devlyn-cli 2.10.1 → 3.0.0

package/config/skills/_shared/verify-merge-findings.py

@@ -15,15 +15,24 @@ import pathlib
 import re
 import sys
 import tempfile
+import runpy
 from typing import Any
 
 
+JUDGE_OUTPUT_PARSER = runpy.run_path(pathlib.Path(__file__).with_name("judge-output-parser.py"))
+PROCESS_EVIDENCE = runpy.run_path(pathlib.Path(__file__).with_name("process-evidence.py"))
+
+
 SOURCE_FILES = (
     ("mechanical", "verify-mechanical.findings.jsonl"),
     ("judge", "verify.findings.jsonl"),
     ("pair_judge", "verify.pair.findings.jsonl"),
     ("pair_judge", "verify.pair-judge.findings.jsonl"),
 )
+REQUIRED_SOURCE_FILES = {
+    "mechanical": "verify-mechanical.findings.jsonl",
+    "judge": "verify.findings.jsonl",
+}
 
 VERDICT_RANK = {
     "PASS": 0,
@@ -86,8 +95,21 @@ def reject_json_constant(token: str) -> None:
     raise ValueError(f"invalid JSON numeric constant: {token}")
 
 
+def reject_duplicate_keys(pairs: list[tuple[str, object]]) -> dict:
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError(f"duplicate JSON key: {key}")
+        result[key] = value
+    return result
+
+
 def loads_strict_json(text: str) -> Any:
-    return json.loads(text, parse_constant=reject_json_constant)
+    return json.loads(
+        text,
+        parse_constant=reject_json_constant,
+        object_pairs_hook=reject_duplicate_keys,
+    )
 
 
 def rank(verdict: str | None) -> int:
@@ -125,9 +147,187 @@ def finding_rank(finding: dict[str, Any]) -> int:
     return 0
 
