omnilane 0.42.2 → 0.42.5

package/docs/release-notes-0.42.5.md

@@ -0,0 +1,99 @@
+# Omnilane 0.42.5
+
+This release stops one vendor's CLI upgrade from refusing every vendor's dispatch,
+makes that failure visible in `omnilane doctor`, and stops the probe harness from
+signing evidence it never read. Routing, scores, and the frozen AA registry are
+unchanged.
+
+## Why
+
+On 2026-09-09 `agy` was upgraded from 1.1.27 to 1.1.28. That changed its sha256,
+and `apply_transport_overlay` compared every evidence hash in one loop and raised
+on the first mismatch, so `load_registry` failed and **every** dispatch was
+refused:
+
+```json
+{"allowed":false,"code":"invalid-policy-input","message":"transport contract evidence changed"}
+```
+
+Only the seven gemini mappings depended on that binary; the other forty-two were
+collateral. `omnilane doctor` reported 19 passed, 0 failed throughout, because no
+check ever loaded the overlay.
+
+Re-probing showed the upgrade had changed nothing observable: all six agy
+selectors still answered correctly. The outage was entirely the blast radius of a
+config linter that had been given the authority of a security gate.
+
+The same investigation found six `claude-fable-5-1` configurations that had been
+unusable since 2026-09-07. Their probes had failed with a quota refusal, and
+`build_overlay.py` simply omitted them — no record, no warning, nothing for an
+operator to notice.
+
+## Changes
+
+### Evidence staleness is per vendor
+
+- Overlay `evidence[]` entries take an optional `vendor` tag. A tagged entry whose
+  hash drifts, or whose file no longer exists, marks that vendor stale and skips
+  the `verified` upgrade for its mappings; `decide()` then returns
+  `unknown-target-runtime` for that vendor alone.
+- Untagged entries keep the previous global fail-closed behaviour, so overlays
+  built before the tags exist are unaffected.
+- Missing files are treated as staleness, not corruption: the codex and claude
+  evidence paths embed version directories, so their upgrades delete the file
+  rather than change its digest.
+- Structural overlay checks — schema, snapshot, host, exact identity, selector
+  type, effort alignment — remain hard failures.
+
+### Doctor loads the overlay
+
+- A new `transport-overlay` check loads the configured overlay through
+  `aa_policy.load_registry` and names the offending file and vendor on failure.
+  It reports per-vendor verified counts on success and warns when a vendor has
+  degraded. `live-capable` is unchanged: it answers whether a CLI supports a live
+  session, which stays true while the gate refuses the vendor.
+
+### Probes record a verdict
+
+- `probe.py` now derives a `verdict`, `verdict_reason`, `observed_model`, and
+  `probed_at` from the raw evidence through a pure function, per vendor:
+  - Claude responses are judged on `modelUsage` — the billed model the CLI
+    reports — plus `is_error`, and are failed when stderr shows the CLI silently
+    substituted the default effort for an unknown `--effort`. Effort is half of a
+    scored identity, so that path would otherwise certify a mapping at the wrong
+    tier while exit status, `is_error`, `modelUsage`, and the expected token all
+    look correct.
+  - grok and agy reject invalid input outright, so exit status and a clean stderr
+    are sufficient.
+  - codex prints a banner to stderr on every run, so stderr is recorded for review
+    rather than treated as failure.
+- `build_overlay.py` refuses to sign a non-passing probe and records it in a new
+  `unproven[]` block with its reason, so a quota refusal is visible instead of
+  silently dropping configurations. Evidence predating the verdict field is
+  still signed, with a warning naming each legacy entry.
+- The six `claude-fable-5-1` and `claude-fable-5` configurations are listed in
+  the probe table so their failures reach `unproven[]`. Re-probing them on
+  2026-09-09 returned the same quota refusal as on 09-07, so they remain
+  unusable — but `omnilane doctor` now says so rather than leaving an operator
+  to discover it from a refused dispatch.
+- `build_overlay.py` and `probe.py` moved from an untracked `.rollback` sweep
+  directory into `scripts/lib/`, and take `--root`; overlay rebuilds no longer
+  depend on a directory that a cleanup can delete.
+
+## Verification boundary
+
+A passing probe proves the CLI accepted the selector and, for Claude, that the
+billed model matches the request. It still does not certify upstream provider
+identity, and `upstream_identity_verified` remains `false`. grok, agy, and codex
+expose no equivalent of `modelUsage` in the evidence captured so far.
+
+The frozen AA registry and its approved SHA are unchanged. Coverage remains 78
+scored targets, and the host overlay still verifies 49 mappings — codex 26,
+claude 11, gemini 7, grok 5.
+
+## Upgrade
+
+Existing overlays keep working untouched. To gain per-vendor degradation, rebuild
+the overlay with the new `build_overlay.py` so its evidence carries vendor tags.
+Run `omnilane doctor` afterwards and confirm the `transport-overlay` check reports
+the vendor counts you expect.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnilane",
-  "version": "0.42.2",
+  "version": "0.42.5",
   "description": "One routing table, every harness — classify subtasks into lanes and delegate each lane through a compatible caller-owned native agent or vendor CLI.",
   "bin": {
     "omnilane": "bin/omnilane"
@@ -29,7 +29,7 @@
     "docs/model-capabilities-2026-09.md",
     "docs/native-executor.md",
     "docs/completion-wakeup.md",
-    "docs/release-notes-0.42.2.md",
+    "docs/release-notes-0.42.5.md",
     "hooks/",
     "skills/",
     ".claude-plugin/",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "omnilane",
-  "version": "0.42.2",
+  "version": "0.42.5",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs."
 }

