omnilane 0.42.9 → 0.45.0

package/scripts/lib/aa_lanes.py

@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+"""Add eligible_lanes to a refused AA decision.
+
+A refusal that only says no leaves a model caller guessing. This reads the
+decision on stdin and appends the lanes whose chain still holds a target at or
+below the caller's effective ceiling, by registry score alone: no CLI is probed
+and nothing is dispatched. Output is one JSON line, the decision plus the list.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import shlex
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import aa_policy  # noqa: E402
+import caller_identity  # noqa: E402
+
+
+def lanes(paths: list[Path]) -> dict[str, list[list[str]]]:
+    """Lane -> chain segments; the first file naming a lane wins, as in dispatch."""
+    table: dict[str, list[list[str]]] = {}
+    for path in paths:
+        try:
+            text = path.read_text(encoding="utf-8")
+        except OSError:
+            continue
+        for line in text.splitlines():
+            line = line.split("#", 1)[0]
+            if not line.strip() or line[0] in " \t" or ":" not in line:
+                continue
+            name, chain = line.split(":", 1)
+            name = name.strip()
+            if not name or name in table or not chain.strip():
+                continue
+            segments = []
+            for segment in chain.split("|"):
+                try:
+                    fields = shlex.split(segment)
+                except ValueError:
+                    fields = []
+                if fields:
+                    segments.append(fields)
+            table[name] = segments
+    return table
+
+
+def eligible(registry: dict, table: dict[str, list[list[str]]], ceiling: int) -> list[dict]:
+    found = []
+    for lane, segments in table.items():
+        for fields in segments:
+            vendor = fields[0]
+            if vendor in ("off", "vote") or len(fields) < 2:
+                continue
+            effort = fields[2] if len(fields) > 2 and fields[2] != "-" else None
+            row, _ = caller_identity.resolve(registry, vendor, fields[1], effort)
+            if row is None or row["score"] > ceiling:
+                continue
+            found.append({
+                "lane": lane,
+                "target": row["id"],
+                "score": row["score"],
+                "transport_verified": row["transport_mapping"].get("runtime_verified") is True,
+            })
+            break
+    return found
+
+
+def lane_requirement(registry: dict, segments: list[list[str]], caller: dict | None) -> dict | None:
+    """The cheapest target in one lane, and the caller effort that would reach it."""
+    rows = []
+    for fields in segments:
+        if fields[0] in ("off", "vote") or len(fields) < 2:
+            continue
+        effort = fields[2] if len(fields) > 2 and fields[2] != "-" else None
+        row, _ = caller_identity.resolve(registry, fields[0], fields[1], effort)
+        if row is not None:
+            rows.append(row)
+    if not rows:
+        return None
+    cheapest = min(rows, key=lambda row: (row["score"], row["id"]))
+    required = None
+    if isinstance(caller, dict):
+        reaching = sorted((row for row in registry["scored_configs"]
+                           if row["vendor"] == caller.get("vendor") and row["model"] == caller.get("model")
+                           and row["score"] >= cheapest["score"]),
+                          key=lambda row: (row["score"], row["id"]))
+        if reaching:
+            required = reaching[0]["effort"] or "none"
+    return {"target": cheapest["id"], "score": cheapest["score"], "required_caller_effort": required}
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--registry", required=True)
+    parser.add_argument("--routing", action="append", default=[], type=Path,
+                        help="routing file, highest precedence first; may repeat")
+    parser.add_argument("--lane", help="the lane that was refused")
+    args = parser.parse_args(argv)
+    raw = sys.stdin.read()
+    try:
+        decision = json.loads(raw)
+        ceiling = decision.get("effective_ceiling")
+        if decision.get("allowed") is False and type(ceiling) is int:
+            registry, _ = aa_policy.load_registry(args.registry)
+            table = lanes(args.routing)
+            decision["eligible_lanes"] = eligible(registry, table, ceiling)
+            if args.lane in table and decision.get("code") == "target-above-effective-ceiling":
+                # The decision describes the last candidate tried; the lane may hold a cheaper one.
+                need = lane_requirement(registry, table[args.lane], decision.get("caller"))
+                if need is not None:
+                    decision["lane_requirement"] = dict(need, lane=args.lane)
+                    if decision.get("inherited_ceiling") == decision.get("caller_score"):
+                        decision["required_caller_effort"] = need["required_caller_effort"]
+                        effort = need["required_caller_effort"]
+                        held = (" The harness recorded no effort, so this caller is held to its "
+                                "model's floor." if decision.get("caller_degraded") else "")
+                        decision["reason"] = (
+                            f"lane {args.lane}'s cheapest target {need['target']} scores "
+                            f"{need['score']}, above this caller's ceiling of {ceiling}.{held} "
+                            + (f"Relaunch the calling session at effort {effort} or higher, or have "
+                               "a human operator dispatch it." if effort else
+                               "No effort of the caller's model reaches it; a stronger caller model "
+                               "or a human operator has to dispatch it."))
+        sys.stdout.write(json.dumps(decision, ensure_ascii=False, separators=(",", ":")) + "\n")
+    except (ValueError, OSError, aa_policy.PolicyError, KeyError, TypeError):
+        # Guidance is best effort; the refusal itself must always get through.
+        sys.stdout.write(raw if raw.endswith("\n") else raw + "\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/lib/aa_policy.py

