@unrulysystems/native-motion-conformance 0.1.0-alpha.0

package/src/oracle/judge.ts

@@ -0,0 +1,1374 @@
+// The judge boundary accepts only the provenance-free serialized bundle. Unblinding is intentionally
+// absent from this module's dispatch API; only `decideOracleGuard` receives it after judgment.
+
+import { oracleContentHash } from './attestation'
+import { isOracleControlKind, type OracleControlKind } from './controls'
+import {
+  serializeJudgeBundle,
+  type OracleJudgeBundle,
+  type OracleUnblindingRecord,
+} from './presenter'
+import type { OracleTraceSpan } from './scenarios'
+import type { TraceEvent } from './types'
+
+interface BunJudgeProcess {
+  readonly exited: Promise<number>
+  readonly stdout: ReadableStream<Uint8Array>
+  readonly stderr: ReadableStream<Uint8Array>
+  kill(signal?: number): void
+}
+
+interface BunSyncProcess {
+  readonly exitCode: number
+  readonly stdout: Uint8Array
+  readonly stderr: Uint8Array
+}
+
+// Bun is the repository's runtime, but its ambient types are intentionally not in the conformance
+// tsconfig. Declare only this local subprocess capability rather than widening the package types.
+declare const Bun: {
+  readonly env: Readonly<Record<string, string | undefined>>
+  which(binary: string): string | null
+  spawn(
+    command: readonly string[],
+    options: {
+      readonly stdin: Blob
+      readonly stdout: 'pipe'
+      readonly stderr: 'pipe'
+      readonly cwd: string
+      readonly env: Readonly<Record<string, string>>
+    },
+  ): BunJudgeProcess
+  spawnSync(
+    command: readonly string[],
+    options: {
+      readonly stdout: 'pipe' | 'ignore'
+      readonly stderr: 'pipe' | 'ignore'
+      readonly cwd?: string
+    },
+  ): BunSyncProcess
+  write(path: string, content: string): Promise<number>
+}
+
+export const ORACLE_JUDGE_DIMENSIONS = ['continuity', 'physicalPlausibility'] as const
+export type OracleJudgeDimension = (typeof ORACLE_JUDGE_DIMENSIONS)[number]
+
+export const ORACLE_JUDGE_VALUES = ['pass', 'borderline', 'fail'] as const
+export type OracleJudgeValue = (typeof ORACLE_JUDGE_VALUES)[number]
+
+export interface OracleJudgeIssue {
+  readonly timestamps: readonly number[]
+  readonly description: string
+}
+
+export interface OracleJudgeDimensionVerdict {
+  readonly verdict: OracleJudgeValue
+  readonly issues: readonly OracleJudgeIssue[]
+}
+
+export interface OracleJudgeVerdict {
+  readonly rankings: Readonly<Record<OracleJudgeDimension, readonly string[]>>
+  readonly traces: Readonly<
+    Record<string, Readonly<Record<OracleJudgeDimension, OracleJudgeDimensionVerdict>>>
+  >
+}
+
+/** The narrow production/test seam; it can receive no repository, session, or unblinding context. */
+export interface JudgeProvider {
+  /** The configuration ACTUALLY used (binary resolved absolute); carried onto verdict outcomes. */
+  readonly config: Pick<JudgeProviderConfig, 'binary' | 'args' | 'timeoutMs'>
+  /**
+   * Declared by a provider that enforces config.timeoutMs itself (kills its child, removes its
+   * sandbox, and carries cleanup evidence on the thrown error). Exactly ONE owner per deadline:
+   * when set, dispatchJudge must not race its own timer — two timers at the same deadline let
+   * the outer one win and strand the provider's kill/cleanup evidence (review lqzkrr).
+   */
+  readonly enforcesTimeout?: true
+  /**
+   * `outputSchema` (serialized JSON Schema, derived from the bundle in the TRUSTED dispatch
+   * layer) is dispatch mechanics: providers that can enforce an output shape apply it; the
+   * strict verdict parse remains the gate either way. Providers never parse bundle bytes.
+   */
+  judge(
+    serializedBundle: string,
+    outputSchema?: string,
+  ): Promise<string | OracleJudgeProviderResult>
+}
+
+/**
+ * The per-run blindness proof (ruling 2026-07-14): the judge's transcript showed a pure
+ * prompt→reasoning→message turn — zero tool use — so the verdict was formed from the blinded
+ * bundle alone. REQ-ORACLE-002's "void" semantics, made checkable.
+ */
+export interface OracleBlindnessAudit {
+  /** Content hash of the raw --json event stream the audit ran over. */
+  readonly transcriptHash: string
+  readonly eventCount: number
+  /** The provider session/thread id, so the full rollout transcript can be inspected later. */
+  readonly threadId: string
+}
+
+/**
+ * Providers return the RAW --json transcript; they never audit. The blindness proof is
+ * computed inside `dispatchJudge` (the trusted boundary), so no provider — real or injected —
+ * can mint or forge one (review v3xau5 m5c76852b). CLI results additionally carry the hash of
+ * the exact bundle bytes they executed against plus the config that ACTUALLY ran, and are
+ * frozen — a captured result can be neither doctored nor replayed for another bundle
+ * (review hscuvh m4dc9de18/ma799e14e).
+ */
+export interface OracleJudgeProviderResult {
+  readonly transcript: string
+  /** Set by the CLI provider: hash of the serialized bundle bytes this execution received. */
+  readonly bundleHash?: string
+  /** Set by the CLI provider: the configuration the child ACTUALLY executed with. */
+  readonly executedConfig?: Pick<JudgeProviderConfig, 'binary' | 'args' | 'timeoutMs'>
+  readonly cleanupFailed?: OracleJudgeCleanupError
+}
+
+export interface JudgeProviderConfig {
+  readonly binary: string
+  readonly args: readonly string[]
+  readonly timeoutMs: number
+}
+
+/** The complete, inspectable child-process boundary. No parent environment is ever spread in. */
+export interface IsolatedJudgeSpawnOptions {
+  readonly command: readonly string[]
+  readonly stdin: Blob
+  readonly stdout: 'pipe'
+  readonly stderr: 'pipe'
+  readonly cwd: string
+  readonly env: Readonly<{ PATH: string; HOME: string }>
+}
+
+/**
+ * `codex exec` is a non-interactive default, but the provider stays a driver-configurable seam.
+ * `--skip-git-repo-check` is required because the child deliberately runs in an empty non-git
+ * temp directory (review seuljp m69ea2634).
+ */
+export const DEFAULT_JUDGE_PROVIDER_CONFIG: JudgeProviderConfig = {
+  binary: 'codex',
+  args: ['exec', '--skip-git-repo-check'],
+  timeoutMs: 60_000,
+}
+
+/**
+ * The child PATH is this FIXED system allowlist, never the parent PATH: the parent PATH carries
+ * the repository's bin/, node_modules/.bin, and .direnv/bin — all provenance a path-blind judge
+ * must not see (review seuljp m2c0dce9e). The provider binary is therefore resolved to an
+ * ABSOLUTE executable in the parent environment before dispatch; the child never searches.
+ */
+export const SYSTEM_JUDGE_PATH = '/usr/bin:/bin:/usr/sbin:/sbin'
+
+export interface JudgeBinaryResolvers {
+  /** Parent-env executable lookup (production: `Bun.which`). */
+  which(binary: string): string | undefined
+  /** Real-executable lookup behind a version-manager shim (production: `mise which`). */
+  miseWhich(binary: string): string | undefined
+  /**
+   * Filesystem canonicalization of the final executable (production: `readlink -f` via the
+   * parent PATH — review 6018lg). Containment runs over THIS result — a lexical path would
+   * let an external symlink execute repository-local code (review 2noxkl m3b1becef70d3).