package/scripts/doctor.sh

@@ -33,6 +33,7 @@ REPO="${OMNILANE_DOCTOR_REPO:-$SCRIPT_ROOT}"
 OMNILANE_HOME="${OMNILANE_HOME:-$HOME/.omnilane}"
 PROBE_SCRIPT="${OMNILANE_PROVIDER_PROBE_SCRIPT:-$REPO/scripts/provider-probe.sh}"
 GOAL_LOOP="${OMNILANE_DOCTOR_GOAL_LOOP:-$REPO/scripts/lib/goal-loop.sh}"
+OVERLAY_HEALTH="${OMNILANE_DOCTOR_OVERLAY_HEALTH:-$REPO/scripts/lib/overlay_health.py}"
 # shellcheck disable=SC1091
 source "$SCRIPT_ROOT/scripts/lib/live-protocol.sh"
 PASS_COUNT=0
@@ -409,6 +410,31 @@ else
   report PASS live-unavailable "none"
 fi
 
+# live-capable above answers "does this CLI support a live session", which stays
+# true while the AA gate refuses every dispatch. Nothing else loads the overlay,
+# so one drifted evidence hash used to go unreported by an all-green doctor.
+overlay_path="$(
+  set +u
+  [[ -f "$OMNILANE_HOME/local.sh" ]] && . "$OMNILANE_HOME/local.sh" 2>/dev/null
+  printf '%s' "${OMNILANE_AA_TRANSPORT_OVERLAY:-}"
+)"
+if [[ -z "$overlay_path" ]]; then
+  report PASS transport-overlay "no overlay configured; every runtime mapping stays unverified"
+elif ! command -v python3 >/dev/null 2>&1; then
+  report WARN transport-overlay "python3 is absent; cannot load the AA transport overlay"
+elif [[ ! -r "$OVERLAY_HEALTH" ]]; then
+  report WARN transport-overlay "$OVERLAY_HEALTH is missing"
+else
+  overlay_line="$(OMNILANE_AA_TRANSPORT_OVERLAY="$overlay_path" \
+    python3 "$OVERLAY_HEALTH" "$REPO" 2>&1)"
+  overlay_level="${overlay_line%%	*}"
+  overlay_message="${overlay_line#*	}"
+  case "$overlay_level" in
+    PASS|WARN|FAIL) report "$overlay_level" transport-overlay "$overlay_message" ;;
+    *) report WARN transport-overlay "unreadable overlay health output: $overlay_line" ;;
+  esac
+fi
+
 if [[ -n "$PROBE_VENDOR" ]]; then
   if [[ ! -x "$PROBE_SCRIPT" ]]; then
     report FAIL provider-probe "probe runner is unavailable"

package/scripts/lib/aa_policy.py

@@ -28,6 +28,7 @@ MAX_BYTES = 1_048_576
 APPROVED_REGISTRY_SHA256 = "0782c87de123c02738c3ff60e4bc3c1cc10d110113e872b8f8627212861cdaab"
 
 IDENTITY_FIELDS = ("vendor", "model", "effort", "reasoning", "fallback")
+TRANSPORT_EVIDENCE_VENDORS = frozenset(("codex", "claude", "grok", "gemini"))
 IDENTIFIER = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}\Z")
 
