software-defence-factory 0.12.0 → 0.13.1

package/{operator-skills → .agents/skills}/factory-foundation/SKILL.md

@@ -10,7 +10,7 @@ instructions, existing source and session decisions. Preserve useful work and
 licenses. Assessment-only requests stay read-only. A method-only adoption needs
 no runtime, Docker host or model account.
 
-The [setup plan](../../docs/setup.md) owns supported commands and checkpoints.
+The [setup plan](../../../docs/setup.md) owns supported commands and checkpoints.
 Read the relevant sections rather than inventing a host-specific setup recipe.
 Choose this skill explicitly when adopting Factory. Project preparation tools
 need no knowledge of Factory and do not invoke this transition automatically.
@@ -24,7 +24,7 @@ Use the actual host's OS, service manager, hardware and private network; do not
 assume a machine model, a VPN provider, a cloud, Git forge, issue tracker, CI
 provider or particular harness. Inspect the configured remote and actual provider
 capabilities. GitHub is one adapter; an unsupported host keeps local execution
-without guessed API calls. Use [integration ownership](../../docs/integrations.md).
+without guessed API calls. Use [integration ownership](../../../docs/integrations.md).
 
 Use the existing task/issue record for missing obligations and evidence. Avoid a
 second project registry or a template conversion of an existing application.
@@ -38,9 +38,9 @@ Continue authorized repairs; ask only for decisions or authority actually missin
   repository instructions. Adapt the staged method to the
   project; do not overwrite its files. Reconcile the chosen provider’s issue forms/labels (where supported), CI triggers,
   required checks, protection rules and the intended PR/release path using
-  [repository readiness](../../kit/repository.md). Before trusted GitHub PR
+  [repository readiness](../../../kit/repository.md). Before trusted GitHub PR
   delivery, confirm active candidate-triggered workflows fit the bounded
-  qualification in [recovery](../../docs/recovery.md#trusted-pr-delivery);
+  qualification in [recovery](../../../docs/recovery.md#trusted-pr-delivery);
   unsupported workflows keep delivery patch-only. Organization hooks and
   external CI remain operator-owned. File presence is not proof.
 - **Infrastructure:** choose a private state directory, loopback port, host and

package/README.md

@@ -39,9 +39,12 @@ The runtime supplies policy and six focused skills to its isolated jobs. `init`
 
 ## How the factory works
 
-[![Factory setup, execution and delivery](https://raw.githubusercontent.com/arcitai/software-and-defence-factory/main/docs/architecture.svg)](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/architecture.excalidraw)
+<a href="docs/architecture.md"><img src="docs/diagrams/deployment.svg" width="720" alt="Factory setup: operator access to a private execution host with Docker, a chosen harness and inference; application deployment remains in its own CI/CD."></a>
 
-[Architecture and boundaries](docs/architecture.md) · [Editable Excalidraw source](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/architecture.excalidraw)
+[Architecture and boundaries](docs/architecture.md). Editable views:
+[Setup / deployment](docs/diagrams/deployment.excalidraw) ·
+[Runtime layers / ownership](docs/diagrams/architecture.excalidraw) ·
+[Work lifecycle](docs/diagrams/lifecycle.excalidraw)
 
 Each result belongs to a specific candidate commit and policy. A failed check blocks delivery. Changing the candidate or check policy invalidates earlier evidence. Approval records a handoff; publishing, merging and deployment follow the application's separate authority.
 
@@ -58,8 +61,8 @@ Start setup with `factory foundation` and the [Factory Foundation plan](docs/set
 | `bin/` | CLI entry point |
 | `factory/` | Queue, HTTP API, isolation, evidence, updates and bundled dashboard assets |
 | `dashboard/` | Dashboard source and UI tests |
-| `kit/`, `.agents/skills/` | Portable method, adoption records and six job skills |
-| `operator-skills/` | Factory Foundation setup guidance; never mounted into jobs |
+| `kit/`, `kit/skills/` | Portable method, adoption records and the canonical six job skills |
+| `.agents/skills/` | Repository/operator guidance, including explicit Factory Foundation adoption; outside the job catalog |
 | `scripts/`, `tests/` | Packaging, qualification, release checks and behavioral tests |
 | `docs/` | Setup, architecture, recovery, proof and ownership |
 

