devlyn-cli 2.10.0 → 3.0.0

package/config/skills/_shared/state-phase-write.py

@@ -27,10 +27,12 @@ import copy
 import datetime
 import difflib
 import hashlib
+import importlib.util
 import json
 import os
 import pathlib
 import re
+import runpy
 import shutil
 import subprocess
 import sys
@@ -38,6 +40,7 @@ import tempfile
 
 VALID_VERDICTS = {"PASS", "PASS_WITH_ISSUES", "FAIL", "NEEDS_WORK", "BLOCKED"}
 VALID_TRIGGERS = {"build_gate", "verify"}
+SPAWN_TRIGGERS = VALID_TRIGGERS | {"plan"}
 PHASE_NAMES = {"plan", "probe_derive", "implement", "surface_close", "build_gate", "cleanup", "verify", "final_report"}
 LEGAL_TRANSITIONS = {
     "plan": {"probe_derive", "implement", "final_report"},
@@ -50,11 +53,12 @@ LEGAL_TRANSITIONS = {
     "final_report": set(),
 }
 WORKER_SESSION_ARTIFACT_PHASES = {
+    "plan": "plan",
     "implement": "implement",
     "surface_close": "surface-close",
+    "build_gate": "build_gate",
     "cleanup": "cleanup",
 }
-MODEL_HEADER_RE = re.compile(r"(?m)^[ \t]*model:[ \t]*(\S+)[ \t]*$")
 SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
 SURFACE_ROW_RE = re.compile(
     r"^(?P<obligation>UVR-STALE|PATH-TEST): (?:"
@@ -68,14 +72,37 @@ VALIDATION_EXECUTION_RE = re.compile(
 )
 SURFACE_SKIP_REASON = "auto_surface_close_claude_unavailable"
 SURFACE_RECOVERY_REASON = "surface_close_rolled_back_adjudication_malformed"
+PLAN_MAX_DISPATCHES = 2
+PLAN_SPAWN_RECEIPT_FIELDS = (
+    "round", "started_at", "triggered_by", "engine", "model_requested", "prompt_sha256",
+)
+PLAN_COMPLETION_RECEIPT_FIELDS = (
+    "completed_at", "duration_ms", "verdict", "model_effective", "output_sha256",
+)
+PLAN_RECEIPT_FIELDS = PLAN_SPAWN_RECEIPT_FIELDS + PLAN_COMPLETION_RECEIPT_FIELDS
+_PROCESS_EVIDENCE_MODULE = None
+_INVOCATION_RECEIPT_MODULE = None
 
 
 def reject_json_constant(token: str) -> None:
     raise ValueError(f"invalid JSON numeric constant: {token}")
 
 
+def reject_duplicate_keys(pairs: list[tuple[str, object]]) -> dict:
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError(f"duplicate JSON key: {key}")
+        result[key] = value
+    return result
+
+
 def loads_strict_json(text: str):
-    return json.loads(text, parse_constant=reject_json_constant)
+    return json.loads(
+        text,
+        parse_constant=reject_json_constant,
+        object_pairs_hook=reject_duplicate_keys,
+    )
 
 
 def now_ms() -> datetime.datetime:
@@ -120,6 +147,236 @@ def write_state(state_path: pathlib.Path, state: dict) -> None:
         raise
 
 
+def validate_plan_output(state: dict, devlyn: pathlib.Path | None, phase: str) -> None:
+    plan = (state.get("phases") or {}).get("plan")
+    if not isinstance(plan, dict) or plan.get("completed_at") is None:
+        return
+    expected = plan.get("output_sha256")
+    if expected is None and state.get("version") != "3.0":
+        return
+    if (
+        expected is None and "output_sha256" in plan and plan.get("verdict") == "BLOCKED"
+        and devlyn is not None and not os.path.lexists(devlyn / "plan.md")
+    ):
+        if phase != "final_report":
+            raise SystemExit("BLOCKED:plan-output-missing: only final_report is allowed")
+        return
+    if not isinstance(expected, str) or SHA256_RE.fullmatch(expected) is None:
+        raise SystemExit("BLOCKED:plan-integrity-invalid: phases.plan.output_sha256 is missing")
+    if devlyn is None:
+        raise SystemExit("BLOCKED:plan-integrity-invalid: .devlyn is required to rehash PLAN output")
+    plan_path = devlyn / "plan.md"
+    try:
+        actual = hashlib.sha256(plan_path.read_bytes()).hexdigest()
+    except OSError as exc:
+        raise SystemExit(f"BLOCKED:plan-integrity-invalid: cannot read {plan_path}: {exc}") from exc
+    if actual != expected:
+        raise SystemExit(
+            "BLOCKED:plan-integrity-mismatch: "
+            f"expected={expected} actual={actual} path={plan_path}"
+        )
+
+
+def bind_plan_output(state: dict, devlyn: pathlib.Path | None) -> None:
+    if devlyn is None:
+        raise SystemExit("BLOCKED:plan-integrity-invalid: .devlyn is required to bind PLAN output")
+    plan_path = devlyn / "plan.md"
+    plan = state["phases"]["plan"]
+    if (
+        plan.get("verdict") == "BLOCKED" and plan.get("output_sha256") is None
+        and not os.path.lexists(plan_path)
+    ):
+        digest = None
+    else:
+        try:
+            digest = hashlib.sha256(plan_path.read_bytes()).hexdigest()
+        except OSError as exc:
+            raise SystemExit(f"BLOCKED:plan-integrity-invalid: cannot read {plan_path}: {exc}") from exc
+    plan["output_sha256"] = digest
+
+
+def final_report_digest(state: dict, devlyn: pathlib.Path | None, log_file: str | None) -> str:
+    try:
+        if devlyn is None or not log_file:
+            raise ValueError("--log-file must name .devlyn/final-report.md")
+        path = devlyn / "final-report.md"
+        supplied = pathlib.Path(log_file)
+        if supplied.parent.resolve() / supplied.name != devlyn.resolve() / path.name:
+            raise ValueError("--log-file must name the canonical final-report.md")
+        if path.is_symlink() or not path.is_file():
+            raise ValueError("final-report.md must be a nonsymlink regular file")
+        raw = path.read_bytes()
+        lines = raw.decode("utf-8").splitlines()
+        run_id = state.get("run_id")
+        prefix = "<!-- devlyn:final-report run_id="
+        if (
+            not isinstance(run_id, str) or not run_id or not lines
+            or lines[0] != f"{prefix}{run_id} -->"
+            or sum(line.startswith(prefix) for line in lines) != 1
+        ):
+            raise ValueError("first line must uniquely identify the current state.run_id")
+        if not any(line.strip() for line in lines[1:]):
+            raise ValueError("final-report.md body must not be empty")
+        return hashlib.sha256(raw).hexdigest()
+    except (OSError, UnicodeError, ValueError) as exc:
+        raise SystemExit(f"BLOCKED:final-report-invalid: {exc}") from exc
+
+
+def process_evidence_module():
+    global _PROCESS_EVIDENCE_MODULE
+    if _PROCESS_EVIDENCE_MODULE is None:
+        module_path = pathlib.Path(__file__).with_name("process-evidence.py")
+        spec = importlib.util.spec_from_file_location("devlyn_process_evidence", module_path)
+        if spec is None or spec.loader is None:
+            raise SystemExit(f"BLOCKED:process-evidence-invalid: cannot load {module_path}")
+        module = importlib.util.module_from_spec(spec)
+        previous_bytecode_setting = sys.dont_write_bytecode
+        sys.dont_write_bytecode = True
+        try:
+            spec.loader.exec_module(module)
+        finally:
+            sys.dont_write_bytecode = previous_bytecode_setting
+        _PROCESS_EVIDENCE_MODULE = module
+    return _PROCESS_EVIDENCE_MODULE
+
+
+def invocation_receipt_module():
+    global _INVOCATION_RECEIPT_MODULE
+    if _INVOCATION_RECEIPT_MODULE is None:
+        module_path = pathlib.Path(__file__).with_name("invocation-receipt.py")
+        spec = importlib.util.spec_from_file_location("devlyn_invocation_receipt", module_path)
+        if spec is None or spec.loader is None:
+            raise SystemExit(f"BLOCKED:invocation-receipt-invalid: cannot load {module_path}")
+        module = importlib.util.module_from_spec(spec)
+        previous_bytecode_setting = sys.dont_write_bytecode
+        sys.dont_write_bytecode = True
+        try:
+            spec.loader.exec_module(module)
+        finally:
+            sys.dont_write_bytecode = previous_bytecode_setting
+        _INVOCATION_RECEIPT_MODULE = module
+    return _INVOCATION_RECEIPT_MODULE
+
+
+def bind_process_evidence(
+    state: dict, phase: str, verdict: str | None,
+    devlyn: pathlib.Path | None, work: pathlib.Path | None,
+) -> None:
+    if phase == "implement" and verdict not in {"PASS", "PASS_WITH_ISSUES"}:
+        return
+    if phase not in {"implement", "build_gate"}:
+        return
+    source = state.get("source")
+    if work is None or devlyn is None:
+        if isinstance(source, dict) and source.get("type") == "spec":
+            raise SystemExit(
+                "BLOCKED:process-evidence-invalid: worktree is required for spec evidence validation"
+            )
+        state.setdefault("process_evidence", None)
+        return
+    runner = process_evidence_module()
+    try:
+        results_path = devlyn / "spec-verify.results.json"
+        if phase == "implement":
+            obligations = runner.declared_obligations(work, state, phase)
+            if not obligations:
+                state.setdefault("process_evidence", None)
+                return
+            round_ = runner.phase_round(state, phase)
+            manifest_path = runner.manifest_relative_path(state, phase)
+            carrier = runner.validate_manifest(
+                work, manifest_path, state.get("run_id"), phase, round_, obligations,
+            )
+        elif verdict == "BLOCKED" and not os.path.lexists(results_path):
+            round_ = runner.phase_round(state, phase)
+            carrier = runner.validate_manifest(
+                work, runner.manifest_relative_path(state, phase),
+                state.get("run_id"), phase, round_, require_expectations=False,
+            )
+        else:
+            if not results_path.is_file():
+                raise runner.EvidenceError(
+                    "spec-verify.results.json is missing for BUILD_GATE completion"
+                )
+            results = loads_strict_json(results_path.read_text(encoding="utf-8"))
+            if not isinstance(results, dict):
+                raise runner.EvidenceError(
+                    "spec-verify.results.json must contain a JSON object"
+                )
+            commands = results.get("commands")
+            if not isinstance(commands, list):
+                raise runner.EvidenceError(
+                    "spec-verify.results.json commands must be an array"
+                )
+            carrier = results.get("process_evidence")
+            if carrier is None:
+                if commands:
+                    raise runner.EvidenceError(
+                        "BUILD_GATE commands exist without a process-evidence carrier"
+                    )
+                manifest_path = work / runner.manifest_relative_path(state, phase)
+                if manifest_path.exists():
+                    raise runner.EvidenceError(
+                        "BUILD_GATE manifest exists without a process-evidence carrier"
+                    )
+                if runner.mechanical_evidence_required(work, state):
+                    raise runner.EvidenceError(
+                        "required BUILD_GATE evidence has no process-evidence carrier"
+                    )
+                state.setdefault("process_evidence", None)
+                return
+            round_ = runner.phase_round(state, phase)
+            manifest = carrier.get("manifest") if isinstance(carrier, dict) else None
+            if (
+                not isinstance(carrier, dict)
+                or carrier.get("phase") != phase
+                or carrier.get("round") != round_
+                or not isinstance(manifest, dict)
+                or manifest.get("path") != runner.manifest_relative_path(state, phase)
+            ):
+                raise runner.EvidenceError(
+                    "BUILD_GATE process-evidence carrier does not match the active run/round"
+                )
+            outcome = runner.validate_summary_commands(work, commands, carrier)
+            if outcome["verdict"] == "BLOCKED" and verdict != "BLOCKED":
+                denial = outcome["capability_denials"][0]
+                raise runner.EvidenceError(
+                    "BUILD_GATE capability denial requires BLOCKED verdict: "
+                    f"{denial['id']}:{denial['operation']}"
+                )
+            if (
+                outcome["verdict"] == "NEEDS_WORK"
+                and verdict in {"PASS", "PASS_WITH_ISSUES"}
+            ):
+                raise runner.EvidenceError(
+                    "BUILD_GATE process evidence mismatch cannot complete as "
+                    f"{verdict}: {','.join(outcome['failed_ids'])}"
+                )
+    except (runner.EvidenceError, OSError, UnicodeError, ValueError) as exc:
+        raise SystemExit(f"BLOCKED:process-evidence-invalid: {exc}") from exc
+    existing = state.get("process_evidence")
+    if existing is None:
+        existing = []
+    if not isinstance(existing, list):
+        raise SystemExit("BLOCKED:process-evidence-invalid: state.process_evidence must be null or an array")
+    try:
+        for prior in existing:
+            runner.validate_bound_carrier(work, prior)
+    except runner.EvidenceError as exc:
+        raise SystemExit(f"BLOCKED:process-evidence-invalid: {exc}") from exc
+    if any(
+        isinstance(item, dict)
+        and item.get("phase") == carrier["phase"]
+        and item.get("round") == carrier["round"]
+        for item in existing
+    ):
+        raise SystemExit(
+            "BLOCKED:process-evidence-invalid: duplicate state carrier for "
+            f"{phase} round {carrier['round']}"
+        )
+    state["process_evidence"] = [*existing, carrier]
+
+
 def parse_string_list(raw: str, label: str) -> list[str]:
     try:
         value = loads_strict_json(raw)
@@ -226,6 +483,24 @@ def ensure_surface_clean_baseline(work: pathlib.Path, devlyn: pathlib.Path, stat
         raise SystemExit(f"BLOCKED:surface-close-preexisting-delta: {detail}")
 
 
+def validate_surface_brace_glob(entry: str) -> str | None:
+    if "{" not in entry and "}" not in entry:
+        return None
+    brace = re.search(r"\{([^{}]*)\}", entry)
+    alternatives = brace.group(1).split(",") if brace else []
+    if (
+        entry.count("{") != 1
+        or entry.count("}") != 1
+        or len(alternatives) < 2
+        or any(not value or any(char in value for char in "{},/*") for value in alternatives)
+    ):
+        return (
+            f"unsupported brace glob {entry!r}; supported form is {{alt1,alt2,...}} "
+            "with at least two non-empty plain alternatives"
+        )
+    return None
+
+
 def validate_authorized_surface(raw: str) -> list[str]:
     surface = parse_string_list(raw, "--authorized-surface-json")
     if not surface:
@@ -238,24 +513,103 @@ def validate_authorized_surface(raw: str) -> list[str]:
             or pathlib.PurePosixPath(path).is_absolute() or ".." in parts
         ):
             raise SystemExit(f"error: invalid authorized_surface entry: {entry!r}")
+        brace_error = validate_surface_brace_glob(entry)
+        if brace_error is not None:
+            raise SystemExit(f"error: {brace_error}")
     return surface
 
 
 def path_matches_surface(path: str, surface: list[str]) -> bool:
     for entry in surface:
-        if entry.endswith("/**"):
-            prefix = entry[:-3].rstrip("/")
-            if path == prefix or path.startswith(f"{prefix}/"):
+        brace_error = validate_surface_brace_glob(entry)
+        if brace_error is not None:
+            raise ValueError(brace_error)
+        if "{" in entry:
+            brace = re.search(r"\{([^{}]*)\}", entry)
+            assert brace is not None
+            alternatives = brace.group(1).split(",")
+            entries = tuple(
+                entry[:brace.start()] + value + entry[brace.end():]
+                for value in alternatives
+            )
+        else:
+            entries = (entry,)
+        for expanded in entries:
+            if expanded.endswith("/**"):
+                prefix = expanded[:-3].rstrip("/")
+                if path == prefix or path.startswith(f"{prefix}/"):
+                    return True
+            elif path == expanded:
                 return True
-        elif path == entry:
-            return True
     return False
 