+   * Deeper environment compromise (hard links, PATH shadowing) is wontfix by the ratified
+   * environment-trust cap (packet Decision 2026-07-14).
+   */
+  realpath(path: string): string | undefined
+  /**
+   * The symlink-resolved repository TOPLEVEL (production: git, fail-closed — review x4why2
+   * db4609a4dbd1 killed the cwd fallback); a binary resolved inside it is provenance and is
+   * refused.
+   */
+  readonly repoRoot: string
+}
+
+/**
+ * Resolves the configured binary to the real absolute executable, in the PARENT environment,
+ * at provider construction (fail-loud early, not at dispatch). A mise shim re-resolves to the
+ * shimmed executable because shims exit 1 under an isolated HOME (review seuljp m69ea2634).
+ */
+export function resolveJudgeBinary(binary: string, resolvers: JudgeBinaryResolvers): string {
+  const direct = resolvers.which(binary)
+  if (direct === undefined || direct === '') {
+    throw new OracleJudgeError(`provider binary ${binary} is not resolvable on the parent PATH`)
+  }
+  const resolved = direct.includes('/mise/shims/') ? resolvers.miseWhich(binary) : direct
+  if (resolved === undefined || resolved === '') {
+    throw new OracleJudgeError(
+      `provider binary ${binary} resolves to a mise shim and mise cannot name the real executable`,
+    )
+  }
+  // Canonicalize BEFORE containment (review 2noxkl m3b1becef70d3): an external PATH entry that
+  // is a symlink into the repository passes a lexical check while executing repository-local
+  // code. The canonical path is also what executes and what records carry.
+  const canonical = resolvers.realpath(resolved)
+  if (canonical === undefined || canonical === '' || !canonical.startsWith('/')) {
+    throw new OracleJudgeError(
+      `provider binary ${binary} could not be canonicalized to an absolute executable path (resolved ${resolved})`,
+    )
+  }
+  if (!resolvers.repoRoot.startsWith('/')) {
+    throw new OracleJudgeError(
+      `binary containment needs an absolute repository root, received ${resolvers.repoRoot === '' ? 'an empty path' : `"${resolvers.repoRoot}"`}`,
+    )
+  }
+  // Path-segment exact (review x4why2/zo9ag1 boundary class): a loose prefix both accepted
+  // in-repo binaries under a narrowed boundary and rejected innocent repository siblings.
+  if (canonical === resolvers.repoRoot || canonical.startsWith(`${resolvers.repoRoot}/`)) {
+    throw new OracleJudgeError(
+      `provider binary ${binary} resolves inside the repository (${canonical}) — repository-local executables are provenance; configure an external binary`,
+    )
+  }
+  return canonical
+}
+
+// The judge transcript's ALLOWED vocabulary: a blind judgment is exactly session bookkeeping,
+// private reasoning, and the verdict message. Everything else — tool calls, shell executions,
+// file access, web search — is context acquisition and voids the run. Unknown types fail
+// closed: a codex upgrade that adds event kinds must be re-vetted here, loudly.
+const ALLOWED_JUDGE_EVENT_TYPES = new Set([
+  'thread.started',
+  'turn.started',
+  'turn.completed',
+  'item.started',
+  'item.updated',
+  'item.completed',
+])
+const ALLOWED_JUDGE_ITEM_TYPES = new Set(['agent_message', 'reasoning'])
+
+/**
+ * Parses a `codex exec --json` event stream into the verdict text plus the blindness proof.
+ * Fail-closed per REQ-ORACLE-002: any tool-use item, unknown event/item type, unparseable
+ * line, or missing agent message throws (the dispatch becomes `blocked`, the verdict void).
+ */
+export function parseJudgeEventStream(stdout: string): {
+  rawText: string
+  blindness: OracleBlindnessAudit
+} {
+  const lines = stdout
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => line !== '')
+  if (lines.length === 0) throw new OracleJudgeError('judge transcript is empty')
+
+  // Fail-closed lifecycle state machine (review v3xau5 m96f0ce16): exactly ONE fresh completed
+  // turn — thread.started first, then turn.started, then judgment items, then turn.completed
+  // last. Missing, duplicated, reordered, or trailing events void the verdict.
+  let state: 'expect-thread' | 'expect-turn-start' | 'in-turn' | 'done' = 'expect-thread'
+  let threadId: string | undefined
+  let lastAgentMessage: string | undefined
+  const voidVerdict = (why: string): never => {
+    throw new OracleJudgeError(`judge transcript ${why} — verdict void`)
+  }
+  for (const line of lines) {
+    let event: { type?: string; thread_id?: string; item?: { type?: string; text?: string } }
+    try {
+      event = JSON.parse(line) as typeof event
+    } catch {
+      return voidVerdict('line is not valid JSON')
+    }
+    // Valid JSON that is not an object (null, arrays, scalars) must hit the typed boundary
+    // here — a property read below would leak a raw TypeError (review i7n8qn 59d8eac0f713).
+    if (typeof event !== 'object' || event === null || Array.isArray(event)) {
+      return voidVerdict('line is not a JSON event object')
+    }
+    if (typeof event.type !== 'string' || !ALLOWED_JUDGE_EVENT_TYPES.has(event.type)) {
+      return voidVerdict(
+        `contains a disallowed event type ${String(event.type)} — blindness cannot be verified`,
+      )
+    }
+    switch (event.type) {
+      case 'thread.started': {
+        if (state !== 'expect-thread') return voidVerdict('has an out-of-order thread.started')
+        if (typeof event.thread_id !== 'string' || event.thread_id === '') {
+          return voidVerdict('carries no thread id')
+        }
+        threadId = event.thread_id
+        state = 'expect-turn-start'
+        break
+      }
+      case 'turn.started': {
+        if (state !== 'expect-turn-start') return voidVerdict('has an out-of-order turn.started')
+        state = 'in-turn'
+        break
+      }
+      case 'turn.completed': {
+        if (state !== 'in-turn') return voidVerdict('has an out-of-order turn.completed')
+        state = 'done'
+        break
+      }
+      default: {
+        // item.started / item.updated / item.completed
+        if (state !== 'in-turn') return voidVerdict('has a judgment item outside the turn')
+        const itemType = event.item?.type
+        if (typeof itemType !== 'string' || !ALLOWED_JUDGE_ITEM_TYPES.has(itemType)) {
+          return voidVerdict(
+            `contains a tool-use or unknown item type ${String(itemType)} — the judge acquired context beyond the blinded bundle`,
+          )
+        }
+        if (event.type === 'item.completed' && itemType === 'agent_message') {
+          const text = event.item?.text
+          if (typeof text !== 'string') {
+            return voidVerdict('carries a non-string agent message')
+          }
+          // The prompt requires exactly ONE JSON response; a second completed message means
+          // extra prose or a multi-answer turn — parsing "the last one" would let arbitrary
+          // unaudited text ride ahead of the verdict (review i7n8qn bf3c4791a24e).
+          if (lastAgentMessage !== undefined) {
+            return voidVerdict('contains more than one agent message')
+          }
+          lastAgentMessage = text
+        }
+        break
+      }
+    }
+  }
+  if (state !== 'done') return voidVerdict('does not contain one completed turn')
+  if (threadId === undefined) return voidVerdict('carries no thread id')
+  if (lastAgentMessage === undefined || lastAgentMessage.trim() === '') {
+    return voidVerdict('contains no agent message')
+  }
+  return {
+    rawText: lastAgentMessage,
+    blindness: {
+      transcriptHash: oracleContentHash(stdout),
+      eventCount: lines.length,
+      threadId,
+    },
+  }
+}
+
+function productionJudgeBinaryResolvers(): JudgeBinaryResolvers {
+  return {
+    which: (binary) => Bun.which(binary) ?? undefined,
+    miseWhich: (binary) => {
+      const result = Bun.spawnSync(['mise', 'which', binary], { stdout: 'pipe', stderr: 'ignore' })
+      if (result.exitCode !== 0) return undefined
+      const path = new TextDecoder().decode(result.stdout).trim()
+      return path === '' ? undefined : path
+    },
+    // Plain name via the parent PATH like the sibling spawns (git/mktemp/rm): a hard-coded
+    // /usr/bin/realpath does not exist on this macOS host and killed provider construction
+    // with ENOENT (review 6018lg mcd86451d3b6c, grounded live). `readlink -f` resolves on
+    // both BSD (macOS >= 12.3) and coreutils PATHs; failure stays fail-loud at construction.