package/docs/interfaces.md

@@ -35,6 +35,7 @@ shell endpoint or a second scheduler.
 | Synthetic qualification | `demo`, `qualify` | No qualification endpoint | Synthetic disclosure only | Explicit separate state; never target an application accidentally |
 | Immutable source admission | `init --source-ref`, `run --source-ref`, `issue start --source-ref`; status and build evidence carry the resolved SHA | `POST /api/v1/jobs` resolves/retains before acknowledgement; shared source metadata in status | Issue Start work, local request and revision forms accept a ref; task detail shows requested ref, resolved SHA and prior source commits | Build/retry use retained objects; revisions start fresh by default; explicit continuation keeps the reviewed tree and recorded source; a new ref replaces the base; legacy source remains unknown |
 | Trusted PR handoff | `publish JOB_ID` publishes/reconciles; `abandon-delivery JOB_ID --branch-sha SHA` records a checked local resolution for a pre-write branch collision | Authenticated `POST /api/v1/jobs/:id/publish` and `/abandon-delivery`; shared receipt, conflict identity and removal policy | Publish/reconcile and explicit “Abandon local delivery; keep remote branch” actions share controller state; errors/results and inspected branch identity are visible | New writes require matching protected Codex/Pi build/review provenance, deterministic verify/handoff provenance, non-synthetic bound artifacts and a qualified GitHub Actions tree. Shared delivery status exposes `workflow_qualification` and the same reason blocks CLI/API/dashboard capability and publication/retry. Candidate workflow changes, unsupported triggers/syntax, or active generated-push, selected-ref-dispatch and PR jobs with write/secrets/environment/OIDC/deploy access, self-hosted runners or ambiguous privileged guards refuse trusted writes. Supported ASCII guard comparisons follow GitHub's case-insensitive string semantics; unknown PR refs, non-ASCII mismatches, and glob/escaped branch filters cannot prove a privileged job inactive. The shared summary's `action_mode` distinguishes new/resumable publication from read-only reconciliation and drives idle and pending task button wording. Branch-only collisions and unknown/abandoned states offer neither; known PR receipts and pending PR-creation checkpoints retain read-only reconciliation. Abandonment checks the current run, saved intent, exact branch head and absence of an associated PR; it writes no provider data, preserves the remote branch/evidence, disables republishing and permits local removal. Uncertain effects and incompatible evidence stay blocked. Destination remains private operator config; patch-only remains default |
+| Delivered-commit check readback | `publish JOB_ID` reconciles, `status` returns saved checks | Existing publish/status routes return the same `delivery_status.checks` | Delivered-commit checks, per-row conclusions/scope, uncertainty and refresh | 0.13.1 verifies exact commit/provider identity; installed/live/browser qualification pending; no required-check or mergeability claim |
 | Optional trusted web verification | `web probe` performs a real local Chromium interaction; `doctor` reports readiness | Verify stores a shared story summary and protected JSON artifact in the run | Task history shows passed/failed/unavailable/inconclusive plus tool, candidate, policy and story hashes | Disabled by default. Required operator stories and Playwright/Chromium image ID are frozen in attempt policy. Linux Chromium proof cannot qualify native/mobile OS behavior; see [the browser contract](web-verification.md) |
 