 
+def safe_path_matches_surface(path: str, surface: list[str]) -> bool:
+    parsed = pathlib.PurePosixPath(path)
+    return not (parsed.is_absolute() or ".." in parsed.parts) and path_matches_surface(path, surface)
+
+
+def worktree_file_exists(work: pathlib.Path, path: str) -> bool:
+    parsed = pathlib.PurePosixPath(path)
+    if parsed.is_absolute() or ".." in parsed.parts:
+        return False
+    try:
+        resolved = (work / path).resolve()
+        resolved.relative_to(work.resolve())
+        return resolved.is_file()
+    except (OSError, RuntimeError, ValueError):
+        return False
+
+
+def worktree_path_exists(work: pathlib.Path, path: str) -> bool:
+    parsed = pathlib.PurePosixPath(path)
+    if parsed.is_absolute() or ".." in parsed.parts:
+        return False
+    try:
+        resolved = (work / path).resolve()
+        resolved.relative_to(work.resolve())
+        return resolved.exists()
+    except (OSError, RuntimeError, ValueError):
+        return False
+
+
+def resolve_na_surface_citation(
+    work: pathlib.Path, raw: str, parsed_path: str, parsed_line: int | None,
+    surface: list[str],
+) -> tuple[str, int | None]:
+    def proven(path: str) -> bool:
+        if path in surface and not path.endswith("/**"):
+            return True
+        return worktree_file_exists(work, path) and any(
+            entry.endswith("/**") and safe_path_matches_surface(path, [entry])
+            for entry in surface
+        )
+
+    if proven(raw):
+        return raw, None
+    if worktree_path_exists(work, raw) and not safe_path_matches_surface(raw, surface):
+        raise SystemExit(f"BLOCKED:surface-close-adjudication-out-of-surface: {raw}")
+    if (
+        worktree_path_exists(work, parsed_path)
+        and not safe_path_matches_surface(parsed_path, surface)
+    ):
+        raise SystemExit(f"BLOCKED:surface-close-adjudication-out-of-surface: {raw}")
+    for split in range(len(raw) - 1, -1, -1):
+        if raw[split] != ":" or not proven(raw[:split]):
+            continue
+        suffix = raw[split:]
+        if not re.fullmatch(r":[1-9][0-9]*", suffix):
+            raise SystemExit(
+                f"BLOCKED:surface-close-adjudication-malformed: citation {raw!r}"
+            )
+        return raw[:split], int(suffix[1:])
+    return parsed_path, parsed_line
+
+
 def surface_offenders(work: pathlib.Path, devlyn: pathlib.Path, state: dict,
                       surface: list[str]) -> list[str]:
     tracked, untracked = surface_delta_paths(work, devlyn, state)
-    return sorted(path for path in set(tracked + untracked) if not path_matches_surface(path, surface))
+    return sorted(path for path in set(tracked + untracked) if not safe_path_matches_surface(path, surface))
 
 
 def path_exists_at_commit(work: pathlib.Path, sha: str, path: str) -> bool:
@@ -342,14 +696,20 @@ def validate_surface_adjudication(
         raw_line = match.group("fired_line") or match.group("na_line")
         line_number = int(raw_line) if raw_line is not None else None
         citation = path if line_number is None else f"{path}:{line_number}"
-        if not path_matches_surface(path, surface):
+        if status == "N/A":
+            path, line_number = resolve_na_surface_citation(
+                work, citation, path, line_number, surface,
+            )
+            citation = path if line_number is None else f"{path}:{line_number}"
+        if not safe_path_matches_surface(path, surface):
             raise SystemExit(
                 f"BLOCKED:surface-close-adjudication-out-of-surface: {citation}"
             )
-        cited = work / path
         try:
+            cited = (work / path).resolve()
+            cited.relative_to(work.resolve())
             cited_lines = cited.read_text(encoding="utf-8").splitlines()
-        except (OSError, UnicodeError) as exc:
+        except (OSError, RuntimeError, UnicodeError, ValueError) as exc:
             raise SystemExit(
                 f"BLOCKED:surface-close-adjudication-citation-missing: {citation}: {exc}"
             ) from exc
@@ -464,7 +824,7 @@ def validate_surface_write_audit(
                     "BLOCKED:surface-close-write-audit-violation: "
                     f"line {line_number}: {raw_target!r}"
                 ) from exc
-            if not path_matches_surface(relative, surface):
+            if not safe_path_matches_surface(relative, surface):
                 raise SystemExit(
                     "BLOCKED:surface-close-write-audit-violation: "
                     f"line {line_number}: {relative!r}"
@@ -488,16 +848,66 @@ def require_surface_adjudication_malformed(
     )
 
 
+CLAUDE_USAGE_COUNTERS = (
+    ("input_tokens", "inputTokens"),
+    ("output_tokens", "outputTokens"),
+    ("cache_read_input_tokens", "cacheReadInputTokens"),
+    ("cache_creation_input_tokens", "cacheCreationInputTokens"),
+)
+
+
+def select_claude_primary_model(evidence: dict) -> str:
+    model_usage = evidence.get("modelUsage")
+    models = (
+        [model for model in model_usage if isinstance(model, str) and model]
+        if isinstance(model_usage, dict)
+        else []
+    )
+    if len(models) == 1:
+        return models[0]
+    if not models:
+        raise ValueError("Claude JSON wrapper has no effective-model evidence")
+
+    usage = evidence.get("usage")
+    if not isinstance(usage, dict):
+        raise ValueError("multi-entry Claude JSON wrapper has malformed top-level usage")
+
+    def counters(container: dict, fields: tuple[str, ...]) -> tuple[int, ...]:
+        values = tuple(container.get(field) for field in fields)
+        if any(
+            not isinstance(value, int)
+            or isinstance(value, bool)
+            or value < 0
+            for value in values
+        ):
+            raise ValueError("multi-entry Claude JSON wrapper has malformed usage counters")
+        return values
+
+    primary_usage = counters(
+        usage, tuple(field[0] for field in CLAUDE_USAGE_COUNTERS)
+    )
+    matches = []
+    for model in models:
+        entry = model_usage[model]
+        if not isinstance(entry, dict):
+            raise ValueError("multi-entry Claude JSON wrapper has malformed modelUsage entry")
+        if counters(
+            entry, tuple(field[1] for field in CLAUDE_USAGE_COUNTERS)
+        ) == primary_usage:
+            matches.append(model)
+    if len(matches) == 1:
+        return matches[0]
+    raise ValueError(
+        "multi-entry Claude JSON wrapper has no unique primary usage match"
+    )
+
+
 def parse_effective_model(session_log: pathlib.Path) -> str:
     try:
         text = session_log.read_text(encoding="utf-8")
     except (OSError, UnicodeError) as exc:
         raise ValueError(f"cannot read engine session log {session_log}: {exc}") from exc
 
-    header = MODEL_HEADER_RE.search(text)
-    if header:
-        return header.group(1)
-
     models: set[str] = set()
     if session_log.suffix == ".jsonl":
         for line_number, line in enumerate(text.splitlines(), start=1):
@@ -520,9 +930,8 @@ def parse_effective_model(session_log: pathlib.Path) -> str:
             evidence = loads_strict_json(text)
         except ValueError:
             evidence = None
-        model_usage = evidence.get("modelUsage") if isinstance(evidence, dict) else None
-        if isinstance(model_usage, dict):
-            models.update(model for model in model_usage if isinstance(model, str) and model)
+        if isinstance(evidence, dict) and isinstance(evidence.get("modelUsage"), dict):
+            return select_claude_primary_model(evidence)
 
     if len(models) == 1:
         return next(iter(models))
@@ -1126,42 +1535,135 @@ def clear_verify_round_artifacts(devlyn: pathlib.Path) -> None:
     # verify-merge-findings.py (iter-0060 R0 finding).
     # verify*.jsonl (not just *.findings.jsonl): judge-specific files like
     # verify.findings.judge-codex.jsonl end in .judge-<engine>.jsonl.
-    # *-judge.* covers every engine's stdout/stderr capture (codex-judge.*,
-    # claude-judge.* — adapters/claude.md ## Invocation).
-    for pattern in ("verify*.jsonl", "*-judge.*"):
+    # The judge suffixes cover harness-owned stdout/stderr captures and the
+    # collector-written pair-judge.summary.json, without matching prompts.
+    for pattern in ("verify*.jsonl", "*-judge.stdout", "*-judge.stderr", "*-judge.summary.json"):
         for path in devlyn.glob(pattern):
             path.unlink()
     (devlyn / "verify-merge.summary.json").unlink(missing_ok=True)
 
 
-def append_phase_history(entry: dict) -> None:
+def is_plan_dispatch_receipt(entry: dict) -> bool:
+    return all(field in entry for field in PLAN_RECEIPT_FIELDS)
+
+
+def append_phase_history(entry: dict, phase: str) -> None:
     if entry.get("started_at") is None:
         return
     history = entry.get("history")
     if not isinstance(history, list):
         history = []
-    history.append({
-        "started_at": entry.get("started_at"),
-        "verdict": entry.get("verdict"),
-        "completed_at": entry.get("completed_at"),
-        "duration_ms": entry.get("duration_ms"),
-    })
+    if phase == "plan" and is_plan_dispatch_receipt(entry):
+        fields = PLAN_RECEIPT_FIELDS + (
+            ("invocation_receipt",) if "invocation_receipt" in entry else ()
+        )
+    elif phase in WORKER_SESSION_ARTIFACT_PHASES and "invocation_receipt" in entry:
+        fields = (
+            "started_at", "verdict", "completed_at", "duration_ms",
+            "invocation_receipt",
+        ) + (("role_argv",) if "role_argv" in entry else ())
+    elif phase == "verify":
+        fields = ("started_at", "verdict", "completed_at", "duration_ms", "round", "engine", "role_evidence")
+    else:
+        fields = ("started_at", "verdict", "completed_at", "duration_ms")
+    history.append({field: entry.get(field) for field in fields})
     entry["history"] = history
 
 
+def role_config_module():
+    return runpy.run_path(pathlib.Path(__file__).with_name("role-config.py"))
+
+
+def bind_worker_role_argv(state, phase, entry, devlyn, receipt):
+    if phase not in {"implement", "cleanup"}:
+        return None
+    helper = role_config_module()
+    resolution = helper["snapshot"](state)
+    effort = resolution["roles"]["worker"]["effort_requested"] if resolution else None
+    if effort is None:
+        return None
+    path = devlyn / f"{phase}.argv.{entry['round']}.json"
+    if path.is_symlink() or not path.is_file():
+        raise ValueError("explicit worker effort requires the retained native argv array")
+    raw = path.read_bytes()
+    argv = helper["loads"](raw)
+    if not isinstance(argv, list) or any(not isinstance(arg, str) for arg in argv):
+        raise ValueError("worker argv must be an array of strings")
+    if hashlib.sha256(json.dumps(argv, separators=(",", ":")).encode()).hexdigest() != receipt["argv_sha256"]:
+        raise ValueError("worker argv differs from the actual invocation receipt")
+    values = [argv[i + 1] for i, arg in enumerate(argv[:-1]) if arg in {"-c", "--config"}]
+    efforts = [value.split("=", 1)[1].strip('"') for value in values if value.startswith("model_reasoning_effort=")]
+    if efforts != [effort]:
+        raise ValueError("worker effort differs from the frozen explicit selection")
+    return {"path": ".devlyn/" + path.name, "sha256": hashlib.sha256(raw).hexdigest(),
+            "bytes": len(raw), "effort_requested": effort, "identity_basis": "invocation-argv"}
+
+
+def freeze_roles(state: dict, work: pathlib.Path, default_engine: str) -> dict:
+    helper = role_config_module()
+    existing = helper["snapshot"](state)
+    if existing is not None:
+        return existing
+    if any(isinstance(entry, dict) and entry.get("started_at") for entry in state.get("phases", {}).values()):
+        raise ValueError("BLOCKED:invalid-engine-config: roles must be frozen before phase dispatch")
+    resolved = helper["resolve"](
+        work, default_engine,
+        flag_engine=state.get("engine") if state.get("engine_source") == "flag" else None,
+        run_input=state.get("role_config_input"), no_pair=state.get("role_no_pair", False),
+    )
+    state["role_resolution"] = resolved
+    state["engine"], state["engine_source"] = resolved["legacy_engine"], resolved["legacy_source"]
+    return resolved
+
+
 def do_spawn(state: dict, phase: str, round_: int, triggered_by: str | None,
              pre_sha: str | None, engine: str | None, model: str | None, *,
              input_patch_sha256: str | None = None,
              prompt_sha256: str | None = None,
-             untracked_before: list[str] | None = None) -> None:
+             untracked_before: list[str] | None = None,
+             devlyn: pathlib.Path | None = None) -> None:
+    if phase in {"implement", "cleanup", "verify"} and "role_resolution" in state:
+        resolution = role_config_module()["snapshot"](state)
+        selected = resolution["roles"]["primary_judge" if phase == "verify" else "worker"]
+        if engine is not None and engine != selected["engine"]:
+            raise SystemExit("BLOCKED:role-selection-mismatch: phase engine differs from frozen selection")
+        engine = selected["engine"]
+        wanted_model = selected["model_requested"]
+        if wanted_model is not None and model is not None and wanted_model != model:
+            raise SystemExit("BLOCKED:role-selection-mismatch: phase model differs from frozen selection")
+        model = wanted_model or model
     # Merge, don't replace: a phase-gated large run's `exec` progress (or any
     # other field this script doesn't own) survives a fix-loop respawn.
+    phases_value = state.get("phases")
+    entry = phases_value.get(phase) if isinstance(phases_value, dict) else None
+    validate_plan_output(state, devlyn, phase)
+    if phase == "plan":
+        history = entry.get("history", []) if isinstance(entry, dict) else []
+        if not isinstance(history, list):
+            raise SystemExit("error: phases.plan.history must be an array")
+        dispatch_count = len(history) + int(
+            isinstance(entry, dict) and entry.get("started_at") is not None
+        )
+        if dispatch_count >= PLAN_MAX_DISPATCHES:
+            raise SystemExit("BLOCKED:plan-respawn-exhausted")
+        if round_ != dispatch_count:
+            raise SystemExit(
+                f"BLOCKED:plan-round-nonmonotonic: expected={dispatch_count} supplied={round_}"
+            )
+        if not isinstance(engine, str) or not engine:
+            raise SystemExit("error: phases.plan spawn requires --engine")
+        if not isinstance(model, str) or not model:
+            raise SystemExit("error: phases.plan spawn requires --model")
+        if prompt_sha256 is None or not SHA256_RE.fullmatch(prompt_sha256):
+            raise SystemExit("error: phases.plan spawn requires --prompt-sha256")
+        if dispatch_count > 0 and triggered_by is None:
+            raise SystemExit("error: phases.plan re-spawn requires --triggered-by")
     if phase == "surface_close" and engine != "claude":
         raise SystemExit("error: phases.surface_close spawn requires --engine claude")
-    if phase == "surface_close" and not model:
-        raise SystemExit("error: phases.surface_close spawn requires --model")
-    phases = state.setdefault("phases", {})
-    entry = phases.get(phase)
+    if phase == "surface_close" and model is not None and (
+        not isinstance(model, str) or not model.strip() or model != model.strip()
+    ):
+        raise SystemExit("error: phases.surface_close explicit --model must be a nonempty exact string")
     if phase == "surface_close" and isinstance(entry, dict) and (
         entry.get("started_at") is not None or entry.get("skipped_reason") is not None
     ):
@@ -1175,8 +1677,42 @@ def do_spawn(state: dict, phase: str, round_: int, triggered_by: str | None,
             raise SystemExit("error: phases.surface_close spawn requires --prompt-sha256")
         if untracked_before is None:
             raise SystemExit("error: phases.surface_close spawn requires --untracked-before-json")
-    elif input_patch_sha256 is not None or prompt_sha256 is not None or untracked_before is not None:
-        raise SystemExit("error: SURFACE_CLOSE metadata is invalid for this phase")
+    elif phase == "plan":
+        if input_patch_sha256 is not None or untracked_before is not None:
+            raise SystemExit("error: SURFACE_CLOSE metadata is invalid for this phase")
+    else:
+        if input_patch_sha256 is not None or untracked_before is not None:
+            raise SystemExit("error: SURFACE_CLOSE metadata is invalid for this phase")
+        if prompt_sha256 is not None and SHA256_RE.fullmatch(prompt_sha256) is None:
+            raise SystemExit("error: --prompt-sha256 must be a lowercase SHA-256 digest")
+        requested_engine = (
+            engine if isinstance(engine, str) and engine else
+            entry.get("engine") if isinstance(entry, dict) else
+            state.get("engine")
+        )
+        if (
+            state.get("version") == "3.0"
+            and requested_engine == "codex"
+            and phase in WORKER_SESSION_ARTIFACT_PHASES
+            and prompt_sha256 is None
+        ):
+            raise SystemExit(
+                f"error: schema-v3 Codex phases.{phase} spawn requires --prompt-sha256"
+            )
+        requested_model = (
+            model if isinstance(model, str) and model else
+            entry.get("model_requested") if isinstance(entry, dict) else None
+        )
+        if (
+            state.get("version") == "3.0"
+            and requested_engine == "codex"
+            and phase in WORKER_SESSION_ARTIFACT_PHASES
+            and not requested_model
+        ):
+            raise SystemExit(
+                f"error: schema-v3 Codex phases.{phase} spawn requires --model"
+            )
+    phases = state.setdefault("phases", {})
     if not isinstance(entry, dict):
         entry = {}
         phases[phase] = entry
@@ -1184,7 +1720,10 @@ def do_spawn(state: dict, phase: str, round_: int, triggered_by: str | None,
         raise SystemExit(
             f"error: phases.{phase} has an open span — complete it before respawn"
         )
-    append_phase_history(entry)
+    append_phase_history(entry, phase)
+    if phase in WORKER_SESSION_ARTIFACT_PHASES:
+        entry.pop("invocation_receipt", None)
+        entry.pop("role_argv", None)
     entry["started_at"] = now_iso()
     entry["completed_at"] = None
     entry["duration_ms"] = None
@@ -1195,8 +1734,16 @@ def do_spawn(state: dict, phase: str, round_: int, triggered_by: str | None,
     entry["sub_verdicts"] = None
     if phase == "verify":
         entry["judge_durations_ms"] = None
+        entry.pop("role_evidence", None)
     if engine is not None:
         entry["engine"] = engine
+    elif (
+        state.get("version") == "3.0"
+        and "engine" not in entry
+        and isinstance(state.get("engine"), str)
+        and state["engine"]
+    ):
+        entry["engine"] = state["engine"]
     if model is not None:
         entry["model_requested"] = model
     else:
@@ -1205,9 +1752,10 @@ def do_spawn(state: dict, phase: str, round_: int, triggered_by: str | None,
     entry["model_effective"] = None
     if pre_sha is not None:
         entry["pre_sha"] = pre_sha
+    if prompt_sha256 is not None:
+        entry["prompt_sha256"] = prompt_sha256
     if phase == "surface_close":
         entry["input_patch_sha256"] = input_patch_sha256
-        entry["prompt_sha256"] = prompt_sha256
         entry["untracked_before"] = untracked_before
 