 
+def mechanical_evidence_required(devlyn: pathlib.Path, state: dict[str, Any]) -> bool:
+    return PROCESS_EVIDENCE["mechanical_evidence_required"](devlyn.parent.resolve(), state)
+
+
+def mechanical_evidence_carrier(devlyn: pathlib.Path) -> dict[str, Any] | None:
+    state_path = devlyn / "pipeline.state.json"
+    state = loads_strict_json(state_path.read_text(encoding="utf-8"))
+    if not isinstance(state, dict):
+        raise ValueError("pipeline.state.json must contain a JSON object")
+    results_path = devlyn / "spec-verify.results.json"
+    if not results_path.is_file():
+        if state.get("version") == "3.0" and mechanical_evidence_required(devlyn, state):
+            raise ValueError("spec-verify.results.json is required for VERIFY MECHANICAL evidence")
+        return None
+    results = loads_strict_json(results_path.read_text(encoding="utf-8"))
+    if not isinstance(results, dict):
+        raise ValueError("spec-verify.results.json must contain a JSON object")
+    commands = results.get("commands")
+    if not isinstance(commands, list):
+        raise ValueError("spec-verify.results.json commands must be an array")
+    carrier = results.get("process_evidence")
+    if carrier is None:
+        if commands:
+            raise ValueError("MECHANICAL commands exist without a process-evidence carrier")
+        if mechanical_evidence_required(devlyn, state):
+            raise ValueError("required VERIFY MECHANICAL evidence has no process-evidence carrier")
+        run_id = state.get("run_id")
+        phases = state.get("phases")
+        verify_phase = phases.get("verify") if isinstance(phases, dict) else None
+        round_ = verify_phase.get("round") if isinstance(verify_phase, dict) else None
+        if isinstance(run_id, str) and isinstance(round_, int) and not isinstance(round_, bool):
+            manifest_path = (
+                devlyn / "process-evidence" / run_id / "verify"
+                / f"round-{round_}" / "manifest.json"
+            )
+            if manifest_path.exists():
+                raise ValueError("VERIFY manifest exists without a process-evidence carrier")
+        return None
+    run_id = state.get("run_id")
+    phases = state.get("phases")
+    verify_phase = phases.get("verify") if isinstance(phases, dict) else None
+    round_ = verify_phase.get("round") if isinstance(verify_phase, dict) else None
+    if not isinstance(run_id, str) or not run_id:
+        raise ValueError("state.run_id is required for sealed MECHANICAL evidence")
+    if isinstance(round_, bool) or not isinstance(round_, int) or round_ < 0:
+        raise ValueError("phases.verify.round is required for sealed MECHANICAL evidence")
+    if not isinstance(carrier, dict) or carrier.get("phase") != "verify" or carrier.get("round") != round_:
+        raise ValueError("MECHANICAL process-evidence carrier does not match the VERIFY round")
+    PROCESS_EVIDENCE["validate_summary_commands"](
+        devlyn.parent.resolve(), commands, carrier,
+    )
+    expected_prefix = f".devlyn/process-evidence/{run_id}/verify/round-{round_}/"
+    manifest = carrier.get("manifest")
+    if not isinstance(manifest, dict) or not str(manifest.get("path", "")).startswith(expected_prefix):
+        raise ValueError("MECHANICAL process-evidence carrier does not match state.run_id")
+
+    bound = state.get("process_evidence")
+    if bound is not None:
+        if not isinstance(bound, list):
+            raise ValueError("state.process_evidence must be null or an array")
+        same_round = [
+            item for item in bound
+            if isinstance(item, dict)
+            and item.get("phase") == "verify"
+            and item.get("round") == round_
+        ]
+        if same_round and same_round != [carrier]:
+            raise ValueError("state-bound VERIFY evidence disagrees with MECHANICAL results")
+    return carrier
+
+
+def mechanical_evidence_violation(devlyn: pathlib.Path) -> dict[str, Any] | None:
+    try:
+        mechanical_evidence_carrier(devlyn)
+    except (PROCESS_EVIDENCE["EvidenceError"], OSError, UnicodeError, ValueError) as exc:
+        return {
+            "id": "verify-mechanical-evidence-invalid",
+            "rule_id": "invariant.process-evidence-invalid",
+            "severity": "CRITICAL",
+            "confidence": "high",
+            "file": "spec-verify.results.json",
+            "line": 1,
+            "message": f"Sealed VERIFY MECHANICAL evidence failed rehash before merge: {exc}",
+            "criterion_ref": "process-evidence://mechanical",
+            "source": "mechanical",
+        }
+    return None
+
+
+def mechanical_evidence_outcome(devlyn: pathlib.Path) -> dict[str, Any] | None:
+    carrier = mechanical_evidence_carrier(devlyn)
+    if carrier is None:
+        return None
+    return PROCESS_EVIDENCE["bound_carrier_outcome"](devlyn.parent.resolve(), carrier)
+
+
+ROLE_CONFIG = runpy.run_path(pathlib.Path(__file__).with_name("role-config.py"))
+JUDGE_ROLE_EVIDENCE = runpy.run_path(pathlib.Path(__file__).with_name("judge-role-evidence.py"))
+
+
+def resolved_primary_engine(state):
+    return ROLE_CONFIG["primary_engine"](state)
+
+
+def primary_timeout_blocker(id_: str, message: str) -> dict[str, Any]:
+    return {
+        "id": id_,
+        "rule_id": "verify.primary.timeout-contract",
+        "severity": "CRITICAL",
+        "confidence": "high",
+        "file": "verify.primary.timeout.json",
+        "line": 1,
+        "message": message,
+        "criterion_ref": "verify.primary.timeout",
+        "source": "judge",
+    }
+
+
+def read_primary_timeout_marker(
+    devlyn: pathlib.Path,
+) -> tuple[dict[str, Any] | None, dict[str, Any] | None]:
+    path = devlyn / "verify.primary.timeout.json"
+    if not path.is_file():
+        return None, None
+    try:
+        marker = loads_strict_json(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, ValueError) as exc:
+        return None, primary_timeout_blocker(
+            "verify-primary-timeout-marker-malformed",
+            f"verify.primary.timeout.json is malformed: {exc}",
+        )
+    if not isinstance(marker, dict) or set(marker) != {"engine", "budget_seconds"}:
+        return None, primary_timeout_blocker(
+            "verify-primary-timeout-marker-malformed",
+            "verify.primary.timeout.json must contain exactly engine and budget_seconds.",
+        )
+    engine = marker["engine"]
+    budget_seconds = marker["budget_seconds"]
+    if not isinstance(engine, str) or not engine:
+        return None, primary_timeout_blocker(
+            "verify-primary-timeout-marker-malformed",
+            "verify.primary.timeout.json engine must be a non-empty string.",
+        )
+    if (
+        not isinstance(budget_seconds, int)
+        or isinstance(budget_seconds, bool)
+        or budget_seconds != 600
+    ):
+        return None, primary_timeout_blocker(
+            "verify-primary-timeout-budget-mismatch",
+            "verify.primary.timeout.json budget_seconds must equal 600.",
+        )
+    try:
+        state = loads_strict_json(
+            (devlyn / "pipeline.state.json").read_text(encoding="utf-8")
+        )
+    except (OSError, UnicodeError, ValueError) as exc:
+        return None, primary_timeout_blocker(
+            "verify-primary-timeout-engine-mismatch",
+            f"Cannot authenticate the primary timeout engine from pipeline.state.json: {exc}",
+        )
+    try:
+        expected_engine = resolved_primary_engine(state) if isinstance(state, dict) else None
+    except ValueError:
+        expected_engine = None
+    if (
+        not isinstance(expected_engine, str)
+        or not expected_engine
+        or engine != expected_engine
+    ):
+        return None, primary_timeout_blocker(
+            "verify-primary-timeout-engine-mismatch",
+            "Primary timeout engine does not match the resolved primary judge.",
+        )
+    return {"engine": engine, "budget_seconds": budget_seconds}, None
+
+
 def read_findings(devlyn: pathlib.Path) -> tuple[list[dict[str, Any]], dict[str, str | None]]:
     findings: list[dict[str, Any]] = []
     source_verdicts: dict[str, str | None] = {source: "PASS" for source, _ in SOURCE_FILES}
+    primary_timeout_marker, primary_timeout_violation = read_primary_timeout_marker(devlyn)
     # A verdict must come from a judge that ran: pair_judge stays null until
     # spawn evidence exists (a pair findings file or pair stdout). verify.md's
     # pair contract records null when no second agent is spawned.
@@ -135,6 +335,27 @@ def read_findings(devlyn: pathlib.Path) -> tuple[list[dict[str, Any]], dict[str,
     for source, name in SOURCE_FILES:
         path = devlyn / name
         if not path.is_file():
+            # A verdict-binding mechanical result contractually skips both
+            # judges. Its absent primary carrier is therefore not evidence a
+            # dispatched primary judge failed to produce.
+            if source == "judge" and rank(source_verdicts.get("mechanical")) >= 2:
+                source_verdicts[source] = None
+                continue
+            if source == "judge" and primary_timeout_marker is not None:
+                continue
+            if REQUIRED_SOURCE_FILES.get(source) == name:
+                findings.append({
+                    "id": f"verify-merge-required-source-missing-{source}",
+                    "rule_id": "verify.findings.required-source-missing",
+                    "severity": "CRITICAL",
+                    "confidence": "high",
+                    "file": name,
+                    "line": 1,
+                    "message": f"Required VERIFY {source} findings file is missing: {name}",
+                    "criterion_ref": "verify-merge",
+                    "source": source,
+                })
+                source_verdicts[source] = "BLOCKED"
             continue
         if source_verdicts[source] is None:
             source_verdicts[source] = "PASS"
@@ -168,6 +389,50 @@ def read_findings(devlyn: pathlib.Path) -> tuple[list[dict[str, Any]], dict[str,
                 source_verdicts[source] = worse(
                     source_verdicts[source], RANK_VERDICT[finding_rank(item)]
                 )
+    evidence_violation = mechanical_evidence_violation(devlyn)
+    if evidence_violation is not None:
+        findings.append(evidence_violation)
+        source_verdicts["mechanical"] = "BLOCKED"
+    else:
+        outcome = mechanical_evidence_outcome(devlyn)
+        if outcome is not None and outcome["verdict"] != "PASS":
+            blocked = outcome["verdict"] == "BLOCKED"
+            ids = (
+                [item["id"] for item in outcome["capability_denials"]]
+                if blocked else outcome["failed_ids"]
+            )
+            findings.append({
+                "id": (
+                    "verify-mechanical-capability-denied"
+                    if blocked else "verify-mechanical-expectation-mismatch"
+                ),
+                "rule_id": (
+                    "invariant.build-env-underprovisioned"
+                    if blocked else "invariant.mechanical-expectation-mismatch"
+                ),
+                "severity": "CRITICAL" if blocked else "HIGH",
+                "confidence": "high",
+                "file": "spec-verify.results.json",
+                "line": 1,
+                "message": (
+                    "Sealed VERIFY MECHANICAL evidence records a capability denial: "
+                    if blocked else
+                    "Sealed VERIFY MECHANICAL evidence records failed expectations: "
+                ) + ",".join(ids),
+                "criterion_ref": "process-evidence://mechanical",
+                "source": "mechanical",
+                "verdict_binding": True,
+            })
+            source_verdicts["mechanical"] = outcome["verdict"]
+    if primary_timeout_violation is not None:
+        findings.append(primary_timeout_violation)
+        source_verdicts["judge"] = "BLOCKED"
+    elif primary_timeout_marker is not None:
+        findings.append(primary_timeout_blocker(
+            "verify-primary-timeout",
+            "Primary JUDGE exceeded its authenticated 600-second wall budget.",
+        ))
+        source_verdicts["judge"] = "BLOCKED"
     findings.extend(detect_pair_stdout_contract_violations(devlyn, source_verdicts))
     pair_summary_path = devlyn / "pair-judge.summary.json"
     pair_carrier_exists = any(
@@ -207,6 +472,26 @@ def read_findings(devlyn: pathlib.Path) -> tuple[list[dict[str, Any]], dict[str,
             source_verdicts["pair_judge"] = worse(
                 source_verdicts["pair_judge"], pair_verdict
             )
+    if (devlyn / "pipeline.state.json").is_file():
+        try:
+            state = loads_strict_json((devlyn / "pipeline.state.json").read_text())
+            required = JUDGE_ROLE_EVIDENCE["required_roles"](state)
+            if rank(source_verdicts.get("mechanical")) >= 2:
+                required = []
+            for role in required:
+                source = "judge" if role == "primary_judge" else "pair_judge"
+                if source_verdicts.get(source) in {"BLOCKED", "TIMEOUT"}:
+                    continue
+                try:
+                    JUDGE_ROLE_EVIDENCE["authenticate"](devlyn, state, role)
+                except (ValueError, OSError, TypeError, KeyError) as exc:
+                    source_verdicts[source] = "BLOCKED"
+                    findings.append({**primary_timeout_blocker("verify-role-evidence-invalid", str(exc)),
+                                     "source": source, "rule_id": "verify.role-evidence"})
+        except (ValueError, OSError, TypeError, KeyError) as exc:
+            source_verdicts["judge"] = "BLOCKED"
+            findings.append({**primary_timeout_blocker("verify-role-resolution-invalid", str(exc)),
+                             "rule_id": "verify.role-resolution"})
     return findings, source_verdicts
 
 
@@ -218,6 +503,29 @@ def has_pair_findings(devlyn: pathlib.Path) -> bool:
     return False
 
