[CompleteDotTech]

Fixes #17

The standalone reports previously retained row evidence and run counts without identifying the checker build that acquired them. Add a run-level provenance envelope with the checker name/version, SHA-256 of the standalone executable, canonical embedded-rule digest/date, and one UTC generation timestamp. JSON, CSV result/empty-summary records and HTML retain that identity and distinguish it from observation time. Checkpoint recovery preserves the original acquisition identity; legacy checkpoints remain readable with explicitly unknown identity rather than being attributed to the recovery executable.

Validation: five new provenance regression methods fail on the unchanged parent. The full Windows suite passes (196 tests, 25 platform skips); all five provenance methods also pass on native Linux, including symlink/copy identity. CLI help, skill metadata validation and committed whitespace checks pass. Tests are synthetic/offline; existing scope, TLS/robots/pacing/deadline, checkpoint output protection and uncertainty behavior remain intact.

Stacked dependency: parent #20 at 0c755e124cbd37b1c071061a3667ae93c200c19a must actually merge before this PR, followed by final base reconciliation and required reviews/checks. Parent dependencies #19 and #18 are transitive. Hosted Copilot exact-final-head review remains required; no merge is authorized without the coordinator gate.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T03:11:36.480540Z	059caee	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ae056b9a4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[CompleteDotTech]

Exact-head validation at 8ae056b9a4f2806f6cb83c5b42d91726233f1a55: all 10 hosted checks passed. Local full suite: 196 tests successful, 25 platform skips. Five new provenance regression methods also passed on native Linux. The same methods fail against unchanged parent 0c755e124cbd37b1c071061a3667ae93c200c19a. Skill validation, CLI help and committed diff checks passed.

Required hosted Copilot is blocked: the documented copilot-pull-request-reviewer[bot] request returned successfully, but readback has no requested reviewer, no review_requested event, no completed review and no inline comments. This is not approval. PR remains unmerged, and parent PR #20 must actually merge before final reconciliation/merge.

[CompleteDotTech]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 059caee3af

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[CompleteDotTech]

Final validation for signed head 059caee3afbc4ee19e49ca7d4769c84ad3085a81: all 10 hosted CI checks passed, full local suite 197 tests successful (25 platform skips), six native Linux provenance tests passed. The one hosted Codex finding was fixed with a changed-rules recovery regression, evidence reply, and verified resolved discussion. Fresh hosted Codex review completed on this exact head with has_any_findings=false and has_unresolved_findings=false (summary comment 6407301302).

Required GitHub Copilot is still unregistered: documented bot requests return success but no requested reviewer or completed Copilot review. Codex is supplemental, not a substitute. This stacked PR remains unmerged; parent PR #20 must actually merge before final coordinator reconciliation.