 
@@ -147,14 +148,35 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
     _check(overlay.get("schema_version") == 1, "unsupported transport overlay")
     _check(overlay.get("snapshot_id") == registry["snapshot"]["id"], "transport overlay snapshot mismatch")
     _check(overlay.get("host") == socket.gethostname(), "transport overlay host mismatch")
+    stale_vendors: set[str] = set()
     for evidence in overlay.get("evidence", []):
-        fd = os.open(evidence["path"], os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        _check(isinstance(evidence, dict), "invalid transport evidence")
+        vendor = evidence.get("vendor")
+        _check(
+            "vendor" not in evidence
+            or type(vendor) is str and vendor in TRANSPORT_EVIDENCE_VENDORS,
+            "invalid transport evidence vendor",
+        )
+        evidence_path = evidence["path"]
+        evidence_sha256 = evidence["sha256"]
+        _check(type(evidence_path) is str, "invalid transport evidence path")
+        _check(type(evidence_sha256) is str, "invalid transport evidence digest")
+        try:
+            fd = os.open(evidence_path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        except FileNotFoundError:
+            if vendor is None:
+                raise
+            stale_vendors.add(vendor)
+            continue
         with os.fdopen(fd, "rb") as stream:
             _check(stat.S_ISREG(os.fstat(stream.fileno()).st_mode), "invalid transport evidence file")
             digest_file = hashlib.sha256()
             for block in iter(lambda: stream.read(1024 * 1024), b""):
                 digest_file.update(block)
-        _check(digest_file.hexdigest() == evidence["sha256"], "transport contract evidence changed")
+        if digest_file.hexdigest() != evidence_sha256:
+            if vendor is None:
+                _check(False, "transport contract evidence changed")
+            stale_vendors.add(vendor)
     _check(bool(overlay.get("evidence")), "transport overlay requires local evidence")
     for mapping in overlay.get("mappings", []):
         rows = [row for row in registry["scored_configs"] if row["id"] == mapping.get("config_id")]
@@ -175,6 +197,8 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
             _check(mapping["runtime_model"].endswith("-" + row["effort"]), "encoded effort does not match exact tuple")
         else:
             _check(mapping.get("runtime_model") == row["model"], "overlay model mismatch")
+        if row["vendor"] in stale_vendors:
+            continue
         row["transport_mapping"].update(
             status="verified", runtime_verified=True,
             runtime_model=mapping["runtime_model"], runtime_effort=mapping["runtime_effort"],
@@ -183,6 +207,7 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
             verification="request-selector-contract", upstream_identity_verified=False,
             overlay_sha256=digest, overlay_host=overlay["host"],
         )
+    registry["_stale_transport_vendors"] = sorted(stale_vendors)
 
 
 def load_registry(path: str | Path, expected_sha256: str | None = None) -> tuple[dict[str, Any], str]:
@@ -233,6 +258,8 @@ def _runtime_target(registry: dict[str, Any], vendor: str, model: str,
     exact_id = [row for row in registry["scored_configs"] if row["id"] == target_config] if target_config else registry["scored_configs"]
     if target_config and not exact_id:
         return None, "unknown-target-config", {"target_config": target_config}
+    if vendor in registry.get("_stale_transport_vendors", []):
+        return None, "unknown-target-runtime", {"vendor": vendor, "model": model, "effort": effort}
     vendor_rows = [row for row in exact_id if row["vendor"] == vendor]
     candidates: list[dict[str, Any]] = []
     unresolved: list[str] = []