@@ -23,9 +23,12 @@ from typing import Any
 
 
 MAX_BYTES = 1_048_576
-# Approval anchor for the frozen AA v4.2 2026-09-07 source bytes. Updating this
-# constant is a governance change, never a caller argument/environment override.
-APPROVED_REGISTRY_SHA256 = "0782c87de123c02738c3ff60e4bc3c1cc10d110113e872b8f8627212861cdaab"
+# Approval anchor for the frozen AA source bytes. Updating these constants is a
+# governance change, never a caller argument/environment override.
+# scripts/aa_rebaseline.py regenerates the registry; it never touches this pin.
+APPROVED_BENCHMARK_VERSION = "4.3.2"
+APPROVED_AS_OF = "2026-09-22"
+APPROVED_REGISTRY_SHA256 = "a1109913b9928d943bc440787d26caaf7818e40abdaae32899750d65e5eb5fdd"
 
 IDENTITY_FIELDS = ("vendor", "model", "effort", "reasoning", "fallback")
 TRANSPORT_EVIDENCE_VENDORS = frozenset(("codex", "claude", "grok", "gemini"))
@@ -109,10 +112,10 @@ def _validate_registry(value: dict[str, Any]) -> dict[str, Any]:
     _check(isinstance(snapshot, dict), "invalid AA registry snapshot")
     for key in ("id", "benchmark_version", "as_of", "frozen"):
         _check(key in snapshot, "incomplete AA registry snapshot")
-    _check(snapshot["benchmark_version"] == "4.2"
-           and snapshot["as_of"] == "2026-09-07"
+    _check(snapshot["benchmark_version"] == APPROVED_BENCHMARK_VERSION
+           and snapshot["as_of"] == APPROVED_AS_OF
            and snapshot["frozen"] is True,
-           "AA registry is not frozen v4.2 dated 2026-09-07")
+           f"AA registry is not frozen v{APPROVED_BENCHMARK_VERSION} dated {APPROVED_AS_OF}")
     policy = value["policy"]
     _check(isinstance(policy, dict)
            and policy.get("decision") == "target_score <= min(caller_score, inherited_ceiling)"
@@ -135,7 +138,8 @@ def _validate_registry(value: dict[str, Any]) -> dict[str, Any]:
         _check(type(row["score"]) is int and 0 <= row["score"] <= 100,
                "invalid AA score")
         _check(type(row["estimated"]) is bool, "invalid AA estimated flag")
-        _check(row["benchmark_version"] == "4.2" and row["as_of"] == "2026-09-07",
+        _check(row["benchmark_version"] == APPROVED_BENCHMARK_VERSION
+               and row["as_of"] == APPROVED_AS_OF,
                "mixed AA registry snapshot")
         _check(isinstance(row["transport_mapping"], dict), "invalid transport mapping")
     return value
@@ -239,7 +243,13 @@ def load_caller(path: str | Path, registry: dict[str, Any],
     _check(value.get("snapshot_id") == registry["snapshot"]["id"],
            "caller-context snapshot does not match frozen registry")
     _check(value.get("kind") == "model", "unsupported caller-context kind")
+    # effort_unverified marks a caller degraded to its model's lowest-scored row
+    # because the launching harness recorded no effort; it may only be true.
+    unverified = value.pop("effort_unverified", None)
+    _check(unverified is None or unverified is True, "invalid caller-context effort_unverified")
     _exact_fields(value, {"schema_version", "snapshot_id", "kind", "caller", "inherited_ceiling"})
+    if unverified:
+        value["effort_unverified"] = True
     value["caller"] = _identity(value["caller"], "caller")
     ceiling = value["inherited_ceiling"]
     _check(type(ceiling) is int and 0 <= ceiling <= 100,
@@ -345,10 +355,15 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
                      "file it prints as --caller-context, which dispatch does itself when the "
                      "launching CLI names its model and effort; a human operator passes "
                      "--operator-asserted-human"),
+            failed_gate="caller-identity",
+            reason="no caller identity reached the gate",
+            next_command="omnilane whoami",
         )
         return base
     base["caller_context_sha256"] = caller_sha256
     caller_identity = caller["caller"]
+    degraded = caller.get("effort_unverified") is True
+    base["caller_degraded"] = degraded
     caller_rows = _matching_rows(registry, caller_identity)
     if len(caller_rows) != 1:
