diff --git a/.Jules/palette.md b/.Jules/palette.md
index 159662d06c..9864e9e356 100644
--- a/.Jules/palette.md
+++ b/.Jules/palette.md
@@ -1,3 +1,5 @@
-## 2024-05-20 - Repository without UI Codebase
-**Learning:** This repository is a GitHub organization profile consisting entirely of Markdown documentation and static assets, and does not contain an active UI or frontend application codebase.
-**Action:** Since there is no UI, no UX enhancements can be applied. Aborting UX enhancements and PR creation as per instructions.
+## 2026-09-29 - Product UI boundary confirmed
+
+**Learning:** This repository owns the ContextualWisdomLab GitHub Actions control plane, including production CI scripts, tests, workflows, and documentation. It does not own an interactive product UI or frontend application.
+
+**Action:** Do not invent product UI work in this repository. Improve the control-plane artifacts here and route reusable product UI work to its canonical product owner.
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000000..dbd43187c2
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,5 @@
+# Source validation only; labels do not attest runtime isolation.
+self-hosted-runner:
+  labels:
+    - cwlab-ci-isolated
+    - cwlab-control
diff --git a/.github/actions/noema-review/two_phase.py b/.github/actions/noema-review/two_phase.py
index c850da81b9..d5da7b8270 100755
--- a/.github/actions/noema-review/two_phase.py
+++ b/.github/actions/noema-review/two_phase.py
@@ -156,6 +156,7 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
         return 0
     expected_base = _canonical_base(pull_request)
     actor = _reviewer_actor()
+    author = gate.require_distinct_pr_author(pull_request, actor)
     if pull_request.get("isDraft"):
         print("PR is draft; Noema verdict preparation skipped.")
         return 0
@@ -190,6 +191,8 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             "pull_request_number": number,
             "expected_head": expected,
             "expected_base": expected_base,
+            "reviewer_actor": actor,
+            "pull_request_author": author,
             "verdict": verdict,
         },
     )
@@ -250,6 +253,8 @@ def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             "pull_request_number",
             "expected_head",
             "expected_base",
+            "reviewer_actor",
+            "pull_request_author",
             "verdict",
         }
         if set(payload) != required_keys:
@@ -277,6 +282,14 @@ def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             print("Pull request base advanced after model review; stale prepared verdict was not published.")
             return 0
         actor = _reviewer_actor(allow_refreshed_app=True)
+        author = gate.require_distinct_pr_author(current_pull_request, actor)
+        if payload["pull_request_author"] != author:
+            raise RuntimeError("Noema pull request author changed after verdict preparation")
+        reviewer_actor = payload["reviewer_actor"]
+        if not isinstance(reviewer_actor, str) or not reviewer_actor.strip():
+            raise RuntimeError("Noema prepared reviewer actor is invalid")
+        if reviewer_actor.strip().casefold() != actor.strip().casefold():
+            raise RuntimeError("Noema refreshed reviewer actor differs from verdict preparation")
         if current_pull_request.get("isDraft"):
             print("PR became draft after model review; prepared verdict was not published.")
             return 0
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 71201af75d..0000000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    target-branch: "main"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-
-  - package-ecosystem: "pip"
-    directory: "/"
-    target-branch: "main"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
diff --git a/.github/runner-images/law-ai-agent/Dockerfile b/.github/runner-images/law-ai-agent/Dockerfile
new file mode 100644
index 0000000000..5c73db15e5
--- /dev/null
+++ b/.github/runner-images/law-ai-agent/Dockerfile
@@ -0,0 +1,8 @@
+FROM ghcr.io/actions/actions-runner@sha256:e5496277be5d09bc968b3d64911b74e219ac4a3f2edce956a3ecf9271bea1ef4
+USER root
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends postgresql-16 postgresql-client-16 libpq-dev python3-venv ca-certificates git curl \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+USER runner
+WORKDIR /home/runner
diff --git a/.github/workflows/actions-queue-health.yml b/.github/workflows/actions-queue-health.yml
index b6286ee922..febf0679b2 100644
--- a/.github/workflows/actions-queue-health.yml
+++ b/.github/workflows/actions-queue-health.yml
@@ -15,7 +15,9 @@ permissions:
 jobs:
   collect:
     name: Collect exact-head queue evidence
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 30
     permissions:
       contents: read
diff --git a/.github/workflows/agent-mention-noema-dispatch.yml b/.github/workflows/agent-mention-noema-dispatch.yml
index c9514a47a1..c2729b9819 100644
--- a/.github/workflows/agent-mention-noema-dispatch.yml
+++ b/.github/workflows/agent-mention-noema-dispatch.yml
@@ -28,7 +28,9 @@ permissions:
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read
diff --git a/.github/workflows/agent-mention-opencode-dispatch.yml b/.github/workflows/agent-mention-opencode-dispatch.yml
index 3b21667832..221a5bdb74 100644
--- a/.github/workflows/agent-mention-opencode-dispatch.yml
+++ b/.github/workflows/agent-mention-opencode-dispatch.yml
@@ -28,7 +28,9 @@ permissions:
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read
diff --git a/.github/workflows/agent-mention-router-quality-ci.yml b/.github/workflows/agent-mention-router-quality-ci.yml
index 9c36a89119..57030437ef 100644
--- a/.github/workflows/agent-mention-router-quality-ci.yml
+++ b/.github/workflows/agent-mention-router-quality-ci.yml
@@ -13,7 +13,10 @@ on:
       - "scripts/ci/agent_mention_sweep.py"
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
   push:
     branches: [main]
     paths:
@@ -26,7 +29,10 @@ on:
       - "scripts/ci/agent_mention_sweep.py"
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
 
 concurrency:
   group: agent-mention-router-quality-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
@@ -40,7 +46,9 @@ env:
 
 jobs:
   quality:
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 20
     steps:
       - name: Harden runner
diff --git a/.github/workflows/agent-review-runtime-quality-ci.yml b/.github/workflows/agent-review-runtime-quality-ci.yml
index dc3baea170..9b2de6745c 100644
--- a/.github/workflows/agent-review-runtime-quality-ci.yml
+++ b/.github/workflows/agent-review-runtime-quality-ci.yml
@@ -5,6 +5,10 @@ on:
     branches: [main]
     paths:
       - ".github/workflows/agent-review-runtime-quality-ci.yml"
+      - "scripts/ci/codeql_ghas_configuration_identity.py"
+      - "tests/test_codeql_ghas_configuration_identity.py"
+      - "tests/test_codeql_ghas_analyses_pagination.py"
+      - "tests/test_github_api_url_boundary.py"
       - ".github/workflows/noema-review.yml"
       - ".github/actions/noema-review/two_phase.py"
       - "tests/test_noema_reviewer_token_lifetime.py"
@@ -60,9 +64,17 @@ on:
       - "scripts/ci/zdr_policy.py"
       - "scripts/ci/contextual_orchestrator_review_policy.py"
       - "scripts/ci/contextual_orchestrator_review_launcher.py"
+      - "scripts/ci/personal_review_route.py"
       - "scripts/ci/contextual_orchestrator_review_sidecar.sh"
       - "tests/test_zdr_policy.py"
       - "tests/test_contextual_orchestrator_review_policy.py"
+      - "tests/test_contextual_orchestrator_review_launcher.py"
+      - "tests/test_review_auto_route.py"
+      - "tests/test_personal_review_route.py"
+      - "tests/test_tokyo_review_consumer.py"
+      - "tests/test_review_auto_cost_admission.py"
+      - "tests/test_review_ai_app_independence.py"
+      - "tests/test_review_preflight_concurrency.py"
       - "tests/test_contextual_orchestrator_review_sidecar_contract.py"
       - "tests/test_sidecar_disk_free_guard.py"
       - "tests/test_hourly_review_repair_callers.py"
@@ -116,9 +128,11 @@ on:
       - "docs/doctoring/exact-artifact-sbom-attestation.md"
       - "docs/doctoring/exact-artifact-sbom-quality-runner-consolidation-20260903.md"
       - "CHANGELOG.d/20260903-exact-artifact-quality-runner-consolidation.md"
+      - "requirements-opencode-review-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
       - "requirements-noema-document-ci.txt"
       - "requirements-noema-document-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
 
 # PR validation only: a new head cancels only an older run of this workflow
 # for the same repository and pull request.
@@ -132,7 +146,9 @@ permissions:
 jobs:
   agent_review_runtime_quality:
     name: agent-review-runtime-quality
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 25
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -173,6 +189,7 @@ jobs:
           review_repair_suite=false
           commercial_readiness_suite=false
           exact_artifact_suite=false
+          ghas_suite=false
 
           while IFS= read -r changed_path; do
             case "$changed_path" in
@@ -184,6 +201,14 @@ jobs:
                 review_repair_suite=true
                 commercial_readiness_suite=true
                 exact_artifact_suite=true
+                ghas_suite=true
+                ;;
+              scripts/ci/codeql_ghas_configuration_identity.py|\
+              tests/test_codeql_ghas_configuration_identity.py|\
+              tests/test_codeql_ghas_analyses_pagination.py|\
+              tests/test_github_api_url_boundary.py|\
+              tests/test_agent_review_runtime_quality_consolidation.py)
+                ghas_suite=true
                 ;;
               tests/test_pr_review_autofix_nvidia_nim_contract.py)
                 opencode_suite=true
@@ -237,11 +262,13 @@ jobs:
               tests/test_strix_quality_timeout_fixture_budget.py)
                 strix_suite=true
                 ;;
-              requirements-opencode-review-ci-hashes.txt)
+              requirements-opencode-review-ci.txt|\
+              requirements-opencode-review-ci-hashes.txt|\
+              requirements-noema-document-ci.txt|\
+              scripts/ci/compile_opencode_review_lock.sh)
                 noema_suite=true
                 opencode_suite=true
                 ;;
-              requirements-noema-document-ci.txt|\
               requirements-noema-document-ci-hashes.txt)
                 noema_suite=true
                 ;;
@@ -264,9 +291,17 @@ jobs:
               scripts/ci/zdr_policy.py|\
               scripts/ci/contextual_orchestrator_review_policy.py|\
               scripts/ci/contextual_orchestrator_review_launcher.py|\
+              scripts/ci/personal_review_route.py|\
               scripts/ci/contextual_orchestrator_review_sidecar.sh|\
               tests/test_zdr_policy.py|\
               tests/test_contextual_orchestrator_review_policy.py|\
+              tests/test_contextual_orchestrator_review_launcher.py|\
+              tests/test_review_auto_route.py|\
+              tests/test_personal_review_route.py|\
+              tests/test_tokyo_review_consumer.py|\
+              tests/test_review_auto_cost_admission.py|\
+              tests/test_review_ai_app_independence.py|\
+              tests/test_review_preflight_concurrency.py|\
               tests/test_contextual_orchestrator_review_sidecar_contract.py|\
               tests/test_sidecar_disk_free_guard.py|\
               tests/test_hourly_review_repair_callers.py|\
@@ -336,6 +371,7 @@ jobs:
             echo "review_repair=$review_repair_suite"
             echo "commercial_readiness=$commercial_readiness_suite"
             echo "exact_artifact=$exact_artifact_suite"
+            echo "ghas=$ghas_suite"
           } >>"$GITHUB_OUTPUT"
 
       - name: Install exact hash-verified base dependencies
@@ -444,11 +480,19 @@ jobs:
             --cov=scripts.ci.pr_review_autofix_context \
             --cov=scripts.ci.zdr_policy \
             --cov=scripts.ci.contextual_orchestrator_review_policy \
+            --cov=scripts.ci.contextual_orchestrator_review_launcher \
             --cov-branch \
             --cov-fail-under=100 \
             tests/test_pr_review_conflict_scope.py \
             tests/test_zdr_policy.py \
             tests/test_contextual_orchestrator_review_policy.py \
+            tests/test_contextual_orchestrator_review_launcher.py \
+            tests/test_review_auto_route.py \
+            tests/test_personal_review_route.py \
+            tests/test_tokyo_review_consumer.py \
+            tests/test_review_auto_cost_admission.py \
+            tests/test_review_ai_app_independence.py \
+            tests/test_review_preflight_concurrency.py \
             tests/test_contextual_orchestrator_review_sidecar_contract.py \
             tests/test_sidecar_disk_free_guard.py \
             tests/test_hourly_review_repair_callers.py \
@@ -488,6 +532,13 @@ jobs:
             scripts/ci/contextual_orchestrator_review_launcher.py \
             tests/test_zdr_policy.py \
             tests/test_contextual_orchestrator_review_policy.py \
+            tests/test_contextual_orchestrator_review_launcher.py \
+            tests/test_review_auto_route.py \
+            tests/test_personal_review_route.py \
+            tests/test_tokyo_review_consumer.py \
+            tests/test_review_auto_cost_admission.py \
+            tests/test_review_ai_app_independence.py \
+            tests/test_review_preflight_concurrency.py \
             tests/test_contextual_orchestrator_review_sidecar_contract.py \
             tests/test_sidecar_disk_free_guard.py \
             tests/test_hourly_review_repair_callers.py \
@@ -568,6 +619,21 @@ jobs:
             tests/test_verify_exact_artifact_sbom_handoff.py \
             tests/test_exact_artifact_quality_single_runner.py
 
+      - name: Verify GHAS identity, pagination, and API boundary contracts
+        if: steps.affected_suites.outputs.ghas == 'true'
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          set -euo pipefail
+          python -m pytest -q \
+            tests/test_codeql_ghas_configuration_identity.py \
+            tests/test_codeql_ghas_analyses_pagination.py \
+            tests/test_github_api_url_boundary.py
+          python -m compileall -q \
+            scripts/ci/codeql_ghas_configuration_identity.py \
+            tests/test_codeql_ghas_configuration_identity.py \
+            tests/test_codeql_ghas_analyses_pagination.py \
+            tests/test_github_api_url_boundary.py
+
       - name: Verify consolidated workflow contract
         run: |
           set -euo pipefail
diff --git a/.github/workflows/audit-central-ruleset.yml b/.github/workflows/audit-central-ruleset.yml
index 655a319835..e735ae1923 100644
--- a/.github/workflows/audit-central-ruleset.yml
+++ b/.github/workflows/audit-central-ruleset.yml
@@ -25,7 +25,9 @@ permissions:
 jobs:
   audit:
     name: Audit organization ruleset 18156473
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     env:
       GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
     steps:
diff --git a/.github/workflows/cloudflare-dns.yml b/.github/workflows/cloudflare-dns.yml
index 991202f4e9..6b23e3b053 100644
--- a/.github/workflows/cloudflare-dns.yml
+++ b/.github/workflows/cloudflare-dns.yml
@@ -44,7 +44,9 @@ permissions:
 jobs:
   reconcile:
     name: Reconcile zones (${{ github.event.client_payload.mode || 'dry-run' }})
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/.github/workflows/codeql-pr.yml b/.github/workflows/codeql-pr.yml
index 356244f7fc..1be7ae0449 100644
--- a/.github/workflows/codeql-pr.yml
+++ b/.github/workflows/codeql-pr.yml
@@ -60,7 +60,9 @@ jobs:
     name: Detect CodeQL languages
     # Draft PRs get no runner; ready_for_review re-runs this on the same head.
     if: (github.event.action != 'closed') && (github.event.pull_request.draft != true || github.event.action == 'converted_to_draft' || github.event.action == 'closed')
-    runs-on: ${{ fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '"ubuntu-24.04"') }}
+    runs-on:
+      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read
@@ -164,7 +166,9 @@ jobs:
     # dependency exactly; the only case where it's genuinely skipped is a
     # closed PR, where this job being implicitly skipped too is fine because
     # closed PRs need no required check.
-    runs-on: ${{ fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '"ubuntu-24.04"') }}
+    runs-on:
+      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     # Verdict reads have exceeded five minutes; retain the ten-minute control budget.
     timeout-minutes: 10
     permissions:
@@ -367,7 +371,9 @@ jobs:
       && github.event.pull_request.state != 'closed'
       && needs.detect-languages.result == 'success'
       && needs.detect-languages.outputs.code == 'true'
-    runs-on: ${{ fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '"ubuntu-24.04"') }}
+    runs-on:
+      group: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read
diff --git a/.github/workflows/company-default-head-trust-gate.yml b/.github/workflows/company-default-head-trust-gate.yml
new file mode 100644
index 0000000000..08745e92d0
--- /dev/null
+++ b/.github/workflows/company-default-head-trust-gate.yml
@@ -0,0 +1,64 @@
+name: Reusable company default-head trust gate
+
+on:
+  workflow_call:
+    inputs:
+      target_runner_label:
+        required: true
+        type: string
+      trusted_ref_sha:
+        required: false
+        type: string
+        default: ""
+      trusted_ref_ack:
+        required: false
+        type: string
+        default: ""
+    outputs:
+      runner_matrix:
+        value: ${{ jobs.validate.outputs.runner_matrix }}
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, Linux, X64, cwlab-ci-isolated]
+    timeout-minutes: 5
+    outputs:
+      runner_matrix: ${{ steps.runner.outputs.runner_matrix }}
+    steps:
+      - id: runner
+        shell: bash
+        env:
+          TARGET: ${{ inputs.target_runner_label }}
+        run: |
+          case "$TARGET" in
+            all) matrix='["itxllmpgw01","itxllmpgw02","xtrmsales-llmgw1","xtrmsales-llmgw2"]' ;;
+            itxllmpgw01|itxllmpgw02|itxllmpgw03|itxllmpgw04|xtrmsales-llmgw1|xtrmsales-llmgw2|llm-gateway-dev|itx-llm-operation-1|itx-llm-operation-2)
+              matrix="[\"$TARGET\"]"
+              ;;
+            *) echo "unsupported target_runner_label=$TARGET" >&2; exit 2 ;;
+          esac
+          echo "runner_matrix=$matrix" >> "$GITHUB_OUTPUT"
+      - shell: bash
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch || 'main' }}
+          REF_NAME: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -Eeuo pipefail
+          if [ "$REF_NAME" != "$DEFAULT_BRANCH" ]; then
+            echo "self-hosted failure diagnostics require the protected default branch" >&2
+            exit 2
+          fi
+          current_sha="$(gh api "repos/$REPOSITORY/commits/$DEFAULT_BRANCH" --jq .sha)"
+          if [ "$SHA" != "$current_sha" ]; then
+            echo "refusing stale default-branch run sha=$SHA current_sha=$current_sha" >&2
+            exit 2
+          fi
+          echo "trusted_ref_status=current_default_head sha=$SHA"
diff --git a/.github/workflows/company-settlement-validate.yml b/.github/workflows/company-settlement-validate.yml
new file mode 100644
index 0000000000..2cd0498ba3
--- /dev/null
+++ b/.github/workflows/company-settlement-validate.yml
@@ -0,0 +1,56 @@
+# Source-only fixed-pool candidate. Caller-context group admission remains separate.
+name: Company settlement validate
+on:
+  workflow_call: {}
+permissions:
+  contents: read
+jobs:
+  validate:
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, Linux, X64, cwlab-ci-isolated]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - name: Install locked test dependencies
+        run: uv pip install --system -r requirements.txt -r requirements-dev.txt
+      - name: Start isolated PostgreSQL without a TCP listener
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          pg_bin="$(pg_config --bindir)"
+          test -x "$pg_bin/initdb"
+          test -x "$pg_bin/pg_ctl"
+          "$pg_bin/postgres" --version
+          data_dir="$RUNNER_TEMP/settlement-verify-postgres"
+          socket_dir="$RUNNER_TEMP/settlement-verify-socket"
+          mkdir -m 700 "$data_dir" "$socket_dir"
+          printf 'SETTLEMENT_VERIFY_PG_BIN=%s\n' "$pg_bin" >> "$GITHUB_ENV"
+          printf 'SETTLEMENT_VERIFY_PG_DATA=%s\n' "$data_dir" >> "$GITHUB_ENV"
+          "$pg_bin/initdb" -D "$data_dir" --no-locale --encoding=UTF8 \
+            --auth-local=trust --auth-host=reject
+          "$pg_bin/pg_ctl" -D "$data_dir" \
+            -o "-F -h '' -k $socket_dir" -l "$RUNNER_TEMP/settlement-verify-postgres.log" -w start
+          printf 'SETTLEMENT_VERIFY_TEST_DSN=host=%s dbname=postgres\n' "$socket_dir" >> "$GITHUB_ENV"
+      - name: Verify exact-head PgCat and lock regressions
+        env:
+          SETTLEMENT_VERIFY_REQUIRE_POSTGRES: "1"
+        run: >-
+          python -m pytest -q tests/test_issue119_pgcat_endpoint_resolver.py
+          tests/test_issue119_settlement_live_verify.py
+          tests/test_issue119_settlement_replica_routing.py
+          tests/test_issue119_settlement_review_regressions.py
+          tests/test_multi_instance_runtime_contract.py
+      - name: Stop isolated test database
+        if: always()
+        shell: bash
+        run: |
+          if test -f "${SETTLEMENT_VERIFY_PG_DATA:-}/postmaster.pid"; then
+            "$SETTLEMENT_VERIFY_PG_BIN/pg_ctl" -D "$SETTLEMENT_VERIFY_PG_DATA" -m fast -w stop
+          fi
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 1bb83c2baf..fc63256794 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -1,6 +1,6 @@
 # Reusable Dependency Review (workflow_call), consolidating the near-
-# identical dependency-review.yml files argos, mightyETL, newsdom-api,
-# scopeweave, and naruon each carried independently. See
+# identical dependency-review.yml files argos, mightyETL, naruon, newsdom-api,
+# and scopeweave each carried independently. See
 # docs/adr/0024-dependency-review-reusable-workflow-consolidation.md and
 # docs/doctoring/dependency-review-reusable-workflow-consolidation.md for the
 # per-repo field audit behind these inputs.
@@ -9,34 +9,41 @@
 # calling repo's own thin workflow file -- a workflow_call target cannot also
 # be the thing GitHub triggers directly on pull_request.
 #
-# Dependency Review requires GitHub Dependency Graph (and, on private repos
-# without GitHub Advanced Security, it is unavailable regardless of a repo's
-# own settings). scopeweave's original workflow already detected this
-# dynamically via the dependency-graph compare API instead of assuming from
-# public/private repository status (mightyETL's original approach, which is
-# wrong for a private repo that does have GHAS). This reusable workflow
-# adopts the dynamic detection as the common, more-correct behavior for
-# every caller, so no per-repo public/private input is needed.
+# Dependency Review requires a successful Dependency Graph comparison for the
+# exact pull-request base/head. Repository visibility is not a sufficient
+# capability signal, and HTTP 403/404 are not safe availability signals:
+# GitHub can use those statuses for authorization/policy denials as well as
+# unavailable resources. For a pull_request, only exact immutable base/head
+# object IDs plus a valid owner/name repository identity may reach transport,
+# and only HTTP 200 authorizes running the pinned action. Every non-200
+# comparison fails closed. Non-pull_request triggers may skip because they do
+# not carry the exact PR base/head identity.
+#
+# Reusable-workflow permissions can only be maintained or reduced through the
+# call chain. Every thin caller therefore must declare at least `contents:
+# read` and `pull-requests: read`; this workflow cannot elevate a caller token
+# that omitted those scopes.
 #
 # Example caller (.github/workflows/dependency-review.yml in a product repo).
-# Pin `uses:` to this file's exact commit SHA, not @main: an unpinned mutable
-# ref would run an unreviewed central change against every PR check in the
-# calling repo (Devin flagged this on the first four callers; fixed in all of
-# them). If the calling repo's branch protection requires a status check
-# literally named after the old standalone job, converting to `uses:` here
-# will rename the published check to "<calling job> / dependency-review" and
-# silently break that required check -- update the branch protection's
-# required-check name to match before or immediately after merging a caller.
+# Pin `uses:` to the exact protected-main commit SHA carrying this workflow,
+# never `@main`: a mutable central ref could run an unreviewed workflow change
+# against the caller's PR checks. If branch protection requires the old
+# standalone job name, note that reusable workflow adoption publishes the
+# combined check name `<calling job> / dependency-review`; update the required
+# check name to the exact published context without weakening the gate.
 #
 #   name: Dependency Review
 #   on:
 #     pull_request:
+#   permissions:
+#     contents: read
+#     pull-requests: read
 #   concurrency:
 #     group: dependency-review-${{ github.event.pull_request.number || github.ref }}
 #     cancel-in-progress: true
 #   jobs:
 #     dependency-review:
-#       uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@<commit-sha>
+#       uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@<protected-main-commit-sha>
 #       with:
 #         fail_on_severity: high
 #         allow_ghsas: "GHSA-69w3-r845-3855"
@@ -86,7 +93,9 @@ permissions:
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     env:
       # Opts every JS action this job runs (checkout, dependency-review-action)
       # into the Node 24 actions runtime ahead of GitHub's default cutover,
@@ -121,30 +130,43 @@ jobs:
             exit 0
           fi
 
+          git_object_id='^[0-9a-f]{40}([0-9a-f]{24})?$'
+          repository_identity='^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'
+          if ! [[ "${BASE_SHA}" =~ $git_object_id ]] || ! [[ "${HEAD_SHA}" =~ $git_object_id ]]; then
+            echo "::error::Dependency review evidence unavailable: exact 40- or 64-character hexadecimal base and head revisions are required before any compare request. Named refs are not evidence. Verify the pull-request event SHAs, then rerun. Failing closed."
+            exit 1
+          fi
+          if ! [[ "${REPOSITORY}" =~ $repository_identity ]]; then
+            echo "::error::Dependency review evidence unavailable: owner/name repository identity is required before any compare request. Verify the pull-request repository, then rerun. Failing closed."
+            exit 1
+          fi
+          repository_owner="${REPOSITORY%%/*}"
+          repository_name="${REPOSITORY#*/}"
+          if [ "${repository_owner}" = "." ] || [ "${repository_owner}" = ".." ] || [ "${repository_name}" = "." ] || [ "${repository_name}" = ".." ]; then
+            echo "::error::Dependency review evidence unavailable: owner/name repository identity is required before any compare request. Dot or parent-directory path components are not evidence. Verify the pull-request repository, then rerun. Failing closed."
+            exit 1
+          fi
+
           api_url="${GITHUB_API_URL:-https://api.github.com}"
           response_file="$(mktemp)"
+          curl_exit=0
           status="$(
             curl -fsS -o "$response_file" -w '%{http_code}' \
               -H "Accept: application/vnd.github+json" \
               -H "Authorization: Bearer ${GH_TOKEN}" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
               "${api_url}/repos/${REPOSITORY}/dependency-graph/compare/${BASE_SHA}...${HEAD_SHA}" \
-              || true
-          )"
+          )" || curl_exit=$?
 
-          if [ "$status" = "200" ]; then
+          if [ "$curl_exit" -eq 0 ] && [ "$status" = "200" ]; then
             echo "available=true" >>"$GITHUB_OUTPUT"
             exit 0
           fi
 
-          if [ "$status" = "403" ] || [ "$status" = "404" ]; then
-            echo "::warning::Dependency graph compare returned HTTP ${status} for ${REPOSITORY}; skipping the dependency-review hard gate (GitHub Dependency Graph, or GitHub Advanced Security on a private repository, is unavailable)."
-            echo "available=false" >>"$GITHUB_OUTPUT"
-            exit 0
+          echo "::error::Dependency graph comparison failed with curl exit ${curl_exit} and HTTP ${status:-unavailable}. For a pull_request, transport failures and non-200 responses are ambiguous between feature availability and authorization/policy/transport failure, so Dependency Review fails closed instead of being skipped."
+          if [ -s "$response_file" ]; then
+            cat "$response_file"
           fi
-
-          echo "::error::Dependency graph availability check failed with HTTP ${status}. This is not a 'graph unavailable' response (403/404) -- treating it as a genuine failure instead of silently skipping the security gate."
-          cat "$response_file"
           exit 1
 
       - name: Dependency review
@@ -155,9 +177,3 @@ jobs:
           fail-on-severity: ${{ inputs.fail_on_severity }}
           allow-ghsas: ${{ inputs.allow_ghsas }}
           comment-summary-in-pr: ${{ inputs.comment_summary_in_pr }}
-
-      - name: Dependency graph unavailable note
-        if: steps.dependency_graph.outputs.available != 'true' && github.event_name == 'pull_request'
-        run: |
-          echo "Dependency Review requires GitHub Dependency Graph to be enabled for this repository (and, on private repositories, GitHub Advanced Security)."
-          echo "Other required dependency-vulnerability gates (OSV-Scanner, Scorecard) remain the blocking coverage until Dependency Graph is available here."
diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index f86b614022..8097a8c1aa 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -45,7 +45,9 @@ permissions:
 jobs:
   deploy_pages:
     name: Deploy ${{ inputs.project_name }}
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     steps:
       - name: Checkout caller repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/.github/workflows/exact-artifact-sbom-attestation.yml b/.github/workflows/exact-artifact-sbom-attestation.yml
index 198392aa0c..1e280ecb4f 100644
--- a/.github/workflows/exact-artifact-sbom-attestation.yml
+++ b/.github/workflows/exact-artifact-sbom-attestation.yml
@@ -64,7 +64,9 @@ env:
 jobs:
   verify-evidence-artifact:
     name: Verify inert sealed evidence
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 15
     permissions:
       actions: read
@@ -180,7 +182,9 @@ jobs:
   attest-exact-artifacts:
     name: Attest exact wheel and sdist SBOMs
     needs: verify-evidence-artifact
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 20
     permissions:
       actions: read
@@ -372,13 +376,13 @@ jobs:
           EOF
           {
             printf '\n## Exact signed identity\n\n'
-            printf -- '- Source repository: `%s`\n' "$SOURCE_REPOSITORY"
-            printf -- '- Source SHA: `%s`\n' "$SOURCE_SHA"
-            printf -- '- Signer repository: `%s`\n' "$SIGNER_REPOSITORY"
-            printf -- '- Signer workflow: `%s`\n' "$signer_workflow"
-            printf -- '- Predicate type: `%s`\n' "$PREDICATE_TYPE"
-            printf -- '- Wheel: `%s`\n' "$WHEEL_FILENAME"
-            printf -- '- Source distribution: `%s`\n' "$SDIST_FILENAME"
+            printf -- "- Source repository: \`%s\`\n" "$SOURCE_REPOSITORY"
+            printf -- "- Source SHA: \`%s\`\n" "$SOURCE_SHA"
+            printf -- "- Signer repository: \`%s\`\n" "$SIGNER_REPOSITORY"
+            printf -- "- Signer workflow: \`%s\`\n" "$signer_workflow"
+            printf -- "- Predicate type: \`%s\`\n" "$PREDICATE_TYPE"
+            printf -- "- Wheel: \`%s\`\n" "$WHEEL_FILENAME"
+            printf -- "- Source distribution: \`%s\`\n" "$SDIST_FILENAME"
             cat <<EOF
 
           ## Online verification commands
@@ -420,9 +424,10 @@ jobs:
           } >> offline-attestation-evidence/README.md
           (
             cd offline-attestation-evidence
-            LC_ALL=C find . -maxdepth 1 -type f ! -name SHA256SUMS -printf '%f\n' \
-              | LC_ALL=C sort \
+            evidence_names="$(LC_ALL=C find . -maxdepth 1 -type f ! -name SHA256SUMS -printf '%f\n' | LC_ALL=C sort)"
+            printf '%s\n' "$evidence_names" \
               | while IFS= read -r evidence_file; do
+                  [ -n "$evidence_file" ] || continue
                   sha256sum "$evidence_file"
                 done > SHA256SUMS
           )
diff --git a/.github/workflows/exact-head-coverage-quality-gate.yml b/.github/workflows/exact-head-coverage-quality-gate.yml
index 6b957571d2..f0670a4b50 100644
--- a/.github/workflows/exact-head-coverage-quality-gate.yml
+++ b/.github/workflows/exact-head-coverage-quality-gate.yml
@@ -37,7 +37,9 @@ permissions:
 
 jobs:
   quality-gate:
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: ${{ inputs.timeout_minutes }}
     steps:
       - name: Checkout exact source revision
diff --git a/.github/workflows/law-ai-agent-ci.yml b/.github/workflows/law-ai-agent-ci.yml
new file mode 100644
index 0000000000..d0c19baf53
--- /dev/null
+++ b/.github/workflows/law-ai-agent-ci.yml
@@ -0,0 +1,117 @@
+name: Law AI Agent central CI
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: law-ci-${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || format('{0}-{1}', github.event_name, github.ref) }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    runs-on:
+      group: CWL law CI
+      labels: [self-hosted, Linux, X64, law-ai-agent-ci]
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        python-version: ["3.12", "3.14"]
+    steps:
+      - name: Admit exact owned caller before checkout
+        id: admission
+        shell: bash
+        env:
+          CALLER_REPOSITORY: ${{ github.repository }}
+          CALLER_EVENT: ${{ github.event_name }}
+          CALLER_REF: ${{ github.ref }}
+          SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          CENTRAL_REPOSITORY: ${{ job.workflow_repository }}
+          CENTRAL_REF: ${{ job.workflow_ref }}
+          CENTRAL_SHA: ${{ job.workflow_sha }}
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          """Fail closed before checking out consumer or central source."""
+          import json
+          import os
+          import re
+          import sys
+          from pathlib import Path
+          e = os.environ
+          owned = "ContextualWisdomLab/law-ai-agent"
+          valid = e["CALLER_REPOSITORY"] == owned
+          valid &= e["CENTRAL_REPOSITORY"] == "ContextualWisdomLab/.github"
+          valid &= bool(re.fullmatch(r"[0-9a-f]{40}", e["SOURCE_SHA"]))
+          valid &= bool(re.fullmatch(r"[0-9a-f]{40}", e["CENTRAL_SHA"]))
+          valid &= e["CENTRAL_REF"] == (
+              "ContextualWisdomLab/.github/.github/workflows/law-ai-agent-ci.yml@"
+              + e["CENTRAL_SHA"]
+          )
+          payload = json.loads(Path(e["GITHUB_EVENT_PATH"]).read_text())
+          event = e["CALLER_EVENT"]
+          if event == "pull_request":
+              pr = payload.get("pull_request", {})
+              head, base = pr.get("head", {}), pr.get("base", {})
+              valid &= head.get("repo", {}).get("full_name") == owned
+              valid &= base.get("repo", {}).get("full_name") == owned
+              valid &= head.get("sha") == e["SOURCE_SHA"]
+              valid &= base.get("ref") == "main"
+          elif event == "push":
+              valid &= e["CALLER_REF"] == "refs/heads/main"
+              valid &= payload.get("ref") == "refs/heads/main"
+              valid &= payload.get("after") == e["SOURCE_SHA"]
+              valid &= payload.get("deleted") is False
+          elif event == "workflow_dispatch":
+              valid &= e["CALLER_REF"] == "refs/heads/main"
+          else:
+              valid = False
+          if not valid:
+              sys.exit("law-ci: admission refused")
+          with open(e["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+              output.write("source_sha=" + e["SOURCE_SHA"] + "\n")
+          PY
+      - name: Checkout admitted consumer head
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 verified commit
+        with:
+          repository: ContextualWisdomLab/law-ai-agent
+          ref: ${{ steps.admission.outputs.source_sha }}
+          path: source
+          persist-credentials: false
+      - name: Checkout this reusable workflow source
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 verified commit
+        with:
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}
+          path: central
+          persist-credentials: false
+      - name: Verify both checkout identities
+        shell: bash
+        env:
+          SOURCE_SHA: ${{ steps.admission.outputs.source_sha }}
+          CENTRAL_SHA: ${{ job.workflow_sha }}
+        run: |
+          set -euo pipefail
+          test "$(git -C "$GITHUB_WORKSPACE/source" rev-parse HEAD)" = "$SOURCE_SHA"
+          test "$(git -C "$GITHUB_WORKSPACE/central" rev-parse HEAD)" = "$CENTRAL_SHA"
+      - name: Provision pinned uv and matrix Python
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 dereferenced commit
+        with:
+          version: "0.12.5"
+          python-version: ${{ matrix.python-version }}
+          enable-cache: false
+      - name: Run isolated native database and artifact gates
+        shell: bash
+        env:
+          LAW_CI_SOURCE: ${{ github.workspace }}/source
+          LAW_CI_SOURCE_SHA: ${{ steps.admission.outputs.source_sha }}
+          LAW_CI_PYTHON_VERSION: ${{ matrix.python-version }}
+        run: bash "$GITHUB_WORKSPACE/central/scripts/ci/law_ai_agent_ci.sh" run
+      - name: Cleanup owned native cluster on cancellation
+        if: always()
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/central/scripts/ci/law_ai_agent_ci.sh" cleanup
diff --git a/.github/workflows/noema-review.yml b/.github/workflows/noema-review.yml
index 08ea600538..6c81d859e2 100644
--- a/.github/workflows/noema-review.yml
+++ b/.github/workflows/noema-review.yml
@@ -41,7 +41,9 @@ jobs:
         && github.event.action != 'converted_to_draft'
         && github.event.pull_request.head.repo.full_name == github.repository
       )
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     outputs:
       admitted: ${{ steps.live_head.outputs.admitted }}
@@ -70,7 +72,13 @@ jobs:
             exit 1
           fi
           echo "repository=${TARGET_REPOSITORY#*/}" >>"$GITHUB_OUTPUT"
-          if [ -n "${METADATA_TOKEN:-}" ]; then
+          if [ "$TARGET_REPOSITORY" = "ContextualWisdomLab/k-csap-skills" ]; then
+            if [ -z "${NOEMA_GITHUB_APP_CLIENT_ID:-}" ] || [ -z "${NOEMA_GITHUB_APP_PRIVATE_KEY:-}" ]; then
+              echo "::error::k-csap-skills Noema metadata requires the native GitHub App client ID and private key; credential fallback is forbidden."
+              exit 1
+            fi
+            echo "source=github-app" >>"$GITHUB_OUTPUT"
+          elif [ -n "${METADATA_TOKEN:-}" ]; then
             echo "source=pat" >>"$GITHUB_OUTPUT"
           elif [ -n "${NOEMA_GITHUB_APP_CLIENT_ID:-}" ] && [ -n "${NOEMA_GITHUB_APP_PRIVATE_KEY:-}" ]; then
             echo "source=github-app" >>"$GITHUB_OUTPUT"
@@ -94,7 +102,7 @@ jobs:
       - name: Admit only the exact live Noema head
         id: live_head
         env:
-          GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.noema_metadata_app_token.outputs.token || github.token }}
+          GH_TOKEN: ${{ env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && steps.noema_metadata_app_token.outputs.token || (env.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' && (secrets.NOEMA_REVIEW_TOKEN || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.noema_metadata_app_token.outputs.token || github.token)) || '' }}
         run: |
           set -euo pipefail
           echo "admitted=false" >>"$GITHUB_OUTPUT"
@@ -137,7 +145,9 @@ jobs:
     # PR/REPO lookup naturally falls through to "scan everything" for that
     # path, matching strix.yml's identical repository_dispatch behavior.
     if: github.event_name != 'pull_request_target' || (github.event.action != 'closed' && github.event.action != 'converted_to_draft')
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read
@@ -193,7 +203,9 @@ jobs:
     if: >-
       github.event_name == 'pull_request_target' &&
       (github.event.action == 'closed' || github.event.action == 'converted_to_draft')
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     # Bound this job well short of GitHub's 360-minute platform default. Its
     # only step is a single-repository, status-filtered gh api --paginate
     # list-and-cancel sweep (up to 3 passes x 5 statuses), no branch update
@@ -371,7 +383,9 @@ jobs:
   noema-review:
     name: noema-review
     needs: [admit-current-head, changed-scope]
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     # No job-level timeout-minutes here, deliberately. This job's "Prepare
     # Noema model verdict" step calls two_phase.py's call_llm synchronously
     # via the contextual-orchestrator gateway and blocks on the model's own
@@ -425,6 +439,8 @@ jobs:
       # diff.
       PR_NUMBER: ${{ (needs.changed-scope.outputs.code != 'false' && (github.event.pull_request.number || github.event.client_payload.pr_number)) || '' }}
       EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.client_payload.pr_head_sha || '' }}
+      NOEMA_TOOLING_MANIFEST_SHA256: ${{ vars.NOEMA_TOOLING_MANIFEST_SHA256 || '' }}
+      NOEMA_EXECUTION_ADMISSION_SHA256: ${{ vars.NOEMA_EXECUTION_ADMISSION_SHA256 || '' }}
     steps:
       - name: Skip events without pull request context
         if: env.PR_NUMBER == ''
@@ -493,6 +509,10 @@ jobs:
           trusted_archive="${RUNNER_TEMP}/trusted-noema-source.tar.gz"
           api_url="${GITHUB_API_URL:-https://api.github.com}"
           curl -fsSL \
+            --retry 3 \
+            --retry-all-errors \
+            --retry-delay 1 \
+            --retry-max-time 30 \
             -H "Authorization: Bearer ${GH_TOKEN}" \
             -H "Accept: application/vnd.github+json" \
             -o "$trusted_archive" \
@@ -516,7 +536,13 @@ jobs:
             exit 1
           fi
           echo "repository=${TARGET_REPOSITORY#*/}" >>"$GITHUB_OUTPUT"
-          if [ -n "${METADATA_TOKEN:-}" ]; then
+          if [ "$TARGET_REPOSITORY" = "ContextualWisdomLab/k-csap-skills" ]; then
+            if [ -z "${NOEMA_GITHUB_APP_CLIENT_ID:-}" ] || [ -z "${NOEMA_GITHUB_APP_PRIVATE_KEY:-}" ]; then
+              echo "::error::k-csap-skills Noema metadata requires the native GitHub App client ID and private key; credential fallback is forbidden."
+              exit 1
+            fi
+            echo "source=github-app" >>"$GITHUB_OUTPUT"
+          elif [ -n "${METADATA_TOKEN:-}" ]; then
             echo "source=pat" >>"$GITHUB_OUTPUT"
           elif [ -n "${NOEMA_GITHUB_APP_CLIENT_ID:-}" ] && [ -n "${NOEMA_GITHUB_APP_PRIVATE_KEY:-}" ]; then
             echo "source=github-app" >>"$GITHUB_OUTPUT"
@@ -540,7 +566,7 @@ jobs:
       - name: Reject a stale trigger before credential or model setup
         if: env.PR_NUMBER != ''
         env:
-          GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.noema_metadata_app_token.outputs.token || github.token }}
+          GH_TOKEN: ${{ env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && steps.noema_metadata_app_token.outputs.token || (env.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' && (secrets.NOEMA_REVIEW_TOKEN || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.noema_metadata_app_token.outputs.token || github.token)) || '' }}
         run: |
           set -euo pipefail
           if [[ ! "$EXPECTED_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
@@ -631,6 +657,34 @@ jobs:
           done
           echo "Cancelled ${cancelled} superseded Noema run(s) after live-head validation."
 