+    realpath: (path) => {
+      const result = Bun.spawnSync(['readlink', '-f', path], {
+        stdout: 'pipe',
+        stderr: 'pipe',
+      })
+      if (result.exitCode !== 0) return undefined
+      const resolved = new TextDecoder().decode(result.stdout).trim()
+      return resolved === '' ? undefined : resolved
+    },
+    // The provenance boundary is the symlink-resolved git TOPLEVEL, never process.cwd() — a
+    // nested package cwd narrows the boundary and accepts in-repo binaries elsewhere in the
+    // checkout (review zo9ag1 237efe935de5). Fail-closed when git cannot name it.
+    repoRoot: repositoryRealPathBoundary(),
+  }
+}
+
+export class OracleJudgeError extends Error {
+  /**
+   * Structured sandbox-cleanup evidence riding the error itself — the message-string append
+   * alone lets a cleanup failure vanish behind a successful retry (terminal gate r3 major).
+   */
+  readonly cleanupFailed?: OracleJudgeCleanupError
+  constructor(message: string, cleanupFailed?: OracleJudgeCleanupError) {
+    super(`oracle judge: ${message}`)
+    this.name = 'OracleJudgeError'
+    if (cleanupFailed !== undefined) this.cleanupFailed = cleanupFailed
+  }
+}
+
+/**
+ * Whether the transcript came from a process the REAL CLI provider spawned (`cli`) or from an
+ * injected provider (`unverified`, test-only). The run record admits only `cli` outcomes.
+ */
+export type JudgeExecutionProvenance = 'cli' | 'unverified'
+
+export type JudgeDispatchOutcome =
+  | {
+      readonly status: 'complete'
+      readonly rawText: string
+      /** The full raw --json event stream, retained for independent re-audit. */
+      readonly transcript: string
+      readonly blindness?: OracleBlindnessAudit
+      readonly executionProvenance: JudgeExecutionProvenance
+      /** For CLI executions: the config that ACTUALLY ran, carried on the branded result. */
+      readonly executedConfig?: Pick<JudgeProviderConfig, 'binary' | 'args' | 'timeoutMs'>
+      readonly cleanupFailed?: OracleJudgeCleanupError
+    }
+  | {
+      readonly status: 'blocked'
+      readonly cause: string
+      /** Structured sandbox-cleanup evidence — message-string-only evidence lets a cleanup
+       * failure vanish behind a successful retry (terminal gate r3 major). */
+      readonly cleanupFailed?: OracleJudgeCleanupError
+    }
+
+export type JudgeVerdictOutcome =
+  | {
+      readonly status: 'complete'
+      readonly rawText: string
+      /** The full raw --json event stream, retained for independent re-audit. */
+      readonly transcript: string
+      readonly verdict: OracleJudgeVerdict
+      /** Content hash of the EXACT serialized bundle this outcome judged — binds outcome↔bundle. */
+      readonly bundleHash: string
+      /** The provider configuration ACTUALLY used, carried from the provider — never claimed. */
+      readonly provider: Pick<JudgeProviderConfig, 'binary' | 'args' | 'timeoutMs'>
+      /** The per-run transcript audit; REQUIRED by the run record (ruling 2026-07-14). */
+      readonly blindness?: OracleBlindnessAudit
+      readonly executionProvenance: JudgeExecutionProvenance
+      readonly cleanupFailed?: OracleJudgeCleanupError
+    }
+  | {
+      readonly status: 'blocked'
+      readonly cause: string
+      /**
+       * The agent-message text a verdict parse REJECTED, carried for operational diagnosis —
+       * without it a live integrity block is undiagnosable (the run discards the transcript).
+       * Blinded content only; absent when the dispatch itself failed before any message.
+       */
+      readonly rawText?: string
+      /**
+       * Sandbox-cleanup evidence from a dispatch that completed before the verdict parse
+       * blocked — dropping it here would let a leftover sandbox vanish behind a retry
+       * (terminal gate r2 major 3).
+       */
+      readonly cleanupFailed?: OracleJudgeCleanupError
+    }
+
+function causeOf(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+function positiveTimeout(timeoutMs: number): number {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new OracleJudgeError(`timeout must be a positive finite number, received ${timeoutMs}`)
+  }
+  return timeoutMs
+}
+
+const JUDGE_TEMP_DIRECTORY_PREFIX = 'native-motion-oracle-judge-'
+
+/**
+ * Proves the judge child's cwd is OUTSIDE the repository. Codex discovers ambient context
+ * (AGENTS.md, git metadata) by walking UP from its cwd, so a sandbox created inside the worktree
+ * leaks repository provenance while the event stream still audits clean (review edscpo
+ * e7b02aec0f21). Both inputs must be absolute, symlink-resolved paths; containment is
+ * path-segment exact so a sibling like `/repo-x` is never mistaken for `/repo`. Fail-closed:
+ * an unprovable input throws rather than passing.
+ */
+export function assertJudgeCwdOutsideRepository(
+  cwdRealPath: string,
+  repositoryRealPath: string,
+): void {
+  if (!cwdRealPath.startsWith('/')) {
+    throw new OracleJudgeError(
+      `cwd containment needs an absolute resolved judge cwd, received ${cwdRealPath === '' ? 'an empty path' : `"${cwdRealPath}"`}`,
+    )
+  }
+  if (!repositoryRealPath.startsWith('/')) {
+    throw new OracleJudgeError(
+      `cwd containment needs an absolute resolved repository root, received ${repositoryRealPath === '' ? 'an empty path' : `"${repositoryRealPath}"`}`,
+    )
+  }
+  if (cwdRealPath === repositoryRealPath || cwdRealPath.startsWith(`${repositoryRealPath}/`)) {
+    throw new OracleJudgeError(
+      `judge cwd ${cwdRealPath} is inside the repository ${repositoryRealPath} — the child could acquire repository context; point TMPDIR outside the worktree`,
+    )
+  }
+}
+
+/** Symlink-resolved absolute path via `/bin/pwd -P` (conformance deliberately has no fs types). */
+function judgeRealPathOf(path: string): string {
+  const result = Bun.spawnSync(['/bin/pwd', '-P'], { stdout: 'pipe', stderr: 'pipe', cwd: path })
+  const resolved = new TextDecoder().decode(result.stdout).trim()
+  if (result.exitCode !== 0 || resolved === '') {
+    const stderr = new TextDecoder().decode(result.stderr).trim()
+    throw new OracleJudgeError(`could not resolve real path of ${path}: ${stderr || 'pwd failed'}`)
+  }
+  return resolved
+}
+
+/**
+ * The fail-closed boundary policy: the containment proof needs the repository TOPLEVEL. A
+ * process-cwd fallback would narrow the boundary from a nested package cwd and let a TMPDIR
+ * elsewhere inside the repository pass containment (review x4why2 db4609a4dbd1) — when git
+ * cannot name the toplevel, dispatch must not proceed.