 The current generic task form can name the Defence workflow; that is not a
@@ -128,3 +129,50 @@ remain visible when it is closed. Rows and cards share compact metadata; source
 readiness remains distinct from the runtime badge, and full assignments and
 linked attempts remain in detail. These presentation controls do not change
 headless records or admission semantics.
+
+## Delivered-commit checks (0.13.1, bounded #37 slice)
+
+The controller keeps its before/after PR repository, branch, target and immutable
+head guards. The GitHub adapter reads that delivered head, not a moving ref or
+merge commit. CLI/API/dashboard share the saved normalized `checks` object:
+
+- `target`: requested `repository` URL, immutable `sha`, validated
+  `pull_request_number`; null for an invalid request. This names the read target,
+  not proof that every returned row belongs to it.
+- Each check run retains `head_sha`, raw `conclusion`, `status`, `passed` and
+  `non_blocking`; `scope` is `commit`, `pull_request` or `unknown`. An exact
+  `head_sha` with `pull_requests: []` is commit-scoped. Missing/malformed or
+  conflicting associations do not qualify. Commit statuses use the combined
+  response's exact SHA and repository identity and carry the same scope/flags.
+  Supplied PR `head`/`base`, repository and owner containers must be objects,
+  never null, scalars or arrays. Supplied repository names, owner login and
+  API/HTML URLs must agree, including on combined statuses; supplied combined
+  commit/status URLs must identify the exact target. Optional association details
+  may be absent. A supplied head SHA must match; a supplied base SHA must be
+  well formed but may differ from the delivered head. Combined statuses still
+  require a repository `full_name` and exact commit SHA.
+- Optional row API self `url` fields must name the requested repository and
+  `check-runs/{id}` or `statuses/{id}` resource, agreeing with a supplied numeric
+  row ID. The documented legacy `statuses/{sha}` form must name the exact delivered
+  SHA; its suffix is a commit identity, not a row ID. Missing self URLs remain
+  supported. Malformed or contradictory self URLs make that row's status/scope
+  unknown and both flags false. CI details/HTML/target links are presentation
+  links, not repository identity; external CI destinations remain usable.
+- `pagination_complete` requires both arrays and exact nonnegative totals
+  within the existing 100-row bound. No extra pages or polling are introduced.
+  Empty, partial, unreadable or unknown data never establishes aggregate success;
+  `reason` explains unknown results. Verified failures remain visible with partial
+  data. Otherwise incomplete/unverified data takes precedence over cancellation,
+  pending and positive results.
+- `success` requires at least one executed success and all observed rows to be
+  non-blocking. Skipped/neutral-only results are `non_blocking`, not passing
+  execution. `pending`, `failure`, `cancelled` and `unknown` remain distinct;
+  raw conclusions retain timeout/action-required and unrecognized outcomes.
+
+Old receipts are not rewritten. Without matching target/scope metadata the
+human view marks recorded results unverified and offers the existing refresh;
+headless consumers must likewise treat absent provenance as unknown. These are
+observations of delivered-commit checks, not proof of required-check completion,
+branch protection, mergeability, deployment or model quality. Protected Verify,
+independent Review and explicit acceptance remain unchanged. #37 remains open
+for the other parity gaps above; no role/profile or workflow redesign is included.

package/docs/npm.md

@@ -104,8 +104,8 @@ installation or retained attempt needs them.
 
 ## Protected evidence compatibility
 
-Factory 0.12.0 recognizes version-1 execution profiles emitted by native
-**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1, 0.11.2 and 0.12.0**. This is an exact allowlist in
+Factory 0.13.1 recognizes version-1 execution profiles emitted by native
+**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1, 0.11.2, 0.12.0, 0.13.0 and 0.13.1**. This is an exact allowlist in
 `factory/execution-profile.mjs`, independent of the installed package version;
 it is not a semver range or an automatic promise for later releases. Unknown
 runtime strings, unknown profile formats and incomplete legacy acceptance
@@ -153,6 +153,28 @@ Version 0.12.0 adds the all-work Inbox read model and restores the retained
 overview. Protected execution writers and acceptance/publication guards are
 unchanged; the explicit compatible-writer entry preserves all checks above.
 
+Version 0.13.0 relocates byte-identical runtime skill instructions to
+`kit/skills/` and adds a read-only alias of that catalog for Codex discovery.
+The audit covers `execution-profile.mjs`, `processes.mjs`, executor candidate,
+check, review and acceptance writers, `execution-evidence.mjs` and both delivery
+capability/validation paths. The v1 schema, candidate reconstruction, current
+policy checks, isolation and model credential rules are unchanged. Foundation
+is outside the job catalog. Supported old immutable evidence remains subject
+to every existing guard; unknown later versions receive no automatic trust.
+
+Version 0.13.1 changes only delivered-commit check readback and its presentation.
+The same writer/validator audit above found no changes to protected v1 execution,
+candidate, check, review or acceptance writers, policy binding, isolation or
+credentials. The explicit 0.13.1 entry is covered by retained-profile capability
+and publication validation tests; old records remain immutable and unknown
+versions remain blocked. Provider check observations are separate from protected
+Verify evidence and cannot authorize acceptance or publication.
+
+Old installed releases retain their own files and mount paths until an idle,
+reviewed update. No installed catalog, execution profile or historical hash is
+rewritten by this layout change. Qualify the exact updated package/image before
+resuming work; retained releases/evidence stay available for recovery.
+
 New publication still requires the current remote target to equal the original
 accepted base; reviewed-candidate continuation preserves that baseline, while
 target refresh remains #72. See [the verification map](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/proof.md) for delivered