         detail = _unknown_reason(registry, caller_identity)
@@ -356,9 +371,24 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
             code="unknown-caller-config" if not caller_rows else "ambiguous-caller-config",
             message=detail or "caller exact vendor/model/effort/reasoning/fallback is not uniquely scored",
             caller=caller_identity,
+            failed_gate="caller-identity",
+            reason="the caller context names a configuration the frozen registry does not score exactly once",
+            next_command="omnilane whoami",
         )
         return base
     caller_row = caller_rows[0]
+    model_rows = [row for row in registry["scored_configs"]
+                  if row["vendor"] == caller_row["vendor"] and row["model"] == caller_row["model"]]
+    if degraded and caller_row["score"] != min(row["score"] for row in model_rows):
+        base.update(
+            code="invalid-degraded-caller",
+            message="an effort-unverified caller must name its model's lowest-scored row",
+            caller=caller_identity,
+            failed_gate="caller-identity",
+            reason="effort_unverified was set on a row above the model's floor",
+            next_command="omnilane whoami",
+        )
+        return base
     effective = min(caller_row["score"], caller["inherited_ceiling"])
     base.update(
         caller=caller_identity,
@@ -370,7 +400,14 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
         registry, vendor, model, effort, target_config
     )
     if target_row is None:
-        base.update(code=mapping_code, message="target runtime cannot be mapped to one verified exact AA configuration", **detail)
+        base.update(
+            code=mapping_code,
+            message="target runtime cannot be mapped to one verified exact AA configuration",
+            failed_gate="target-transport",
+            reason=("the caller is identified; this host's transport overlay does not currently "
+                    f"verify {vendor} {model} at effort {effort}"),
+            next_command="omnilane resign --check",
+            **detail)
         return base
     target_score = target_row["score"]
     target_identity = _row_identity(target_row)
@@ -381,9 +418,30 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
         target_estimated=target_row["estimated"],
     )
     if target_score > effective:
+        reaching = sorted((row for row in model_rows if row["score"] >= target_score),
+                          key=lambda row: (row["score"], row["id"]))
+        required = reaching[0]["effort"] or "none" if reaching else None
+        if caller["inherited_ceiling"] < caller_row["score"]:
+            reason = ("this worker inherited a ceiling below the target; only the session that "
+                      "dispatched it, or a human operator, can reach this target")
+            required = None
+        elif required is None:
+            reason = (f"no scored effort of {caller_row['model']} reaches {target_score}; a "
+                      "stronger caller model or a human operator has to dispatch this target")
+        elif degraded:
+            reason = (f"the launching harness recorded no effort, so the caller was held to "
+                      f"{caller_row['model']}'s floor of {effective}; relaunch the session with an "
+                      f"explicit effort of {required} or higher")
+        else:
+            reason = (f"relaunch the calling session at effort {required} or higher, or have a "
+                      "human operator dispatch this target")
         base.update(
             code="target-above-effective-ceiling",
             message=f"target score {target_score} exceeds effective caller ceiling {effective}",
+            failed_gate="downward-ceiling",
+            reason=reason,
+            required_caller_effort=required,
+            next_command="omnilane list",
         )
         return base
     child_context = {
@@ -402,6 +460,105 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
     return base
 