 
+def canonical_other_judge_stdout(devlyn: pathlib.Path, primary_engine: str) -> list[pathlib.Path]:
+    adapters = pathlib.Path(__file__).with_name("adapters")
+    engine_names = {
+        path.stem for path in adapters.glob("*.md")
+        if path.stem != "README"
+    }
+    return sorted(
+        devlyn / f"{engine}-judge.stdout"
+        for engine in engine_names
+        if engine != primary_engine and (devlyn / f"{engine}-judge.stdout").is_file()
+    )
+
+
+def pair_capture_exists(devlyn: pathlib.Path, stdout_paths: list[pathlib.Path]) -> bool:
+    return bool(stdout_paths) or has_pair_findings(devlyn) or any(
+        (devlyn / name).is_file()
+        for name in (
+            "verify.pair.timeout.json",
+            "pair-judge.summary.json",
+        )
+    )
+
+
 def pair_trigger_status(devlyn: pathlib.Path) -> tuple[bool, dict[str, Any] | None]:
     state_path = devlyn / "pipeline.state.json"
     if not state_path.is_file():
@@ -384,12 +692,41 @@ def risk_profile_contract_violation(devlyn: pathlib.Path) -> dict[str, Any] | No
 def verify_state_contract_violation(devlyn: pathlib.Path) -> dict[str, Any] | None:
     state_path = devlyn / "pipeline.state.json"
     if not state_path.is_file():
-        return None
+        return {
+            "id": "verify-state-missing",
+            "rule_id": "verify.state.missing",
+            "message": "pipeline.state.json is required before VERIFY merge.",
+            "file": "pipeline.state.json",
+        }
     try:
         state = loads_strict_json(state_path.read_text(encoding="utf-8"))
     except ValueError:
-        return None
-    if not isinstance(state, dict) or not state_uses_default_pair_contract(state):
+        return {
+            "id": "verify-pair-trigger-state-malformed",
+            "rule_id": "verify.pair.emission-contract",
+            "message": "pipeline.state.json is malformed; cannot verify pair_trigger contract.",
+            "file": "pipeline.state.json",
+        }
+    if not isinstance(state, dict):
+        return {
+            "id": "verify-state-malformed",
+            "rule_id": "verify.state.malformed",
+            "message": "pipeline.state.json must be a JSON object before VERIFY merge.",
+            "file": "pipeline.state.json",
+        }
+    try:
+        engine = resolved_primary_engine(state)
+    except ValueError:
+        engine = None
+    if not isinstance(engine, str) or not engine.strip():
+        rule = "verify.state.engine-malformed"
+        return {
+            "id": rule,
+            "rule_id": rule,
+            "message": "pipeline.state.json requires a valid primary engine before VERIFY merge.",
+            "file": "pipeline.state.json",
+        }
+    if not state_uses_default_pair_contract(state):
         return None
     source = state.get("source")
     if not isinstance(source, dict) or source.get("type") != "generated":
@@ -806,14 +1143,47 @@ def read_pair_timeout_marker(devlyn: pathlib.Path) -> tuple[dict[str, Any] | Non
     return {"engine": engine, "budget_seconds": budget_seconds}, None
 