 
@@ -1238,21 +1786,49 @@ def do_complete(state: dict, phase: str, verdict: str | None,
                  post_sha: str | None, findings_file: str | None, log_file: str | None,
                  engine: str | None, model: str | None,
                  engine_session_log: str | None = None,
-                 devlyn: pathlib.Path | None = None) -> str | None:
+                 devlyn: pathlib.Path | None = None,
+                 work: pathlib.Path | None = None) -> str | None:
     phases = state.setdefault("phases", {})
     entry = phases.get(phase)
     if not isinstance(entry, dict) or not entry.get("started_at"):
         raise SystemExit(f"error: phases.{phase} was never spawned (no started_at) — cannot complete")
+    if phase == "verify" and verdict is not None:
+        raise SystemExit(
+            "error: phases.verify.verdict is owned by verify-merge-findings.py "
+            "--write-state; do not pass --verdict to complete for this phase"
+        )
+    if entry.get("completed_at") is not None:
+        raise SystemExit(
+            f"error: phases.{phase} already completed — respawn before completing again"
+        )
+    if phase != "plan":
+        validate_plan_output(state, devlyn, phase)
+    if phase == "final_report":
+        report_digest = final_report_digest(state, devlyn, log_file)
+        log_file = ".devlyn/final-report.md"
+    if phase == "plan" and entry.get("prompt_sha256") is not None:
+        missing = [field for field in PLAN_SPAWN_RECEIPT_FIELDS if field not in entry]
+        if missing:
+            raise SystemExit(
+                "error: phases.plan spawn receipt is incomplete: " + ",".join(missing)
+            )
+        if engine is not None and engine != entry["engine"]:
+            raise SystemExit("error: phases.plan completion cannot replace spawn engine")
+        if model is not None and model != entry["model_requested"]:
+            raise SystemExit("error: phases.plan completion cannot replace requested model")
+    if state.get("version") == "3.0" and phase != "plan":
+        if engine is not None and engine != entry.get("engine"):
+            raise SystemExit(f"error: phases.{phase} completion cannot replace spawn engine")
+        if model is not None and model != entry.get("model_requested"):
+            raise SystemExit(
+                f"error: phases.{phase} completion cannot replace requested model"
+            )
+    bind_process_evidence(state, phase, verdict, devlyn, work)
     started = parse_iso(entry["started_at"])
     now = now_ms()
     entry["completed_at"] = now_iso(now)
     entry["duration_ms"] = max(0, round((now - started).total_seconds() * 1000))
     if phase == "verify":
-        if verdict is not None:
-            raise SystemExit(
-                "error: phases.verify.verdict is owned by verify-merge-findings.py "
-                "--write-state; do not pass --verdict to complete for this phase"
-            )
         if entry.get("verdict") is None:
             raise SystemExit(
                 "error: phases.verify.verdict is still null — run "
@@ -1262,17 +1838,24 @@ def do_complete(state: dict, phase: str, verdict: str | None,
         entry["verdict"] = verdict
     else:
         raise SystemExit(f"error: --verdict is required to complete phases.{phase}")
+    if phase == "plan":
+        if state.get("version") == "3.0":
+            bind_plan_output(state, devlyn)
+        else:
+            entry.setdefault("output_sha256", None)
+    if phase == "final_report":
+        entry["output_sha256"] = report_digest
     if findings_file is not None or log_file is not None:
         artifacts = entry.setdefault("artifacts", {"findings_file": None, "log_file": None})
         if findings_file is not None:
             artifacts["findings_file"] = findings_file
         if log_file is not None:
             artifacts["log_file"] = log_file
-    if engine is not None:
+    if engine is not None and phase != "plan":
         entry["engine"] = engine
-    if model is not None:
+    if model is not None and phase != "plan":
         entry["model_requested"] = model
-    else:
+    elif phase != "plan":
         entry.setdefault("model_requested", None)
     entry.pop("model", None)
 
@@ -1284,13 +1867,74 @@ def do_complete(state: dict, phase: str, verdict: str | None,
             retained_session = candidate
 
     attestation_error = None
-    if engine_session_log is None:
+    if phase == "surface_close":
+        canonical_result = (devlyn or pathlib.Path(".devlyn")) / "surface-close.output.json"
+        if engine_session_log is None or pathlib.Path(engine_session_log).resolve() != canonical_result.resolve():
+            attestation_error = (
+                "BLOCKED:model-attestation-failed: SURFACE_CLOSE requires canonical native JSON "
+                f"via --engine-session-log {canonical_result}"
+            )
+        else:
+            # Select the Claude JSON parser even if the caller used a .jsonl symlink alias.
+            engine_session_log = str(canonical_result)
+    schema_v3_worker = (
+        state.get("version") == "3.0"
+        and artifact_phase is not None
+        and entry.get("engine") == "codex"
+    )
+    if schema_v3_worker and retained_session is None:
+        expected_session = (
+            devlyn / f"{artifact_phase}.worker-session.{entry.get('round')}.jsonl"
+            if devlyn is not None else
+            pathlib.Path(".devlyn") / f"{artifact_phase}.worker-session.{entry.get('round')}.jsonl"
+        )
+        attestation_error = (
+            "BLOCKED:model-attestation-failed: canonical retained worker session is missing: "
+            f"{expected_session}"
+        )
+    if (
+        attestation_error is None
+        and schema_v3_worker
+        and engine_session_log is not None
+        and pathlib.Path(engine_session_log).resolve() != retained_session.resolve()
+    ):
+        attestation_error = (
+            "BLOCKED:model-attestation-failed: --engine-session-log must be the canonical "
+            f"phase/round session {retained_session}"
+        )
+    if attestation_error is not None:
+        entry["model_effective"] = None
+    elif engine_session_log is None:
         entry["model_effective"] = None
         if retained_session is not None:
             attestation_error = (
                 "BLOCKED:model-attestation-failed: --engine-session-log is required because "
                 f"retained worker session exists: {retained_session}"
             )
+    elif schema_v3_worker:
+        receipt_path = devlyn / f"{artifact_phase}.invocation.{entry.get('round')}.json"
+        try:
+            receipt = invocation_receipt_module().validate_receipt(
+                work.resolve(), receipt_path,
+                run_id=state.get("run_id"),
+                phase=phase,
+                round_=entry.get("round"),
+                model=entry.get("model_requested"),
+                prompt_sha256=entry.get("prompt_sha256"),
+                session_path=retained_session,
+            )
+            if receipt["exit_code"] != 0:
+                raise invocation_receipt_module().ReceiptError(
+                    f"Codex invocation exited {receipt['exit_code']}"
+                )
+            role_argv = bind_worker_role_argv(state, phase, entry, devlyn, receipt)
+            if role_argv is not None:
+                entry["role_argv"] = role_argv
+            entry["model_effective"] = None  # The receipt binds argv, not an observed model.
+            entry["invocation_receipt"] = receipt
+        except (OSError, UnicodeError, ValueError) as exc:
+            entry["model_effective"] = None
+            attestation_error = f"BLOCKED:invocation-receipt-invalid: {exc}"
     else:
         try:
             entry["model_effective"] = parse_effective_model(pathlib.Path(engine_session_log))
@@ -1333,6 +1977,7 @@ def do_transition(
     next_prompt_sha256: str | None = None,
     next_untracked_before: list[str] | None = None,
     between=None,
+    work: pathlib.Path | None = None,
 ) -> dict:
     """Validate complete + caller-selected spawn against a copy of state.
 
@@ -1346,7 +1991,7 @@ def do_transition(
     candidate = copy.deepcopy(state)
     attestation_error = do_complete(
         candidate, phase, verdict, post_sha, findings_file, log_file,
-        engine, model, engine_session_log, devlyn,
+        engine, model, engine_session_log, devlyn, work,
     )
     if attestation_error is not None:
         raise SystemExit(attestation_error)
@@ -1358,6 +2003,7 @@ def do_transition(
         input_patch_sha256=next_input_patch_sha256,
         prompt_sha256=next_prompt_sha256,
         untracked_before=next_untracked_before,
+        devlyn=devlyn,
     )
     return candidate
 
@@ -1377,14 +2023,387 @@ def do_surface_adjudication_recovery(state: dict, devlyn: pathlib.Path) -> str |
     return None
 
 
+def final_report_self_test() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        work = pathlib.Path(tmp)
+        devlyn = work / ".devlyn"
+        devlyn.mkdir()
+        state_path = devlyn / "pipeline.state.json"
+        report = devlyn / "final-report.md"
+        script = pathlib.Path(__file__).resolve()
+        archive = script.with_name("archive_run.py")
+        run_id = "rs-final-report-0126"
+        write_state(state_path, {"version": "3.0", "run_id": run_id, "engine": "claude", "phases": {}})
+        command = [sys.executable, str(script), "--devlyn-dir", ".devlyn", "--phase", "final_report"]
+        spawned = subprocess.run(command + ["spawn", "--round", "0"], cwd=work, capture_output=True, text=True)
+        assert spawned.returncode == 0, spawned.stderr
+        before = state_path.read_bytes()
+        marker = f"<!-- devlyn:final-report run_id={run_id} -->\n"
+        valid = (marker + "# Report\nPASS_WITH_ISSUES — retained LOW finding.\n").encode("utf-8")
+        outside = work / "other.md"
+        outside.write_bytes(valid)
+        cases = (
+            "missing-argument", "missing-file", "empty", "blank-body", "stale",
+            "missing-marker", "duplicate-marker", "invalid-utf8", "directory", "symlink", "wrong-path",
+        )
+        for case in cases:
+            if report.is_dir() and not report.is_symlink():
+                report.rmdir()
+            else:
+                report.unlink(missing_ok=True)
+            args = ["--log-file", ".devlyn/final-report.md"]
+            if case == "missing-argument":
+                args = []
+            elif case == "empty":
+                report.write_bytes(b"")
+            elif case == "blank-body":
+                report.write_text(marker + " \t\n", encoding="utf-8")
+            elif case == "stale":
+                report.write_bytes(valid.replace(run_id.encode(), b"another-run"))
+            elif case == "missing-marker":
+                report.write_bytes(b"# Report\nBLOCKED\n")
+            elif case == "duplicate-marker":
+                report.write_bytes(valid + marker.encode())
+            elif case == "invalid-utf8":
+                report.write_bytes(marker.encode() + b"\xff")
+            elif case == "directory":
+                report.mkdir()
+            elif case == "symlink":
+                report.symlink_to(outside)
+            elif case == "wrong-path":
+                report.write_bytes(valid)
+                args = ["--log-file", str(outside)]
+            result = subprocess.run(command + ["complete", "--verdict", "PASS_WITH_ISSUES", *args],
+                                    cwd=work, capture_output=True, text=True)
+            assert result.returncode == 1 and "BLOCKED:final-report-invalid" in result.stderr, (case, result)
+            assert state_path.read_bytes() == before, case
+        report.write_bytes(valid)
+        result = subprocess.run(command + ["complete", "--verdict", "PASS_WITH_ISSUES", "--log-file", ".devlyn/final-report.md"],
+                                cwd=work, capture_output=True, text=True)
+        assert result.returncode == 0, result.stderr
+        completed_bytes = state_path.read_bytes()
+        completed = read_state(state_path)
+        final = completed["phases"]["final_report"]
+        assert final["completed_at"] is not None and final["verdict"] == "PASS_WITH_ISSUES"
+        assert final["artifacts"]["log_file"] == ".devlyn/final-report.md"
+        assert final["output_sha256"] == hashlib.sha256(valid).hexdigest()
+        archive_command = [sys.executable, str(archive), "--devlyn-dir", ".devlyn"]
+        for case in ("missing", "altered", "null-digest", "malformed-digest", "wrong-path", "symlink"):
+            candidate = copy.deepcopy(completed)
+            report.unlink(missing_ok=True)
+            report.write_bytes(valid)
+            if case == "missing":
+                report.unlink()
+            elif case == "altered":
+                report.write_bytes(valid + b"changed after completion\n")
+            elif case in {"null-digest", "malformed-digest"}:
+                candidate["phases"]["final_report"]["output_sha256"] = None if case == "null-digest" else "invalid"
+            elif case == "wrong-path":
+                candidate["phases"]["final_report"]["artifacts"]["log_file"] = str(outside)
+            else:
+                report.unlink()
+                report.symlink_to(outside)
+            write_state(state_path, candidate)
+            before_archive = state_path.read_bytes()
+            result = subprocess.run(archive_command, cwd=work, capture_output=True, text=True)
+            assert result.returncode == 1 and "error: archive blocked:" in result.stderr, (case, result)
+            assert state_path.read_bytes() == before_archive, case
+            assert not (devlyn / "runs").exists(), case
+            if case != "missing":
+                assert report.is_symlink() if case == "symlink" else report.read_bytes() == (
+                    valid + b"changed after completion\n" if case == "altered" else valid
+                ), case
+        report.unlink()
+        report.write_bytes(valid)
+        state_path.write_bytes(completed_bytes)
+        result = subprocess.run(archive_command, cwd=work, capture_output=True, text=True)
+        assert result.returncode == 0, result.stderr
+        target = devlyn / "runs" / run_id
+        assert (target / "final-report.md").read_bytes() == valid
+        assert (target / "pipeline.state.json").read_bytes() == completed_bytes
+        assert not state_path.exists() and not report.exists()
+        assert outside.read_bytes() == valid
+    print("PASS iter-0126 final report: 11 invalid CLI completions preserve state; exact binding/archive; 6 archive refusals preserve artifacts")
+
+
 def self_test() -> int:
     import time
 
+    final_report_self_test()
+    with tempfile.TemporaryDirectory() as tmp:
+        work = pathlib.Path(tmp); devlyn = work / ".devlyn"; devlyn.mkdir()
+        helper = role_config_module()
+        config = {"roles": {"worker": {"engine": "codex", "model": "gpt-6-astra", "effort": "high"},
+                            "primary_judge": {"engine": "claude"}}}
+        (devlyn / "engines.json").write_bytes(helper["encoded"](config))
+        state = {"version": "3.0", "engine": "codex", "engine_source": "default", "phases": {}}
+        frozen = freeze_roles(state, work, "codex")
+        (devlyn / "engines.json").write_text('{"executor":"claude"}')
+        assert freeze_roles(state, work, "codex") == frozen
+        do_spawn(state, "verify", 0, None, None, None, None, devlyn=devlyn)
+        assert state["engine"] == "codex" and state["phases"]["verify"]["engine"] == "claude"
+        for phase in ("implement", "cleanup"):
+            before = copy.deepcopy(state)
+            try:
+                do_spawn(state, phase, 0, None, None, "claude", None, devlyn=devlyn)
+            except SystemExit:
+                pass
+            else:
+                raise AssertionError("wrong worker engine accepted")
+            assert state == before
+        argv = ["--json", "-m", "gpt-6-astra", "-c", "model_reasoning_effort=high", "task"]
+        receipt = {"argv_sha256": hashlib.sha256(json.dumps(argv, separators=(",", ":")).encode()).hexdigest()}
+        path = devlyn / "implement.argv.0.json"
+        path.write_text(json.dumps(argv))
+        binding = bind_worker_role_argv(state, "implement", {"round": 0}, devlyn, receipt)
+        assert binding["effort_requested"] == "high"
+        path.write_text(json.dumps([*argv, "extra"]))
+        try:
+            bind_worker_role_argv(state, "implement", {"round": 0}, devlyn, receipt)
+        except ValueError:
+            pass
+        else:
+            raise AssertionError("modified worker argv accepted")
+        assert bind_worker_role_argv(state, "build_gate", {}, devlyn, receipt) is None
+    print("PASS explicit roles: frozen primary/worker routing and actual worker argv binding")
+
+    try:
+        loads_strict_json('{"process_evidence":null,"process_evidence":[]}')
+    except ValueError as exc:
+        assert "duplicate JSON key" in str(exc)
+    else:
+        raise AssertionError("duplicate pipeline state key was accepted")
+
     with tempfile.TemporaryDirectory() as tmp:
         devlyn = pathlib.Path(tmp)
         state_path = devlyn / "pipeline.state.json"
         write_state(state_path, {"phases": {}})
 