+      - name: Admit independently pinned premerge tooling and execution
+        if: env.PR_NUMBER != ''
+        env:
+          GH_TOKEN: ${{ steps.noema_metadata_app_token.outputs.token || github.token }}
+          NOEMA_TOOLING_MANIFEST_SHA256: ${{ vars.NOEMA_TOOLING_MANIFEST_SHA256 || '' }}
+          NOEMA_EXECUTION_ADMISSION_SHA256: ${{ vars.NOEMA_EXECUTION_ADMISSION_SHA256 || '' }}
+        run: |
+          set -euo pipefail
+          # The existing custodian supplies original manifests, accepted namespace,
+          # source/dependency pins and phase JWT files. Missing evidence stays STOP.
+          python3 -I -B "$GITHUB_WORKSPACE/scripts/ci/noema_bootstrap_producer.py" \
+            --materialize --private-parent "$RUNNER_TEMP/noema-private-bootstrap" \
+            --source-root "$RUNNER_TEMP/noema-tooling-supplier" \
+            --manifest "$RUNNER_TEMP/noema-accepted-tooling.json" \
+            --accepted-digest "$NOEMA_TOOLING_MANIFEST_SHA256" \
+            --admission "$RUNNER_TEMP/noema-execution-admission.json" \
+            --admission-digest "$NOEMA_EXECUTION_ADMISSION_SHA256" \
+            --repo "$TARGET_REPOSITORY" --pr-number "$PR_NUMBER" \
+            --expected-head "$EXPECTED_HEAD_SHA"
+          python3 -I -B "$GITHUB_WORKSPACE/scripts/ci/premerge_review_tooling.py" \
+            --admit-production --tooling-root "$RUNNER_TEMP/noema-private-bootstrap/tooling" \
+            --manifest "$RUNNER_TEMP/noema-accepted-tooling.json" \
+            --accepted-digest "$NOEMA_TOOLING_MANIFEST_SHA256" \
+            --admission "$RUNNER_TEMP/noema-execution-admission.json" \
+            --admission-digest "$NOEMA_EXECUTION_ADMISSION_SHA256" \
+            --repo "$TARGET_REPOSITORY" --pr-number "$PR_NUMBER" \
+            --expected-head "$EXPECTED_HEAD_SHA"
+
       - name: Select fail-closed Noema reviewer credential
         if: env.PR_NUMBER != ''
         id: noema_credential
@@ -638,7 +692,7 @@ jobs:
           NOEMA_GITHUB_APP_CLIENT_ID: ${{ vars.NOEMA_GITHUB_APP_CLIENT_ID || '' }}
           NOEMA_GITHUB_APP_PRIVATE_KEY: ${{ secrets.NOEMA_GITHUB_APP_PRIVATE_KEY || '' }}
           TOKEN_EXCHANGE_URL: ${{ vars.NOEMA_TOKEN_EXCHANGE_URL || vars.NOEMA_EXCHANGE_URL || '' }}
-          NOEMA_REVIEW_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN }}
+          NOEMA_REVIEW_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || '' }}
         run: |
           set -euo pipefail
 
@@ -649,6 +703,15 @@ jobs:
           repository_name="${TARGET_REPOSITORY#*/}"
           echo "repository=$repository_name" >>"$GITHUB_OUTPUT"
 
+          if [ "$TARGET_REPOSITORY" = "ContextualWisdomLab/k-csap-skills" ]; then
+            if [ -z "${NOEMA_GITHUB_APP_CLIENT_ID:-}" ] || [ -z "${NOEMA_GITHUB_APP_PRIVATE_KEY:-}" ]; then
+              echo "::error::k-csap-skills Noema reviewer requires the native GitHub App client ID and private key; PAT/OIDC fallback is forbidden."
+              exit 1
+            fi
+            echo "source=github-app" >>"$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           if [ -n "${NOEMA_REVIEW_TOKEN:-}" ]; then
             echo "source=pat" >>"$GITHUB_OUTPUT"
             echo "::notice::Noema reviewer using the NOEMA_REVIEW_TOKEN secret fallback identity."
@@ -679,14 +742,9 @@ jobs:
           private-key: ${{ secrets.NOEMA_GITHUB_APP_PRIVATE_KEY }}
           owner: ContextualWisdomLab
           repositories: ${{ steps.noema_credential.outputs.repository }}
-          permission-actions: read
-          permission-checks: read
           permission-contents: read
           permission-metadata: read
-          permission-pull-requests: write
-          permission-security-events: read
-          permission-statuses: read
-          permission-vulnerability-alerts: read
+          permission-pull-requests: read
 
       - name: Exchange Noema app token through OIDC
         if: env.PR_NUMBER != '' && steps.noema_credential.outputs.source == 'oidc'
@@ -749,7 +807,7 @@ jobs:
       - name: Validate current pull request head
         if: env.PR_NUMBER != ''
         env:
-          GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token }}
+          GH_TOKEN: ${{ env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && steps.noema_github_app_token.outputs.token || (env.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' && (secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token)) || '' }}
         run: |
           set -euo pipefail
           if ! [[ "$EXPECTED_HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
@@ -769,7 +827,7 @@ jobs:
         if: env.PR_NUMBER != ''
         id: target_visibility
         env:
-          GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token }}
+          GH_TOKEN: ${{ env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && steps.noema_github_app_token.outputs.token || (env.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' && (secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token)) || '' }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
@@ -822,9 +880,13 @@ jobs:
         if: env.PR_NUMBER != ''
         id: live_draft
         env:
-          GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token }}
+          GH_TOKEN: ${{ env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && steps.noema_github_app_token.outputs.token || (env.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' && (secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token)) || '' }}
         run: |
-          set -uo pipefail
+          set -euo pipefail
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "::error::Noema reviewer credential is missing for live draft check."
+            exit 1
+          fi
           live_draft=false
           if pull_request_json="$(gh api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}" 2>/tmp/noema-live-draft-error)"; then
             if jq -e -s 'length == 1 and (.[0] | type == "object" and .draft == true)' <<<"$pull_request_json" >/dev/null 2>&1; then
@@ -853,9 +915,71 @@ jobs:
           python-version: "3.12"
           update-environment: false
 
+      - name: Admit existing personal LiteLLM auto route
+        id: personal_route
+        if: env.PR_NUMBER != '' && steps.live_draft.outputs.live_draft != 'true'
+        env:
+          LLM_GATEWAY_API_KEY: ${{ secrets.LLM_GATEWAY_API_KEY }}
+          PERSONAL_REVIEW_ZERO_COST_ATTESTED: ${{ vars.PERSONAL_REVIEW_ZERO_COST_ATTESTED || 'false' }}
+          PERSONAL_REVIEW_ZDR_ATTESTED: ${{ vars.PERSONAL_REVIEW_ZDR_ATTESTED || 'false' }}
+          PRIVATE_TARGET: ${{ steps.target_visibility.outputs.require_zdr }}
+        run: |
+          set -euo pipefail
+          if [ -z "${LLM_GATEWAY_API_KEY:-}" ]; then
+            echo '::error::STOP: existing personal review Secret is unavailable.'
+            exit 1
+          fi
+          python3 -m scripts.ci.personal_review_route \
+            --zero-cost "$PERSONAL_REVIEW_ZERO_COST_ATTESTED" \
+            --zero-retention "$PERSONAL_REVIEW_ZDR_ATTESTED" \
+            --private-target "$PRIVATE_TARGET"
+          echo 'selected=true' >>"$GITHUB_OUTPUT"
+
+      - name: Initialize current Noema sidecar evidence
+        id: noema_evidence
+        if: env.PR_NUMBER != '' && steps.live_draft.outputs.live_draft != 'true' && steps.personal_route.outputs.selected != 'true'
+        run: |
+          set -euo pipefail
+          # Separate setup from the producer: unsafe paths fail before its outcome
+          # can admit an upload. Clear only these two files, before early startup.
+          python3 -I <<'PY'
+          import os
+          import stat
+          from pathlib import Path
+
+          workspace_text = os.environ["GITHUB_WORKSPACE"]
+          workspace = Path(workspace_text)
+          if (
+              not workspace.is_absolute()
+              or ".." in workspace.parts
+              or workspace.resolve(strict=True) != workspace
+              or not workspace.is_dir()
+          ):
+              raise SystemExit("Noema evidence workspace must be an unaliased directory")
+          evidence = workspace / "strix_runs"
+          if evidence.is_symlink() or (evidence.exists() and not evidence.is_dir()):
+              raise SystemExit("Noema evidence parent must be a non-symlink directory")
+          owned = (
+              evidence / "contextual-orchestrator-preflight.json",
+              evidence / "contextual-orchestrator-sidecar.stderr.log",
+          )
+          # Validate both before deleting either; reject dangling links, special
+          # files and hardlink aliases as well as nonregular evidence paths.
+          for path in owned:
+              try:
+                  metadata = path.lstat()
+              except FileNotFoundError:
+                  continue
+              if not stat.S_ISREG(metadata.st_mode) or metadata.st_nlink != 1:
+                  raise SystemExit("Noema evidence must be regular, single-link files")
+          evidence.mkdir(mode=0o700, exist_ok=True)
+          for path in owned:
+              path.unlink(missing_ok=True)
+          PY
+
       - name: Provision contextual-orchestrator review sidecar
         id: noema_sidecar
-        if: env.PR_NUMBER != '' && steps.live_draft.outputs.live_draft != 'true'
+        if: env.PR_NUMBER != '' && steps.live_draft.outputs.live_draft != 'true' && steps.personal_route.outputs.selected != 'true'
         env:
           SIDECAR_PYTHON: ${{ steps.sidecar_python.outputs.python-path }}
           BYTEZ_API_KEY: ${{ secrets.BYTEZ_API_KEY }}
@@ -864,6 +988,7 @@ jobs:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR: ${{ steps.target_visibility.outputs.require_zdr }}
+          CONTEXTUAL_ORCHESTRATOR_POOL: auto
         run: |
           set -euo pipefail
           test ! -L "$GITHUB_WORKSPACE/strix_runs"
@@ -912,11 +1037,15 @@ jobs:
         if: env.PR_NUMBER != '' && steps.live_draft.outputs.live_draft != 'true'
         id: noema_prepare
         env:
-          GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token }}
+          GH_TOKEN: ${{ env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && steps.noema_github_app_token.outputs.token || (env.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' && (secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token)) || '' }}
           NOEMA_REVIEW_TOKEN_SOURCE: ${{ steps.noema_credential.outputs.source == 'pat' && 'noema-review-pat' || steps.noema_credential.outputs.source == 'github-app' && 'noema-review-github-app' || 'noema-review-app-oidc' }}
           NOEMA_REVIEW_ACTOR: ${{ steps.noema_github_app_token.outputs['app-slug'] && format('{0}[bot]', steps.noema_github_app_token.outputs['app-slug']) || '' }}
           NOEMA_REVIEW_INSTALLATION_ID: ${{ steps.noema_github_app_token.outputs['installation-id'] }}
           NOEMA_TRANSPORT_RETRY_ATTEMPT: ${{ toJSON(github.event.client_payload.transport_retry_attempt) }}
+          LLM_GATEWAY_API_KEY: ${{ secrets.LLM_GATEWAY_API_KEY }}
+          PERSONAL_ROUTE_SELECTED: ${{ steps.personal_route.outputs.selected }}
+          NOEMA_GITHUB_APP_CLIENT_ID: ${{ vars.NOEMA_GITHUB_APP_CLIENT_ID }}
+          NOEMA_GITHUB_APP_PRIVATE_KEY: ${{ secrets.NOEMA_GITHUB_APP_PRIVATE_KEY }}
         run: |
           set -euo pipefail
           if [ -z "${PR_NUMBER:-}" ]; then
@@ -928,18 +1057,34 @@ jobs:
             echo "::error::Noema reviewer credential selection succeeded but no token was minted; review cannot prepare a verdict."
             exit 1
           fi
+          if [ "${PERSONAL_ROUTE_SELECTED:-}" = 'true' ]; then
+            test -n "${LLM_GATEWAY_API_KEY:-}"
+            export NOEMA_LLM_API_URL="https://litellm.poinnetworks.net/v1/chat/completions"
+            export NOEMA_LLM_MODEL="auto"
+            export NOEMA_LLM_API_KEY="$LLM_GATEWAY_API_KEY"
+            unset NOEMA_LLM_VIA_ORCHESTRATOR
+          else
           if [ -z "${CONTEXTUAL_ORCHESTRATOR_BASE_URL:-}" ] || [ -z "${CONTEXTUAL_ORCHESTRATOR_TOKEN_FILE:-}" ]; then
             echo "::error::contextual-orchestrator review sidecar must be provisioned before Noema LLM review."
             exit 1
           fi
           source "$GITHUB_WORKSPACE/scripts/ci/load_contextual_orchestrator_token.sh"
           export NOEMA_LLM_API_URL="${CONTEXTUAL_ORCHESTRATOR_BASE_URL%/}/v1/chat/completions"
-          export NOEMA_LLM_MODEL="orchestrator/free"
+          export NOEMA_LLM_MODEL="orchestrator/auto"
           export NOEMA_LLM_API_KEY="${CONTEXTUAL_ORCHESTRATOR_TOKEN}"
           export NOEMA_LLM_VIA_ORCHESTRATOR=1
-          verdict_file="${RUNNER_TEMP}/noema-verdict-envelope.json"
-          rm -f "$verdict_file"
-          python3 "$GITHUB_WORKSPACE/.github/actions/noema-review/two_phase.py"             --repo "$TARGET_REPOSITORY"             --pr-number "$PR_NUMBER"             --expected-head "$EXPECTED_HEAD_SHA"             --prepare-verdict-file "$verdict_file"
+          fi
+          verdict_file="${RUNNER_TEMP}/noema-private-bootstrap/verdict.json"
+          test ! -e "$verdict_file"
+          node "$GITHUB_WORKSPACE/scripts/ci/noema_existing_app_issuer.cjs" \
+            --phase prepare --private-parent "$RUNNER_TEMP/noema-private-bootstrap" \
+            --source-root "$RUNNER_TEMP/noema-tooling-supplier" \
+            --manifest "$RUNNER_TEMP/noema-accepted-tooling.json" \
+            --accepted-digest "$NOEMA_TOOLING_MANIFEST_SHA256" \
+            --admission "$RUNNER_TEMP/noema-execution-admission.json" \
+            --admission-digest "$NOEMA_EXECUTION_ADMISSION_SHA256" \
+            --repo "$TARGET_REPOSITORY" --pr-number "$PR_NUMBER" \
+            --expected-head "$EXPECTED_HEAD_SHA" --verdict-file "$verdict_file"
           if [ -f "$verdict_file" ]; then
             echo "prepared=true" >>"$GITHUB_OUTPUT"
           else
@@ -948,7 +1093,10 @@ jobs:
           fi
 
       - name: Upload contextual-orchestrator sidecar evidence
-        if: always() && env.PR_NUMBER != ''
+        # A live Draft never provisions the sidecar. Retain only current producer
+        # terminal diagnostics; absent/skipped outcomes cannot publish stale files.
+        # Non-Draft upload failures still fail the required review job.
+        if: always() && env.PR_NUMBER != '' && steps.live_draft.outputs.live_draft != 'true' && (steps.noema_sidecar.outcome == 'success' || steps.noema_sidecar.outcome == 'failure' || steps.noema_sidecar.outcome == 'cancelled')
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: noema-sidecar-evidence
@@ -958,6 +1106,36 @@ jobs:
           if-no-files-found: ignore
           retention-days: 5
 
+      - name: Refresh read-only Noema GitHub App metadata token after model
+        if: env.PR_NUMBER != '' && steps.noema_prepare.outputs.prepared == 'true' && steps.noema_credential.outputs.source == 'github-app'
+        id: noema_publication_metadata_token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.NOEMA_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.NOEMA_GITHUB_APP_PRIVATE_KEY }}
+          owner: ContextualWisdomLab
+          repositories: ${{ steps.noema_credential.outputs.repository }}
+          permission-contents: read
+          permission-metadata: read
+          permission-pull-requests: read
+
+      - name: Revalidate prepared scope before publisher credential refresh
+        if: env.PR_NUMBER != '' && steps.noema_prepare.outputs.prepared == 'true'
+        env:
+          GH_TOKEN: ${{ steps.noema_publication_metadata_token.outputs.token || '' }}
+        run: |
+          set -euo pipefail
+          python3 -I -B "$GITHUB_WORKSPACE/scripts/ci/noema_bootstrap_producer.py" \
+            --revalidate-publish --private-parent "$RUNNER_TEMP/noema-private-bootstrap" \
+            --source-root "$RUNNER_TEMP/noema-tooling-supplier" \
+            --manifest "$RUNNER_TEMP/noema-accepted-tooling.json" \
+            --accepted-digest "$NOEMA_TOOLING_MANIFEST_SHA256" \
+            --admission "$RUNNER_TEMP/noema-execution-admission.json" \
+            --admission-digest "$NOEMA_EXECUTION_ADMISSION_SHA256" \
+            --verdict-file "$RUNNER_TEMP/noema-private-bootstrap/verdict.json" \
+            --repo "$TARGET_REPOSITORY" --pr-number "$PR_NUMBER" \
+            --expected-head "$EXPECTED_HEAD_SHA"
+
       - name: Refresh repository-scoped Noema GitHub App token for publication
         if: env.PR_NUMBER != '' && steps.noema_prepare.outputs.prepared == 'true' && steps.noema_credential.outputs.source == 'github-app'
         id: noema_github_app_publication_token
@@ -967,34 +1145,43 @@ jobs:
           private-key: ${{ secrets.NOEMA_GITHUB_APP_PRIVATE_KEY }}
           owner: ContextualWisdomLab
           repositories: ${{ steps.noema_credential.outputs.repository }}
-          permission-actions: read
-          permission-checks: read
           permission-contents: read
           permission-metadata: read
-          permission-pull-requests: write
-          permission-security-events: read
-          permission-statuses: read
-          permission-vulnerability-alerts: read
+          permission-pull-requests: read
 
       - name: Publish prepared Noema verdict on the exact live head
         if: env.PR_NUMBER != '' && steps.noema_prepare.outputs.prepared == 'true'
         env:
-          GH_TOKEN: ${{ steps.noema_credential.outputs.source == 'pat' && secrets.NOEMA_REVIEW_TOKEN || steps.noema_credential.outputs.source == 'github-app' && steps.noema_github_app_publication_token.outputs.token || steps.noema_credential.outputs.source == 'oidc' && steps.noema_oidc_token.outputs.token || '' }}
+          GH_TOKEN: ${{ env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && steps.noema_github_app_publication_token.outputs.token || (env.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' && (steps.noema_credential.outputs.source == 'pat' && secrets.NOEMA_REVIEW_TOKEN || steps.noema_credential.outputs.source == 'github-app' && steps.noema_github_app_publication_token.outputs.token || steps.noema_credential.outputs.source == 'oidc' && steps.noema_oidc_token.outputs.token || '')) || '' }}
           NOEMA_REVIEW_TOKEN_SOURCE: ${{ steps.noema_credential.outputs.source == 'pat' && 'noema-review-pat' || steps.noema_credential.outputs.source == 'github-app' && 'noema-review-github-app-refresh' || steps.noema_credential.outputs.source == 'oidc' && 'noema-review-app-oidc' || '' }}
           NOEMA_REVIEW_ACTOR: ${{ steps.noema_github_app_publication_token.outputs['app-slug'] && format('{0}[bot]', steps.noema_github_app_publication_token.outputs['app-slug']) || '' }}
           NOEMA_REVIEW_INSTALLATION_ID: ${{ steps.noema_github_app_publication_token.outputs['installation-id'] }}
+          NOEMA_GITHUB_APP_CLIENT_ID: ${{ vars.NOEMA_GITHUB_APP_CLIENT_ID }}
+          NOEMA_GITHUB_APP_PRIVATE_KEY: ${{ secrets.NOEMA_GITHUB_APP_PRIVATE_KEY }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
             echo "::error::Noema publication has no credential for the explicitly selected reviewer source; refusing any GITHUB_TOKEN or author fallback."
             exit 1
           fi
-          verdict_file="${RUNNER_TEMP}/noema-verdict-envelope.json"
+          verdict_file="${RUNNER_TEMP}/noema-private-bootstrap/verdict.json"
           if [ ! -f "$verdict_file" ]; then
             echo "::error::Noema prepared-verdict output claimed success but its private envelope is missing."
             exit 1
           fi
-          python3 "$GITHUB_WORKSPACE/.github/actions/noema-review/two_phase.py"             --repo "$TARGET_REPOSITORY"             --pr-number "$PR_NUMBER"             --expected-head "$EXPECTED_HEAD_SHA"             --publish-verdict-file "$verdict_file"
+          if [ "${{ steps.noema_credential.outputs.source }}" != 'github-app' ]; then
+            echo "::error::Two-phase Noema issuer requires the existing authenticated GitHub App route; no PAT/OIDC authority relabeling."
+            exit 1
+          fi
+          node "$GITHUB_WORKSPACE/scripts/ci/noema_existing_app_issuer.cjs" \
+            --phase publish --private-parent "$RUNNER_TEMP/noema-private-bootstrap" \
+            --source-root "$RUNNER_TEMP/noema-tooling-supplier" \
+            --manifest "$RUNNER_TEMP/noema-accepted-tooling.json" \
+            --accepted-digest "$NOEMA_TOOLING_MANIFEST_SHA256" \
+            --admission "$RUNNER_TEMP/noema-execution-admission.json" \
+            --admission-digest "$NOEMA_EXECUTION_ADMISSION_SHA256" \
+            --repo "$TARGET_REPOSITORY" --pr-number "$PR_NUMBER" \
+            --expected-head "$EXPECTED_HEAD_SHA" --verdict-file "$verdict_file"
 
   continue-noema-transport:
     needs: [admit-current-head, noema-review]
@@ -1004,7 +1191,9 @@ jobs:
       && needs.noema-review.result == 'failure'
       && needs.noema-review.outputs.transport_capacity_unavailable == 'true'
       && needs.noema-review.outputs.transport_retry_eligible == 'true'
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/contextual-orchestrator' || github.repository == 'ContextualWisdomLab/fast-mlsirm' || github.repository == 'ContextualWisdomLab/cwl-telemetry' || github.repository == 'ContextualWisdomLab/naruon' || github.repository == 'ContextualWisdomLab/late-life-anxiety-reanalysis' || github.repository == 'ContextualWisdomLab/tokyo-travel-2026') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 10
     permissions:
       contents: write
diff --git a/.github/workflows/opencode-review-coalesce-tick.yml b/.github/workflows/opencode-review-coalesce-tick.yml
index 35f1da22c7..a9b657ba31 100644
--- a/.github/workflows/opencode-review-coalesce-tick.yml
+++ b/.github/workflows/opencode-review-coalesce-tick.yml
@@ -54,7 +54,9 @@ jobs:
     # gate back to step scope: that reintroduces multi-hour queue wait for
     # an inert echo under the org concurrent-job ceiling.
     if: vars.OPENCODE_REVIEW_COALESCE_ENABLED == 'true'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 4
     permissions:
       actions: write
@@ -85,18 +87,18 @@ jobs:
           repos_file="${RUNNER_TEMP}/coalesce-repos.txt"
           : >"$repos_file"
           cursor=""
-          for page in 1 2 3 4 5 6 7 8 9 10; do
+          for _page in 1 2 3 4 5 6 7 8 9 10; do
             cursor_arg=()
             if [ -n "$cursor" ]; then
               cursor_arg=(-f "cursor=$cursor")
             fi
-            response="$(gh api graphql -f query='
-              query($cursor: String) {
-                search(query: "org:ContextualWisdomLab is:pr is:open draft:false", type: ISSUE, first: 100, after: $cursor) {
+            response="$(gh api graphql -f query="
+              query(\$cursor: String) {
+                search(query: \"org:ContextualWisdomLab is:pr is:open draft:false\", type: ISSUE, first: 100, after: \$cursor) {
                   nodes { ... on PullRequest { repository { nameWithOwner } } }
                   pageInfo { hasNextPage endCursor }
                 }
-              }' "${cursor_arg[@]}" 2>/dev/null || echo '{}')"
+              }" "${cursor_arg[@]}" 2>/dev/null || echo '{}')"
             printf '%s' "$response" | jq -r '.data.search.nodes[]?.repository.nameWithOwner // empty' >>"$repos_file"
             has_next="$(printf '%s' "$response" | jq -r '.data.search.pageInfo.hasNextPage // false')"
             [ "$has_next" = "true" ] || break
diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml
index 09bbf8181a..443888bf1f 100644
--- a/.github/workflows/opencode-review-dispatch.yml
+++ b/.github/workflows/opencode-review-dispatch.yml
@@ -396,9 +396,11 @@ jobs:
     if: >-
       needs.validate-pr-metadata.result == 'success'
       && github.event_name == 'repository_dispatch'
+    # Pull-request merge-tree tests run only on the clean-per-job isolated pool.
+    # Keep metadata and review publication on their separate trusted jobs.
     runs-on:
-      group: CWL central OpenCode
-      labels: [self-hosted, linux, x64]
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 300
     permissions:
       # The PR tree arrives through a same-run artifact. No repository-content,
@@ -747,7 +749,7 @@ jobs:
               changed_basename="${changed_path##*/}"
               case "$changed_basename" in
                 *.py|pyproject.toml|uv.lock|poetry.lock|Pipfile|Pipfile.lock|\
-                setup.py|setup.cfg|tox.ini|pytest.ini|.pytest.ini|\
+                setup.cfg|tox.ini|pytest.ini|.pytest.ini|\
                 requirements.lock|requirements*.txt|requirements*.in|\
                 environment.yml|environment.yaml)
                   python_coverage_required=1
@@ -976,6 +978,9 @@ jobs:
             && rm -rf /tmp/base-python-requirements \
             && rm -f /usr/local/libexec/install-base-python-locks.py
           COPY base-rust-dependencies /opt/base-rust-dependencies
+          # Crate archives keep modes such as 0640 through COPY, so make the base
+          # Rust dependency tree readable by the unprivileged coverage sandbox UID.
+          RUN chmod -R a+rX /opt/base-rust-dependencies
           DOCKERFILE
             # Debian's rustc lags the MSRV of pinned repositories (fast-mlsirm pins
             # 1.97.1; Debian ships 1.85), so a base-pinned repository gets that exact
@@ -1116,9 +1121,11 @@ jobs:
           }
 
           append_command() {
-            printf '$ ' >>"$summary_file"
-            printf '%q ' "$@" >>"$summary_file"
-            printf '\n' >>"$summary_file"
+            {
+              printf '$ '
+              printf '%q ' "$@"
+              printf '\n'
+            } >>"$summary_file"
           }
 
           emit_captured_log() {
@@ -1406,13 +1413,13 @@ jobs:
             project_is_maturin_project "$project_dir" || return 0
             run_and_capture "Offline PyO3/maturin extension build (${project_dir})" \
               env CARGO_NET_OFFLINE=true CARGO_BUILD_JOBS=1 \
-              bash -c 'set -eu
-                cd "$1"
-                dist_dir="$(mktemp -d)"
-                python3 -m maturin build --offline --release -o "$dist_dir"
-                python3 -m pip install --user --no-index --no-deps --force-reinstall "$dist_dir"/*.whl
-                python3 "$2" "$dist_dir"/*.whl .
-                rm -rf "$dist_dir"' bash "$project_dir" "${GITHUB_WORKSPACE}/scripts/ci/place_maturin_extension.py"
+              bash -c "set -eu
+                cd \"\$1\"
+                dist_dir=\"\$(mktemp -d)\"
+                python3 -m maturin build --offline --release -o \"\$dist_dir\"
+                python3 -m pip install --user --no-index --no-deps --force-reinstall \"\$dist_dir\"/*.whl
+                python3 \"\$2\" \"\$dist_dir\"/*.whl .
+                rm -rf \"\$dist_dir\"" bash "$project_dir" "${GITHUB_WORKSPACE}/scripts/ci/place_maturin_extension.py"
           }
 
           run_python_test_coverage() {
@@ -1431,14 +1438,14 @@ jobs:
                 done <<<"$configured_commands_json"
             else
               run_and_capture "Python coverage with missing-line report (${project_dir})" \
-                bash -c 'cd "$1" && PYTHONPATH="$([ -d src ] && printf src:. || printf .)" python3 -m coverage run -m pytest tests && python3 -m coverage report --show-missing' bash "$project_dir"
+                bash -c "cd \"\$1\" && PYTHONPATH=\"\$([ -d src ] && printf src:. || printf .)\" python3 -m coverage run -m pytest tests && python3 -m coverage report --show-missing" bash "$project_dir"
             fi
             done < <(tracked_python_projects_with_tests)
 
             if [ "$measured_projects" -eq 0 ]; then
               if has_tracked_files '*.py'; then
                 run_and_capture "Python coverage with missing-line report" \
-                  bash -c 'PYTHONPATH="$([ -d src ] && printf src:. || printf .)" python3 -m coverage run -m pytest && python3 -m coverage report --show-missing'
+                  bash -c "PYTHONPATH=\"\$([ -d src ] && printf src:. || printf .)\" python3 -m coverage run -m pytest && python3 -m coverage report --show-missing"
               elif python3 -I -c 'import pytest_cov' >/dev/null 2>&1; then
                 run_and_capture "Python pytest-cov coverage" python3 -m pytest --cov=. --cov-report=term-missing
               else
@@ -1589,7 +1596,7 @@ jobs:
               if [ -f "${project_dir}/tests/test_docstrings.py" ]; then
                 measured_projects=1
                 run_and_capture "Python docstring coverage (${project_dir})" \
-                  bash -c 'cd "$1" && PYTHONPATH="$([ -d src ] && printf src:. || printf .)" python3 -m pytest tests/test_docstrings.py' bash "$project_dir"
+                  bash -c "cd \"\$1\" && PYTHONPATH=\"\$([ -d src ] && printf src:. || printf .)\" python3 -m pytest tests/test_docstrings.py" bash "$project_dir"
               fi
             done < <(tracked_python_projects_with_tests)
             [ "$measured_projects" -eq 1 ]
@@ -1957,21 +1964,21 @@ jobs:
                 if [ -n "$package_name" ] && jq -e '.workspaces // empty' package.json >/dev/null 2>&1; then
                   run_and_capture "Tauri frontendDist build (${package_dir})" corepack npm run build --workspace "$package_name"
                 else
-                  run_and_capture "Tauri frontendDist build (${package_dir})" bash -c 'cd "$1" && corepack npm run build' bash "$package_dir"
+                  run_and_capture "Tauri frontendDist build (${package_dir})" bash -c "cd \"\$1\" && corepack npm run build" bash "$package_dir"
                 fi
                 ;;
               pnpm)
                 if [ -n "$package_name" ] && [ -f pnpm-workspace.yaml ]; then
                   run_and_capture "Tauri frontendDist build (${package_dir})" corepack pnpm --filter "$package_name" run build
                 else
-                  run_and_capture "Tauri frontendDist build (${package_dir})" bash -c 'cd "$1" && corepack pnpm run build' bash "$package_dir"
+                  run_and_capture "Tauri frontendDist build (${package_dir})" bash -c "cd \"\$1\" && corepack pnpm run build" bash "$package_dir"
                 fi
                 ;;
               yarn)
                 if [ -n "$package_name" ] && jq -e '.workspaces // empty' package.json >/dev/null 2>&1; then
                   run_and_capture "Tauri frontendDist build (${package_dir})" yarn workspace "$package_name" build
                 else
-                  run_and_capture "Tauri frontendDist build (${package_dir})" bash -c 'cd "$1" && yarn build' bash "$package_dir"
+                  run_and_capture "Tauri frontendDist build (${package_dir})" bash -c "cd \"\$1\" && yarn build" bash "$package_dir"
                 fi
                 ;;
             esac
@@ -2087,8 +2094,13 @@ jobs:
             # coverage command still runs and reports any uncovered GPU lines
             # exactly as before, so Rust repositories without GPU code are
             # unaffected and no gate is weakened.
-            if ls /usr/share/vulkan/icd.d/lvp_icd*.json >/dev/null 2>&1; then
-              lvp_icd="$(ls /usr/share/vulkan/icd.d/lvp_icd*.json | head -n1)"
+            local lvp_icd="" candidate_icd
+            for candidate_icd in /usr/share/vulkan/icd.d/lvp_icd*.json; do
+              [ -f "$candidate_icd" ] || continue
+              lvp_icd="$candidate_icd"
+              break
+            done
+            if [ -n "$lvp_icd" ]; then
               export VK_ICD_FILENAMES="$lvp_icd"
               export VK_DRIVER_FILES="$lvp_icd"
               export WGPU_BACKEND=vulkan
@@ -2655,7 +2667,27 @@ jobs:
           python-version: "3.12"
           update-environment: false
 
+      - name: Admit existing personal LiteLLM auto route
+        id: personal_route
+        env:
+          LLM_GATEWAY_API_KEY: ${{ secrets.LLM_GATEWAY_API_KEY }}
+          PERSONAL_REVIEW_ZERO_COST_ATTESTED: ${{ vars.PERSONAL_REVIEW_ZERO_COST_ATTESTED || 'false' }}
+          PERSONAL_REVIEW_ZDR_ATTESTED: ${{ vars.PERSONAL_REVIEW_ZDR_ATTESTED || 'false' }}
+          PRIVATE_TARGET: ${{ needs.validate-pr-metadata.outputs.is_private }}
+        run: |
+          set -euo pipefail
+          if [ -z "${LLM_GATEWAY_API_KEY:-}" ]; then
+            echo '::error::STOP: existing personal review Secret is unavailable.'
+            exit 1
+          fi
+          python3 -m scripts.ci.personal_review_route \
+            --zero-cost "$PERSONAL_REVIEW_ZERO_COST_ATTESTED" \
+            --zero-retention "$PERSONAL_REVIEW_ZDR_ATTESTED" \
+            --private-target "$PRIVATE_TARGET"
+          echo 'selected=true' >>"$GITHUB_OUTPUT"
+
       - name: Provision contextual-orchestrator review sidecar
+        if: steps.personal_route.outputs.selected != 'true'
         env:
           SIDECAR_PYTHON: ${{ steps.sidecar_python.outputs.python-path }}
           BYTEZ_API_KEY: ${{ secrets.BYTEZ_API_KEY }}
@@ -2664,6 +2696,7 @@ jobs:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR: ${{ needs.validate-pr-metadata.outputs.is_private }}
+          CONTEXTUAL_ORCHESTRATOR_POOL: auto
         run: |
           set -euo pipefail
           bash "$GITHUB_WORKSPACE/scripts/ci/contextual_orchestrator_review_sidecar.sh"
@@ -3295,13 +3328,13 @@ jobs:
               language_signal="Match changed prose"
             fi
 
-            printf -- '- Preferred review language: `%s`\n' "$language_signal"
+            printf -- "- Preferred review language: \`%s\`\\n" "$language_signal"
             printf -- '- Rule: write human-readable review prose in the preferred language; keep file paths, identifiers, logs, quoted source, error text, and protocol literals unchanged.\n'
-            printf -- '- PR title: `%s`\n' "$(printf '%s' "$title" | tr '\r\n`' '   ' | cut -c 1-240)"
+            printf -- "- PR title: \`%s\`\\n" "$(printf '%s' "$title" | tr '\r\n`' '   ' | cut -c 1-240)"
             if [ -n "$body" ]; then
-              printf -- '- PR body excerpt: `%s`\n' "$(printf '%s' "$body" | tr '\r\n`' '   ' | cut -c 1-360)"
+              printf -- "- PR body excerpt: \`%s\`\\n" "$(printf '%s' "$body" | tr '\r\n`' '   ' | cut -c 1-360)"
             else
-              printf -- '- PR body excerpt: `[empty]`\n'
+              printf -- "- PR body excerpt: \`[empty]\`\\n"
             fi
           }
 
@@ -3580,7 +3613,7 @@ jobs:
             shift
 
             if ! git -C "$OPENCODE_SOURCE_WORKDIR" diff "$@"; then
-              printf 'Unable to collect %s from `%s` to `%s`; continue review from available changed-file evidence and direct file inspection.\n' "$description" "$PR_MERGE_BASE" "$PR_HEAD_SHA"
+              printf "Unable to collect %s from \`%s\` to \`%s\`; continue review from available changed-file evidence and direct file inspection.\\n" "$description" "$PR_MERGE_BASE" "$PR_HEAD_SHA"
             fi
           }
 
@@ -3590,13 +3623,13 @@ jobs:
             printf -- "- Base SHA: \`%s\`\n" "$PR_BASE_SHA"
             printf -- "- Head SHA: \`%s\`\n\n" "$PR_HEAD_SHA"
             if ! PR_MERGE_BASE="$(git -C "$OPENCODE_SOURCE_WORKDIR" merge-base "$PR_BASE_SHA" "$PR_HEAD_SHA")"; then
-              printf 'Merge-base discovery failed for `%s` and `%s`; falling back to base SHA for bounded diff evidence.\n\n' "$PR_BASE_SHA" "$PR_HEAD_SHA"
+              printf "Merge-base discovery failed for \`%s\` and \`%s\`; falling back to base SHA for bounded diff evidence.\\n\\n" "$PR_BASE_SHA" "$PR_HEAD_SHA"
               PR_MERGE_BASE="$PR_BASE_SHA"
             fi
             printf -- "- Merge base SHA: \`%s\`\n\n" "$PR_MERGE_BASE"
             printf '## Current-head authority order\n\n'
             printf 'Treat current-head sections in this file as authoritative for this run: Other unresolved review thread evidence, Failed GitHub Check evidence, Coverage execution evidence, Changed files, and Focused changed hunks.\n'
-            printf 'All PR reviews and comments evidence is historical context only and may contain stale bot conclusions. Do not infer active failed checks, unresolved threads, or missing changed files from those comments unless current-head evidence corroborates the same claim for Head SHA `%s`.\n\n' "$PR_HEAD_SHA"
+            printf "All PR reviews and comments evidence is historical context only and may contain stale bot conclusions. Do not infer active failed checks, unresolved threads, or missing changed files from those comments unless current-head evidence corroborates the same claim for Head SHA \`%s\`.\\n\\n" "$PR_HEAD_SHA"
             if ! git -C "$OPENCODE_SOURCE_WORKDIR" diff --name-only --find-renames "$PR_MERGE_BASE" "$PR_HEAD_SHA" |
               awk 'NF > 0 && $0 !~ /^\// && $0 !~ /(^|\/)\.\.($|\/)/ { print }' >"$OPENCODE_CHANGED_FILES_FILE"; then
               printf 'Changed-file discovery failed; downstream review must inspect the PR head directly.\n\n'
@@ -3752,6 +3785,10 @@ jobs:
 
       - name: Prepare isolated OpenCode review workspace
         env:
+          PERSONAL_ROUTE_SELECTED: ${{ steps.personal_route.outputs.selected }}
+          PERSONAL_REVIEW_ZERO_COST_ATTESTED: ${{ vars.PERSONAL_REVIEW_ZERO_COST_ATTESTED || 'false' }}
+          PERSONAL_REVIEW_ZDR_ATTESTED: ${{ vars.PERSONAL_REVIEW_ZDR_ATTESTED || 'false' }}
+          PRIVATE_TARGET: ${{ needs.validate-pr-metadata.outputs.is_private }}
           OPENCODE_REVIEW_WORKDIR: ${{ runner.temp }}/opencode-review-project
           OPENCODE_EVIDENCE_FILE: ${{ runner.temp }}/opencode-review-evidence.md
           OPENCODE_FAILED_CHECK_EVIDENCE_FILE: ${{ runner.temp }}/opencode-failed-check-evidence.md
@@ -4101,8 +4138,8 @@ jobs:
 
           jq -n '{
             "$schema": "https://opencode.ai/config.json",
-            "model": "contextual-orchestrator/orchestrator/free",
-            "small_model": "contextual-orchestrator/orchestrator/free",
+            "model": "contextual-orchestrator/orchestrator/auto",
+            "small_model": "contextual-orchestrator/orchestrator/auto",
             "enabled_providers": ["contextual-orchestrator"],
             "lsp": false,
             "mcp": {},
@@ -4184,8 +4221,8 @@ jobs:
 
           gateway_config="${OPENCODE_REVIEW_WORKDIR}/opencode.gateway.jsonc"
           jq '
-            .model = "contextual-orchestrator/orchestrator/free" |
-            .small_model = "contextual-orchestrator/orchestrator/free" |
+            .model = "contextual-orchestrator/orchestrator/auto" |
+            .small_model = "contextual-orchestrator/orchestrator/auto" |
             .enabled_providers = ["contextual-orchestrator"] |
             .provider = {
               "contextual-orchestrator": {
@@ -4196,8 +4233,8 @@ jobs:
                   "apiKey": "{env:CONTEXTUAL_ORCHESTRATOR_TOKEN}"
                 },
                 "models": {
-                "orchestrator/free": {
-                  "name": "Orchestrator Free (ZDR-first zero-cost pool)",
+                "orchestrator/auto": {
+                  "name": "Orchestrator Auto (cost-fenced dynamic selection)",
                   "tool_call": true,
                   "reasoning": true,
                   "options": {
@@ -4219,11 +4256,18 @@ jobs:
           ' "${OPENCODE_REVIEW_WORKDIR}/opencode.jsonc" >"$gateway_config"
           mv -- "$gateway_config" "${OPENCODE_REVIEW_WORKDIR}/opencode.jsonc"
 
-          if ! grep -Fq 'contextual-orchestrator/orchestrator/free' "${OPENCODE_REVIEW_WORKDIR}/opencode.jsonc" \
+          if ! grep -Fq 'contextual-orchestrator/orchestrator/auto' "${OPENCODE_REVIEW_WORKDIR}/opencode.jsonc" \
             || ! grep -Fq 'CONTEXTUAL_ORCHESTRATOR_BASE_URL' "${OPENCODE_REVIEW_WORKDIR}/opencode.jsonc"; then
             echo '::error::Generated isolated opencode.jsonc is missing the contextual-orchestrator gateway route.'
             exit 1
           fi
+          if [ "${PERSONAL_ROUTE_SELECTED:-}" = 'true' ]; then
+            python3 -m scripts.ci.personal_review_route \
+              --zero-cost "$PERSONAL_REVIEW_ZERO_COST_ATTESTED" \
+              --zero-retention "$PERSONAL_REVIEW_ZDR_ATTESTED" \
+              --private-target "$PRIVATE_TARGET" \
+              --opencode-config "${OPENCODE_REVIEW_WORKDIR}/opencode.jsonc"
+          fi
           printf 'Prepared isolated OpenCode review workspace: %s\n' "$OPENCODE_REVIEW_WORKDIR"
 
       - name: Run OpenCode PR Review model pool
@@ -4231,10 +4275,12 @@ jobs:
         if: needs.coverage-evidence.result == 'success'
         continue-on-error: true
         env:
+          LLM_GATEWAY_API_KEY: ${{ secrets.LLM_GATEWAY_API_KEY }}
+          PERSONAL_ROUTE_SELECTED: ${{ steps.personal_route.outputs.selected }}
           SHARE: "false"
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
           NO_COLOR: "1"
-          OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/free"
+          OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/auto"
           # One attempt per model, then fall through to the next model. Retrying
           # the SAME model 5x let a rate-limited/hung leader consume the whole
           # step, so the pool never reached a healthy fallback model.
@@ -4272,7 +4318,12 @@ jobs:
           RUN_ATTEMPT: ${{ github.run_attempt }}
         run: |
           set -euo pipefail
-          source "$GITHUB_WORKSPACE/scripts/ci/load_contextual_orchestrator_token.sh"
+          if [ "${PERSONAL_ROUTE_SELECTED:-}" = 'true' ]; then
+            test -n "${LLM_GATEWAY_API_KEY:-}"
+            export OPENCODE_MODEL_CANDIDATES="personal-litellm/auto"
+          else
+            source "$GITHUB_WORKSPACE/scripts/ci/load_contextual_orchestrator_token.sh"
+          fi
           set +e
           bash "$GITHUB_WORKSPACE/scripts/ci/run_opencode_review_model_pool.sh"
           pool_status=$?
@@ -4607,27 +4658,27 @@ jobs:
               "$@"
           }
 
