triad-plus 1.12.0 → 1.12.2

package/CHANGELOG.md

@@ -1,6 +1,23 @@
 # Changelog
 
-## Unreleased
+## 1.12.2 — 2026-09-26
+
+- Fix compatibility for historical assignments with `scope_contract: null` and
+  omit unconfigured scope contracts from new bootstrap templates while keeping
+  valid scope enforcement fail-closed.
+- Clarify the exact explicit verifier identity/run-id invocation contract and
+  the omission rule for unconfigured repository-skill bindings.
+- Clarify the bounded Card and delivery handoff report-context contract without
+  changing Reviewer independence or deterministic verification semantics.
+
+## 1.12.1 — 2026-09-26
+
+- Bind approved human-readable Card reports to the independently verified
+  candidate manifest, preserving the pre-commit verifier fingerprint while
+  recording the committed fingerprint separately.
+- Preserve raw candidate bytes for commit-derived hashes, fail closed on
+  post-verification path/content changes, and retain legacy no-manifest
+  behavior without silently widening the verified candidate.
 
 ## 1.12.0 — 2026-09-23
 

package/docs/human-readable-reports.md

@@ -29,12 +29,35 @@ node .triad-runtime/triad-human-report.mjs \
   --base-commit <card-baseline-commit>
 ```
 
-For an approved Card the renderer requires a final commit, candidate
-fingerprint, passing verifier evidence, independent Reviewer approval, and the
-complete changed-path manifest. A blocked or not-delivered terminal Card must
+For an approved Card the renderer requires a final commit, the candidate
+fingerprint recorded by passing verifier evidence, independent Reviewer
+approval, and the complete changed-path manifest. Current verifier evidence
+also carries a `candidate_manifest` with the verified paths and content hashes.
+The renderer binds that manifest to the final commit delta (allowing the
+expected `git_head` change caused by the commit) and records the resulting
+committed fingerprint separately. A blocked or not-delivered terminal Card must
 include a truthful reason and never claims delivery. Writes are atomic and
 re-running the command with the same context is idempotent.
 
+### Card context checklist
+
+The derived card context should carry only canonical control-plane fields:
+
+- `card.id` (and its title, goal/outcome, repository, and card path);
+- terminal `status`, `attempts`, and verification runs;
+- at least one passing verification run with its evidence path and candidate
+  fingerprint;
+- independent `review.decision: approved` and its evidence/fingerprint;
+- `final.branch`, `final.commit`, `final.repository`, `final.base_commit`, and
+  `final.candidate_fingerprint`;
+- assignment/packet/verification provenance and bounded evidence references.
+
+For an approved card, `final.candidate_fingerprint` is the pre-commit
+fingerprint recorded by the passing verifier. The renderer computes and records
+`final.committed_candidate_fingerprint` from the committed delta; do not replace
+the verified fingerprint with a newly calculated value in the input context.
+The source card and canonical evidence remain read-only.
+
 ## Materialize the final handoff
 
 ```bash
@@ -50,3 +73,21 @@ links to the technical evidence, branch/commit map, quality-contract closure,
 Evaluator+ result, delivery gates, demo details, risks, and practical test.
 It is a view for people, not an alternative delivery state machine.
 
+### Handoff context checklist
+
+The derived handoff context must include a non-empty `cards` list and a
+`decision` plus `executive_summary`. Each card entry carries `id`, `title`,
+`status`, `summary`, `report_path`, and, when available, `commit`,
+`candidate_fingerprint`, `verification`, `review`, `evaluator_report`, and
+`evidence_refs`. The remaining canonical handoff fields are:
+
+`code_areas`, `residual`, `verification`, `review`, `branch_commits`,
+`practical_test`, `evaluator`, `delivery`, `quality_contract`,
+`delivery_criteria`, `demo`, `evidence_refs`, `exceptions`, `prd_baseline`,
+`approved_cards`, `push_evidence`, `gate_metrics`,
+`local_worktree_integration`, `delivery_closure_record`, `final_message`,
+`risks`, and `generated_from`.
+
+Populate fields from canonical run, card, verifier, Reviewer, Evaluator+, and
+delivery records. Do not pass Developer reasoning, queue-control narrative, or
+unbounded source documents merely to satisfy the renderer.

package/docs/verification.md

@@ -17,6 +17,36 @@ An agent-reported claim is not the same as verification evidence. A Developer ca
 report the commands it ran; `triad-verify` independently observes declared
 required `control-plane` gates and writes atomic evidence.
 