+        # Iter-0089 P-0089-1/2/6: PLAN authorization is a CLI-level,
+        # state-derived ledger contract. Rejections must leave the actual
+        # state file byte-identical, not merely preserve an in-memory copy.
+        script = str(pathlib.Path(__file__).resolve())
+        digest0 = hashlib.sha256(b"plan prompt round 0").hexdigest()
+        digest1 = hashlib.sha256(b"plan prompt round 1").hexdigest()
+
+        def plan_cli(*event_args: str) -> subprocess.CompletedProcess[str]:
+            return subprocess.run(
+                [
+                    sys.executable, script, "--devlyn-dir", str(devlyn),
+                    "--phase", "plan", *event_args,
+                ],
+                capture_output=True, text=True, check=False,
+            )
+
+        def assert_plan_rejected_unchanged(
+            expected_stderr: str, *event_args: str,
+        ) -> None:
+            before = state_path.read_bytes()
+            before_hash = hashlib.sha256(before).hexdigest()
+            result = plan_cli(*event_args)
+            assert result.returncode != 0, result.stdout
+            assert result.stderr.strip() == expected_stderr, result.stderr
+            after = state_path.read_bytes()
+            assert after == before
+            assert hashlib.sha256(after).hexdigest() == before_hash
+
+        required_spawn = (
+            "spawn", "--round", "0", "--engine", "claude",
+            "--model", "plan-test-model", "--prompt-sha256", digest0,
+        )
+        assert_plan_rejected_unchanged(
+            "error: phases.plan spawn requires --engine",
+            "spawn", "--round", "0", "--model", "plan-test-model",
+            "--prompt-sha256", digest0,
+        )
+        assert_plan_rejected_unchanged(
+            "error: phases.plan spawn requires --model",
+            "spawn", "--round", "0", "--engine", "claude",
+            "--prompt-sha256", digest0,
+        )
+        assert_plan_rejected_unchanged(
+            "error: phases.plan spawn requires --prompt-sha256",
+            "spawn", "--round", "0", "--engine", "claude",
+            "--model", "plan-test-model",
+        )
+        assert_plan_rejected_unchanged(
+            "error: phases.plan spawn requires --prompt-sha256",
+            "spawn", "--round", "0", "--engine", "claude",
+            "--model", "plan-test-model", "--prompt-sha256", "ABC",
+        )
+        assert_plan_rejected_unchanged(
+            "BLOCKED:plan-round-nonmonotonic: expected=0 supplied=1",
+            "spawn", "--round", "1", "--engine", "claude",
+            "--model", "plan-test-model", "--prompt-sha256", digest0,
+        )
+
+        result = plan_cli(*required_spawn)
+        assert result.returncode == 0, result.stderr
+        plan0 = read_state(state_path)["phases"]["plan"]
+        assert {field: plan0[field] for field in PLAN_SPAWN_RECEIPT_FIELDS} == {
+            "round": 0,
+            "started_at": plan0["started_at"],
+            "triggered_by": None,
+            "engine": "claude",
+            "model_requested": "plan-test-model",
+            "prompt_sha256": digest0,
+        }
+        result = plan_cli("complete", "--verdict", "NEEDS_WORK")
+        assert result.returncode == 0, result.stderr
+        completed0 = read_state(state_path)["phases"]["plan"]
+        assert all(field in completed0 for field in PLAN_RECEIPT_FIELDS)
+        assert completed0["model_effective"] is None
+        assert completed0["completed_at"] is not None
+        assert completed0["duration_ms"] >= 0
+        assert_plan_rejected_unchanged(
+            "BLOCKED:plan-round-nonmonotonic: expected=1 supplied=0",
+            "spawn", "--round", "0", "--triggered-by", "plan",
+            "--engine", "claude", "--model", "plan-test-model",
+            "--prompt-sha256", digest1,
+        )
+        assert_plan_rejected_unchanged(
+            "BLOCKED:plan-round-nonmonotonic: expected=1 supplied=2",
+            "spawn", "--round", "2", "--triggered-by", "plan",
+            "--engine", "claude", "--model", "plan-test-model",
+            "--prompt-sha256", digest1,
+        )
+        assert_plan_rejected_unchanged(
+            "error: phases.plan re-spawn requires --triggered-by",
+            "spawn", "--round", "1", "--engine", "claude",
+            "--model", "plan-test-model", "--prompt-sha256", digest1,
+        )
+        result = plan_cli(
+            "spawn", "--round", "1", "--triggered-by", "plan",
+            "--engine", "claude", "--model", "plan-test-model",
+            "--prompt-sha256", digest1,
+        )
+        assert result.returncode == 0, result.stderr
+        plan1 = read_state(state_path)["phases"]["plan"]
+        assert len(plan1["history"]) == 1
+        assert set(plan1["history"][0]) == set(PLAN_RECEIPT_FIELDS)
+        assert plan1["history"][0]["prompt_sha256"] == digest0
+        assert plan1["prompt_sha256"] == digest1
+        guard_error = (
+            "error: phases.plan complete with PASS or PASS_WITH_ISSUES requires "
+            "--phase plan transition --verdict <verdict> --next-phase <phase>"
+        )
+        assert_plan_rejected_unchanged(
+            guard_error, "complete", "--verdict", "PASS",
+        )
+        assert_plan_rejected_unchanged(
+            guard_error, "complete", "--verdict", "PASS_WITH_ISSUES",
+        )
+        result = plan_cli(
+            "transition", "--verdict", "PASS", "--next-phase", "implement",
+            "--next-round", "0", "--next-engine", "claude",
+        )
+        assert result.returncode == 0, result.stderr
+        for supplied_round in (0, 1, 2):
+            assert_plan_rejected_unchanged(
+                "BLOCKED:plan-respawn-exhausted",
+                "spawn", "--round", str(supplied_round),
+                "--triggered-by", "plan", "--engine", "claude",
+                "--model", "plan-test-model", "--prompt-sha256", digest1,
+            )
+        old_receipt = {
+            "started_at": "2026-01-01T00:00:00.000Z",
+            "verdict": "PASS",
+            "completed_at": "2026-01-01T00:00:01.000Z",
+            "duration_ms": 1000,
+        }
+        assert not is_plan_dispatch_receipt(old_receipt)
+        assert is_plan_dispatch_receipt(read_state(state_path)["phases"]["plan"])
+
+        # Iter-0112: schema-v3 PLAN output is an immutable authority receipt.
+        plan_output = devlyn / "plan.md"
+        plan_output.write_text("# Authorized plan\n- config/skills/x.py\n", encoding="utf-8")
+        write_state(state_path, {"version": "3.0", "phases": {}})
+        result = plan_cli(*required_spawn)
+        assert result.returncode == 0, result.stderr
+        result = plan_cli(
+            "transition", "--verdict", "PASS", "--next-phase", "implement",
+            "--next-round", "0", "--next-engine", "claude",
+        )
+        assert result.returncode == 0, result.stderr
+        sealed_plan_state = read_state(state_path)
+        assert sealed_plan_state["phases"]["plan"]["output_sha256"] == hashlib.sha256(
+            plan_output.read_bytes()
+        ).hexdigest()
+        plan_output.write_text(
+            "# Authorized plan\n- config/skills/x.py\n- unapproved.py\n",
+            encoding="utf-8",
+        )
+        before = state_path.read_bytes()
+        blocked_plan_mutation = subprocess.run(
+            [
+                sys.executable, script, "--devlyn-dir", str(devlyn),
+                "--phase", "build_gate", "spawn", "--round", "0",
+            ],
+            capture_output=True, text=True, check=False,
+        )
+        assert blocked_plan_mutation.returncode != 0
+        assert "BLOCKED:plan-integrity-mismatch" in blocked_plan_mutation.stderr
+        assert state_path.read_bytes() == before
+        assert_plan_rejected_unchanged(
+            "error: phases.plan already completed — respawn before completing again",
+            "complete", "--verdict", "NEEDS_WORK",
+        )
+        print("PASS iter-0112 PLAN output digest blocks mid-flight widening")
+
+        write_state(state_path, {
+            "phases": {
+                "plan": {
+                    "started_at": "2026-01-01T00:00:00.000Z",
+                    "completed_at": None,
+                    "duration_ms": None,
+                    "round": 0,
+                    "triggered_by": None,
+                    "verdict": None,
+                },
+                "implement": None,
+            }
+        })
+        result = plan_cli("complete", "--verdict", "BLOCKED")
+        assert result.returncode == 0, result.stderr
+        assert read_state(state_path)["phases"]["plan"]["verdict"] == "BLOCKED"
+        write_state(state_path, {
+            "phases": {
+                "plan": {
+                    "started_at": "2026-01-01T00:00:00.000Z",
+                    "completed_at": None,
+                    "duration_ms": None,
+                    "round": 0,
+                    "triggered_by": None,
+                    "verdict": None,
+                },
+                "implement": None,
+            }
+        })
+        result = plan_cli(
+            "complete", "--verdict", "PASS", "--engine-session-log",
+            str(devlyn / "missing-session.jsonl"),
+        )
+        assert result.returncode == 1, result.stderr
+        assert "BLOCKED:model-attestation-failed" in result.stderr
+        assert guard_error not in result.stderr
+        attestation_blocked = read_state(state_path)["phases"]["plan"]
+        assert attestation_blocked["verdict"] == "BLOCKED"
+        assert attestation_blocked["completed_at"] is not None
+        assert attestation_blocked["model_effective"] is None
+        legacy_state = {"phases": {"plan": old_receipt | {"round": 0}}}
+        write_state(state_path, legacy_state)
+        result = plan_cli(
+            "spawn", "--round", "1", "--triggered-by", "plan",
+            "--engine", "claude", "--model", "plan-test-model",
+            "--prompt-sha256", digest1,
+        )
+        assert result.returncode == 0, result.stderr
+        archived_legacy = read_state(state_path)["phases"]["plan"]["history"][0]
+        assert archived_legacy == old_receipt
+        print("PASS iter-0089 PLAN ledger: P-0089-1/2/6")
+
+        write_state(state_path, {"phases": {}})
+
         # Round 0: spawn -> complete.
         state = read_state(state_path)
         do_spawn(state, "implement", 0, None, None, "claude", None)
@@ -1430,15 +2449,552 @@ def self_test() -> int:
         write_state(state_path, state)
         final = read_state(state_path)["phases"]["implement"]
         assert final["verdict"] == "PASS"
+        assert read_state(state_path)["process_evidence"] is None
         assert parse_iso(final["started_at"]) == parse_iso(respawned["started_at"])
         assert parse_iso(final["completed_at"]) >= parse_iso(final["started_at"])
         assert final["artifacts"]["findings_file"] == ".devlyn/x.jsonl"
 