+ */
+export function resolveJudgeRepositoryBoundary(gitToplevel: string | undefined): string {
+  if (gitToplevel === undefined || gitToplevel === '') {
+    throw new OracleJudgeError(
+      'git could not name the repository toplevel — the cwd containment boundary is unprovable, refusing dispatch',
+    )
+  }
+  return gitToplevel
+}
+
+/** The repository toplevel per git, symlink-resolved; throws when git cannot name one. */
+function repositoryRealPathBoundary(): string {
+  const result = Bun.spawnSync(['git', 'rev-parse', '--show-toplevel'], {
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+  const toplevel = new TextDecoder().decode(result.stdout).trim()
+  return judgeRealPathOf(
+    resolveJudgeRepositoryBoundary(result.exitCode === 0 ? toplevel : undefined),
+  )
+}
+
+/** Bun's deliberately narrow ambient surface has no fs declarations in conformance. */
+function createIsolatedTempDirectory(): string {
+  const tmp = Bun.env.TMPDIR ?? '/tmp'
+  const result = Bun.spawnSync(['mktemp', '-d', `${tmp}/${JUDGE_TEMP_DIRECTORY_PREFIX}XXXXXX`], {
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+  const cwd = new TextDecoder().decode(result.stdout).trim()
+  if (result.exitCode !== 0 || cwd === '') {
+    const stderr = new TextDecoder().decode(result.stderr).trim()
+    throw new OracleJudgeError(
+      `could not create isolated temp directory: ${stderr || 'mktemp failed'}`,
+    )
+  }
+  // Ambient TMPDIR is untrusted input: prove the created sandbox sits outside the repository
+  // before any child can see it, and leave nothing behind when the proof fails — carrying the
+  // cleanup failure too when removal itself fails (review x4why2 20708ce0baff).
+  try {
+    assertJudgeCwdOutsideRepository(judgeRealPathOf(cwd), repositoryRealPathBoundary())
+  } catch (error) {
+    throw withJudgeCleanupEvidence(error, removeIsolatedTempDirectory(cwd))
+  }
+  return cwd
+}
+
+export interface OracleJudgeCleanupError {
+  readonly path: string
+  readonly cause: string
+}
+
+/**
+ * Joins an execution failure with a sandbox-cleanup failure on ONE typed error, without ever
+ * mutating the original: a frozen error made `error.message = ...` throw a TypeError that lost
+ * BOTH failures (review x4why2 20708ce0baff). No cleanup failure → the original passes through
+ * untouched; with one, a NEW OracleJudgeError carries both texts (single prefix).
+ */
+export function withJudgeCleanupEvidence(
+  error: unknown,
+  cleanupFailed: OracleJudgeCleanupError | undefined,
+): Error {
+  if (cleanupFailed === undefined) {
+    return error instanceof Error ? error : new OracleJudgeError(String(error))
+  }
+  const cleanup = `; cleanup failed at ${cleanupFailed.path}: ${cleanupFailed.cause}`
+  const body =
+    error instanceof OracleJudgeError
+      ? error.message.replace(/^oracle judge: /, '')
+      : causeOf(error)
+  return new OracleJudgeError(`${body}${cleanup}`, cleanupFailed)
+}
+
+function removeIsolatedTempDirectory(cwd: string): OracleJudgeCleanupError | undefined {
+  const result = Bun.spawnSync(['rm', '-rf', cwd], { stdout: 'ignore', stderr: 'pipe' })
+  if (result.exitCode === 0) return undefined
+  const stderr = new TextDecoder().decode(result.stderr).trim()
+  return { path: cwd, cause: stderr || `rm exited ${result.exitCode}` }
+}
+
+/**
+ * Builds the complete child boundary without consulting process state. PATH is the fixed system
+ * allowlist and cwd an empty temp directory (structural guards); HOME is the REAL home so the
+ * provider's authentication works — blindness is proven per-run by the transcript audit
+ * (ruling 2026-07-14), not by stripping credentials.
+ */
+export function createIsolatedJudgeSpawnOptions(
+  command: readonly string[],
+  serializedBundle: string,
+  cwd: string,
+  path: string,
+  home: string,
+): IsolatedJudgeSpawnOptions {
+  return {
+    command: [...command],
+    stdin: new Blob([serializedBundle]),
+    stdout: 'pipe',
+    stderr: 'pipe',
+    cwd,
+    env: { PATH: path, HOME: home },
+  }
+}
+
+// The ONLY argv the CLI judge may run with (review v3xau5 m1a97ad2e): codex accepts
+// context-bearing arguments (`exec resume --last`, `-C <dir>`) that expose prior-session or
+// repository state while the event stream still audits clean. The argv is therefore pinned;
+// a config that asks for anything else fails loudly at construction.
+const FIXED_JUDGE_CLI_ARGS = ['exec', '--skip-git-repo-check'] as const
+
+/** The process seam (test-injectable). Production is `Bun.spawn`; the trust anchor is here. */
+export type JudgeSpawn = (options: IsolatedJudgeSpawnOptions) => BunJudgeProcess
+
+/**
+ * The OS boundary the provider executes through — spawn, sandbox cwd lifecycle, and the real
+ * HOME. One injectable seam so tests fake the operating system, never the provider logic; the
+ * trust anchor for `cli` execution provenance is exactly this seam.
+ */
+export interface JudgeExecutionSeam {
+  readonly spawn: JudgeSpawn
+  createCwd(): string
+  removeCwd(cwd: string): OracleJudgeCleanupError | undefined
+  home(): string | undefined
+  /** Places dispatch-mechanics files (the verdict output schema) inside the isolated cwd. */
+  writeCwdFile(cwd: string, name: string, content: string): void | Promise<void>
+}
+
+function productionExecutionSeam(): JudgeExecutionSeam {
+  return {
+    spawn: (options) => Bun.spawn(options.command, options),
+    createCwd: createIsolatedTempDirectory,
+    removeCwd: removeIsolatedTempDirectory,
+    home: () => Bun.env.HOME,
+    writeCwdFile: async (cwd, name, content) => {
+      await Bun.write(`${cwd}/${name}`, content)
+    },
+  }
+}
+
+// Provenance brand for CLI-executed transcripts: results in this set came off the stdout pipe
+// of a process the REAL provider spawned with the pinned argv. Injected providers cannot join;
+// the run record refuses their outcomes (review kpp2fg m7f2a61c9).
+const cliExecutedResults = new WeakSet<object>()
+
+/** The output schema's fixed name inside the isolated sandbox cwd (dispatch mechanics). */
+const JUDGE_SCHEMA_FILENAME = 'verdict-schema.json'
+
+/** SIGTERM→SIGKILL escalation grace on a timed-out judge child (terminal gate r3 major). */
+const JUDGE_KILL_GRACE_MS = 2000
+
+/**
+ * removeCwd is a seam and may THROW rather than return; an exception must become structured
+ * cleanup evidence, never a raw error that bypasses the cleanup-exit-2 rule (terminal gate r4).
+ */
+function safeRemoveCwd(
+  execution: JudgeExecutionSeam,
+  cwd: string,
+): OracleJudgeCleanupError | undefined {
+  try {
+    return execution.removeCwd(cwd)
+  } catch (error) {
+    return { path: cwd, cause: `removal threw: ${causeOf(error)}` }
+  }
+}
+
+/** A bounded non-interactive provider whose child sees only blind bytes in an empty cwd. */
+export function createCliJudgeProvider(
+  config: JudgeProviderConfig,
+  resolvers: JudgeBinaryResolvers = productionJudgeBinaryResolvers(),
+  execution: JudgeExecutionSeam = productionExecutionSeam(),
+): JudgeProvider {
+  const timeoutMs = positiveTimeout(config.timeoutMs)
+  if (config.binary.trim() === '') throw new OracleJudgeError('provider binary is empty')
+  if (
+    config.args.length !== FIXED_JUDGE_CLI_ARGS.length ||
+    config.args.some((arg, index) => arg !== FIXED_JUDGE_CLI_ARGS[index])
+  ) {
+    throw new OracleJudgeError(
+      `provider arguments are pinned to [${FIXED_JUDGE_CLI_ARGS.join(', ')}] — context-bearing arguments would defeat the blindness audit`,
+    )
+  }
+  // Resolve to the real absolute executable NOW, in the parent env — the child gets only the
+  // fixed system PATH and could neither find the binary nor be trusted to search for it.