+## Explicit verifier dispatch contract
+
+When the configured route is `explicit_dispatch`, invoke the installed verifier
+with the active assignment's exact Developer identity. The trigger is supplied
+as JSON on stdin; it is not inferred from the shell process or from the card:
+
+```bash
+agent_id="<assignment.agent_id>"
+run_id="<assignment.verification_run_id>"
+printf '{"event":"manual_explicit_dispatch","agent_id":"%s","agent_type":"triad_developer","run_id":"%s"}' "$agent_id" "$run_id" |
+  node .triad-runtime/triad-verify.mjs \
+    --project /absolute/path/to/control-workspace \
+    --assignment /absolute/path/to/control-workspace/.loop/runtime/assignments/<assignment-file>.json \
+    --run-id "$run_id"
+```
+
+`agent_id` must match the active assignment exactly and `agent_type` must be
+`triad_developer`. The `run_id` on stdin and `--run-id` must match the active
+assignment when one is bound. A missing or mismatched trigger is
+`invalid_context`; no gate runs and no retry/remediation budget is consumed.
+
+When the repository has no router or required repository skills, omit the
+`required_repository_skills` property from the assignment. Do not represent an
+unconfigured binding as a present empty array: a present array is a declared
+binding and must contain at least one validated skill. This documents existing
+runtime behavior; it does not add a new verifier mode or transition.
+
+`triad-verify.mjs` does not expose a help screen. Use the assignment, project
+configuration, and this explicit recipe rather than invoking it with `--help`.
+
 ## Immutable Quality Contract
 
 Projects may opt into `project.quality_contract` with a project-relative JSON

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triad-plus",
-  "version": "1.12.0",
+  "version": "1.12.2",
   "description": "A lightweight, evidence-backed engineering loop for coding agents.",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,7 +28,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "test": "node tests/runtime-forward-test.mjs && node tests/retry-scope-contracts-test.mjs && node tests/cli-install-test.mjs && node tests/installation-manifest-test.mjs && node tests/codex-liveness-test.mjs && node tests/bmad-story-importer-test.mjs && node tests/bmad-epics-intake-test.mjs && node tests/immutable-quality-contract-test.mjs && node tests/assignment-packet-test.mjs && node tests/repository-context-test.mjs && node tests/tui-model-configuration-test.mjs && node tests/human-reports-test.mjs",
+    "test": "node tests/runtime-forward-test.mjs && node tests/retry-scope-contracts-test.mjs && node tests/cli-install-test.mjs && node tests/installation-manifest-test.mjs && node tests/codex-liveness-test.mjs && node tests/bmad-story-importer-test.mjs && node tests/bmad-epics-intake-test.mjs && node tests/immutable-quality-contract-test.mjs && node tests/assignment-packet-test.mjs && node tests/repository-context-test.mjs && node tests/tui-model-configuration-test.mjs && node tests/human-reports-test.mjs && node tests/human-report-fingerprint-binding-test.mjs",
     "pack:check": "npm pack --dry-run"
   },
   "repository": {

package/runtime/lib/fingerprint.mjs

@@ -63,6 +63,67 @@ function pathsFor(entry) {
   return entry.status === "renamed" ? [entry.source, entry.destination] : [entry.path];
 }
 