-        # complete() before spawn() must fail loudly, not silently invent data.
-        write_state(state_path, {"phases": {}})
-        state = read_state(state_path)
-        try:
-            do_complete(state, "build_gate", "PASS", None, None, None, None, None)
+        # Iter-0111 R2: successful IMPLEMENT completion and transition both
+        # validate declared evidence before any lifecycle mutation, then bind
+        # the exact manifest and stream digests into state. Legacy runs with no
+        # declaration remain legal through the null carrier asserted above.
+        evidence_work = devlyn / "process-evidence-state"
+        evidence_devlyn = evidence_work / ".devlyn"
+        evidence_spec_dir = evidence_work / "docs" / "evidence"
+        evidence_devlyn.mkdir(parents=True)
+        evidence_spec_dir.mkdir(parents=True)
+        (evidence_spec_dir / "spec.md").write_text("# Evidence fixture\n", encoding="utf-8")
+        (evidence_spec_dir / "spec.expected.json").write_text(json.dumps({
+            "verification_commands": [{"cmd": "printf build-gate"}],
+            "process_evidence": [{
+                "id": "red-first",
+                "phase": "implement",
+                "cmd": "printf red-before-fix >&2; exit 7",
+                "exit_code": 7,
+                "stdout_contains": ["red-before-fix"],
+            }],
+        }) + "\n", encoding="utf-8")
+        evidence_state = {
+            "run_id": "rs-state-evidence",
+            "source": {"type": "spec", "spec_path": "docs/evidence/spec.md"},
+            "phases": {"implement": None, "build_gate": None},
+        }
+        do_spawn(evidence_state, "implement", 0, None, None, "codex", None)
+        evidence_state_path = evidence_devlyn / "pipeline.state.json"
+        write_state(evidence_state_path, evidence_state)
+        evidence_script = str(pathlib.Path(__file__).resolve())
+
+        def evidence_state_cli(event: str, *event_args: str) -> subprocess.CompletedProcess[str]:
+            return subprocess.run(
+                [
+                    sys.executable, evidence_script, "--devlyn-dir", ".devlyn",
+                    "--phase", "implement", event, *event_args,
+                ],
+                cwd=evidence_work, capture_output=True, text=True, check=False,
+            )
+
+        for event_args in (
+            ("complete", "--verdict", "PASS"),
+            (
+                "transition", "--verdict", "PASS", "--next-phase", "build_gate",
+                "--next-round", "0",
+            ),
+        ):
+            before = evidence_state_path.read_bytes()
+            result = evidence_state_cli(event_args[0], *event_args[1:])
+            assert result.returncode != 0
+            assert "BLOCKED:process-evidence-invalid" in result.stderr
+            assert "missing" in result.stderr
+            assert evidence_state_path.read_bytes() == before
+
+        runner_script = str(pathlib.Path(__file__).with_name("process-evidence.py").resolve())
+        captured = subprocess.run(
+            [
+                sys.executable, runner_script, "--devlyn-dir", ".devlyn", "run",
+                "--phase", "implement", "--id", "red-first",
+            ],
+            cwd=evidence_work, capture_output=True, text=True, check=False,
+        )
+        assert captured.returncode == 0, captured.stderr
+        manifest_rel = loads_strict_json(captured.stdout)["manifest_path"]
+        manifest = evidence_work / manifest_rel
+        stderr_path = manifest.parent / "red-first.stderr"
+        original_stderr = stderr_path.read_bytes()
+        stderr_path.write_bytes(b"altered")
+        before = evidence_state_path.read_bytes()
+        altered = evidence_state_cli("complete", "--verdict", "PASS")
+        assert altered.returncode != 0
+        assert "digest or byte count mismatch" in altered.stderr
+        assert evidence_state_path.read_bytes() == before
+        stderr_path.write_bytes(original_stderr)
+        transitioned = evidence_state_cli(
+            "transition", "--verdict", "PASS", "--next-phase", "build_gate",
+            "--next-round", "0",
+        )
+        assert transitioned.returncode == 0, transitioned.stderr
+        sealed_state = read_state(evidence_state_path)
+        carrier = sealed_state["process_evidence"][0]
+        assert carrier["phase"] == "implement" and carrier["round"] == 0
+        assert carrier["manifest"]["path"] == manifest_rel
+        assert carrier["manifest"]["sha256"] == hashlib.sha256(manifest.read_bytes()).hexdigest()
+        assert sealed_state["phases"]["implement"]["verdict"] == "PASS"
+        assert sealed_state["phases"]["build_gate"]["started_at"] is not None
+        print("PASS iter-0111 process evidence: completion/transition gate and state digest binding")
+
+        # Gate-discovered iter-0111 regression: BUILD_GATE MECHANICAL emitted
+        # sealed process evidence, but completion left it outside the state
+        # binding and archive_run.py correctly rejected the orphaned files.
+        def build_gate_state_cli(
+            event: str, *event_args: str,
+        ) -> subprocess.CompletedProcess[str]:
+            return subprocess.run(
+                [
+                    sys.executable, evidence_script, "--devlyn-dir", ".devlyn",
+                    "--phase", "build_gate", event, *event_args,
+                ],
+                cwd=evidence_work, capture_output=True, text=True, check=False,
+            )
+
+        results_path = evidence_devlyn / "spec-verify.results.json"
+        results_path.write_text(json.dumps({
+            "commands": [{"pass": True}], "process_evidence": None,
+        }) + "\n", encoding="utf-8")
+        before = evidence_state_path.read_bytes()
+        missing = build_gate_state_cli("complete", "--verdict", "PASS")
+        assert missing.returncode != 0
+        assert "commands exist without a process-evidence carrier" in missing.stderr
+        assert evidence_state_path.read_bytes() == before
+        results_path.write_text(json.dumps({
+            "commands": [], "process_evidence": None,
+        }) + "\n", encoding="utf-8")
+        removed = build_gate_state_cli("complete", "--verdict", "PASS")
+        assert removed.returncode != 0
+        assert "required BUILD_GATE evidence has no process-evidence carrier" in removed.stderr
+        assert evidence_state_path.read_bytes() == before
+
+        runner = process_evidence_module()
+
+        def write_build_gate_results() -> dict:
+            current = read_state(evidence_state_path)
+            round_ = runner.phase_round(current, "build_gate")
+            obligation = runner.normalize_obligation({
+                "id": "verification-command-0001",
+                "phase": "build_gate",
+                "argv": [sys.executable, "-c", "print('sealed build gate')"],
+            })
+            relative = runner.manifest_relative_path(current, "build_gate")
+            runner.capture_process(
+                evidence_work, evidence_work / relative, current["run_id"],
+                "build_gate", round_, obligation,
+            )
+            build_carrier = runner.validate_manifest(
+                evidence_work, relative, current["run_id"], "build_gate", round_,
+                [obligation], require_expectations=False,
+            )
+            results_path.write_text(json.dumps({
+                "commands": runner.bound_carrier_summary_commands(
+                    evidence_work, build_carrier,
+                ),
+                "process_evidence": build_carrier,
+            }) + "\n", encoding="utf-8")
+            return build_carrier
+
+        build_carrier_0 = write_build_gate_results()
+        completed = build_gate_state_cli("complete", "--verdict", "PASS")
+        assert completed.returncode == 0, completed.stderr
+        completed_state = read_state(evidence_state_path)
+        assert completed_state["process_evidence"] == [carrier, build_carrier_0]
+
+        spawned = build_gate_state_cli(
+            "spawn", "--round", "1", "--triggered-by", "build_gate",
+        )
+        assert spawned.returncode == 0, spawned.stderr
+        build_carrier_1 = write_build_gate_results()
+        transitioned = build_gate_state_cli(
+            "transition", "--verdict", "PASS", "--next-phase", "cleanup",
+            "--next-round", "0",
+        )
+        assert transitioned.returncode == 0, transitioned.stderr
+        build_bound_state = read_state(evidence_state_path)
+        assert build_bound_state["process_evidence"] == [
+            carrier, build_carrier_0, build_carrier_1,
+        ]
+        assert build_bound_state["phases"]["cleanup"]["started_at"] is not None
+        print("PASS iter-0111 BUILD_GATE evidence: completion/transition state binding")
+
+        # Iter-0112 audit counterexample: a valid carrier previously authenticated
+        # bytes only, so a failed entry or capability denial could still be completed
+        # with caller-supplied PASS.
+        build_bound_state["phases"]["build_gate"] = None
+        do_spawn(build_bound_state, "build_gate", 2, "build_gate", None, None, None)
+        write_state(evidence_state_path, build_bound_state)
+        mismatch = runner.normalize_obligation({
+            "id": "verification-command-0001",
+            "phase": "build_gate",
+            "argv": [sys.executable, "-c", "raise SystemExit(7)"],
+        })
+        mismatch_rel = runner.manifest_relative_path(build_bound_state, "build_gate")
+        runner.capture_process(
+            evidence_work, evidence_work / mismatch_rel, build_bound_state["run_id"],
+            "build_gate", 2, mismatch,
+        )
+        mismatch_carrier = runner.validate_manifest(
+            evidence_work, mismatch_rel, build_bound_state["run_id"], "build_gate", 2,
+            [mismatch], require_expectations=False,
+        )
+        mismatch_commands = runner.bound_carrier_summary_commands(
+            evidence_work, mismatch_carrier,
+        )
+        mismatch_commands[0]["pass"] = True
+        results_path.write_text(json.dumps({
+            "commands": mismatch_commands, "process_evidence": mismatch_carrier,
+        }) + "\n", encoding="utf-8")
+        before = evidence_state_path.read_bytes()
+        laundered = build_gate_state_cli("complete", "--verdict", "PASS")
+        assert laundered.returncode != 0
+        assert "command 0 disagrees with sealed process evidence" in laundered.stderr
+        assert evidence_state_path.read_bytes() == before
+        results_path.write_text(json.dumps({
+            "commands": [], "process_evidence": None,
+        }) + "\n", encoding="utf-8")
+        removed_after_capture = build_gate_state_cli("complete", "--verdict", "PASS")
+        assert removed_after_capture.returncode != 0
+        assert "manifest exists without a process-evidence carrier" in removed_after_capture.stderr
+        assert evidence_state_path.read_bytes() == before
+        results_path.write_text(json.dumps({
+            "commands": runner.bound_carrier_summary_commands(
+                evidence_work, mismatch_carrier,
+            ),
+            "process_evidence": mismatch_carrier,
+        }) + "\n", encoding="utf-8")
+        failed = build_gate_state_cli("complete", "--verdict", "FAIL")
+        assert failed.returncode == 0, failed.stderr
+
+        failed_state = read_state(evidence_state_path)
+        do_spawn(failed_state, "build_gate", 3, "build_gate", None, None, None)
+        write_state(evidence_state_path, failed_state)
+        denied = runner.normalize_obligation({
+            "id": "verification-command-0001",
+            "phase": "build_gate",
+            "cmd": "python3 -m pytest",
+        })
+        denied_rel = runner.manifest_relative_path(failed_state, "build_gate")
+        runner.record_capability_denial(
+            evidence_work, evidence_work / denied_rel, failed_state["run_id"],
+            "build_gate", 3, denied, "subprocess", b"parent denied",
+        )
+        denied_carrier = runner.validate_manifest(
+            evidence_work, denied_rel, failed_state["run_id"], "build_gate", 3,
+            [denied], require_expectations=False,
+        )
+        denied_commands = runner.bound_carrier_summary_commands(
+            evidence_work, denied_carrier,
+        )
+        denied_commands[0]["pass"] = True
+        results_path.write_text(json.dumps({
+            "commands": denied_commands, "process_evidence": denied_carrier,
+        }) + "\n", encoding="utf-8")
+        before = evidence_state_path.read_bytes()
+        denial_laundered = build_gate_state_cli("complete", "--verdict", "PASS")
+        assert denial_laundered.returncode != 0
+        assert "command 0 disagrees with sealed process evidence" in denial_laundered.stderr
+        assert evidence_state_path.read_bytes() == before
+        results_path.write_text(json.dumps({
+            "commands": runner.bound_carrier_summary_commands(
+                evidence_work, denied_carrier,
+            ),
+            "process_evidence": denied_carrier,
+        }) + "\n", encoding="utf-8")
+        blocked = build_gate_state_cli("complete", "--verdict", "BLOCKED")
+        assert blocked.returncode == 0, blocked.stderr
+        print("PASS iter-0112 BUILD_GATE sealed outcome owns the verdict floor")
+
+        def test_interrupted_build_gate() -> None:
+            # Iter-0119 R1-R5: interrupted observations bind only to BLOCKED,
+            # without changing their bytes or bypassing archive/receipt guards.
+            work = (devlyn / "interrupted-build-gate").resolve()
+            active = work / ".devlyn"
+            active.mkdir(parents=True)
+            state_file = active / "pipeline.state.json"
+            summary = active / "spec-verify.results.json"
+            runner = process_evidence_module()
+            archive_spec = importlib.util.spec_from_file_location(
+                "interrupted_archive", pathlib.Path(__file__).with_name("archive_run.py"),
+            )
+            assert archive_spec is not None and archive_spec.loader is not None
+            archive = importlib.util.module_from_spec(archive_spec)
+            archive_spec.loader.exec_module(archive)
+            fixture = {
+                "version": "3.0", "run_id": "rs-interrupted-build-gate",
+                "source": {"type": "spec", "spec_path": "spec.md"},
+                "phases": {"build_gate": None, "final_report": None},
+                "process_evidence": None,
+            }
+            do_spawn(fixture, "build_gate", 0, None, None, "claude", None)
+            write_state(state_file, fixture)
+            open_bytes = state_file.read_bytes()
+            relative = runner.manifest_relative_path(fixture, "build_gate")
+            manifest = work / relative
+            obligations = [
+                runner.normalize_obligation({
+                    "id": f"verification-command-{index:04d}", "phase": "build_gate",
+                    "argv": [sys.executable, "-c", (
+                        "import os; os.write(1, b'observed\\x00\\xff\\n'); "
+                        f"os.write(2, b'diagnostic\\r\\n'); raise SystemExit({exit_code})"
+                    )],
+                })
+                for index, exit_code in enumerate((0, 7, 0), 1)
+            ]
+            (work / "spec.md").write_text("# Interrupted build fixture\n", encoding="utf-8")
+            (work / "spec.expected.json").write_text(json.dumps({
+                "process_evidence": obligations,
+            }), encoding="utf-8")
+            assert runner.declared_obligations(work, fixture, "build_gate") == obligations
+            for obligation in obligations[:2]:
+                runner.capture_process(
+                    work, manifest, fixture["run_id"], "build_gate", 0, obligation,
+                )
+            manifest_bytes = manifest.read_bytes()
+            document = loads_strict_json(manifest_bytes.decode("utf-8"))
+            assert [entry["expectation_met"] for entry in document["entries"]] == [True, False]
+            assert [entry["outcome"] for entry in document["entries"]] == [
+                {"kind": "exit", "exit_code": code, "signal": None} for code in (0, 7)
+            ]
+            observed = {path: path.read_bytes() for path in manifest.parent.iterdir()}
+            assert set(observed) == {manifest} | {
+                manifest.parent / f"verification-command-{index:04d}.{stream}"
+                for index in (1, 2) for stream in ("stdout", "stderr")
+            }
+            carrier = runner.validate_manifest(
+                work, relative, fixture["run_id"], "build_gate", 0,
+                require_expectations=False,
+            )
+            cli_env = {key: value for key, value in os.environ.items()
+                       if not key.startswith("DEVLYN_INVOCATION_")}
+            cli_env["PYTHONDONTWRITEBYTECODE"] = "1"
+
+            def cli(*args: str) -> subprocess.CompletedProcess[str]:
+                return subprocess.run(
+                    [sys.executable, str(pathlib.Path(__file__).resolve()),
+                     "--devlyn-dir", ".devlyn", "--phase", "build_gate", *args],
+                    cwd=work, env=cli_env, capture_output=True, text=True, check=False,
+                )
+
+            def rejected(*args: str, error: str = "BLOCKED:process-evidence-invalid") -> None:
+                before = state_file.read_bytes()
+                result = cli(*args)
+                assert result.returncode != 0, result.stdout
+                assert error in result.stderr, result.stderr
+                assert state_file.read_bytes() == before
+
+            def archived(state: dict) -> None:
+                paths = archive.dynamic_evidence_artifacts(active, state)
+                assert set(paths) == set(observed)
+                assert {path: path.read_bytes() for path in paths} == observed
+                assert {path: path.read_bytes() for path in manifest.parent.iterdir()} == observed
+
+            def terminal() -> dict:
+                state = read_state(state_file)
+                entry = state["phases"]["build_gate"]
+                assert entry["verdict"] == "BLOCKED"
+                assert entry["completed_at"] is not None and entry["duration_ms"] >= 0
+                assert entry["model_effective"] is None
+                assert entry.get("invocation_receipt") is None
+                assert state["phases"]["final_report"] is None
+                assert state["process_evidence"] == [carrier]
+                assert not summary.exists() and not summary.is_symlink()
+                archived(state)
+                return state
+
+            completed = cli("complete", "--verdict", "BLOCKED")
+            assert completed.returncode == 0, completed.stderr
+            bound = terminal()
+            print("PASS iter-0119 absent-summary BLOCKED persists exact five-file evidence")
+
+            for control in ("unbound", "tampered", "manifest", "binding", "malformed", "duplicate"):
+                candidate = copy.deepcopy(bound)
+                extra = manifest.parent / "unexpected.stdout"
+                stream = manifest.parent / "verification-command-0001.stdout"
+                if control == "unbound":
+                    extra.write_bytes(b"unbound")
+                elif control == "tampered":
+                    stream.write_bytes(b"tampered")
+                elif control == "manifest":
+                    manifest.write_text("{", encoding="utf-8")
+                elif control == "malformed":
+                    candidate["process_evidence"] = [{}]
+                elif control == "duplicate":
+                    candidate["process_evidence"].append(copy.deepcopy(carrier))
+                else:
+                    candidate["process_evidence"][0]["manifest"]["sha256"] = "0" * 64
+                try:
+                    archive.dynamic_evidence_artifacts(active, candidate)
+                except archive.ArchiveError as exc:
+                    if control == "duplicate":
+                        assert "duplicate state-bound process-evidence" in str(exc), str(exc)
+                    else:
+                        assert ("unbound process-evidence" if control == "unbound" else
+                                "invalid bound process evidence") in str(exc), str(exc)
+                else:
+                    raise AssertionError(f"archive accepted {control}")
+                extra.unlink(missing_ok=True)
+                stream.write_bytes(observed[stream])
+                manifest.write_bytes(manifest_bytes)
+            archived(bound)
+
+            state_file.write_bytes(open_bytes)
+            for verdict in ("PASS", "PASS_WITH_ISSUES", "NEEDS_WORK", "FAIL"):
+                rejected("complete", "--verdict", verdict, error="spec-verify.results.json is missing")
+            rejected("complete", error="spec-verify.results.json is missing")
+            manifest.unlink()
+            rejected("complete", "--verdict", "BLOCKED")
+            manifest.write_text("{", encoding="utf-8")
+            rejected("complete", "--verdict", "BLOCKED")
+            for control in ("run_id", "phase", "round", "expectation", "expectation_met",
+                            "duplicate", "path", "bytes", "sha256"):
+                altered = copy.deepcopy(document)
+                entry = altered["entries"][1]
+                if control in {"run_id", "phase", "round"}:
+                    altered[control] = {"run_id": "rs-wrong", "phase": "implement", "round": 1}[control]
+                elif control == "expectation":
+                    entry["expectation"]["exit_code"] = "zero"
+                elif control == "expectation_met":
+                    entry[control] = True
+                elif control == "duplicate":
+                    altered["entries"].append(copy.deepcopy(entry))
+                else:
+                    entry["stdout"][control] = {
+                        "path": "../escaped.stdout", "bytes": entry["stdout"]["bytes"] + 1,
+                        "sha256": "0" * 64,
+                    }[control]
+                manifest.write_text(json.dumps(altered), encoding="utf-8")
+                rejected("complete", "--verdict", "BLOCKED")
+            manifest.write_bytes(manifest_bytes)
+            stream = manifest.parent / "verification-command-0001.stdout"
+            stream.write_bytes(b"tampered")
+            rejected("complete", "--verdict", "BLOCKED")
+            stream.write_bytes(observed[stream])
+            outside = devlyn / "escaped-evidence"
+            for path in (manifest, manifest.parent / "verification-command-0001.stdout"):
+                outside.write_bytes(observed[path])
+                path.unlink()
+                path.symlink_to(outside)
+                rejected("complete", "--verdict", "BLOCKED")
+                path.unlink()
+                path.write_bytes(observed[path])
+            bad_prior = copy.deepcopy(carrier)
+            bad_prior["manifest"]["sha256"] = "0" * 64
+            for invalid, error in (
+                ({}, "state.process_evidence must be null or an array"),
+                ([{}], "state process-evidence carrier has an invalid shape"),
+                ([bad_prior], "bound process evidence manifest digest mismatch"),
+                ([carrier], "duplicate state carrier"),
+            ):
+                candidate = copy.deepcopy(fixture)
+                candidate["process_evidence"] = invalid
+                write_state(state_file, candidate)
+                rejected("complete", "--verdict", "BLOCKED", error=error)
+            state_file.write_bytes(open_bytes)
+
+            commands = runner.bound_carrier_summary_commands(work, carrier)
+            wrong_commands = copy.deepcopy(commands)
+            wrong_commands[1]["pass"] = True
+            wrong_carrier = copy.deepcopy(carrier)
+            wrong_carrier["round"] = 1
+            for content in (
+                "{", "[]", json.dumps({"commands": {}}),
+                json.dumps({"commands": commands, "process_evidence": None}),
+                json.dumps({"commands": commands, "process_evidence": wrong_carrier}),
+                json.dumps({"commands": wrong_commands, "process_evidence": carrier}),
+            ):
+                summary.write_text(content, encoding="utf-8")
+                rejected("complete", "--verdict", "BLOCKED")
+            summary.unlink()
+            summary.mkdir()
+            rejected("complete", "--verdict", "BLOCKED")
+            summary.rmdir()
+            summary.symlink_to(active / "absent-summary")
+            rejected("complete", "--verdict", "BLOCKED")
+            summary.unlink()
+            # A valid summary symlink retains the existing outcome floor.
+            target = devlyn / "valid-summary.json"
+            target.write_text(json.dumps({
+                "commands": commands, "process_evidence": carrier,
+            }), encoding="utf-8")
+            summary.symlink_to(target)
+            for verdict in ("PASS", "PASS_WITH_ISSUES"):
+                rejected("complete", "--verdict", verdict, error="mismatch cannot complete")
+            completed = cli("complete", "--verdict", "FAIL")
+            assert completed.returncode == 0, completed.stderr
+            summarized = read_state(state_file)
+            assert summarized["phases"]["build_gate"]["verdict"] == "FAIL"
+            assert summarized["process_evidence"] == [carrier]
+            archived(summarized)
+            summary.unlink()
+            print("PASS iter-0119 ineligible verdicts, invalid summaries and integrity controls preserve state")
+
+            # Valid nonzero receipt: transition stays atomic; standalone
+            # completion persists BLOCKED before reporting the receipt error.
+            prompt = active / "build_gate.prompt.0"
+            prompt.write_text("inspect interrupted build\n", encoding="utf-8")
+            session = active / "build_gate.worker-session.0.jsonl"
+            session.write_text('{"type":"thread.started"}\n', encoding="utf-8")
+            receipt = active / "build_gate.invocation.0.json"
+            model = "gpt-5.6-sol"
+            candidate = copy.deepcopy(fixture)
+            candidate["phases"]["build_gate"].update({
+                "engine": "codex", "model_requested": model,
+                "prompt_sha256": hashlib.sha256(prompt.read_bytes()).hexdigest(),
+            })
+            write_state(state_file, candidate)
+            receipts = invocation_receipt_module()
+            receipts.start_receipt(
+                work, receipt, fixture["run_id"], "build_gate", 0, str(prompt), str(session),
+                ["--json", "-C", str(work), "-s", "workspace-write", "-m", model,
+                 "-c", "sandbox_workspace_write.network_access=true", "inspect interrupted build"],
+            )
+            receipts.finish_receipt(work, receipt, 7)
+            receipt_bytes = receipt.read_bytes()
+            error = "BLOCKED:invocation-receipt-invalid: Codex invocation exited 7"
+            rejected(
+                "transition", "--verdict", "BLOCKED", "--engine-session-log", str(session),
+                "--next-phase", "final_report", "--next-round", "0", error=error,
+            )
+            completed = cli(
+                "complete", "--verdict", "BLOCKED", "--engine-session-log", str(session),
+            )
+            assert completed.returncode == 1, completed.stdout
+            assert completed.stderr.strip() == error, completed.stderr
+            terminal()
+            assert receipt.read_bytes() == receipt_bytes
+            print("PASS iter-0119 nonzero receipt persists BLOCKED before exit1; transition stays atomic")
+
+            candidate = copy.deepcopy(bound)
+            do_spawn(candidate, "build_gate", 1, None, None, "claude", None)
+            write_state(state_file, candidate)
+            next_relative = runner.manifest_relative_path(candidate, "build_gate")
+            runner.capture_process(
+                work, work / next_relative, fixture["run_id"], "build_gate", 1, obligations[0],
+            )
+            next_carrier = runner.validate_manifest(
+                work, next_relative, fixture["run_id"], "build_gate", 1,
+                require_expectations=False,
+            )
+            completed = cli("complete", "--verdict", "BLOCKED")
+            assert completed.returncode == 0, completed.stderr
+            appended = read_state(state_file)
+            assert appended["process_evidence"] == [carrier, next_carrier]
+            assert appended["phases"]["build_gate"]["verdict"] == "BLOCKED"
+            assert {path: path.read_bytes() for path in observed} == observed
+            assert set(observed).issubset(archive.dynamic_evidence_artifacts(active, appended))
+
+        test_interrupted_build_gate()
+
+        # complete() before spawn() must fail loudly, not silently invent data.
+        write_state(state_path, {"phases": {}})
+        state = read_state(state_path)
+        try:
+            do_complete(state, "build_gate", "PASS", None, None, None, None, None)
         except SystemExit as e:
             assert "never spawned" in str(e)
         else:
@@ -1505,7 +3061,9 @@ def self_test() -> int:
         attestation_state = copy.deepcopy(transition_state)
         attestation_state["phases"]["plan"]["model_requested"] = "wanted-model"
         attestation_log = devlyn / "transition-attestation.log"
-        attestation_log.write_text("model: other-model\n", encoding="utf-8")
+        attestation_log.write_text(json.dumps({
+            "modelUsage": {"other-model": {"inputTokens": 1}},
+        }) + "\n", encoding="utf-8")
         write_state(state_path, attestation_state)
         attestation_before = state_path.read_bytes()
         try:
@@ -1657,7 +3215,10 @@ def self_test() -> int:
         # flow does.
         write_state(state_path, {"phases": {}})
         state = read_state(state_path)
-        do_spawn(state, "plan", 0, None, None, None, None)
+        do_spawn(
+            state, "plan", 0, None, None, "claude", "plan-test-model",
+            prompt_sha256=digest0,
+        )
         write_state(state_path, state)
         state = read_state(state_path)
         try:
@@ -1693,8 +3254,11 @@ def self_test() -> int:
             "verify-merge.summary.json",
             "codex-judge.stdout",
             "claude-judge.stdout",
+            "claude-judge.stderr",
+            "pair-judge.summary.json",
         ):
             (devlyn / name).write_text("stale\n", encoding="utf-8")
+        (devlyn / "codex-primary-judge.prompt.md").write_text("current\n", encoding="utf-8")
         (devlyn / "spec-verify.json").write_text("{}", encoding="utf-8")
         clear_verify_round_artifacts(devlyn)
         for name in (
@@ -1705,8 +3269,11 @@ def self_test() -> int:
             "verify-merge.summary.json",
             "codex-judge.stdout",
             "claude-judge.stdout",
+            "claude-judge.stderr",
+            "pair-judge.summary.json",
         ):
             assert not (devlyn / name).exists(), f"{name} must be cleared on VERIFY spawn"
+        assert (devlyn / "codex-primary-judge.prompt.md").exists(), "judge prompts must survive VERIFY spawn"
         assert (devlyn / "spec-verify.json").exists(), "non-VERIFY-round files must survive"
 