+  const binary = resolveJudgeBinary(config.binary, resolvers)
+  // Snapshot + freeze the validated arguments: retaining the caller's array by reference would
+  // let a post-validation mutation reach the child argv (review kpp2fg m9c4e81a7).
+  const args = Object.freeze([...FIXED_JUDGE_CLI_ARGS]) as readonly string[]
+  const resolvedConfig = Object.freeze({ binary, args, timeoutMs })
+
+  // The provider object itself is frozen below: swapping `config` after construction would let
+  // a record claim a provider/argv that never executed (review hscuvh ma799e14e).
+  return Object.freeze({
+    config: resolvedConfig,
+    // This provider owns its deadline: the internal timer kills the child, both paths remove
+    // the sandbox, and cleanup evidence rides the thrown error — dispatchJudge must not race
+    // a second timer over it (review lqzkrr).
+    enforcesTimeout: true as const,
+    async judge(
+      serializedBundle: string,
+      outputSchema?: string,
+    ): Promise<OracleJudgeProviderResult> {
+      const home = execution.home()
+      if (home === undefined || home === '') {
+        throw new OracleJudgeError('provider HOME is unavailable for authenticated dispatch')
+      }
+      const cwd = execution.createCwd()
+      let judgeProcess: BunJudgeProcess
+      try {
+        // --json makes the child emit the auditable event stream; `-` reads the prompt from
+        // stdin (this codex fork otherwise waits on extra stdin input); --output-schema pins
+        // the emission to the trusted layer's bundle-derived shape from a file INSIDE the
+        // sandbox (no repo path in argv — review seuljp class). All three are dispatch
+        // mechanics, deliberately NOT configurable.
+        const schemaArgs: string[] = []
+        if (outputSchema !== undefined) {
+          // Awaited: the child reads this file at startup — an unfinished write is a race.
+          await execution.writeCwdFile(cwd, JUDGE_SCHEMA_FILENAME, outputSchema)
+          schemaArgs.push('--output-schema', `${cwd}/${JUDGE_SCHEMA_FILENAME}`)
+        }
+        const options = createIsolatedJudgeSpawnOptions(
+          [binary, ...args, '--json', ...schemaArgs, '-'],
+          serializedBundle,
+          cwd,
+          SYSTEM_JUDGE_PATH,
+          home,
+        )
+        judgeProcess = execution.spawn(options)
+      } catch (error) {
+        const cleanupFailed = safeRemoveCwd(execution, cwd)
+        const cleanup =
+          cleanupFailed === undefined
+            ? ''
+            : `; cleanup failed at ${cleanupFailed.path}: ${cleanupFailed.cause}`
+        throw new OracleJudgeError(
+          `provider could not start: ${causeOf(error)}${cleanup}`,
+          cleanupFailed,
+        )
+      }
+      let timer: ReturnType<typeof setTimeout> | undefined
+      let escalation: ReturnType<typeof setTimeout> | undefined
+      let rawText: string | undefined
+      try {
+        // Single-owner termination (terminal gate r3 major): on timeout the child is killed
+        // and its EXIT IS AWAITED before anything touches the sandbox — rejecting early let a
+        // retry overlap a still-running judge and removed the cwd under a live process.
+        // SIGTERM escalates to SIGKILL after a bounded grace; SIGKILL is non-maskable, so the
+        // await below settles for any userspace child (a kernel-stuck process is environment-
+        // trust territory).
+        let timedOutAfterMs: number | undefined
+        timer = setTimeout(() => {
+          timedOutAfterMs = timeoutMs
+          judgeProcess.kill()
+          escalation = setTimeout(() => judgeProcess.kill(9), JUDGE_KILL_GRACE_MS)
+        }, timeoutMs)
+        const exitCode = await judgeProcess.exited
+        if (timedOutAfterMs !== undefined) {
+          throw new OracleJudgeError(`provider timed out after ${timedOutAfterMs}ms`)
+        }
+        const stdout = await new Response(judgeProcess.stdout).text()
+        const stderr = await new Response(judgeProcess.stderr).text()
+        if (exitCode !== 0) {
+          throw new OracleJudgeError(`provider exited ${exitCode}: ${stderr.trim() || 'no stderr'}`)
+        }
+        rawText = stdout
+      } catch (error) {
+        // The sandbox is removed on the failure path too, and BOTH failures are carried on one
+        // typed error — never by mutating the original, which a frozen error turns into a
+        // TypeError that loses all evidence (review edscpo 9c406a7c201c, x4why2 20708ce0baff).
+        throw withJudgeCleanupEvidence(error, safeRemoveCwd(execution, cwd))
+      } finally {
+        if (timer !== undefined) clearTimeout(timer)
+        if (escalation !== undefined) clearTimeout(escalation)
+      }
+      const cleanupFailed = safeRemoveCwd(execution, cwd)
+      if (rawText === undefined) throw new OracleJudgeError('provider returned no stdout')
+      // The provider hands back the RAW transcript only; auditing happens in dispatchJudge.
+      // The result is provenance-branded, FROZEN, and bound to the exact bundle bytes this
+      // execution received plus the config that actually ran — capture-and-replay against a
+      // different bundle or post-capture doctoring both fail structurally (review hscuvh).
+      const result: OracleJudgeProviderResult = Object.freeze({
+        transcript: rawText,
+        bundleHash: oracleContentHash(serializedBundle),
+        executedConfig: resolvedConfig,
+        // Frozen COPY: the seam returned this object and may retain a reference — a shared or
+        // mutable cleanup record is doctorable evidence (review edscpo 9c406a7c201c).
+        ...(cleanupFailed === undefined
+          ? {}
+          : {
+              cleanupFailed: Object.freeze({
+                path: cleanupFailed.path,
+                cause: cleanupFailed.cause,
+              }),
+            }),
+      })
+      cliExecutedResults.add(result)
+      return result
+    },
+  })
+}
+
+/** Converts unavailable or non-responsive judge execution into the required fail-closed outcome. */
+export async function dispatchJudge(
+  provider: JudgeProvider,
+  bundle: OracleJudgeBundle,
+  options: Pick<JudgeProviderConfig, 'timeoutMs'> = DEFAULT_JUDGE_PROVIDER_CONFIG,
+): Promise<JudgeDispatchOutcome> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  // Hoisted so the catch can still reach RESULT-borne cleanup evidence when the audit throws —
+  // error-borne evidence alone dropped it (terminal gate r4 major 73d12a5e0c9f).
+  let result: OracleJudgeProviderResult | undefined
+  try {
+    const timeoutMs = positiveTimeout(options.timeoutMs)
+    // The strict output schema is derived HERE, in the trusted layer, from the real bundle —
+    // the provider receives it as opaque bytes and never parses bundle content (transport
+    // ruling 2026-07-14).
+    const outputSchema = JSON.stringify(verdictSchemaFor(bundle))
+    // Exactly ONE deadline owner (review lqzkrr): a provider that enforces its own timeout is
+    // awaited directly — its kill/sandbox-removal runs to completion and its cleanup evidence
+    // arrives on the thrown error. Racing a second timer at the same deadline lets the outer
+    // one (scheduled first) win, returning `blocked` while the child is still alive and
+    // stranding that evidence. The race remains as the backstop for non-enforcing providers.