-          self_check_filter='
+          self_check_filter="
             def self_check:
-              (.name // "") as $n
-              | ["opencode-review", "coverage-evidence", "coverage-source-tree", "required-workflow-bootstrap", "metadata-only gate evaluation", "scan-pr-queue"] | index($n);
+              (.name // \"\") as \$n
+              | [\"opencode-review\", \"coverage-evidence\", \"coverage-source-tree\", \"required-workflow-bootstrap\", \"metadata-only gate evaluation\", \"scan-pr-queue\"] | index(\$n);
             def latest_peer_checks:
               [
                 (.check_runs // [])[]
                 | select(self_check | not)
                 | . + {
                     checkedAt: (
-                      if ((.started_at // "") != "") then .started_at
-                      else (.completed_at // "")
+                      if ((.started_at // \"\") != \"\") then .started_at
+                      else (.completed_at // \"\")
                       end
                     )
                   }
               ]
-              | sort_by(.app.slug // "", .name // "", .checkedAt // "", .id // 0)
-              | group_by([.app.slug // "", .name // ""])
+              | sort_by(.app.slug // \"\", .name // \"\", .checkedAt // \"\", .id // 0)
+              | group_by([.app.slug // \"\", .name // \"\"])
               | map(last)
               | .[];
-          '
+          "
 
           check_runs_file="$(mktemp)"
           pending_checks_file="$(mktemp)"
@@ -4830,6 +4881,8 @@ jobs:
         # extensions for image validation or package/GPU builds plus API and
         # publication overhead.
         env:
+          LLM_GATEWAY_API_KEY: ${{ secrets.LLM_GATEWAY_API_KEY }}
+          PERSONAL_ROUTE_SELECTED: ${{ steps.personal_route.outputs.selected }}
           GH_TOKEN: ${{ steps.opencode_app_token.outputs.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
           CHECK_LOOKUP_GH_TOKEN: ${{ github.token }}
           # The OpenCode app installation token is exchanged from api.opencode.ai
@@ -4852,7 +4905,7 @@ jobs:
           COVERAGE_EVIDENCE_SUMMARY: ${{ needs.coverage-evidence.outputs.coverage_summary || 'Coverage evidence job did not run or did not publish coverage evidence.' }}
           OPENCODE_REVIEW_WORKDIR: ${{ runner.temp }}/opencode-review-project
           OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head
-          MODEL: contextual-orchestrator/orchestrator/free
+          MODEL: contextual-orchestrator/orchestrator/auto
           USE_GITHUB_TOKEN: "true"
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
           NO_COLOR: "1"
@@ -4886,6 +4939,10 @@ jobs:
           OPENCODE_EXPORT_TIMEOUT_SECONDS: "60"
         run: |
           set -euo pipefail
+          if [ "${PERSONAL_ROUTE_SELECTED:-}" = 'true' ]; then
+            test -n "${LLM_GATEWAY_API_KEY:-}"
+            export MODEL="personal-litellm/auto"
+          fi
           quoted_coverage="${COVERAGE_EVIDENCE_RESULT:-}"
           COVERAGE_EVIDENCE_RESULT="$(python3 scripts/ci/opencode_coverage_identity.py \
             --repo "$GH_REPOSITORY" \
@@ -5274,7 +5331,7 @@ jobs:
             if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
               {
                 printf '## OpenCode %s review body\n\n' "$event"
-                printf -- '- Head SHA: `%s`\n' "$HEAD_SHA"
+                printf -- "- Head SHA: \`%s\`\\n" "$HEAD_SHA"
                 printf -- '- Workflow run: %s\n' "$RUN_ID"
                 printf -- '- Workflow attempt: %s\n\n' "$RUN_ATTEMPT"
                 printf '%s\n' "$body"
@@ -5628,7 +5685,7 @@ jobs:
               printf '## Summary\n\n'
               printf '%s\n\n' "$summary"
               printf '## Adversarial validation\n\n'
-              printf '```json\n%s\n```\n\n' "$adversarial_evidence"
+              printf "\`\`\`json\\n%s\\n\`\`\`\\n\\n" "$adversarial_evidence"
               printf -- '- Result: REQUEST_CHANGES\n'
               printf -- '- Reason: %s\n\n' "$reason"
               printf -- "- Head SHA: \`%s\`\n" "$HEAD_SHA"
@@ -6214,9 +6271,15 @@ jobs:
               printf 'Skipping publish-step failed-check OpenCode diagnosis for central review-process self-repair; using collected current-head failed-check logs/SARIF fallback so the publish step stays bounded.\n' >&2
               return 1
             fi
-            source "$GITHUB_WORKSPACE/scripts/ci/load_contextual_orchestrator_token.sh"
-            if [ -z "${CONTEXTUAL_ORCHESTRATOR_TOKEN:-}" ]; then
-              return 1
+            if [ "${PERSONAL_ROUTE_SELECTED:-}" = 'true' ]; then
+              if [ -z "${LLM_GATEWAY_API_KEY:-}" ]; then
+                return 1
+              fi
+            else
+              source "$GITHUB_WORKSPACE/scripts/ci/load_contextual_orchestrator_token.sh"
+              if [ -z "${CONTEXTUAL_ORCHESTRATOR_TOKEN:-}" ]; then
+                return 1
+              fi
             fi
             if ! python3 "$GITHUB_WORKSPACE/scripts/ci/assert_opencode_reasoning_effort.py" \
               --config "$OPENCODE_REVIEW_WORKDIR/opencode.jsonc" \
@@ -6443,33 +6506,33 @@ jobs:
 
             case "$mode" in
               failed)
-                jq_filter='
+                jq_filter="
                   [.[].check_runs[]?]
-                  | sort_by((.started_at // .completed_at // .created_at // ""), (.id // 0))
-                  | group_by(.name // "")
+                  | sort_by((.started_at // .completed_at // .created_at // \"\"), (.id // 0))
+                  | group_by(.name // \"\")
                   | map(last)
                   | .[]?
-                  | select(((.name // "" | ascii_downcase) as $n | ["opencode-review","coverage-evidence","metadata-only gate evaluation"] | index($n)) | not)
-                  | select((.status // "") == "completed")
-                  | select((.conclusion // "" | ascii_upcase) as $c | ["FAILURE","TIMED_OUT","ACTION_REQUIRED","CANCELLED","STARTUP_FAILURE"] | index($c))
-                  | select((.name // "") != "scan-pr-queue")
-                  | select(((.conclusion // "" | ascii_downcase) == "cancelled" and ((.name // "") | contains("$" + "{{"))) | not)
-                  | select(((.conclusion // "" | ascii_downcase) == "cancelled" and (.name // "") == "noema-review") | not)
-                  | "- " + (if (.name // "") == "strix" then "Strix Security Scan/strix" else ((.name // "check") + " check run") end) + ": " + (.conclusion // "unknown") + (if (.details_url // .html_url // "") != "" then " (" + (.details_url // .html_url) + ")" else "" end)
-                '
+                  | select(((.name // \"\" | ascii_downcase) as \$n | [\"opencode-review\",\"coverage-evidence\",\"metadata-only gate evaluation\"] | index(\$n)) | not)
+                  | select((.status // \"\") == \"completed\")
+                  | select((.conclusion // \"\" | ascii_upcase) as \$c | [\"FAILURE\",\"TIMED_OUT\",\"ACTION_REQUIRED\",\"CANCELLED\",\"STARTUP_FAILURE\"] | index(\$c))
+                  | select((.name // \"\") != \"scan-pr-queue\")
+                  | select(((.conclusion // \"\" | ascii_downcase) == \"cancelled\" and ((.name // \"\") | contains(\"\$\" + \"{{\"))) | not)
+                  | select(((.conclusion // \"\" | ascii_downcase) == \"cancelled\" and (.name // \"\") == \"noema-review\") | not)
+                  | \"- \" + (if (.name // \"\") == \"strix\" then \"Strix Security Scan/strix\" else ((.name // \"check\") + \" check run\") end) + \": \" + (.conclusion // \"unknown\") + (if (.details_url // .html_url // \"\") != \"\" then \" (\" + (.details_url // .html_url) + \")\" else \"\" end)
+                "
                 ;;
               pending)
-                jq_filter='
+                jq_filter="
                   [.[].check_runs[]?]
-                  | sort_by((.started_at // .completed_at // .created_at // ""), (.id // 0))
-                  | group_by(.name // "")
+                  | sort_by((.started_at // .completed_at // .created_at // \"\"), (.id // 0))
+                  | group_by(.name // \"\")
                   | map(last)
                   | .[]?
-                  | select(((.name // "" | ascii_downcase) as $n | ["opencode-review","coverage-evidence","metadata-only gate evaluation"] | index($n)) | not)
-                  | select((.name // "") != "scan-pr-queue")
-                  | select((.status // "") != "completed")
-                  | "- " + (if (.name // "") == "strix" then "Strix Security Scan/strix" else ((.name // "check") + " check run") end) + ": " + (.status // "unknown") + (if (.details_url // .html_url // "") != "" then " (" + (.details_url // .html_url) + ")" else "" end)
-                '
+                  | select(((.name // \"\" | ascii_downcase) as \$n | [\"opencode-review\",\"coverage-evidence\",\"metadata-only gate evaluation\"] | index(\$n)) | not)
+                  | select((.name // \"\") != \"scan-pr-queue\")
+                  | select((.status // \"\") != \"completed\")
+                  | \"- \" + (if (.name // \"\") == \"strix\" then \"Strix Security Scan/strix\" else ((.name // \"check\") + \" check run\") end) + \": \" + (.status // \"unknown\") + (if (.details_url // .html_url // \"\") != \"\" then \" (\" + (.details_url // .html_url) + \")\" else \"\" end)
+                "
                 ;;
               *)
                 return 1
@@ -6527,10 +6590,10 @@ jobs:
               -f owner="$owner" \
               -f name="$name" \
               -F number="$PR_NUMBER" \
-              -f query='
-                query($owner:String!,$name:String!,$number:Int!) {
-                  repository(owner:$owner,name:$name) {
-                    pullRequest(number:$number) {
+              -f query="
+                query(\$owner:String!,\$name:String!,\$number:Int!) {
+                  repository(owner:\$owner,name:\$name) {
+                    pullRequest(number:\$number) {
                       statusCheckRollup {
                         contexts(first: 100) {
                           nodes {
@@ -6555,7 +6618,7 @@ jobs:
                     }
                   }
                 }
-              ' \
+              " \
               --jq '
                 (.data.repository.pullRequest.statusCheckRollup.contexts.nodes // [])
                 | map(
@@ -6680,7 +6743,7 @@ jobs:
               -f owner="$owner" \
               -f name="$name" \
               -F number="$PR_NUMBER" \
-              -f query='query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){id}}}' \
+              -f query="query(\$owner:String!,\$name:String!,\$number:Int!){repository(owner:\$owner,name:\$name){pullRequest(number:\$number){id}}}" \
               --jq '.data.repository.pullRequest.id // empty')"; then
               echo "GitHub Checks statusCheckRollup PR id lookup failed; falling back to current-head REST check-runs." >&2
               pr_node_id=""
@@ -7124,21 +7187,21 @@ jobs:
                 -f "ref=refs/heads/${head_ref}" \
                 -f state=open \
                 -F per_page=100 \
-                --jq '
+                --jq "
                   [
                     .[]
                     | {
                         number: (.number // 0),
-                        rule: (.rule.id // .rule.name // "unknown"),
-                        tool: (.tool.name // "code-scanning"),
-                        severity: (.rule.security_severity_level // .rule.severity // "unknown"),
-                        url: (.html_url // "")
+                        rule: (.rule.id // .rule.name // \"unknown\"),
+                        tool: (.tool.name // \"code-scanning\"),
+                        severity: (.rule.security_severity_level // .rule.severity // \"unknown\"),
+                        url: (.html_url // \"\")
                       }
-                    | select((.severity | ascii_downcase) as $s | ["medium","high","critical","warning","error"] | index($s))
+                    | select((.severity | ascii_downcase) as \$s | [\"medium\",\"high\",\"critical\",\"warning\",\"error\"] | index(\$s))
                   ]
                   | .[]
-                  | "- " + .tool + "/" + .rule + ": " + .severity + " alert #" + (.number | tostring) + (if .url != "" then " (" + .url + ")" else "" end)
-                ' >"$output_file" 2>"$lookup_error_file"; then
+                  | \"- \" + .tool + \"/\" + .rule + \": \" + .severity + \" alert #\" + (.number | tostring) + (if .url != \"\" then \" (\" + .url + \")\" else \"\" end)
+                " >"$output_file" 2>"$lookup_error_file"; then
               sed 's/^/gh: /' "$lookup_error_file" >&2 || true
               rm -f "$lookup_error_file"
               return 1
@@ -7186,7 +7249,7 @@ jobs:
                 printf 'OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.\n\n'
                 printf '## Findings\n\n'
                 printf '### 1. HIGH Current-head GitHub Checks - Fix failed required checks before approval\n'
-                printf -- '- Problem: Failed same-head checks remain for `%s`.\n' "$HEAD_SHA"
+                printf -- "- Problem: Failed same-head checks remain for \`%s\`.\\n" "$HEAD_SHA"
                 printf -- '- Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.\n'
                 printf -- '- Fix: Read and fix the failed check logs below, then rerun the current-head checks.\n'
                 printf -- '- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.\n\n'
@@ -7242,11 +7305,11 @@ jobs:
               if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
                 {
                   printf '## OpenCode required check satisfied by existing same-head approval\n\n'
-                  printf -- '- Result: `EXISTING_CURRENT_HEAD_APPROVAL`\n'
-                  printf -- '- Head SHA: `%s`\n' "$HEAD_SHA"
+                  printf -- "- Result: \`EXISTING_CURRENT_HEAD_APPROVAL\`\\n"
+                  printf -- "- Head SHA: \`%s\`\\n" "$HEAD_SHA"
                   printf -- '- Workflow run: %s\n' "$RUN_ID"
                   printf -- '- Workflow attempt: %s\n' "$RUN_ATTEMPT"
-                  printf -- '- Model-pool outcome: `%s`\n' "${OPENCODE_MODEL_POOL_OUTCOME:-unknown}"
+                  printf -- "- Model-pool outcome: \`%s\`\\n" "${OPENCODE_MODEL_POOL_OUTCOME:-unknown}"
                   printf -- '- Reason: a prior real-model OpenCode APPROVED review with passed structured adversarial probes already targets this exact head, and the fallback rechecked coverage, peer checks, code-scanning alerts, and unresolved review threads before accepting it.\n'
                   printf -- '- Review state: unchanged; no duplicate APPROVE review was posted from model-output-unavailable evidence.\n\n'
                 } >>"$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index 1194d7eea6..1cfbea07b7 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -43,7 +43,9 @@ jobs:
     # queue wait between two single-digit-second jobs. See
     # docs/doctoring/actions-capacity-root-cause-20260917.md for the
     # underlying measurement methodology.
-    runs-on: ${{ github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     permissions:
       contents: read
       pull-requests: read
@@ -152,6 +154,10 @@ jobs:
           api_url="${GITHUB_API_URL:-https://api.github.com}"
           mkdir -p "$trusted_source_dir"
           curl -fsSL \
+            --retry 3 \
+            --retry-all-errors \
+            --retry-delay 1 \
+            --retry-max-time 30 \
             -H "Authorization: Bearer ${GH_TOKEN}" \
             -H "Accept: application/vnd.github+json" \
             -o "$trusted_archive" \
@@ -304,7 +310,9 @@ jobs:
     # gap using the identical classifier. Fails OPEN: an unreadable, empty,
     # or truncated file list reviews everything.
     if: (github.event_name != 'pull_request_target' || (github.event.action != 'closed' && github.event.action != 'converted_to_draft')) && (github.event.pull_request.draft != true || github.event.action == 'converted_to_draft' || github.event.action == 'closed')
-    runs-on: ${{ github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read
@@ -358,7 +366,9 @@ jobs:
     name: coverage-source-tree
     needs: [required-workflow-bootstrap]
     if: needs.required-workflow-bootstrap.outputs.admitted == 'true'
-    runs-on: ${{ github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     steps:
       - run: >-
           echo "PR-head source and coverage execution are delegated to the
@@ -378,7 +388,9 @@ jobs:
     # through coverage-source-tree, so an unadmitted head still skips it.
     needs: [required-workflow-bootstrap]
     if: needs.required-workflow-bootstrap.outputs.admitted == 'true'
-    runs-on: ${{ github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     steps:
       - run: >-
           echo "This required-workflow job preserves the stable branch-protection
@@ -397,7 +409,9 @@ jobs:
     # directly by this job's own `if:` below, not inherited through that edge.
     needs: [required-workflow-bootstrap, changed-scope]
     if: needs.required-workflow-bootstrap.outputs.admitted == 'true'
-    runs-on: ${{ github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     permissions:
       contents: read
       pull-requests: read
@@ -517,6 +531,7 @@ jobs:
           PR_ACTION: ${{ github.event.action }}
           PR_DRAFT: ${{ github.event.pull_request.draft }}
           CHANGED_SCOPE_CODE: ${{ needs.changed-scope.outputs.code }}
+          WORKFLOW_SHA: ${{ github.workflow_sha }}
         run: |
           set -euo pipefail
           if [ "$PR_ACTION" = "closed" ]; then
@@ -558,35 +573,40 @@ jobs:
           if [ "$PR_DRAFT" = "true" ]; then
             echo "Event draft snapshot is stale; checking the verdict for the live ready PR."
           fi
-          reviews="$(gh api --paginate "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}/reviews?per_page=100")"
-          verdict="$(printf '%s\n' "$reviews" | jq -r -s --arg sha "$HEAD_SHA" '
-            (add // [])
-            | [
-                .[]
-                | select(
-                    (.user.login // "" | ascii_downcase) as $user
-                    | $user == "opencode-agent" or $user == "opencode-agent[bot]"
-                  )
-                | select((.commit_id // "" | ascii_downcase) == ($sha | ascii_downcase))
-                | select(.state == "APPROVED" or .state == "CHANGES_REQUESTED")
-              ]
-            | (last // {}) as $review
-            | ($review.body // "" | ascii_downcase) as $body
-            | if $review.state == "CHANGES_REQUESTED" then
-                "CHANGES_REQUESTED"
-              elif $review.state == "APPROVED"
-                and ($body | contains("deterministic current-head evidence") | not)
-                and ($body | contains("deterministic fallback approval") | not)
-                and ($body | contains("model-unavailable evidence fallback") | not)
-                and ($body | contains("did not emit a usable current-head control block") | not)
-                and ($body | contains("scope: `unsupported`") | not)
-                and ($body | contains("model-pool outcome: `unknown`") | not)
-              then
-                "APPROVED"
-              else
-                empty
-              end
-          ')"
+          reviews="$(gh api --paginate --slurp "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}/reviews?per_page=100")"
+          helper="$(mktemp)"
+          trap 'rm -f "$helper"' EXIT
+          gh api "repos/ContextualWisdomLab/.github/contents/scripts/ci/opencode_review_receipt_gate.py?ref=${WORKFLOW_SHA}" \
+            --jq .content | base64 --decode >"$helper"
+          verdict="$(python3 - "$helper" "$reviews" "$HEAD_SHA" <<'PY'
+          import importlib.machinery
+          import importlib.util
+          import json
+          import sys
+
+          helper_path, reviews_json, head_sha = sys.argv[1:]
+          loader = importlib.machinery.SourceFileLoader("trusted_opencode_receipt_gate", helper_path)
+          spec = importlib.util.spec_from_loader(loader.name, loader)
+          if spec is None or spec.loader is None:
+              raise RuntimeError("trusted OpenCode receipt helper could not be loaded")
+          gate = importlib.util.module_from_spec(spec)
+          spec.loader.exec_module(gate)
+          pages = json.loads(reviews_json)
+          if not isinstance(pages, list) or not all(
+              isinstance(page, list) and all(isinstance(review, dict) for review in page)
+              for page in pages
+          ):
+              raise ValueError("formal review lookup returned malformed paginated JSON")
+          reviews = [review for page in pages for review in page
+                     if str((review.get("user") or {}).get("login") or "").lower()
+                     in {"opencode-agent", "opencode-agent[bot]"}]
+          receipt, reason = gate.evaluate_receipts(reviews, head_sha, is_draft=False)
+          if receipt is None:
+              print(f"No current-head formal OpenCode verdict: {reason}", file=sys.stderr)
+              raise SystemExit(0)
+          print(receipt["state"])
+          PY
+          )"
           if [ -z "$verdict" ]; then
             echo "::error::No APPROVED or CHANGES_REQUESTED from opencode-agent on the current head. The dispatch workflow will rerun this failed job after publishing an authenticated exact-head verdict."
             exit 1
@@ -607,7 +627,9 @@ jobs:
     # head no longer matches the live one. The target job also revalidates the
     # live PR before dispatch and verdict admission.
     if: github.event_name == 'pull_request_target' && github.event.action == 'synchronize'
-    runs-on: ${{ github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     permissions:
       actions: write
       contents: read
diff --git a/.github/workflows/organization-commercial-readiness-loop.yml b/.github/workflows/organization-commercial-readiness-loop.yml
index ad70331b4c..fa1ef018ff 100644
--- a/.github/workflows/organization-commercial-readiness-loop.yml
+++ b/.github/workflows/organization-commercial-readiness-loop.yml
@@ -16,7 +16,9 @@ jobs:
     if: >-
       github.repository == 'ContextualWisdomLab/.github' &&
       github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 25
     permissions:
       contents: read
diff --git a/.github/workflows/pr-auto-rebase.yml b/.github/workflows/pr-auto-rebase.yml
index 1f9ec482e8..4992224926 100644
--- a/.github/workflows/pr-auto-rebase.yml
+++ b/.github/workflows/pr-auto-rebase.yml
@@ -68,7 +68,9 @@ permissions:
 
 jobs:
   auto-rebase:
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     permissions:
       contents: read         # checkout only; force-push uses the app or PR-write token below
       pull-requests: write   # read PR queue and manage labels
diff --git a/.github/workflows/pr-review-autofix.yml b/.github/workflows/pr-review-autofix.yml
index a0cf3642d4..4528a3f014 100644
--- a/.github/workflows/pr-review-autofix.yml
+++ b/.github/workflows/pr-review-autofix.yml
@@ -22,7 +22,9 @@ permissions:
 
 jobs:
   autofix:
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     # No job-level timeout-minutes here, deliberately. This job's dominant
     # cost is `opencode run` (up to two invocations: the main autofix pass,
     # and a base-merge conflict-resolution pass) -- a job-level wall-clock
diff --git a/.github/workflows/pr-review-fix-scheduler.yml b/.github/workflows/pr-review-fix-scheduler.yml
index b6d3fff560..5543bbc2b9 100644
--- a/.github/workflows/pr-review-fix-scheduler.yml
+++ b/.github/workflows/pr-review-fix-scheduler.yml
@@ -92,7 +92,9 @@ jobs:
     # API reads and autofix dispatch only; no pull-request content is checked
     # out. The central main caller uses the idle control pool instead of the
     # saturated hosted queue; any other caller keeps hosted Ubuntu 24.04.
-    runs-on: ${{ github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/hourly-review-repair.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/hourly-review-repair.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/hourly-review-repair.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 35
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
diff --git a/.github/workflows/pr-review-merge-scheduler.yml b/.github/workflows/pr-review-merge-scheduler.yml
index a26fd4857e..7777f02bed 100644
--- a/.github/workflows/pr-review-merge-scheduler.yml
+++ b/.github/workflows/pr-review-merge-scheduler.yml
@@ -354,6 +354,10 @@ jobs:
           trusted_archive="${RUNNER_TEMP}/trusted-scheduler-source.tar.gz"
           api_url="${GITHUB_API_URL:-https://api.github.com}"
           curl -fsSL \
+            --retry 3 \
+            --retry-all-errors \
+            --retry-delay 1 \
+            --retry-max-time 30 \
             -H "Authorization: Bearer ${GH_TOKEN}" \
             -H "Accept: application/vnd.github+json" \
             -o "$trusted_archive" \
diff --git a/.github/workflows/python-security.yml b/.github/workflows/python-security.yml
index 1788cfd40b..6e07d817c2 100644
--- a/.github/workflows/python-security.yml
+++ b/.github/workflows/python-security.yml
@@ -46,7 +46,9 @@ jobs:
   detect-python:
     name: Detect Python
     if: github.event.action != 'closed'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     outputs:
       has_python: ${{ steps.detect.outputs.has_python }}
       has_manifest: ${{ steps.detect.outputs.has_manifest }}
@@ -77,7 +79,9 @@ jobs:
     name: Bandit (Python SAST)
     needs: detect-python
     if: github.event.action != 'closed' && needs.detect-python.outputs.has_python == 'true'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       contents: read
       security-events: write
@@ -204,7 +208,9 @@ jobs:
     name: pip-audit (Python dependency audit)
     needs: detect-python
     if: github.event.action != 'closed' && needs.detect-python.outputs.has_manifest == 'true'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/r-package-check.yml b/.github/workflows/r-package-check.yml
index 221d66a838..0d23daac2a 100644
--- a/.github/workflows/r-package-check.yml
+++ b/.github/workflows/r-package-check.yml
@@ -45,8 +45,8 @@ on:
         description: >-
           JSON array of {os, r, http-user-agent?} objects for
           strategy.matrix.config. Default is a single ubuntu-latest/release
-          leg; override with a JSON array for a multi-OS/multi-R-version
-          matrix.
+          leg. Only ubuntu-latest and ubuntu-24.04 Linux/x64 image aliases
+          execute; other OS/architecture legs are explicitly STOP, not PASS.
         required: false
         type: string
         default: '[{"os": "ubuntu-latest", "r": "release"}]'
@@ -91,14 +91,63 @@ permissions:
   contents: read
 
 jobs:
+  admit-platforms:
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, Linux, X64, cwlab-ci-isolated]
+    outputs:
+      matrix: ${{ steps.admit.outputs.matrix }}
+    steps:
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.10'
+      - id: admit
+        env:
+          R_MATRIX: ${{ inputs.r_matrix }}
+        shell: bash
+        run: |
+          matrix=$(python - "$R_MATRIX" <<'PY'
+          """Bound the R matrix to supported Linux/x64 image aliases, never runner labels."""
+          import json
+          import sys
+
+
+          def admit(raw):
+              """Reject unsupported matrix legs before any R job can be scheduled."""
+              rows = json.loads(raw)
+              if not isinstance(rows, list) or not 1 <= len(rows) <= 64:
+                  raise ValueError('Expected 1..64 matrix objects')
+              for row in rows:
+                  if not isinstance(row, dict) or not isinstance(row.get('os'), str):
+                      raise ValueError('Expected an OS string in each matrix object')
+                  if not isinstance(row.get('r'), str) or not row['r'].strip():
+                      raise ValueError('Expected a nonempty R version')
+                  if row['os'] in ('ubuntu-latest', 'ubuntu-24.04'):
+                      continue
+                  raise ValueError('STOP unsupported platform leg: ' + repr(row['os']))
+              return rows
+
+
+          if __name__ == '__main__':
+              try:
+                  print(json.dumps(admit(sys.argv[1]), separators=(',', ':')))
+              except (ValueError, TypeError, IndexError) as error:
+                  print(str(error), file=sys.stderr)
+                  sys.exit(1)
+          PY
+          )
+          printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
   R-CMD-check:
-    runs-on: ${{ matrix.config.os }}
+    needs: admit-platforms
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, Linux, X64, cwlab-ci-isolated]
     name: ${{ matrix.config.os }} (${{ matrix.config.r }})
 
     strategy:
       fail-fast: false
       matrix:
-        config: ${{ fromJSON(inputs.r_matrix) }}
+        config: ${{ fromJSON(needs.admit-platforms.outputs.matrix) }}
 
     env:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release-dependency-license-strix-gate.yml b/.github/workflows/release-dependency-license-strix-gate.yml
index 68d48d15ef..8fbec4df37 100644
--- a/.github/workflows/release-dependency-license-strix-gate.yml
+++ b/.github/workflows/release-dependency-license-strix-gate.yml
@@ -162,7 +162,9 @@ env:
 jobs:
   prepare:
     name: Verify exact distributions and approve the licence closure
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 180
     permissions:
       contents: read
@@ -455,7 +457,9 @@ jobs:
   strix:
     name: Strix ${{ matrix.key }}
     needs: prepare
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 360
     permissions:
       contents: read
@@ -709,7 +713,9 @@ jobs:
     name: Strix overflow ${{ matrix.key }}
     needs: prepare
     if: ${{ needs.prepare.outputs.has_overflow == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 360
     permissions:
       contents: read
@@ -726,7 +732,9 @@ jobs:
           ((needs.prepare.outputs.has_overflow == 'true' && needs.strix_overflow.result == 'success') ||
            (needs.prepare.outputs.has_overflow == 'false' && needs.strix_overflow.result == 'skipped')) }}
     name: Collect every Strix binding and seal the complete verdict
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 180
     permissions:
       contents: read
diff --git a/.github/workflows/repository-metadata-reconcile.yml b/.github/workflows/repository-metadata-reconcile.yml
index 16316a9298..fd14ba112f 100644
--- a/.github/workflows/repository-metadata-reconcile.yml
+++ b/.github/workflows/repository-metadata-reconcile.yml
@@ -18,6 +18,10 @@ on:
       - "tests/test_repository_label_convergence.py"
       - "tests/test_repository_label_identity.py"
       - "tests/test_repository_label_live_verification.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-noema-document-ci.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
       - ".github/workflows/repository-metadata-reconcile.yml"
   schedule:
     - cron: "23 * * * *"
@@ -31,7 +35,9 @@ concurrency:
 
 jobs:
   validate:
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 20
     steps:
       - name: Harden runner
@@ -42,6 +48,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
           persist-credentials: false
       - name: Verify exact revision
         shell: bash
@@ -103,7 +110,9 @@ jobs:
   apply:
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     needs: validate
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 45
     environment: repository-metadata-maintenance
     steps:
diff --git a/.github/workflows/sast-semgrep.yml b/.github/workflows/sast-semgrep.yml
index f8ab04b865..2f128c1aea 100644
--- a/.github/workflows/sast-semgrep.yml
+++ b/.github/workflows/sast-semgrep.yml
@@ -50,7 +50,9 @@ jobs:
     # Fails OPEN: an unreadable, empty, or truncated file list scans everything.
     # The gate lives inside this job as a step-level guard (one runner, not two).
     if: github.event.action != 'closed'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       contents: read
       pull-requests: read
diff --git a/.github/workflows/sbom-generation.yml b/.github/workflows/sbom-generation.yml
index 588baefe1e..7d630dd78a 100644
--- a/.github/workflows/sbom-generation.yml
+++ b/.github/workflows/sbom-generation.yml
@@ -43,7 +43,9 @@ permissions:
 
 jobs:
   generate-sbom:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       # write is needed for release-asset upload and dependency submission.
       contents: write
diff --git a/.github/workflows/sbom-inventory-scheduler.yml b/.github/workflows/sbom-inventory-scheduler.yml
index 5d3210728d..e60d66b7d0 100644
--- a/.github/workflows/sbom-inventory-scheduler.yml
+++ b/.github/workflows/sbom-inventory-scheduler.yml
@@ -30,7 +30,9 @@ permissions:
 
 jobs:
   aggregate-sbom-inventory:
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     permissions:
       contents: write
       id-token: write
diff --git a/.github/workflows/scheduled-security-scan.yml b/.github/workflows/scheduled-security-scan.yml
index 6b6a90aa36..0c2f118d1c 100644
--- a/.github/workflows/scheduled-security-scan.yml
+++ b/.github/workflows/scheduled-security-scan.yml
@@ -38,7 +38,9 @@ permissions:
 jobs:
   detect-languages:
     name: Detect CodeQL languages
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     outputs:
       matrix: ${{ steps.detect.outputs.matrix }}
     steps:
@@ -72,7 +74,9 @@ jobs:
   codeql:
     name: CodeQL periodic (${{ matrix.language }})
     needs: detect-languages
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       actions: read
       contents: read
@@ -102,7 +106,9 @@ jobs:
 
   trivy-fs:
     name: Trivy filesystem (periodic)
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/scorecard-analysis.yml b/.github/workflows/scorecard-analysis.yml
index 6222b28b28..2064ab9b54 100644
--- a/.github/workflows/scorecard-analysis.yml
+++ b/.github/workflows/scorecard-analysis.yml
@@ -29,7 +29,9 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: ["self-hosted", "linux", "x64", "cwlab-ci-isolated"]
     permissions:
       security-events: write
       id-token: write
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 948ae583d4..3698e30056 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -35,7 +35,9 @@ permissions:
 jobs:
   gitleaks:
     name: gitleaks (secret scan)
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index e04d7bf8f3..46cddd322e 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -71,7 +71,9 @@ jobs:
     # docs/doctoring/required-workflow-path-filter-boundary.md.
     # Fails OPEN: an unreadable, empty, or truncated file list scans everything.
     if: github.event.action != 'closed'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 5
     permissions:
       contents: read
@@ -126,7 +128,9 @@ jobs:
   osv-scan:
     needs: changed-scope
     if: github.event.action != 'closed' && needs.changed-scope.outputs.deps == 'true'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 25
     permissions:
       actions: read
@@ -339,6 +343,10 @@ jobs:
           echo "::warning::OSV SARIF upload to code scanning failed after the base/head comparison. The PR-introduced vulnerability reporter above remains the hard gate, so upload rate limits cannot hide OSV findings."
       - name: Upload OSV debug artifacts
         if: always()
+        # The reporter and SARIF upload above preserve the security verdict.
+        # Debug retention quota is observability only and must not turn a clean
+        # comparison into a failed security gate.
+        continue-on-error: true
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.0
         with:
           name: osv-scan-debug
@@ -352,7 +360,9 @@ jobs:
   dependency-review:
     needs: changed-scope
     if: github.event.action != 'closed' && needs.changed-scope.outputs.deps == 'true'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       contents: read
       pull-requests: read
@@ -387,6 +397,23 @@ jobs:
           set -euo pipefail
 
           api_url="${GITHUB_API_URL:-https://api.github.com}"
+          git_object_id='^[0-9a-f]{40}([0-9a-f]{24})?$'
+          repository_identity='^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'
+          if ! [[ "${BASE_SHA}" =~ $git_object_id ]] || ! [[ "${HEAD_SHA}" =~ $git_object_id ]]; then
+            echo "::error::Dependency review evidence unavailable: exact 40- or 64-character hexadecimal base and head revisions are required before any compare request. Named refs are not evidence. Verify the pull-request event SHAs, then rerun. Failing closed."
+            exit 1
+          fi
+          if ! [[ "${REPOSITORY}" =~ $repository_identity ]]; then
+            echo "::error::Dependency review evidence unavailable: owner/name repository identity is required before any compare request. Verify the pull-request repository, then rerun. Failing closed."
+            exit 1
+          fi
+          repository_owner="${REPOSITORY%%/*}"
+          repository_name="${REPOSITORY#*/}"
+          if [ "${repository_owner}" = "." ] || [ "${repository_owner}" = ".." ] || [ "${repository_name}" = "." ] || [ "${repository_name}" = ".." ]; then
+            echo "::error::Dependency review evidence unavailable: owner/name repository identity is required before any compare request. Dot or parent-directory path components are not evidence. Verify the pull-request repository, then rerun. Failing closed."
+            exit 1
+          fi
+
           set +e
           status="$(
             curl -sS --connect-timeout 10 --max-time 30 \
@@ -436,7 +463,9 @@ jobs:
   gitleaks:
     name: gitleaks (secret scan)
     if: github.event.action != 'closed' && github.repository == 'ContextualWisdomLab/.github'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       contents: read
       security-events: write
@@ -526,7 +555,9 @@ jobs:
   trivy-fs:
     needs: changed-scope
     if: github.event.action != 'closed' && needs.changed-scope.outputs.code == 'true'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     permissions:
       contents: read
       security-events: write
@@ -553,6 +584,10 @@ jobs:
       - name: Trivy filesystem scan
         uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
+          # Runner groups can schedule onto different hosts. Reinstall the
+          # pinned binary instead of trusting a cache entry whose path or
+          # executable bit belongs to a previous runner.
+          cache: false
           scan-type: fs
           scan-ref: .
           scanners: vuln,secret,misconfig
@@ -633,7 +668,9 @@ jobs:
   scorecard:
     needs: changed-scope
     if: github.event.action != 'closed' && needs.changed-scope.outputs.code == 'true'
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     # SOFT: posture findings are unrelated to the PR diff, so never block merge.
     continue-on-error: true
     permissions:
diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml
index abdc8af49e..2b65a5cc64 100644
--- a/.github/workflows/strix.yml
+++ b/.github/workflows/strix.yml
@@ -130,7 +130,9 @@ jobs:
     # docs/doctoring/required-workflow-path-filter-boundary.md.
     # Fails OPEN: an unreadable, empty, or truncated file list scans everything.
     if: (github.event_name != 'pull_request_target' || (github.event.action != 'closed' && github.event.action != 'converted_to_draft')) && (github.event.pull_request.draft != true || github.event.action == 'converted_to_draft' || github.event.action == 'closed')
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read
@@ -190,7 +192,9 @@ jobs:
         github.event_name != 'pull_request_target' ||
         (github.event.action != 'closed' && github.event.action != 'converted_to_draft')
       ) && (github.event.pull_request.draft != true || github.event.action == 'converted_to_draft' || github.event.action == 'closed')
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       contents: read
@@ -340,7 +344,9 @@ jobs:
         github.event.pull_request.base.repo.full_name || github.repository }}-${{
         github.event.pull_request.number || github.run_id }}
       cancel-in-progress: true
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     # Bound this gh-api-only cleanup job so a stuck call (rate limit, hung
     # `gh api --paginate`) cannot silently occupy a runner for GitHub's
     # 360-minute platform default -- exactly the window when a busy PR is
@@ -462,7 +468,9 @@ jobs:
     # scans may take more than two hours per model (docs/product-goal-directive.md).
     # Inference has no wall-clock deadline; cancellation is reserved for an
     # explicit operator action or a superseded head.
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     # Least-privilege token scoped to this job (Scorecard alert #43): the scan
     # exchanges an OIDC token (id-token) and publishes same-repo status evidence
     # from the scan job only.
@@ -839,18 +847,22 @@ jobs:
       - name: Gate Strix secrets
         id: gate
         env:
-          STRIX_MODEL: contextual-orchestrator/orchestrator/free
+          STRIX_MODEL: auto
           STRIX_MODEL_REQUESTED: ${{ github.event.client_payload.strix_llm || '' }}
         run: |
           requested_model="$(printf '%s' "$STRIX_MODEL_REQUESTED" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
           case "$requested_model" in
-            ""|orchestrator/free|contextual-orchestrator/orchestrator/free) ;;
+            ""|auto|orchestrator/auto|contextual-orchestrator/orchestrator/auto) ;;
             *)
-              echo '::error::Strix model overrides are limited to contextual-orchestrator/orchestrator/free.'
+              echo '::error::Strix model overrides must select literal auto; free and direct-provider routes are not admitted.'
               exit 1
               ;;
           esac
           strix_model="$(printf '%s' "$STRIX_MODEL" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+          if [ "$strix_model" != "auto" ]; then
+            echo '::error::Strix primary model must remain literal auto.'
+            exit 1
+          fi
           {
             echo "strix_model=$strix_model"
             echo 'enabled=true'
@@ -876,7 +888,7 @@ jobs:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR: ${{ steps.target_visibility.outputs.is_private }}
-          CONTEXTUAL_ORCHESTRATOR_POOL: free
+          CONTEXTUAL_ORCHESTRATOR_POOL: auto
         run: |
           set -euo pipefail
           report_parent="$GITHUB_WORKSPACE/strix_runs"
@@ -1033,11 +1045,11 @@ jobs:
           strix_llm_file="$RUNNER_TEMP/strix_llm.txt"
           strix_model="$(printf '%s' "$STRIX_MODEL" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
           case "$strix_model" in
-            orchestrator/free | contextual-orchestrator/orchestrator/free)
-              printf '%s' 'orchestrator/free' > "$strix_llm_file"
+            auto)
+              printf '%s' 'auto' > "$strix_llm_file"
               ;;
             *)
-              echo '::error::STRIX_LLM must select contextual-orchestrator/orchestrator/free.'
+              echo '::error::STRIX_LLM must remain literal auto; free fallback is not admitted.'
               exit 1
               ;;
           esac
@@ -1297,7 +1309,9 @@ jobs:
     name: publish-manual-pr-evidence-status
     needs: strix
     if: ${{ always() && !cancelled() && github.event_name == 'repository_dispatch' && github.event.client_payload.pr_head_sha != '' }}
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     # Single-shot OIDC exchange plus a handful of curl/gh api calls, no loop
     # or pagination -- same shape as the agent-mention-*-dispatch.yml
     # validate-and-forward jobs, which bound at timeout-minutes: 5. Without
@@ -1520,7 +1534,9 @@ jobs:
       && needs.strix.result == 'failure'
       && needs.strix.outputs.transport_capacity_unavailable == 'true'
       && needs.strix.outputs.transport_retry_eligible == 'true'
-    runs-on: ${{ (github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ ((github.repository == 'ContextualWisdomLab/.github' || github.repository == 'ContextualWisdomLab/fast-mlsirm') && github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main' && fromJSON('{"group":"CWL central control","labels":["self-hosted","linux","x64","cwlab-control"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 10
     permissions:
       contents: write
diff --git a/.github/workflows/trusted-uv-materializer-quality-ci.yml b/.github/workflows/trusted-uv-materializer-quality-ci.yml
index db70ec324c..8a5e9db20c 100644
--- a/.github/workflows/trusted-uv-materializer-quality-ci.yml
+++ b/.github/workflows/trusted-uv-materializer-quality-ci.yml
@@ -2,28 +2,43 @@ name: Trusted uv Materializer Quality CI
 
 on:
   pull_request:
-    branches: [main]
     paths:
       - ".github/workflows/trusted-uv-materializer-quality-ci.yml"
+      - ".github/workflows/company-default-head-trust-gate.yml"
+      - ".github/workflows/company-settlement-validate.yml"
+      - "tests/test_company_default_head_trust_gate.py"
       - "scripts/ci/materialize_base_python_requirements.py"
+      - "scripts/ci/verify_release_maturin_tool_assets.py"
       - "tests/conftest.py"
       - "tests/test_materialize*.py"
       - "tests/test_trusted_uv*.py"
       - "tests/test_uv*.py"
       - "tests/test_repository_branch_coverage_*.py"
+      - "tests/test_verify_release_maturin_tool_assets.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
       - "pyproject.toml"
   push:
     branches: [main]
     paths:
       - ".github/workflows/trusted-uv-materializer-quality-ci.yml"
+      - ".github/workflows/company-default-head-trust-gate.yml"
+      - ".github/workflows/company-settlement-validate.yml"
+      - "tests/test_company_default_head_trust_gate.py"
       - "scripts/ci/materialize_base_python_requirements.py"
+      - "scripts/ci/verify_release_maturin_tool_assets.py"
       - "tests/conftest.py"
       - "tests/test_materialize*.py"
       - "tests/test_trusted_uv*.py"
       - "tests/test_uv*.py"
       - "tests/test_repository_branch_coverage_*.py"
+      - "tests/test_verify_release_maturin_tool_assets.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
       - "pyproject.toml"
 
 concurrency:
@@ -39,7 +54,9 @@ env:
 jobs:
   minimum-python-contract:
     name: Python 3.10 compatibility contract
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 10
     steps:
       - name: Harden runner
@@ -85,7 +102,9 @@ jobs:
 
   full-quality-gate:
     name: Python 3.14 full quality gate
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 20
     steps:
       - name: Harden runner
@@ -98,6 +117,7 @@ jobs:
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
 
       - name: Set up current stable Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
diff --git a/CHANGELOG.d/20260930-github-api-http-error-close.md b/CHANGELOG.d/20260930-github-api-http-error-close.md
new file mode 100644
index 0000000000..df2feb4a78
--- /dev/null
+++ b/CHANGELOG.d/20260930-github-api-http-error-close.md
@@ -0,0 +1,7 @@
+## Fixed
+
+- Close file-like `HTTPError` responses in the central CodeQL, Strix, Noema,
+  Pingora, review-preflight, Pages, and sandbox-readiness clients after bounded
+  status/telemetry extraction, preventing Python 3.14 resource leaks without
+  permitting redirects, suppressing warnings, or weakening bearer-token
+  authority checks; cap CodeQL diagnostic error-body reads at 400 bytes.
diff --git a/CHANGELOG.d/20260930-semgrep-maturin-asset-urlopen.md b/CHANGELOG.d/20260930-semgrep-maturin-asset-urlopen.md
index 5b64363842..9a950691b9 100644
--- a/CHANGELOG.d/20260930-semgrep-maturin-asset-urlopen.md
+++ b/CHANGELOG.d/20260930-semgrep-maturin-asset-urlopen.md
@@ -2,6 +2,8 @@
 