 
+def is_result_less_message_stream(stdout_text: str) -> bool:
+    """True when a declared whole-message stream stops before its terminal result.
+
+    The timeout marker attests the killed process. This classifier admits only a
+    valid stream prefix, optionally ending in one truncated JSON record.
+    """
+    lines = [raw for line in stdout_text.splitlines() if (raw := line.strip())]
+    if not lines:
+        return False
+    try:
+        first = JUDGE_OUTPUT_PARSER["loads_strict_json"](lines[0])
+    except ValueError:
+        return False
+    if (
+        not isinstance(first, dict)
+        or first.get("type") != "system"
+        or first.get("subtype") != "init"
+        or not isinstance(first.get("session_id"), str)
+    ):
+        return False
+    session_id = first["session_id"]
+    for index, raw in enumerate(lines[1:], 1):
+        try:
+            item = JUDGE_OUTPUT_PARSER["loads_strict_json"](raw)
+        except ValueError:
+            return index == len(lines) - 1 and raw.startswith("{") and not raw.endswith("}")
+        if (
+            not isinstance(item, dict)
+            or item.get("type") not in {"assistant", "user"}
+            or item.get("session_id") != session_id
+        ):
+            return False
+    return True
+
+
 def detect_pair_stdout_contract_violations(
     devlyn: pathlib.Path,
     source_verdicts: dict[str, str | None],
 ) -> list[dict[str, Any]]:
-    # *-judge.stdout: any engine's pair-judge capture (codex-judge.stdout,
-    # claude-judge.stdout — adapters/claude.md ## Invocation). The emission
-    # contract is engine-neutral.
-    stdout_paths = sorted(devlyn.glob("*-judge.stdout"))
+    # The primary uses its explicit phase engine, or the legacy executor; only the OTHER engine's
+    # capture is pair evidence.
     timeout_marker, timeout_violation = read_pair_timeout_marker(devlyn)
     if timeout_violation is not None:
         source_verdicts["pair_judge"] = "BLOCKED"
@@ -865,6 +1235,11 @@ def detect_pair_stdout_contract_violations(
                 state_violation["rule_id"],
             )
         ]
+    state = loads_strict_json((devlyn / "pipeline.state.json").read_text(encoding="utf-8"))
+    assert isinstance(state, dict)
+    engine = resolved_primary_engine(state)
+    assert isinstance(engine, str) and engine.strip()
+    stdout_paths = canonical_other_judge_stdout(devlyn, engine)
     if not required and not pair_trigger_present(devlyn):
         missing_violation = pair_trigger_missing_contract_violation(devlyn, source_verdicts)
         if missing_violation is not None:
@@ -896,27 +1271,65 @@ def detect_pair_stdout_contract_violations(
                 reason_violation["file"],
             )
         ]
-    if has_pair_findings(devlyn):
+    trigger_present = pair_trigger_present(devlyn)
+    if trigger_present and not required:
+        if pair_capture_exists(devlyn, stdout_paths):
+            source_verdicts["pair_judge"] = "BLOCKED"
+            return [
+                pair_blocker(
+                    "verify-pair-skipped-output-present",
+                    "Pair state is skipped or ineligible, but a canonical OTHER-judge carrier exists.",
+                    stdout_paths[0].name if stdout_paths else "verify.pair.findings.jsonl",
+                    "verify.pair.state-capture-contradiction",
+                )
+            ]
+        source_verdicts["pair_judge"] = None
         return []
+    if len(stdout_paths) > 1:
+        source_verdicts["pair_judge"] = "BLOCKED"
+        return [
+            pair_blocker(
+                "verify-pair-output-ambiguous",
+                "Multiple canonical OTHER-engine stdout carriers exist: "
+                + ", ".join(path.name for path in stdout_paths),
+                stdout_paths[0].name,
+            )
+        ]
+    if timeout_marker is not None:
+        expected_timeout_stdout = f"{timeout_marker['engine']}-judge.stdout"
+        if timeout_marker["engine"] == engine or (
+            stdout_paths and stdout_paths[0].name != expected_timeout_stdout
+        ):
+            source_verdicts["pair_judge"] = "BLOCKED"
+            return [
+                pair_blocker(
+                    "verify-pair-timeout-engine-mismatch",
+                    "Pair timeout engine does not match the canonical OTHER-engine carrier.",
+                    "verify.pair.timeout.json",
+                )
+            ]
     if not stdout_paths:
         if timeout_marker is not None:
-            source_verdicts["pair_judge"] = "TIMEOUT"
+            if rank(source_verdicts["pair_judge"]) <= rank("TIMEOUT"):
+                source_verdicts["pair_judge"] = "TIMEOUT"
             return []
         if required:
             source_verdicts["pair_judge"] = "BLOCKED"
             return [
                 pair_blocker(
                     "verify-pair-required-output-missing",
-                    "Pair-mode was required, but the pair-JUDGE produced no stdout or canonical findings file.",
+                    "Pair-mode was required, but the pair-JUDGE produced no canonical OTHER-engine stdout.",
                     "verify.pair.findings.jsonl",
                 )
             ]
         return []
+    if has_pair_findings(devlyn):
+        return []
     if source_verdicts["pair_judge"] is None and timeout_marker is None:
         source_verdicts["pair_judge"] = "PASS"
     for stdout_path in stdout_paths:
-        raw_text = stdout_path.read_text(encoding="utf-8")
-        if not raw_text.strip():
+        stdout_text = stdout_path.read_text(encoding="utf-8")
+        if not stdout_text.strip():
             if timeout_marker is not None:
                 continue
             source_verdicts["pair_judge"] = "BLOCKED"
@@ -927,41 +1340,27 @@ def detect_pair_stdout_contract_violations(
                     stdout_path.name,
                 )
             ]
-        has_jsonl_finding = False
-        has_nonpass_summary = False
-        for line in raw_text.splitlines():
-            raw = line.strip()
-            if not raw:
-                continue
-            if raw.startswith("# SUMMARY "):
-                try:
-                    summary = loads_strict_json(raw.removeprefix("# SUMMARY ").strip())
-                except ValueError:
-                    continue
-                if summary.get("verdict") in {"NEEDS_WORK", "FAIL", "BLOCKED"}:
-                    has_nonpass_summary = True
-                continue
-            if raw.startswith("#"):
-                continue
-            try:
-                item = loads_strict_json(raw)
-            except ValueError:
+        try:
+            stdout_findings, stdout_summary = JUDGE_OUTPUT_PARSER["collect_stdout"](stdout_path)
+        except SystemExit as exc:
+            if timeout_marker is not None and is_result_less_message_stream(stdout_text):
                 continue
-            if isinstance(item, dict) and str(item.get("severity") or "").upper() in {
-                "CRITICAL",
-                "HIGH",
-                "MEDIUM",
-                "LOW",
-            }:
-                has_jsonl_finding = True
-        if has_jsonl_finding or has_nonpass_summary:
+            source_verdicts["pair_judge"] = "BLOCKED"
+            return [
+                pair_blocker(
+                    "verify-pair-emission-contract-violated",
+                    f"pair-JUDGE stdout {stdout_path.name} violates the shared emission parser: {exc}",
+                    stdout_path.name,
+                )
+            ]
+        if stdout_findings or stdout_summary is None or stdout_summary["verdict"] != "PASS":
             source_verdicts["pair_judge"] = "BLOCKED"
             return [
                 pair_blocker(
                     "verify-pair-emission-contract-violated",
                     (
                         f"pair-JUDGE stdout {stdout_path.name} contained findings or a non-PASS "
-                        "summary, but the canonical pair findings JSONL file was empty."
+                        "verdict, but the canonical pair findings JSONL file was empty."
                     ),
                     stdout_path.name,
                 )
@@ -1004,11 +1403,47 @@ def write_state(devlyn: pathlib.Path, summary: dict[str, Any]) -> None:
     if not state_path.is_file():
         raise SystemExit(f"error: {state_path} not found")
     state = loads_strict_json(state_path.read_text(encoding="utf-8"))
+    try:
+        carrier = mechanical_evidence_carrier(devlyn)
+    except (PROCESS_EVIDENCE["EvidenceError"], OSError, UnicodeError, ValueError) as exc:
+        if summary.get("source_verdicts", {}).get("mechanical") != "BLOCKED":
+            raise SystemExit(f"error: invalid MECHANICAL process evidence: {exc}") from exc
+        carrier = None
+    if carrier is not None:
+        bound = state.get("process_evidence")
+        if bound is None:
+            bound = []
+        elif not isinstance(bound, list):
+            raise SystemExit("error: state.process_evidence must be null or an array")
+        same_round = [
+            item for item in bound
+            if isinstance(item, dict)
+            and item.get("phase") == carrier["phase"]
+            and item.get("round") == carrier["round"]
+        ]
+        if same_round and same_round != [carrier]:
+            raise SystemExit("error: state-bound VERIFY evidence disagrees with MECHANICAL results")
+        if not same_round:
+            bound.append(carrier)
+        state["process_evidence"] = bound
     phases = state.setdefault("phases", {})
     verify = phases.get("verify")
     if not isinstance(verify, dict):
         verify = {}
         phases["verify"] = verify
+    role_evidence = {}
+    try:
+        required_roles = JUDGE_ROLE_EVIDENCE["required_roles"](state)
+    except ValueError as exc:
+        if summary.get("source_verdicts", {}).get("judge") != "BLOCKED":
+            raise SystemExit(str(exc)) from exc
+        required_roles = []  # Persist the invalid-resolution failure; no legacy dispatch.
+    for role in required_roles:
+        source = "judge" if role == "primary_judge" else "pair_judge"
+        if summary.get("source_verdicts", {}).get(source) in {"PASS", "PASS_WITH_ISSUES", "NEEDS_WORK"}:
+            role_evidence[role] = JUDGE_ROLE_EVIDENCE["authenticate"](devlyn, state, role)
+    if role_evidence:
+        verify["role_evidence"] = role_evidence
     verify["verdict"] = summary["verdict"]
     sub = verify.get("sub_verdicts")
     if sub is None:
@@ -1034,15 +1469,28 @@ def write_state(devlyn: pathlib.Path, summary: dict[str, Any]) -> None:
 
 
 def self_test() -> int:
+    import subprocess
+
+    try:
+        loads_strict_json('{"verdict":"PASS","verdict":"BLOCKED"}')
+    except ValueError as exc:
+        assert "duplicate JSON key" in str(exc)
+    else:
+        raise AssertionError("duplicate VERIFY authority key was accepted")
     with tempfile.TemporaryDirectory() as tmp:
         devlyn = pathlib.Path(tmp)
 