+    let providerResult: string | OracleJudgeProviderResult
+    if (provider.enforcesTimeout === true) {
+      providerResult = await provider.judge(serializeJudgeBundle(bundle), outputSchema)
+    } else {
+      const timedOut = new Promise<never>((_, reject) => {
+        timer = setTimeout(
+          () => reject(new OracleJudgeError(`provider timed out after ${timeoutMs}ms`)),
+          timeoutMs,
+        )
+      })
+      providerResult = await Promise.race([
+        provider.judge(serializeJudgeBundle(bundle), outputSchema),
+        timedOut,
+      ])
+    }
+    result = typeof providerResult === 'string' ? { transcript: providerResult } : providerResult
+    if (result.transcript.trim() === '')
+      return {
+        status: 'blocked',
+        cause: 'judge provider returned empty output',
+        ...(result.cleanupFailed === undefined ? {} : { cleanupFailed: result.cleanupFailed }),
+      }
+    // TRUSTED BOUNDARY: the audit runs HERE over the raw transcript, so no provider can mint
+    // or forge a blindness proof. Anything beyond one clean turn throws → blocked, void.
+    const audited = parseJudgeEventStream(result.transcript)
+    const isCli = cliExecutedResults.has(result)
+    if (isCli && result.bundleHash !== oracleContentHash(serializeJudgeBundle(bundle))) {
+      // A frozen CLI result replayed against a different bundle: the execution is real but it
+      // is not bound to THESE bundle bytes — the verdict is void for this bundle.
+      return {
+        status: 'blocked',
+        cause: 'judge execution result is bound to a different bundle — replay refused',
+        ...(result.cleanupFailed === undefined ? {} : { cleanupFailed: result.cleanupFailed }),
+      }
+    }
+    return {
+      status: 'complete',
+      rawText: audited.rawText,
+      transcript: result.transcript,
+      blindness: audited.blindness,
+      executionProvenance: isCli ? 'cli' : 'unverified',
+      ...(isCli && result.executedConfig !== undefined
+        ? { executedConfig: result.executedConfig }
+        : {}),
+      ...(result.cleanupFailed === undefined ? {} : { cleanupFailed: result.cleanupFailed }),
+    }
+  } catch (error) {
+    // Structured cleanup evidence survives the dispatch-level block — the message string alone
+    // cannot reach the retry aggregation's exit-2 rule (terminal gate r3 major). Error-borne
+    // evidence (provider throw paths) takes precedence; RESULT-borne evidence covers the case
+    // where the dispatch completed dirty and the AUDIT then threw (terminal gate r4 major).
+    const cleanupFailed =
+      error instanceof OracleJudgeError && error.cleanupFailed !== undefined
+        ? error.cleanupFailed
+        : result?.cleanupFailed
+    return {
+      status: 'blocked',
+      cause: `judge provider could not be verified: ${causeOf(error)}`,
+      ...(cleanupFailed === undefined ? {} : { cleanupFailed }),
+    }
+  } finally {
+    if (timer !== undefined) clearTimeout(timer)
+  }
+}
+
+function object(value: unknown, path: string): Record<string, unknown> {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new OracleJudgeError(`${path} must be an object`)
+  }
+  return value as Record<string, unknown>
+}
+
+function exactKeys(
+  value: Record<string, unknown>,
+  expected: readonly string[],
+  path: string,
+): void {
+  const actual = Object.keys(value)
+  if (actual.length !== expected.length || actual.some((key) => !expected.includes(key))) {
+    throw new OracleJudgeError(`${path} must have exactly: ${expected.join(', ')}`)
+  }
+}
+
+function labelsOf(bundle: OracleJudgeBundle): readonly string[] {
+  const labels = bundle.traces.map((trace) => trace.label)
+  if (new Set(labels).size !== labels.length || labels.some((label) => label.trim() === '')) {
+    throw new OracleJudgeError('judge bundle has invalid label vocabulary')
+  }
+  return labels
+}
+
+function stringArray(value: unknown, path: string): readonly string[] {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
+    throw new OracleJudgeError(`${path} must be a string array`)
+  }
+  return value
+}
+
+function parseIssue(
+  value: unknown,
+  path: string,
+  gridTimes: ReadonlySet<number>,
+): OracleJudgeIssue {
+  const issue = object(value, path)
+  exactKeys(issue, ['timestamps', 'description'], path)
+  if (
+    !Array.isArray(issue.timestamps) ||
+    issue.timestamps.length === 0 ||
+    issue.timestamps.some((t) => typeof t !== 'number' || !Number.isFinite(t))
+  ) {
+    throw new OracleJudgeError(`${path}.timestamps must be a non-empty finite number array`)
+  }
+  if (issue.timestamps.some((timestamp) => !gridTimes.has(timestamp as number))) {
+    throw new OracleJudgeError(`${path}.timestamps must cite exact grid row timestamp(s)`)
+  }
+  if (
+    typeof issue.description !== 'string' ||
+    issue.description.trim() === '' ||
+    issue.description.includes('\n')
+  ) {
+    throw new OracleJudgeError(`${path}.description must be one non-empty line`)
+  }
+  return { timestamps: issue.timestamps as readonly number[], description: issue.description }
+}
+
+function parseDimensionVerdict(
+  value: unknown,
+  path: string,
+  gridTimes: ReadonlySet<number>,
+): OracleJudgeDimensionVerdict {
+  const dimension = object(value, path)
+  exactKeys(dimension, ['verdict', 'issues'], path)
+  if (!(ORACLE_JUDGE_VALUES as readonly string[]).includes(dimension.verdict as string)) {
+    throw new OracleJudgeError(`${path}.verdict must be pass, borderline, or fail`)
+  }
+  if (!Array.isArray(dimension.issues))
+    throw new OracleJudgeError(`${path}.issues must be an array`)
+  const issues = dimension.issues.map((issue, index) =>
+    parseIssue(issue, `${path}.issues[${index}]`, gridTimes),
+  )
+  if (dimension.verdict === 'pass' && issues.length !== 0) {
+    throw new OracleJudgeError(`${path}: pass verdict must have no issues`)
+  }
+  if (dimension.verdict !== 'pass' && issues.length === 0) {
+    throw new OracleJudgeError(`${path}: non-pass verdict requires timestamped issue(s)`)
+  }
+  return { verdict: dimension.verdict as OracleJudgeValue, issues }
+}
+
+/**
+ * The bundle-derived STRICT output schema handed to the provider as dispatch mechanics (ruling
+ * 2026-07-14, live-leg attempt 4): the judge model miscounts braces in free-form emissions and
+ * within-run retries are sampling-correlated, so the emission shape is closed STRUCTURALLY at
+ * the transport — the phase-3 precedent. Labels are exact per bundle (strict mode cannot
+ * express dynamic keys; the labels are already blinded and already in the prompt, so nothing
+ * leaks). parseJudgeVerdict remains the trusted validator — this schema constrains the model,
+ * it never replaces the parse.