 - `scripts/ci/verify_release_maturin_tool_assets.py` fetches from a fixed
   `https://github.com/PyO3/maturin/releases/download/v1.15.0/` origin, and `verify_assets` admits only
-  five literal asset names, but `p/default`'s `dynamic-urllib-use-detected` flagged the call on
-  main and failed Semgrep on every PR. The call now carries the repository's standard reasoned
-  `nosemgrep`/`nosec B310` suppression.
+  five literal asset names. The downloader now uses a standard-library opener
+  that admits one credential-free HTTPS redirect only from the exact GitHub
+  release path to `release-assets.githubusercontent.com`, bounds the response,
+  and closes it on every path. It uses neither `urlopen` nor
+  `HTTPSConnection`, and carries no `nosemgrep` or `nosec` suppression.
diff --git a/CHANGELOG.d/20261001-gap-baseline-source-restoration.md b/CHANGELOG.d/20261001-gap-baseline-source-restoration.md
new file mode 100644
index 0000000000..a2d7d53a8f
--- /dev/null
+++ b/CHANGELOG.d/20261001-gap-baseline-source-restoration.md
@@ -0,0 +1,5 @@
+## Fixed
+
+- Restore the complete product and technical gap baseline after a connector
+  display truncation replaced the source artifact, and add a regression guard
+  that rejects future truncation banners.
diff --git a/CHANGELOG.d/20261001-noema-document-reader-dependencies.md b/CHANGELOG.d/20261001-noema-document-reader-dependencies.md
new file mode 100644
index 0000000000..486643700c
--- /dev/null
+++ b/CHANGELOG.d/20261001-noema-document-reader-dependencies.md
@@ -0,0 +1,5 @@
+### Noema document reader closes new transitive advisories
+
+- The generated npm lock now selects `fast-uri` 3.1.8 and `ip-address` 10.7.1,
+  removing the three medium-severity findings published against the previous
+  transitive versions while leaving the direct runtime manifest unchanged.
diff --git a/CHANGELOG.d/20261001-noema-document-reader-transitive-cves.md b/CHANGELOG.d/20261001-noema-document-reader-transitive-cves.md
new file mode 100644
index 0000000000..4a19c4bb5e
--- /dev/null
+++ b/CHANGELOG.d/20261001-noema-document-reader-transitive-cves.md
@@ -0,0 +1,8 @@
+### Noema document reader transitive security updates
+
+- Updated the locked `fast-uri` dependency from 3.1.7 to 3.1.8 and
+  `ip-address` from 10.7.0 to 10.7.1. These are the first releases outside
+  the affected ranges for GHSA-hrr3-gc8f-f4qj, GHSA-j6r3-76f7-8jcv, and
+  GHSA-h3mg-xc3c-68pw. The direct dependency ranges are unchanged.
+- Added a deterministic regression contract that rejects reintroduction of
+  vulnerable hoisted or nested copies of either transitive package.
diff --git a/CHANGELOG.d/20261001-strix-litellm-credential-exfiltration.md b/CHANGELOG.d/20261001-strix-litellm-credential-exfiltration.md
new file mode 100644
index 0000000000..e4d748764c
--- /dev/null
+++ b/CHANGELOG.d/20261001-strix-litellm-credential-exfiltration.md
@@ -0,0 +1,6 @@
+### Shared Strix LiteLLM security floor
+
+- Pinned LiteLLM 1.94.3 in the Strix source input and regenerated the complete
+  hash lock after exact-head `pip-audit` found CVE-2026-84377 in 1.94.1.
+- Added a source/lock parity regression contract and preserved the stacked Noema
+  document-reader transitive security repair without copying its implementation.
diff --git a/CHANGELOG.d/20261001-trusted-review-archive-retry.md b/CHANGELOG.d/20261001-trusted-review-archive-retry.md
new file mode 100644
index 0000000000..783b243562
--- /dev/null
+++ b/CHANGELOG.d/20261001-trusted-review-archive-retry.md
@@ -0,0 +1,6 @@
+### Central review source survives transient GitHub archive failures
+
+- Required Noema, Required OpenCode, and the PR review merge scheduler now use
+  bounded native `curl` retries when materializing the immutable trusted
+  `.github` source archive. Authentication, exact-SHA binding, extraction, and
+  fail-closed behavior are unchanged.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d90fa0c899..ff4e5a0699 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,148 @@
+### Law CI cleanup rejects symlinked PostgreSQL descendants
+
+- The central law-agent cleanup now refuses symbolic links at every component
+  from the owned scratch root through the PostgreSQL cluster and
+  `postmaster.pid`. Cancellation and normal-exit cleanup therefore retain
+  evidence instead of invoking `pg_ctl` through an untrusted descendant path.
+  Contracts cover all five descendant boundaries in normal and Actions-mode
+  execution. Hosted exact-head Checks and independent review remain required.
+### Security scanner setup no longer inherits runner-local failures
+
+- Disable `trivy-action`'s binary cache on the heterogeneous `CWL CI isolated`
+  runner group. Exact run `37242578328`, job `112314054734`, restored a
+  `trivy-binary-v0.70.0-Linux-X64` cache entry but then failed before scanning
+  with `trivy: command not found`; installing the pinned binary per job removes
+  that runner-local path and executable-bit dependency.
+- Treat the always-run OSV debug artifact upload as observability rather than a
+  security verdict. Exact job `112314054619` completed the base/head comparison,
+  reported no PR-introduced finding, and uploaded SARIF before GitHub artifact
+  quota exhaustion failed the debug upload. The scanner and SARIF gates remain
+  unchanged and fail closed; only that optional retention step is non-blocking.
+- RED `cc42969ba8ed4abeb1819412c146af2a9dadae8f` adds both workflow contracts;
+  GREEN `26f993c0bbe88d50bf81473e31d179ad7b317657` passes 5,488 tests, 10 skips,
+  and 40 subtests. PR #2565 remains Draft/HOLD for fresh hosted evidence,
+  isolated-capacity canary, and qualifying independent approval.
+
+### Isolated CI routing gains a runner-group authority boundary
+
+- Reject the complete reusable R matrix when any requested leg is not one of
+  the admitted Linux/x64 image aliases. A required macOS, Windows, ARM, or
+  unknown leg can no longer disappear while the remaining Ubuntu leg reports
+  success; callers must request only executable legs or receive a failed
+  admission job.
+- Serialize the caller-controlled R matrix OS label with GitHub `toJSON()`
+  before inserting it into the group-scoped runner selector. Quotes,
+  backslashes, newlines, and duplicate `group`/`labels` text remain one
+  data label and cannot replace the fixed `CWL CI isolated` authority
+  boundary. The executable workflow contract covers benign and hostile values.
+  The integrated Maturin verifier now also documents its archive extraction and
+  command entry point, restoring the repository's 100% public-doc gate.
+- Scope every ordinary and non-main self-hosted fallback through the dedicated
+  `CWL CI isolated` runner group as well as the existing platform/isolation
+  labels. A durable regression rejects label-only isolated selectors, while
+  workflow-specific contracts preserve dynamic matrix and trusted-main routing.
+  The reusable R matrix selector now escapes its literal JSON braces for
+  GitHub's `format()` expression, so Linux, Windows, macOS and unsupported OS
+  labels render a valid group-scoped `runs-on` object instead of failing before
+  runner admission.
+  The change remains Draft/HOLD until operators provision the group, restrict
+  its repository access, demonstrate disposable cleanup, and return exact-head
+  canary and required-Check evidence.
+
+### Maturin download failures close every transport response
+
+- Refactor the bounded Maturin asset downloader so successful and rejected
+  responses share one unconditional close path while `HTTPError` keeps its own
+  explicit close path. A new regression exercises a non-200 response and an
+  opener-raised HTTP error. This removes an impossible optional-response branch
+  without changing hosts, redirects, byte limits, hashes, or fail-closed error
+  mapping; the focused suite is 17 passed with 100% statement and branch
+  coverage. The trusted full-suite workflow now also tracks the verifier source
+  and its focused test, so a future lifecycle change cannot omit the repository
+  coverage gate that detected this regression. The pull-request trigger admits
+  stacked canonical-owner bases as well as `main`; the protected-branch push
+  trigger remains restricted to `main`.
+
+### Shared Strix lock advances beyond the PyJWT recursion DoS
+
+- Advance the explicit Strix source pin and generated hash lock from PyJWT
+  `2.14.0` to `2.15.0`, closing GHSA-42vr-xj54-vc7v / CVE-2026-101918. Exact Security
+  Scan run `36741151937` found the advisory in dependent PR #2540; the
+  canonical owner repair stays in #2531. A source/lock contract, deterministic
+  lock regeneration, and pip-audit evidence keep the dependent branch free of a
+  leaf workaround and prevent a return to `2.14.0`. Exact-head hosted security
+  Checks, independent approval, ordinary protected integration, and immutable
+  consumer-pin advancement remain required before release admission.
+
+### Shared urllib3 locks close proxy and streaming CVEs
+
+- Pin urllib3 2.8.0 as an explicit source input in both the pip-audit and
+  Strix security-tooling closures, regenerate their hash locks without unrelated
+  version movement, and add a four-file parity contract. This closes
+  CVE-2026-97687 and CVE-2026-97689 found by exact-head Python Security while
+  preserving hash checking and the existing Strix cryptography override.
+
+### Full-suite parser locks and honest branch coverage converge
+
+- Consolidated the complete valid ancestry of `.github#2521` into `.github#2530`
+  with ordinary two-parent merges so the parser-lock and repository-coverage
+  gates no longer wait on one another. Behavior-level tests exercise the final
+  branches in the OpenCode queue, Strix dependency classifier, release runtime
+  prescreener, and release dependency gate without exclusions, pragmas,
+  threshold reductions, or sample shrinking. Direct consumers of the common
+  generated lock now also track both source requirements and the canonical
+  compiler. `.github#2532`'s warning-fatal HTTP response-lifecycle repair is
+  carried in the same successor so the complete suite can regenerate one
+  exact-head receipt. Protected hosted Checks and qualifying independent review
+  remain mandatory before ordinary merge; predecessors remain open until
+  merged-tree equivalence is proven. The combined Python 3.14 warnings-fatal
+  suite passes 5,291 tests with 5 optional skips and 40 subtests; all 18,729
+  production statements and 7,642 branches are covered, and production
+  Docstring coverage is 100%. The durable review-repair owner also triggers,
+  executes, compiles, and measures both launcher runtime suites at 100%.
+  Exact Git blobs, Cargo development locks, runtime receipts, final fanout caps,
+  and the Python 3.10 TOML fallback are covered as explicit trust boundaries;
+  one unreachable postcondition was removed only after prior fail-closed
+  validation made that state mechanically impossible.
+
+### Full-suite quality environments install their collection parsers
+
+- The common OpenCode quality input now owns the existing hash-pinned
+  `defusedxml` document parser and `PyYAML` workflow parser used during complete
+  repository test collection. Its Python 3.14/Linux lock was regenerated by
+  the repository compiler without manual hash edits. Local verification
+  reproduced the lock byte-for-byte, installed the common and Noema locks
+  together, imported both parsers, and passed 73 focused contracts with two
+  optional skips. Hosted exact-head Checks and qualifying independent review
+  remain required before protected merge.
+
+### Shared security fixtures use patched PyJWT and PyO3 releases
+
+- The Strix hash lock now takes PyJWT `2.14.0` as an explicit source input,
+  closing CVE-2026-102274 without hiding the dependency in the cryptography-only
+  override file. The offline Rust coverage fixture advances from PyO3 `0.22.6`
+  to `0.29.2`, beyond the `0.29.0` fixes for GHSA-36hh-v3qg-5jq4 and
+  GHSA-chgr-c6px-7xpp. Source/lock parity tests prevent either generated lock
+  from silently returning to the vulnerable versions. Protected integration,
+  immutable consumer-pin advancement, and fresh exact-head hosted security
+  Checks remain required before release admission.
+### Dependency Review requires a completed authenticated comparison
+
+- The reusable Dependency Review preflight now requires both curl exit zero
+  and HTTP 200 before publishing `available=true`. A regression reproduces a
+  partial transfer that prints `200` but exits 18, preserving the fail-closed
+  gate. The bundled Security Scan already enforced both signals and remains
+  unchanged. `.github#2565` now preserves the complete `.github#1725` owner
+  delta through published ordinary two-parent merge
+  `650bc6e35409d52d24fec890c2ab74063794e9b8` (tree
+  `9522f0b9c96247b3412e147bc6f89fd2595c0776`) while retaining its isolated
+  runner-group selectors. The merged-tree focused contract is 53/53 and the
+  warning-fatal full suite is 5,437 passed, 10 skipped, 40 subtests. Both PRs remain
+  Proposed until exact-head hosted Checks and qualifying independent review are
+  complete. The carried security decision is ADR-0034, the concurrent owned
+  CodeQL decision is ADR-0033, and a repository-wide executable contract now
+  rejects duplicate numeric ADR identities.
+
 ### Intel macOS native archives are bound to x86_64 bytes
 
 - The release prescreener now requires every native member in an Intel macOS
diff --git a/docs/adr/0034-dependency-review-fail-closed-permission-envelope.md b/docs/adr/0034-dependency-review-fail-closed-permission-envelope.md
new file mode 100644
index 0000000000..75ec5f9cd2
--- /dev/null
+++ b/docs/adr/0034-dependency-review-fail-closed-permission-envelope.md
@@ -0,0 +1,72 @@
+# ADR-0034: Fail closed on ambiguous Dependency Review authority and preserve caller permissions
+
+- **Status:** Proposed
+- **Date:** 2026-09-02
+- **Scope:** `.github/workflows/dependency-review.yml`, its thin product callers, and the reusable-workflow security contract
+- **Supersedes:** ADR-0024 only where ADR-0024 treated HTTP 403/404 as confirmed Dependency Graph unavailability or showed callers without an explicit permission envelope
+
+## Problem
+
+The protected-main consolidation from #1724 exposed two independent security-contract defects.
+
+First, the reusable workflow classified Dependency Graph compare HTTP 403/404 as `available=false` and therefore skipped the blocking Dependency Review action. Those responses are not authoritative proof that the feature is unavailable: they can also be authorization or policy failures. Turning an ambiguous authorization-shaped response into success silently removes a security gate.
+
+Second, the migration examples and thin callers omitted the permission envelope that the original repository-local workflows carried. GitHub reusable workflows cannot elevate `GITHUB_TOKEN` permissions through the call chain. A called workflow may maintain or reduce permissions granted by the caller, but it cannot manufacture `pull-requests: read` when the caller did not grant it. The result is a workflow-level `startup_failure` before any job is created.
+
+## Constraints
+
+1. Dependency Review remains a distinct hard gate; OSV-Scanner, Scorecard, or another scanner cannot substitute for an ambiguous Dependency Review failure.
+2. The called workflow needs only `contents: read` and `pull-requests: read`; no write permission is introduced.
+3. Product callers remain thin and repository-owned. They keep repository-specific trigger, severity, allowlist, and `continue_on_error` policy.
+4. Consumers pin the reusable workflow to an immutable protected-main commit after this proposal is merged. `@main`, branch URLs, and unmerged PR heads are not production authority.
+5. Non-`pull_request` invocations may skip because they lack an exact PR base/head pair; pull requests fail closed unless the comparison endpoint returns HTTP 200.
+
+## Considered alternatives
+
+### Treat 403/404 as feature unavailable
+
+Rejected. The status code alone cannot distinguish a genuinely unavailable Dependency Graph from denied authorization/policy. A false negative here converts a required security control into a warning.
+
+### Infer support from repository visibility or GHAS assumptions
+
+Rejected. Visibility is not a capability proof and was already the weaker design ADR-0024 replaced.
+
+### Rely on the called workflow's `permissions:` block
+
+Rejected as insufficient. GitHub does not let a reusable workflow elevate permissions beyond the caller's grant. The called workflow still declares its least-privilege ceiling, but each thin caller must explicitly grant the same read scopes.
+
+### Grant broader token permissions globally
+
+Rejected. It increases blast radius and hides a caller-contract defect instead of repairing it.
+
+## Decision
+
+1. For `pull_request`, the Dependency Graph compare preflight sets `available=true` only when curl exits zero and the endpoint returns HTTP 200. Every transport failure or other HTTP status is emitted with an error and terminates the job nonzero.
+2. Remove the pull-request "Dependency graph unavailable" success path. No alternate scanner is described as replacement authority.
+3. Keep the called workflow at `contents: read` + `pull-requests: read` and require every thin caller to declare at least those same scopes explicitly.
+4. Make the executable central contract fail when the canonical caller example omits either required scope.
+5. Replace the mutable `@main` caller example with an immutable `<protected-main-commit-sha>` placeholder. After merge, consumers pin the resulting protected-main SHA.
+
+## Exact evidence
+
+- #1725 first RED: `cb07b8bb28ef9d3a147cc966a0c70654d132da1d`; first production repair: `31f60e532e135008cabd09fcddd46a53062b0ea0`.
+- Permission-envelope RED: `ee0f1ce544965772775b590050e40476df4ea8f6`; it changes only the contract and requires the missing caller permission example.
+- Permission-envelope production repair: `ca3bdbd210de988ccd31f7fb96d3a97adfdb9bff`.
+- `newsdom-api#784@1623977e6c37c78cb1a94a7a48c48f6d02cac86c`: run `33622976911`, `startup_failure`, zero jobs, reusable workflow immutably resolved to `.github@0bcd22d8bb07650aafb0a8f116e4c2bbb8744f03`.
+- `mightyETL#330@65efdf7b4064df5b9811c0403defb707e6efbc02`: run `33623035969`, `startup_failure`, zero jobs.
+- Consumer permission repairs then produced materialized current-head runs: newsdom-api `9a798d5ac7b9b295a1accb2327fc76611352290f` run `33623818000`; mightyETL `4576f863ede9fca0673d6cce5ae8a4093246f5ab` run `33623854807`; scopeweave `db8b8ed6d36a6dc6cc1d07255a7a9a86bc88bf4f` run `33623761776`; Argos #557 `ee4c5dd326977407435b0f2425fdecebc34a810f` run `33623867278`.
+
+Hosted exact-current-head Checks and independent review remain required before this ADR may become Accepted.
+
+## Consequences and follow-up
+
+- A missing or denied Dependency Graph comparison is visible as a blocking failure instead of silent coverage loss.
+- Caller permission omissions become an executable contract defect rather than an undocumented deployment prerequisite.
+- The central workflow still cannot repair a consumer's omitted permissions by itself; each consumer must carry the explicit read-only envelope and later bump its immutable reusable-workflow pin to the protected-main SHA that contains this decision.
+- #1643's canary run remains independent diagnostic evidence for the required Security Scan path; its run/check result is not transferred to this gate. #1725 nevertheless integrates the durable immutable-identity validation source delta into the canonical reusable Dependency Review owner and verifies that integrated behavior with its own tests and exact-head Checks.
+
+## References
+
+GitHub. (n.d.). *Reusing workflow configurations*. GitHub Docs. https://docs.github.com/actions/using-workflows/reusing-workflows
+
+GitHub. (n.d.). *Use GITHUB_TOKEN for authentication in workflows*. GitHub Docs. https://docs.github.com/actions/security-guides/automatic-token-authentication
diff --git a/docs/adr/adr-0032-owned-codeql-status-and-settlement-authority.md b/docs/adr/adr-0033-owned-codeql-status-and-settlement-authority.md
similarity index 96%
rename from docs/adr/adr-0032-owned-codeql-status-and-settlement-authority.md
rename to docs/adr/adr-0033-owned-codeql-status-and-settlement-authority.md
index 50c6392edc..70e554756e 100644
--- a/docs/adr/adr-0032-owned-codeql-status-and-settlement-authority.md
+++ b/docs/adr/adr-0033-owned-codeql-status-and-settlement-authority.md
@@ -1,5 +1,5 @@
 ---
-title: "ADR-0032: Owned CodeQL status and settlement authority"
+title: "ADR-0033: Owned CodeQL status and settlement authority"
 status: Proposed
 date: "2026-09-27"
 authors: "Codex"
@@ -8,7 +8,7 @@ supersedes: ""
 superseded_by: ""
 ---
 
-# ADR-0032: Owned CodeQL status and settlement authority
+# ADR-0033: Owned CodeQL status and settlement authority
 