+function candidateManifest(candidate, files) {
+  return {
+    base_commit: candidate.base_commit,
+    git_head: candidate.git_head,
+    changes: candidate.changes,
+    ignored_paths: candidate.ignored_paths,
+    files,
+  };
+}
+
+/**
+ * Return the content/path binding captured for a candidate independently of
+ * the Git commit identity used to produce it. The fingerprint value below
+ * intentionally retains its historical git_head binding; reports use this
+ * manifest to bind that verified candidate to the later commit tree.
+ */
+export function candidateManifestFor(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  if (!Array.isArray(value.files) || !Array.isArray(value.changes)) return null;
+  return {
+    base_commit: value.base_commit ?? null,
+    git_head: value.git_head ?? null,
+    changes: value.changes,
+    ignored_paths: Array.isArray(value.ignored_paths) ? value.ignored_paths : [],
+    files: value.files,
+  };
+}
+
+function changePaths(manifest) {
+  return (manifest?.changes ?? []).flatMap((change) => change?.status === "renamed"
+    ? [change.source, change.destination]
+    : [change.path]).filter((value) => typeof value === "string").sort();
+}
+
+function fileEntries(manifest) {
+  return (manifest?.files ?? [])
+    .map((file) => ({ path: file?.path, sha256: file?.sha256 }))
+    .sort((left, right) => String(left.path).localeCompare(String(right.path)));
+}
+
+function ignoredPaths(manifest) {
+  return [...new Set(manifest?.ignored_paths ?? [])].filter((value) => typeof value === "string").sort();
+}
+
+/**
+ * Compare a verifier's pre-commit manifest with a commit-derived manifest.
+ * git_head is deliberately excluded: committing an unchanged candidate is
+ * expected to change that identity. Paths and content hashes are not ignored,
+ * so a file added or modified after verification fails closed.
+ */
+export function candidateManifestsBind(verified, committed, { expectedBaseCommit = null } = {}) {
+  const left = candidateManifestFor(verified);
+  const right = candidateManifestFor(committed);
+  if (!left || !right) return false;
+  if (expectedBaseCommit && (left.base_commit !== expectedBaseCommit || right.base_commit !== expectedBaseCommit)) return false;
+  if (left.base_commit !== right.base_commit) return false;
+  if (JSON.stringify(ignoredPaths(left)) !== JSON.stringify(ignoredPaths(right))) return false;
+  if (JSON.stringify(fileEntries(left)) !== JSON.stringify(fileEntries(right))) return false;
+  return JSON.stringify(changePaths(left)) === JSON.stringify(changePaths(right));
+}
+
 export async function collectCandidateChanges(worktree, { baseCommit = null } = {}) {
   const root = await realpath(worktree);
   const head = (await gitLines(root, ["rev-parse", "HEAD"]))[0] ?? "NO_HEAD";
@@ -120,7 +181,7 @@ export async function collectCandidateChangesAtCommit(worktree, { baseCommit, co
 }
 
 async function commitFileHash(root, commit, relativePath) {
-  const result = await runProcess("git", ["show", `${commit}:${relativePath}`], { cwd: root, timeoutMs: 15_000 });
+  const result = await runProcess("git", ["show", `${commit}:${relativePath}`], { cwd: root, timeoutMs: 15_000, encoding: null });
   if (result.exitCode !== 0) throw new Error(`git show failed for ${commit}:${relativePath}`);
   return digest(result.stdout);
 }
@@ -144,7 +205,13 @@ export async function calculateCandidateFingerprintAtCommit(worktree, { baseComm
     files.push({ path: relativePath, sha256: contentHash });
   }
   const canonical = JSON.stringify({ git_head: candidate.git_head, files });
-  return { algorithm: "sha256", value: digest(canonical), git_head: candidate.git_head, files };
+  return {
+    algorithm: "sha256",
+    value: digest(canonical),
+    git_head: candidate.git_head,
+    files,
+    manifest: candidateManifest(candidate, files),
+  };
 }
 
 export async function worktreeBranch(worktree) {
@@ -181,5 +248,11 @@ export async function calculateCandidateFingerprint(worktree) {
     files.push({ path: relativePath, sha256: contentHash });
   }
   const canonical = JSON.stringify({ git_head: candidate.git_head, files });
-  return { algorithm: "sha256", value: digest(canonical), git_head: candidate.git_head, files };
+  return {
+    algorithm: "sha256",
+    value: digest(canonical),
+    git_head: candidate.git_head,
+    files,
+    manifest: candidateManifest(candidate, files),
+  };
 }

package/runtime/lib/human-reports.mjs

@@ -1,6 +1,6 @@
 import path from "node:path";
 import { readFile } from "node:fs/promises";
-import { calculateCandidateFingerprintAtCommit, collectCandidateChangesAtCommit } from "./fingerprint.mjs";
+import { calculateCandidateFingerprintAtCommit, candidateManifestsBind, collectCandidateChangesAtCommit } from "./fingerprint.mjs";
 import { writeAtomicText } from "./evidence.mjs";
 