+        # Every completed VERIFY has deterministic mechanical and primary
+        # judge carriers.  Missing either one is an evidence failure, not PASS.
+        (devlyn / "verify-mechanical.findings.jsonl").write_text("", encoding="utf-8")
+
         # state-phase-write.py's spawn always writes sub_verdicts: null (the
         # per-round reset contract, state-schema.md#write-protocol) — this is
         # the real shape write_state() sees on every VERIFY completion, not
         # the pre-populated {} the other scenarios below seed for brevity.
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": None,
@@ -1054,6 +1502,152 @@ def self_test() -> int:
             encoding="utf-8",
         )
         (devlyn / "verify.findings.jsonl").write_text("", encoding="utf-8")
+
+        sealed_work = pathlib.Path(tmp) / "sealed-work"
+        sealed_devlyn = sealed_work / ".devlyn"
+        sealed_devlyn.mkdir(parents=True)
+        sealed_state = {
+            "run_id": "rs-sealed-mechanical",
+            "engine": "claude",
+            "process_evidence": None,
+            "phases": {"verify": {"round": 2, "verdict": None, "sub_verdicts": None}},
+        }
+        obligation = PROCESS_EVIDENCE["normalize_obligation"]({
+            "id": "mechanical-0",
+            "phase": "verify",
+            "argv": [sys.executable, "-c", "print('sealed')"],
+        })
+        manifest_rel = PROCESS_EVIDENCE["manifest_relative_path"](sealed_state, "verify")
+        PROCESS_EVIDENCE["capture_process"](
+            sealed_work, sealed_work / manifest_rel, sealed_state["run_id"],
+            "verify", 2, obligation,
+        )
+        carrier = PROCESS_EVIDENCE["validate_manifest"](
+            sealed_work, manifest_rel, sealed_state["run_id"], "verify", 2,
+            [obligation], require_expectations=False,
+        )
+        (sealed_devlyn / "pipeline.state.json").write_text(
+            json.dumps(sealed_state), encoding="utf-8",
+        )
+        sealed_commands = PROCESS_EVIDENCE["bound_carrier_summary_commands"](
+            sealed_work, carrier,
+        )
+        (sealed_devlyn / "spec-verify.results.json").write_text(
+            json.dumps({"commands": sealed_commands, "process_evidence": carrier}),
+            encoding="utf-8",
+        )
+        (sealed_devlyn / "verify-mechanical.findings.jsonl").write_text("", encoding="utf-8")
+        (sealed_devlyn / "verify.findings.jsonl").write_text("", encoding="utf-8")
+        sealed_findings, sealed_verdicts = read_findings(sealed_devlyn)
+        assert sealed_verdicts["mechanical"] == "PASS", sealed_findings
+        sealed_summary = write_outputs(sealed_devlyn, sealed_findings, sealed_verdicts)
+        write_state(sealed_devlyn, sealed_summary)
+        bound_state = loads_strict_json(
+            (sealed_devlyn / "pipeline.state.json").read_text(encoding="utf-8")
+        )
+        assert bound_state["process_evidence"] == [carrier], bound_state
+
+        failed_work = pathlib.Path(tmp) / "failed-work"
+        failed_devlyn = failed_work / ".devlyn"
+        failed_devlyn.mkdir(parents=True)
+        failed_state = {
+            "version": "3.0",
+            "run_id": "rs-failed-mechanical",
+            "engine": "claude",
+            "source": {"type": "spec", "spec_path": "docs/failed/spec.md"},
+            "process_evidence": None,
+            "phases": {"verify": {"round": 0, "verdict": None, "sub_verdicts": None}},
+        }
+        failed_spec = failed_work / "docs" / "failed"
+        failed_spec.mkdir(parents=True)
+        (failed_spec / "spec.md").write_text("# failed fixture\n", encoding="utf-8")
+        (failed_spec / "spec.expected.json").write_text(json.dumps({
+            "verification_commands": [{"cmd": "exit 7", "exit_code": 0}],
+        }) + "\n", encoding="utf-8")
+        failed_obligation = PROCESS_EVIDENCE["normalize_obligation"]({
+            "id": "verification-command-0001",
+            "phase": "verify",
+            "cmd": "exit 7",
+        })
+        failed_manifest = PROCESS_EVIDENCE["manifest_relative_path"](failed_state, "verify")
+        PROCESS_EVIDENCE["capture_process"](
+            failed_work, failed_work / failed_manifest, failed_state["run_id"],
+            "verify", 0, failed_obligation,
+        )
+        failed_carrier = PROCESS_EVIDENCE["validate_manifest"](
+            failed_work, failed_manifest, failed_state["run_id"], "verify", 0,
+            [failed_obligation], require_expectations=False,
+        )
+        (failed_devlyn / "pipeline.state.json").write_text(
+            json.dumps(failed_state), encoding="utf-8",
+        )
+        # Exact laundering attempt: mutable derivatives say PASS/empty while
+        # the state-identical sealed manifest still records the failed command.
+        laundered_commands = PROCESS_EVIDENCE["bound_carrier_summary_commands"](
+            failed_work, failed_carrier,
+        )
+        laundered_commands[0]["pass"] = True
+        (failed_devlyn / "spec-verify.results.json").write_text(json.dumps({
+            "commands": laundered_commands, "process_evidence": failed_carrier,
+        }), encoding="utf-8")
+        (failed_devlyn / "verify-mechanical.findings.jsonl").write_text("", encoding="utf-8")
+        (failed_devlyn / "verify.findings.jsonl").write_text("", encoding="utf-8")
+        failed_findings, failed_verdicts = read_findings(failed_devlyn)
+        assert failed_verdicts["mechanical"] == "BLOCKED", failed_verdicts
+        assert any(
+            item.get("id") == "verify-mechanical-evidence-invalid"
+            for item in failed_findings
+        ), failed_findings
+        assert write_outputs(failed_devlyn, failed_findings, failed_verdicts)["verdict"] == "BLOCKED"
+
+        (failed_devlyn / "spec-verify.results.json").write_text(json.dumps({
+            "commands": [], "process_evidence": None,
+        }), encoding="utf-8")
+        removed_findings, removed_verdicts = read_findings(failed_devlyn)
+        assert removed_verdicts["mechanical"] == "BLOCKED", removed_verdicts
+        assert any(
+            item.get("id") == "verify-mechanical-evidence-invalid"
+            for item in removed_findings
+        ), removed_findings
+        print("PASS iter-0112 sealed VERIFY outcome resists mutable-derivative laundering")
+
+        sealed_stdout = sealed_work / carrier["streams"][0]["stdout"]["path"]
+        sealed_stdout.write_bytes(sealed_stdout.read_bytes() + b"altered")
+        altered_findings, altered_verdicts = read_findings(sealed_devlyn)
+        assert altered_verdicts["mechanical"] == "BLOCKED", altered_verdicts
+        assert any(
+            finding.get("id") == "verify-mechanical-evidence-invalid"
+            for finding in altered_findings
+        ), altered_findings
+
+        skipped_work = pathlib.Path(tmp) / "skipped-work"
+        skipped_work.mkdir()
+        (skipped_work / "pipeline.state.json").write_text(json.dumps({
+            "engine": "claude",
+            "risk_profile": {"pair_default_enabled": False},
+            "phases": {"verify": {"pair_trigger": {
+                "eligible": False,
+                "reasons": [],
+                "skipped_reason": "user_no_pair",
+            }}},
+        }), encoding="utf-8")
+        (skipped_work / "verify-mechanical.findings.jsonl").write_text("", encoding="utf-8")
+        (skipped_work / "verify.findings.jsonl").write_text("", encoding="utf-8")
+        generic_primary = skipped_work / "verify-judge.stdout"
+        for generic_output in ("PASS\n", "NEEDS_WORK\n"):
+            generic_primary.write_text(generic_output, encoding="utf-8")
+            generic_findings, generic_verdicts = read_findings(skipped_work)
+            assert generic_verdicts["pair_judge"] is None, generic_verdicts
+            assert not any(
+                finding.get("file") == generic_primary.name for finding in generic_findings
+            ), generic_findings
+        (skipped_work / "codex-judge.stdout").write_text("PASS\n", encoding="utf-8")
+        contradiction_findings, contradiction_verdicts = read_findings(skipped_work)
+        assert contradiction_verdicts["pair_judge"] == "BLOCKED", contradiction_verdicts
+        assert any(
+            finding.get("id") == "verify-pair-skipped-output-present"
+            for finding in contradiction_findings
+        ), contradiction_findings
         findings, source_verdicts = read_findings(devlyn)
         summary = write_outputs(devlyn, findings, source_verdicts)
         write_state(devlyn, summary)
@@ -1065,12 +1659,92 @@ def self_test() -> int:
         assert state["phases"]["verify"]["judge_durations_ms"] == {
             "judge": 23, "pair_judge": 31,
         }, state
+        original_state = (devlyn / "pipeline.state.json").read_bytes()
+        for malformed in (None, {}, {"roles": {}}):
+            bad_state = loads_strict_json(original_state)
+            bad_state["role_resolution"] = malformed
+            (devlyn / "pipeline.state.json").write_text(json.dumps(bad_state))
+            result = subprocess.run([sys.executable, str(pathlib.Path(__file__).resolve()),
+                                     "--devlyn-dir", str(devlyn), "--write-state"], capture_output=True, text=True)
+            assert result.returncode == 0 and "Traceback" not in result.stderr, result.stderr
+            persisted = loads_strict_json((devlyn / "pipeline.state.json").read_text())
+            assert persisted["phases"]["verify"]["verdict"] == "BLOCKED"
+            assert "verify-role-resolution-invalid" in (devlyn / "verify-merged.findings.jsonl").read_text()
+        (devlyn / "pipeline.state.json").write_bytes(original_state)
+        different_primary = {"engine": "codex", "phases": {"verify": {"engine": "claude"}}}
+        (devlyn / "pipeline.state.json").write_text(json.dumps(different_primary))
+        (devlyn / "verify.primary.timeout.json").write_text(json.dumps({"engine": "claude", "budget_seconds": 600}))
+        marker, violation = read_primary_timeout_marker(devlyn)
+        assert marker is not None and violation is None
+        different_primary["phases"]["verify"]["engine"] = None
+        (devlyn / "pipeline.state.json").write_text(json.dumps(different_primary))
+        assert read_primary_timeout_marker(devlyn)[1] is not None
+        (devlyn / "verify.primary.timeout.json").unlink()
+        (devlyn / "pipeline.state.json").write_bytes(original_state)
+
+        (devlyn / "verify.findings.jsonl").unlink()
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        assert summary["verdict"] == "BLOCKED", summary
+        assert summary["source_verdicts"]["judge"] == "BLOCKED", summary
+        assert any(
+            finding["id"] == "verify-merge-required-source-missing-judge"
+            for finding in findings
+        ), findings
+
+        # iter-0113: a valid primary timeout is an explicit BLOCKED source,
+        # never the generic missing-source path or pair-style TIMEOUT.
+        (devlyn / "verify.primary.timeout.json").write_text(
+            json.dumps({"engine": "claude", "budget_seconds": 600}) + "\n",
+            encoding="utf-8",
+        )
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        assert summary["verdict"] == "BLOCKED", summary
+        assert summary["source_verdicts"]["judge"] == "BLOCKED", summary
+        assert any(
+            finding["id"] == "verify-primary-timeout"
+            for finding in findings
+        ), findings
+        assert not any(
+            finding["id"] == "verify-merge-required-source-missing-judge"
+            for finding in findings
+        ), findings
+
+        (devlyn / "verify.findings.jsonl").write_text(
+            json.dumps({"id": "primary-timeout-high", "severity": "HIGH"}) + "\n",
+            encoding="utf-8",
+        )
+        findings, source_verdicts = read_findings(devlyn)
+        assert source_verdicts["judge"] == "BLOCKED", source_verdicts
+        assert {finding["id"] for finding in findings} >= {
+            "primary-timeout-high", "verify-primary-timeout",
+        }, findings
+
+        for marker, expected_id in (
+            ("{\n", "verify-primary-timeout-marker-malformed"),
+            (
+                json.dumps({"engine": "codex", "budget_seconds": 600}) + "\n",
+                "verify-primary-timeout-engine-mismatch",
+            ),
+            (
+                json.dumps({"engine": "claude", "budget_seconds": 601}) + "\n",
+                "verify-primary-timeout-budget-mismatch",
+            ),
+        ):
+            (devlyn / "verify.primary.timeout.json").write_text(marker, encoding="utf-8")
+            findings, source_verdicts = read_findings(devlyn)
+            assert source_verdicts["judge"] == "BLOCKED", source_verdicts
+            assert any(finding["id"] == expected_id for finding in findings), findings
+        (devlyn / "verify.primary.timeout.json").unlink()
+        (devlyn / "verify.findings.jsonl").write_text("", encoding="utf-8")
 