 ## Status
 
diff --git a/docs/doctoring/all-self-hosted-runner-routing-20261003.md b/docs/doctoring/all-self-hosted-runner-routing-20261003.md
new file mode 100644
index 0000000000..5eebc87357
--- /dev/null
+++ b/docs/doctoring/all-self-hosted-runner-routing-20261003.md
@@ -0,0 +1,48 @@
+# All-self-hosted workflow routing — staged rollout
+
+## Authority and scope
+
+On October 3, 2026, the user directed this SDP workstream: “self hosted runner로 모두 전환”. This change covers every runner declaration in the central `.github` repository (73 jobs) and SDP (4 jobs). It does not claim migration of unrelated ecosystem repositories or deployment of runner infrastructure.
+
+## Routing and isolation
+
+Existing restricted control, CodeQL and OpenCode groups stay intact. Existing exact-main workflow predicates and repository predicates stay intact; only their GitHub-hosted fallback changes. Ordinary jobs and non-main fallbacks require the dedicated `CWL CI isolated` runner group and all labels `self-hosted`, `linux`, `x64`, `cwlab-ci-isolated`. Both constraints are mandatory: GitHub routes a group selector through the group's repository access boundary and then matches every label inside that group. The label remains a provisioning contract, not a claim that a suitable runner already exists. Never add a privileged control/review runner to this group or apply the isolation label merely to release queued PR jobs.
+
+PR code must execute on disposable, job-isolated machines without production credentials, privileged Docker sockets, internal-network access or state shared with trusted control jobs. Rebuild the job environment after each job. Secret-bearing trusted jobs need separate disposable instances from untrusted PR jobs. Labels are mutable metadata and GitHub does not validate that the `linux` and `x64` labels match the runner machine; label-only routing therefore cannot prove the authority boundary. The dedicated group is the repository-access boundary, while the labels express the required platform and isolation capability inside it. Keep current token permissions, environment approvals, immutable artifact checks, exact-head review and required merge gates. This patch declares the required group but does not widen runner-group allowlists, register runners, alter secrets or bypass protection.
+
+R reusable jobs use Linux/x64-only admission: every requested leg must name `ubuntu-latest` or `ubuntu-24.04`. R versions and other fields remain unchanged for an admitted matrix. Any unsupported or malformed leg stops the complete matrix with STOP / nonzero, including mixed and unsupported-only matrices; no requested check is dropped to manufacture success. Admission and R execution both use the fixed `CWL CI isolated` group with `self-hosted`, `Linux`, `X64`, and `cwlab-ci-isolated` labels. Windows, macOS, ARM and unknown images are not platform coverage, and stopped legs have no queued R check. Linux instances still need compatible userspace and CI dependencies; labels do not install packages or attest the image.
+
+The first group-scoped R selector encoded its runner object with unescaped
+literal JSON braces inside GitHub's `format()` expression. GitHub requires
+literal braces in a format template to be doubled; the unescaped opening brace
+was parsed as a replacement field and stopped the matrix before runner
+admission. RED `f9211898d83f039cdf7ff82c8f93c72c9c10dceb`
+renders the exact workflow template for Linux, Windows, macOS and an unsupported
+OS and reproduces the failure. GREEN
+`7fc1e2e8ad5091adff6c56b501e93d1d4ac2f211` doubles only the outer braces,
+retains `{0}` and `{1}`, and passes all eight focused contracts both normally
+and with `GITHUB_ACTIONS=true`. This proves selector serialization only; it does
+not prove that the runner group, capacity, cleanup or operating-system images
+exist.
+
+## Actual admission observation and rollout prerequisite
+
+The complete organization runner inventory read during preparation had 9 runners: 7 online Linux x64 and 2 offline. None carried `cwlab-ci-isolated`; no registered Windows or macOS runners were observed, and no verified `CWL CI isolated` group/capacity record was available. Existing groups contain privileged or workflow-restricted runners. Therefore this configuration is not runtime-ready and must not be enabled or merged before the authorized runner operator creates the dedicated group, limits its repository access, and provides disposable isolated capacity. The OpenCode group's sole runner `cwlab-s1-04` was offline; changing fallback routing does not repair it.
+
+Before promotion, the operator must return real runner identity/group/access records, prove that `CWL CI isolated` excludes privileged pools and admits only the intended repositories, demonstrate isolated cleanup and tool availability, and produce a successful canary job plus every exact-head required gate. Provisioning and runtime canaries are not completed by local YAML parsing or pytest. Preserve existing current-head executions; do not cancel or duplicate model reviews. Ship through normal reviewed protected PRs only, after prerequisites are satisfied.
+
+## Verification and rollback
+
+Permanent regression tests enumerate declarations, reject every GitHub-hosted fallback, require the dedicated group whenever `cwlab-ci-isolated` is selected, and keep PR-executing jobs outside privileged pools. Existing workflow-contract assertions are migrated rather than deleted. A structured YAML inventory verifies all 77 central/product job declarations; normal test suites and immutable source comparisons are separate evidence. Rollback is an ordinary reviewed revert of the migration PRs, not a protection change, group-access expansion or runner relabeling.
+
+## Primary sources (APA 7)
+
+GitHub. (n.d.). Choosing the runner for a job. GitHub Docs. Retrieved October 3, 2026, from https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job
+
+GitHub. (n.d.). *Expressions: format*. GitHub Docs. Retrieved October 3, 2026, from https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#format
+
+GitHub. (n.d.). Self-hosted runners reference. GitHub Docs. Retrieved October 3, 2026, from https://docs.github.com/en/actions/reference/runners/self-hosted-runners
+
+GitHub. (n.d.). Managing access to self-hosted runners using groups. GitHub Docs. Retrieved October 3, 2026, from https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/manage-access
+
+GitHub. (n.d.). Using self-hosted runners in a workflow. GitHub Docs. Retrieved October 3, 2026, from https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/use-in-a-workflow
diff --git a/docs/doctoring/central-coverage-owner-stack-2521.md b/docs/doctoring/central-coverage-owner-stack-2521.md
new file mode 100644
index 0000000000..412899d94e
--- /dev/null
+++ b/docs/doctoring/central-coverage-owner-stack-2521.md
@@ -0,0 +1,46 @@
+# Central coverage owner stack RCA
+
+## Incident and ownership
+
+`ContextualWisdomLab/.github#2521` owns the repository-wide Python statement
+and branch coverage repair. Concurrent PRs carried valid prerequisites rather
+than competing implementations: #2530 owns the hash-pinned parser inputs used
+by complete test collection, and #2532 owns explicit closure of file-like
+GitHub `HTTPError` responses. Both were preserved as ordinary merge parents;
+neither failure was treated as a reason to discard a PR.
+
+## Root causes
+
+The first warning-fatal integrated run separated three causes:
+
+1. the predecessor tree lacked parser dependencies required during collection;
+2. synthetic GitHub redirect/error paths leaked response objects under Python
+   3.14 and therefore failed when `ResourceWarning` was promoted to an error;
+3. four central scripts retained executable paths that their tests did not
+   reach, while two tests invoked a live `gh` boundary or asserted nothing.
+
+The remaining coverage work was test-first and behavior-bound. It exercises
+queue admission/cancellation, bounded repository scans, exact Git blobs,
+Cargo workspace and development-lock identity, runtime receipt architecture,
+release fanout limits, and Python 3.10 TOML parser fallback. The runtime archive
+prescreener's final repeated count check was proven unreachable because its
+earlier exact-cardinality, uniqueness, and per-archive validation already
+reject every false case; only that redundant branch was removed.
+
+## Evidence and acceptance
+
+- RED integrated evidence: 5,196 passed, 6 skipped; 90 statements missed and
+  29 partial branches across the four remaining owner modules.
+- Focused release dependency evidence: 950 passed with warnings treated as
+  errors.
+- GREEN combined-successor evidence after re-fetching and ordinarily merging
+  current #2530 and #2521 heads: 5,291 passed, 5 skipped, 40 subtests passed;
+  18,729/18,729 production statements and 7,642/7,642 branches covered, with
+  production Docstring coverage at 100%.
+- No warning, security result, or fail-closed input validation was suppressed.
+
+This local result is not merge authority. Acceptance requires publication to
+the re-fetched #2530 successor branch without force, fresh hosted Checks bound
+to that exact commit, qualifying independent review, and ordinary protected
+merge. The #2521 predecessor remains open until that protected merge and
+complete tree carryover are verified.
diff --git a/docs/doctoring/codeql-ghas-analyses-pagination.md b/docs/doctoring/codeql-ghas-analyses-pagination.md
new file mode 100644
index 0000000000..ad647f7d62
--- /dev/null
+++ b/docs/doctoring/codeql-ghas-analyses-pagination.md
@@ -0,0 +1,78 @@
+# Complete GHAS analyses pagination
+
+Status: local source repair on base `37b10243cec3d160ecc9c1be75c71428b160a703`;
+protected integration, hosted security checks and independent review remain required.
+
+## Root cause and ownership
+
+`list_codeql_analyses()` returned only the first `per_page=100` response and
+ignored `Link`. An identity first encountered on a later page could therefore
+be absent from the evidence supplied to the existing base/head pairing rule.
+The central standalone helper owns this retrieval defect, not a consumer
+repository's CodeQL workflow or lifecycle policy.
+
+The read-only overlap survey collected 383 open central PRs and examined the
+exact committed helper source in all 11 file-overlap candidates. Ten retained
+the single-request implementation; #2205's head has no helper source.
+In particular, #2532's HTTP-error-response closure is separate
+work: it is not complete-history pagination and is not implemented here.
+No duplicate pagination implementation was found in those candidate heads.
+
+## Contract
+
+- Preserve the public `list_codeql_analyses()` arguments and list return shape,
+  the optional ref filter, analysis order, and existing identity pairing policy.
+- Follow GitHub's `next` Link only after validating canonical HTTPS
+  `api.github.com`, the exact repository analyses path, unchanged decoded
+  `ref`/`tool_name`/`per_page`, and the next sequential page number. GitHub's
+  numeric `/repositories/<id>/code-scanning/analyses` alias is accepted only
+  after an authenticated, redirect-free read of the original owner/name
+  repository metadata verifies that exact positive integer ID. Cache this
+  binding within one collection; never infer it from an analysis row.
+- Reject ambiguous/malformed Link relations, query changes, cycles or skips
+  before creating another authenticated request. Continue refusing redirects.
+- Collect at most **1000 pages**, each with integer `per_page` in **1..100**.
+  Exceeding that resource bound raises an incomplete-evidence error; no prefix
+  is returned as complete history.
+- HTTP/transport errors, non-list JSON, invalid JSON/UTF-8 and empty HTTP bodies
+  abort the entire collection. A valid empty JSON array remains supported.
+- Do not retire, filter or rewrite configuration identities; do not upload SARIF,
+  synthesize security status, weaken a gate or change lifecycle approval policy.
+
+The transport's `_request_json()` still returns JSON to its original callers;
+its optional output-header mapping exposes Link to traversal. Repeated physical
+Link fields are combined in response order using `get_all("Link")` before the
+existing relation grammar is validated; later next relations cannot be hidden,
+and duplicates/malformed fields fail closed before another authenticated request.
+Dict-shaped test responses retain their single-value lookup compatibility. Its
+pre-existing empty-body behavior remains compatible when that mapping is not
+requested.
+The module remains stdlib-only and executable as a standalone fetched script.
+
+## Regression and validation
+
+`tests/test_codeql_ghas_analyses_pagination.py` drives the actual opener seam
+with synthetic HTTP responses, never live credentials or invented GHAS state.
+A three-page, 201-row regression keeps an active identity on page three and
+proves it still blocks a head missing that identity. Negative cases exercise
+poisoned next targets (with no second bearer request), cycles, malformed Link,
+later-page errors and the independent literal 1000-page boundary. Positive
+cases cover no ref, PR refs, escaped ref characters, query ordering, single
+pages, valid empty arrays and the pre-existing non-dict-row behavior.
+
+Validate the helper and existing authority/credential contracts in normal and
+`GITHUB_ACTIONS=true` modes, with 100% statements, branches and docstrings.
+Run the dispatch workflow contracts too. On macOS, nine unchanged workflow
+fixtures fail because they explicitly invoke `/bin/bash` 3.2 with Bash 4+
+`${value,,}` syntax; the same failures reproduce in a clean archive of the
+exact base. Do not reinterpret those baseline failures as passing CI.
+
+## Primary references
+
+- [GitHub REST pagination](https://docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api)
+  specifies following response Link relations rather than assuming one page.
+- [List code scanning analyses](https://docs.github.com/en/rest/code-scanning/code-scanning?apiVersion=2022-11-28#list-code-scanning-analyses-for-a-repository)
+  documents the paginated analyses endpoint, ref filter and page-size limit.
+
+This API-contract repair adds no new scientific inference or model invocation;
+there is no paper PDF to redistribute.
diff --git a/docs/doctoring/dependency-review-fail-closed-permission-envelope.md b/docs/doctoring/dependency-review-fail-closed-permission-envelope.md
new file mode 100644
index 0000000000..2f4dca0cc2
--- /dev/null
+++ b/docs/doctoring/dependency-review-fail-closed-permission-envelope.md
@@ -0,0 +1,114 @@
+# Dependency Review fail-closed authority and caller permission envelope
+
+## Incident boundary
+
+Protected `ContextualWisdomLab/.github` main introduced the central reusable Dependency Review workflow through #1724. Subsequent exact-head evidence exposed three owner-contract defects that are repaired together in #1725 because all belong to the canonical dependency-review admission boundary.
+
+### Defect A — ambiguous HTTP status normalized to success
+
+The initial reusable preflight treated Dependency Graph compare HTTP 403/404 as proof that the feature was unavailable, wrote `available=false`, and let the pull-request gate finish successfully. That inference is unsafe: an authorization/policy denial can present the same status shape. The repair keeps the exact base/head compare request but authorizes the action only on HTTP 200; every other pull-request response is blocking and reports its status.
+
+Test-first evidence:
+
+- RED `cb07b8bb28ef9d3a147cc966a0c70654d132da1d` makes 403/404-as-unavailable, the fallback note, and any non-explicit fail-closed response illegal.
+- Production `31f60e532e135008cabd09fcddd46a53062b0ea0` removes the 403/404 success branch and fallback note, preserving the pinned action, inputs, and non-`pull_request` skip boundary.
+
+### Defect B — thin callers lost required `GITHUB_TOKEN` permissions
+
+The original repository-local workflows carried read permission envelopes, but the migration examples/thin callers did not preserve them uniformly. GitHub reusable workflows cannot elevate the caller token. Consequently the called workflow's own `permissions: contents: read, pull-requests: read` declaration is only a ceiling; it cannot grant `pull-requests: read` when the caller omitted it.
+
+Live immutable-pin evidence isolates this from mutable-ref resolution:
+
+| Consumer | Exact head | Run | Result before caller repair |
+| --- | --- | --- | --- |
+| `ContextualWisdomLab/newsdom-api#784` | `1623977e6c37c78cb1a94a7a48c48f6d02cac86c` | `33622976911` | `startup_failure`, zero jobs; referenced workflow resolved to `.github@0bcd22d8bb07650aafb0a8f116e4c2bbb8744f03` |
+| `ContextualWisdomLab/mightyETL#330` | `65efdf7b4064df5b9811c0403defb707e6efbc02` | `33623035969` | `startup_failure`, zero jobs |
+
+The consumer-side repair explicitly restores:
+
+```yaml
+permissions:
+  contents: read
+  pull-requests: read
+```
+
+Fresh heads then materialized Dependency Review runs instead of failing before job creation:
+
+- newsdom-api `9a798d5ac7b9b295a1accb2327fc76611352290f`, run `33623818000`;
+- mightyETL `4576f863ede9fca0673d6cce5ae8a4093246f5ab`, run `33623854807`;
+- scopeweave `db8b8ed6d36a6dc6cc1d07255a7a9a86bc88bf4f`, run `33623761776`;
+- Argos #557 `ee4c5dd326977407435b0f2425fdecebc34a810f`, run `33623867278`.
+
+Central test-first repair for this second defect:
+
+- RED `ee0f1ce544965772775b590050e40476df4ea8f6` adds `test_example_caller_preserves_required_permission_envelope()` without changing production/example workflow text. Against its parent it fails because the canonical caller example has no `permissions:` block.
+- GREEN production `ca3bdbd210de988ccd31f7fb96d3a97adfdb9bff` adds the least-privilege caller envelope, explains the reusable-workflow permission ceiling, and replaces the mutable `@main` example with `<protected-main-commit-sha>`.
+
+### Defect C — compare identity was trusted before transport
+
+The earlier bundled Security Scan accepted the event-provided repository/base/head strings without first proving they were exact immutable Git object identities and one legal `owner/name` repository identity. That left the preflight contract weaker than the evidence it claimed to authorize.
+
+The predecessor owner lane #1643 added fail-before-transport validation and a temporary A/B canary. Its exact-head canary run `33589436750`, job `100120235906`, executed on `2026-09-02` and produced decisive evidence for the same immutable pair:
+
+- repository: `ContextualWisdomLab/.github`;
+- base: `bb14b014eee31e6abdb5d2fffbb805aa29420eac`;
+- head: `a6a2759640e6aa1d1e1219e1cd7aacdeffef32c0`;
+- anonymous compare: HTTP `404`, curl exit `0`;
+- job-token compare with `contents: read` and `pull-requests: read`: HTTP `200`, curl exit `0`.
+
+This proves that anonymous status is not an availability authority and that the least-privilege job token can establish the exact comparison. The temporary canary itself is diagnostic-only and is not part of the publishable successor contract.
+
+#1725 carries the durable part of that predecessor delta into the canonical writer:
+
+- both the reusable workflow and bundled Security Scan reject non-exact base/head revisions before curl;
+- repository identity must be exactly one non-dot `owner/name` pair; `ContextualWisdomLab/.github` remains legal;
+- the compare request uses the job token and only HTTP 200 authorizes the pinned Dependency Review action;
+- named refs, malformed identities, 403/404 and all other non-200 outcomes fail closed.
+
+### Defect D — HTTP text could hide a failed curl transfer
+
+The reusable preflight appended `|| true` to curl and then authorized solely on
+the printed HTTP status. A partial body transfer can print `200` and still exit
+nonzero, so the old branch could publish `available=true` for incomplete
+evidence. The executable regression makes the fake transport print `200` and
+exit `18`; the preflight must remain nonzero and must not publish availability.
+The minimal repair captures curl's exit status and requires both exit zero and
+HTTP 200. The bundled Security Scan already enforced both conditions and was
+left unchanged.
+
+Test-first evidence: RED `fe9d193343d12dbd229815a18ce85b494b3acff9` adds only the executable transport
+contract and fails on the inherited preflight; its ordinary child carries the
+minimal production and documentation repair.
+
+## Security invariants
+
+1. Pull-request Dependency Review executes only after curl completes successfully and an exact base/head compare returns HTTP 200.
+2. Base/head revisions must be exact 40- or 64-character lowercase hexadecimal Git object IDs before transport.
+3. Repository identity must be exactly one non-dot `owner/name` pair before transport.
+4. No anonymous response, HTTP 403/404, or other non-200 response is translated into a successful "unavailable" state.
+5. OSV-Scanner, Scorecard, and the separate Security Scan path remain independent controls; they do not satisfy a failed Dependency Review gate.
+6. The called workflow and each caller use only `contents: read` and `pull-requests: read` for this path. No write permission is introduced.
+7. Product callers pin the central workflow to an immutable protected-main commit after merge. `@main`, PR heads, and branch URLs are not production authority.
+8. A non-`pull_request` event may skip because it lacks the PR base/head identity required for the comparison.
+
+## Verification and merge boundary
+
+The focused owner contracts are:
+
+```bash
+PYTHONPATH=. pytest -q \
+  tests/test_dependency_review_reusable_workflow_contract.py \
+  tests/test_dependency_review_bundled_scan_identity_contract.py
+```
+
+The repository's normal exact-current-head required Checks, full coverage evidence, security scans, and independent reviews remain authoritative. #1725 stays Proposed/Draft while those gates are non-terminal or any substantive finding is unresolved. Queue saturation does not authorize bypass of a startup, permission, provenance, review, or security defect.
+
+After #1725 reaches protected main through ordinary protection, each consumer must bump its immutable reusable-workflow pin to that protected-main SHA and regenerate exact-head Dependency Review evidence. No consumer should return to `@main`.
+
+## References
+
+GitHub. (n.d.-a). *Reusing workflow configurations*. GitHub Docs. https://docs.github.com/actions/using-workflows/reusing-workflows
+
+GitHub. (n.d.-b). *Use GITHUB_TOKEN for authentication in workflows*. GitHub Docs. https://docs.github.com/actions/security-guides/automatic-token-authentication
+
+GitHub. (n.d.-c). *REST API endpoints for the dependency graph*. GitHub Docs. https://docs.github.com/rest/dependency-graph
diff --git a/docs/doctoring/full-suite-parser-locks-20260930.md b/docs/doctoring/full-suite-parser-locks-20260930.md
new file mode 100644
index 0000000000..8454481059
--- /dev/null
+++ b/docs/doctoring/full-suite-parser-locks-20260930.md
@@ -0,0 +1,81 @@
+# Full-suite parser dependency admission
+
+## Incident
+
+At protected `main@37b10243cec3d160ecc9c1be75c71428b160a703`, the common
+OpenCode quality lock did not install the parsers imported by repository test
+collection. Agent Mention Router Quality run
+[36443475158](https://github.com/ContextualWisdomLab/.github/actions/runs/36443475158)
+and source-repair run
+[36443475290](https://github.com/ContextualWisdomLab/.github/actions/runs/36443475290)
+reported `ModuleNotFoundError: No module named 'defusedxml'` and 13 collection
+errors. The newer main additionally has four workflow tests importing `yaml`.
+These are environment failures before test execution, not product findings or
+passing coverage measurements.
+
+## Repair boundary
+
+The shared tooling input reuses `requirements-noema-document-ci.txt` for the
+existing `defusedxml==0.7.1` pin and adds the existing security-tooling
+`PyYAML==6.0.3` pin. The generated lock is rebuilt only with
+`./scripts/ci/compile_opencode_review_lock.sh` (Python 3.14, Linux target,
+`--upgrade`, hashes). The required upgrade also resolves Hypothesis 6.168.3
+instead of 6.168.0. No hashes are edited by hand.
+
+Installing the entire Bandit lock alongside this lock is not the repair: their
+Pygments pins differ. The common quality environment instead resolves its own
+complete, consistent dependency closure. Hash checking remains mandatory.
+PyYAML's repository reports MIT. GitHub reports NOASSERTION for defusedxml,
+so its installed hash-pinned 0.7.1 wheel's LICENSE was read directly and confirms
+Python Software Foundation License Version 2; a missing SPDX detection is not
+interpreted as missing permission.
+
+A contract regression requires both parser packages in the installed lock.
+RED: one failing test because both packages were absent. GREEN: 36 tests passed
+and two optional document-format tests skipped after hash-locked installation.
+The full repository suite is a separate verification step, not implied by that
+focused result. On code head `41e95af9dd1ac95dea716d53c44df1eacbd81d9d`, the final
+isolated run finished with 5,165 passed, five skipped and 40 subtests passed in
+356.08 seconds. It used only the common quality lock plus the project-pinned
+pip seed, disabled incidental pytest plugin autoload and cleared live event/token
+environment variables. An inherited ResourceWarning from a synthetic HTTPError
+fixture remains visible; it is not suppressed or treated as a product failure.
+
+## Verification environment
+
+The first YAML-present full run on source-repair head `deb47f8db` finished with
+5,232 passed, seven failed, five skipped and 40 subtests passed. Two failures
+were a locally unseeded virtualenv lacking pip; five used pytest temporary
+paths beneath the host home, which the sandbox correctly refuses. Installing
+project-pinned pip 26.2.1 and using an isolated `/tmp` basetemp made all seven
+reproductions pass. These local environment corrections do not weaken sandbox
+validation and are not changes to production code.
+
+An initial clean-lock run had one further environment failure: macOS inherited
+`/tmp` group 0, which this user does not belong to, and silently cleared the
+setgid bit when the test requested mode 2600. A direct mode probe observed 600,
+while a staff-owned directory retained 2600. The final run used a unique
+staff-owned parent outside the host home; the security check itself was not
+changed. Both the targeted permission test and the complete suite passed there.
+
+Source-repair's own two scripts separately measured 100% statement/branch
+coverage and 100% docstrings. Neither those measurements nor the parser repair
+constitute hosted exact-head approval or merge authorization.
+
+## Consumers and limits
+
+Quality workflows install `requirements-opencode-review-ci-hashes.txt` directly.
+The central OpenCode coverage image also consumes it in
+`.github/workflows/opencode-review-dispatch.yml`, together with the existing
+Noema document lock. No exact-head fast-mlsirm Noema HTTP 400 or Strix report
+scope failure is claimed resolved by this dependency change. Those incidents
+require their own current-head transport/report evidence and independent review.
+
+## References
+
+Python Packaging Authority. (n.d.). *Secure installs*. Retrieved September 30,
+2026, from https://pip.pypa.io/en/stable/topics/secure-installs/
+
+The pip documentation requires every dependency in hash-checking mode to be
+pinned and hashed. The repair preserves that contract rather than adding an
+unhashed installation fallback.
diff --git a/docs/doctoring/github-api-http-error-response-lifecycle.md b/docs/doctoring/github-api-http-error-response-lifecycle.md
new file mode 100644
index 0000000000..e26110c0b8
--- /dev/null
+++ b/docs/doctoring/github-api-http-error-response-lifecycle.md
@@ -0,0 +1,86 @@
+# GitHub API HTTP error response lifecycle
+
+Status: Proposed source repair; exact-head hosted security Checks and independent review remain mandatory.
+
+## Incident and exact owner
+
+Protected `ContextualWisdomLab/.github` `main` at
+`37b10243cec3d160ecc9c1be75c71428b160a703` reproduced eight failures in
+`tests/test_github_api_url_boundary.py` under Python 3.14.7 with warnings promoted
+to errors. Both authenticated GitHub REST clients correctly refused a synthetic
+302 without sending a second request, but the resulting `HTTPError` response was
+left open and Python reported `ResourceWarning: Implicitly cleaning up
+<HTTPError 302: 'Found'>`.
+
+The exact RED command was:
+
+```console
+GITHUB_ACTIONS=true python -m pytest tests/test_github_api_url_boundary.py -q -W error
+```
+
+Result on the protected revision: `8 failed, 26 passed`. The same result in a
+clean protected-revision worktree proves this is a pre-existing central supplier
+defect rather than a consumer or `.github#2040` branch-only failure.
+
+## Root cause and repair
+
+Python documents `urllib.error.HTTPError` as both an exception and the same kind
+of file-like response returned by `urlopen()`, with a readable error-body file
+pointer. The clients converted the exception into their domain error but did not
+close that response object. Success responses already used context managers; the
+HTTP error path violated the same lifecycle boundary.
+
+The repair keeps the existing fail-closed redirect policy and error mapping.
+The first exact-tree verification also exposed the same lifecycle defect in
+other central HTTP boundaries, so the owner repair now covers every observed
+path rather than leaving warning-fatal failures for a successor:
+
+- `codeql_ghas_configuration_identity._request_json` reads at most 400 bytes of
+  diagnostic body and closes the `HTTPError` in `finally`, including decode/read
+  failures;
+- `strix_evidence_binding.default_github_opener` snapshots the status code,
+  closes the response, and then raises `EvidenceBindingError`;
+- `noema_review_gate.call_llm` extracts only bounded allowlisted gateway
+  telemetry and then closes the response in `finally`;
+- the Pingora artifact client closes JSON and raw-blob HTTP errors after
+  preserving its existing 404/domain-error mapping;
+- the review preflight closes provider HTTP errors after recording only the
+  safe status and retry fields;
+- Pages publication and sandbox readiness probes close rejected redirects
+  before returning their existing fail-closed result;
+- the production-opener regression now asserts that the single synthetic 302
+  response is closed as well as proving no redirected bearer request occurs,
+  and each newly discovered caller has an equivalent close contract.
+
+The 400-byte intake bound matches the pre-existing 400-character public
+diagnostic limit without reading an arbitrarily large untrusted response first.
+No warning filter, security suppression, redirect allowance, timeout, or check
+threshold changed.
+
+## Acceptance
+
+1. The protected-revision RED becomes GREEN under Python 3.14.7 and `-W error`.
+2. CodeQL identity, Strix evidence, Noema, Pingora, review-preflight, Pages,
+   sandbox readiness, and URL-authority suites remain GREEN with warnings
+   fatal.
+3. Changed production behavior retains contract coverage and public docs.
+4. Hosted Semgrep, Bandit, CodeQL, dependency, and independent review Checks pass
+   on the exact PR head before ordinary protected merge.
+5. `.github#2040` then merges the protected repair normally and regenerates its
+   own exact-head evidence; stale predecessor failures are not rerun as proof.
+
+Local repair evidence on Python 3.14.7 is `35 passed` for the URL-authority
+suite after adding the bounded-intake regression (`1 failed` before the repair),
+`220 passed` for the original eight-file CodeQL/Strix impact suite, `69 passed`
+for the sandbox E2E suite, and `5161 passed, 10 skipped, 40 subtests passed`
+for the complete warning-fatal test tree. The original two production modules
+each report 100% statement/branch coverage, while the repository-wide report
+remains at its pre-existing 99% because unrelated production files outside this
+delta retain uncovered branches. Hosted exact-head Checks, rather than this
+local evidence, remain the merge authority.
+
+## Primary reference
+
+Python Software Foundation. (2026). *urllib.error — Exception classes raised by
+urllib.request* (Python 3.14.7 documentation).
+https://docs.python.org/3.14/library/urllib.error.html
diff --git a/docs/doctoring/law-ai-agent-central-ci.md b/docs/doctoring/law-ai-agent-central-ci.md
new file mode 100644
index 0000000000..4bb159440f
--- /dev/null
+++ b/docs/doctoring/law-ai-agent-central-ci.md
@@ -0,0 +1,145 @@
+# Law AI Agent 중앙 CI 이관 기록
+
+## 범위와 상태
+
+- 2026-10-05 14:02 KST 사용자 승인. 중앙 소유자는 `ContextualWisdomLab/.github`다.
+- 중앙 기준본: `main@37b10243cec3d160ecc9c1be75c71428b160a703`.
+- 검증한 소비 기준본: `ContextualWisdomLab/law-ai-agent@301800bd9e2f1c0876ff3466b0de8013474c7d26`.
+- 이 변경은 새 workflow, shell helper, 중앙 계약 테스트, 이 기록의 네 파일만 소유한다.
+  기존 중앙 control/security/scanner와 소비 source는 수정하지 않는다.
+- AGENTS, CLAUDE, master context, product directive, Project protocol, gap baseline,
+  `ContextualWisdomLab/naruon#974` spec을 읽었다. Project #1은 조회 당시 503개 항목이었다.
+  조회한 앞 100개는 전체 인벤토리가 아니다. 이 작업의 통합 담당자는 Coordinator다.
+- 소스 이관과 runner 운영은 다른 증거다. 보호된 병합, GitHub job 성공, 출시를 주장하지 않는다.
+
+## 신뢰 경계
+
+`workflow_call`만 허용한다. 중앙 public PR 이벤트는 private 소비 code를 checkout하지 않는다.
+첫 inline admission은 checkout 전에 exact caller repository, 이벤트와 SHA를 검사한다.
+허용 이벤트는 같은 저장소의 main 대상 PR, main push, main 수동 실행이다.
+Fork, 다른 저장소, `pull_request_target`, mutable 중앙 ref, 잘못된 SHA는 실패한다.
+Fork를 성공한 skip으로 처리하지 않는다.
+
+소비 checkout은 이벤트의 PR head 또는 github.sha다. 중앙 helper checkout은
+`job.workflow_repository`와 `job.workflow_sha`다. `github.workflow_sha`를 중앙 SHA로 쓰지 않는다.
+공식 문서는 job 필드가 “workflow file that defines the current job”을 가리킨다고 설명한다
+(GitHub, n.d.-a). 두 checkout의 실제 HEAD를 검사한다. 경로는 `source`와 `central`로 분리한다.
+`persist-credentials: false`, `contents: read`, cache 비활성화를 적용한다. 별도 secret과
+`secrets: inherit`은 없다. 소비 concurrency prefix와 중앙 `law-ci` prefix는 달라야 한다.
+
+검증한 action 객체:
+
+- checkout commit: `fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09`.
+- 소비 setup-uv의 `94527f2e458b27549849d47d273a16bec83a01e9`는 annotated tag 객체다.
+  REST git tag 응답에서 commit `37802adc94f370d6bfd71619e3f0bf239e1f3b78`을 확인했다.
+  중앙은 이 commit을 pin한다. uv 버전은 0.12.5다.
+
+Runner selector는 group `CWL law CI`, labels `self-hosted/Linux/X64/law-ai-agent-ci`다.
+Python 3.12/3.14 matrix는 `max-parallel: 1`, 각 job은 20분이다.
+Reusable workflow의 runner 접근과 hosted billing은 caller context를 따른다
+(GitHub, n.d.-b). 중앙 소스 이관으로 private caller의 전역 admission 문제가 해결됐다는 주장은 하지 않는다.
+격리 runner의 운영 권한·자원·network 검증은 Coordinator의 별도 영수증이 필요하다.
+
+기존 중앙 workflow에는 Harden-Runner가 있다. 이 lane에는 효과가 없는 action을 복사하지 않았다.
+공급자 문서는 self-hosted runner에 Enterprise 구독과 runner infrastructure agent가 필요하며,
+구독 없이 action만 추가하면 no-op이라고 설명한다 (StepSecurity, n.d.). Egress 강제와
+host 격리는 runner provisioning 경계다. 이 기록은 해당 제어의 실제 활성화를 증명하지 않는다.
+
+## 실행 계약
+
+Helper는 BASH_SOURCE로 자기 경로를 찾는다. CWD에 의존하지 않는다.
+정확한 consumer commit을 `git archive`로 새 scratch source에 복원한다.
+이전 checkout의 dist, venv, cache를 사용하지 않는다.
+
+- native PostgreSQL은 provisioned `pg_config --bindir`에서 찾는다. 런타임 apt/sudo 설치는 없다.
+- RUNNER_TEMP의 짧은 `mktemp` immediate-child root, uid 소유권, mode 0700,
+  socket 0700, TCP off, test database만 사용한다. 모든 경로 component의 symlink를 거부한다.
+- `LAW_AGENT_ROOT`와 소비 안전 코드가 실제 읽는 `LAW_AGENT_POSTGRES_ROOT`는 같은 scratch다.
+- 서버와 연결의 statement 10초, lock 2초 제한을 유지한다. 실제 consumer 승인 함수
+  `connect(..., test_only=True)`를 사용하여 migration 001/002를 commit한다.
+  committed baseline fixture가 suite 앞부분에서 필요하므로 전체 pytest 전에 초기화한다.
+- uv locked sync, ruff, format, mypy, 전체 pytest/coverage90/subprocess coverage를 유지한다.
+  JUnit의 모든 suite에서 skip/failure/error 0과 test count 양수를 확인한다.
+- 새 outdir에서 정확히 wheel 1개와 sdist 1개를 요구한다. uv의 자동 `.gitignore`는
+  `--no-create-gitignore`로 막는다 (Astral, n.d.).
+- 새 lane-local cache를 online prime한 뒤 다른 새 venv에 실제 offline wheel 설치를 한다.
+  source 밖에서 `python -I`로 installed prefix 안의 module, 두 migration resource와 CLI help를 확인한다.
+- 생성 직후 trap을 설치한다. 기존 state marker는 덮어쓰거나 삭제하지 않는다.
+  child 실패 상태를 보존하고 cleanup 실패를 성공으로 바꾸지 않는다.
+  항상 실행하는 workflow cleanup은 private uid/mode와 canonical immediate-child 범위를 다시 검사한다.
+
+Shell은 Python interrogate 대상이 아니다. 모든 shell function 앞의 역할·실패 경계 주석과
+모든 embedded Python block의 module docstring을 이 파일의 문서화 계약으로 사용한다.
+이는 전체 조직의 100% coverage/docstring gate가 실행됐다는 주장이 아니다.
+
+## 실제 검증
+
+2026-10-05 KST, macOS 로컬의 실제 native PostgreSQL 18.6와 uv 0.12.5에서 실행했다.
+소비 source는 위의 정확한 committed SHA다. 소비 작업 중 추가된 미커밋 테스트는 포함하지 않는다.
+요청 당시 343개와 달리 현재 기준본의 실제 collection은 **345개**다.
+
+| 실행 | 실제 결과 |
+|---|---|
+| Python 3.12.14 전체 소비 suite | 345 passed, skipped 0, coverage 98.95% |
+| Python 3.14.7 전체 소비 suite | 345 passed, skipped 0, coverage 98.87% |
+| 두 Python의 ruff / format / mypy | 통과 |
+| 두 Python의 fresh wheel/sdist + offline 새 venv 설치 | 통과 |
+| 두 Python의 source 밖 isolated resource / CLI help | 통과 |
+| 두 Python의 native cluster stop와 scratch 제거 | 통과 |
+| 중앙 admission TDD | 15 RED → 15 GREEN |
+| 중앙 helper evidence TDD | 7 RED → 23 GREEN |
+| 실행 계약 TDD | 2 RED → 25 GREEN |
+| 실제 빌드 `.gitignore` 회귀 | RED 확인 후 수정·두 lane 재실행 통과 |
+| 독립 리뷰 cleanup/trap 회귀 | nested/public root와 trap 순서 3 RED → 31 GREEN |
+
+Synthetic tool fixture는 child exit 37의 전파, stop 실패, 재cleanup만 검사한다.
+실제 DB 검증으로 계산하지 않는다. 실제 DB 결과는 위의 두 native 실행뿐이다.
+독립 리뷰 뒤 강화한 최종 helper bytes는 아래 최종 checkpoint에서 다시 검증한다.
+
+`actionlint 1.7.12`는 공식 `job.workflow_*` 필드를 아직 모른다. 처음 실행은 이 필드와
+custom label에서 실패했다. 임시 custom-label config와 이 세 필드의 exact error regex만
+ignore한 실행은 통과했다. Workflow expression 검사가 완전히 지원된다는 주장은 하지 않는다.
+공식 context 문서와 admission runtime 테스트를 별도 근거로 남긴다.
+Shellcheck와 `bash -n`은 통과했다. 중앙 full-suite/100% coverage는 별도 실행 상태를 기록한다.
+
+## 최종 로컬 checkpoint — 14:42 KST
+
+독립 리뷰 수정 뒤 동일 helper bytes를 두 Python에서 다시 실행했다.
+3.12.14는 345 passed / skip 0 / 98.95%, 3.14.7은 345 passed / skip 0 / 98.87%다.
+양쪽 offline 실설치, prefix/resource/CLI help와 cleanup을 포함하여 exit 0이다.
+중앙 subset은 일반 환경과 `GITHUB_ACTIONS=true`에서 각각 **33 passed**다.
+Shellcheck, bash 구문, 6개 embedded Python block compile, 제한적 actionlint와 diff check는 통과했다.
+중앙 전체 suite와 100% coverage/interrogate는 이 worker에서 실행하지 않았다.
+
+최종 core 파일 SHA-256:
+
+| 파일 | SHA-256 |
+|---|---|
+| `.github/workflows/law-ai-agent-ci.yml` | `3aac714edfb5438c1f7c0eb6420fcff2f43b39692324cd6d7e86c4c103cfc164` |
+| `scripts/ci/law_ai_agent_ci.sh` | `7ee3d7d4f7083d87b921530f4ee3c7ce7dd8041e9611f4429390aa58f9e4e935` |
+| `tests/test_law_ai_agent_ci.py` | `8afd78b82f0c2a270375192eb35454735b1bb192b573bc89027d951b50900b35` |
+
+이 문서 자체의 hash는 Coordinator handoff에서 별도로 전달한다.
+다른 agent의 runner image/provisioning/review 파일은 shared worktree에 있지만 이 worker는 수정하지 않았다.
+
+## 남은 통합 확인
+
+1. 독립 reviewer에게 final 네 파일 SHA-256을 전달한다.
+2. Coordinator가 격리 Linux runner에서 final helper exact bytes를 실행한다.
+3. 소비 thin SHA caller의 exact commit과 중앙 protected commit을 연결한다.
+4. GitHub current-head required checks, 독립 승인, protected merge를 따로 검증한다.
+5. 활성 기존 writer/cron의 재개는 Coordinator가 소유한다. 이 worker는 스케줄을 변경하지 않는다.
+
+## References (APA 7)
+
+Astral. (n.d.). *Commands: uv build*. Retrieved October 5, 2026, from
+https://docs.astral.sh/uv/reference/cli/
+
+GitHub. (n.d.-a). *Contexts reference*. Retrieved October 5, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
+
+GitHub. (n.d.-b). *Reusing workflow configurations*. Retrieved October 5, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations
+
+StepSecurity. (n.d.). *Harden-Runner*. Retrieved October 5, 2026, from
+https://github.com/step-security/harden-runner
diff --git a/docs/doctoring/law-central-ci-independent-review.md b/docs/doctoring/law-central-ci-independent-review.md
new file mode 100644
index 0000000000..becd4bc6cc
--- /dev/null
+++ b/docs/doctoring/law-central-ci-independent-review.md
@@ -0,0 +1,89 @@
+# Law central CI — independent bounded review
+
+검토일: 2026-10-05 KST. 담당 dispatch: `ctx_03ac2f3ed053`.
+
+## 판정
+
+**BOUNDED PASS — writer 완료 뒤 frozen 6파일 bytes와 전달 SHA256이 일치했다. 원격 gate, 소비 caller pin과 출시의 PASS가 아니다.**
+
+Coordinator는 writer_done `msg_87a489827bae`, outcome succeeded와 14:44 KST byte freeze를 확인했다. 검토자는 freeze SHA256 6개를 현재 파일에서 직접 다시 계산하고 일치시켰다. 조기 발견한 root 경계와 trap-before-marker 결함은 final helper에서 수정됐다. 현재 승인된 source/design 검토 범위에서 미해결 blocking 결함은 발견하지 않았다.
+
+검토 대상은 중앙 신규 reusable workflow, shell helper, 계약 테스트와 운영 설명이다. 제품 원문을 중앙에 복사하지 않는다. 검토자는 제품 소스, 자격 증명, 다른 private 자료를 읽지 않았다. 소스 수정, Git 변경, 빌드, 전체 테스트, 컨테이너 실행과 등록을 하지 않았다. 이 문서만 검토자가 소유한다.
+
+## 조기 발견 — 수정 중인 bytes 기준
+
+1. **Cleanup 경로 경계** — 최초 helper의 `cleanup_root`는 최종 root의 디렉터리/비-symlink 여부와 basename만 검사했다. `cleanup_state`는 marker의 regular/non-symlink 여부와 lexical prefix만 검사했다. marker/root owner, mode, 정규화된 즉시 자식과 parent symlink 검증이 없었다. 삭제를 실행하지 않고 Bash 조건만 평가했다. `/scope/lawci.parent/lawci.child`와 `/scope/lawci.parent/../lawci.child` 모두 lexical prefix 조건에 통과했다. 기존 정리 경계 안에서 owner/mode와 canonical direct-child 경계를 확인하는 수정을 coordinator에 전달했다.
+2. **Marker 생성 이전 실패** — 최초 helper는 `mktemp` 이후 state 부재 검사와 state 쓰기를 완료한 다음 EXIT trap을 설치했다. state 충돌/쓰기 실패 시 새 scratch 정리가 실행되지 않는다. 기존 marker와 이번 실행 marker의 소유 여부를 구분하면서 trap을 일찍 설치하는 좁은 수정이 필요하다.
+3. **실행 증거의 강도** — 최초 helper는 PostgreSQL 도구 존재를 검사하나 16.15 runtime version을 검사하지 않았다. matrix Python은 uv 선택값이며 실행 interpreter version 검사가 없었다. 설치 wheel의 import는 source 밖임만 확인하고 이번 installed prefix 안임은 확인하지 않았다. image/runtime 영수증과 최종 수정 확인이 필요하다. 재현 없이 실제 image가 잘못됐다고 주장하지 않는다.
+
+## 현재 직접 관측
+
+- 14:31 KST GitHub API: runner group `11`, `CWL law CI`, visibility `selected`, `allows_public_repositories=false`, 선택 repository ID는 `[1404539192]` 한 개다. workflow restriction은 설정되지 않았다. 이것은 선택된 private 저장소의 접근 범위이며 특정 중앙 workflow만 허용하는 ACL은 아니다.
+- 같은 조회: runner `1134186`, Linux, `online`, `busy=false`; labels는 `self-hosted`, `Linux`, `X64`, `law-ai-agent-ci`다. 재등록, 영구 재사용 또는 컨테이너 폐기의 증거는 아니다.
+- 최초 workflow는 `workflow_call`만 받는다. contents 권한은 read다. 두 checkout은 persist-credentials=false이며 consumer head와 called workflow SHA를 따로 검증한다. admission은 owned same-repository PR, main push, main dispatch만 인정하고 fork와 pull_request_target을 거부한다.
+- `bash -n scripts/ci/law_ai_agent_ci.sh`는 exit 0이었다. 검토 Python은 `/Users/seonghobae/.pyenv/versions/3.14.5/bin/python3`, version `3.14.5`였다. 이것은 runner Python 3.12/3.14 실행 증거가 아니다.
+- 중앙 기존 tracked 파일 수정은 최초 `git status --short`에 없었다. 신규 workflow/helper/test 3개가 untracked였다. 다른 writer가 작업 중이므로 이 관측을 최종 상태로 재사용하지 않는다.
+
+## 공식 설계 근거
+
+- GitHub 2026-09-03 Changelog, “GitHub Actions: Early September 2026 updates”: `job.workflow_ref`, `job.workflow_sha`, `job.workflow_repository`, `job.workflow_file_path`가 해당 job을 정의한 workflow의 identity를 제공한다. github.workflow_*와 달리 reusable called workflow를 가리킨다. GitHub Enterprise Server에는 제공되지 않는다.
+- GitHub Docs, “Contexts reference”, job context: 위 called-workflow identity 의미가 현재 reference에도 있다.
+- GitHub Docs, “Reusing workflow configurations”, access/runner behavior: private caller는 public reusable workflow를 사용할 수 있다. Actions 허용 설정은 별도 전제다. 같은 조직 called workflow는 caller에게 제공된 조직 self-hosted runner를 사용할 수 있다. GitHub-hosted runner 배정과 billing은 caller context다. 중앙 이전을 billing 또는 현재 StartupFailure 해소로 판정하지 않는다.
+
+공식 페이지는 검토 세션에서 직접 검색했다. 운영 API 관측은 문서 일반론과 구분한다.
+
+## 중간 수정 확인 — 14:37 KST, 아직 freeze 전
+
+- `validate_owned_root`가 marker/root uid와 0600/0700 mode, immediate-child, parent symlink 검증을 추가했다. 기존 lexical-only 문제는 읽은 revised bytes에서 해소됐다.
+- trap이 marker 생성보다 먼저 설치되고 `state_owned`가 이전 marker 삭제를 막는다. 조기 lifecycle 문제는 읽은 revised bytes에서 해소됐다.
+- source Python major/minor runtime 검사와 wheel import의 `sys.prefix` 내부 검사가 추가됐다. PostgreSQL 16.15는 여전히 Dockerfile의 major-only 패키지 지정과 실제 image receipt를 구분해야 한다.
+- 4번째 파일은 `.github/runner-images/law-ai-agent/Dockerfile`이다. 공식 base digest는 dispatch와 일치한다. build 중 root는 apt 설치에만 사용하고 최종 USER는 runner다. 실제 배포 image와 final Dockerfile bytes 동일성은 미확인이다.
+
+## 소비 계약 테스트 — 명시적으로 승인된 한 파일
+
+Coordinator가 `/Users/seonghobae/orca/projects/law-ai-agent-pg-moa/tests/test_central_ci_caller.py`만 읽도록 추가 승인했다. 42줄의 해당 파일만 읽었다. private product source와 실제 caller workflow는 읽지 않았다.
+
+- immutable 40-hex 중앙 참조 1개, 중앙 실행 중복 금지, contents read, events와 concurrency literal을 검사한다.
+- 테스트 보강 권고: YAML 구조로 `uses`가 job-level인지, push와 pull_request 양쪽 branch 범위가 main인지 확인한다. 현재 branch literal 한 번만 있으면 통과한다. 이는 실제 caller 결함 판정이 아니라 테스트의 증명 범위다.
+- consumer test의 현재 RED3/pass1은 coordinator 관측이며 검토자가 실행하지 않았다. 중앙 SHA pin을 쓰기 전 결과를 최종 gate로 주장하지 않는다.
+
+## 최종 frozen bytes와 직접 bounded probe
+
+14:44–14:46 KST, 다음 SHA256을 full bytes에서 계산했다. 모두 Coordinator freeze receipt와 일치했다.
+
+| 파일 | SHA256 |
+|---|---|
+| `.github/workflows/law-ai-agent-ci.yml` | `3aac714edfb5438c1f7c0eb6420fcff2f43b39692324cd6d7e86c4c103cfc164` |
+| `scripts/ci/law_ai_agent_ci.sh` | `7ee3d7d4f7083d87b921530f4ee3c7ce7dd8041e9611f4429390aa58f9e4e935` |
+| `tests/test_law_ai_agent_ci.py` | `8afd78b82f0c2a270375192eb35454735b1bb192b573bc89027d951b50900b35` |
+| `docs/doctoring/law-ai-agent-central-ci.md` | `08f02306e9aee3d9ca2a4d5ada6b0cc50a492831de08e4712479eec13772e6e5` |
+| `.github/runner-images/law-ai-agent/Dockerfile` | `17596881141c761c5e1a55a81d1b2b76559f6fac3aa8b66e1b705f4990808694` |
+| `docs/doctoring/law-ci-runner-provisioning.md` | `c798d85cc1db6b92113b2463dbbdb9b12b7115c23dbdf02f7fc0937f041af281` |
+
+직접 실행 결과:
+
+- 실제 workflow admission parsed Python body: 정상 main push 허용, mutable 중앙 ref/target event/중앙 caller/uppercase SHA 거부, **5개 PASS**.
+- 실제 helper의 root validator parsed Python body: owned direct-child 허용, nested root/symlink root/0644 marker 거부, **4개 PASS**. validator만 실행했고 stop/remove는 실행하지 않았다.
+- embedded Python **6개 compile PASS**, `bash -n` exit **0**.
+- 승인된 소비 테스트 44줄을 다시 읽었다. Coordinator가 event별 main branch와 job-level uses regex를 추가했음을 확인했다. 실제 caller는 중앙 commit 전이므로 별도 후속 검토다.
+
+## 실행 증거의 경계와 다음 단계
+
+- writer 문서의 macOS native 두 lane/33 central tests 성공은 writer 관측이다. 검토자가 재실행하지 않았다.
+- Coordinator는 final helper `7ee3d7d…`와 consumer baseline `301800bd…`를 사용한 Linux 격리 image에서 3.12.3: 345 pass, skip 0, coverage 98.95%; 3.14.7: 345 pass, skip 0, coverage 98.87%, full quality/offline wheel/cleanup exit 0을 직접 확인했다고 전달했다. 이는 producer 관측이며 검토자 자신의 실행과 구분한다.
+- image SHA, container limits/mounts와 sudo 거부는 provisioning 문서와 Coordinator producer 영수증이다. 문서는 egress 방화벽 미검증, VM 수준 격리 아님, apt 재빌드 결과 가변, ephemeral 이후 새 등록 필요를 명확히 기록했다. 현재 source 검토가 이를 보안 인증으로 확대하지 않는다.
+- inherited PGOPTIONS는 helper에서 제거된다. native server timeout 10s/2s를 유지한다. 단일 job 20분은 품질 lane이며 중앙 모델 검토 timeout 변경이 아니다.
+- 실제 소비 thin SHA caller, 원격 current-head required checks, ordinary protected merge/publish가 남았다. 중앙 기존 review/security gate는 변경하지 않았다. 중앙 이관은 billing/permission gate 우회가 아니다.
+
+
+## 후속 공백 경로 수리 — scratch 검증, 미게시
+
+위 14:44–14:46의 helper `7ee3d7d…` 및 test `8afd78b8…` 값은 당시 frozen source의 역사적 receipt다. 이후 a55 source의 migration inventory·ancestor admission 수리 bytes와 같다는 주장이 아니다. 당시 producer의 DB/wheel 관측을 이 후속 후보의 실행으로 전이하지 않는다.
+
+현재 scratch는 a55 head의 source에 공백 경로용 두 줄 수정과 별도 회귀 테스트를 추가했다. helper SHA-256은 `67b7b11968eed60745537d9e000a5c834f1cfbc22409d8321f16191ac25355f6`이며, 기존 test SHA-256은 `cbc5fa07cb6f004ff32f4f8a89f91d16dbcb4e944f9850af14d64c10e7311a25`, 추가 test SHA-256은 `736eb442735e1d40744edb554a65c087f825079eb91f5dc7650a679d6d3b8800`다.
+
+- RED: 실제 helper에서 추출한 pg_ctl 호출과 conninfo 할당을 실행했다. 공백이 든 path를 shlex token seam으로 확인한 2개 assertion이 실패했다.
+- 최소 GREEN: pg_ctl server option의 socket 값을 double quote하고 conninfo host 값을 single quote했다. 같은 두 assertion은 2 passed, Bash syntax exit 0이다.
+- pg_ctl executable은 합성 capture stub이다. shlex token seam은 실제 libpq parser 또는 native PostgreSQL startup이 아니다. 현재 host PATH에는 PostgreSQL 실행 파일이 없어 실제 native startup은 NOT_RUN이다.
+- 이 후보는 공백 경로만 검증했다. quote/backslash 등 별도 경로 문자에 대한 전체 escaping acceptance를 주장하지 않는다. 실제 native startup과 독립 검토 전 canonical adoption·게시·App 승인으로 확대하지 않는다.
+- 새 base362fed와의 조합은 아직 실행하지 않았다. a55의 이전 full gate를 이 수정이나 새 base의 결과로 전이하지 않는다.
diff --git a/docs/doctoring/law-ci-runner-provisioning.md b/docs/doctoring/law-ci-runner-provisioning.md
new file mode 100644
index 0000000000..1fa421ab41
--- /dev/null
+++ b/docs/doctoring/law-ci-runner-provisioning.md
@@ -0,0 +1,57 @@
+# Law CI 전용 runner 제공 기록
+
+## 목표와 책임
+
+ContextualWisdomLab/law-ai-agent#1의 품질 실행을 중앙 reusable workflow로 옮긴다.
+중앙 issue는 ContextualWisdomLab/.github#2580, GitHub Project #1은 In Progress다.
+사용자는 2026-10-05 KST에 중앙 .github 이관과 self-hosted 전환을 명시했다.
+제품 source와 source 기록은 private consumer에 유지한다. 중앙 public repo에 원문을 복사하지 않는다.
+
+## 2026-10-05 14:25 KST 실측
+
+- 새 group 11, `CWL law CI`: selected repository는 `ContextualWisdomLab/law-ai-agent` (1404539192) 하나.
+- public repository 허용 false, 기존 control/security/signing/GPU/health group 변경 0.
+- 새 runner 1134186 `law-ai-agent-ci-isolated-20261005`: Linux X64, label `law-ai-agent-ci`, online, busy false.
+- 별도 컨테이너: non-root UID1001, mounts [], cap-drop ALL, no-new-privileges, memory2147483648, nanoCPUs2000000000, pids512.
+- host Docker socket, host home/credential, production database volume, published port, host network 사용 0.
+- 컨테이너에서 sudo는 no-new-privileges 때문에 거부된다. 이는 helper에 sudo install이 없다는 전제와 일치한다.
+- immutable base: `ghcr.io/actions/actions-runner@sha256:e5496277be5d09bc968b3d64911b74e219ac4a3f2edce956a3ecf9271bea1ef4`.
+- 로컬 제공 image SHA256 `7eef6dcf639e556ab28c8970978f30b668dc9d21099b8c8d206d3c8d863f7068`.
+- `.github/runner-images/law-ai-agent/Dockerfile`의 SHA256 `17596881141c761c5e1a55a81d1b2b76559f6fac3aa8b66e1b705f4990808694`.
+- native PostgreSQL 16.15와 pg_config bindir `/usr/lib/postgresql/16/bin`를 직접 확인했다.
+- runner 2.337.0과 `Listening for Jobs`를 확인했다. GitHub job 성공 증거는 아니다.
+- 이미지 apt 해석 결과는 위 image에 고정돼 있다. Dockerfile의 apt package는 재빌드 시 바뀔 수 있다. registry 배포/이미지 서명은 수행하지 않았다.
+
+## 재현 운영 계약
+
+이미지 build는 provisioning 때만 수행한다. CI job에서 sudo/apt 설치하지 않는다.
+전용 image는 DB 바이너리를 제공하고 workflow가 uv0.12.5와 Python matrix를 제공한다.
+각 runner는 `--ephemeral --disableupdate --runnergroup 'CWL law CI' --labels law-ai-agent-ci`로 등록한다.
+단일 job 종료 후 등록이 해제된다. 다음 matrix job은 새 컨테이너와 새 등록이 필요하다.
+등록 token은 승인된 GitHub API로 구하고 stdin으로 config.sh에 전달한다.
+`ACTIONS_RUNNER_INPUT_TOKEN`은 등록 child에만 적용하며 stdout·로그·파일·명령 인자에 직접 넣지 않는다.
+서버 .credentials 등의 generated credential 파일은 컨테이너 내부에만 존재한다. 컨테이너 제거 시 함께 회수한다.
+
+컨테이너 생성 옵션은 `--restart=no --cap-drop ALL --security-opt no-new-privileges --memory=2g --cpus=2 --pids-limit=512`다.
+이미지 writable layer는 job 전용이다. host mount를 추가하거나 host 네트워크로 전환하지 않는다.
+같은 명칭의 busy runner는 제거하지 않는다. API의 id/name/group/busy와 컨테이너 owner label을 대조한 뒤 owned idle resource만 회수한다.
+초기 detached stdin 전달은 대기 상태로 남았다. 원인은 detached container의 stdin attachment였다.
+owned unregistered container를 제거하고 `docker exec -i` 등록 → 별도 `docker exec -d` 실행으로 수리했다.
+등록 성공, online, workflow 해석, job 시작, source checkout, 품질 verdict를 별도 확인한다.
+
+## 신뢰 한계와 실제 다음 gate
+
+이 개발용 컨테이너를 VM 수준 격리 또는 hostile workload 보안 인증으로 표현하지 않는다.
+network는 GitHub/toolchain 접근을 위해 존재한다. host private network에 대한 별도 egress 방화벽은 이 기록에서 검증하지 않았다.
+일반 CI가 signing/security runner나 운영 자격을 공유하지 않도록 repo별 group을 사용한다.
+reusable workflow의 runner access와 billing은 caller context다. 중앙 파일 이관은 caller의 계정 admission을 자동 해결하지 않는다.
+issue ContextualWisdomLab/law-ai-agent#2의 정책 정상화 증거와 실제 runner-bound job가 있어야 ordinary merge를 승인한다.
+공급된 runner만으로 성과를 만들지 않는다. 실제 Linux helper/full-suite 기록과 exact-head GitHub job receipt를 별도로 남긴다.
+
+## 공식 근거 (APA 7)
+
+GitHub. (2026, September 3). *GitHub Actions: Early September 2026 updates*. GitHub Changelog. https://github.blog/changelog/2026-09-03-github-actions-early-september-2026-updates/
+
+GitHub. (n.d.). *Reusing workflow configurations*. GitHub Docs. Retrieved October 5, 2026, from https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations
+
+GitHub. (n.d.). *Reuse workflows*. GitHub Docs. Retrieved October 5, 2026, from https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
diff --git a/docs/doctoring/law-ci-test-portability-fix.md b/docs/doctoring/law-ci-test-portability-fix.md
new file mode 100644
index 0000000000..bb15ee74be
--- /dev/null
+++ b/docs/doctoring/law-ci-test-portability-fix.md
@@ -0,0 +1,60 @@
+# Law CI test portability fix
+
+## 범위
+
+2026-10-05 KST. Dispatch `ctx_df60f6521590`.
+기준 HEAD는 `9e482e14c3d31a09e9167af2fafb2edab26fbf12`다.
+수정 파일은 `tests/test_law_ai_agent_ci.py`와 이 새 보고서뿐이다.
+Git commit, push, 원격 게시, runner 설정, 제품 helper 변경은 하지 않았다.
+
+GitHub에서 PR #2581의 head/base와 CodeRabbit comment `4181096101`을 직접 읽었다.
+Finding은 유효했다. 기존 fixture는 `~/.hermes/cache/scratch`가 이미 있어야 했다.
+해당 부모 디렉터리가 없으면 두 parametrize case 모두 child 실패 주입 이전에 실패했다.
+CodeRabbit의 `/tmp` 고정 제안은 적용하지 않았다. 현재 TMPDIR와 canonical 경로 검증을 유지했다.
+
+## RED → GREEN
+
+실행 interpreter는 `/Users/seonghobae/.pyenv/versions/3.14.5/bin/python3`, Python **3.14.5**다.
+환경 snapshot의 3.14.7과 구분한다. 실제 TMPDIR는
+`/var/folders/vq/nxtc622x2lg1xq3jpdktymdw0000gn/T/`였다.
+
+1. 새 subprocess 회귀 테스트를 먼저 추가했다. 빈 HOME, 긴 RUNNER_TEMP, 짧은 TMPDIR에서
+   기존 실제 `test_synthetic_child_failure_and_cleanup_are_not_success[False/True]`를 각각 실행했다.
+2. `python3 -m pytest tests/test_law_ai_agent_ci.py -q -k without_hermes_home`는
+   **2 failed, 33 deselected**였다. 두 child 모두 `.hermes/cache/scratch/lf.*`에서
+   **FileNotFoundError**였다. 이는 추정이나 별도 mock 재현이 아니다.
+3. 테스트 전용 `short_temp_root()`를 추가했다. `tempfile.gettempdir()`의 resolved 경로를 우선한다.
+   `l.` + 8자리 임시 이름과 `/lawci.XXXXXX`를 포함한 24자 예산을 적용한다.
+   생성될 helper scratch는 기존 계약인 **65자 미만**을 유지한다.
+4. 기본 temp 경로가 길면 HOME 아래 `.cache/law-ci-tests`를 canonical 경로로 선택한다.
+   길이를 먼저 검사하고 mode 0700으로 생성한다. 기존 경로의 uid와 private mode도 검사한다.
+   긴 HOME까지 허용하려고 `/tmp` alias나 제품 validator를 우회하지 않는다.
+5. GREEN 회귀 child는 `--basetemp`를 지정해 pytest 자체 임시 파일과 helper scratch를 분리한다.
+   두 case는 child exit **37**, stop 호출, stop 실패 시 보존, 재cleanup을 실제 helper로 확인한다.
+   새 `keep` sentinel은 cleanup 이후에도 내용 `unrelated`를 유지한다.
+   테스트 종료 시 TemporaryDirectory가 이번 실행 디렉터리만 제거한다.
+
+## 최종 검증
+
+| 명령/계약 | 실제 결과 |
+|---|---|
+| 원래 collection | 33 tests |
+| 두 no-Hermes-HOME subprocess + 기존 두 failure case | 4 passed, 31 deselected |
+| `python3 -m pytest tests/test_law_ai_agent_ci.py -q` | **39 passed, 10.18s** |
+| `GITHUB_ACTIONS=true python3 -m pytest tests/test_law_ai_agent_ci.py -q` | **39 passed, 10.88s** |
+| `git diff --check` | exit 0 |
+| 추가 portability 계약 | short temp, symlink alias canonicalization, long temp fallback, TMPDIR 없는 default |
+
+기존 33개와 새 6개가 모두 통과했다. Synthetic PostgreSQL 도구 결과를 실제 DB 실행으로 계산하지 않는다.
+전체 중앙 suite/coverage는 중복 실행하지 않았다. Coordinator의 진행 중 baseline 결과와 별도다.
+중앙 provider/model review timeout은 변경하지 않았다. 독립 리뷰와 보호된 원격 gate는 Coordinator가 소유한다.
+
+## Exact bytes
+
+| 파일 | SHA-256 |
+|---|---|
+| `tests/test_law_ai_agent_ci.py` | `e36b38d67befd4f591c2362fe2306430af8843d8028d7d13e3deb5429bfece79` |
+| `scripts/ci/law_ai_agent_ci.sh` (변경 없음) | `7ee3d7d4f7083d87b921530f4ee3c7ce7dd8041e9611f4429390aa58f9e4e935` |
+| `.github/workflows/law-ai-agent-ci.yml` (변경 없음) | `3aac714edfb5438c1f7c0eb6420fcff2f43b39692324cd6d7e86c4c103cfc164` |
+
+보고서 자체의 SHA-256은 handoff에서 따로 전달한다.
diff --git a/docs/doctoring/maturin-download-response-lifecycle-20261001.md b/docs/doctoring/maturin-download-response-lifecycle-20261001.md
new file mode 100644
index 0000000000..b6765daae8
--- /dev/null
+++ b/docs/doctoring/maturin-download-response-lifecycle-20261001.md
@@ -0,0 +1,44 @@
+# Maturin download response-lifecycle RCA
+
+## Incident
+
+Trusted uv Materializer run `36811202519`, job `110206427182`, checked out
+`.github#1653@5cd141ec2c33b631d164af936cd1c9de70e4c9a4`. All 5,314 tests passed,
+but the complete repository gate reported 99% coverage. The only incomplete
+owner was `scripts/ci/verify_release_maturin_tool_assets.py`: five statements
+and two branches in its non-200 and `HTTPError` response paths.
+
+## Root cause and boundary
+
+The bounded downloader belongs to the central `.github#2530` successor, not
+the #1653 label-taxonomy delta. Its nullable `response` finalizer encoded a
+false branch that cannot fall through: when `opener.open()` raises, control
+re-raises from the `HTTPError` handler before the code following the finalizer.
+That made honest 100% branch evidence impossible even though successful
+responses were closed. The Trusted uv workflow path filter also omitted this
+verifier and its tests, so fixing the canonical owner would not itself request
+the complete gate that originally exposed the defect downstream. After the
+path repair, owner head `8cf2ea5f73976d47b2267fb52ac28284323404b7`
+still produced no gate because the workflow admitted only PRs whose base was
+`main`, while #2530 is correctly stacked on canonical owner #2531.
+
+## Repair
+
+The downloader now closes every returned response in one unconditional nested
+`finally` block. An opener-raised `HTTPError` remains independently closed by
+its handler. Tests assert closure for both an HTTP 503 response and an HTTP 502
+exception. A workflow contract now requires both verifier paths in pull-request
+and protected-branch triggers, and a separate contract admits stacked PR bases
+while the push trigger remains restricted to protected `main`. The repair does
+not change admitted hosts, the one-hop redirect
+contract, credentials, request timeout, byte bounds, digests, or error mapping.
+
+## Evidence and remaining gates
+
+- Hosted RED: 5,314 passed, 5 skipped, 40 subtests; 18,775 statements with 5
+  missing, 7,652 branches with 2 partial; total 99%.
+- Local owner GREEN: 17 focused tests; 107/107 statements and 34/34 branches;
+  `git diff --check` clean.
+- Required before acceptance: complete exact-head hosted suite, security and
+  CodeQL verdicts, qualifying independent approval, ordinary owner integration,
+  then ordinary merge-forward into #1653 and fresh consumer Checks.
diff --git a/docs/doctoring/noema-document-reader-dependency-baseline-20261001.md b/docs/doctoring/noema-document-reader-dependency-baseline-20261001.md
new file mode 100644
index 0000000000..4e723f2040
--- /dev/null
+++ b/docs/doctoring/noema-document-reader-dependency-baseline-20261001.md
@@ -0,0 +1,33 @@
+# Noema document-reader dependency baseline
+
+## Incident
+
+Security Scan run
+[`36773087489`](https://github.com/ContextualWisdomLab/.github/actions/runs/36773087489),
+Trivy job `110084194330`, found three medium-severity vulnerabilities in the
+generated Noema document-reader lock at exact PR head
+`a99784219305d1b6e14cf76f0acea30c5ee45e21`:
+
+- `fast-uri` 3.1.7: CVE-2026-86472 / GHSA-hrr3-gc8f-f4qj;
+- `ip-address` 10.7.0: CVE-2026-101911 / GHSA-h3mg-xc3c-68pw; and
+- `ip-address` 10.7.0: CVE-2026-101912 / GHSA-j6r3-76f7-8jcv.
+
+The upstream fast-uri advisory fixes the 3.x line in 3.1.8. The ip-address
+advisories fix both findings in 10.7.1; this lock selects the first patched 10.7.1
+release within the existing `^10.2.0` transitive range.
+
+## Ownership and decision
+
+The vulnerable file is owned by the central `.github` Noema document-reader
+runtime, so the repair stays in that owner instead of patching consumer
+repositories. The direct manifest is unchanged. `npm update` regenerated only
+the two transitive lock entries, including registry URL and integrity digest.
+
+## Verification and remaining gate
+
+`tests/test_noema_document_reader_runtime_dependencies.py` first failed on
+3.1.7 and 10.7.0, then passed with exactly one safe entry for each package.
+The focused Python context suite passed 14 tests with 2 skipped, `npm ci
+--ignore-scripts` reproduced the lock, and `npm audit --omit=dev
+--audit-level=moderate` reported zero vulnerabilities. Hosted Security Scan,
+CodeQL, independent approval, and ordinary protected merge remain required.
diff --git a/docs/doctoring/product-gap-baseline-source-integrity-20261001.md b/docs/doctoring/product-gap-baseline-source-integrity-20261001.md
new file mode 100644
index 0000000000..a009f92bbb
--- /dev/null
+++ b/docs/doctoring/product-gap-baseline-source-integrity-20261001.md
@@ -0,0 +1,28 @@
+# Product gap baseline source-integrity repair
+
+## Incident
+
+Repository Metadata Reconcile run `36777030872`, job `110097412873`, ran
+against `.github#2530@61a3f2ebbf6adf9c237a647552ccffeb52b00f47`.
+Five tests failed because `docs/product-technical-gap-baseline.md` began with
+a connector display warning and contained only 433 lines. The previous complete
+artifact contained 3,703 lines and 361,021 bytes.
+
+## Root cause
+
+Commit `bd3cfe8645844ec7b140a1b73d2b339f8e4283dc` attempted to change one
+dependency-floor row, but persisted a truncated connector rendering instead of
+the Git blob. This removed G-17 publication evidence, the 107-row live
+inventory, APA 7th references, and buyer-facing PRD/TRD/UML/Gap evidence.
+
+## RED to GREEN
+
+- RED `c8d41f52962814d080a1c4947acbff2f3f9bb81e` rejects the connector warning
+  and output-line banner at the artifact boundary.
+- GREEN restores the complete parent blob and reapplies only the intended
+  `ip-address` 10.7.1 dependency-floor row.
+- The focused integrity, gap-baseline, and published-lineage tests must pass
+  before the full warnings-fatal repository suite is accepted.
+
+Hosted exact-head Metadata, authenticated agent verdicts, and independent
+approval remain required; this record is not merge authorization.
diff --git a/docs/doctoring/shared-security-baseline-pyjwt-pyo3-20260930.md b/docs/doctoring/shared-security-baseline-pyjwt-pyo3-20260930.md
new file mode 100644
index 0000000000..d0f1cbbb2b
--- /dev/null
+++ b/docs/doctoring/shared-security-baseline-pyjwt-pyo3-20260930.md
@@ -0,0 +1,157 @@
+# Shared PyJWT and PyO3 security baseline repair
+
+## Status and decision
+
+**Proposed; release HOLD.** The central `.github` repository owns both affected
+dependency surfaces, so the repair belongs on a protected-main foundation PR.
+It must not be copied into PR #1026, which changes neither lock. The owner repair
+must pass exact-head review and hosted security Checks, merge ordinarily, and
+then reach #1026 through a non-force merge from protected `main`.
+
+## Exact incident evidence
+
+PR [#1026](https://github.com/ContextualWisdomLab/.github/pull/1026) was observed
+at exact head `6f645a73502e159d5a229805afa34868ad9bb851` against protected
+`main@37b10243cec3d160ecc9c1be75c71428b160a703`.
+
+- [Security Scan run 36495499815](https://github.com/ContextualWisdomLab/.github/actions/runs/36495499815),
+  job `109380628690`, reported PyO3 `0.22.6` in
+  `tests/fixtures/coverage-cargo/Cargo.lock`: GHSA-36hh-v3qg-5jq4 (High, 8.0)
+  and GHSA-chgr-c6px-7xpp (Medium, 5.5). Both advisories fix the defect in
+  PyO3 `0.29.0`; this repair selects and locally verifies `0.29.2`.
+- [Python Security run 36495499871](https://github.com/ContextualWisdomLab/.github/actions/runs/36495499871),
+  job `109380725819`, reported PyJWT `2.13.0` in
+  `requirements-strix-ci-hashes.txt` as affected by CVE-2026-102274. PyJWT
+  `2.14.0` is the fixed release.
+- The exact #1026 diff changes neither vulnerable file. The same lock bytes
+  were present on protected `main`, establishing a shared baseline defect rather
+  than a PR-specific regression.
+
+## Root cause and operational scenarios
+
+PyJWT was only a transitive MCP dependency, so the generated Strix lock could
+select a newly vulnerable release without an explicit reviewed source pin. A
+malformed RSA JWK can raise a plain `ValueError` and abort processing of the
+whole JWK Set. An operator can therefore lose otherwise valid signing keys and
+fail authentication or review-agent startup because one untrusted key is bad.
+
+The offline Rust coverage fixture intentionally pins exact crate releases, but
+its PyO3 pin was not advanced when the two 2026 advisories were published. One
+defect permits an out-of-bounds read from iterator methods; the other omits a
+required `Sync` bound and permits a data race. Even though this is a test
+fixture, the central scanner correctly treats its lock as executable supply
+chain material.
+
+## RED to GREEN contract
+
+RED commit `cd84d887` introduced two fail-closed contracts:
+
+1. `requirements-strix-ci.txt` must explicitly select PyJWT `2.14.0`, and the
+   generated hash lock must contain the same version.
+2. The Rust coverage fixture manifest and lock must both select PyO3 `0.29.2`.
+
+The implementation adds the direct PyJWT input, regenerates the Python 3.13
+manylinux hash lock with the repository command, advances the exact PyO3
+manifest pin, and regenerates the Cargo lock with Rust `1.97.1`. The
+cryptography override remains single-purpose; it does not become a general
+security-version overlay.
+
+## Ownership, release, and failure recovery
+
+The fixed-source release workflows consume `requirements-strix-ci-hashes.txt`
+from immutable central revisions. This PR repairs the canonical owner bytes but
+does not rewrite those workflows to an open branch. After ordinary protected
+merge, a separate consumer change must advance their exact source commit and
+rerun API/schema, security, SBOM, and provenance evidence. If any exact-head
+scanner, build, or independent review fails, the PR remains HOLD and the root
+cause is repaired here; no bypass or mutable source reference is permitted.
+
+## Local verification on the repaired tree
+
+- Focused dependency, fixed-source, Maturin asset, and Rust toolchain contracts:
+  48 passed, 1 skipped.
+- Repository regression suite: 5,160 passed, 11 skipped, 40 subtests passed.
+- Rust `1.97.1` `cargo check --locked`: passed for the coverage fixture.
+- Python lock regeneration with `uv 0.12.18`, seeded with the existing reviewed
+  output, was byte-identical. Input SHA-256 values were `c3812261…` for
+  `requirements-strix-ci.txt` and `3b745514…` for the override; the output was
+  `8f8318d4…`. A hash-enforced installation loaded PyJWT `2.14.0`. A fresh
+  unseeded solve is intentionally not claimed to be byte-identical because it
+  may select newer allowed transitive releases.
+- `pip-audit`: no known vulnerabilities in the Strix lock. OSV's direct
+  `pyo3@0.29.2` query returned no vulnerability records.
+
+No production Python module changes in this repair. The repository-wide
+coverage and docstring commands expose separate protected-main baseline debt:
+coverage is 99% (178 statements missing) and `interrogate scripts/ci` is 97%
+(43 docstrings missing). Those failures are not waived or called green here;
+they require their own bounded owner repair before the repository can claim the
+100% global gates.
+
+## References
+
+GitHub. (2026, June 12). *Out-of-bounds read in PyO3 iterator methods*
+(GHSA-36hh-v3qg-5jq4). GitHub Advisory Database.
+https://github.com/advisories/GHSA-36hh-v3qg-5jq4
+
+GitHub. (2026, June 12). *PyO3 missing Sync bound can lead to a data race*
+(GHSA-chgr-c6px-7xpp). GitHub Advisory Database.
+https://github.com/advisories/GHSA-chgr-c6px-7xpp
+
+Open Source Vulnerabilities. (2026). *CVE-2026-102274: PyJWT RSA JWK Set
+availability failure*.
+https://osv.dev/vulnerability/CVE-2026-102274
+
+## 2026-10-01 urllib3 audit follow-up
+
+Python Security run `36733279716`, job `109949358063`, found two newly
+published vulnerabilities in urllib3 2.7.0: CVE-2026-97687 permits target TLS
+policy to weaken or replace HTTPS proxy TLS policy, and CVE-2026-97689 permits
+an unbounded chunk-size line to consume memory in streaming clients. Both are
+fixed in urllib3 2.8.0. The same vulnerable transitive pin appeared in the
+pip-audit and Strix hash locks, so this remains one central security-owner
+repair rather than two consumer workarounds.
+
+The repair adds urllib3 2.8.0 to both source inputs and regenerates both locks
+with their recorded uv commands. A contract requires exactly one 2.8.0 row in
+each source input and generated lock. Comparison against exact predecessor
+`d1aa3659fca527a6c7330151f3ab4df3d7578391` shows no unrelated package-version
+movement. Repeated compilation produced identical SHA-256 digests, and
+pip-audit 2.10.1 reported no known vulnerabilities for either generated lock.
+These local results are not merge authority: exact-head hosted security Checks,
+terminal authenticated CodeQL evidence, independent approval, and ordinary
+protected merge remain required.
+
+## 2026-10-01 PyJWT recursion denial-of-service follow-up
+
+Security Scan run [36741151937](https://github.com/ContextualWisdomLab/.github/actions/runs/36741151937)
+found GHSA-42vr-xj54-vc7v /
+CVE-2026-101918 in PyJWT 2.14.0. Dependency Review job `109975641239` and OSV
+job `109975641271` both rejected that shared Strix lock. An attacker-controlled,
+deeply nested unsigned JWT payload can exhaust Python recursion during unverified
+payload parsing in `PyJWKClient.get_signing_key_from_jwt`, before key lookup,
+and raise an uncaught request-level exception;
+the available evidence does not establish a process crash or authentication
+bypass. PyJWT 2.15.0 contains the upstream fix.
+
+The canonical-owner repair advances the explicit source pin and generated lock
+to 2.15.0. Lock regeneration changes only the PyJWT version and its wheel/sdist
+hashes; urllib3 2.8.0, PyO3 0.29.2, and the single-purpose cryptography override
+remain unchanged. The existing parity test was first changed to require 2.15.0
+and failed against the 2.14.0 source and lock before implementation. Hosted
+exact-head Security, CodeQL, independent approval, ordinary protected merge,
+and immutable consumer-pin advancement remain release gates.
+
+Local verification used the hosted-workflow Python 3.12 line. The focused
+source/lock contract passed 5 tests and the warnings-as-errors repository suite
+passed 5,167 tests, 6 skips, and 40 subtests. Repeating the recorded `uv 0.12.18`
+compile command was byte-identical at lock SHA-256 `76443a3300d0…`; a
+hash-enforced, no-dependency installation loaded PyJWT 2.15.0 and urllib3 2.8.0.
+`pip-audit 2.10.1` reported no known vulnerabilities. The repository's existing
+97% docstring baseline remains a separate HOLD and is not represented as green.
+An independent review found no remaining Critical, Important, or Minor finding
+after correcting the advisory's attack-vector wording.
+
+GitHub. (2026). *PyJWT has a denial of service vulnerability via maliciously
+crafted JWT token with deeply nested payload* (GHSA-42vr-xj54-vc7v).
+https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v
diff --git a/docs/doctoring/shared-security-litellm-credential-exfiltration-20261001.md b/docs/doctoring/shared-security-litellm-credential-exfiltration-20261001.md
new file mode 100644
index 0000000000..fc573fc8e1
--- /dev/null
+++ b/docs/doctoring/shared-security-litellm-credential-exfiltration-20261001.md
@@ -0,0 +1,53 @@
+# Shared Strix LiteLLM credential-exfiltration RCA
+
+## Incident binding
+
+On 2026-10-01, `.github` PR #2531 exact head
+`516471fbe7d4e93a50c7bbba20402447f06f8d8b` failed Python Security run
+`36799069276`, job `110169140365`. The unmodified
+`requirements-strix-ci-hashes.txt` selected LiteLLM 1.94.1, and `pip-audit`
+reported CVE-2026-84377 / GHSA-3cv6-jpf6-8222. The advisory describes an
+authenticated request-body routing override that can redirect an upstream call,
+exfiltrate configured provider credentials, and reach internal services.
+
+This is a canonical control-plane dependency defect, not a product-PR finding
+and not an audit-service transient. The same exact head also failed Trivy on the
+Noema document reader's `fast-uri` 3.1.7 and `ip-address` 10.7.0. Stacked PR
+#2545 already owns and proves the minimal Node transitive repair, so its ordinary
+commit is preserved in the repaired #2531 ancestry instead of being copied or
+reimplemented.
+
+## Test-first repair
+
+The RED contract
+`test_strix_litellm_security_pin_is_an_explicit_lock_input` first failed because
+the source input did not own a LiteLLM pin. The minimal repair:
+
+1. selects `litellm==1.94.3` in `requirements-strix-ci.txt`, the first patched
+   release in the retained 1.94 line;
+2. regenerates `requirements-strix-ci-hashes.txt` with the repository's declared
+   `uv pip compile --generate-hashes` command;
+3. requires exact source/lock parity so a future resolver run cannot silently
+   restore an affected release; and
+4. preserves #2545's `fast-uri==3.1.8` and `ip-address==10.7.1` source overrides,
+   lock, and nested-copy regression contract as unchanged ancestry.
+
+No scanner finding is ignored or suppressed. `pip-audit` over the repaired
+hash lock reports no known vulnerabilities. At repaired exact head
+`fe879f7b7f48f729f757e03851bf61149470ccb5`, Python Security run `36800615364`,
+Security Scan run `36800615435`, SAST run `36800615456`, and runtime-quality run
+`36800615444` are terminal GREEN. CodeQL run `36800615319` remains fail-closed:
+both language jobs recorded `verdict=pending` while the exact-head dispatch job
+succeeded. A qualifying independent approval and ordinary protected merge are
+still required; local or partial hosted evidence is not merge authorization.
+
+## References
+
+BerriAI. (2026, August 26). *Authenticated SSRF and provider-credential
+exfiltration via unvalidated request-body routing parameters*
+(GHSA-3cv6-jpf6-8222) [Security advisory]. GitHub.
+https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222
+
+National Institute of Standards and Technology. (2026). *CVE-2026-84377*.
+National Vulnerability Database.
+https://nvd.nist.gov/vuln/detail/CVE-2026-84377
diff --git a/docs/doctoring/trusted-review-archive-transient-retry.md b/docs/doctoring/trusted-review-archive-transient-retry.md
new file mode 100644
index 0000000000..341f79323d
--- /dev/null
+++ b/docs/doctoring/trusted-review-archive-transient-retry.md
@@ -0,0 +1,37 @@
+# Trusted review archive transient retry
+
+## Incident
+
+Bounded Noema continuation run
+[`36760921156`](https://github.com/ContextualWisdomLab/.github/actions/runs/36760921156),
+job `110043067331`, resolved the trusted workflow source to protected
+`main@37b10243cec3d160ecc9c1be75c71428b160a703` and then failed before model
+setup. The GitHub archive API returned HTTP 502 while the workflow executed a
+single `curl -fsSL` request. The source revision, target pull request, and model
+route were not the cause.
+
+## Decision
+
+The three central workflows that materialize the same immutable trusted archive
+use `curl --retry 3 --retry-all-errors --retry-delay 1 --retry-max-time 30`.
+This is a bounded transport repair at the canonical `.github` owner. It does
+not select a mutable ref, bypass archive extraction checks, change credentials,
+or convert a terminal failure into success.
+
+## Alternatives
+
+- Manual rerun was rejected because it would not repair the repeated control
+  path.
+- A custom retry helper was rejected because native `curl` already provides the
+  bounded behavior and another abstraction would enlarge the trusted surface.
+- An unbounded loop was rejected because it could occupy review capacity without
+  a terminal result.
+
+## Verification and remaining gate
+
+`tests/test_trusted_archive_retry_behavior.py` runs the production command from
+each workflow against a local server that returns one 502 followed by a 200.
+The test was RED on the predecessor and GREEN after the bounded retry options.
+Hosted exact-head Checks, unresolved-thread review, qualifying independent
+approval, and ordinary protected merge remain required. A local GREEN result is
+not merge authorization.
diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md
index 6e5f1c549a..88bdaf0b30 100644
--- a/docs/product-technical-gap-baseline.md
+++ b/docs/product-technical-gap-baseline.md
@@ -1,5 +1,73 @@
 # Product and Technical Gap Baseline
 