 
+def decide_inherited(registry: dict[str, Any], registry_sha256: str, *,
+                     caller: dict[str, Any] | None, caller_sha256: str | None,
+                     operator_asserted_human: bool = False,
+                     host_asserted: dict[str, str] | None = None) -> dict[str, Any]:
+    """A native worker that inherits the caller's own model and effort unchanged.
+
+    It runs what the caller runs, so it scores what the caller scores and cannot
+    be an upward dispatch, whether or not the caller's effort is known. There is
+    no external CLI, so no transport mapping is involved. It is nobody's lane
+    target: the decision names no target configuration and must not be reported
+    as satisfying one.
+
+    None of that rests on knowing who the caller is, so a caller whose identity
+    cannot be read still gets an inherited worker, on the host's word for its
+    vendor and model. That decision is marked unverified, carries no ceiling and
+    publishes no child context: a worker that tried to dispatch would have no
+    identity to dispatch with.
+    """
+    base: dict[str, Any] = {
+        "schema_version": 1,
+        "snapshot_id": registry["snapshot"]["id"],
+        "registry_sha256": registry_sha256,
+        "allowed": False,
+        "code": "deny",
+        "message": "AA policy denied dispatch",
+        "caller_kind": "operator-asserted-human" if operator_asserted_human else "model",
+        "target_request": {"vendor": None, "model": None, "effort": None, "inherit": True},
+        "target_config_id": None,
+        "caller_score": None,
+        "inherited_ceiling": None,
+        "effective_ceiling": None,
+        "target_score": None,
+        "target_estimated": None,
+        "child_context": None,
+        "evidence_limit": ("the host asserts that a sub-agent spawned without a model override "
+                           "inherits the caller's runtime; omnilane cannot observe it"),
+    }
+    if operator_asserted_human:
+        base.update(code="inherit-requires-model-caller",
+                    message="only a model running inside a harness has a runtime to inherit",
+                    failed_gate="caller-identity",
+                    reason="a human operator has no sub-agent tool; dispatch a lane instead",
+                    next_command="omnilane list")
+        return base
+    if caller is None and host_asserted is not None:
+        base.update(allowed=True, code="native-inherited-unverified-caller",
+                    message="the worker inherits the caller's own runtime, so it cannot score above it; "
+                            "the caller's vendor and model are the host's statement, not a verified identity",
+                    caller_kind="model-unverified", caller_identity_verified=False,
+                    caller_identity_source="host-asserted",
+                    target={"inherit": True, "vendor": host_asserted["vendor"],
+                            "model": host_asserted["model"]})
+        return base
+    if caller is None:
+        base.update(code="missing-caller-context",
+                    message="no caller identity: an inherited worker still has to know whose runtime it inherits",
+                    failed_gate="caller-identity",
+                    reason="no caller identity reached the gate and the capability file names no current_model",
+                    next_command="omnilane whoami  # if that cannot read this harness: omnilane "
+                                 "native-context --vendor VENDOR --model MODEL --inherits-caller-runtime")
+        return base
+    base["caller_context_sha256"] = caller_sha256
+    base["caller_identity_verified"] = True
+    base["caller_identity_source"] = "caller-context"
+    identity = caller["caller"]
+    degraded = caller.get("effort_unverified") is True
+    rows = _matching_rows(registry, identity)
+    if len(rows) != 1:
+        base.update(code="unknown-caller-config" if not rows else "ambiguous-caller-config",
+                    message=_unknown_reason(registry, identity)
+                    or "caller exact vendor/model/effort/reasoning/fallback is not uniquely scored",
+                    caller=identity, failed_gate="caller-identity",
+                    reason="the caller context names a configuration the frozen registry does not score exactly once",
+                    next_command="omnilane whoami")
+        return base
+    row = rows[0]
+    floor = min(r["score"] for r in registry["scored_configs"]
+                if r["vendor"] == row["vendor"] and r["model"] == row["model"])
+    if degraded and row["score"] != floor:
+        base.update(code="invalid-degraded-caller",
+                    message="an effort-unverified caller must name its model's lowest-scored row",
+                    caller=identity, failed_gate="caller-identity",
+                    reason="effort_unverified was set on a row above the model's floor",
+                    next_command="omnilane whoami")
+        return base
+    effective = min(row["score"], caller["inherited_ceiling"])
+    child = {"schema_version": 1, "snapshot_id": registry["snapshot"]["id"], "kind": "model",
+             "caller": identity, "inherited_ceiling": effective}
+    if degraded:
+        child["effort_unverified"] = True
+    base.update(allowed=True, code="native-inherited-allowed",
+                message="the worker inherits the caller's own runtime, so it cannot score above it",
+                caller=identity, caller_degraded=degraded, caller_score=row["score"],
+                inherited_ceiling=caller["inherited_ceiling"], effective_ceiling=effective,
+                target={"inherit": True, "vendor": row["vendor"], "model": row["model"]},
+                child_context=child)
+    return base
+
+
 def _normalized_effort(value: str) -> str | None:
     return None if value in ("", "-") else value
 