 export const HUMAN_REPORT_SCHEMA_VERSION = 1;
@@ -121,6 +121,7 @@ function validateVerification(run, index, context = {}) {
     })),
     evidence_path: reportPath(run.evidence_path ?? run.path, context),
     candidate_fingerprint: optionalString(run.candidate_fingerprint, `verification ${index + 1} candidate_fingerprint`),
+    candidate_manifest: run.candidate_manifest ?? run.baseline?.candidate_manifest ?? null,
     notes: text(run.notes, "—"),
   };
 }
@@ -150,6 +151,7 @@ function validateFinal(final, status) {
     commit: optionalString(final.commit ?? final.final_commit, "final commit"),
     base_commit: optionalString(final.base_commit, "final base_commit"),
     candidate_fingerprint: optionalString(final.candidate_fingerprint, "final candidate_fingerprint"),
+    committed_candidate_fingerprint: optionalString(final.committed_candidate_fingerprint, "final committed_candidate_fingerprint"),
     worktree: optionalString(final.worktree, "final worktree"),
     repository: optionalString(final.repository, "final repository"),
   };
@@ -260,7 +262,7 @@ export function renderCardReport(input, options = {}) {
     ? review.findings.map((finding) => `| ${tableCell(finding.severity)} | ${tableCell(finding.finding)} | ${tableCell(finding.evidence)} | ${tableCell(finding.resolution)} |`)
     : ["| — | No findings recorded | — | None |"];
   const finalEvidence = report.status === "approved"
-    ? `- Final commit: \`${tableCell(report.final.commit)}\`\n- Candidate fingerprint: \`${tableCell(report.final.candidate_fingerprint)}\`\n- Reviewer decision: \`${tableCell(review?.decision)}\``
+    ? `- Final commit: \`${tableCell(report.final.commit)}\`\n- Verified candidate fingerprint: \`${tableCell(report.final.candidate_fingerprint)}\`\n- Committed candidate fingerprint: \`${tableCell(report.final.committed_candidate_fingerprint ?? "not recorded")}\`\n- Reviewer decision: \`${tableCell(review?.decision)}\``
     : `- Terminal state: \`${status}\`\n- Reason: ${text(report.block_reason)}`;
   return `# Card report — ${report.card.id}: ${report.card.title}
 
@@ -466,6 +468,7 @@ export async function writeCardReport(input, { outputPath, projectRoot = null, w
   const preliminary = normalizeCardReportInput(input, { projectRoot, worktree });
   let changedPaths = preliminary.changed_paths;
   let changedPathsBase = preliminary.changed_paths_base ?? baseCommit;
+  let committedCandidateFingerprint = preliminary.final.committed_candidate_fingerprint;
   if (preliminary.status === "approved") {
     if (!worktree || !(baseCommit ?? preliminary.final.base_commit) || !preliminary.final.commit) {
       throw reportError("human_report_invalid", "approved card report requires a worktree, card baseline, and final commit for canonical evidence");
@@ -480,11 +483,25 @@ export async function writeCardReport(input, { outputPath, projectRoot = null, w
       baseCommit: candidate.base_commit,
       commit: candidate.git_head,
     });
-    if (actualFingerprint.value !== preliminary.final.candidate_fingerprint) {
+    const passingRuns = preliminary.verification.filter((run) =>
+      (run.status === "pass" || run.status === "PASS")
+      && run.candidate_fingerprint === preliminary.final.candidate_fingerprint);
+    const passingRun = passingRuns.find((run) => run.candidate_manifest) ?? passingRuns[0];
+    if (passingRun?.candidate_manifest) {
+      if (!candidateManifestsBind(passingRun.candidate_manifest, actualFingerprint.manifest, { expectedBaseCommit: candidate.base_commit })) {
+        throw reportError("human_report_invalid", "committed candidate does not match the independently verified candidate manifest");
+      }
+    } else if (actualFingerprint.value !== preliminary.final.candidate_fingerprint) {
       throw reportError("human_report_invalid", "final candidate fingerprint does not match the final commit delta");
     }
+    committedCandidateFingerprint = actualFingerprint.value;
   }
-  const report = { ...preliminary, changed_paths: changedPaths ?? [], changed_paths_base: changedPathsBase };
+  const report = {
+    ...preliminary,
+    final: { ...preliminary.final, committed_candidate_fingerprint: committedCandidateFingerprint ?? null },
+    changed_paths: changedPaths ?? [],
+    changed_paths_base: changedPathsBase
+  };
   const markdown = renderCardReport(report, { projectRoot, worktree });
   if (outputPath) {
     try {

package/runtime/lib/process.mjs

@@ -2,11 +2,11 @@ import { spawn } from "node:child_process";
 import process from "node:process";
 