+## 2026-10-09 reusable R matrix conservation
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| `.github#2565@6e924f32a2dbaa0950709c6d8f1391fc1058ef43` printed `STOP` for unsupported R platform legs but returned exit 0 whenever at least one Ubuntu leg remained; the workflow then expanded only the filtered output, so a required macOS, Windows, ARM, or unknown check could disappear while the reusable workflow passed | RED changed the existing executable contract to require the mixed Ubuntu+macOS+Windows+ARM matrix to fail; exact-parent execution failed because the script returned 0 and emitted only Ubuntu. The inline workflow copy had identical behavior | **PRD:** requested required checks are conserved or the request fails; partial silent execution is forbidden. **TRD/RCA:** reject the entire matrix on the first unsupported leg and return the original rows only when every row is admitted; keep the owner script byte-equivalent to the workflow inline copy. **Context Map:** central `.github` owns reusable R admission; product callers consume the released contract. **Flow:** `caller matrix → validate every row → all admitted → fixed isolated Linux/x64 execution`, otherwise `STOP / nonzero`. DB/UI/ERD changes are N/A | **Proposed / focused RED→GREEN complete; full exact-tree verification, hosted exact-head Checks, isolated-capacity canary, and qualifying independent approval remain required** |
+
+## 2026-10-07 security scanner runner isolation
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| `.github#2565@3b35d3d427d17f71472d3bf52ba179338011c17a` restored the pinned Trivy binary cache on one self-hosted runner but could not execute `trivy`, while the completed OSV comparison was reclassified as failed only because optional debug-artifact storage quota was exhausted | Security run `37242578328`; Trivy job `112314054734` logged cache hit followed by `entrypoint.sh: line 88: trivy: command not found` (exit 127). OSV job `112314054619` found no PR-introduced issue and uploaded SARIF before `Upload OSV debug artifacts` failed with `Artifact storage quota has been hit` | **PRD:** a buyer-visible security verdict must represent scanner findings, not runner-local cache state or optional retention quota. **TRD/RCA:** disable `trivy-action` binary caching across the heterogeneous isolated runner group and make only OSV debug retention non-blocking; the base/head reporter and SARIF path remain fail-closed. **Context Map:** central `.github` owns security workflow execution; product repositories consume the released required-workflow contract. **Flow:** `exact head checkout → pinned scanner install → finding gate → SARIF → optional debug retention`. DB/UI/ERD changes are N/A. RED `cc42969b…` failed 2/2 contracts; GREEN `26f993c0…` passes focused tests normally and under `GITHUB_ACTIONS=true`, plus 5,488 passed, 10 skipped, 40 subtests repository-wide | **Proposed / source and contract repair published; fresh exact-head hosted security evidence, isolated-capacity canary, unresolved-thread zero, and qualifying independent approval required** |
+
+## 2026-10-03 isolated self-hosted runner authority boundary
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| `.github#2565@d6ba56d04e22476b2ea41bfe7bb26e2cbc98f98f` routed ordinary jobs and non-main fallbacks by the mutable `cwlab-ci-isolated` label alone, although the PR's own doctoring stated that a generic label does not attest separation; GitHub does not validate OS/architecture label truth, so a privileged or persistent runner with matching labels and repository access could receive untrusted work | RED contract `test_isolated_label_is_scoped_to_dedicated_runner_group` failed first at `.github/workflows/actions-queue-health.yml`; the reviewed tree contained 63 affected `runs-on` declarations across direct, conditional, CodeQL and R-matrix selectors | At the central `.github` owner, require both the dedicated `CWL CI isolated` runner group and existing labels for every isolated selector; preserve trusted-main groups and repository predicates; update exact workflow oracles and rollout doctoring; keep Draft/HOLD until the group, access policy, disposable capacity, cleanup proof, canary and exact-head Checks exist | **Proposed / local RED→GREEN complete; operator capacity, exact-head hosted Checks and qualifying independent approval required** |
+| `.github#2565@cd49a60f1299fb8f7984de8d8ba223db673f7b84` wrapped the reusable R runner JSON in unescaped literal braces inside GitHub `format()`, so expression evaluation treated `"group"` as a replacement field and failed before any matrix job could request a runner; the prior test asserted that defective source literal instead of rendering it | RED `f9211898d83f039cdf7ff82c8f93c72c9c10dceb` added a behavior contract that renders and parses the exact template for Linux, Windows, macOS and an unsupported OS; focused result was 1 failed / 7 passed with `KeyError: '"group"'`. GREEN `7fc1e2e8ad5091adff6c56b501e93d1d4ac2f211` doubles only the outer JSON braces and passes 8/8 normally and with `GITHUB_ACTIONS=true` | Preserve `{0}`/`{1}` substitutions and the original matrix OS label, render one valid group-scoped selector for every supported/unsupported branch, and keep the PR Draft/HOLD until the independent runner-group prerequisites and hosted exact-head gates are satisfied | **Proposed / local RED→GREEN complete; no runner capacity or merge authority claimed** |
+| `.github#2565@f0f7ed988fba5d94eda6513f35d171f23c4bd9a5` inserted caller-controlled `matrix.config.os` inside a quoted JSON string; a quote-bearing label could add duplicate `group` and `labels` members whose last values replaced the fixed isolation boundary | Exact-head RED updated the source contract to require an unquoted `{1}` JSON value plus `toJSON(matrix.config.os)`; before source repair the focused result was 2 failed / 6 passed, after repair 8/8 passed. The behavioral matrix includes benign Linux/Windows/macOS/unsupported labels, a duplicate-key injection string, and backslash/newline data. Full warning-fatal verification is 5,439 passed, 10 skipped, 40 subtests with 18,830/18,830 statements and 7,684/7,684 branches covered. Exact-head public-doc coverage initially exposed two inherited Maturin helper gaps; adding their public contracts restored 100%, and compileall/diff checks pass | **PRD:** untrusted reusable-workflow input must remain data and cannot select privileged capacity. **TRD/RCA:** serialize the OS label exactly once at the GitHub expression boundary, then parse one selector with fixed group and mandatory labels. **Context Map:** central `.github` owns runner admission; callers supply labels through the released workflow contract only. **Flow:** `r_matrix JSON → matrix.config.os → toJSON → format value slot → fromJSON → fixed runner group`. DB/UI/ERD changes are N/A. Require hosted exact-head security/quality Checks, isolated capacity canary, cleanup proof, and qualifying approval | **Proposed / local RED→GREEN and full verification complete; hosted/operator gates pending** |
+
+## 2026-10-01 Maturin response-lifecycle coverage closure
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| `.github#1653@5cd141ec2c33b631d164af936cd1c9de70e4c9a4` passed all 5,314 tests but failed the complete branch gate because the canonical Maturin downloader left five error-path statements and two branches unexecuted; the owner workflow omitted both verifier paths and stacked PR bases | Trusted uv Materializer run `36811202519`, job `110206427182`; `verify_release_maturin_tool_assets.py` 95%, missing lines 104 and 106-112 plus branch 114→116; no owner run at #2530 predecessor `8cf2ea5f73976d47b2267fb52ac28284323404b7` because its base was #2531 rather than `main` | Repair canonical successor `.github#2530`: exercise non-200 and opener-raised `HTTPError` closure, replace the impossible nullable-response finalizer with one unconditional response-owned close scope, add source/test and stacked-PR trigger contracts to the complete gate while retaining protected-main push scope, preserve all network and fail-closed boundaries, then ordinary-merge the accepted owner head into #1653 | **Proposed / hosted RED reproduced; focused verifier coverage GREEN locally; path and stacked-admission contracts RED→GREEN; exact-head hosted full-suite, security, CodeQL, and independent approval required** |
+
+## 2026-10-01 bounded Maturin release downloader SAST closure
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| The canonical Maturin asset verifier replaced a suppressed dynamic `urlopen` call with direct `HTTPSConnection`, but Semgrep's low-confidence certificate-validation audit still rejects every use of that low-level API | `.github#2531@e33d97d022e1c1a26b35d51f9fa4b695fe969547`; SAST run `36802256836`; job `110178968784`; rule `python.lang.security.audit.httpsconnection-detected.httpsconnection-detected` | At source-repair head `eede925e71e0f1526560a305f5219a13c6631227`, replace the low-level connection with a standard-library opener whose redirect handler admits one credential-free HTTPS hop only from the fixed GitHub release path to the exact release-assets host; preserve bounded reads and terminal response closure; prohibit scanner suppressions | **Proposed / RED scanner-contract reproduction and 31 tests plus 4 subtests GREEN locally; source-repair exact-head Security, Python Security, SAST, and runtime-quality GREEN; terminal CodeQL and independent approval required** |
+
+## 2026-10-01 gap baseline source integrity
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| A connector display truncation was committed as the baseline source, removing 3,270 lines of PRD/TRD/UML, Gap-register, APA 7th, and live-inventory evidence | Repository Metadata Reconcile run `36777030872`; job `110097412873`; exact broken head `.github#2530@61a3f2ebbf6adf9c237a647552ccffeb52b00f47`; RED `c8d41f52962814d080a1c4947acbff2f3f9bb81e` | Restore the last complete 3,703-line source blob, reapply only the intended first-patched dependency-floor row, and reject future connector truncation banners in the repository quality gate | **Proposed / local RED→GREEN complete; exact-head hosted Metadata and independent approval required** |
+
+## 2026-10-01 Noema document-reader transitive security baseline
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| The generated Noema document-reader lock selected `fast-uri` 3.1.7 and `ip-address` 10.7.0 after CVE-2026-86472, CVE-2026-101911, and CVE-2026-101912 were published | Security Scan run `36773087489`; Trivy job `110084194330`; exact predecessor `.github#2530@a99784219305d1b6e14cf76f0acea30c5ee45e21` | At the central `.github` owner, regenerate only the two transitive entries to `fast-uri` 3.1.8 and the first patched `ip-address` 10.7.1 release, scan every hoisted or nested lock entry in a regression contract, reproduce with `npm ci`, and require a zero-vulnerability npm audit | **Proposed / local RED→GREEN and audit complete; exact-head hosted security and independent approval required** |
+
+## 2026-10-01 shared Strix LiteLLM credential-exfiltration closure
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| The shared Strix hash lock selected LiteLLM 1.94.1, which is affected by CVE-2026-84377 / GHSA-3cv6-jpf6-8222 and can expose configured provider credentials through authenticated routing overrides | Failing predecessor `.github#2531@516471fbe7d4e93a50c7bbba20402447f06f8d8b`, Python Security run `36799069276`, job `110169140365`; repaired exact head `fe879f7b7f48f729f757e03851bf61149470ccb5`, Python Security run `36800615364`, Security Scan run `36800615435`, SAST run `36800615456`, and runtime-quality run `36800615444` | Preserve stacked #2545's Noema document-reader transitive repair, add a direct `litellm==1.94.3` source floor, regenerate the complete hash lock, bind source and lock with a RED-to-GREEN regression, and require authenticated CodeQL verdict evidence plus independent approval | **Proposed / dependency, security, SAST, and runtime-quality Checks GREEN; CodeQL run `36800615319` fail-closed pending authenticated verdicts; independent approval required** |
+
+## 2026-10-01 trusted review archive transient transport
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| Required Noema resolved the correct immutable trusted source but a single GitHub archive API HTTP 502 exhausted materialization before model setup | `.github` run `36760921156`, job `110043067331`; protected source `37b10243cec3d160ecc9c1be75c71428b160a703`; combined successor predecessor `.github#2530@5b3a76ea71d7ae2fa9b1719f4f82df8d52e98082` | At the central `.github` owner, add bounded native transport retries to Noema, OpenCode, and merge-scheduler trusted archive downloads; prove the actual commands against a deterministic 502→200 server without changing exact-SHA, credential, extraction, or fail-closed contracts | **Proposed / local RED→GREEN complete; exact-head hosted Checks and independent approval required** |
+
+## 2026-10-01 PyJWT recursion denial-of-service closure
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| The shared Strix source and hash lock retained PyJWT 2.14.0 after GHSA-42vr-xj54-vc7v / CVE-2026-101918 disclosed an unauthenticated recursion DoS | Security Scan run `36741151937`; dependency-review job `109975641239`; OSV job `109975641271`; dependent `.github#2540@612d8e77cf13eba84782a22587a72d3ffb4b6c6e`; canonical owner PR #2531 predecessor `dde3ea7876ceb1569db717975cc74f44cc8d18f9` | In canonical owner PR #2531, advance source and lock to 2.15.0 without unrelated package movement, preserve exact source/lock parity, and merge-forward dependent branches only after owner acceptance | **Proposed / exact-head Checks and independent approval required** |
+
+## 2026-10-01 shared urllib3 security closure
+
+| Gap | Exact evidence | Action | Status |
+|---|---|---|---|
+| pip-audit and Strix locks retained urllib3 2.7.0 after CVE-2026-97687 and CVE-2026-97689 were published | Python Security run `36733279716`, job `109949358063`; exact predecessor `d1aa3659fca527a6c7330151f3ab4df3d7578391` | In canonical owner PR #2531, pin urllib3 2.8.0 in both source inputs, regenerate both hash locks without unrelated version movement, and bind all four files with one contract | **Proposed / exact-head Checks and independent approval required** |
+
 작성 기준일: **2026-08-26 10:35 KST**
 대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계
 현재 보호된 `main`: `826b92394c63deb6981c3a8d16a724d71f85a0d7`
@@ -7,10 +75,46 @@
 
 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다.
 
+### 2026-09-30 central coverage owner stack delta
+
+| Gap ID | 상태 | exact-head evidence | causal owner / next gate |
+|---|---|---|---|
+| CONTROL-CENTRAL-COVERAGE-OWNER-01 | **Proposed — complete local integration GREEN; hosted exact-head acceptance pending** | Current coverage owner `.github#2521@61fb469a…`, parser/security/response integration successor `.github#2530@2510618f…`, GitHub API response-lifecycle owner `.github#2532@9d3ec75d…`를 ordinary two-parent merge로 보존했다. 첫 integrated warning-fatal run은 `5196 passed, 6 skipped` 뒤 queue/Strix/release prescreen/release dependency의 실제 미실행 분기 90개와 partial branch 29개를 드러냈다. Dummy/live-CLI tests를 bounded behavior contracts로 교체하고, exact Git blob·Cargo development lock·runtime receipt·final fanout cap·Python 3.10 TOML fallback을 검증했으며, 앞선 필수조건 때문에 도달 불가능했던 prescreener postcondition만 제거했다. 두 live head를 재수집·일반 병합한 combined successor는 `5291 passed, 5 skipped, 40 subtests passed`, owned production `18729/18729` statements 및 `7642/7642` branches, Docstring 100%, warning 0이다. | Canonical owner는 중앙 `ContextualWisdomLab/.github`이며 source delta는 ordinary merge ancestry로만 통합한다. #2530과 #2521의 live head 이동을 재수집해 force 없이 merge했고 새 integrated tree 전체를 재검증했다. 게시된 #2530 exact head의 hosted security/quality Checks 및 qualifying independent approval을 새로 확인한다. queued/skipped/pending을 성공으로 간주하지 않고 #2521/#2530/#2532를 단순 Close하지 않는다. [RCA와 검증 근거](doctoring/central-coverage-owner-stack-2521.md). |
+
+### 2026-09-30 full-suite parser-lock incident delta
+
+| Gap ID | 상태 | exact-head evidence | causal owner / next gate |
+|---|---|---|---|
+| CONTROL-QUALITY-FULL-SUITE-PARSER-LOCK-01 | **Proposed — `.github#2530` combined successor preserves live parser, security, response-lifecycle, and coverage heads; hosted acceptance pending** | Protected `main@37b10243…`의 common quality lock만 설치하는 전체 suite가 `defusedxml`을 찾지 못해 collection error 13건으로 중단됐고, 같은 suite의 신규 workflow 계약은 `yaml`을 import한다. Concurrent-head 재검증 뒤 live #2530 `2510618f…`와 live #2521 `61fb469a…`를 Force Push·rebase 없이 ordinary merge했다. 이 ancestry는 security prerequisite #2531 `d1aa3659…`, response-lifecycle prerequisite #2532 `9d3ec75d…`, parser lock, coverage 수리를 함께 보존한다. 잠금을 직접 설치하는 모든 workflow는 생성 lock, 두 source input, compiler 변경을 추적하며 선택형 runtime quality도 실제 consumer suite를 실행한다. Review-repair owner는 launcher runtime 두 suite를 직접 실행·계측한다. Combined local evidence는 Python 3.14 warnings-fatal 5,291 passed, 5 skipped, 40 subtests, production 18,729/18,729 statements·7,642/7,642 branches, Docstring 100%다. 이 행은 live Project #1 상태나 merge authorization을 주장하지 않는다. | Canonical owner는 중앙 `.github`의 source requirement, 생성 hash lock, compiler, 직접 소비 quality workflows다. 새 combined exact head의 hosted Checks, 미해결 thread 0, qualifying independent approval을 다시 수집해야 ordinary protected merge할 수 있다. #2531/#2532/#2521은 protected successor merge와 complete carryover를 확인하기 전 닫지 않는다. |
+| CONTROL-REPOSITORY-BRANCH-COVERAGE-01 | **Proposed — `.github#2521`의 전체 유효 delta를 `.github#2530` combined successor가 ordinary merge로 승계; exact-head hosted acceptance pending** | `.github#2521`는 production exclusion을 제거해 전역 100% 주장을 정직하게 RED로 되돌렸다. 네 잔여 소유자인 `opencode_queue_priority`, `strix_unverified_dependency`, `prescreen_release_runtime_archives`, `release_dependency_gate`의 실제 분기를 test-first로 모두 실행했고, launcher production omission도 제거했다. `.github#2530`의 parser lock 없이는 전체 suite collection이 실패하고, parser-lock PR은 이 coverage gap 때문에 전역 gate가 실패하는 순환 선행조건이었다. predecessor의 current head `61fb469a…`까지 successor ancestry에 보존하며 predecessor는 successor의 보호 병합과 tree 동등성을 확인하기 전 닫지 않는다. | Canonical owner는 중앙 `.github`의 production CI modules와 complete repository gate다. coverage 제외·pragma·threshold 하향·샘플 축소는 허용하지 않는다. refreshed combined successor의 complete warnings-fatal suite, 100% statement/branch report, hosted Checks, independent approval, ordinary protected merge를 새 exact head에서 완료해야 한다. |
+
+### 2026-09-30 공유 보안 기준 exact-head delta
+
+이 delta는 아래 2026-08-26 인벤토리를 덮어쓰지 않는다. 2026-09-30 재수집한
+보호 `main`은 `37b10243cec3d160ecc9c1be75c71428b160a703`이고, live API의 첫
+페이지에는 열린 PR 50개가 있었다. 페이지 전체를 조직의 총 PR 수로 추론하지 않는다.
+
+| Gap ID | 상태 | exact-head evidence | causal owner / next gate |
+|---|---|---|---|
+| CONTROL-SHARED-SECURITY-LOCK-01 | **Source repair in progress — release HOLD** | `.github#1026@6f645a73502e159d5a229805afa34868ad9bb851`의 Security Scan run `36495499815`는 공통 Rust fixture의 PyO3 `0.22.6`에서 GHSA-36hh-v3qg-5jq4와 GHSA-chgr-c6px-7xpp를 검출했고, Python Security run `36495499871`은 공통 Strix hash lock의 PyJWT `2.13.0`에서 CVE-2026-102274를 검출했다. 두 파일은 #1026 변경 범위 밖이며 보호 `main`에도 동일하게 남아 있었다. RED commit `cd84d887`는 PyO3 `0.29.2`와 PyJWT `2.14.0` source/lock parity를 요구한다. | 중앙 `.github`가 공통 fixture와 Strix lock을 소유한다. [RCA와 검증 계약](doctoring/shared-security-baseline-pyjwt-pyo3-20260930.md)에 따라 owner PR의 exact-head Checks와 독립 승인, ordinary protected merge, immutable consumer source pin 갱신, 그리고 #1026의 비강제 main merge-forward가 순서대로 필요하다. 어떤 실패도 #1026 전용 패치나 bypass로 처리하지 않는다. |
+
+### 2026-09-30 GitHub API response lifecycle incident delta
+
+| Gap ID | 상태 | exact-head evidence | causal owner / next gate |
+|---|---|---|---|
+| CONTROL-GITHUB-API-HTTP-ERROR-CLOSE-01 | **Proposed — protected-main RED reproduced; source repair under hosted exact-head verification** | 보호된 `.github/main@37b10243cec3d160ecc9c1be75c71428b160a703`의 Python 3.14.7 `tests/test_github_api_url_boundary.py -W error`가 실제 CodeQL/Strix opener의 synthetic 302 여덟 경우에서 `ResourceWarning: Implicitly cleaning up <HTTPError 302>`로 `8 failed, 26 passed`였다. 첫 repair의 warning-fatal full suite가 동일 defect를 Noema/Pingora/preflight/Pages/sandbox readiness에서 추가로 드러냈다. | Canonical owner는 중앙 `.github`이다. 각 caller가 기존 bounded status/telemetry와 fail-closed mapping을 보존한 뒤 file-like error response를 명시적으로 닫는다. `5161 passed, 10 skipped, 40 subtests passed`로 complete warning-fatal local tree가 GREEN이다. [RCA와 acceptance](doctoring/github-api-http-error-response-lifecycle.md)를 따라 exact-head hosted security, independent review, ordinary protected merge를 완료한 뒤 `.github#2040`과 review-transport stack이 새 protected head를 정상 병합해 downstream 증거를 재생성해야 한다. |
+
+### 2026-10-03 Dependency Review transport-completion delta
+
+| Gap ID / 상태 | PRD / TRD / Context Map / evidence / next gate |
+|---|---|
+| `CONTROL-DEPENDENCY-REVIEW-TRANSPORT-EXIT-01` — **Complete owner carryover integrated into `.github#2565`; Proposed/HOLD pending exact-head hosted evidence and independent approval** | **PRD:** 구매자는 불완전한 dependency comparison이 보안 gate를 통과하지 않음을 보장받아야 한다. **TRD/RCA:** reusable preflight가 curl의 nonzero 종료를 `|| true`로 숨기고 출력된 HTTP `200`만 검사해 partial transfer에도 `available=true`를 발행할 수 있었다. **Context Map:** 중앙 `.github` Dependency Review admission owner가 thin callers 앞에서 exact base/head와 authenticated transport completion을 소유하며, bundled Security Scan은 같은 identity/transport invariant를 적용한다. **실행 흐름:** `exact identity validation → authenticated curl → curl exit == 0 AND HTTP 200 → available=true → pinned Dependency Review`; DB/UI/ERD 변화는 N/A다. **RED→GREEN:** #1725 RED `fe9d1933…`의 fake curl `HTTP 200 + exit 18` 회귀는 defect head에서 실패했다. #2565 published ordinary two-parent merge `650bc6e35409d52d24fec890c2ab74063794e9b8` (tree `9522f0b9c96247b3412e147bc6f89fd2595c0776`)가 #1725 exact `229027280e8bce6cc4f13e722b2b0c280a1ac17d`의 source/tests/ADR/doctoring/CHANGELOG/Gap delta를 runner-group stack에 보존했고, 결합 focused suite는 일반 및 `GITHUB_ACTIONS=true`에서 각각 53/53, warning-fatal 전체 suite는 5,437 passed, 10 skipped, 40 subtests다. Review에서 발견된 ADR-0025/0032 충돌은 security decision을 ADR-0034로, owned CodeQL decision을 ADR-0033으로 이동하고 numeric identity uniqueness 계약을 추가해 제거했다. **다음 gate:** fresh exact-head hosted security/review Checks, unresolved thread 0, qualifying independent approval, runner-group/capacity/cleanup canary, ordinary protected merge가 필요하다. |
+
 ### 2026-09-19 exact-head incident delta
 
 | Gap ID | 상태 | exact-head evidence | causal owner / next gate |
 |---|---|---|---|
+| CONTROL-LAW-CI-CLUSTER-SYMLINK-01 | **Proposed — `.github#2581` owner repair; local GREEN, hosted acceptance pending** | Exact parent `7558db6749e6f73a83cefd5f67dfaca380c8ef7d` allowed symlinks at `data`, `private`, `postgres`, `cluster`, and `postmaster.pid` to reach the synthetic `pg_ctl` boundary. Five RED cases now exercise the real helper; the minimal shared `cleanup_root` guard makes all five GREEN and preserves the root/marker/foreign PID evidence. | Canonical owner is `scripts/ci/law_ai_agent_ci.sh`. Keep `.github#2581` Draft until the final exact head passes the complete local suite, source-executing hosted Checks, and qualifying independent review; never substitute a skipped/zero-step run or bypass. |
 | CONTROL-OPENCODE-COVERAGE-LOCK-CONTEXT-01 | **Proposed — PR-bound incident register; GitHub Project #1 roadmap item이 아님; `.github#2385@950ab885…` source convergence, hosted acceptance pending** | Required OpenCode run `35370902053`의 `coverage-evidence` job `105778600365`은 PR source 실행 전에 `COPY requirements-opencode-review-ci-hashes.txt requirements-noema-document-ci-hashes.txt /tmp/`에서 두 번째 파일을 찾지 못해 종료했다. RED `9b9f5edcd`는 Dockerfile의 모든 lock input이 trusted build context에 존재해야 한다는 계약을 고정했다. 이 행은 live Project 상태를 주장하지 않고 exact-head PR evidence만 추적하며, protected integration 뒤 제거 여부를 재평가한다. | Canonical owner는 중앙 `.github/.github/workflows/opencode-review-dispatch.yml`이고 complete successor는 `.github#2385`이다. 두 lockfile을 각각 regular non-symlink로 검증하고 build context로 복사한 뒤 exact-head focused/full suite와 새 hosted `coverage-evidence`를 통과해야 한다. PR 제품 source나 coverage 비율의 결함으로 오인하지 않으며 synthetic status·manual rerun·bypass를 사용하지 않는다. |
 
 ### 2026-09-13 current-head incident delta
diff --git a/opencode.jsonc b/opencode.jsonc
index 3b5f34e2a6..2663186084 100644
--- a/opencode.jsonc
+++ b/opencode.jsonc
@@ -1,11 +1,11 @@
 {
   "$schema": "https://opencode.ai/config.json",
   // Default routed through the vendored contextual-orchestrator gateway
-  // (orchestrator/free: fail-closed zero-cost pool, ZDR-first). The gateway
+  // (orchestrator/auto: fail-closed zero-cost pool, ZDR-first). The gateway
   // must be provisioned before a review starts; there is no direct-provider
   // fallback for review content.
-  "model": "contextual-orchestrator/orchestrator/free",
-  "small_model": "contextual-orchestrator/orchestrator/free",
+  "model": "contextual-orchestrator/orchestrator/auto",
+  "small_model": "contextual-orchestrator/orchestrator/auto",
   "enabled_providers": ["contextual-orchestrator"],
   "lsp": false,
   "mcp": {},
@@ -290,7 +290,7 @@
     // vendored contextual-orchestrator LLM gateway. It auto-discovers models
     // across Bytez/NVIDIA NIM (x2 keys)/OpenRouter/OpenAI from KV-registered
     // credentials and serves the fail-closed zero-cost pool under the virtual
-    // model id `orchestrator/free`, with ZDR-compliant (zero-data-retention)
+    // model id `orchestrator/auto`, with ZDR-compliant (zero-data-retention)
     // routes prioritized by scripts/ci/zdr_policy.py. Requires
     // CONTEXTUAL_ORCHESTRATOR_BASE_URL and CONTEXTUAL_ORCHESTRATOR_TOKEN,
     // which scripts/ci/contextual_orchestrator_review_sidecar.sh provisions on
@@ -306,8 +306,8 @@
         "apiKey": "{env:CONTEXTUAL_ORCHESTRATOR_TOKEN}"
       },
       "models": {
-        "orchestrator/free": {
-          "name": "Orchestrator Free (ZDR-first zero-cost pool)",
+        "orchestrator/auto": {
+          "name": "Orchestrator Auto (cost-fenced dynamic selection)",
           "tool_call": true,
           "reasoning": true,
           "options": {
diff --git a/pyproject.toml b/pyproject.toml
index ff6353c164..cebf24066b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,16 +19,8 @@ pythonpath = ["."]
 [tool.coverage.run]
 branch = true
 source = ["scripts/ci"]
-# contextual_orchestrator_review_launcher.py imports the vendored
-# contextual-orchestrator library, which is installed only inside the review
-# sidecar's runtime (scripts/ci/contextual_orchestrator_review_sidecar.sh).
-# It cannot be imported by this repository's test suite, so it is omitted from
-# coverage exactly as contextual-orchestrator omits its own runtime-only
-# __main__.py and server.py. The policy and ZDR decision logic it consumes are
-# fully tested offline.
 omit = [
     "tests/*",
-    "scripts/ci/contextual_orchestrator_review_launcher.py",
 ]
 