package/scripts/lib/build_overlay.py

@@ -6,6 +6,8 @@ corresponds to a probe run under the selected evidence root whose raw
 stdout/stderr is hashed into the manifest, so the overlay's evidence[] anchors
 the whole set.
 """
+from __future__ import annotations
+
 import argparse
 import hashlib
 import json
@@ -14,9 +16,13 @@ import shutil
 import socket
 from collections import Counter
 from datetime import datetime, timezone
+import sys
 from pathlib import Path
 
-REPO = Path(os.environ.get("OMNILANE_REPO", "/Users/vincentw/dev/omnilane"))
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import cli_provenance  # noqa: E402
+
+REPO = Path(os.environ.get("OMNILANE_REPO") or Path(__file__).resolve().parents[2])
 HOME = Path.home()
 SWEEP_ID = os.environ.get("OMNILANE_TRANSPORT_SWEEP_ID", "overlay-reprobe-20260909")
 DEFAULT_ROOT = HOME / ".omnilane" / "transport-evidence" / SWEEP_ID
@@ -43,6 +49,9 @@ PROVEN["grok/grok-4-6"] = ("cli_reasoning_effort", "grok-4.6", "gk-grok-4_6-high
 for effort in ["xhigh", "medium", "low"]:
     PROVEN[f"grok/grok-4-6-{effort}"] = ("cli_reasoning_effort", "grok-4.6", f"gk-grok-4_6-{effort}")
 PROVEN["grok/grok-4-5"] = ("cli_reasoning_effort", "grok-4.5", "gk-grok-4_5-high")
+# AA scores grok-4.7 at xhigh and high only; its base row is the xhigh one.
+PROVEN["grok/grok-4-7"] = ("cli_reasoning_effort", "grok-4.7", "gk-grok-4_7-xhigh")
+PROVEN["grok/grok-4-7-high"] = ("cli_reasoning_effort", "grok-4.7", "gk-grok-4_7-high")
 
 for cid, rid, ev in [
     ("gemini/gemini-3-8-flash", "gemini-3.8-flash-high", "agy-gemini-3_8-flash-high"),
@@ -75,6 +84,12 @@ for cid, model in [("claude/claude-sonnet-5", "claude-sonnet-5"),
                    ("claude/claude-opus-4-6-adaptive", "claude-opus-4-6"),
                    ("claude/claude-sonnet-4-6-adaptive", "claude-sonnet-4-6")]:
     PROVEN[cid] = ("model_and_effort", model, f"cl-{model}-max")
+# Targets resolve on vendor/model/effort alone, so claude-sonnet-5-non-reasoning
+# (also effort high) must never be listed here: two verified rows at one
+# selector make every sonnet-5 high dispatch ambiguous-runtime-mapping.
+for effort in ["xhigh", "high", "medium", "low"]:
+    PROVEN[f"claude/claude-sonnet-5-{effort}"] = (
+        "model_and_effort", "claude-sonnet-5", f"cl-claude-sonnet-5-{effort}")
 
 # Fable is listed so its failures reach unproven[] rather than vanishing. Its
 # probes were refused for quota on 2026-09-07 and again on 2026-09-09; the
@@ -98,19 +113,21 @@ def cli_path(name: str) -> Path:
     return Path(found).resolve()
 