package/docs/setup.md

@@ -1,7 +1,13 @@
 # Factory Foundation: repository and execution setup
 
-The operator skill is available through `factory foundation`.
+The operator skill is available through `factory foundation`, including from
+an installed npm package without a source checkout. Its canonical source is
+[.agents/skills/factory-foundation/SKILL.md](../.agents/skills/factory-foundation/SKILL.md).
+Use it explicitly for adoption; it is independent of AIOS. Repository/operator
+guidance stays outside the runtime catalog at `kit/skills/`.
 See [Factory concepts](concepts.md) for host, worker, harness and agent roles.
+The [setup/deployment view](architecture.md#setup-and-deployment) shows operator
+access, the private execution host and the separate application delivery boundary.
 
 Use this plan for a new installation or when moving an existing Factory to an
 execution host. Complete the applicable checkpoints in order and record the
@@ -36,7 +42,19 @@ this plan.
 
 For method-only adoption, run `factory kit --output NEW_DIRECTORY`
 and follow [the adoption guide](../kit/README.md). The remaining host/runtime
-steps apply only when using Factory's optional controller.
+steps apply only when using Factory's optional controller. Export maps the six
+job skills into staged `.agents/skills/`; it never changes the application's
+AGENTS.md or installs global skills. Foundation stays in the installed package.
+
+Runtime jobs receive only the reviewed catalog as read-only `/factory-skills`.
+Codex agent phases also discover that same catalog at `/etc/codex/skills`; Pi
+uses `--skill /factory-skills`. Verify discovery on the exact installed image
+without credentials or inference (Codex native listing and Pi RPC
+`get_commands`), then qualify inference separately when authorized. Custom
+harness discovery remains operator-owned. A directory listing alone is not
+native discovery proof. Bundled instructions install no model, browser, Docker
+or provider access. Repository guidance remains readable project context and
+cannot expand job permissions.
 
 ## 2. Establish host access and boot prerequisites
 

package/docs/workflows.md

@@ -15,12 +15,16 @@ Defence currently runs **Investigate** against supplied scoped evidence and
 produces a private draft. It is not production monitoring, exploitation or
 verified recovery. See [Defence integration](defence-integration.md).
 
-The six bundled job skills cover triage, specification, implementation, review,
+The six bundled job skills in `kit/skills/` cover triage, specification, implementation, review,
 security and evaluation. They are instructions, not six running processes.
 All are mounted read-only for agent steps; the role prompt supplies the work
 boundary. Triage/specification prepare scope before admission; evaluation is a
 separately scoped comparison. Factory Foundation is an operator setup skill,
-kept outside those execution mounts.
+at `.agents/skills/factory-foundation/SKILL.md`, used explicitly for adoption
+and kept outside those execution mounts. CLI/API/Skills show actual installed
+paths, content and SHA-256. Codex additionally mounts the same runtime catalog at
+`/etc/codex/skills`; Pi uses `--skill /factory-skills`. Discovery on a particular
+image needs native qualification, and skills provide neither tools nor access.
 
 ## Start work
 

package/factory/definition.mjs

@@ -24,7 +24,7 @@ const skillRoles = {
 export function factoryDefinition(config) {
   const harness = harnessOf(config);
   const skills = Object.entries(skillRoles).map(([role, purpose]) => {
-    const id = `factory-${role}`, path = `.agents/skills/${id}/SKILL.md`;
+    const id = `factory-${role}`, path = `kit/skills/${id}/SKILL.md`;
     const content = readFileSync(join(ROOT, path), 'utf8');
     return { id, purpose, path, content, sha256: digest(content) };
   });
@@ -58,7 +58,7 @@ export function factoryDefinition(config) {
 }
 
 export function foundationSkill() {
-  const path = 'operator-skills/factory-foundation/SKILL.md';
+  const path = '.agents/skills/factory-foundation/SKILL.md';
   const content = readFileSync(join(ROOT, path), 'utf8');
   return { id: 'factory-foundation', purpose: 'Prepare a repository and host for bounded Factory work', path, content, sha256: digest(content) };
 }