+ */
+export function verdictSchemaFor(bundle: OracleJudgeBundle): object {
+  const issue = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['timestamps', 'description'],
+    properties: {
+      timestamps: { type: 'array', items: { type: 'number' } },
+      description: { type: 'string' },
+    },
+  }
+  const dimension = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['verdict', 'issues'],
+    properties: {
+      verdict: { type: 'string', enum: [...ORACLE_JUDGE_VALUES] },
+      issues: { type: 'array', items: issue },
+    },
+  }
+  const labels = labelsOf(bundle)
+  const ranking = { type: 'array', items: { type: 'string' } }
+  return {
+    type: 'object',
+    additionalProperties: false,
+    required: ['rankings', 'traces'],
+    properties: {
+      rankings: {
+        type: 'object',
+        additionalProperties: false,
+        required: [...ORACLE_JUDGE_DIMENSIONS],
+        properties: { continuity: ranking, physicalPlausibility: ranking },
+      },
+      traces: {
+        type: 'object',
+        additionalProperties: false,
+        required: labels,
+        properties: Object.fromEntries(
+          labels.map((label) => [
+            label,
+            {
+              type: 'object',
+              additionalProperties: false,
+              required: [...ORACLE_JUDGE_DIMENSIONS],
+              properties: { continuity: dimension, physicalPlausibility: dimension },
+            },
+          ]),
+        ),
+      },
+    },
+  }
+}
+
+/** Strict REQ-ORACLE-007 parser: labels, dimensions, vocabulary, and actionable non-passes exact. */
+export function parseJudgeVerdict(rawText: string, bundle: OracleJudgeBundle): OracleJudgeVerdict {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(rawText) as unknown
+  } catch (error) {
+    throw new OracleJudgeError(`malformed JSON: ${causeOf(error)}`)
+  }
+  const root = object(parsed, 'verdict')
+  exactKeys(root, ['rankings', 'traces'], 'verdict')
+  const labels = labelsOf(bundle)
+  const rankingsInput = object(root.rankings, 'verdict.rankings')
+  exactKeys(rankingsInput, ORACLE_JUDGE_DIMENSIONS, 'verdict.rankings')
+  const rankings = {} as Record<OracleJudgeDimension, readonly string[]>
+  for (const dimension of ORACLE_JUDGE_DIMENSIONS) {
+    const ranking = stringArray(rankingsInput[dimension], `verdict.rankings.${dimension}`)
+    if (
+      ranking.length !== labels.length ||
+      new Set(ranking).size !== ranking.length ||
+      ranking.some((label) => !labels.includes(label))
+    ) {
+      throw new OracleJudgeError(
+        `verdict.rankings.${dimension} must rank each bundle label exactly once`,
+      )
+    }
+    rankings[dimension] = ranking
+  }
+  const tracesInput = object(root.traces, 'verdict.traces')
+  exactKeys(tracesInput, labels, 'verdict.traces')
+  const traces: Record<string, Record<OracleJudgeDimension, OracleJudgeDimensionVerdict>> = {}
+  for (const label of labels) {
+    const trace = object(tracesInput[label], `verdict.traces.${label}`)
+    exactKeys(trace, ORACLE_JUDGE_DIMENSIONS, `verdict.traces.${label}`)
+    const blindedTrace = bundle.traces.find((candidate) => candidate.label === label)
+    if (blindedTrace === undefined) {
+      throw new OracleJudgeError(`judge bundle has no grid for label ${label}`)
+    }
+    const gridTimes = new Set(blindedTrace.rows.map((row) => row.t))
+    traces[label] = {
+      continuity: parseDimensionVerdict(
+        trace.continuity,
+        `verdict.traces.${label}.continuity`,
+        gridTimes,
+      ),
+      physicalPlausibility: parseDimensionVerdict(
+        trace.physicalPlausibility,
+        `verdict.traces.${label}.physicalPlausibility`,
+        gridTimes,
+      ),
+    }
+  }
+  return { rankings, traces }
+}
+
+/** Joins dispatch and strict parsing at the driver-facing seam so malformed output is never a pass. */
+// Chain-of-custody brand: the run-record builder admits ONLY outcomes this function produced,
+// so raw text, verdict, and provider claims cannot be fabricated (review seuljp m18f8b1ed).
+const judgedOutcomes = new WeakSet<object>()
+
+export function assertJudgeVerdictOutcome(
+  outcome: JudgeVerdictOutcome,
+): asserts outcome is JudgeVerdictOutcome & { status: 'complete' } {
+  if (outcome.status !== 'complete' || !judgedOutcomes.has(outcome)) {
+    throw new OracleJudgeError('outcome was not produced by judgeBundle')
+  }
+}
+
+// Runtime immutability for the evidence chain: a branded outcome that could be mutated in place
+// would defeat the brand (review c6w0wg m25), so the whole verdict graph is frozen.
+function deepFreezeOutcome(outcome: JudgeVerdictOutcome & { status: 'complete' }): void {
+  for (const dimension of ORACLE_JUDGE_DIMENSIONS) {
+    Object.freeze(outcome.verdict.rankings[dimension])
+  }
+  Object.freeze(outcome.verdict.rankings)
+  for (const trace of Object.values(outcome.verdict.traces)) {
+    for (const dimension of ORACLE_JUDGE_DIMENSIONS) {
+      for (const issue of trace[dimension].issues) {
+        Object.freeze(issue.timestamps)
+        Object.freeze(issue)
+      }
+      Object.freeze(trace[dimension].issues)
+      Object.freeze(trace[dimension])
+    }
+    Object.freeze(trace)
+  }
+  Object.freeze(outcome.verdict.traces)
+  Object.freeze(outcome.verdict)
+  Object.freeze(outcome.provider.args)
+  Object.freeze(outcome.provider)
+  if (outcome.blindness !== undefined) Object.freeze(outcome.blindness)
+  if (outcome.cleanupFailed !== undefined) Object.freeze(outcome.cleanupFailed)
+  Object.freeze(outcome)
+}
+
+export async function judgeBundle(
+  provider: JudgeProvider,
+  bundle: OracleJudgeBundle,
+  options: Pick<JudgeProviderConfig, 'timeoutMs'> = DEFAULT_JUDGE_PROVIDER_CONFIG,
+): Promise<JudgeVerdictOutcome> {
+  const dispatched = await dispatchJudge(provider, bundle, options)
+  if (dispatched.status === 'blocked') return dispatched
+  try {
+    const outcome: JudgeVerdictOutcome & { status: 'complete' } = {
+      status: 'complete',
+      rawText: dispatched.rawText,
+      transcript: dispatched.transcript,
+      verdict: parseJudgeVerdict(dispatched.rawText, bundle),
+      bundleHash: oracleContentHash(serializeJudgeBundle(bundle)),
+      // For CLI executions the branded result's executedConfig is authoritative — a swapped
+      // provider.config can never reach a record (review hscuvh ma799e14e).
+      provider: dispatched.executedConfig ?? provider.config,
+      executionProvenance: dispatched.executionProvenance,
+      ...(dispatched.blindness === undefined ? {} : { blindness: dispatched.blindness }),
+      ...(dispatched.cleanupFailed === undefined
+        ? {}
+        : { cleanupFailed: dispatched.cleanupFailed }),
+    }
+    deepFreezeOutcome(outcome)
+    judgedOutcomes.add(outcome)
+    return outcome
+  } catch (error) {
+    // The rejected emission rides the block for diagnosis (blinded content only) — a live
+    // integrity block without it is undiagnosable, the run discards the transcript. Cleanup
+    // evidence from the completed dispatch rides too (terminal gate r2 major 3).