 [tool.coverage.report]
diff --git a/requirements-opencode-review-ci-hashes.txt b/requirements-opencode-review-ci-hashes.txt
index 116009874b..f58dc7f4d3 100644
--- a/requirements-opencode-review-ci-hashes.txt
+++ b/requirements-opencode-review-ci-hashes.txt
@@ -137,88 +137,96 @@ coverage==7.15.4 \
     # via
     #   -r requirements-opencode-review-ci.txt
     #   pytest-cov
-hypothesis==6.168.0 \
-    --hash=sha256:046fe4bcfce2a2fa186ba9d96bbb62c25c2f6c2e4071f0783ed6b5cc481d0669 \
-    --hash=sha256:076a2096c34448931c3cfeb2eb7a6b843a56ffdce5e4e3a025bfdf8f935666d9 \
-    --hash=sha256:085c9aa246487c56a40ca89003d285cbffdbb5be4097ba6d0139f9c21003c04a \
-    --hash=sha256:0ba3838c4a92e0b9730d1ed7e67e4950c152ad79d0a0c7594065262db84c55c4 \
-    --hash=sha256:112b0900059bf9d7d6528ed729770629ab146e0d133c4143b9bd4a01dc002bcc \
-    --hash=sha256:16864797de4b024e4c6cebd44598af932f870aad811341bc5bc24c738801ff76 \
-    --hash=sha256:1894782fae5d9a7bb44e6dcf848ccb09ccb5babab48d8b5c31a0a7fc025b82a1 \
-    --hash=sha256:1d1aa5b3484e329295d88488a5ba06243909e65c2ab616513c2d36721de4ed1d \
-    --hash=sha256:1f4cd0ff11bd470a1a846296ed5fe55e84214194850370994fd1370fe73d3099 \
-    --hash=sha256:2085ee74ac3ab6b70e2f7ffae9b4cb74c246da2f574b2de81a0818a8a30f659f \
-    --hash=sha256:2264f15a1c80329e3ad48e39c44bd5c9429b7b04c9ee62cdd72f4b10aaac9f29 \
-    --hash=sha256:24b52a2b1c8db6e1e516f9295c8e4ef7ef63303ff24fbbc5b35f4ff71dcd732c \
-    --hash=sha256:283eda952bcb1987ccba1c8b634db0e8a960e1e92e2daa7003bc2392f19cea01 \
-    --hash=sha256:2a380b521b5a76a9e8917d64adcf7f861a45a4360a34b1579af14c5df8eb0377 \
-    --hash=sha256:2a838218ff1eab8d7b4bf66b96037fce0a802f61f2fa5fd4b784696cac365ce7 \
-    --hash=sha256:348d9b93fd4129f67f9bab94f3d70709a9372bbe0e0d22731325ce85d5eb409f \
-    --hash=sha256:34e3c8b66047ba92f8b8df5e427074058d92db58038f007da4bf9d14e934ad3c \
-    --hash=sha256:35f1262831b5acc74ded15f629965daffcd657f6016ee04fc9605f6eb2b334c0 \
-    --hash=sha256:3b3ce1cce70b25a37ed1a38a53ce7204785726c675c0f41a0f83c338a7e47b3d \
-    --hash=sha256:3bc00fd8cda04b58e37a1163e8a65389b247b4f5ee547ae37d244a4960995517 \
-    --hash=sha256:3f6dcf66270278d078bed01b401f47db4e26456cd909d8e23c6b9366a6c0b131 \
-    --hash=sha256:3f7486bed33225d02f6aa78a4c4ba2b6f84992a82571cdda1bf08dce41d13507 \
-    --hash=sha256:4085b61e25d3dcc6c9151d4115269870aee8cdb921611ee5c989b2786449be09 \
-    --hash=sha256:45fcfa05f746e253350f55f216bcef59754f5f2b85745f1fc2bb8ba81dd517a9 \
-    --hash=sha256:47b89491ff02e3ae9b302c440457938e87b47a45b9a1d98ff5575b6910d779e2 \
-    --hash=sha256:489d5c060f49f495b64215cae627c71730cffd5ef59dc4d7f431932e6e6d2e67 \
-    --hash=sha256:4d7d29dd63ad9fdc4aa1d65fa272449e14aaf6c6bb8451091818c2945533a43a \
-    --hash=sha256:527452b43e79e6dfbf9cb69145a940547a3cd177c556698a3fc939ed2354c4b3 \
-    --hash=sha256:53469a1a7c4861b12c9a8622f762d7d1fd7bcf171884e1018ed5a8f063a5c063 \
-    --hash=sha256:5427a3c951080c18170486f775df6a82153882b819eca6b8e7ed77693634e5ab \
-    --hash=sha256:5920d267f7d8cfd376672f2bde5905cdf284d47519582e41ce7c142d48ee46c4 \
-    --hash=sha256:5b54769033b84477931d2072e7133a7555e0de5c53fd5ca3bbde960762d7d31b \
-    --hash=sha256:5f099b1c8fc49ec2d9d7944e661addb97d7c38e818fb8d1f78073c43895a87f6 \
-    --hash=sha256:6b750390dac4429da0cb70ab3fe758457f0cea3d9c843d48c59d0690d1189fda \
-    --hash=sha256:6de30e559eb151de14a5f74bceb4d97792a9315ada2a1816b5da825cd7d28edc \
-    --hash=sha256:6f0dd437ec01140676192422b61f2f833b3ce6a3213da9b7e196ad6b3777e795 \
-    --hash=sha256:6ff259260015f9be3756dcd4bc11c08e007314dec6b43d9a89084c4f34f94475 \
-    --hash=sha256:719b45b0512e3535a6a0077c2f7c6053b02ac0e72d60693f66f98790a33855b2 \
-    --hash=sha256:72af51087b7b5ab21c49f0d502f803c20897678652835596bd2a8b169a39135e \
-    --hash=sha256:73084b76e4a79cd0f7883ce80fc60c9f374ce7dcad8f520b39db40470ce1852f \
-    --hash=sha256:732ae5d47482f99d8028cca096729625f05690a83f5e7ce31466e266155792f4 \
-    --hash=sha256:754016594fe78cef91790e0922f60d183c52f531255fbfa30dac495b813e2128 \
-    --hash=sha256:76d4d36ed2fd62de11382f1d608169c1ffa9a49d3b9351146d8ff87cb81a66f7 \
-    --hash=sha256:7d55562bf8d41cfa18559c33f30cadf44ceac8e517509d7a022a9feace621f28 \
-    --hash=sha256:8067e6b4b48e5cfdc849a1a20c9d4972b3f532b3e3edb5e2b5dfd106045a5236 \
-    --hash=sha256:812a84c4cc7f7ae4fcb39a5647cc2698e6c18254f8423126425578f1dcdac782 \
-    --hash=sha256:891b2d281ede45130e7fa0a22fd65336cc77ef2f780ec3792e8de6fc274a02c8 \
-    --hash=sha256:8e4b2d434e0dd134f3d31ac1efc1825bf99730dfe70fec005ff66d7211836d79 \
-    --hash=sha256:9018b20acdb061b2ef4b2fa7f558ca5db97ffea316e0a528bc003a24b2ac996e \
-    --hash=sha256:91e3de666a6c4f7543000d1710e25055d63ef3032c98bd2ab338b3087bdaa780 \
-    --hash=sha256:92cff497b92e2285ff6a94193fdee04aba483a4115d501c1f9a570bd103fcd20 \
-    --hash=sha256:93413d1b0af50a7b165d66278c529174bf2fd1773c78027735dc0b50d1d3fd27 \
-    --hash=sha256:990026952d5b2eca290c88f639ac639233f47e13dae338c6dfb6e4774bcab349 \
-    --hash=sha256:9a2079cd09919956dd388f1a1f8ea5a79f2b2437650fbeda31d8661217ffefef \
-    --hash=sha256:9a72ed7afa1f7e30488b8a5754fca0ad9755518bdb77d6f0b003cadf7437a5f9 \
-    --hash=sha256:9ba679f183c67adcb6f4ad93694beafb6da99fe691757f4e57b04ae77e581ba8 \
-    --hash=sha256:9d9a8574f80fc859313aee56167d202e8625c0eedd200971130f0839f06d1c93 \
-    --hash=sha256:a0d28418c104d7268fdebcc09bc49f7b6569b5eb942430c6859f53ec8d4edf63 \
-    --hash=sha256:a4956f41ab1ec6e6ef9262a35970e9f3e2caaaa1cdafe0d413156c6934dd99d8 \
-    --hash=sha256:a74b0945acbbd552c7c2d0a99a3b5232962b8848c8eed1829451800a9bfcf00b \
-    --hash=sha256:a9650c4882fdbdd8e90bdae602a8bfa8c6f09dc5d06afec5b9b23982e8f60a04 \
-    --hash=sha256:b5449a64eb37d9a4aa6ac9cd2ab0fd1a24145adf421ef1536884f73f39824887 \
-    --hash=sha256:bc935a5d5f86fd8f5af951b8fbe00307f6f7c596f82a9a27c17d974f6ab0a26c \
-    --hash=sha256:bfef4d46dbf1704a7b8fa3a78778651a2cb18870ca0a70da19c381646822b149 \
-    --hash=sha256:c3af200b322f710c76c2189866246cdcff2039165dd77edff1a7bf1157162fb0 \
-    --hash=sha256:cb10aa59b0af45badca76911f5323f40d24fdbe00d01b7b67fef8648c99411b5 \
-    --hash=sha256:cd0c1dcf308e919c8ae708054d0ad61921ae87634a9aea574a9851da584cebc1 \
-    --hash=sha256:d0620fa320fa66649e6bfd71e94f3f86115fffebb7e3c6dcece19d1aaff8e07f \
-    --hash=sha256:d0bdb77f976740b8cd5ec697327ea343d02d052b9916d213b5d4c65d823415cd \
-    --hash=sha256:db2751c27bffc8491a96d72969649089d5400115e4b7c49bf7167ebbdcc84193 \
-    --hash=sha256:deb02de608268928d779aa889b0a9d67794b1cc0c54a322cf19e386be8a46ca7 \
-    --hash=sha256:e21e30b76b6d3adb87c550576132a3204f4c257ec43353f6c09b9d59bb762abc \
-    --hash=sha256:e2df8afacf9261070795db36db4a394e3ccdbb663fd2d38c7a9fba0c836dcecc \
-    --hash=sha256:e86820053afad84677f301c0b892a226be1df49790800a65668ae7cc8a1ac571 \
-    --hash=sha256:ec0886fe0be9091669937989f9a662beca42ae14a4a6dab25491c2c63365f88d \
-    --hash=sha256:ecf0ab13cef899efb816ffdd7963e0679f372520884ce06756c7642f3df94213 \
-    --hash=sha256:f62bdabf278db9ff61df5f3203d608949f0d893d0e30cdac3f2330e67e41ae68 \
-    --hash=sha256:f77af7721ff35a58fa8797decd14c932c350a2548686c6e9b844db710a3a2441 \
-    --hash=sha256:f89d8e998d3c936ffbbd1c3686c96f0378f6558aecc5967a3035a857f2bab0ad \
-    --hash=sha256:fb8cdf45361e259df86e19f8cd042ce2d6c7e6ad88fa631b78a4e3a83c2e572d \
-    --hash=sha256:fcc5bad4300a751804ce41f0e10d77f85272668160708ce39ec579bca8984843
+defusedxml==0.7.1 \
+    --hash=sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69 \
+    --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61
+    # via -r requirements-noema-document-ci.txt
+hypothesis==6.168.3 \
+    --hash=sha256:01768a03a30dc54df7fe457c0b34016c84d598fa00d5965ededab93ba4eb3408 \
+    --hash=sha256:0369f5df055f96e117ab12e5f249668ff144731ab5280bc7a205fdf81f990b89 \
+    --hash=sha256:03b131043608f94a2578a2a896a1a72092acb7079815eef5b8513b08447e0e62 \
+    --hash=sha256:0608c610fc002978fc5de0f471770d8817e9455cb8649a47983c9f8bccfc1897 \
+    --hash=sha256:0bdfc53c041b61c854fa3761735736b991bc2bddafee45a361cfe4d43027c1ef \
+    --hash=sha256:0df00cbe8133aa220308d11fa28e3add996cf5102a39b279c1d711015fd9114b \
+    --hash=sha256:0e1d91530cefdb9e0b6467c203eb509c61a11d70480a37db59cb53a2f9913102 \
+    --hash=sha256:101531b4ccf7fa12965a6b295d10b64c2f8a8fab61e1f9b18c55335d8fb02575 \
+    --hash=sha256:140fe3cc7ba98a4ffeeb6492c318b43c326110a4d7b4f56bb759d5c264e2dc1c \
+    --hash=sha256:1a8a4ffc6c6e6e577f2bfbcfebf7cffbb310283ba2532c729570a0a752cebaaa \
+    --hash=sha256:1b230a850de63334c16654a34a2d547e0179d36b9071d4439b3e7237f6d077e7 \
+    --hash=sha256:209dc54cdb1b4d6d7020ad8d09e44c49756361b7183adacea4d6f5705085b595 \
+    --hash=sha256:26084ef31653108da9e5eb171278a1d930e90d8631604391f828219f5c1f6cb2 \
+    --hash=sha256:26928956c54748e4dfa587333741ab750246123b93484955646ff316cca27eef \
+    --hash=sha256:28d88fa174ecbd4ecbd7bb290f06d0db084a3971c3f511ae2830b65b5e25500f \
+    --hash=sha256:29dc56e6dc6eeb0aeb08ac463f847279bde2336c4786faf7ee0af4b93cd031a7 \
+    --hash=sha256:2b52ac363096232bebc2add117e9178d91f4248f4cdb919fd1026b5f86a4bb16 \
+    --hash=sha256:320920b1e3dae8611eee8a03d063cf2187446f2a17c38cfb8a7fc1466f71eee2 \
+    --hash=sha256:32d0699566aaa93f9e97a44705d7164386f1e91de78d277f53bada35e78bcc96 \
+    --hash=sha256:35380baa981108a7f60c4eab71e46acd8d8f58440520346a1a6aba06dca7e074 \
+    --hash=sha256:377438de53afb94347d9845b7d90db5905c6d2a8d612108e9938e0f80503bb90 \
+    --hash=sha256:3bc85014577982ec6d2e266edc5cd6e7a7d3674c648791ca983c67a52f89a0c4 \
+    --hash=sha256:3cf6f1eeaf41cd8d60cf1f88fde905ca1dd77c906929a507d6ac7f66f2ccba2a \
+    --hash=sha256:3ef7d26f5789e691401d5f87eafed9bd2763f0dbe47af6d6b66012a509404766 \
+    --hash=sha256:3f1122223759acc0fe5301c1ae505d762ee61af91db7b191a791ccdbcd965462 \
+    --hash=sha256:41e0120814de5c3a6b58d8cb27cb11b8873ab33fba130cd09855a27f5a12a1ca \
+    --hash=sha256:44ace770bda3a0301739fc5a413c764de790c739df1f1a7218dd049f8594d9f5 \
+    --hash=sha256:4bedbb379eab34f792af7ee9a05aae04e9c08bbb52e0f90f5a2110d4fe4b2fbd \
+    --hash=sha256:558625ff28e415f2f770cad618c2c9e05a045a6586949397f178d537bec2f083 \
+    --hash=sha256:5a953115b9f5c95133ab2d04efffeec96e5658c3207923dca7285f7db3e6bbef \
+    --hash=sha256:6042b8707a4b25bbbfe20b110258fb7549a68951e5525608a8ce06091039e9fc \
+    --hash=sha256:6173558e676ad25ed1e20507fa4024a0d816dd90f715f77006e5a28f19109026 \
+    --hash=sha256:61f5782d807b1e6aa5c9beef1054cb2037e7d1add48a64972cd6ee447778781f \
+    --hash=sha256:650528e2b1e2a45e95c2df624d4b9364b8ac5a027ba84e1eea2bc5398dd01dcd \
+    --hash=sha256:65d78e4357ec48ed2c67825f06740ee3599be4cfe770a6092bed07108d679ac5 \
+    --hash=sha256:71ab606c472449cb872ef2a7acaec679ee4f651b7f0a477a04ebc85d8933ef8c \
+    --hash=sha256:7311d8ff296806ea41513d52edc832fcf43a1dc8d5c5f308cc386fc31b253a05 \
+    --hash=sha256:73960a58f6efc8cbc57d8ad0647955f7c5b25f3d562e3eaa57afa1c69894f7aa \
+    --hash=sha256:73c5627497968cc62d140e9fde1ea21e12cac7b64dc419fea8286cd34ff1ad4e \
+    --hash=sha256:753bb501f8560d2e321ed3b62596b4496c56f15668b0a0669231ccc3e6c4e80d \
+    --hash=sha256:785e2c45f8c08e274b4bf1ccae97f1a4e09407e9a68e80790cfab1d17a4a45fa \
+    --hash=sha256:7aacf3cf40c7ce8f9e4924d5b57bc0b068beafdfed2347bcf160a28b4cfbba7b \
+    --hash=sha256:7b9638789548361a57d984f56619ac694a914c328181d911271618409261ff4a \
+    --hash=sha256:818b3d09bba60ef90463e47a4bc87275dba1e8aeb184d3102888440ca7c7837d \
+    --hash=sha256:8367f623a98cbf90f33fd2a43b100671b152b5975bc343a578290945f52f7018 \
+    --hash=sha256:836eda971f25ddfce274107ed113297e8acede8d9b267775742b8ba8a404d0f0 \
+    --hash=sha256:9029775dc2e25e3e8e596c4306926f0079158353631c7c52c285bbc5c8073c2b \
+    --hash=sha256:92325b276360fe86c5bf71a568c0d53a6d140b0de36dcf029f9164a17803bb24 \
+    --hash=sha256:9b2d47f5d9060b049039bef0b267e88480f6468f95ee394e514e84a81ccdc5f5 \
+    --hash=sha256:9d120009d145697909f2f0c532f2d568558ddd6990707f8cba6576bfb9770696 \
+    --hash=sha256:9dcf6448b1ecc37f2b23f2d1b3ddfc9ff6b6910614c15a642dc82f419b96037b \
+    --hash=sha256:9e3c36eba80e089ecfa28ec08049723223cb41d3cfe4d9988169cf98440e402b \
+    --hash=sha256:a43388f9067678fef6e13bdff325b6cfa6961a590498bb37f7ff31589c83bc75 \
+    --hash=sha256:aac5889ea7b0b86cf2bf5709250b7576c44859dd249d1be23c009a7d6fb9f742 \
+    --hash=sha256:ae4f9f094041dcce5119ebd7bab71062743ab02b6e654d056b370beda78c19e2 \
+    --hash=sha256:af8ca98cd11dc7f9427bb90483abcd9688d4df2e8e63893a30a2423b027ebb11 \
+    --hash=sha256:b1872d2dc3f3758dfbf17cc39838b8e6b6a5c39a37811c067245e87b12d50f74 \
+    --hash=sha256:b345f818083ec99966a43ca4f7b38feb62c6920ce28572bc2bde4948a8b7eaba \
+    --hash=sha256:b823ba1fcec8da730f29316d010b06d3f7e0c3828dcf91020e24c55e7d24652a \
+    --hash=sha256:b987d73eba95183a7e59cca6d1925c588aa4307922d9852cc2b4d282a2ae4128 \
+    --hash=sha256:bb1063cb794765097b8c0add598bd34a904f44dc15db81275dd1f0ed1ac567ed \
+    --hash=sha256:bc2b1c37631f2231dd0d077225aa5908fc2bd34a4c3faf475053b0bc2eb24c95 \
+    --hash=sha256:bff12e036b67abc5ded682f724f4d7afaff5223190270a0763695f218c079068 \
+    --hash=sha256:c73c6188056e6dc110260e39d141c69c3d02f23e3ba1d8610c7a8b6f2510ec96 \
+    --hash=sha256:ccfc29505aa1cdcc254cb9cd701fd0811fef5480addd97d4127a00df023410f7 \
+    --hash=sha256:d20972ca134e652e9928ecd200966a8a2857adc2812c1d74b12a872e5cd503eb \
+    --hash=sha256:d28e3a6b511a74ce37df5274b51f36c2b274fea7365e00b16f0c81e22acd5957 \
+    --hash=sha256:d4569c39bd97d9573e946429ed676f3b55a7c8ed80920addd67d384a47d59b38 \
+    --hash=sha256:d479985fe73af97badfb72dc6d20c6a353e486a36f6d065f600026e0cf954a86 \
+    --hash=sha256:d63b0226cd3e0d8bdd97c3384b22a21934ed4d53246c1c93575dada616672499 \
+    --hash=sha256:dc66390fb12d80585aa9222bf538ce8b7aa22cf5d118250647355a1c9e8f62f4 \
+    --hash=sha256:dd2849c269d674e4618590f3b48d443bd4c06b5aef3d8d869086c2e6d213d248 \
+    --hash=sha256:e2d4c68729a13df9af4998d2652cfb5d541c5609b88c306880a5dfb284938ec2 \
+    --hash=sha256:e9784aca26eddfe99b03a0292320db742cc8a74200ef864fdce949f526f973cd \
+    --hash=sha256:eafbec09d3e87d13d8242411d1f5868b5e879f1bd6d95e233e9ff80c527bea1c \
+    --hash=sha256:f071737e4e775bebba07e319eb645a880d1e0186b4d24bad23255e849d86d483 \
+    --hash=sha256:f076bcd0f77fdcdb7797826c879099573d03a02e228ebe649ea917081b962ac0 \
+    --hash=sha256:f09c05a23a8025dd5cad07c2ed299a46778e72d49ff0dd5bf353bcc0f7dc1580 \
+    --hash=sha256:f0aaaed00438fa6673d856aaee12a4a8afbde82a9f3c5ff487cacfb064239afe \
+    --hash=sha256:f27e6df1576bf838e7f484d4ae5cba92114497ca30afb917056bf1ea33e95675 \
+    --hash=sha256:f413629de94d38a7a2ad259697a6752526143cb49c2e2d7bdba19381c80693f6 \
+    --hash=sha256:f59a3912858d0609c26054aa1c474847c797937f5e0e1c77f0d3f08032e50f09 \
+    --hash=sha256:f8122cfdd0bc0ba843063effa22ac310bdebdb3a1319bf1e63f14baa119c72ab \
+    --hash=sha256:fd7f75a2e23288ee82ee965a952473d9c5447c2cbc1afc94be09d2402201774e \
+    --hash=sha256:fd81241f4cd76fb18d481e87b9688b30a0cb5c30841730513323ba1c7aba1837
     # via -r requirements-opencode-review-ci.txt
 iniconfig==2.3.0 \
     --hash=sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730 \
@@ -272,6 +280,81 @@ pytest-cov==7.1.0 \
     --hash=sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2 \
     --hash=sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678
     # via -r requirements-opencode-review-ci.txt
+pyyaml==6.0.3 \
+    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
+    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
+    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
+    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
+    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
+    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
+    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
+    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
+    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
+    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
+    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
+    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
+    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
+    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
+    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
+    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
+    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
+    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
+    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
+    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
+    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
+    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
+    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
+    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
+    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
+    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
+    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
+    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
+    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
+    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
+    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
+    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
+    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
+    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
+    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
+    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
+    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
+    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
+    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
+    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
+    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
+    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
+    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
+    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
+    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
+    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
+    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
+    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
+    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
+    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
+    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
+    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
+    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
+    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
+    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
+    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
+    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
+    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
+    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
+    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
+    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
+    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
+    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
+    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
+    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
+    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
+    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
+    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
+    # via -r requirements-opencode-review-ci.txt
 sortedcontainers==2.4.0 \
     --hash=sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88 \
     --hash=sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0
diff --git a/requirements-opencode-review-ci.txt b/requirements-opencode-review-ci.txt
index bf2112ed68..452ce2f074 100644
--- a/requirements-opencode-review-ci.txt
+++ b/requirements-opencode-review-ci.txt
@@ -12,4 +12,7 @@ interrogate==1.7.0
 maturin==1.15.0
 pytest==9.1.1
 pytest-cov==7.1.0
+# Full-suite collection imports the Noema document parser and workflow YAML.
+-r requirements-noema-document-ci.txt
+PyYAML==6.0.3
 uv==0.12.7
diff --git a/requirements-pip-audit-ci-hashes.txt b/requirements-pip-audit-ci-hashes.txt
index 7a41a3d2d8..9a331a0d62 100644
--- a/requirements-pip-audit-ci-hashes.txt
+++ b/requirements-pip-audit-ci-hashes.txt
@@ -391,7 +391,9 @@ tomli-w==1.2.0 \
     --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
     --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
     # via pip-audit
-urllib3==2.7.0 \
-    --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
-    --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
-    # via requests
+urllib3==2.8.0 \
+    --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \
+    --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63
+    # via
+    #   -r requirements-pip-audit-ci.txt
+    #   requests
diff --git a/requirements-pip-audit-ci.txt b/requirements-pip-audit-ci.txt
index 684087ba51..bec9276178 100644
--- a/requirements-pip-audit-ci.txt
+++ b/requirements-pip-audit-ci.txt
@@ -1 +1,2 @@
 pip-audit==2.10.1
+urllib3==2.8.0
diff --git a/requirements-strix-ci-hashes.txt b/requirements-strix-ci-hashes.txt
index eb83beda17..ba3198c876 100644
--- a/requirements-strix-ci-hashes.txt
+++ b/requirements-strix-ci-hashes.txt
@@ -144,6 +144,7 @@ anyio==4.14.2 \
     --hash=sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494 \
     --hash=sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f
     # via
+    #   -r requirements-strix-ci.txt
     #   google-genai
     #   gql
     #   httpx
@@ -1119,24 +1120,45 @@ jsonschema-specifications==2025.9.1 \
     --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe \
     --hash=sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d
     # via jsonschema
-litellm==1.94.1 \
-    --hash=sha256:001be1cde7950f2ae484e450ab2f8e93ab8791e5e8d4da560d21f2fb456b0b47 \
-    --hash=sha256:07c1771315d7d26e242ef90b9336bcbc49a52158ff72ee640b4f8160cc963147 \
-    --hash=sha256:156c62022320bccab7c3507b6b13400b26e55b74c799e5a4a2d5bf904a77368f \
-    --hash=sha256:1b0bc4a2373e54f2bd4c13f8ef9fda3839bfb2e1173fb4bcea3150b07d4c59bc \
-    --hash=sha256:2103e9b155d6545b48936d2ac2e614661613adb9e3d081c58c7303ca5dd6c656 \
-    --hash=sha256:44e55a55270dee8bb85e063940c368d32040e6db66765c55db4b884fc002d4ef \
-    --hash=sha256:66bc95498af3ab687ce7570704cb274bcf1d78049afa87a9f5f64db45b72847d \
-    --hash=sha256:a6f5274876f20dd5c9e53ba3da502e94f5b3c681c5027a0398231d0caae4aacd \
-    --hash=sha256:af37356cf5b325a2887c40ff772b39e1e0865b988297c544b29123ffb13fd1b9 \
-    --hash=sha256:b0145d6b9fb718d12b7242ce5c975123f4dbfecd7b8ed1eb6a6939b0e506c946 \
-    --hash=sha256:c5c9247d9fea8fe7cda851f7b15db560ee547a8325a0af86048967edf3ccfa15 \
-    --hash=sha256:cfef0468bda9c1ba8f554bebc2966f08436f1ead98017e7ed2d7663ece77f1c2 \
-    --hash=sha256:d14e5812b5f36af2ab45461ee0c925251bc07daf65c33b8f2ce3fd3ec1235eae \
-    --hash=sha256:e9b6d92e305d96bdadb8a5ccd343b1ac188de142fbd6c91f72c75416b8c25c48 \
-    --hash=sha256:e9effe4c1e9206740b4bb4c98142ea1f71bae57e49df007cd25ef24b0ce4563f \
-    --hash=sha256:ffa9a6cd9b6205d60b02ffc0b7f077a03693d835b06d2a34bfeaabb4f073c08a
+litellm==1.94.3 \
+    --hash=sha256:0ddb60a439cc361e69bb4f550a78d1656c8edad6753f8fece14f60bbd0fcd054 \
+    --hash=sha256:1017f29a6f72a16ef1b026208b3e52c7197b91ae848b396c817bfb051f86c300 \
+    --hash=sha256:136960922878cbc66065346583a60fd0d35f3b1dbe853d636d10da39f049399f \
+    --hash=sha256:14f06f1486aa4eef0684a2088539548e3647495fa119edc2b8145c5cfee3ca24 \
+    --hash=sha256:1594d231e005f6a99e319310f2e3c0d33f26d8c746e90ec42fedc2b413f16573 \
+    --hash=sha256:1ec0ff6e81acbfa85b4af90f9460c46a7872a28d53aaeee956ad7d289f47edc4 \
+    --hash=sha256:2098c818ce5d8139eb46a851f26d1ac5caac1502e19d5223af4930b31682c461 \
+    --hash=sha256:45b9f56f02a5417b249ecaf6f01f2531e744b17b701aaea441741ed9431ba35e \
+    --hash=sha256:4a21e3f5cc72b18bd424009e5ad9addcee5ebdd726c7b26cadb4c87f865f5f1b \
+    --hash=sha256:56bb6b303e2e341eb55570fd0cfa5734e5d89e8a1a5ee0096e7bb0bd9f27f9e2 \
+    --hash=sha256:57a82dbbf1528aa530f021f1e6fe7528331c7d5f95fa755a17f984623eaf29ae \
+    --hash=sha256:584b705ece98e7b7a2fc3cf4b720711d0b786e4d131de5c4469c34cabc3f55e0 \
+    --hash=sha256:5b7ef13f56e167c76ca5dfc2e6bba8e52faf6371a540c00585ee7cff81af4ba0 \
+    --hash=sha256:68b5b8c4ec8d51e4a2d02cf5405b6dd85be06b8ccf0205b7b0b30c1d3c02aebe \
+    --hash=sha256:6ae267172e1c615346523faf6de6cac2f21937bda2e15e0af8c5d3291476a4e5 \
+    --hash=sha256:87a343c86304daa6be5f96493f1eb0796d57142886f21f8d0815e1712d2bfc18 \
+    --hash=sha256:93e13c1919f8eaeb3bee9a9160c6339d1fc3913254981a1e152023c5815667cc \
+    --hash=sha256:9d0fabd73ca571771773a892de1c57e208349c99a3bbc51cd049a326f7a6f6e2 \
+    --hash=sha256:9e339bea866f313487b1d7e150374360700f7ed80cac41722f7ddb072b9b685e \
+    --hash=sha256:9f0529505cd5cceed220f89b311f4403fa076beae18069e9df31c4e59b226871 \
+    --hash=sha256:a18386278e02a2b7f8d73bf836f1c7945133becca7894ee0641dbacc6473322d \
+    --hash=sha256:ac40df3e6f412a2e87f61553640922d63c8114e433c85992461317b5f67ce78f \
+    --hash=sha256:b6984b3b8032ab6807aa7c56423e961a5c4220d6b93a348dbf37ec1162b68e2d \
+    --hash=sha256:b6ba10b699165a9a46811f2d3abe92967dc1c2d16f972d1057dae5c5c9cd460b \
+    --hash=sha256:c0eee30a6d7c38fd4702339a5a53648f140ed8e5307baa321215d0d10dd9e535 \
+    --hash=sha256:c526656e85ee1be21038c75774c094b97e7439e649dc13f61cb434700199990a \
+    --hash=sha256:ccf58062430fdfd53d1ebb02d55d2316ad1068005dbb4186a522039077489f9b \
+    --hash=sha256:d2027a4e492fd85702ffdbcc43be770a450c521b8c8c0c995e6f7d2fb6df1d49 \
+    --hash=sha256:d8eedd2dc2e504ea8452392c4c66c102ed7ccd204307d72420fd073552b59ea9 \
+    --hash=sha256:de2b3cc1a5cb5b9c7e393b55a0da58cdbe46f0b373b215d4422e30b2d5dec29b \
+    --hash=sha256:deac3f3efdb5373729f37f612d2469696bbc928baef5f7c80ae7a2b0940b7939 \
+    --hash=sha256:e05cabfc94633e47b725bed0851ecf18809117d23e8d6ef9abaa6059c2712261 \
+    --hash=sha256:e4255bc09a27d99e8c1526baf76ff307e16d3543f51fda9c87c51a71c99c8ff7 \
+    --hash=sha256:f8913c9f10ef3fb1baf4ab16fc77e110f92c1c0a9a16fa0f86d1b90b417e063f \
+    --hash=sha256:f8c9a92d6165570065349b8d324e7b58800cb993c39b85a5f3c7458b5d926f3d \
+    --hash=sha256:fafb59618a85f3c96d38a123ac53187c75e722a6b4e34d305063661262f62ea8
     # via
+    #   -r requirements-strix-ci.txt
     #   openai-agents
     #   strix-agent
 markdown-it-py==4.2.0 \
@@ -1811,17 +1833,19 @@ pygments==2.20.0 \
     --hash=sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f \
     --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
     # via rich
-pyjwt==2.13.0 \
-    --hash=sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423 \
-    --hash=sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728
-    # via mcp
+pyjwt==2.15.0 \
+    --hash=sha256:7a3742debf6b879e912dbb9819ceec1594be812452b78c5f2e2dfc56564954f8 \
+    --hash=sha256:b11c5f9791d7bf51c2b39a81ed669f6b2dbbd669df2942f6c60167e9e3d1abe4
+    # via
+    #   -r requirements-strix-ci.txt
+    #   mcp
 pyopenssl==26.4.0 \
     --hash=sha256:28dfcce0162b9211413e26dfbfdf1d24317fbeba18fc93c12400a1856b2a0bc7 \
     --hash=sha256:f0eb0cb2d581d3ad2b9c489468485e7f2ab6727d08401bcf9d824c3caddf3c1c
     # via google-auth
-pypdf==6.16.1 \
-    --hash=sha256:63fec31c4092ae50b6729beedcb469055b60d20c834bde1c402df241f371f644 \
-    --hash=sha256:c4d1b43ddae921387321cf63936cd16a7743b91d2da92f165c149a195c972ba9
+pypdf==6.19.0 \
+    --hash=sha256:7e5d6e730e7dae87d560a2cee218b852f6498c8be61966f3cd02ead971e48d14 \
+    --hash=sha256:bbc43aca292369ccc6cbc8a921991ecf2538a3587ab5a116eff06c321d647155
     # via strix-agent
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
@@ -2346,10 +2370,11 @@ typing-inspection==0.4.4 \
     #   mcp
     #   pydantic
     #   pydantic-settings
-urllib3==2.7.0 \
-    --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
-    --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
+urllib3==2.8.0 \
+    --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \
+    --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63
     # via
+    #   -r requirements-strix-ci.txt
     #   docker
     #   requests
 uvicorn==0.49.0 \
diff --git a/requirements-strix-ci.txt b/requirements-strix-ci.txt
index 50e8a05f9b..3a31a6c2c1 100644
--- a/requirements-strix-ci.txt
+++ b/requirements-strix-ci.txt
@@ -1,6 +1,9 @@
 strix-agent==1.5.3
+litellm==1.94.3
 anyio==4.14.2
+pyjwt==2.15.0
 openai[httpx2]==2.54.0
+urllib3==2.8.0
 aiohttp==3.14.3
 google-cloud-aiplatform==1.133.0
 protobuf<8.0.0
diff --git a/scripts/ci/codeql_ghas_configuration_identity.py b/scripts/ci/codeql_ghas_configuration_identity.py
index 53e00c41c6..527afa12e3 100644
--- a/scripts/ci/codeql_ghas_configuration_identity.py
+++ b/scripts/ci/codeql_ghas_configuration_identity.py
@@ -19,6 +19,7 @@
 import argparse
 import json
 import os
+import re
 import sys
 import time
 import urllib.error
@@ -29,6 +30,8 @@
 DEFAULT_SETUP_ANALYSIS_KEY = "dynamic/github-code-scanning/codeql:analyze"
 CODEQL_TOOL_NAME = "CodeQL"
 GITHUB_API_AUTHORITY = "api.github.com"
+MAX_ANALYSES_PAGES = 1000
+MAX_HTTP_ERROR_DIAGNOSTIC_BYTES = 400
 
 
 class ConfigurationIdentityError(RuntimeError):
@@ -182,8 +185,11 @@ def _require_github_api_url(url: str) -> str:
     return url
 
 
-def _request_json(url: str, *, token: str, timeout_seconds: int) -> Any:
-    """GET one canonical GitHub REST URL without redirects, or fail closed."""
+def _request_json(
+    url: str, *, token: str, timeout_seconds: int,
+    response_headers: dict[str, str] | None = None,
+) -> Any:
+    """GET canonical REST JSON; optionally expose Link without changing the result."""
     url = _require_github_api_url(url)
     request = urllib.request.Request(
         url,
@@ -198,8 +204,21 @@ def _request_json(url: str, *, token: str, timeout_seconds: int) -> Any:
     try:
         with _GITHUB_API_OPENER.open(request, timeout=timeout_seconds) as response:
             payload = response.read().decode("utf-8")
+            if response_headers is not None:
+                headers: Any = getattr(response, "headers", {})
+                if hasattr(headers, "get_all"):
+                    response_headers["Link"] = ", ".join(headers.get_all("Link", []))
+                else:
+                    response_headers["Link"] = headers.get("Link", "")
+    except UnicodeDecodeError as exc:
+        raise ConfigurationIdentityError("GitHub API returned invalid UTF-8") from exc
     except urllib.error.HTTPError as exc:
-        body = exc.read().decode("utf-8", errors="replace")[-400:]
+        try:
+            body = exc.read(MAX_HTTP_ERROR_DIAGNOSTIC_BYTES).decode(
+                "utf-8", errors="replace"
+            )
+        finally:
+            exc.close()
         raise ConfigurationIdentityError(
             f"GitHub API GET failed with HTTP {exc.code}: {body}"
         ) from exc
@@ -208,6 +227,8 @@ def _request_json(url: str, *, token: str, timeout_seconds: int) -> Any:
             f"GitHub API transport failed: {type(exc).__name__}"
         ) from exc
     if not payload.strip():
+        if response_headers is not None:
+            raise ConfigurationIdentityError("GitHub analyses API returned an empty body; evidence incomplete")
         return []
     try:
         return json.loads(payload)
@@ -215,6 +236,61 @@ def _request_json(url: str, *, token: str, timeout_seconds: int) -> Any:
         raise ConfigurationIdentityError("GitHub API returned invalid JSON") from exc
 
 
+def _next_analyses_page(
+    link: str, *, endpoint: str, params: Mapping[str, str], page: int,
+    token: str, timeout_seconds: int, repository_ids: dict[str, int],
+) -> str:
+    """Validate GitHub's Link grammar and bind next to the same sequential query.
+
+    Only canonical HTTPS, this repository's analyses endpoint, and unchanged
+    ref/tool/per_page filters may receive the bearer header. A terminal last
+    relation must name the current page and preserve those same invariants.
+    Unknown, duplicate, malformed or non-sequential relations abort rather
+    than prove completeness.
+    """
+    if not link:
+        return ""
+    relations: dict[str, str] = {}
+    for part in link.split(","):
+        match = re.fullmatch(r'\s*<([^<>\s]+)>\s*;\s*rel="(next|prev|first|last)"\s*', part)
+        if match is None or match.group(2) in relations:
+            raise ConfigurationIdentityError("malformed or duplicate analyses pagination Link")
+        relations[match.group(2)] = match.group(1)
+    target = relations.get("next", "") or relations.get("last", "")
+    if not target:
+        return ""
+    _require_github_api_url(target)
+    parsed = urllib.parse.urlsplit(target)
+    try:
+        query = urllib.parse.parse_qs(parsed.query, keep_blank_values=True, strict_parsing=True)
+    except ValueError as exc:
+        raise ConfigurationIdentityError("malformed analyses pagination query") from exc
+    expected = {key: [value] for key, value in params.items()}
+    expected["page"] = [str(page + 1 if "next" in relations else page)]
+    if query != expected:
+        raise ConfigurationIdentityError("analyses pagination changed filters or page sequence")
+    if parsed.path != urllib.parse.urlsplit(endpoint).path:
+        alias = re.fullmatch(r"/repositories/([1-9][0-9]*)/code-scanning/analyses", parsed.path)
+        if alias is None:
+            raise ConfigurationIdentityError("analyses pagination changed endpoint")
+        if "id" not in repository_ids:
+            metadata = _request_json(
+                endpoint.removesuffix("/code-scanning/analyses"),
+                token=token, timeout_seconds=timeout_seconds,
+            )
+            repo_id = metadata.get("id") if isinstance(metadata, dict) else None
+            if type(repo_id) is not int or repo_id <= 0:
+                raise ConfigurationIdentityError("analyses pagination repository ID could not be verified")
+            repository_ids["id"] = repo_id
+        if alias.group(1) != str(repository_ids["id"]):
+            raise ConfigurationIdentityError("analyses pagination changed repository ID")
+    if "next" not in relations:
+        return ""
+    if page >= MAX_ANALYSES_PAGES:
+        raise ConfigurationIdentityError("analyses pagination page limit exceeded; evidence incomplete")
+    return target
+
+
 def list_codeql_analyses(
     repository: str,
     *,
@@ -223,20 +299,43 @@ def list_codeql_analyses(
     per_page: int = 100,
     timeout_seconds: int = 30,
 ) -> list[dict[str, Any]]:
-    """List code-scanning analyses for a repository, optionally filtered by ref."""
-    if not repository or "/" not in repository:
+    """Collect complete CodeQL history (at most 1000 pages), optionally by ref.
+
+    Follow only sequential Link targets bound to the original repository and
+    ref/tool/page-size query. Transport, malformed links or the page budget
+    abort the collection: callers never receive partial identity evidence.
+    """
+    if not repository or re.fullmatch(r"[A-Za-z0-9_-]+/[A-Za-z0-9_.-]+", repository) is None:
         raise ConfigurationIdentityError("repository must be owner/name")
+    if repository.split("/")[1] in {".", ".."}:
+        raise ConfigurationIdentityError("repository must be owner/name")
+    if type(per_page) is not int or not 1 <= per_page <= 100:
+        raise ConfigurationIdentityError("per_page must be an integer from 1 to 100")
     if not token:
         raise ConfigurationIdentityError("token is required to list analyses")
     params: dict[str, str] = {"per_page": str(per_page), "tool_name": CODEQL_TOOL_NAME}
     if ref:
         params["ref"] = ref
     query = urllib.parse.urlencode(params)
-    url = f"https://api.github.com/repos/{repository}/code-scanning/analyses?{query}"
-    payload = _request_json(url, token=token, timeout_seconds=timeout_seconds)
-    if not isinstance(payload, list):
-        raise ConfigurationIdentityError("code-scanning analyses response was not a list")
-    return [row for row in payload if isinstance(row, dict)]
+    endpoint = f"https://api.github.com/repos/{repository}/code-scanning/analyses"
+    url = f"{endpoint}?{query}"
+    rows: list[dict[str, Any]] = []
+    page = 1
+    repository_ids: dict[str, int] = {}
+    while url:
+        headers: dict[str, str] = {}
+        payload = _request_json(
+            url, token=token, timeout_seconds=timeout_seconds, response_headers=headers,
+        )
+        if not isinstance(payload, list):
+            raise ConfigurationIdentityError("code-scanning analyses response was not a list")
+        rows.extend(row for row in payload if isinstance(row, dict))
+        url = _next_analyses_page(
+            headers["Link"], endpoint=endpoint, params=params, page=page,
+            token=token, timeout_seconds=timeout_seconds, repository_ids=repository_ids,
+        )
+        page += 1
+    return rows
 
 
 def wait_for_language_pairing(
diff --git a/scripts/ci/collect_release_strix_bindings.py b/scripts/ci/collect_release_strix_bindings.py
index c4478fdeff..8162ba36c1 100644
--- a/scripts/ci/collect_release_strix_bindings.py
+++ b/scripts/ci/collect_release_strix_bindings.py
@@ -337,6 +337,8 @@ def collect_bindings(
 
 
 def main() -> None:
+    """Collect and print the full release dependency review from CLI inputs."""
+
     parser = argparse.ArgumentParser()
     for name in (
         "capture", "license-report", "plan", "metadata", "attempt", "repository",
diff --git a/scripts/ci/contextual_orchestrator_review_launcher.py b/scripts/ci/contextual_orchestrator_review_launcher.py
index 811dc7d3f8..65911430c2 100644
--- a/scripts/ci/contextual_orchestrator_review_launcher.py
+++ b/scripts/ci/contextual_orchestrator_review_launcher.py
@@ -33,6 +33,7 @@
 import sys
 from pathlib import Path
 from typing import Any, Callable
+from urllib.error import HTTPError
 
 from scripts.ci.contextual_orchestrator_review_policy import (
     FREE_POOL_CREDENTIAL_NAMES,
@@ -329,10 +330,15 @@ def _safe_retry_after_seconds(exc: Exception) -> int | None:
     # runs inside the probe walk's exception handler, so a ValueError here
     # would escape ``_preflight_review_agents`` -- whose callers catch only
     # ``ReviewPreflightError`` -- and kill the boot before any evidence file
-    # is written. Every ``isdecimal`` string is accepted by ``int``.
-    if not isinstance(raw, str) or not raw.strip().isdecimal():
+    # is written. Reject more than five decimal characters before conversion:
+    # the accepted ceiling is 86400, and Python deliberately rejects very
+    # long integer strings before ``int`` can return a value.
+    if not isinstance(raw, str):
         return None
-    seconds = int(raw.strip())
+    normalized = raw.strip()
+    if len(normalized) > 5 or not normalized.isdecimal():
+        return None
+    seconds = int(normalized)
     return seconds if 0 <= seconds <= 86400 else None
 