package/factory/execution-profile.mjs

@@ -10,12 +10,15 @@ import { expectedWebStories, webPolicyHash } from './web-verification.mjs';
 // 0.9.1, 0.10.0, 0.11.0 and 0.11.1 (unchanged protected evidence writers),
 // 0.11.2 (exact patch bytes and pre-acceptance reconstruction; same v1 schema).
 // 0.12.0 restores the Inbox read model/presentation; protected writers and guards are unchanged.
+// 0.13.0 relocates identical job skills and adds a read-only Codex discovery alias.
+// 0.13.1 corrects read-only delivered-commit checks; protected v1 writers are unchanged.
+// Candidate/check/review/acceptance schemas, isolation and credential/permission guards are unchanged.
 // Older writers still require exact patch/tree reconstruction before publication.
 // Deliberately independent of VERSION: a release bump is not
 // evidence compatibility. Re-audit this list for every trust-relevant writer,
 // isolation or validation change; remove versions whose guarantees no longer
 // satisfy current policy. See docs/npm.md. This predicate alone grants no trust.
-const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2', '0.12.0']);
+const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2', '0.12.0', '0.13.0', '0.13.1']);
 
 export function isSupportedExecutionProfile(profile) {
   return profile?.version === 1 && SUPPORTED_EXECUTION_RUNTIMES_V1.has(profile.runtimeVersion);

package/factory/executor.mjs

@@ -91,7 +91,10 @@ async function container(mode, input, command, options = {}) {
     '--mount',`type=bind,source=${join(workspace,'.git')},target=/workspace/.git,readonly`];
   args.push('--mount',`type=bind,source=${reportDir},target=/output`,
     '--mount',`type=bind,source=${join(ROOT,'kit')},target=/factory-policy,readonly`,
-    '--mount',`type=bind,source=${join(ROOT,'.agents/skills')},target=/factory-skills,readonly`);
+    '--mount',`type=bind,source=${join(ROOT,'kit/skills')},target=/factory-skills,readonly`);
+  // The same reviewed catalog supplies Codex native discovery; no operator skills.
+  if (mode !== 'verify' && harnessOf(config) === 'codex')
+    args.push('--mount',`type=bind,source=${join(ROOT,'kit/skills')},target=/etc/codex/skills,readonly`);
   if (scratch) args.push('--mount',`type=bind,source=${scratch},target=/scratch`);
   if (mode === 'verify') args.push('--env',`FACTORY_BASE_REVISION=${git('rev-parse',`${metadata().base}^{commit}`)}`);
   const logPath = join(folder, attempt, `${mode}.log`);

package/factory/providers/github-delivery.mjs

@@ -32,45 +32,92 @@ function slug(repository) {
   return `${match[1]}/${match[2]}`;
 }
 