         # Fix-loop respawn of phase-gated IMPLEMENT must preserve `exec`
@@ -1782,14 +3349,24 @@ def self_test() -> int:
         subprocess.run(["git", "config", "user.name", "self-test"], cwd=work, check=True)
         (work / "allowed.txt").write_text("base\n", encoding="utf-8")
         (work / "blocked.txt").write_text("base\n", encoding="utf-8")
+        (work / "blocked:literal.txt:1").write_text("base\n", encoding="utf-8")
+        (work / "blocked:raw.txt").write_text("base\n", encoding="utf-8")
+        (work / "branchbase").write_text("line\n" * 10, encoding="utf-8")
+        (work / "branchbase:7").write_text("base\n", encoding="utf-8")
+        (work / "branchbase:dir").mkdir()
+        (work / "branchbase:dir" / "marker").write_text("base\n", encoding="utf-8")
+        (work / "exact:1").write_text("base\n", encoding="utf-8")
         (work / "schedule").mkdir()
         (work / "schedule" / "__init__.py").write_text("line\n" * 700, encoding="utf-8")
         (work / "test_schedule.py").write_text("line\n", encoding="utf-8")
         (work / "tests").mkdir()
         (work / "tests" / "cli.test.js").write_text("line\n" * 170, encoding="utf-8")
+        (work / "tests" / "literal:1-3").write_text("line\n", encoding="utf-8")
         subprocess.run(
-            ["git", "add", "--", "allowed.txt", "blocked.txt", "schedule/__init__.py",
-             "test_schedule.py", "tests/cli.test.js"],
+            ["git", "add", "--", "allowed.txt", "blocked.txt", "blocked:literal.txt:1",
+             "blocked:raw.txt", "branchbase", "branchbase:7", "branchbase:dir/marker",
+             "exact:1", "schedule/__init__.py", "test_schedule.py", "tests/cli.test.js",
+             "tests/literal:1-3"],
             cwd=work, check=True,
         )
         subprocess.run(["git", "commit", "-qm", "base"], cwd=work, check=True)
@@ -1825,18 +3402,26 @@ def self_test() -> int:
             else:
                 raise AssertionError("SURFACE_CLOSE accepted a non-Claude engine")
             assert rejected_state == {"sentinel": True}
-        rejected_state = {"sentinel": True}
-        try:
-            do_spawn(
-                rejected_state, "surface_close", 0, None, pre_sha, "claude", None,
-                input_patch_sha256=file_sha256(patch), prompt_sha256=file_sha256(prompt),
-                untracked_before=["kept.txt"],
-            )
-        except SystemExit as exc:
-            assert "phases.surface_close spawn requires --model" in str(exc)
-        else:
-            raise AssertionError("SURFACE_CLOSE accepted a missing requested model")
-        assert rejected_state == {"sentinel": True}
+        for blank_model in ("", " ", " sonnet"):
+            rejected_state = {"sentinel": True}
+            try:
+                do_spawn(
+                    rejected_state, "surface_close", 0, None, pre_sha, "claude", blank_model,
+                    input_patch_sha256=file_sha256(patch), prompt_sha256=file_sha256(prompt),
+                    untracked_before=["kept.txt"],
+                )
+            except SystemExit as exc:
+                assert "explicit --model must be a nonempty exact string" in str(exc)
+            else:
+                raise AssertionError("SURFACE_CLOSE accepted an invalid requested model")
+            assert rejected_state == {"sentinel": True}
+        inherited_surface = {**copy.deepcopy(surface_state), "version": "3.0"}
+        do_spawn(
+            inherited_surface, "surface_close", 0, None, pre_sha, "claude", None,
+            input_patch_sha256=file_sha256(patch), prompt_sha256=file_sha256(prompt),
+            untracked_before=["kept.txt"],
+        )
+        assert inherited_surface["phases"]["surface_close"]["model_requested"] is None
         do_spawn(
             surface_state, "surface_close", 0, None, pre_sha, "claude", "sonnet",
             input_patch_sha256=file_sha256(patch), prompt_sha256=file_sha256(prompt),
@@ -1845,9 +3430,89 @@ def self_test() -> int:
         validate_surface_inputs(work, work_devlyn, surface_state)
         validate_surface_prompt(work_devlyn, surface_state)
         ensure_surface_clean_baseline(work, work_devlyn, surface_state)
+        (work_devlyn / "pipeline.state.json").write_text(
+            json.dumps(surface_state), encoding="utf-8",
+        )
+        for entry in ("src/{a,b", "src/{a,}/**", "src/{a,{b,c}}", "src/{a,**}"):
+            surface_check = subprocess.run(
+                [
+                    sys.executable, str(pathlib.Path(__file__).resolve()),
+                    "--devlyn-dir", ".devlyn", "--phase", "surface_close", "surface-check",
+                    "--authorized-surface-json", json.dumps([entry]),
+                ],
+                cwd=work, capture_output=True, text=True,
+            )
+            if (
+                surface_check.returncode == 0
+                or "error: unsupported brace glob" not in surface_check.stderr
+                or "supported form" not in surface_check.stderr
+                or "Traceback" in surface_check.stderr
+            ):
+                raise AssertionError(f"surface-check did not fail closed for {entry}: {surface_check.stderr}")
         surface = validate_authorized_surface(
-            '["allowed.txt", "schedule/**", "test_schedule.py", "tests/**"]'
+            '["allowed.txt", "branchbase", "exact-link", "exact:1", "schedule/**", '
+            '"test_schedule.py", "tests/**", "x.ts"]'
         )
+        assert path_matches_surface("src/a/example.py", ["src/{a,b}/**"])
+        assert path_matches_surface("src/b/example.py", ["src/{a,b}/**"])
+        assert not path_matches_surface("src/c/example.py", ["src/{a,b}/**"])
+        for entry in ("src/{a,b", "src/{a,}/**", "src/{a,{b,c}}", "src/{a,**}"):
+            try:
+                validate_authorized_surface(json.dumps([entry]))
+            except SystemExit as exc:
+                assert str(exc).startswith("error: unsupported brace glob") and "supported form" in str(exc)
+            else:
+                raise AssertionError(f"malformed brace glob passed validation: {entry}")
+            try:
+                path_matches_surface("src/a/example.py", [entry])
+            except ValueError as exc:
+                assert entry in str(exc) and "supported form" in str(exc)
+            else:
+                raise AssertionError(f"malformed brace glob accepted: {entry}")
+        outside = devlyn / "outside.txt"
+        outside.write_text("outside\n", encoding="utf-8")
+        (work / "outside-link").symlink_to(outside)
+        assert worktree_file_exists(work, "allowed.txt")
+        assert not worktree_file_exists(work, str(outside))
+        assert not worktree_file_exists(work, "../outside.txt")
+        assert not worktree_file_exists(work, "outside-link")
+        assert worktree_path_exists(work, "branchbase:dir")
+        assert not worktree_path_exists(work, str(outside))
+        assert not worktree_path_exists(work, "../outside.txt")
+        assert not worktree_path_exists(work, "outside-link")
+        (work / "outside-link").unlink()
+        for link, target in (
+            ("exact-link", "allowed.txt"),
+            ("tests/inside-link", "cli.test.js"),
+        ):
+            (work / link).symlink_to(target)
+            output = work_devlyn / "surface-close.stdout"
+            output.write_text(
+                f"UVR-STALE: N/A {link} — contained symlink\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                encoding="utf-8",
+            )
+            validate_surface_adjudication(
+                work, work_devlyn, surface_state, surface,
+            )
+            (work / link).unlink()
+        for link in ("exact-link", "tests/outside-link"):
+            (work / link).symlink_to(outside)
+            output = work_devlyn / "surface-close.stdout"
+            output.write_text(
+                f"UVR-STALE: N/A {link} — escaping symlink\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                encoding="utf-8",
+            )
+            try:
+                validate_surface_adjudication(
+                    work, work_devlyn, surface_state, surface,
+                )
+            except SystemExit as exc:
+                assert "citation-missing" in str(exc), (link, exc)
+            else:
+                raise AssertionError(f"SURFACE_CLOSE followed escaping symlink: {link}")
+            (work / link).unlink()
         entry = surface_entry(surface_state)
         assert entry["prompt_sha256"] == file_sha256(prompt)
         assert entry["model_requested"] == "sonnet"
@@ -1873,6 +3538,18 @@ def self_test() -> int:
             encoding="utf-8",
         )
         validate_surface_adjudication(work, work_devlyn, surface_state, surface)
+        output.write_text(
+            "UVR-STALE: N/A exact:1 — exact colon path is unchanged\n"
+            "PATH-TEST: N/A exact:1:1 — exact colon path line is covered\nPASS\n",
+            encoding="utf-8",
+        )
+        validate_surface_adjudication(work, work_devlyn, surface_state, surface)
+        output.write_text(
+            "UVR-STALE: N/A tests/literal:1-3 — literal range-shaped path is unchanged\n"
+            "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+            encoding="utf-8",
+        )
+        validate_surface_adjudication(work, work_devlyn, surface_state, surface)
 
         output.write_text(
             "PATH-TEST review confirms every success/failure path the goal specifies (chaining in both positions, exact-nth-run cancellation via both `run_pending()` and `run_all()`, first-limit-wins with `.until()` in both directions, `next_run`/`idle_seconds` reflecting removal, validation errors, repeated-call override, per-job independence) is already covered by the added tests — no gap found.\n\n"
@@ -1924,6 +3601,81 @@ def self_test() -> int:
                 "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
                 "citation-missing",
             ),
+            (
+                "UVR-STALE: N/A allowed.txt:49-73,223-235,293-295 — production range citation\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "adjudication-malformed",
+            ),
+            (
+                "UVR-STALE: N/A allowed.txt:1, allowed.txt:1 — production list citation\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "adjudication-malformed",
+            ),
+            (
+                "UVR-STALE: N/A tests/cli.test.js:1-3 — glob range citation\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "adjudication-malformed",
+            ),
+            (
+                "UVR-STALE: N/A x.ts:12:34 — doubled line citation\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "adjudication-malformed",
+            ),
+            (
+                "UVR-STALE: N/A allowed.txt:0 — zero line citation\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "adjudication-malformed",
+            ),
+            (
+                "UVR-STALE: N/A allowed.txt:012 — leading-zero line citation\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "adjudication-malformed",
+            ),
+            (
+                "UVR-STALE: N/A allowed.txt: — empty line citation\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "adjudication-malformed",
+            ),
+            (
+                "UVR-STALE: N/A blocked.txt:1 — blocked parsed path\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "out-of-surface",
+            ),
+            (
+                "UVR-STALE: N/A blocked.txt:1-3 — blocked range citation\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "out-of-surface",
+            ),
+            (
+                "UVR-STALE: N/A blocked:literal.txt:1 — blocked raw colon path\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "out-of-surface",
+            ),
+            (
+                "UVR-STALE: N/A blocked:raw.txt:1 — blocked parsed colon path\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "out-of-surface",
+            ),
+            (
+                "UVR-STALE: N/A branchbase:7 — existing unauthorized raw path\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "out-of-surface",
+            ),
+            (
+                "UVR-STALE: N/A branchbase:dir:1 — existing unauthorized parsed directory\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "out-of-surface",
+            ),
+            (
+                "UVR-STALE: N/A tests/../blocked.txt:1 — wildcard traversal\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "out-of-surface",
+            ),
+            (
+                "UVR-STALE: N/A tests/ghost.txt:1 — nonexistent glob descendant\n"
+                "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+                "citation-missing",
+            ),
         )
         for raw_output, marker in rejected_outputs:
             output.write_text(raw_output, encoding="utf-8")
@@ -1934,6 +3686,14 @@ def self_test() -> int:
             else:
                 raise AssertionError(f"SURFACE_CLOSE accepted invalid adjudication: {marker}")
 
+        output.write_text(
+            "UVR-STALE: N/A allowed.txt:49-73,223-235,293-295 — production range citation\n"
+            "PATH-TEST: FIRED allowed.txt:1\nPASS\n",
+            encoding="utf-8",
+        )
+        require_surface_adjudication_malformed(
+            work, work_devlyn, surface_state, surface,
+        )
         output.write_text(
             "UVR-STALE: N/A allowed.txt:1 — no stale interface text\n"
             "PATH-TEST: N/A allowed.txt:1 — requested path already covered\nPASS\n",
@@ -2006,6 +3766,78 @@ def self_test() -> int:
         assert completed_surface["model_effective"] == "sonnet"
         assert completed_surface["verdict"] == "PASS"
 
+        inherited_completion = copy.deepcopy(inherited_surface)
+        assert do_complete(
+            inherited_completion, "surface_close", "PASS", pre_sha, None, None,
+            None, None, str(wrapper_log), devlyn=work_devlyn,
+        ) is None
+        assert inherited_completion["phases"]["surface_close"]["model_requested"] is None
+        assert inherited_completion["phases"]["surface_close"]["model_effective"] == "sonnet"
+        replacement = copy.deepcopy(inherited_surface)
+        try:
+            do_complete(replacement, "surface_close", "PASS", None, None, None,
+                        None, "sonnet", str(wrapper_log), devlyn=work_devlyn)
+        except SystemExit as exc:
+            assert "cannot replace requested model" in str(exc)
+        else:
+            raise AssertionError("completion replaced inherited model selection")
+        assert replacement == inherited_surface
+
+        native_json = wrapper_log.read_bytes()
+        transcript_bytes = transcript.read_bytes()
+        foreign_log = work_devlyn / "foreign.output.json"
+        foreign_log.write_bytes(native_json)
+        for retained in (False, True):
+            if retained:
+                transcript.write_bytes(transcript_bytes)
+            else:
+                transcript.unlink()
+            for log in (None, str(foreign_log)):
+                rejected = copy.deepcopy(inherited_surface)
+                error = do_complete(rejected, "surface_close", "PASS", None, None, None,
+                                    None, None, log, devlyn=work_devlyn)
+                assert error and "canonical native JSON" in error
+                assert rejected["phases"]["surface_close"]["verdict"] == "BLOCKED"
+        for invalid_json in (
+            b"not JSON", b'{"result":"PASS"}',
+            b'{"modelUsage":{"model-a":{},"model-b":{}}}',
+            b'{"type":"turn_context","payload":{"model":"sonnet"}}\n',
+        ):
+            wrapper_log.write_bytes(invalid_json)
+            rejected = copy.deepcopy(inherited_surface)
+            assert do_complete(rejected, "surface_close", "PASS", None, None, None,
+                               None, None, str(wrapper_log), devlyn=work_devlyn)
+            assert rejected["phases"]["surface_close"]["verdict"] == "BLOCKED"
+        alias_log = work_devlyn / "aliased-native.jsonl"
+        alias_log.symlink_to(wrapper_log)
+        rejected = copy.deepcopy(inherited_surface)
+        assert do_complete(rejected, "surface_close", "PASS", None, None, None,
+                           None, None, str(alias_log), devlyn=work_devlyn)
+        wrapper_log.unlink()
+        rejected = copy.deepcopy(inherited_surface)
+        assert do_complete(rejected, "surface_close", "PASS", None, None, None,
+                           None, None, str(wrapper_log), devlyn=work_devlyn)
+        recovery_failure = copy.deepcopy(inherited_surface)
+        assert do_surface_adjudication_recovery(recovery_failure, work_devlyn)
+        assert recovery_failure["phases"]["surface_close"]["verdict"] == "BLOCKED"
+        assert not recovery_failure["phases"]["surface_close"].get("continued_after_block")
+        transition_state = copy.deepcopy(inherited_surface)
+        try:
+            do_transition(transition_state, "surface_close", "build_gate", "PASS", pre_sha,
+                          None, None, None, None, None, work_devlyn, 0, None, None, "claude", None)
+        except SystemExit as exc:
+            assert "canonical native JSON" in str(exc)
+        else:
+            raise AssertionError("SURFACE_CLOSE opened BUILD_GATE without native evidence")
+        assert transition_state == inherited_surface
+        wrapper_log.write_text('{"modelUsage":{"different-model":{"inputTokens":1}}}\n')
+        mismatch = copy.deepcopy(surface_state)
+        assert "model-attestation-mismatch" in do_complete(
+            mismatch, "surface_close", "PASS", None, None, None, None, None,
+            str(wrapper_log), devlyn=work_devlyn,
+        )
+        wrapper_log.write_bytes(native_json)
+
         recovery_state = loads_strict_json(json.dumps(surface_state))
         recovery_started_at = recovery_state["phases"]["surface_close"]["started_at"]
         output.write_text("UVR-STALE: FIRED allowed.txt:1\nPASS\n", encoding="utf-8")
@@ -2059,20 +3891,178 @@ def self_test() -> int:
         assert skipped["verdict"] is None
         assert skipped["skipped_reason"] == SURFACE_SKIP_REASON
 