package/scripts/lib/build_overlay.py

@@ -0,0 +1,189 @@
+#!/usr/bin/env python3
+"""Build the merged omnilane AA transport overlay from verified probe evidence.
+
+Only (config_id, selector) pairs listed in PROVEN are written. Every entry here
+corresponds to a probe run under the selected evidence root whose raw
+stdout/stderr is hashed into the manifest, so the overlay's evidence[] anchors
+the whole set.
+"""
+import argparse
+import hashlib
+import json
+import os
+import socket
+from datetime import datetime, timezone
+from pathlib import Path
+
+REPO = Path(os.environ.get("OMNILANE_REPO", "/Users/vincentw/dev/omnilane"))
+HOME = Path.home()
+SWEEP_ID = os.environ.get("OMNILANE_TRANSPORT_SWEEP_ID", "overlay-reprobe-20260909")
+DEFAULT_ROOT = HOME / ".omnilane" / "transport-evidence" / SWEEP_ID
+REGISTRY = json.loads((REPO / "config/aa-model-policy.json").read_text())
+ROWS = {r["id"]: r for r in REGISTRY["scored_configs"]}
+IDENTITY_FIELDS = ("vendor", "model", "effort", "reasoning", "fallback")
+
+# config_id -> (selector_type, runtime_model, probe evidence basename)
+PROVEN: dict[str, tuple[str, str, str]] = {}
+
+for model, slug in [("gpt-6-astra", "gpt-6-astra"), ("gpt-5.6-sol", "gpt-5_6-sol"),
+                    ("gpt-5.6-luna", "gpt-5_6-luna"), ("gpt-5.6-terra", "gpt-5_6-terra")]:
+    base = model.replace(".", "-").replace("gpt-", "gpt-")
+    for effort in ["max", "xhigh", "high", "medium", "low"]:
+        cid = f"codex/{model.replace('.', '-')}" + ("" if effort == "max" else f"-{effort}")
+        ev = f"cx-avail-{model.replace('.', '_')}" if effort == "high" else f"cx-{model.replace('.', '_')}-{effort}"
+        PROVEN[cid] = ("model_and_effort", model, ev)
+
+for effort in ["xhigh", "medium"]:
+    PROVEN[f"codex/gpt-5-4-mini" + ("" if effort == "xhigh" else f"-{effort}")] = (
+        "model_and_effort", "gpt-5.4-mini", f"cx-gpt-5_4-mini-{effort}")
+
+PROVEN["grok/grok-4-6"] = ("cli_reasoning_effort", "grok-4.6", "PRIOR:grok-effort-2026-09-07")
+for effort in ["xhigh", "medium", "low"]:
+    PROVEN[f"grok/grok-4-6-{effort}"] = ("cli_reasoning_effort", "grok-4.6", f"gk-grok-4_6-{effort}")
+PROVEN["grok/grok-4-5"] = ("cli_reasoning_effort", "grok-4.5", "gk-grok-4_5-high")
+
+for cid, rid, ev in [
+    ("gemini/gemini-3-8-flash", "gemini-3.8-flash-high", "PRIOR:gemini-flash-high"),
+    ("gemini/gemini-3-8-flash-medium", "gemini-3.8-flash-medium", "agy-gemini-3_8-flash-medium"),
+    ("gemini/gemini-3-8-flash-low", "gemini-3.8-flash-low", "agy-gemini-3_8-flash-low"),
+    ("gemini/gemini-3-7-flash", "gemini-3.7-flash-high", "agy-gemini-3_7-flash-high"),
+    ("gemini/gemini-3-7-flash-medium", "gemini-3.7-flash-medium", "agy-gemini-3_7-flash-medium"),
+    ("gemini/gemini-3-7-flash-low", "gemini-3.7-flash-low", "agy-gemini-3_7-flash-low"),
+    ("gemini/gemini-3-6-flash", "gemini-3.6-flash-high", "agy-gemini-3_6-flash-high"),
+]:
+    PROVEN[cid] = ("model_id_encoded_effort", rid, ev)
+
+for effort in ["max", "xhigh", "high", "medium", "low"]:
+    cid = "claude/claude-opus-5" + ("" if effort == "max" else f"-{effort}")
+    PROVEN[cid] = ("model_and_effort", "claude-opus-5", f"cl-claude-opus-5-{effort}")
+# gpt-6-astra rejects effort "none" upstream ("Unsupported value: 'none' is not
+# supported with the 'gpt-6-astra' model"), so it has no non-reasoning selector.
+for model in ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.4-mini"]:
+    PROVEN[f"codex/{model.replace('.', '-')}-non-reasoning"] = (
+        "model_and_effort", model, f"cx-{model.replace('.', '_')}-none")
+
+# Default (no --effort) Haiku 4.5 spent 124 thinking tokens, so the selector
+# lands on the reasoning row rather than its non-reasoning sibling.
+PROVEN["claude/claude-4-5-haiku-reasoning"] = (
+    "model_and_effort", "claude-haiku-4-5", "cl-rmode-claude-haiku-4-5-noeffort")
+
+for cid, model in [("claude/claude-sonnet-5", "claude-sonnet-5"),
+                   ("claude/claude-opus-4-8", "claude-opus-4-8"),
+                   ("claude/claude-opus-4-7", "claude-opus-4-7"),
+                   ("claude/claude-opus-4-6-adaptive", "claude-opus-4-6"),
+                   ("claude/claude-sonnet-4-6-adaptive", "claude-sonnet-4-6")]:
+    PROVEN[cid] = ("model_and_effort", model, f"cl-{model}-max")
+
+# Fable is listed so its failures reach unproven[] rather than vanishing. Its
+# probes were refused for quota on 2026-09-07 and again on 2026-09-09; the
+# verdict decides whether these rows become mappings or stay visible failures.
+for effort in ["max", "xhigh", "high", "medium", "low"]:
+    cid = "claude/claude-fable-5-1" + ("" if effort == "max" else f"-{effort}")
+    PROVEN[cid] = ("model_and_effort", "claude-fable-5-1", f"cl-claude-fable-5-1-{effort}")
+PROVEN["claude/claude-fable-5"] = (
+    "model_and_effort", "claude-fable-5", "cl-claude-fable-5-max")
+
+CORE_EVIDENCE = [
+    (HOME / ".grok/downloads/grok-1.0.13-macos-aarch64", "grok"),
+    (REPO / "scripts/runners/run-grok.sh", "grok"),
+    (HOME / ".codex/packages/standalone/releases/0.153.4-aarch64-apple-darwin/bin/codex", "codex"),
+    (REPO / "scripts/runners/run-codex.sh", "codex"),
+    (HOME / ".local/share/claude/versions/2.1.263", "claude"),
+    (REPO / "scripts/runners/run-claude.sh", "claude"),
+    (HOME / ".local/bin/agy", "gemini"),
+    (REPO / "scripts/runners/run-gemini.sh", "gemini"),
+]
+
+
+def sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with open(path, "rb") as stream:
+        for block in iter(lambda: stream.read(1 << 20), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def main(argv: list[str] | None = None) -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--root",
+        type=Path,
+        default=DEFAULT_ROOT,
+        help=f"probe sweep root (default: {DEFAULT_ROOT})",
+    )
+    args = parser.parse_args(argv)
+    root = args.root.expanduser()
+
+    manifest = {"probe_runs": {}}
+    unproven = []
+    for cid, (_, _, ev) in sorted(PROVEN.items()):
+        if ev.startswith("PRIOR:"):
+            manifest["probe_runs"][cid] = {"source": ev, "note": "verified in the 2026-09-07 Codex run"}
+            continue
+        entry = {}
+        for suffix in ("json", "stdout", "stderr"):
+            path = root / "evidence" / f"{ev}.{suffix}"
+            if path.exists():
+                entry[suffix] = {"path": str(path), "sha256": sha256(path)}
+        if "json" not in entry:
+            raise SystemExit(f"missing probe evidence for {cid}: {ev}")
+        descriptor_path = Path(entry["json"]["path"])
+        descriptor = json.loads(descriptor_path.read_text())
+        if not isinstance(descriptor, dict):
+            raise SystemExit(f"invalid probe descriptor for {cid}: {ev}")
+        if "verdict" not in descriptor:
+            print(f"warning: legacy evidence (verdict=unknown): {cid}: {ev}")
+        elif descriptor["verdict"] != "pass":
+            unproven.append({
+                "config_id": cid,
+                "verdict_reason": descriptor.get("verdict_reason") or f"verdict: {descriptor['verdict']}",
+                "observed_model": descriptor.get("observed_model"),
+                "probed_at": descriptor.get("probed_at") or datetime.fromtimestamp(
+                    descriptor_path.stat().st_mtime, timezone.utc).isoformat(),
+            })
+            # Visibility only: failed evidence must not enter the signed manifest.
+            continue
+        manifest["probe_runs"][cid] = entry
+    manifest_path = root / "probe-manifest.json"
+    manifest_path.write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n")
+
+    mappings = []
+    for cid, (selector, runtime_model, _) in sorted(PROVEN.items()):
+        if cid not in manifest["probe_runs"]:
+            continue
+        row = ROWS[cid]
+        mapping = {
+            "config_id": cid,
+            "identity": {key: row[key] for key in IDENTITY_FIELDS},
+            "runtime_model": runtime_model,
+            "runtime_effort": row["effort"],
+            "selector_type": selector,
+            "verification": "request-selector-contract",
+        }
+        if selector == "cli_reasoning_effort":
+            mapping["cli_flag"] = "--reasoning-effort"
+        mappings.append(mapping)
+
+    evidence = [
+        {"path": str(path), "sha256": sha256(path), "vendor": vendor}
+        for path, vendor in CORE_EVIDENCE
+    ]
+    evidence.append({"path": str(manifest_path), "sha256": sha256(manifest_path)})
+
+    overlay = {
+        "schema_version": 1,
+        "snapshot_id": REGISTRY["snapshot"]["id"],
+        "host": socket.gethostname(),
+        "source": ("claude-code / MacStudio / operator-directed full sweep 2026-09-07; "
+                   "gemini selectors re-probed 2026-09-09 after agy 1.1.27 -> 1.1.28"),
+        "evidence": evidence,
+        "mappings": mappings,
+        "unproven": unproven,
+    }
+    out = root / "transport-contracts.local.json"
+    out.write_text(json.dumps(overlay, indent=2, ensure_ascii=False) + "\n")
+    print(f"wrote {out} with {len(mappings)} mappings and {len(evidence)} evidence anchors")
+
+
+if __name__ == "__main__":
+    main()