-function checkSummary(runs, status, pullRequestNumber) {
-  const checkRuns = Array.isArray(runs?.check_runs) ? runs.check_runs.slice(0, 100).map(run => ({
-    kind: 'check_run',
-    name: String(run.name || 'Unnamed check').slice(0, 200),
-    status: pullRequestNumber && Array.isArray(run.pull_requests)
-      && run.pull_requests.some(pull => pull.number === pullRequestNumber)
-      ? ['queued', 'in_progress', 'completed'].includes(run.status) ? run.status : 'unknown'
-      : 'unknown',
-    conclusion: typeof run.conclusion === 'string' ? run.conclusion : null,
-    url: typeof run.html_url === 'string' ? run.html_url : null,
-    passed: run.status === 'completed' && run.conclusion === 'success'
-      && pullRequestNumber && Array.isArray(run.pull_requests) && run.pull_requests.some(pull => pull.number === pullRequestNumber),
-    non_blocking: run.status === 'completed' && ['success', 'skipped', 'neutral'].includes(run.conclusion)
-      && pullRequestNumber && Array.isArray(run.pull_requests) && run.pull_requests.some(pull => pull.number === pullRequestNumber),
-  })) : [];
-  const contexts = Array.isArray(status?.statuses) ? status.statuses.slice(0, 100).map(item => ({
-    name: String(item.context || 'Unnamed status').slice(0, 200),
-    status: ['pending', 'success', 'failure', 'error'].includes(item.state) ? item.state : 'unknown',
-    url: typeof item.target_url === 'string' ? item.target_url : null,
-  })) : [];
-  const rows = [
-    ...checkRuns.map(item => ({ ...item, kind: 'check_run',
-      passed: item.status === 'completed' && item.conclusion === 'success',
-      non_blocking: item.status === 'completed' && ['success', 'skipped', 'neutral'].includes(item.conclusion) })),
-    ...contexts.map(item => ({ ...item, kind: 'commit_status', passed: item.status === 'success', non_blocking: item.status === 'success' })),
-  ];
+// This is observed commit evidence, never branch-protection or acceptance policy.
+function checkSummary(runs, status, target) {
+  const repositoryName = slug(target.repository).toLowerCase();
+  const repositoryAPI = `https://api.github.com/repos/${repositoryName}`;
+  const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+  const optionalIdentity = (value, expected) => value === undefined
+    || (typeof value === 'string' && value.toLowerCase() === expected);
+  // API self URLs identify a repository resource; CI details/target links do
+  // not. Status examples also use the legacy statuses/{sha} endpoint, whose
+  // suffix identifies the commit rather than the individual status ID.
+  const matchesSelfURL = (row, endpoint) => {
+    if (row.url === undefined) return true;
+    if (typeof row.url !== 'string') return false;
+    if (endpoint === 'statuses' && optionalIdentity(row.url, `${repositoryAPI}/statuses/${target.sha}`)) return true;
+    const match = row.url.match(/\/([1-9][0-9]*)$/);
+    return !!match && Number.isSafeInteger(Number(match[1]))
+      && optionalIdentity(row.url, `${repositoryAPI}/${endpoint}/${match[1]}`)
+      && (row.id === undefined || (Number.isSafeInteger(row.id) && String(row.id) === match[1]));
+  };
+  // Optional details may be absent, but supplied containers and identities must
+  // all agree. Optional chaining alone would erase malformed head/base values.
+  const matchesRepository = repo => repo === undefined || (object(repo)
+    && optionalIdentity(repo.full_name, repositoryName)
+    && optionalIdentity(repo.url, repositoryAPI)
+    && optionalIdentity(repo.html_url, target.repository.toLowerCase())
+    && optionalIdentity(repo.name, repositoryName.split('/')[1])
+    && (repo.owner === undefined || (object(repo.owner)
+      && optionalIdentity(repo.owner.login, repositoryName.split('/')[0]))));
+  const matchesPullSide = (side, head) => side === undefined || (object(side)
+    && (side.sha === undefined || (typeof side.sha === 'string' && /^[a-f0-9]{40}$/.test(side.sha)
+      && (!head || side.sha === target.sha)))
+    && matchesRepository(side.repo));
+  const checkRuns = Array.isArray(runs?.check_runs) ? runs.check_runs.slice(0, 100).map(run => {
+    const associations = run?.pull_requests;
+    const identity = object(run) && run.head_sha === target.sha && matchesSelfURL(run, 'check-runs') && Array.isArray(associations)
+      && associations.every(pull => object(pull) && pull.number === target.pull_request_number
+        && optionalIdentity(pull.url, `${repositoryAPI}/pulls/${target.pull_request_number}`)
+        && matchesPullSide(pull.head, true) && matchesPullSide(pull.base, false));
+    const runStatus = identity && ['queued', 'in_progress', 'completed'].includes(run?.status) ? run.status : 'unknown';
+    return {
+      kind: 'check_run',
+      name: String(run?.name || 'Unnamed check').slice(0, 200),
+      head_sha: typeof run?.head_sha === 'string' ? run.head_sha : null,
+      scope: identity ? (associations.length ? 'pull_request' : 'commit') : 'unknown',
+      status: runStatus,
+      conclusion: typeof run?.conclusion === 'string' ? run.conclusion : null,
+      url: typeof run?.html_url === 'string' ? run.html_url : null,
+      passed: runStatus === 'completed' && run.conclusion === 'success',
+      non_blocking: runStatus === 'completed' && ['success', 'skipped', 'neutral'].includes(run.conclusion),
+    };
+  }) : [];
+  const statusIdentity = object(status) && status.sha === target.sha
+    && object(status.repository) && typeof status.repository.full_name === 'string'
+    && matchesRepository(status.repository)
+    && optionalIdentity(status.commit_url, `${repositoryAPI}/commits/${target.sha}`)
+    && optionalIdentity(status.url, `${repositoryAPI}/commits/${target.sha}/status`);
+  const contexts = Array.isArray(status?.statuses) ? status.statuses.slice(0, 100).map(item => {
+    const identity = statusIdentity && object(item) && matchesSelfURL(item, 'statuses');
+    const itemStatus = identity && ['pending', 'success', 'failure', 'error'].includes(item?.state) ? item.state : 'unknown';
+    return {
+      kind: 'commit_status',
+      name: String(item?.context || 'Unnamed status').slice(0, 200),
+      head_sha: typeof status?.sha === 'string' ? status.sha : null,
+      scope: identity ? 'commit' : 'unknown',
+      status: itemStatus,
+      url: typeof item?.target_url === 'string' ? item.target_url : null,
+      passed: itemStatus === 'success', non_blocking: itemStatus === 'success',
+    };
+  }) : [];
+  const rows = [...checkRuns, ...contexts];
   const failed = rows.some(item => item.kind === 'check_run'
-    ? item.status === 'completed' && ['failure', 'action_required', 'timed_out', 'cancelled'].includes(item.conclusion)
+    ? item.status === 'completed' && ['failure', 'action_required', 'timed_out'].includes(item.conclusion)
     : item.status === 'failure' || item.status === 'error');
+  const cancelled = rows.some(item => item.status === 'completed' && item.conclusion === 'cancelled');
   const pending = rows.some(item => item.status === 'pending' || item.status === 'queued' || item.status === 'in_progress');
-  const unknown = rows.some(item => item.status === 'unknown'
+  const unknown = !statusIdentity || rows.some(item => item.status === 'unknown'
     || (item.kind === 'check_run' && item.status === 'completed'
       && !['success', 'skipped', 'neutral', 'failure', 'action_required', 'timed_out', 'cancelled'].includes(item.conclusion)));
-  const complete = Number.isSafeInteger(runs?.total_count) && runs.total_count === checkRuns.length
-    && Number.isSafeInteger(status?.total_count) && status.total_count === contexts.length;
+  const completePage = (payload, key) => Array.isArray(payload?.[key]) && payload[key].length <= 100
+    && Number.isSafeInteger(payload.total_count) && payload.total_count === payload[key].length;
+  const complete = completePage(runs, 'check_runs') && completePage(status, 'statuses');
   const onlyNonBlocking = rows.length > 0 && rows.every(item => item.non_blocking);
-  const state = failed ? 'failure' : !complete || unknown ? 'unknown' : pending ? 'pending'
+  const state = failed ? 'failure' : !complete || unknown ? 'unknown' : cancelled ? 'cancelled' : pending ? 'pending'
     : onlyNonBlocking ? (rows.some(item => item.passed) ? 'success' : 'non_blocking') : 'unknown';
-  return { state, pagination_complete: complete, check_runs: checkRuns, commit_statuses: contexts };
+  return { state, target, pagination_complete: complete, check_runs: checkRuns, commit_statuses: contexts,
+    ...(state === 'unknown' ? { reason: 'Check readback is empty, incomplete or contains unverified identity or status.' } : {}) };
 }
 