 export function runProcess(command, args = [], options = {}) {
-  const { cwd, timeoutMs = 600_000, shell = false, killGraceMs = 2_000 } = options;
+  const { cwd, timeoutMs = 600_000, shell = false, killGraceMs = 2_000, encoding = "utf8" } = options;
   return new Promise((resolve) => {
     const detached = process.platform !== "win32";
     const child = spawn(command, args, { cwd, shell, detached, stdio: ["ignore", "pipe", "pipe"] });
-    let stdout = "";
+    let stdout = encoding === null ? [] : "";
     let stderr = "";
     let timedOut = false;
     let forceTimer;
@@ -15,13 +15,16 @@ export function runProcess(command, args = [], options = {}) {
       signalProcess(child, "SIGTERM", detached);
       forceTimer = setTimeout(() => signalProcess(child, "SIGKILL", detached), killGraceMs);
     }, timeoutMs);
-    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stdout.on("data", (chunk) => {
+      if (encoding === null) stdout.push(Buffer.from(chunk));
+      else stdout += chunk;
+    });
     child.stderr.on("data", (chunk) => { stderr += chunk; });
     child.on("error", (error) => { stderr += `${error.message}\n`; });
     child.on("close", (exitCode, signal) => {
       clearTimeout(timer);
       clearTimeout(forceTimer);
-      resolve({ exitCode: exitCode ?? 1, signal, timedOut, stdout, stderr });
+      resolve({ exitCode: exitCode ?? 1, signal, timedOut, stdout: encoding === null ? Buffer.concat(stdout) : stdout, stderr });
     });
   });
 }

package/runtime/triad-verify.mjs

@@ -115,7 +115,10 @@ function withinRoot(root, candidate, label) {
 
 async function scopePreflight(projectRoot, worktree, assignment) {
   const specification = assignment.scope_contract;
-  if (specification === undefined) {
+  // v1.12.1's assignment template materialized an unconfigured scope as
+  // `null`. Treat that historical sentinel exactly like an omitted contract,
+  // while continuing to fail closed for every malformed non-null value.
+  if (specification === undefined || specification === null) {
     const candidate = await collectCandidateChanges(worktree);
     return {
       configured: false,
@@ -236,6 +239,7 @@ async function main() {
           candidate_fingerprint: before.value,
           branch,
         },
+        candidate_manifest: before.manifest,
         assignment_packet: assignmentPacket,
         repository_skills: repositorySkills,
         scope,
@@ -266,14 +270,15 @@ async function main() {
       trigger,
       assignment_ref: path.relative(projectRoot, assignmentPath),
       baseline: {
-          prd_sha256: assignment.expected_prd_sha256,
-          card_sha256: assignment.expected_card_sha256,
-          quality_baseline_fingerprint: qualityBaseline?.fingerprint ?? null,
-          gates_sha256: trusted.actualHash,
+        prd_sha256: assignment.expected_prd_sha256,
+        card_sha256: assignment.expected_card_sha256,
+        quality_baseline_fingerprint: qualityBaseline?.fingerprint ?? null,
+        gates_sha256: trusted.actualHash,
         git_head: before.git_head,
         candidate_fingerprint: before.value,
         branch,
       },
+      candidate_manifest: before.manifest,
       assignment_packet: assignmentPacket,
       repository_skills: repositorySkills,
       scope,

package/schemas/verification-evidence.schema.json

@@ -13,6 +13,39 @@
     "assignment_sha256": { "type": ["string", "null"] },
     "trigger": { "type": "object", "required": ["event", "agent_id", "agent_type"], "properties": { "event": { "type": "string" }, "agent_id": { "type": ["string", "null"] }, "agent_type": { "type": ["string", "null"] } } },
     "baseline": { "type": "object", "required": ["prd_sha256", "card_sha256", "git_head", "candidate_fingerprint"], "properties": { "prd_sha256": { "type": ["string", "null"] }, "card_sha256": { "type": ["string", "null"] }, "quality_baseline_fingerprint": { "type": ["string", "null"], "pattern": "^[a-fA-F0-9]{64}$" }, "git_head": { "type": ["string", "null"] }, "candidate_fingerprint": { "type": ["string", "null"] }, "branch": { "type": ["string", "null"] } } },
+    "candidate_manifest": {
+      "type": ["object", "null"],
+      "required": ["base_commit", "git_head", "changes", "ignored_paths", "files"],
+      "properties": {
+        "base_commit": { "type": ["string", "null"] },
+        "git_head": { "type": ["string", "null"] },
+        "changes": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["status"],
+            "properties": {
+              "status": { "type": "string" },
+              "path": { "type": ["string", "null"] },
+              "source": { "type": ["string", "null"] },
+              "destination": { "type": ["string", "null"] }
+            }
+          }
+        },
+        "ignored_paths": { "type": "array", "items": { "type": "string" } },
+        "files": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["path", "sha256"],
+            "properties": {
+              "path": { "type": "string" },
+              "sha256": { "type": "string" }
+            }
+          }
+        }
+      }
+    },
     "assignment_packet": {
       "type": ["object", "null"],
       "required": ["path", "sha256"],