 
+RUNNERS = {"grok": "run-grok.sh", "codex": "run-codex.sh", "claude": "run-claude.sh",
+           "gemini": "run-gemini.sh"}
+CLI_NAMES = {"grok": "grok", "codex": "codex", "claude": "claude", "gemini": "agy"}
+
+
 def core_evidence() -> list[tuple[Path, str]]:
     """Resolved when a build runs, not at import: a host missing one CLI can
     still load this module to read PROVEN."""
-    return [
-        (cli_path("grok"), "grok"),
-        (REPO / "scripts/runners/run-grok.sh", "grok"),
-        (cli_path("codex"), "codex"),
-        (REPO / "scripts/runners/run-codex.sh", "codex"),
-        (cli_path("claude"), "claude"),
-        (REPO / "scripts/runners/run-claude.sh", "claude"),
-        (cli_path("agy"), "gemini"),
-        (REPO / "scripts/runners/run-gemini.sh", "gemini"),
-    ]
+    anchors = []
+    for vendor in ("grok", "codex", "claude", "gemini"):
+        if shutil.which(CLI_NAMES[vendor]) is None:
+            continue  # not installed here: main() signs nothing for it
+        anchors += [(cli_path(CLI_NAMES[vendor]), vendor),
+                    (REPO / "scripts/runners" / RUNNERS[vendor], vendor)]
+    return anchors
 
 
 def sha256(path: Path) -> str:
@@ -129,6 +146,12 @@ def main(argv: list[str] | None = None) -> None:
         default=DEFAULT_ROOT,
         help=f"probe sweep root (default: {DEFAULT_ROOT})",
     )
+    parser.add_argument(
+        "--source",
+        default=os.environ.get("OMNILANE_TRANSPORT_SOURCE")
+        or f"{socket.gethostname()} / build_overlay {datetime.now(timezone.utc).date().isoformat()}",
+        help="free-text provenance recorded in the overlay",
+    )
     args = parser.parse_args(argv)
     root = args.root.expanduser()
 
@@ -144,7 +167,11 @@ def main(argv: list[str] | None = None) -> None:
             if path.exists():
                 entry[suffix] = {"path": str(path), "sha256": sha256(path)}
         if "json" not in entry:
-            raise SystemExit(f"missing probe evidence for {cid}: {ev}")
+            # A vendor nobody is logged in to was never probed; that is a gap in this
+            # host's overlay, not a reason to refuse to sign the vendors that were.
+            unproven.append({"config_id": cid, "verdict_reason": "not probed on this host",
+                             "observed_model": None, "probed_at": None})
+            continue
         descriptor_path = Path(entry["json"]["path"])
         descriptor = json.loads(descriptor_path.read_text())
         if not isinstance(descriptor, dict):
@@ -169,11 +196,18 @@ def main(argv: list[str] | None = None) -> None:
     manifest_path = root / "probe-manifest.json"
     manifest_path.write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n")
 
+    anchors = core_evidence()
+    anchored = {vendor for _, vendor in anchors}
     mappings = []
     for cid, (selector, runtime_model, _) in sorted(PROVEN.items()):
         if cid not in manifest["probe_runs"]:
             continue
         row = ROWS[cid]
+        if row["vendor"] not in anchored:
+            # Evidence with no executable to pin it to verifies nothing.
+            unproven.append({"config_id": cid, "verdict_reason": "vendor CLI is not installed",
+                             "observed_model": None, "probed_at": None})
+            continue
         mapping = {
             "config_id": cid,
             "identity": {key: row[key] for key in IDENTITY_FIELDS},
@@ -187,18 +221,20 @@ def main(argv: list[str] | None = None) -> None:
             mapping["cli_flag"] = "--reasoning-effort"
         mappings.append(mapping)
 
-    evidence = [
-        {"path": str(path), "sha256": sha256(path), "vendor": vendor}
-        for path, vendor in core_evidence()
-    ]
+    evidence = []
+    for path, vendor in anchors:
+        anchor = {"path": str(path), "sha256": sha256(path), "vendor": vendor}
+        if path.name != RUNNERS[vendor]:
+            # The signer an unattended re-sign is later held to; see cli_provenance.
+            anchor["codesign"] = cli_provenance.facts(path)
+        evidence.append(anchor)
     evidence.append({"path": str(manifest_path), "sha256": sha256(manifest_path)})
 
     overlay = {
         "schema_version": 1,
         "snapshot_id": REGISTRY["snapshot"]["id"],
         "host": socket.gethostname(),
-        "source": ("claude-code / MacStudio / operator-directed full sweep 2026-09-07; "
-                   "gemini selectors re-probed 2026-09-09 after agy 1.1.27 -> 1.1.28"),
+        "source": args.source,
         "evidence": evidence,
         "mappings": mappings,
         "unproven": unproven,