 export function githubDeliveryProvider({ request = requestGitHub } = {}) {
@@ -145,16 +192,17 @@ export function githubDeliveryProvider({ request = requestGitHub } = {}) {
       return get(`${apiRoot}/${slug(repository)}/pulls/${number}`);
     },
     async readChecks(repository, sha, pullRequestNumber) {
-      if (!Number.isSafeInteger(pullRequestNumber) || pullRequestNumber < 1)
-        return { state: 'unknown', check_runs: [], commit_statuses: [], reason: 'A pull request identity is required to associate checks with delivery.' };
+      if (!Number.isSafeInteger(pullRequestNumber) || pullRequestNumber < 1 || !/^[a-f0-9]{40}$/.test(sha || ''))
+        return { state: 'unknown', target: null, pagination_complete: false, check_runs: [], commit_statuses: [], reason: 'A valid pull request number and immutable delivered commit are required.' };
+      const target = { repository, sha, pull_request_number: pullRequestNumber };
       try {
         const [runs, status] = await Promise.all([
           get(`${apiRoot}/${slug(repository)}/commits/${sha}/check-runs?per_page=100`),
           get(`${apiRoot}/${slug(repository)}/commits/${sha}/status?per_page=100`),
         ]);
-        return checkSummary(runs, status, pullRequestNumber);
+        return checkSummary(runs, status, target);
       } catch {
-        return { state: 'unknown', check_runs: [], commit_statuses: [], reason: 'GitHub checks could not be read with the configured identity.' };
+        return { state: 'unknown', target, pagination_complete: false, check_runs: [], commit_statuses: [], reason: 'GitHub checks could not be read with the configured identity.' };
       }
     },
   };