+    return {
+      status: 'blocked',
+      cause: `judge verdict could not be verified: ${causeOf(error)}`,
+      rawText: dispatched.rawText,
+      ...(dispatched.cleanupFailed === undefined
+        ? {}
+        : { cleanupFailed: dispatched.cleanupFailed }),
+    }
+  }
+}
+
+export interface OracleGuardInput {
+  readonly verdict: OracleJudgeVerdict
+  /** This is deliberately guard-only: no provider or parser accepts an unblinding record. */
+  readonly unblinding: OracleUnblindingRecord
+  readonly controlKinds: readonly OracleControlKind[]
+}
+
+export interface OracleAdvisoryOrdering {
+  readonly dimension: OracleJudgeDimension
+  readonly bestToWorst: readonly ('native-core' | 'motion-dom')[]
+}
+
+/** A real-trace failure outside A6(b)'s planted-control classes; reported but never gates. */
+export interface OracleUnclassifiedFinding {
+  readonly label: string
+  readonly engine: 'native-core' | 'motion-dom'
+  readonly dimension: OracleJudgeDimension
+  readonly timestamps: readonly number[]
+  readonly description: string
+}
+
+export type OracleGuardOutcome =
+  | {
+      readonly status: 'blocked'
+      readonly cause: string
+      readonly advisory: readonly OracleAdvisoryOrdering[]
+      readonly unclassifiedFindings: readonly OracleUnclassifiedFinding[]
+    }
+  | {
+      readonly status: 'fail'
+      readonly cause: string
+      readonly advisory: readonly OracleAdvisoryOrdering[]
+      readonly unclassifiedFindings: readonly OracleUnclassifiedFinding[]
+    }
+  | {
+      readonly status: 'pass'
+      readonly advisory: readonly OracleAdvisoryOrdering[]
+      readonly unclassifiedFindings: readonly OracleUnclassifiedFinding[]
+    }
+
+function advisoryFor(input: OracleGuardInput): readonly OracleAdvisoryOrdering[] {
+  const advisories: OracleAdvisoryOrdering[] = []
+  for (const dimension of ORACLE_JUDGE_DIMENSIONS) {
+    const engines = input.verdict.rankings[dimension].flatMap((label) => {
+      const source = input.unblinding[label]?.source
+      return source !== undefined && 'engine' in source ? [source.engine] : []
+    })
+    if (engines.includes('native-core') && engines.includes('motion-dom')) {
+      advisories.push({
+        dimension,
+        bestToWorst: engines as readonly ('native-core' | 'motion-dom')[],
+      })
+    }
+  }
+  return advisories
+}
+
+function dimensionForControl(kind: OracleControlKind): OracleJudgeDimension {
+  return kind === 'C-DISC' ? 'continuity' : 'physicalPlausibility'
+}
+
+function blocked(cause: string, advisory: readonly OracleAdvisoryOrdering[]): OracleGuardOutcome {
+  return { status: 'blocked', cause, advisory, unclassifiedFindings: [] }
+}
+
+// Classification is STRUCTURAL — dimension enum + defect location only. Free-text descriptions
+// are for humans; matching them is bypassable by wording ("abrupt position step" is a
+// discontinuity a regex missed — review seuljp mb4d89c69) and never participates in gating.
+
+function discontinuityAtMarkedEvent(
+  issue: OracleJudgeIssue,
+  eventTimes: readonly TraceEvent[],
+): boolean {
+  // A continuity-dimension failure timestamped AT a marked boundary IS the C-DISC defect class.
+  return issue.timestamps.some((timestamp) => eventTimes.some((event) => event.t === timestamp))
+}
+
+function nonSpringSettle(traceSpan: OracleTraceSpan): boolean {
+  // A physical-plausibility failure on a trace that settles IS the C-LIN defect class.
+  return traceSpan === 'settles'
+}
+
+function isPlantedControlClassFailure(
+  dimension: OracleJudgeDimension,
+  issue: OracleJudgeIssue,
+  eventTimes: readonly TraceEvent[],
+  traceSpan: OracleTraceSpan,
+): boolean {
+  switch (dimension) {
+    case 'continuity':
+      return discontinuityAtMarkedEvent(issue, eventTimes)
+    case 'physicalPlausibility':
+      return nonSpringSettle(traceSpan)
+  }
+}
+
+/** A6's pure, post-judgment calibration and regression decision. */
+export function decideOracleGuard(inputs: readonly OracleGuardInput[]): OracleGuardOutcome {
+  const advisory = inputs.flatMap(advisoryFor)
+  const kindsSeen = new Set<OracleControlKind>()
+  for (const input of inputs) {
+    const labels = Object.keys(input.unblinding)
+    const verdictLabels = Object.keys(input.verdict.traces)
+    const labelSets = [
+      labels,
+      verdictLabels,
+      ...ORACLE_JUDGE_DIMENSIONS.map((dimension) => input.verdict.rankings[dimension]),
+    ]
+    if (labelSets.some((candidate) => new Set(candidate).size !== candidate.length)) {
+      return blocked('could not verify label closure: duplicate label', advisory)
+    }
+    if (
+      labelSets.some(
+        (candidate) =>
+          candidate.length !== labels.length || candidate.some((label) => !labels.includes(label)),
+      )
+    ) {
+      return blocked(
+        'could not verify label closure: bundle, verdict, and unblinding labels differ',
+        advisory,
+      )
+    }
+    for (const kind of input.controlKinds) {
+      if (!isOracleControlKind(kind))
+        return blocked(`could not verify unknown control kind ${kind}`, advisory)
+      kindsSeen.add(kind)
+    }
+    for (const kind of input.controlKinds) {
+      const dimension = dimensionForControl(kind)
+      const controls = labels.filter((label) => {
+        const source = input.unblinding[label]?.source
+        return source !== undefined && 'control' in source && source.control === kind
+      })
+      if (controls.length !== 1)
+        return blocked(`could not verify ${kind}: expected exactly one unblinded control`, advisory)
+      const realLabels = labels.filter(
+        (label) => 'engine' in (input.unblinding[label]?.source ?? {}),
+      )
+      if (realLabels.length === 0)
+        return blocked(`could not verify ${kind}: bundle has no real traces`, advisory)
+      const ranking = input.verdict.rankings[dimension]
+      const controlRank = ranking.indexOf(controls[0]!)
+      if (controlRank < 0 || realLabels.some((label) => controlRank <= ranking.indexOf(label))) {
+        return blocked(
+          `could not verify ${kind}: control was not ranked below every real trace on ${dimension}`,
+          advisory,
+        )
+      }
+      const verdict = input.verdict.traces[controls[0]!]![dimension]
+      if (verdict.verdict === 'pass')
+        return blocked(`could not verify ${kind}: control was rated pass on ${dimension}`, advisory)
+    }
+  }
+  for (const kind of ['C-DISC', 'C-LIN'] as const) {
+    if (!kindsSeen.has(kind))
+      return blocked(`could not verify calibration: ${kind} was absent from the run`, advisory)
+  }
+  const unclassifiedFindings: OracleUnclassifiedFinding[] = []
+  const unclassifiedFindingKeys = new Set<string>()
+  // The FULL scan always completes before the outcome is decided: an early return on the first
+  // classified gating failure would persist unclassifiedFindings that never saw later
+  // dimensions, traces, or bundles — incomplete guard evidence (review lqzkrr a7d2f160b9ce).
+  // The gate itself still reports the FIRST classified failure encountered.
+  let gatingCause: string | undefined
+  for (const input of inputs) {
+    for (const [label, entry] of Object.entries(input.unblinding)) {
+      if (!('engine' in entry.source)) continue
+      for (const dimension of ORACLE_JUDGE_DIMENSIONS) {
+        const verdict = input.verdict.traces[label]?.[dimension]
+        if (verdict?.verdict === 'fail') {
+          // EVERY issue matching the planted-control class is classified — first-match-only
+          // would misfile same-class siblings as unclassified findings and the persisted guard
+          // evidence would be inaccurate (review i7n8qn 0bce5fc70fb4).
+          const classifiedIssues = new Set(
+            verdict.issues.filter((issue) =>
+              isPlantedControlClassFailure(dimension, issue, entry.eventTimes, entry.traceSpan),
+            ),
+          )
+          for (const issue of verdict.issues) {
+            if (!classifiedIssues.has(issue)) {
+              const key = JSON.stringify([
+                entry.traceHash,
+                dimension,
+                issue.timestamps,
+                issue.description,
+              ])
+              if (!unclassifiedFindingKeys.has(key)) {
+                unclassifiedFindingKeys.add(key)
+                unclassifiedFindings.push({
+                  label,
+                  engine: entry.source.engine,
+                  dimension,
+                  timestamps: issue.timestamps,
+                  description: issue.description,
+                })
+              }
+            }
+          }
+          const [firstClassified] = classifiedIssues
+          if (firstClassified !== undefined && gatingCause === undefined) {
+            gatingCause = `real ${entry.source.engine} trace ${label} failed ${dimension}: ${firstClassified.description}`
+          }
+        }
+      }
+    }
+  }
+  if (gatingCause !== undefined) {
+    return { status: 'fail', cause: gatingCause, advisory, unclassifiedFindings }
+  }
+  return { status: 'pass', advisory, unclassifiedFindings }
+}