package/scripts/lib/overlay_health.py

@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+"""Report whether the configured AA transport overlay still loads.
+
+Prints one `LEVEL<TAB>message` line for `omnilane doctor`. Always exits 0; the
+caller decides how to grade the level. Nothing here contacts a provider.
+
+Exists because no other doctor check observes the AA gate: every vendor CLI can
+be reachable and every lane resolvable while `load_registry` refuses the whole
+registry over one drifted evidence hash.
+"""
+import hashlib
+import os
+import sys
+from collections import Counter
+from pathlib import Path
+
+REPO = Path(sys.argv[1]) if len(sys.argv) > 1 else Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / "scripts" / "lib"))
+
+
+def emit(level: str, message: str) -> None:
+    print(f"{level}\t{message}")
+    raise SystemExit(0)
+
+
+def digest(path: Path) -> str:
+    value = hashlib.sha256()
+    with open(path, "rb") as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            value.update(block)
+    return value.hexdigest()
+
+
+def offenders(overlay_path: Path) -> list[str]:
+    """Name the evidence entries that no longer match, for an actionable report."""
+    import json
+
+    try:
+        overlay = json.loads(overlay_path.read_text())
+    except (OSError, ValueError):
+        return []
+    found = []
+    for entry in overlay.get("evidence", []):
+        path = Path(entry.get("path", ""))
+        tag = entry.get("vendor") or "untagged"
+        if not path.exists():
+            found.append(f"{tag}:missing {path}")
+        elif digest(path) != entry.get("sha256"):
+            found.append(f"{tag}:hash drift {path}")
+    return found
+
+
+def main() -> None:
+    overlay_path = os.environ.get("OMNILANE_AA_TRANSPORT_OVERLAY", "")
+    if not overlay_path:
+        emit("PASS", "no overlay configured; every runtime mapping stays unverified")
+    if not Path(overlay_path).exists():
+        emit("FAIL", f"configured overlay is missing: {overlay_path}")
+
+    try:
+        import aa_policy
+    except ImportError as error:
+        emit("WARN", f"cannot import aa_policy: {error}")
+
+    try:
+        registry, _ = aa_policy.load_registry(str(REPO / "config" / "aa-model-policy.json"))
+    except Exception as error:  # PolicyError, OSError, and anything else fails the gate
+        detail = "; ".join(offenders(Path(overlay_path))) or str(error)
+        emit("FAIL", f"overlay rejected, every dispatch is refused: {error} ({detail})")
+
+    verified = Counter()
+    for row in registry["scored_configs"]:
+        if row["transport_mapping"].get("runtime_verified") is True:
+            verified[row["vendor"]] += 1
+    summary = ", ".join(f"{v} {n}" for v, n in sorted(verified.items())) or "none"
+
+    import json
+
+    overlay = json.loads(Path(overlay_path).read_text())
+    unproven = overlay.get("unproven", [])
+    extra = f"; {len(unproven)} config(s) recorded unproven" if unproven else ""
+
+    stale = registry.get("_stale_transport_vendors", [])
+    if stale:
+        detail = "; ".join(o for o in offenders(Path(overlay_path))) or "unknown cause"
+        emit("WARN", f"stale vendor(s) {', '.join(stale)} degraded to unverified "
+                     f"({detail}); still verified: {summary}{extra}")
+    emit("PASS", f"verified mappings: {summary}{extra}")
+
+
+main()