessionReceipt = executionGuard.receipt(guardStage, [piRuntimeHome]);
-        const postSessionGuard = postSessionReceipt.stamp;
-        const assetError = postSessionReceipt.error;
-        if (!assetError && item.surface !== "codex-cli") resetBenchmarkPiRuntimeEphemeralState(piRuntimeHome);
-        if (!interruptedSignal) {
-          if (assetError) {
-            fatalExecutionReceipt = postSessionReceipt;
-            if (sessionEvidence) retainWorkspaceForensics({ runRoot, workspaceRoot: sessionEvidence.workspaceRoot, key: sessionEvidence.key, record });
-            if (record) {
-              persistUnacceptedBenchmarkAttempt({ runRoot, manifest, record, reason: "execution-asset-mismatch-after-provider-attempt", forceTokenUnavailable: true });
-              fs.rmSync(path.join(runRoot, "pending-record.json"), { force: true });
-              fs.rmSync(path.join(runRoot, "measured-record-ready.json"), { force: true });
-              appendPrivateJsonl(infrastructureLedgerPath, { ...record, accepted: false, contaminated: true, executionAsset: assetError.executionAsset ?? { reason: assetError.message } });
-              if (sessionEvidence) fs.rmSync(sessionEvidence.inflightPath, { force: true });
-            }
-            fatalRunError = assetError;
-            break;
-          }
-          if (sessionEvidence && !record.abortSuite) promoteMeasuredBenchmarkRecord({ runRoot, ledgerBinding, record, postSessionGuard });
-        }
-        if (interruptedSignal && sessionEvidence) {
-          retainWorkspaceForensics({ runRoot, workspaceRoot: sessionEvidence.workspaceRoot, key: sessionEvidence.key, record });
-          persistUnacceptedBenchmarkAttempt({ runRoot, manifest, record, reason: "interrupted-provider-attempt-not-accepted-as-a-measured-outcome" });
-          fs.rmSync(path.join(runRoot, "pending-record.json"), { force: true });
-          fs.rmSync(path.join(runRoot, "measured-record-ready.json"), { force: true });
-          appendPrivateJsonl(infrastructureLedgerPath, { ...record, accepted: false, interrupted: true });
-          fs.rmSync(sessionEvidence.inflightPath, { force: true });
-        }
-        if (!record.abortSuite || interruptedSignal) break;
-        const retryAvailable = record.infrastructureRetryable === true && infrastructureAttempt <= options.infrastructureRetries;
-        infrastructureFailures.push({
-          attempt: infrastructureAttempt,
-          failure: record.infrastructureFailure ?? record.failure,
-          class: record.infrastructureClass ?? "infrastructure",
-          agent: record.agent,
-          usage: record.usage,
-          usageStatus: record.usageStatus,
-          durationSeconds: record.durationSeconds
-        });
-        if (record.usageStatus === "unknown-after-provider-start") {
-          manifest.unknownCostAttempts = Number(manifest.unknownCostAttempts ?? 0) + 1;
-          manifest.tokenClaimsUnavailableReason = "one-or-more-provider-attempts-have-unknown-usage";
-        }
-        // A runner error before runBenchmarkSession creates its durable in-flight
-        // marker is positively pre-provider. Post-provider throws leave that
-        // marker behind and terminal recovery persists them fail-closed.
-        if (record.attemptId) persistUnacceptedBenchmarkAttempt({ runRoot, manifest, record });
-        appendPrivateJsonl(infrastructureLedgerPath, { ...record, accepted: false, retryAvailable });
-        if (sessionEvidence) {
-          retainWorkspaceForensics({ runRoot, workspaceRoot: sessionEvidence.workspaceRoot, key: sessionEvidence.key, record });
-          fs.rmSync(sessionEvidence.inflightPath, { force: true });
-        }
-        if (!retryAvailable) {
-          if (attemptError) fatalRunError = new Error(record.infrastructureFailure ?? "benchmark runner infrastructure error");
-          break;
-        }
-        process.stdout.write(`           RETRY ${infrastructureAttempt}/${options.infrastructureRetries} (${record.infrastructureFailure ?? record.failure})\n`);
-        if (options.retryDelaySeconds > 0) {
-          await new Promise((resolve) => setTimeout(resolve, options.retryDelaySeconds * 1_000));
-        }
-      }
-      if (interruptedSignal) break;
-      if (fatalRunError) break;
-      if (record.abortSuite) {
-        if (!fatalRunError) fatalRunError = new Error(record.infrastructureFailure ?? record.failure ?? "agent startup failure");
-        break;
-      }
-      const retainWorkspace = options.keepWorkspaces || !record.resolved || sessionEvidence?.workflowFailed;
-      if (retainWorkspace && sessionEvidence) {
-        retainWorkspaceForensics({ runRoot, workspaceRoot: sessionEvidence.workspaceRoot, key: sessionEvidence.key, record });
-      }
-      runs.push(record);