         # iter-0072 Amendment 3: generated schema-v3 runs mechanically prove
         # raw-goal persistence and required SURFACE_CLOSE dispatch.
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "version": "3.0",
+                "engine": "claude",
                 "complexity": "large",
                 "source": {"type": "generated"},
                 "phases": {"verify": {"verdict": None, "sub_verdicts": None}},
@@ -1089,6 +1763,7 @@ def self_test() -> int:
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "version": "3.0",
+                "engine": "claude",
                 "complexity": "large",
                 "source": {"type": "generated", "goal_path": "", "goal_sha256": "A" * 64},
             }),
@@ -1106,6 +1781,7 @@ def self_test() -> int:
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "version": "3.0",
+                "engine": "claude",
                 "complexity": "medium",
                 "source": generated_source,
                 "phases": {
@@ -1134,6 +1810,7 @@ def self_test() -> int:
             (devlyn / "pipeline.state.json").write_text(
                 json.dumps({
                     "version": "3.0",
+                    "engine": "claude",
                     "complexity": "medium",
                     "source": generated_source,
                     "phases": {"surface_close": surface_entry},
@@ -1145,6 +1822,7 @@ def self_test() -> int:
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "version": "3.0",
+                "engine": "claude",
                 "complexity": "medium",
                 "source": generated_source,
                 "phases": {
@@ -1161,15 +1839,15 @@ def self_test() -> int:
 
         for state_shape in (
             {
-                "version": "3.0", "complexity": "medium",
+                "version": "3.0", "engine": "claude", "complexity": "medium",
                 "source": {"type": "spec"}, "phases": {"surface_close": None},
             },
             {
-                "version": "3.0", "complexity": "large",
+                "version": "3.0", "engine": "claude", "complexity": "large",
                 "source": generated_source, "phases": {"surface_close": None},
             },
             {
-                "version": "2.0", "complexity": "medium",
+                "version": "2.0", "engine": "claude", "complexity": "medium",
                 "source": {"type": "generated"}, "phases": {"surface_close": None},
             },
         ):
@@ -1184,6 +1862,7 @@ def self_test() -> int:
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "version": "3.0",
+                "engine": "claude",
                 "mode": "spec",
                 "risk_profile": {"pair_default_enabled": True},
                 "phases": {
@@ -1211,7 +1890,7 @@ def self_test() -> int:
         # A non-null, non-dict sub_verdicts is corrupted state, not a legal
         # placeholder — write_state() must fail loud, not silently coerce it.
         (devlyn / "pipeline.state.json").write_text(
-            json.dumps({"phases": {"verify": {"verdict": None, "sub_verdicts": "corrupt"}}}),
+            json.dumps({"engine": "claude", "phases": {"verify": {"verdict": None, "sub_verdicts": "corrupt"}}}),
             encoding="utf-8",
         )
         findings, source_verdicts = read_findings(devlyn)
@@ -1225,6 +1904,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1247,6 +1927,7 @@ def self_test() -> int:
             json.dumps({"id": "p1", "severity": "HIGH"}) + "\n",
             encoding="utf-8",
         )
+        (devlyn / "codex-judge.stdout").write_text("PASS\n", encoding="utf-8")
         findings, source_verdicts = read_findings(devlyn)
         summary = write_outputs(devlyn, findings, source_verdicts)
         write_state(devlyn, summary)
@@ -1255,6 +1936,7 @@ def self_test() -> int:
         assert state["phases"]["verify"]["verdict"] == "NEEDS_WORK", state
         assert state["phases"]["verify"]["sub_verdicts"]["pair_judge"] == "NEEDS_WORK", state
         assert (devlyn / "verify-merged.findings.jsonl").read_text(encoding="utf-8")
+        (devlyn / "codex-judge.stdout").unlink()
         (devlyn / "verify.findings.jsonl").write_text(
             '{"id":"nan","severity":NaN}\n',
             encoding="utf-8",
@@ -1268,7 +1950,7 @@ def self_test() -> int:
             for finding in findings
         ), findings
         (devlyn / "pipeline.state.json").write_text(
-            json.dumps({"phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}}}),
+            json.dumps({"engine": "claude", "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}}}),
             encoding="utf-8",
         )
         (devlyn / "verify.findings.jsonl").write_text("", encoding="utf-8")
@@ -1296,6 +1978,10 @@ def self_test() -> int:
         # Engine-neutral stdout contract (iter-0060): a Claude pair-judge
         # capture (claude-judge.stdout, adapters/claude.md ## Invocation)
         # binds the same emission contract as the Codex one.
+        (devlyn / "pipeline.state.json").write_text(
+            json.dumps({"engine": "codex", "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}}}),
+            encoding="utf-8",
+        )
         (devlyn / "claude-judge.stdout").write_text(
             json.dumps({"id": "clj1", "severity": "HIGH"}) + "\n",
             encoding="utf-8",
@@ -1314,6 +2000,7 @@ def self_test() -> int:
         # records TIMEOUT and leaves the merged verdict to mechanical+primary.
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "codex",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1353,7 +2040,7 @@ def self_test() -> int:
 