-        # Effective model evidence: engine header line and rollout JSONL.
+        # Effective model evidence: handwritten headers are not provenance;
+        # canonical rollout JSONL and Claude wrapper output remain accepted.
         header_log = devlyn / "codex-build.log"
         header_log.write_text("session\nmodel: gpt-5.6-sol\n", encoding="utf-8")
-        assert parse_effective_model(header_log) == "gpt-5.6-sol"
+        try:
+            parse_effective_model(header_log)
+        except ValueError as exc:
+            assert "no effective-model evidence" in str(exc)
+        else:
+            raise AssertionError("plaintext model header was accepted as provenance")
         rollout_log = devlyn / "rollout.jsonl"
         rollout_log.write_text(json.dumps({
             "type": "turn_context", "payload": {"model": "gpt-5.6-terra"},
         }) + "\n", encoding="utf-8")
         assert parse_effective_model(rollout_log) == "gpt-5.6-terra"
         claude_log = devlyn / "claude-result.json"
-        claude_log.write_text(json.dumps({
-            "modelUsage": {"claude-alpha-1": {"inputTokens": 1}},
-        }) + "\n", encoding="utf-8")
-        assert parse_effective_model(claude_log) == "claude-alpha-1"
+
+        def claude_wrapper(primary_usage, entries):
+            wrapper = {"modelUsage": {}}
+            if primary_usage is not None:
+                wrapper["usage"] = dict(zip((
+                    "input_tokens", "output_tokens", "cache_read_input_tokens",
+                    "cache_creation_input_tokens",
+                ), primary_usage))
+            for model, entry_usage, metadata in entries:
+                entry = dict(zip((
+                    "inputTokens", "outputTokens", "cacheReadInputTokens",
+                    "cacheCreationInputTokens",
+                ), entry_usage))
+                entry.update(metadata)
+                wrapper["modelUsage"][model] = entry
+            return wrapper
+
+        oversized_counter = 10 ** 400
+        claude_selector_rows = (
+            (
+                "singleton",
+                {"modelUsage": {"claude-alpha-1": {"inputTokens": 1}}},
+                "claude-alpha-1",
+            ),
+            (
+                "opus-primary",
+                claude_wrapper(
+                    (2854, 9927, 1095180, 73889),
+                    (
+                        ("claude-" "haiku-4-5-20251001", (4106, 14, 0, 0), {
+                            "costUSD": 0.004176,
+                        }),
+                        ("claude-" "opus-5[1m]", (2854, 9927, 1095180, 73889), {
+                            "costUSD": 1.5489249999999999,
+                            "canonicalModel": "claude-" "opus-5",
+                        }),
+                    ),
+                ),
+                "claude-" "opus-5[1m]",
+            ),
+            (
+                "fable-primary",
+                claude_wrapper(
+                    (8068, 26740, 403950, 76656),
+                    (
+                        ("claude-" "haiku-4-5-20251001", (2246, 22, 0, 0), {
+                            "costUSD": 0.002356,
+                        }),
+                        ("claude-" "fable-5", (8068, 26740, 403950, 76656), {
+                            "costUSD": 3.35475,
+                            "canonicalModel": "claude-" "fable-5",
+                        }),
+                    ),
+                ),
+                "claude-" "fable-5",
+            ),
+            (
+                "rank-confound",
+                claude_wrapper(
+                    (3, 5, 7, 11),
+                    (
+                        ("larger-auxiliary", (300000, 500000, 700000, 1100000), {
+                            "costUSD": 999.0,
+                        }),
+                        ("expected-primary", (3, 5, 7, 11), {"costUSD": 0.01}),
+                    ),
+                ),
+                "expected-primary",
+            ),
+            (
+                "oversized-integer",
+                claude_wrapper(
+                    (oversized_counter, 5, 7, 11),
+                    (
+                        ("oversized-primary", (oversized_counter, 5, 7, 11), {}),
+                        ("auxiliary", (3, 5, 7, 11), {}),
+                    ),
+                ),
+                "oversized-primary",
+            ),
+            (
+                "zero-match",
+                claude_wrapper(
+                    (1, 2, 3, 4),
+                    (("model-a", (10, 2, 3, 4), {}), ("model-b", (1, 20, 3, 4), {})),
+                ),
+                ValueError,
+            ),
+            (
+                "duplicate-match",
+                claude_wrapper(
+                    (1, 2, 3, 4),
+                    (("model-a", (1, 2, 3, 4), {}), ("model-b", (1, 2, 3, 4), {})),
+                ),
+                ValueError,
+            ),
+            (
+                "missing-top-level-usage",
+                claude_wrapper(
+                    None,
+                    (("model-a", (1, 2, 3, 4), {}), ("model-b", (5, 6, 7, 8), {})),
+                ),
+                ValueError,
+            ),
+            (
+                "malformed-top-level-float",
+                claude_wrapper(
+                    (1.0, 2, 3, 4),
+                    (("model-a", (1, 2, 3, 4), {}), ("model-b", (5, 6, 7, 8), {})),
+                ),
+                ValueError,
+            ),
+            (
+                "malformed-top-level-negative",
+                claude_wrapper(
+                    (-1, 2, 3, 4),
+                    (("model-a", (-1, 2, 3, 4), {}), ("model-b", (5, 6, 7, 8), {})),
+                ),
+                ValueError,
+            ),
+            (
+                "malformed-entry-counter",
+                claude_wrapper(
+                    (1, 2, 3, 4),
+                    (("model-a", (1, 2, 3, 4), {}), ("model-b", (True, 20, 30, 40), {})),
+                ),
+                ValueError,
+            ),
+        )
+        for row_name, wrapper, expected in claude_selector_rows:
+            claude_log.write_text(json.dumps(wrapper) + "\n", encoding="utf-8")
+            if expected is ValueError:
+                try:
+                    parse_effective_model(claude_log)
+                except ValueError:
+                    pass
+                else:
+                    raise AssertionError(f"Claude selector accepted {row_name}")
+            else:
+                assert parse_effective_model(claude_log) == expected, row_name
+
+        claude_log.write_text(
+            json.dumps(claude_selector_rows[-1][1]) + "\n", encoding="utf-8"
+        )
+        write_state(state_path, {"phases": {}})
+        state = read_state(state_path)
+        do_spawn(
+            state, "plan", 0, None, None, "claude", "claude-default",
+            prompt_sha256=digest0,
+        )
+        malformed = do_complete(
+            state, "plan", "PASS", None, None, None, None, None, str(claude_log)
+        )
+        assert malformed and "model-attestation-failed" in malformed
+        assert state["phases"]["plan"]["model_effective"] is None
+        assert state["phases"]["plan"]["verdict"] == "BLOCKED"
 
         # Requested/effective drift is a persisted, fail-closed attestation.
         write_state(state_path, {"phases": {}})
@@ -2087,6 +4077,21 @@ def self_test() -> int:
         assert mismatched["model_effective"] == "gpt-5.6-terra"
         assert mismatched["verdict"] == "BLOCKED"
 
+        claude_log.write_text(
+            json.dumps(claude_selector_rows[1][1]) + "\n", encoding="utf-8"
+        )
+        write_state(state_path, {"phases": {}})
+        state = read_state(state_path)
+        do_spawn(state, "build_gate", 0, None, None, "claude", "claude-" "opus-5")
+        mismatch = do_complete(
+            state, "build_gate", "PASS", None, None, None, None, None, str(claude_log)
+        )
+        mismatched = state["phases"]["build_gate"]
+        assert mismatch and "model-attestation-mismatch" in mismatch
+        assert mismatched["model_requested"] == "claude-" "opus-5"
+        assert mismatched["model_effective"] == "claude-" "opus-5[1m]"
+        assert mismatched["verdict"] == "BLOCKED"
+
         # A retained mutation-worker session makes the completion flag
         # mandatory; without a retained file, null remains legal.
         retained_log = devlyn / "implement.worker-session.0.jsonl"
@@ -2115,6 +4120,437 @@ def self_test() -> int:
         assert state["phases"]["implement"]["model_effective"] == "gpt-5.6-terra"
         assert state["phases"]["implement"]["verdict"] == "PASS"
 