-      newRuns += 1;
-      const pendingRecordPath = path.join(runRoot, "pending-record.json");
-      ledgerBinding = appendBenchmarkLedger(ledgerPath, record, ledgerBinding);
-      manifest.ledger = ledgerBinding;
-      clearRecoveredBenchmarkAttempts(manifest, record);
-      writeBenchmarkRunManifest(runRoot, manifest);
-      fs.rmSync(pendingRecordPath, { force: true });
-      if (sessionEvidence) {
-        fs.rmSync(sessionEvidence.inflightPath, { force: true });
-        if (!retainWorkspace) fs.rmSync(sessionEvidence.workspaceRoot, { recursive: true, force: true });
-      }
-      const cost = Number.isFinite(record.usage.cost) ? `$${Number(record.usage.cost).toFixed(6)}` : "cost n/a";
-      const completedAfter = runs.filter(completedBenchmarkRecord).length;
-      const remainingAfter = Math.max(0, fullOrder.length - completedAfter);
-      const averageAfterMs = (Date.now() - wallStartedAt) / Math.max(1, newRuns);
-      process.stdout.write(`           ${record.resolved ? "PASS" : `FAIL (${record.failure})`} · ${record.usage.fresh} fresh tok · ${cost} · run ${formatDuration(Number(record.durationSeconds ?? 0) * 1_000)} · remaining ${remainingAfter} · ETA ${formatDuration(averageAfterMs * remainingAfter)}\n`);
-      terminalStop = pairedOutcomeFloorStop({ enabled: options.stopAfterFailedPair, suite, runs, current: item, next: order[index + 1] });
-      if (terminalStop) break;
-      if (fatalRunError) break;
-    }
-    if (!pauseReason && options.maxSessions !== undefined && pendingOrder.length > order.length) {
-      pauseReason = `max-sessions:${options.maxSessions}`;
-    }
+    await runBenchmarkSchedule({
+      order, fullOrder, pendingOrder, options, runs,
+      manifest, recoveredAttemptsByKey, executionGuard, budgetRuntime, codexRuntime,
+      registeredMeasurement, registeredMeasurementRun, registeredRuntimeVerifiers, bootstrapMetadata, runtimeCommands,
+      piRuntimeHome, packageRoot, runCommand, suite, suiteRoot,
+      runId, runRoot, verificationPlan, providerWirePlan, candidateGuard,
+      piCommand, codexCommand, runtime, registeredScopedSessionFactory, suiteDigest,
+      configurationDigest, productionCampaign, rootSeed, ledgerPath, infrastructureLedgerPath,
+      interrupted: () => Boolean(interruptedSignal), state: scheduleState
+    });
   } finally {
+    ({ fatalRunError, pauseReason, preservePiRuntime, fatalExecutionReceipt, ledgerBinding, terminalStop } = scheduleState);
     removeSignalHandlers();
   }
   try {
     const finalLedger = inspectBenchmarkLedger(ledgerPath);
     assertBenchmarkLedgerBinding(ledgerBinding, finalLedger.binding, "benchmark terminal ledger");
-    validateBenchmarkLedgerPrefix(finalLedger.records, fullOrder, (record, index, expected) => expectedBenchmarkRecord(record, index, expected, runId, suite, configurationDigest));
+    validateBenchmarkLedgerPrefix(finalLedger.records, fullOrder, (record, index, expected) => expectedBenchmarkRecord(record, index, expected, runId, suite, configurationDigest, verificationPlan?.identity));
   } catch (error) {
     fatalRunError ??= error;
   }
+  if (productionCampaign) { manifest.campaignEvidence = productionCampaign.snapshot(); writeBenchmarkRunManifest(runRoot, manifest); }
   let finalizationReceipt;
   if (!interruptedSignal && !fatalRunError) {
+    if (providerFreeEvidenceRequired) {
+      fatalRunError ??= productionProviderFreeEvidenceError(manifest.providerFreeEvidence, providerFreeEvidenceBinding, "final production provider-free evidence");
+    }
     finalizationReceipt = executionGuard.receipt("finalization", [piRuntimeHome]);
-    fatalRunError = finalizationReceipt.error;
+    fatalRunError ??= finalizationReceipt.error;
   }
   finalizeBenchmarkRun({
     assuranceEvidence, bootstrapMetadata, candidateGuard, canonicalProductionSuite,
@@ -924,16 +759,18 @@ async function main() {
     lifecycles, manifest, options, packageVersion: packageManifest.version,
     pauseReason, piRuntimeHome, preservePiRuntime,
     productionAllStageBoundaries, productionHostReadinessPolicy, productionSpendControlled, rootSeed, rootSeedDigest,
+    productionCampaign,
     runId, runRoot, runs, runtime, runtimeCommands, source, startedAt, suite,
     suiteDigest, suiteIdentity, terminalStop
   });
-  } finally {
+  } catch (error) { productionAbortFallback(error); writeProductionResumeAbortIfNeeded(resumeState, error); throw error; } finally {
+    budgetRuntime?.close();
     releaseRunLock?.();
+    productionCampaign?.close();
     codexRuntime?.cleanup();
     if (!preservePiRuntime) cleanupBenchmarkPiRuntimeHome(bootstrapMetadata?.piAgentHome, piRuntimeHome);
   }
 }
-
 if (invokedAsEntrypoint(import.meta.url, process.argv[1])) {
   main().catch((error) => {
     console.error(`FAIL: ${error.message}`);