         # iter-0065 case 2: canonical pair findings still bind after timeout.
         (devlyn / "pipeline.state.json").write_text(
-            json.dumps({"phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}}}),
+            json.dumps({"engine": "claude", "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}}}),
             encoding="utf-8",
         )
         (devlyn / "verify.pair.findings.jsonl").write_text(
@@ -1375,7 +2062,7 @@ def self_test() -> int:
         # iter-0065 case 2b: stdout-only HIGH still blocks on emission contract;
         # timeout never converts an observed finding into a solo pass.
         (devlyn / "pipeline.state.json").write_text(
-            json.dumps({"phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}}}),
+            json.dumps({"engine": "claude", "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}}}),
             encoding="utf-8",
         )
         (devlyn / "codex-judge.stdout").write_text(
@@ -1397,9 +2084,125 @@ def self_test() -> int:
         (devlyn / "codex-judge.stdout").unlink()
         (devlyn / "verify.pair.timeout.json").unlink()
 
+        # iter-0106: a budget abort can truncate the whole-message stream before
+        # its terminal result. With a valid marker that capture stays TIMEOUT.
+        (devlyn / "pipeline.state.json").write_text(
+            json.dumps({
+                "engine": "claude",
+                "phases": {
+                    "verify": {
+                        "verdict": "PASS",
+                        "sub_verdicts": {},
+                        "pair_trigger": {
+                            "eligible": True,
+                            "reasons": ["judge.warning"],
+                            "skipped_reason": None,
+                        },
+                    }
+                }
+            }),
+            encoding="utf-8",
+        )
+        partial_stream = (
+            '{"type":"system","subtype":"init","session_id":"s106"}\n'
+            '{"type":"assistant","session_id":"s106","message":{"stop_reason":null,'
+            '"content":[{"type":"text","text":"reading the diff"}]}}\n'
+        )
+        (devlyn / "grok-judge.stdout").write_text(partial_stream, encoding="utf-8")
+        (devlyn / "verify.pair.timeout.json").write_text(
+            json.dumps({"engine": "grok", "budget_seconds": 600}),
+            encoding="utf-8",
+        )
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        assert summary["verdict"] == "PASS", summary
+        assert summary["source_verdicts"]["pair_judge"] == "TIMEOUT", summary
+        assert summary["pair_timeout"] == {"engine": "grok", "budget_seconds": 600}, summary
+        assert not findings, findings
+
+        # A kill may cut the final JSON record mid-write; one malformed tail is
+        # still a valid prefix, while malformed/unknown complete records are not.
+        (devlyn / "grok-judge.stdout").write_text(
+            partial_stream + '{"type":"assistant","session_id":"s106"',
+            encoding="utf-8",
+        )
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        assert summary["source_verdicts"]["pair_judge"] == "TIMEOUT", summary
+        assert not findings, findings
+
+        for invalid_prefix in (
+            '{"type":"system","subtype":"init"}\n',
+            partial_stream + "trailing narration\n",
+            partial_stream
+            + '{"type":"user","session_id":"other"}\n',
+            partial_stream
+            + '{"type":"stream_event","session_id":"s106"}\n',
+            partial_stream
+            + '{"type":"system","subtype":"compact_boundary","session_id":"s106"}\n',
+            partial_stream
+            + '{"type":"assistant"\n'
+            + '{"type":"user","session_id":"s106"}\n',
+        ):
+            (devlyn / "grok-judge.stdout").write_text(invalid_prefix, encoding="utf-8")
+            findings, source_verdicts = read_findings(devlyn)
+            summary = write_outputs(devlyn, findings, source_verdicts)
+            assert summary["source_verdicts"]["pair_judge"] == "BLOCKED", summary
+            assert any(
+                finding.get("id") == "verify-pair-emission-contract-violated"
+                for finding in findings
+            ), findings
+
+        # iter-0106 control: the marker conserves TIMEOUT only for that shape. A
+        # stream that reached its result but welded narration into the terminal
+        # message stays BLOCKED on the emission contract.
+        (devlyn / "grok-judge.stdout").write_text(
+            '{"type":"system","subtype":"init","session_id":"s106"}\n'
+            + json.dumps({
+                "type": "assistant",
+                "session_id": "s106",
+                "message": {
+                    "stop_reason": "end_turn",
+                    "content": [{"type": "text", "text": "I reviewed the diff.\nPASS"}],
+                },
+            }) + "\n"
+            + json.dumps({
+                "type": "result",
+                "subtype": "success",
+                "is_error": False,
+                "stop_reason": "end_turn",
+                "session_id": "s106",
+                "result": "I reviewed the diff.\nPASS",
+            }) + "\n",
+            encoding="utf-8",
+        )
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        assert summary["verdict"] == "BLOCKED", summary
+        assert summary["source_verdicts"]["pair_judge"] == "BLOCKED", summary
+        assert any(
+            finding.get("id") == "verify-pair-emission-contract-violated"
+            for finding in findings
+        ), findings
+        (devlyn / "verify.pair.timeout.json").unlink()
+
+        # iter-0106 control: without a marker the same truncated stream is a
+        # plain emission-contract violation.
+        (devlyn / "grok-judge.stdout").write_text(partial_stream, encoding="utf-8")
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        assert summary["verdict"] == "BLOCKED", summary
+        assert summary["source_verdicts"]["pair_judge"] == "BLOCKED", summary
+        assert any(
+            finding.get("id") == "verify-pair-emission-contract-violated"
+            for finding in findings
+        ), findings
+        (devlyn / "grok-judge.stdout").unlink()
+
         # iter-0065 case 3: without a marker, required empty pair output remains BLOCKED.
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "codex",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1426,7 +2229,7 @@ def self_test() -> int:
 