package/skills/triad-loop-bootstrap/assets/loop-template/runtime/assignments/assignment.template.json

@@ -20,7 +20,6 @@
   "quality_baseline_path": null,
   "expected_quality_baseline_fingerprint": null,
   "required_gate_ids": [],
-  "scope_contract": null,
   "required_repository_skills": [
     {
       "path": ".agents/skills/router/SKILL.md",

package/skills/triad-loop-bootstrap/assets/loop-template/runtime/report-context/card.template.json

@@ -20,6 +20,7 @@
     "commit": "REPLACE_ME",
     "base_commit": "REPLACE_ME",
     "candidate_fingerprint": "REPLACE_ME",
+    "committed_candidate_fingerprint": null,
     "worktree": "REPLACE_ME_ABSOLUTE_PRODUCT_WORKTREE"
   },
   "evidence_refs": [],

package/skills/triad-loop-orchestrator/SKILL.md

@@ -153,7 +153,24 @@ fail-closed escalation; do not dispatch a Developer or consume retry budget.
    for a missing detail or contradiction, not systematic startup context.
 4. After completion, move to `verifying`. Follow the recorded dispatch route:
    wait for a valid hook-produced file when one is configured, otherwise invoke
-   the verifier explicitly. Accept only current evidence whose assignment ID,
+   the verifier with the exact active Developer identity. For explicit dispatch,
+   pipe the trigger JSON and bind the same run ID on stdin and argv:
+
+   ```bash
+   agent_id="<assignment.agent_id>"
+   run_id="<assignment.verification_run_id>"
+   printf '{"event":"manual_explicit_dispatch","agent_id":"%s","agent_type":"triad_developer","run_id":"%s"}' "$agent_id" "$run_id" |
+     node .triad-runtime/triad-verify.mjs \
+       --project /absolute/path/to/control-workspace \
+       --assignment /absolute/path/to/control-workspace/.loop/runtime/assignments/<assignment-file>.json \
+       --run-id "$run_id"
+   ```
+
+   Do not substitute a generic `manual` trigger or a different agent identity.
+   When no repository skills are configured, omit
+   `required_repository_skills` from the assignment; a present empty array is
+   a declared binding and fails closed. These are existing runtime semantics,
+   not a new verification behavior. Accept only current evidence whose assignment ID,
    feature, attempt, PRD/card/gate hashes, expected branch, and candidate
    fingerprint match the active candidate. When an opt-in scope contract is
    configured, `triad-verify` first compares the complete candidate delta from
@@ -213,8 +230,17 @@ candidate fingerprint. Do not copy Developer prose as changed-path evidence.
 
 For an approved Card, the context must include the final commit and fingerprint,
 at least one current passing verifier record, an independent Reviewer approval,
-and the complete Card-baseline commit. Materialize the report with the installed
-runtime command, which collects the complete baseline delta from Git:
+and the complete Card-baseline commit. The final candidate fingerprint in this
+context is the identity recorded by the passing verifier (the pre-commit
+candidate), not a newly recalculated commit fingerprint. Preserve the verifier's
+`candidate_manifest` alongside that record. The report runtime binds that
+independently verified path/content manifest to the final commit delta and
+records both the verified fingerprint and the committed fingerprint. It ignores
+only the expected `git_head` identity change caused by committing; added,
+removed, renamed, or modified paths and their content hashes must still match.
+If a legacy verifier record has no manifest, the historical fingerprint equality
+check remains fail-closed. Materialize the report with the installed runtime
+command, which collects the complete baseline delta from Git:
 
 ```bash
 node .triad-runtime/triad-human-report.mjs \