+        receipt_work = devlyn / "receipt-work"
+        receipt_devlyn = receipt_work / ".devlyn"
+        receipt_devlyn.mkdir(parents=True)
+        receipt_prompt = receipt_devlyn / "implement.prompt.0"
+        receipt_prompt.write_text("implement exactly\n", encoding="utf-8")
+        receipt_session = receipt_devlyn / "implement.worker-session.0.jsonl"
+        receipt_session.write_text('{"type":"thread.started"}\n', encoding="utf-8")
+        receipt_path = receipt_devlyn / "implement.invocation.0.json"
+        receipt_model = "gpt-5.6-sol"
+        receipt_prompt_sha = hashlib.sha256(receipt_prompt.read_bytes()).hexdigest()
+        inherited_engine_state = {
+            "version": "3.0",
+            "run_id": "rs-inherited-engine",
+            "engine": "codex",
+            "phases": {"implement": None},
+        }
+        try:
+            do_spawn(
+                inherited_engine_state, "implement", 0, None, None, None, None,
+                prompt_sha256=receipt_prompt_sha, devlyn=receipt_devlyn,
+            )
+        except SystemExit as exc:
+            assert "spawn requires --model" in str(exc)
+        else:
+            raise AssertionError("schema-v3 inherited Codex engine accepted no model")
+        do_spawn(
+            inherited_engine_state, "implement", 0, None, None, None, receipt_model,
+            prompt_sha256=receipt_prompt_sha, devlyn=receipt_devlyn,
+        )
+        assert inherited_engine_state["phases"]["implement"]["engine"] == "codex"
+        receipt_state = {
+            "version": "3.0",
+            "run_id": "rs-invocation-state",
+            "engine": "codex",
+            "phases": {"implement": None},
+        }
+        do_spawn(
+            receipt_state, "implement", 0, None, None, "codex", receipt_model,
+            prompt_sha256=receipt_prompt_sha, devlyn=receipt_devlyn,
+        )
+        receipt_runner = invocation_receipt_module()
+        receipt_runner.start_receipt(
+            receipt_work, receipt_path, receipt_state["run_id"], "implement", 0,
+            str(receipt_prompt), str(receipt_session),
+            ["--json", "-C", str(receipt_work), "-s", "workspace-write", "-m", receipt_model,
+             "-c", "sandbox_workspace_write.network_access=false", "implement exactly"],
+        )
+        receipt_runner.finish_receipt(receipt_work, receipt_path, 0)
+        rerouted_state = copy.deepcopy(receipt_state)
+        assert do_complete(
+            receipt_state, "implement", "PASS", None, None, None, None, None,
+            str(receipt_session), devlyn=receipt_devlyn, work=receipt_work,
+        ) is None
+        receipt_entry = receipt_state["phases"]["implement"]
+        assert receipt_entry["model_effective"] is None
+        assert receipt_entry["model_requested"] == receipt_model
+        assert receipt_entry["invocation_receipt"]["path"] == (
+            ".devlyn/implement.invocation.0.json"
+        )
+
+        # A native reroute remains a failed phase even after a successful terminal event.
+        receipt_session.write_text(
+            '{"type":"item.completed","item":{"type":"error",'
+            '"message":"model rerouted: gpt-5.6-sol -> other (Policy)"}}\n'
+            '{"type":"turn.completed"}\n', encoding="utf-8",
+        )
+        receipt_path.unlink()
+        receipt_runner.start_receipt(
+            receipt_work, receipt_path, rerouted_state["run_id"], "implement", 0,
+            str(receipt_prompt), str(receipt_session),
+            ["--json", "-C", str(receipt_work), "-s", "workspace-write", "-m", receipt_model,
+             "-c", "sandbox_workspace_write.network_access=false", "implement exactly"],
+        )
+        receipt_runner.finish_receipt(receipt_work, receipt_path, 0)
+        reroute_error = do_complete(
+            rerouted_state, "implement", "PASS", None, None, None, None, None,
+            str(receipt_session), devlyn=receipt_devlyn, work=receipt_work,
+        )
+        assert reroute_error and "model reroute" in reroute_error
+        assert rerouted_state["phases"]["implement"]["verdict"] == "BLOCKED"
+        do_spawn(rerouted_state, "implement", 1, None, None, "codex", receipt_model,
+                 prompt_sha256=receipt_prompt_sha, devlyn=receipt_devlyn)
+        assert rerouted_state["phases"]["implement"]["history"][-1]["verdict"] == "BLOCKED"
+
+        plan_prompt = receipt_devlyn / "plan.prompt.0"
+        plan_prompt.write_text("plan exactly\n", encoding="utf-8")
+        plan_session = receipt_devlyn / "plan.worker-session.0.jsonl"
+        plan_session.write_text('{"type":"thread.started"}\n', encoding="utf-8")
+        plan_path = receipt_devlyn / "plan.invocation.0.json"
+        (receipt_devlyn / "plan.md").write_text("## Files to touch\n", encoding="utf-8")
+        plan_model = "gpt-5.6-sol"
+        plan_prompt_sha = hashlib.sha256(plan_prompt.read_bytes()).hexdigest()
+        plan_state = {
+            "version": "3.0",
+            "run_id": "rs-plan-invocation",
+            "engine": "codex",
+            "phases": {"plan": None},
+        }
+        do_spawn(
+            plan_state, "plan", 0, None, None, "codex", plan_model,
+            prompt_sha256=plan_prompt_sha, devlyn=receipt_devlyn,
+        )
+        receipt_runner.start_receipt(
+            receipt_work, plan_path, plan_state["run_id"], "plan", 0,
+            str(plan_prompt), str(plan_session),
+            ["--json", "-C", str(receipt_work), "-s", "workspace-write",
+             "-m", plan_model, "-c",
+             "sandbox_workspace_write.network_access=false", "plan exactly"],
+        )
+        receipt_runner.finish_receipt(receipt_work, plan_path, 0)
+        assert do_complete(
+            plan_state, "plan", "PASS", None, None, None, None, None,
+            str(plan_session), devlyn=receipt_devlyn, work=receipt_work,
+        ) is None
+        plan_entry = plan_state["phases"]["plan"]
+        assert plan_entry["model_effective"] is None
+        assert plan_entry["model_requested"] == plan_model
+        assert plan_entry["invocation_receipt"]["path"] == ".devlyn/plan.invocation.0.json"
+        assert plan_entry["output_sha256"] == hashlib.sha256(
+            (receipt_devlyn / "plan.md").read_bytes()
+        ).hexdigest()
+        plan_prompt_1 = receipt_devlyn / "plan.prompt.1"
+        plan_prompt_1.write_text("replan exactly\n", encoding="utf-8")
+        plan_session_1 = receipt_devlyn / "plan.worker-session.1.jsonl"
+        plan_session_1.write_text('{"type":"thread.started"}\n', encoding="utf-8")
+        plan_path_1 = receipt_devlyn / "plan.invocation.1.json"
+        plan_prompt_sha_1 = hashlib.sha256(plan_prompt_1.read_bytes()).hexdigest()
+        do_spawn(
+            plan_state, "plan", 1, "plan", None, "codex", plan_model,
+            prompt_sha256=plan_prompt_sha_1, devlyn=receipt_devlyn,
+        )
+        plan_history = plan_state["phases"]["plan"]["history"]
+        assert plan_history[0]["invocation_receipt"]["path"] == (
+            ".devlyn/plan.invocation.0.json"
+        )
+        assert "invocation_receipt" not in plan_state["phases"]["plan"]
+        receipt_runner.start_receipt(
+            receipt_work, plan_path_1, plan_state["run_id"], "plan", 1,
+            str(plan_prompt_1), str(plan_session_1),
+            ["--json", "-C", str(receipt_work), "-s", "workspace-write",
+             "-m", plan_model, "-c",
+             "sandbox_workspace_write.network_access=false", "replan exactly"],
+        )
+        receipt_runner.finish_receipt(receipt_work, plan_path_1, 0)
+        assert do_complete(
+            plan_state, "plan", "PASS", None, None, None, None, None,
+            str(plan_session_1), devlyn=receipt_devlyn, work=receipt_work,
+        ) is None
+        assert plan_state["phases"]["plan"]["invocation_receipt"]["path"] == (
+            ".devlyn/plan.invocation.1.json"
+        )
+
+        confused_state = {
+            "version": "3.0",
+            "run_id": "rs-invocation-confused",
+            "engine": "codex",
+            "phases": {"implement": None},
+        }
+        do_spawn(
+            confused_state, "implement", 0, None, None, "codex", receipt_model,
+            prompt_sha256=receipt_prompt_sha, devlyn=receipt_devlyn,
+        )
+        confused_before = copy.deepcopy(confused_state)
+        try:
+            do_complete(
+                confused_state, "implement", "PASS", None, None, None,
+                "claude", receipt_model, str(receipt_session),
+                devlyn=receipt_devlyn, work=receipt_work,
+            )
+        except SystemExit as exc:
+            assert "cannot replace spawn engine" in str(exc)
+        else:
+            raise AssertionError("completion replaced a Codex spawn with Claude attestation")
+        assert confused_state == confused_before
+        try:
+            do_complete(
+                confused_state, "implement", "PASS", None, None, None,
+                None, "other-model", str(receipt_session),
+                devlyn=receipt_devlyn, work=receipt_work,
+            )
+        except SystemExit as exc:
+            assert "cannot replace requested model" in str(exc)
+        else:
+            raise AssertionError("completion replaced the requested Codex model")
+        assert confused_state == confused_before
+
+        wrong_path_state = {
+            "version": "3.0",
+            "run_id": "rs-invocation-wrong-path",
+            "engine": "codex",
+            "phases": {"implement": None},
+        }
+        do_spawn(
+            wrong_path_state, "implement", 0, None, None, "codex", receipt_model,
+            prompt_sha256=receipt_prompt_sha, devlyn=receipt_devlyn,
+        )
+        arbitrary_log = receipt_devlyn / "handwritten.log"
+        arbitrary_log.write_text(f"model: {receipt_model}\n", encoding="utf-8")
+        wrong_path_error = do_complete(
+            wrong_path_state, "implement", "PASS", None, None, None, None, None,
+            str(arbitrary_log), devlyn=receipt_devlyn, work=receipt_work,
+        )
+        assert wrong_path_error and "canonical phase/round session" in wrong_path_error
+        assert wrong_path_state["phases"]["implement"]["verdict"] == "BLOCKED"
+        print("PASS iter-0112 canonical Codex invocation receipt and session ownership")
+
+        # Iter-0121: rs-20260906T173436Z-5a086a70590e exited 1 with an
+        # empty canonical session and no plan. Exercise the real CLI writes.
+        receipt_state_path = receipt_devlyn / "pipeline.state.json"
+        missing_plan_output = receipt_devlyn / "plan.md"
+        missing_plan_output.unlink()
+        plan_session.write_bytes(b"")
+        plan_path.unlink()
+        receipt_runner.start_receipt(
+            receipt_work, plan_path, plan_state["run_id"], "plan", 0,
+            str(plan_prompt), str(plan_session),
+            ["--json", "-C", str(receipt_work), "-s", "workspace-write",
+             "-m", plan_model, "-c",
+             "sandbox_workspace_write.network_access=false", "plan exactly"],
+        )
+        receipt_runner.finish_receipt(receipt_work, plan_path, 1)
+        failed_receipt_bytes = plan_path.read_bytes()
+
+        def receipt_cli(phase: str, *event_args: str) -> subprocess.CompletedProcess[str]:
+            return subprocess.run(
+                [sys.executable, script, "--devlyn-dir", str(receipt_devlyn),
+                 "--phase", phase, *event_args],
+                cwd=receipt_work, capture_output=True, text=True, check=False,
+            )
+
+        write_state(receipt_state_path, {
+            "version": "3.0", "run_id": plan_state["run_id"],
+            "engine": "codex", "phases": {},
+        })
+        result = receipt_cli(
+            "plan", "spawn", "--round", "0", "--engine", "codex",
+            "--model", plan_model, "--prompt-sha256", plan_prompt_sha,
+        )
+        assert result.returncode == 0, result.stderr
+        open_plan_bytes = receipt_state_path.read_bytes()
+        blocked_args = (
+            "--verdict", "BLOCKED", "--engine-session-log", str(plan_session),
+        )
+        result = receipt_cli("plan", "complete", *blocked_args)
+        assert result.returncode == 1, result.stderr
+        assert "BLOCKED:invocation-receipt-invalid: Codex invocation exited 1" in result.stderr, result.stderr
+        blocked_plan = read_state(receipt_state_path)["phases"]["plan"]
+        assert blocked_plan["verdict"] == "BLOCKED"
+        assert blocked_plan["output_sha256"] is None
+        assert blocked_plan["model_effective"] is None
+        assert blocked_plan["completed_at"] is not None
+        assert blocked_plan["duration_ms"] == round((
+            parse_iso(blocked_plan["completed_at"]) - parse_iso(blocked_plan["started_at"])
+        ).total_seconds() * 1000)
+        assert blocked_plan["duration_ms"] >= 0
+        assert not os.path.lexists(missing_plan_output)
+        assert plan_path.read_bytes() == failed_receipt_bytes
+        print("PASS iter-0121 failed PLAN worker persists BLOCKED timing/null output and receipt error")
+
+        for phase, event_args in [
+            (phase, (
+                "spawn", "--round", "1" if phase == "plan" else "0",
+                "--triggered-by", "plan", "--engine", "codex",
+                "--model", plan_model, "--prompt-sha256", plan_prompt_sha,
+            )) for phase in sorted(PHASE_NAMES - {"final_report"})
+        ] + [
+            ("surface_close", ("surface-skip",)),
+            ("surface_close", ("surface-check", "--authorized-surface-json", "[]")),
+            ("surface_close", ("surface-adjudication-recover", "--authorized-surface-json", "[]")),
+            ("surface_close", ("surface-rollback",)),
+            ("implement", ("durability-enforce", "--round", "1", "--origin-phase", "verify")),
+        ]:
+            before = receipt_state_path.read_bytes()
+            result = receipt_cli(phase, *event_args)
+            assert result.returncode == 1, (phase, event_args, result.stderr)
+            assert "BLOCKED:plan-output-missing" in result.stderr, (phase, event_args, result.stderr)
+            assert receipt_state_path.read_bytes() == before
+        result = receipt_cli("final_report", "spawn", "--round", "0")
+        assert result.returncode == 0, result.stderr
+        blocked_report = receipt_devlyn / "final-report.md"
+        blocked_report.write_text(
+            f"<!-- devlyn:final-report run_id={read_state(receipt_state_path)['run_id']} -->\n"
+            "# BLOCKED\nPLAN invocation failed; no PLAN output was produced.\n", encoding="utf-8",
+        )
+        result = receipt_cli("final_report", "complete", "--verdict", "BLOCKED", "--log-file", str(blocked_report))
+        assert result.returncode == 0, result.stderr
+        terminal_state = read_state(receipt_state_path)
+        assert terminal_state["phases"]["plan"] == blocked_plan
+        assert terminal_state["phases"]["final_report"]["completed_at"] is not None
+        assert terminal_state["phases"]["final_report"]["verdict"] == "BLOCKED"
+        assert terminal_state["phases"]["final_report"]["output_sha256"] == hashlib.sha256(blocked_report.read_bytes()).hexdigest()
+        with tempfile.TemporaryDirectory() as archive_tmp:
+            archive_work = pathlib.Path(archive_tmp)
+            archive_devlyn = archive_work / ".devlyn"
+            archive_devlyn.mkdir()
+            retained = (receipt_state_path, blocked_report, plan_path, plan_prompt, plan_session)
+            for source in retained:
+                shutil.copy2(source, archive_devlyn / source.name)
+            archived = subprocess.run(
+                [sys.executable, str(pathlib.Path(script).with_name("archive_run.py"))],
+                cwd=archive_work, capture_output=True, text=True,
+            )
+            assert archived.returncode == 0, archived.stderr
+            destination = archive_devlyn / "runs" / terminal_state["run_id"]
+            assert not (archive_devlyn / "pipeline.state.json").exists()
+            assert not (destination / "plan.md").exists()
+            assert all((destination / source.name).read_bytes() == source.read_bytes() for source in retained)
+        print("PASS iter-0121 missing-output BLOCKED permits final closure and refuses all work spawns/special events")
+
+        # Non-BLOCKED requests cannot obtain the exception via failed attestation.
+        for verdict in sorted(VALID_VERDICTS - {"BLOCKED"}):
+            receipt_state_path.write_bytes(open_plan_bytes)
+            result = receipt_cli(
+                "plan", "complete", "--verdict", verdict,
+                "--engine-session-log", str(plan_session),
+            )
+            assert result.returncode == 1, (verdict, result.stderr)
+            assert "BLOCKED:plan-integrity-invalid" in result.stderr
+            assert receipt_state_path.read_bytes() == open_plan_bytes
+        for next_phase in ("implement", "probe_derive", "final_report"):
+            result = receipt_cli(
+                "plan", "transition", *blocked_args, "--next-phase", next_phase,
+                "--next-round", "0", "--next-engine", "claude",
+            )
+            assert result.returncode == 1, result.stderr
+            assert "Codex invocation exited 1" in result.stderr
+            assert receipt_state_path.read_bytes() == open_plan_bytes
+        plan_path.write_text("{", encoding="utf-8")
+        result = receipt_cli("plan", "complete", *blocked_args)
+        assert result.returncode == 1, result.stderr
+        assert "BLOCKED:invocation-receipt-invalid" in result.stderr
+        malformed_plan = read_state(receipt_state_path)["phases"]["plan"]
+        assert malformed_plan["verdict"] == "BLOCKED"
+        assert malformed_plan["model_effective"] is None
+        assert malformed_plan["output_sha256"] is None
+        assert malformed_plan["completed_at"] is not None
+
+        # Even attested BLOCKED completion cannot transition into more work.
+        plan_path.unlink()
+        receipt_runner.start_receipt(
+            receipt_work, plan_path, plan_state["run_id"], "plan", 0,
+            str(plan_prompt), str(plan_session),
+            ["--json", "-C", str(receipt_work), "-s", "workspace-write",
+             "-m", plan_model, "-c",
+             "sandbox_workspace_write.network_access=false", "plan exactly"],
+        )
+        receipt_runner.finish_receipt(receipt_work, plan_path, 0)
+        receipt_state_path.write_bytes(open_plan_bytes)
+        for next_phase in ("implement", "probe_derive"):
+            result = receipt_cli(
+                "plan", "transition", *blocked_args, "--next-phase", next_phase,
+                "--next-round", "0", "--next-engine", "claude",
+            )
+            assert result.returncode == 1, result.stderr
+            assert "BLOCKED:plan-output-missing" in result.stderr
+            assert receipt_state_path.read_bytes() == open_plan_bytes
+        result = receipt_cli(
+            "plan", "transition", *blocked_args, "--next-phase", "final_report",
+            "--next-round", "0",
+        )
+        assert result.returncode == 0, result.stderr
+        absent_transition_bytes = receipt_state_path.read_bytes()
+        assert read_state(receipt_state_path)["phases"]["plan"]["model_effective"] is None
+        print("PASS iter-0121 non-BLOCKED output requirement, malformed receipt and atomic transitions")
+
+        for path_kind in ("file", "directory", "dangling-symlink", "unreadable"):
+            if path_kind == "directory":
+                missing_plan_output.mkdir()
+            elif path_kind == "dangling-symlink":
+                missing_plan_output.symlink_to(receipt_devlyn / "missing-target")
+            else:
+                missing_plan_output.write_bytes(b"## Files to touch\n")
+                if path_kind == "unreadable":
+                    missing_plan_output.chmod(0)
+            try:
+                receipt_state_path.write_bytes(absent_transition_bytes)
+                result = receipt_cli("final_report", "complete", "--verdict", "BLOCKED")
+                assert result.returncode == 1, (path_kind, result.stderr)
+                assert "BLOCKED:plan-integrity-invalid" in result.stderr
+                assert receipt_state_path.read_bytes() == absent_transition_bytes
+                if path_kind in {"directory", "dangling-symlink"} or (
+                    path_kind == "unreadable" and not os.access(missing_plan_output, os.R_OK)
+                ):
+                    receipt_state_path.write_bytes(open_plan_bytes)
+                    result = receipt_cli("plan", "complete", *blocked_args)
+                    assert result.returncode == 1, (path_kind, result.stderr)
+                    assert "BLOCKED:plan-integrity-invalid" in result.stderr
+                    assert receipt_state_path.read_bytes() == open_plan_bytes
+            finally:
+                if path_kind == "directory":
+                    missing_plan_output.rmdir()
+                else:
+                    if path_kind == "unreadable":
+                        missing_plan_output.chmod(0o600)
+                    missing_plan_output.unlink()
+        print("PASS iter-0121 lexical absence rejects existing/nonregular/unreadable output")
+
+        # BLOCKED with bytes still binds them, including across legal correction.
+        missing_plan_output.write_bytes(b"## Files to touch\n")
+        receipt_state_path.write_bytes(open_plan_bytes)
+        result = receipt_cli("plan", "complete", *blocked_args)
+        assert result.returncode == 0, result.stderr
+        bound_bytes = receipt_state_path.read_bytes()
+        assert read_state(receipt_state_path)["phases"]["plan"]["output_sha256"] == hashlib.sha256(
+            missing_plan_output.read_bytes()
+        ).hexdigest()
+        result = receipt_cli(
+            "plan", "spawn", "--round", "1", "--triggered-by", "plan",
+            "--engine", "codex", "--model", plan_model,
+            "--prompt-sha256", plan_prompt_sha_1,
+        )
+        assert result.returncode == 0, result.stderr
+        correction_bytes = receipt_state_path.read_bytes()
+        missing_plan_output.unlink()
+        result = receipt_cli(
+            "plan", "complete", "--verdict", "BLOCKED",
+            "--engine-session-log", str(plan_session_1),
+        )
+        assert result.returncode == 1, result.stderr
+        assert "BLOCKED:plan-integrity-invalid" in result.stderr
+        assert receipt_state_path.read_bytes() == correction_bytes
+        for changed in (False, True):
+            if changed:
+                missing_plan_output.write_bytes(b"altered plan\n")
+            receipt_state_path.write_bytes(bound_bytes)
+            result = receipt_cli("final_report", "spawn", "--round", "0")
+            assert result.returncode == 1, result.stderr
+            assert "BLOCKED:plan-integrity-" in result.stderr
+            assert receipt_state_path.read_bytes() == bound_bytes
+        print("PASS iter-0121 BLOCKED output binding rejects deletion/tampering and lost correction output")
+
         retained_log.unlink()
         write_state(state_path, {"phases": {}})
         state = read_state(state_path)
@@ -2128,14 +4564,20 @@ def self_test() -> int:
         # Supplied evidence must parse and never silently record null.
         write_state(state_path, {"phases": {}})
         state = read_state(state_path)
-        do_spawn(state, "plan", 0, None, None, "claude", "claude-default")
+        do_spawn(
+            state, "plan", 0, None, None, "claude", "claude-default",
+            prompt_sha256=digest0,
+        )
         assert do_complete(state, "plan", "PASS", None, None, None, None, None) is None
         assert state["phases"]["plan"]["model_effective"] is None
         invalid_log = devlyn / "invalid-session.log"
         invalid_log.write_text("no model evidence\n", encoding="utf-8")
         write_state(state_path, {"phases": {}})
         state = read_state(state_path)
-        do_spawn(state, "plan", 0, None, None, "claude", "claude-default")
+        do_spawn(
+            state, "plan", 0, None, None, "claude", "claude-default",
+            prompt_sha256=digest0,
+        )
         invalid = do_complete(
             state, "plan", "PASS", None, None, None, None, None, str(invalid_log)
         )
@@ -2227,7 +4669,6 @@ def self_test() -> int:
             ["git", "show", "-s", "--format=%s", "HEAD"], cwd=exact_repo,
             check=True, capture_output=True, text=True,
         ).stdout.strip() == "chore(pipeline): closure-restore round 1"
-        import importlib.util
         gate_spec = importlib.util.spec_from_file_location(
             "f7_carrier_gate", pathlib.Path(__file__).resolve().parents[3]
             / "benchmark/ceiling/scripts/f7-carrier-gate.py",
@@ -2502,11 +4943,13 @@ def main() -> int:
     ap.add_argument("--devlyn-dir", default=".devlyn")
     ap.add_argument("--phase", choices=sorted(PHASE_NAMES))
     ap.add_argument("--self-test", action="store_true")
+    ap.add_argument("--freeze-roles", action="store_true")
+    ap.add_argument("--default-engine", default="claude")
     sub = ap.add_subparsers(dest="event")
 
     spawn_p = sub.add_parser("spawn")
     spawn_p.add_argument("--round", type=int, required=True)
-    spawn_p.add_argument("--triggered-by", choices=sorted(VALID_TRIGGERS), default=None)
+    spawn_p.add_argument("--triggered-by", choices=sorted(SPAWN_TRIGGERS), default=None)
     spawn_p.add_argument("--pre-sha", default=None)
     spawn_p.add_argument("--input-patch-sha256", default=None)
     spawn_p.add_argument("--prompt-sha256", default=None)
@@ -2533,7 +4976,7 @@ def main() -> int:
     transition_p.add_argument("--engine-session-log", default=None)
     transition_p.add_argument("--next-phase", choices=sorted(PHASE_NAMES), required=True)
     transition_p.add_argument("--next-round", type=int, required=True)
-    transition_p.add_argument("--next-triggered-by", choices=sorted(VALID_TRIGGERS), default=None)
+    transition_p.add_argument("--next-triggered-by", choices=sorted(SPAWN_TRIGGERS), default=None)
     transition_p.add_argument("--next-pre-sha", default=None)
     transition_p.add_argument("--next-input-patch-sha256", default=None)
     transition_p.add_argument("--next-prompt-sha256", default=None)
@@ -2555,12 +4998,24 @@ def main() -> int:
     if args.self_test:
         return self_test()
 
+    if args.freeze_roles:
+        devlyn = pathlib.Path(args.devlyn_dir)
+        state_path = devlyn / "pipeline.state.json"
+        try:
+            state = read_state(state_path)
+            result = freeze_roles(state, devlyn.resolve().parent, args.default_engine)
+            write_state(state_path, state)
+            print(json.dumps(result, sort_keys=True))
+            return 0
+        except (ValueError, OSError) as exc:
+            print(str(exc), file=sys.stderr)
+            return 1
+
     surface_events = {
         "surface-check", "surface-adjudication-recover", "surface-rollback", "surface-skip",
     }
     if not args.phase or args.event not in {"spawn", "complete", "transition", "durability-enforce", *surface_events}:
         ap.error("--phase and a phase event are required unless --self-test")
-
     devlyn = pathlib.Path(args.devlyn_dir)
     if not devlyn.is_dir():
         sys.stderr.write(f"error: {devlyn} is not a directory\n")
@@ -2571,6 +5026,7 @@ def main() -> int:
     if args.event == "durability-enforce":
         if args.phase != "implement":
             ap.error("durability-enforce is valid only for --phase implement")
+        validate_plan_output(state, devlyn, args.phase)
         _persist_durability_event(
             pathlib.Path.cwd(), devlyn, state, state_path, args.origin_phase, args.round,
         )
@@ -2580,6 +5036,7 @@ def main() -> int:
     if args.event in surface_events:
         if args.phase != "surface_close":
             ap.error(f"{args.event} is valid only for --phase surface_close")
+        validate_plan_output(state, devlyn, args.phase)
         if args.event == "surface-skip":
             do_surface_skip(state)
             write_state(state_path, state)
@@ -2652,6 +5109,7 @@ def main() -> int:
                 input_patch_sha256=args.input_patch_sha256,
                 prompt_sha256=args.prompt_sha256,
                 untracked_before=untracked_before,
+                devlyn=devlyn,
             )
         else:
             next_untracked_before = (
@@ -2669,6 +5127,7 @@ def main() -> int:
                 next_input_patch_sha256=args.next_input_patch_sha256,
                 next_prompt_sha256=args.next_prompt_sha256,
                 next_untracked_before=next_untracked_before,
+                work=pathlib.Path.cwd(),
             )
         if spawn_phase == "surface_close":
             validate_surface_inputs(pathlib.Path.cwd(), devlyn, state)
@@ -2700,7 +5159,16 @@ def main() -> int:
         attestation_error = do_complete(
             state, args.phase, args.verdict, args.post_sha, args.findings_file,
             args.log_file, args.engine, args.model, args.engine_session_log, devlyn,
+            pathlib.Path.cwd(),
         )
+        if (
+            args.phase == "plan"
+            and state["phases"]["plan"]["verdict"] in {"PASS", "PASS_WITH_ISSUES"}
+        ):
+            raise SystemExit(
+                "error: phases.plan complete with PASS or PASS_WITH_ISSUES requires "
+                "--phase plan transition --verdict <verdict> --next-phase <phase>"
+            )
 
     if args.event not in {"spawn", "transition"}:
         write_state(state_path, state)