         # iter-0065 malformed timeout markers fail closed as a CRITICAL pair blocker.
         (devlyn / "pipeline.state.json").write_text(
-            json.dumps({"phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}}}),
+            json.dumps({"engine": "claude", "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}}}),
             encoding="utf-8",
         )
         (devlyn / "verify.pair.timeout.json").write_text(
@@ -1445,6 +2248,7 @@ def self_test() -> int:
         (devlyn / "verify.pair.timeout.json").unlink()
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1472,6 +2276,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "risk_profile": {
                     "high_risk": True,
@@ -1492,6 +2297,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "risk_profile": "enabled",
                 "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}},
@@ -1509,6 +2315,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "risk_profile": {
                     "high_risk": True,
@@ -1530,6 +2337,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "risk_profile": {
                     "high_risk": True,
@@ -1552,6 +2360,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "pair_verify": True,
                 "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}},
@@ -1569,6 +2378,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "complexity": "large",
                 "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}},
@@ -1591,6 +2401,7 @@ def self_test() -> int:
         )
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "source": {"spec_path": str(spec_path)},
                 "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}},
@@ -1628,6 +2439,7 @@ def self_test() -> int:
         ) is False
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "source": {"spec_path": str(spec_path)},
                 "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}},
@@ -1676,6 +2488,7 @@ def self_test() -> int:
         ) is True
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "source": {"spec_path": str(spec_path)},
                 "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}},
@@ -1693,6 +2506,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "source": {"spec_path": str(spec_path)},
                 "risk_profile": {
@@ -1733,6 +2547,7 @@ def self_test() -> int:
         ) is True
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "free-form",
                 "source": {"criteria_path": str(criteria_path)},
                 "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}},
@@ -1763,6 +2578,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1787,6 +2603,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1811,6 +2628,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1836,6 +2654,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1861,6 +2680,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1886,6 +2706,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1910,6 +2731,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1934,6 +2756,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1958,6 +2781,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -1982,6 +2806,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "risk_profile": {
                     "high_risk": True,
@@ -2013,6 +2838,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "risk_profile": {
                     "high_risk": True,
@@ -2044,6 +2870,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "pair_verify": True,
                 "risk_profile": {
                     "high_risk": True,
@@ -2074,6 +2901,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "mode": "spec",
                 "risk_profile": {
                     "high_risk": True,
@@ -2104,6 +2932,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -2128,6 +2957,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -2152,6 +2982,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -2185,10 +3016,34 @@ def self_test() -> int:
             finding.get("id") == "verify-pair-trigger-mechanical-blocker-unsupported"
             for finding in findings
         ), findings
+        (devlyn / "pipeline.state.json").write_text(
+            json.dumps({
+                "engine": "claude",
+                "phases": {
+                    "verify": {
+                        "verdict": None,
+                        "sub_verdicts": None,
+                        "judge_durations_ms": {"judge": None, "pair_judge": None},
+                    }
+                }
+            }),
+            encoding="utf-8",
+        )
+        (devlyn / "verify.findings.jsonl").unlink()
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        write_state(devlyn, summary)
+        state = loads_strict_json((devlyn / "pipeline.state.json").read_text(encoding="utf-8"))
+        assert summary["verdict"] == "NEEDS_WORK", summary
+        assert summary["source_verdicts"]["judge"] is None, summary
+        assert state["phases"]["verify"]["verdict"] == "NEEDS_WORK", state
+        assert state["phases"]["verify"]["sub_verdicts"]["judge"] is None, state
+        (devlyn / "verify.findings.jsonl").write_text("", encoding="utf-8")
         (devlyn / "verify-mechanical.findings.jsonl").write_text("", encoding="utf-8")
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {
                     "verify": {
                         "verdict": "PASS",
@@ -2220,6 +3075,7 @@ def self_test() -> int:
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "version": "2.0",
+                "engine": "claude",
                 "mode": "spec",
                 "pair_verify": True,
                 "phases": {
@@ -2249,6 +3105,7 @@ def self_test() -> int:
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "version": "3.0",
+                "engine": "claude",
                 "mode": "spec",
                 "pair_verify": True,
                 "phases": {
@@ -2269,6 +3126,7 @@ def self_test() -> int:
             json.dumps({"id": "p-preknown", "severity": "LOW"}) + "\n",
             encoding="utf-8",
         )
+        (devlyn / "codex-judge.stdout").write_text("PASS\n", encoding="utf-8")
         findings, source_verdicts = read_findings(devlyn)
         summary = write_outputs(devlyn, findings, source_verdicts)
         assert summary["verdict"] == "BLOCKED", summary
@@ -2288,12 +3146,14 @@ def self_test() -> int:
         assert '"id":"p-preknown"' in (
             devlyn / "verify-merged.findings.jsonl"
         ).read_text(encoding="utf-8"), findings
+        (devlyn / "codex-judge.stdout").unlink()
 
         # Self-test: archived-v2 sequential primary blocker remains legal.
         (devlyn / "verify.pair.findings.jsonl").unlink()
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "version": "2.0",
+                "engine": "claude",
                 "mode": "spec",
                 "phases": {
                     "verify": {
@@ -2336,6 +3196,7 @@ def self_test() -> int:
 
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
+                "engine": "claude",
                 "phases": {"verify": {"verdict": "PASS", "sub_verdicts": {}}},
                 "verify": {
                     "pair_trigger": {
@@ -2359,7 +3220,7 @@ def self_test() -> int:
         # PASS stdout from a claude judge promotes pair_judge null -> PASS.
         (devlyn / "verify.pair.findings.jsonl").unlink()
         (devlyn / "pipeline.state.json").write_text(
-            json.dumps({"phases": {"verify": {"verdict": None, "sub_verdicts": None}}}),
+            json.dumps({"engine": "codex", "phases": {"verify": {"verdict": None, "sub_verdicts": None}}}),
             encoding="utf-8",
         )
         (devlyn / "claude-judge.stdout").write_text("PASS\n", encoding="utf-8")
@@ -2369,6 +3230,47 @@ def self_test() -> int:
         state = loads_strict_json((devlyn / "pipeline.state.json").read_text(encoding="utf-8"))
         assert summary["verdict"] == "PASS", summary
         assert state["phases"]["verify"]["sub_verdicts"]["pair_judge"] == "PASS", state
+        (devlyn / "claude-judge.stdout").unlink()
+
+        # The primary capture must not be misattributed to the OTHER-engine
+        # pair seat merely because both adapters use *-judge.stdout names.
+        (devlyn / "pipeline.state.json").write_text(
+            json.dumps({"engine": "claude", "phases": {"verify": {"verdict": None, "sub_verdicts": None}}}),
+            encoding="utf-8",
+        )
+        (devlyn / "claude-judge.stdout").write_text("primary prose\n", encoding="utf-8")
+        (devlyn / "codex-judge.stdout").write_text("PASS\n", encoding="utf-8")
+        findings, source_verdicts = read_findings(devlyn)
+        assert source_verdicts["pair_judge"] == "PASS", source_verdicts
+        assert not any(finding["source"] == "pair_judge" for finding in findings), findings
+        (devlyn / "codex-judge.stdout").write_text("pair prose\n", encoding="utf-8")
+        findings, source_verdicts = read_findings(devlyn)
+        assert source_verdicts["pair_judge"] == "BLOCKED", source_verdicts
+        assert any(finding["id"] == "verify-pair-emission-contract-violated" for finding in findings)
+        (devlyn / "claude-judge.stdout").unlink()
+        (devlyn / "codex-judge.stdout").unlink()
+
+        # A primary capture cannot become pair evidence when the state needed
+        # to identify the primary seat is absent, incomplete, or malformed.
+        (devlyn / "claude-judge.stdout").write_text("primary prose\n", encoding="utf-8")
+        (devlyn / "pipeline.state.json").unlink()
+        findings, source_verdicts = read_findings(devlyn)
+        assert source_verdicts["pair_judge"] == "BLOCKED", source_verdicts
+        assert any(finding["id"] == "verify-state-missing" for finding in findings), findings
+        assert not any(finding.get("file") == "claude-judge.stdout" for finding in findings), findings
+
+        (devlyn / "pipeline.state.json").write_text(
+            json.dumps({"version": "3.0", "phases": {"verify": {}}}), encoding="utf-8",
+        )
+        findings, source_verdicts = read_findings(devlyn)
+        assert source_verdicts["pair_judge"] == "BLOCKED", source_verdicts
+        assert any(finding.get("rule_id") == "verify.state.engine-malformed" for finding in findings), findings
+
+        (devlyn / "pipeline.state.json").write_text("{", encoding="utf-8")
+        findings, source_verdicts = read_findings(devlyn)
+        assert source_verdicts["pair_judge"] == "BLOCKED", source_verdicts
+        assert any(finding["id"] == "verify-pair-trigger-state-malformed" for finding in findings), findings
+        (devlyn / "claude-judge.stdout").unlink()
 
         # iter-0083: canonical summary verdict conservation.
         iter_0083_paths = (
@@ -2398,6 +3300,11 @@ def self_test() -> int:
             timeout: bool = False,
         ) -> tuple[list[dict[str, Any]], dict[str, Any]]:
             iter_0083_reset()
+            (devlyn / "pipeline.state.json").write_text(
+                json.dumps({"engine": "claude", "phases": {"verify": {}}}), encoding="utf-8",
+            )
+            (devlyn / "verify-mechanical.findings.jsonl").write_text("", encoding="utf-8")
+            (devlyn / "verify.findings.jsonl").write_text("", encoding="utf-8")
             if carrier is not None:
                 content = (
                     json.dumps({"id": "iter-0083", "severity": severity}) + "\n"
@@ -2418,7 +3325,7 @@ def self_test() -> int:
                 )
             if timeout:
                 (devlyn / "verify.pair.timeout.json").write_text(
-                    json.dumps({"engine": "claude", "budget_seconds": 600}),
+                    json.dumps({"engine": "codex", "budget_seconds": 600}),
                     encoding="utf-8",
                 )
             case_findings, case_source_verdicts = read_findings(devlyn)