 
@@ -389,19 +395,25 @@ def _record_provider_exception(row: dict[str, object], exc: Exception) -> None:
         row: The in-progress per-route evidence row to update.
         exc: The exception a probe attempt raised.
     """
-    row["status"] = "rejected"
-    error_type = type(exc).__name__
-    row["error_type"] = (
-        error_type if error_type.isidentifier() and len(error_type) <= 64 else "provider_error"
-    )
-    http_status = _safe_http_status(exc)
-    if http_status is not None:
-        row["http_status"] = http_status
-    retry_after = _safe_retry_after_seconds(exc)
-    if retry_after is not None:
-        row["retry_after_s"] = retry_after
-    row.pop("finish_reason", None)
-    row.pop("reasoning_without_content", None)
+    try:
+        row["status"] = "rejected"
+        error_type = type(exc).__name__
+        row["error_type"] = (
+            error_type
+            if error_type.isidentifier() and len(error_type) <= 64
+            else "provider_error"
+        )
+        http_status = _safe_http_status(exc)
+        if http_status is not None:
+            row["http_status"] = http_status
+        retry_after = _safe_retry_after_seconds(exc)
+        if retry_after is not None:
+            row["retry_after_s"] = retry_after
+        row.pop("finish_reason", None)
+        row.pop("reasoning_without_content", None)
+    finally:
+        if isinstance(exc, HTTPError):
+            exc.close()
 
 
 def _demote_agent(agent: object, penalty: int) -> object:
@@ -1207,6 +1219,7 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--zdr-endpoints", default=None, help="Optional OpenRouter /api/v1/endpoints/zdr JSON path")
     parser.add_argument("--require-zdr", action="store_true")
     parser.add_argument("--pool", choices=("free", "auto"), default="free")
+    parser.add_argument("--zero-cost-only", action="store_true", help="Exclude priced routes and priced fallback even for auto")
     args = parser.parse_args(argv)
 
     from contextual_orchestrator.credentials import get_credential
@@ -1242,7 +1255,7 @@ def main(argv: list[str] | None = None) -> int:
 
     try:
         discovered, discovery_errors = discover_all_models()
-    except Exception as exc:  # pragma: no cover - provider/networking failure is runtime-only
+    except Exception as exc:
         raise SystemExit(f"review sidecar discovery failed: {exc}") from exc
     _log_discovery_errors(discovery_errors)
     routable_discovered = _routable_discovered_models(discovered)
@@ -1253,7 +1266,7 @@ def main(argv: list[str] | None = None) -> int:
         model_id = getattr(model, "model_id", "")
         if not is_general_chat_agent_model_id(model_id) or not _has_text_output(model):
             continue
-        if args.pool == "free" and _route_identity(model) not in free_route_identities:
+        if (args.pool == "free" or args.zero_cost_only) and _route_identity(model) not in free_route_identities:
             continue
         selected_models.append(model)
     if not selected_models:
@@ -1298,8 +1311,10 @@ def main(argv: list[str] | None = None) -> int:
         account_cap=_catalog_account_cap(DEFAULT_ACCOUNT_CAP),
         zdr_endpoints=zdr_endpoints,
         require_zdr=args.require_zdr,
-        pool=args.pool,
+        pool="free" if args.zero_cost_only else args.pool,
     )
+    result["report"]["requested_pool"] = f"orchestrator/{args.pool}"
+    result["report"]["zero_cost_only"] = args.zero_cost_only
     result["report"] = _with_discovery_counts(
         result["report"], normalized_rows, provider_account=provider_account
     )
@@ -1318,6 +1333,7 @@ def main(argv: list[str] | None = None) -> int:
     )
     if (
         args.pool == "auto"
+        and not args.zero_cost_only
         and admitted_free_rows
         and admitted_priced_rows
         and fallback_limit
@@ -1388,5 +1404,5 @@ def main(argv: list[str] | None = None) -> int:
     return 0
 
 
-if __name__ == "__main__":  # pragma: no cover
+if __name__ == "__main__":
     raise SystemExit(main())
diff --git a/scripts/ci/contextual_orchestrator_review_policy.py b/scripts/ci/contextual_orchestrator_review_policy.py
index 241f84bef7..2169dcc027 100644
--- a/scripts/ci/contextual_orchestrator_review_policy.py
+++ b/scripts/ci/contextual_orchestrator_review_policy.py
@@ -143,6 +143,29 @@ def _normalize_cost_evidence(
     )
 
 
+def normalize_input_modalities(value: object) -> list[str]:
+    """Preserve explicit input evidence as normalized catalog-tag tokens.
+
+    Match the pinned contextual-orchestrator ``input:<modality>`` grammar.
+    Missing evidence remains empty, never guessed text. Malformed nonempty
+    evidence fails closed rather than silently dropping provider exclusions.
+    """
+    if value is None:
+        return []
+    if not isinstance(value, (list, tuple)):
+        raise PolicyError("input_modalities must be a list or tuple of tokens")
+    normalized: list[str] = []
+    for item in value:
+        if not isinstance(item, str):
+            raise PolicyError("input_modalities contains a non-string token")
+        token = item.strip().casefold()
+        if not re.fullmatch(r"[a-z][a-z0-9_-]*", token):
+            raise PolicyError("input_modalities contains an invalid token")
+        if token not in normalized:
+            normalized.append(token)
+    return normalized
+
+
 def _bytez_non_token_price_evidence(
     *,
     is_free: bool,
@@ -240,6 +263,7 @@ def parse_discovery_report(report: Mapping[str, Any]) -> list[dict[str, Any]]:
                 "provider": provider,
                 "model": model,
                 "agent_id": str(candidate_id),
+                "input_modalities": normalize_input_modalities(row.get("input_modalities")),
                 "is_free": is_free,
                 "cost_evidence": cost_evidence,
                 "prompt_price_per_1k": prompt_price,
@@ -395,6 +419,9 @@ def build_zdr_prioritized_catalog(
                     "review",
                     f"cost:{evidence}",
                     "zdr" if zdr else "non-zdr",
+                    *(f"input:{value}" for value in normalize_input_modalities(
+                        row.get("input_modalities")
+                    )),
                 ],
                 "priority": -rank,
                 "disabled": False,
diff --git a/scripts/ci/contextual_orchestrator_review_sidecar.sh b/scripts/ci/contextual_orchestrator_review_sidecar.sh
index 46dd07c3e0..c9fa4ef81e 100755
--- a/scripts/ci/contextual_orchestrator_review_sidecar.sh
+++ b/scripts/ci/contextual_orchestrator_review_sidecar.sh
@@ -321,14 +321,12 @@ case "$orchestrator_pool" in
   free)
     pool_args=(--pool "$orchestrator_pool")
     ;;
+  auto)
+    # Auto resolves the gateway alias; the explicit fence excludes priced candidates and fallback.
+    pool_args=(--pool "$orchestrator_pool" --zero-cost-only)
+    ;;
   *)
-    # GitHub Actions Workflow usage of contextual-orchestrator is pinned to
-    # orchestrator/free: the org has not solved cost-safe free+ZDR routing
-    # well enough yet to justify a priced-inclusive "auto" pool in central CI,
-    # so "auto" is rejected here even though the launcher's own --pool flag
-    # (a general-purpose CLI also used outside GitHub Actions) still accepts
-    # it.
-    fail "CONTEXTUAL_ORCHESTRATOR_POOL must be free"
+    fail "CONTEXTUAL_ORCHESTRATOR_POOL must be free or auto"
     ;;
 esac
 
diff --git a/scripts/ci/law_ai_agent_ci.sh b/scripts/ci/law_ai_agent_ci.sh
new file mode 100755
index 0000000000..542359159c
--- /dev/null
+++ b/scripts/ci/law_ai_agent_ci.sh
@@ -0,0 +1,257 @@
+#!/usr/bin/env bash
+# Law CI: isolate the consumer, native test database, tool cache and built artifacts.
+# Shell function comments are the docstring contract; Python blocks use docstrings.
+set -euo pipefail
+SELF="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/$(basename -- "${BASH_SOURCE[0]}")"
+
+# Verify pytest's JUnit evidence, including every nested suite and executed count.
+verify_junit() {
+  python3 - "$1" <<'PY'
+"""Reject skips, failures, errors and empty JUnit evidence."""
+import sys
+import xml.etree.ElementTree as ET
+suites = list(ET.parse(sys.argv[1]).getroot().iter("testsuite"))
+valid = bool(suites) and sum(int(s.get("tests", "0")) for s in suites) > 0
+valid &= all(int(s.get(k, "0")) == 0 for s in suites for k in ("skipped", "failures", "errors"))
+valid &= not any(ET.parse(sys.argv[1]).getroot().iter("skipped"))
+sys.exit(0 if valid else 1)
+PY
+}
+
+# Refuse ambiguous or stale artifact directories rather than selecting a glob match.
+verify_dist() {
+  python3 - "$1" <<'PY'
+"""Require exactly one regular non-symlink wheel and source archive."""
+import sys
+from pathlib import Path
+entries = list(Path(sys.argv[1]).iterdir())
+valid = len(entries) == 2 and all(p.is_file() and not p.is_symlink() for p in entries)
+valid &= sum(p.name.endswith(".whl") for p in entries) == 1
+valid &= sum(p.name.endswith(".tar.gz") for p in entries) == 1
+sys.exit(0 if valid else 1)
+PY
+}
+
+# Validate owned canonical immediate-child paths and refuse every symlink component.
+validate_owned_root() {
+  python3 - "$RUNNER_TEMP" "$1" "${2:-}" <<'PY'
+"""Authorize only private current-user scratch roots and optional state markers."""
+import os
+import stat
+import sys
+from pathlib import Path
+base, root = map(Path, sys.argv[1:3])
+valid = base.is_absolute() and root.is_absolute()
+for path in (base, root):
+    for component in (path, *path.parents):
+        valid &= not component.is_symlink()
+valid &= root.parent == base and root.name.startswith("lawci.")
+valid &= root.is_dir() and root.resolve().parent == base.resolve()
+if root.exists():
+    info = root.stat()
+    valid &= info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == 0o700
+if sys.argv[3]:
+    marker = Path(sys.argv[3])
+    valid &= marker.parent == base and not marker.is_symlink() and marker.is_file()
+    if marker.is_file():
+        info = marker.stat()
+        valid &= info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == 0o600
+sys.exit(0 if valid else 1)
+PY
+}
+
+# Remove only this lane's private scratch cluster; failed stop leaves evidence for retry.
+cleanup_root() {
+  local root="$1" pg_bin="$2" cluster="$1/data/private/postgres/cluster" boundary_path
+  validate_owned_root "$root" || return 1
+  for boundary_path in \
+    "$root/data" "$root/data/private" "$root/data/private/postgres" \
+    "$cluster" "$cluster/postmaster.pid"; do
+    if [[ -L "$boundary_path" ]]; then
+      printf '%s\n' 'law-ci: PostgreSQL cluster boundary is symlinked; scratch retained' >&2
+      return 1
+    fi
+  done
+  if [[ -e "$cluster" && ! -d "$cluster" ]]; then
+    printf '%s\n' 'law-ci: PostgreSQL cluster path is not a directory; scratch retained' >&2
+    return 1
+  fi
+  if [[ -d "$cluster" ]]; then
+    if [[ ! -f "$cluster/postmaster.pid" ]]; then
+      printf '%s\n' 'law-ci: PostgreSQL cluster PID metadata is missing; shutdown is inconclusive; scratch retained' >&2
+      return 1
+    fi
+    "$pg_bin/pg_ctl" -D "$cluster" -m fast -w stop || return 1
+    if [[ -e "$cluster/postmaster.pid" ]]; then
+      printf '%s\n' 'law-ci: PostgreSQL stop returned success but PID metadata remains; scratch retained' >&2
+      return 1
+    fi
+  fi
+  rm -rf -- "$root"
+}
+
+# Preserve the failing child status and turn a failed database cleanup into failure.
+on_exit() {
+  local status=$?
+  trap - EXIT INT TERM
+  if ! cleanup_root "$scratch" "$pg_bin"; then
+    printf '%s\n' 'law-ci: cleanup failed; owned scratch retained' >&2
+    [[ "$status" != 0 ]] || status=1
+  else
+    if [[ "$state_owned" == 1 ]]; then rm -f -- "$state"; fi
+  fi
+  exit "$status"
+}
+
+# Execute committed source in a fresh short scratch root, never mutate the checkout.
+run_ci() {
+  [[ "${LAW_CI_SOURCE_SHA:-}" =~ ^[0-9a-f]{40}$ ]] &&
+    [[ "$(git -C "${LAW_CI_SOURCE:-}" rev-parse HEAD)" == "$LAW_CI_SOURCE_SHA" ]] || {
+      printf '%s\n' 'law-ci: source identity refused' >&2; return 1;
+    }
+  [[ "${LAW_CI_PYTHON_VERSION:-}" == 3.12 || "${LAW_CI_PYTHON_VERSION:-}" == 3.14 ]]
+  [[ "$(uv --version)" == 'uv 0.12.5 '* ]]
+  pg_bin="$(pg_config --bindir)"
+  for tool in initdb pg_ctl createdb psql; do test -x "$pg_bin/$tool"; done
+  test -d "${RUNNER_TEMP:?}"
+  umask 077
+  scratch="$(mktemp -d "$RUNNER_TEMP/lawci.XXXXXX")"
+  state_owned=0
+  state="$RUNNER_TEMP/law-ci-state-${LAW_CI_PYTHON_VERSION}"
+  trap on_exit EXIT
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  test ! -e "$state" && test ! -L "$state"
+  (set -o noclobber; printf '%s\n' "$scratch" > "$state")
+  state_owned=1
+  # Native Unix socket paths must remain shorter than the platform socket limit.
+  test "${#scratch}" -lt 65
+  export LAW_AGENT_ROOT="$scratch"
+  export LAW_AGENT_POSTGRES_ROOT="$LAW_AGENT_ROOT"
+  export LAW_AGENT_POSTGRES_USER
+  LAW_AGENT_POSTGRES_USER="$(id -un)"
+  export LAW_AGENT_POSTGRES_PORT=55439
+  local private="$scratch/data/private/postgres"
+  mkdir -p "$private/socket" "$scratch/source" "$scratch/out" "$scratch/outside"
+  chmod 700 "$scratch" "$private" "$private/socket"
+  # Consumer safety code requires this exact cluster/socket identity and test database.
+  export LAW_AGENT_TEST_DATABASE_URL="dbname=law_agent_test user=$LAW_AGENT_POSTGRES_USER host='$private/socket' port=$LAW_AGENT_POSTGRES_PORT"
+  unset LAW_AGENT_DATABASE_URL PGHOSTADDR PGSERVICE PGSERVICEFILE PGSYSCONFDIR PGOPTIONS PYTHONPATH PYTHONHOME VIRTUAL_ENV
+  export UV_CACHE_DIR="$scratch/uv-cache" UV_PROJECT_ENVIRONMENT="$scratch/venv"
+  export UV_PYTHON="$LAW_CI_PYTHON_VERSION" UV_NO_CACHE=1
+  printf '%s\n' 'law-ci: fresh native test cluster'
+  "$pg_bin/initdb" -D "$private/cluster" -A trust -U "$LAW_AGENT_POSTGRES_USER" --encoding=UTF8 --no-locale > "$scratch/initdb.log"
+  "$pg_bin/pg_ctl" -D "$private/cluster" -l "$scratch/server.log" \
+    -o "-k \"$private/socket\" -p $LAW_AGENT_POSTGRES_PORT -c listen_addresses='' -c shared_buffers=32MB -c max_connections=15 -c statement_timeout=10s -c lock_timeout=2s" -w start
+  "$pg_bin/createdb" -h "$private/socket" -p "$LAW_AGENT_POSTGRES_PORT" law_agent_test
+  git -C "$LAW_CI_SOURCE" archive "$LAW_CI_SOURCE_SHA" | tar -x -C "$scratch/source"
+  cd "$scratch/source"
+  printf '%s\n' 'law-ci: locked source quality gates'
+  uv sync --locked
+  uv run --locked ruff check .
+  uv run --locked ruff format --check .
+  uv run --locked mypy
+  # Fixtures need the complete archived migration inventory before suite collection.
+  # Retain source evidence outside the checkout for the independent installed smoke.
+  # Use the consumer's real test_only approval, not the broader development CLI path.
+  uv run --locked python - "$scratch/source-migrations.json" <<'PY'
+"""Commit the verified migrations to the fresh, approved test-only database."""
+from hashlib import sha256
+import json
+import os
+from pathlib import Path
+import re
+import sys
+if sys.version_info[:2] != tuple(map(int, os.environ["LAW_CI_PYTHON_VERSION"].split("."))):
+    raise SystemExit("law-ci: Python version mismatch")
+# Check lexical ancestors before traversal or importing the archived product package.
+resources = Path("src/law_ai_agent/migrations").absolute()
+for component in reversed((resources, *resources.parents)):
+    if component.is_symlink() or not component.is_dir():
+        raise SystemExit("law-ci: source migration inventory invalid")
+inventory = []
+versions = set()
+for resource in sorted(resources.iterdir(), key=lambda path: path.name):
+    match = re.fullmatch(r"([0-9]{3})_[a-z][a-z0-9]*(?:_[a-z0-9]+)*\.sql", resource.name)
+    if not match or not resource.is_file() or resource.is_symlink():
+        raise SystemExit("law-ci: source migration inventory invalid")
+    version = int(match[1])
+    script = resource.read_text()
+    if version == 0 or version in versions or not script.strip():
+        raise SystemExit("law-ci: source migration inventory invalid")
+    versions.add(version)
+    # Preserve PostgresStore.migrate's read_text()/script.encode() checksum semantics.
+    inventory.append({"name": resource.name, "version": version,
+                      "checksum": sha256(script.encode()).hexdigest()})
+if not inventory:
+    raise SystemExit("law-ci: source migration inventory invalid")
+from law_ai_agent.postgres import PostgresStore, connect
+with connect(os.environ["LAW_AGENT_TEST_DATABASE_URL"], test_only=True) as connection:
+    PostgresStore(connection).migrate()
+    connection.commit()
+    actual = [{"version": row["version"], "checksum": row["checksum"]}
+              for row in connection.execute(
+                  "SELECT version, checksum FROM law_agent.migration ORDER BY version")]
+    expected = [{"version": row["version"], "checksum": row["checksum"]} for row in inventory]
+    if actual != expected:
+        raise SystemExit("law-ci: database migration inventory mismatch")
+Path(sys.argv[1]).write_text(json.dumps(inventory))
+PY
+  uv run --locked pytest --cov --cov-fail-under=90 --cov-report=term-missing --junitxml="$scratch/junit.xml"
+  bash "$SELF" verify-junit "$scratch/junit.xml"
+  printf '%s\n' 'law-ci: fresh build and installed artifact smoke'
+  uv build --out-dir "$scratch/out" --no-create-gitignore
+  bash "$SELF" verify-dist "$scratch/out"
+  # Prime dependency wheels into a new lane-local cache, then prove real offline install.
+  uv venv --python "$LAW_CI_PYTHON_VERSION" "$scratch/prime"
+  UV_NO_CACHE=0 uv pip install --python "$scratch/prime/bin/python" "$scratch/out/"*.whl
+  uv venv --python "$LAW_CI_PYTHON_VERSION" "$scratch/installed"
+  UV_NO_CACHE=0 uv pip install --offline --python "$scratch/installed/bin/python" "$scratch/out/"*.whl
+  cd "$scratch/outside"
+  "$scratch/installed/bin/python" -I - "$scratch/source-migrations.json" <<'PY'
+"""Verify packaged migration resources outside the source checkout."""
+from hashlib import sha256
+from importlib.resources import files
+import json
+from pathlib import Path
+import sys
+import law_ai_agent
+if not Path(law_ai_agent.__file__).resolve().is_relative_to(Path(sys.prefix).resolve()):
+    raise SystemExit("law-ci: installed package prefix mismatch")
+expected = json.loads(Path(sys.argv[1]).read_text())
+resources = sorted(files("law_ai_agent").joinpath("migrations").iterdir(), key=lambda path: path.name)
+if not expected or [resource.name for resource in resources] != [row["name"] for row in expected]:
+    raise SystemExit("law-ci: installed migration inventory mismatch")
+for resource, row in zip(resources, expected):
+    if not resource.is_file():
+        raise SystemExit("law-ci: installed migration inventory mismatch")
+    script = resource.read_text()
+    if not script.strip() or sha256(script.encode()).hexdigest() != row["checksum"]:
+        raise SystemExit("law-ci: installed migration inventory mismatch")
+PY
+  "$scratch/installed/bin/python" -I -m law_ai_agent --help > "$scratch/installed-help.log"
+  printf '%s\n' 'law-ci: quality, zero-skip database and installed artifact gates passed'
+}
+
+# Recover a lane-local marker on GitHub cancellation; never source marker content.
+cleanup_state() {
+  local version state root pg_bin
+  for version in 3.12 3.14; do
+    state="${RUNNER_TEMP:?}/law-ci-state-$version"
+    test -e "$state" || continue
+    test ! -L "$state" && test -f "$state"
+    IFS= read -r root < "$state"
+    validate_owned_root "$root" "$state"
+    pg_bin="$(pg_config --bindir)"
+    cleanup_root "$root" "$pg_bin"
+    rm -f -- "$state"
+  done
+}
+
+case "${1:-}" in
+  verify-junit) verify_junit "$2" ;;
+  verify-dist) verify_dist "$2" ;;
+  run) run_ci ;;
+  cleanup) cleanup_state ;;
+  *) printf '%s\n' 'law-ci: unknown operation' >&2; exit 1 ;;
+esac
diff --git a/scripts/ci/materialize_base_python_requirements.py b/scripts/ci/materialize_base_python_requirements.py
index 3ddc126604..99d228d5e1 100755
--- a/scripts/ci/materialize_base_python_requirements.py
+++ b/scripts/ci/materialize_base_python_requirements.py
@@ -22,6 +22,7 @@
 import urllib.parse
 import urllib.request
 from typing import Any
+from urllib.error import HTTPError
 
 try:
     import tomllib
@@ -376,8 +377,11 @@ def _download_trusted_uv_archive() -> bytes:
                     break
                 payload.extend(chunk)
     except OSError as exc:
+        error_type = type(exc).__name__
+        if isinstance(exc, HTTPError):
+            exc.close()
         raise RuntimeError(
-            f"trusted uv archive download failed: {type(exc).__name__}"
+            f"trusted uv archive download failed: {error_type}"
         ) from exc
 
     if len(payload) > TRUSTED_UV_DOWNLOAD_MAX_BYTES:
diff --git a/scripts/ci/noema-document-reader/package-lock.json b/scripts/ci/noema-document-reader/package-lock.json
index 1026fd79a3..fe692cdf0e 100644
--- a/scripts/ci/noema-document-reader/package-lock.json
+++ b/scripts/ci/noema-document-reader/package-lock.json
@@ -458,9 +458,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
-      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
       "funding": [
         {
           "type": "github",
@@ -669,9 +669,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.7.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.0.tgz",
-      "integrity": "sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==",
+      "version": "10.7.1",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.1.tgz",
+      "integrity": "sha512-4OUAqU9Z1i3vCnS05hzGiFnEMDpQ+62pAD/MVQOp83fYyNC8GleCqaS0QikQBmcWCrKFiUs/B8ztRRiYOAXuCA==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
diff --git a/scripts/ci/noema-document-reader/package.json b/scripts/ci/noema-document-reader/package.json
index aa4fc0d3ff..2408b5854b 100644
--- a/scripts/ci/noema-document-reader/package.json
+++ b/scripts/ci/noema-document-reader/package.json
@@ -5,5 +5,9 @@
   "dependencies": {
     "@rhwp/core": "0.7.7",
     "hwp-mcp": "0.3.0"
+  },
+  "overrides": {
+    "fast-uri": "3.1.8",
+    "ip-address": "10.7.1"
   }
 }
diff --git a/scripts/ci/noema_bootstrap_producer.py b/scripts/ci/noema_bootstrap_producer.py
new file mode 100644
index 0000000000..5a891b8ff4
--- /dev/null
+++ b/scripts/ci/noema_bootstrap_producer.py
@@ -0,0 +1,409 @@
+"""Preserve authenticated phase issuance bytes in explicit private custody.
+
+The request and revalidation collaborators belong to the existing trusted App
+issuer/runtime owner. This module neither authenticates arbitrary dictionaries
+nor admits native execution from source acceptance or token-action metadata.
+"""
+from __future__ import annotations
+
+import json
+import os
+import stat
+import sys
+import subprocess
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+if str(ROOT) not in sys.path:
+    sys.path.insert(0, str(ROOT))
+
+from scripts.ci.premerge_review_tooling import _unique_object
+
+
+MAX_RESPONSE_BYTES = 2 * 1024 * 1024
+
+
+def materialize_tooling(source_root, target_root, raw_manifest, *, accepted_digest,
+                        admission, private_parent):
+    """Copy exactly externally admitted inert source into a separate namespace.
+
+    Supplied acceptance must be independently authenticated by the runtime owner.
+    This checks its contract and bytes; it never creates acceptance evidence.
+    The parent is held exclusively by that owner, not defended against same-UID
+    or privileged namespace mutation by directory permission bits alone.
+    """
+    import hashlib
+    import sys
+    from scripts.ci.premerge_review_tooling import load_noema_tooling
+    parent, source, target = map(Path, (private_parent, source_root, target_root))
+    if (not parent.is_absolute() or not source.is_absolute() or not target.is_absolute()
+            or target.parent != parent or source == target or parent.is_relative_to(source)):
+        raise ValueError('bootstrap namespace refused')
+    if any(path.is_symlink() for path in (parent, *parent.parents, source)):
+        raise ValueError('bootstrap namespace refused')
+    info = parent.lstat()
+    if (not stat.S_ISDIR(info.st_mode) or info.st_uid != os.getuid()
+            or info.st_mode & 0o077 or os.path.lexists(target)):
+        raise ValueError('bootstrap namespace refused')
+    if admission.get('namespace') != str(parent):
+        raise ValueError('bootstrap namespace differs from independent admission')
+    for field in ('isolated_clean_job', 'native_custody', 'supplier_cost',
+                  'supplier_retention', 'issuer_phase_separation'):
+        if admission.get(field) is not True:
+            raise ValueError('bootstrap execution evidence is not accepted')
+    _validate_runtime(admission, parent)
+    tooling = load_noema_tooling(source, raw_manifest, accepted_digest=accepted_digest,
+        interpreter=Path(sys.executable).resolve(), phase_environment=lambda _: {})
+    inventory = json.loads(raw_manifest)['files']
+    target.mkdir(mode=0o700)
+    for name, digest in inventory.items():
+        raw = (source / name).read_bytes()
+        if hashlib.sha256(raw).hexdigest() != digest:
+            raise ValueError('bootstrap source changed during delivery')
+        destination = target / name
+        destination.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        with os.fdopen(os.open(destination, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o400), 'wb') as stream:
+            stream.write(raw)
+    tooling._verify()
+    load_noema_tooling(target, raw_manifest, accepted_digest=accepted_digest,
+        interpreter=Path(sys.executable).resolve(), phase_environment=lambda _: {})
+    return target
+
+
+def _validate_runtime(admission, parent):
+    """Rebind explicit namespace, interpreter, dependencies and required admission."""
+    import hashlib
+    parent = Path(parent)
+    if not parent.is_absolute() or any(path.is_symlink() for path in (parent, *parent.parents)):
+        raise ValueError('bootstrap namespace refused')
+    info = parent.lstat()
+    if (not stat.S_ISDIR(info.st_mode) or info.st_uid != os.getuid()
+            or info.st_mode & 0o077 or admission.get('namespace') != str(parent)):
+        raise ValueError('bootstrap namespace refused')
+    for field in ('isolated_clean_job', 'native_custody', 'supplier_cost',
+                  'supplier_retention', 'issuer_phase_separation'):
+        if admission.get(field) is not True:
+            raise ValueError('bootstrap execution evidence unavailable')
+    interpreter = admission.get('interpreter')
+    actual_interpreter = Path(sys.executable).resolve()
+    if (not isinstance(interpreter, dict) or set(interpreter) != {'path', 'sha256'}
+            or interpreter['path'] != str(actual_interpreter)
+            or hashlib.sha256(actual_interpreter.read_bytes()).hexdigest() != interpreter['sha256']):
+        raise ValueError('bootstrap interpreter differs from independent admission')
+    dependencies = admission.get('dependencies')
+    if not isinstance(dependencies, dict):
+        raise ValueError('bootstrap dependency inventory unavailable')
+    for name, digest in dependencies.items():
+        path = Path(name)
+        if (not path.is_absolute() or path.is_symlink() or not path.is_file()
+                or hashlib.sha256(path.read_bytes()).hexdigest() != digest):
+            raise ValueError('bootstrap dependency differs from independent admission')
+
+
+def _response(raw):
+    """Parse bounded original API bytes without reflecting credential payloads."""
+    if not isinstance(raw, bytes) or not 0 < len(raw) <= MAX_RESPONSE_BYTES:
+        raise ValueError('issuer response size or type refused')
+    try:
+        value = json.loads(raw, object_pairs_hook=_unique_object)
+    except (UnicodeError, ValueError):
+        raise ValueError('issuer response schema refused') from None
+    if not isinstance(value, dict):
+        raise ValueError('issuer response schema refused')
+    return value
+
+
+def run_bootstrap_review(source_root, raw_manifest, *, accepted_digest, admission,
+                         private_parent, fetch_live, request, revalidate,
+                         inference_key):
+    """Compose actual admitted tooling, original App response and two children.
+
+    Trusted runtime callbacks are externally held authority; this function only
+    checks their supplied admission and orders preparation before the separately
+    minted write token. No supplier policy is inferred from source or fixtures.
+    """
+    import hashlib
+    import subprocess
+    from scripts.ci.premerge_review_tooling import (
+        load_noema_tooling, phase_environment_from_issuance,
+        require_prepared_envelope, require_review_scope,
+    )
+    scope = admission['scope']
+    parent = Path(private_parent)
+    source = Path(source_root)
+    target = materialize_tooling(source, parent / 'tooling', raw_manifest,
+        accepted_digest=accepted_digest, admission=admission, private_parent=parent)
+    if not isinstance(inference_key, str) or not inference_key.strip():
+        raise ValueError('existing inference authority unavailable')
+    envs = {}
+    def fence():
+        """Revalidate supplier, source, admitted scope and external authority."""
+        revalidate()
+        if hashlib.sha256(raw_manifest).hexdigest() != accepted_digest:
+            raise ValueError('bootstrap source pin changed')
+        live = fetch_live()
+        require_review_scope(scope, live)
+        from scripts.ci.premerge_review_tooling import admit_tooling
+        inventory = json.loads(raw_manifest)['files']
+        files = {name: (target / name).read_bytes() for name in inventory}
+        admit_tooling(raw_manifest, accepted_digest=accepted_digest, source_files=files)
+    def issue(phase):
+        """Store exact authenticated response privately and consume its grant."""
+        fence()
+        path = parent / (phase + '.json')
+        produce_issuance(phase, scope=scope, installation_id=admission['installation_id'],
+            app_id=admission['app_id'], output=path, private_parent=parent,
+            request=request, revalidate=fence)
+        fence()
+        response = _response(path.read_bytes())
+        return phase_environment_from_issuance(phase, response,
+            scope=scope, reviewer_actor=scope['reviewer'],
+            installation_id=admission['installation_id'],
+            inference_key=inference_key if phase == 'prepare' else None)
+    fence()
+    envs['prepare'] = issue('prepare')
+    tooling = load_noema_tooling(target, raw_manifest,
+        accepted_digest=accepted_digest, interpreter=Path(__import__('sys').executable),
+        phase_environment=lambda phase: envs[phase])
+    verdict = parent / 'verdict.json'
+    if tooling.prepare_verdict(scope['repository'], scope['number'], scope['head'], verdict) != 0:
+        raise ValueError('model preparation failed')
+    require_prepared_envelope(verdict, scope)
+    fence()
+    # No write grant can be requested until preparation and live revalidation.
+    envs['publish'] = issue('publish')
+    fence()
+    require_prepared_envelope(verdict, scope)
+    return tooling.publish_verdict(scope['repository'], scope['number'], scope['head'], verdict)
+
+
+def produce_issuance(phase, *, scope, installation_id, app_id, output,
+                     private_parent, request, revalidate):
+    """Request exact phase grant and exclusively store the unchanged response.
+
+    Authenticated request supplies original response bytes from the same App
+    transport. The caller must independently bind that collaborator, namespace,
+    and installations; structural checks alone do not establish issuer authority.
+    Publish revalidation must include the prepared envelope and live head/base.
+    No inference credential is consumed here or attached to an issuer request.
+    """
+    if phase not in ('prepare', 'publish'):
+        raise ValueError('issuer phase refused')
+    if any(type(value) is not int or value < 1 for value in (installation_id, app_id)):
+        raise ValueError('issuer identity refused')
+    repository = scope['repository']
+    # Validate repository grammar with the same canonical controller contract.
+    import re
+    if not isinstance(repository, str) or not re.fullmatch(
+            r'ContextualWisdomLab/(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+', repository):
+        raise ValueError('issuer repository refused')
+    if scope['reviewer'] != 'cwl-noema-review[bot]':
+        raise ValueError('issuer actor refused')
+    parent, target = Path(private_parent), Path(output)
+    if not parent.is_absolute() or not target.is_absolute() or target.parent != parent:
+        raise ValueError('issuer output namespace refused')
+    for ancestor in (parent, *parent.parents):
+        if ancestor.is_symlink():
+            raise ValueError('issuer output namespace refused')
+    info = parent.lstat()
+    if not stat.S_ISDIR(info.st_mode) or info.st_uid != os.getuid() or info.st_mode & 0o077:
+        raise ValueError('issuer output namespace refused')
+    if os.path.lexists(target):
+        raise ValueError('issuer output already exists')
+    revalidate()
+    app = _response(request('GET', '/app', None))
+    if type(app.get('id')) is not int or app.get('id') != app_id or app.get('slug') != 'cwl-noema-review':
+        raise ValueError('issuer App identity refused')
+    revalidate()
+    installation = _response(request('GET', '/repos/' + repository + '/installation', None))
+    if (type(installation.get('id')) is not int or type(installation.get('app_id')) is not int
+            or installation.get('id') != installation_id or installation.get('app_id') != app_id):
+        raise ValueError('issuer installation refused')
+    revalidate()
+    permissions = {'contents': 'read', 'metadata': 'read',
+                   'pull_requests': 'read' if phase == 'prepare' else 'write'}
+    raw = request('POST', f'/app/installations/{installation_id}/access_tokens',
+                  {'repositories': [repository.split('/', 1)[1]], 'permissions': permissions})
+    response = _response(raw)
+    if response.get('permissions') != permissions:
+        raise ValueError('issuer phase grant refused')
+    repositories = response.get('repositories')
+    if (not isinstance(repositories, list) or len(repositories) != 1
+            or not isinstance(repositories[0], dict)
+            or repositories[0].get('full_name') != repository):
+        raise ValueError('issuer response repository refused')
+    if not isinstance(response.get('token'), str) or not response['token'].strip():
+        raise ValueError('issuer token missing')
+    revalidate()
+    current = parent.lstat()
+    if (current.st_dev, current.st_ino, current.st_mode, current.st_uid) != (
+            info.st_dev, info.st_ino, info.st_mode, info.st_uid):
+        raise ValueError('issuer output custody changed')
+    fd = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+    try:
+        with os.fdopen(fd, 'wb') as stream:
+            stream.write(raw)
+            stream.flush()
+            os.fsync(stream.fileno())
+    except BaseException:
+        # Retain incomplete private bytes for the existing custody owner;
+        # never overwrite/retry a secret-bearing output after ambiguous I/O.
+        raise
+    return target
+
+
+def _private_bytes(path, parent):
+    """Read one bounded private single-link credential input without diagnostics."""
+    path, parent = Path(path), Path(parent)
+    if not path.is_absolute() or path.parent != parent or parent.is_symlink():
+        raise ValueError('private credential namespace refused')
+    fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
+    try:
+        info = os.fstat(fd)
+        if (not stat.S_ISREG(info.st_mode) or info.st_nlink != 1
+                or info.st_uid != os.getuid() or info.st_mode & 0o077):
+            raise ValueError('private credential custody refused')
+        raw = os.read(fd, MAX_RESPONSE_BYTES + 1)
+        if not 0 < len(raw) <= MAX_RESPONSE_BYTES:
+            raise ValueError('private credential size refused')
+        return raw
+    finally:
+        os.close(fd)
+
+
+def authenticated_transport(jwt_file, private_parent, *, opener=None):
+    """Use the existing externally supplied App JWT on fixed GitHub routes only.
+
+    The runtime owner provides and refreshes this private credential; this helper
+    neither signs a JWT nor reads an App private key. Injected openers are trusted
+    test collaborators, not PR inputs. No redirect or ambient proxy is admitted.
+    """
+    import re
+    import urllib.request
+    jwt = _private_bytes(jwt_file, private_parent).decode('ascii')
+    if not jwt or any(character.isspace() for character in jwt):
+        raise ValueError('existing App authentication unavailable')
+    class NoRedirect(urllib.request.HTTPRedirectHandler):
+        """Reject credential forwarding before any redirected request dispatch."""
+        def redirect_request(self, req, fp, code, msg, headers, newurl):
+            """Keep every response on the independently fixed issuer origin."""
+            return None
+    if opener is None:
+        opener = urllib.request.build_opener(
+            urllib.request.ProxyHandler({}), NoRedirect()).open
+    def request(method, route, payload):
+        """Return unchanged bounded body bytes from an exact authenticated request."""
+        get = method == 'GET' and (route == '/app' or re.fullmatch(
+            r'/repos/ContextualWisdomLab/(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+/installation', route))
+        post = method == 'POST' and re.fullmatch(r'/app/installations/[1-9][0-9]*/access_tokens', route)
+        if not (get or post) or (get and payload is not None):
+            raise ValueError('issuer endpoint refused')
+        body = json.dumps(payload, allow_nan=False).encode() if post else None
+        req = urllib.request.Request('https://api.github.com' + route, data=body,
+            method=method, headers={'Authorization': 'Bearer ' + jwt,
+                'Accept': 'application/vnd.github+json', 'X-GitHub-Api-Version': '2022-11-28',
+                'Content-Type': 'application/json'})
+        with opener(req, timeout=60) as response:
+            headers = getattr(response, 'headers', {})
+            length = headers.get('Content-Length')
+            raw = response.read(MAX_RESPONSE_BYTES + 1)
+            if (not isinstance(raw, bytes) or not 0 < len(raw) <= MAX_RESPONSE_BYTES
+                    or (length is not None and (not str(length).isdigit() or int(length) != len(raw)))):
+                raise ValueError('issuer response framing refused')
+            return raw
+    return request
+
+
+def main(argv=None):
+    """Consume independently pinned bootstrap inputs, refusing absent admission."""
+    import argparse
+    import hashlib
+    import re
+    parser = argparse.ArgumentParser(description=__doc__)
+    modes = parser.add_mutually_exclusive_group(required=True)
+    modes.add_argument('--materialize', action='store_true')
+    modes.add_argument('--issue-prepare', action='store_true')
+    modes.add_argument('--issue-publish', action='store_true')
+    modes.add_argument('--revalidate-publish', action='store_true')
+    modes.add_argument('--revalidate-prepare', action='store_true')
+    parser.add_argument('--private-parent', type=Path, required=True)
+    parser.add_argument('--source-root', type=Path, required=True)
+    parser.add_argument('--manifest', type=Path, required=True)
+    parser.add_argument('--accepted-digest', required=True)
+    parser.add_argument('--admission', type=Path, required=True)
+    parser.add_argument('--admission-digest', required=True)
+    parser.add_argument('--repo', required=True)
+    parser.add_argument('--pr-number', type=int, required=True)
+    parser.add_argument('--expected-head', required=True)
+    parser.add_argument('--app-jwt-file', type=Path)
+    parser.add_argument('--verdict-file', type=Path)
+    args = parser.parse_args(argv)
+    try:
+        if not all(re.fullmatch(r'[0-9a-f]{64}', value) for value in
+                   (args.accepted_digest, args.admission_digest)):
+            raise ValueError('bootstrap independent pins unavailable')
+        raw = args.manifest.read_bytes()
+        admission_raw = args.admission.read_bytes()
+        if hashlib.sha256(admission_raw).hexdigest() != args.admission_digest:
+            raise ValueError('bootstrap admission pin refused')
+        admission = _response(admission_raw)
+        scope = admission['scope']
+        if (scope['repository'], scope['number'], scope['head']) != (
+                args.repo, args.pr_number, args.expected_head):
+            raise ValueError('bootstrap target refused')
+        if args.materialize:
+            materialize_tooling(args.source_root, args.private_parent / 'tooling', raw,
+                accepted_digest=args.accepted_digest, admission=admission,
+                private_parent=args.private_parent)
+            return 0
+        from scripts.ci.premerge_review_tooling import (
+            require_prepared_envelope, require_review_scope, load_noema_tooling,
+        )
+        def fence():
+            """Bind original pins, actual admitted tooling and fresh live metadata."""
+            if (args.manifest.read_bytes() != raw
+                    or args.admission.read_bytes() != admission_raw):
+                raise ValueError('bootstrap external pins changed')
+            tooling = args.private_parent / 'tooling'
+            _validate_runtime(admission, args.private_parent)
+            load_noema_tooling(tooling, raw, accepted_digest=args.accepted_digest,
+                interpreter=Path(sys.executable), phase_environment=lambda _: {})
+            pr = json.loads(subprocess.run(['gh', 'api', f'repos/{args.repo}/pulls/{args.pr_number}'],
+                capture_output=True, text=True, check=True, timeout=60).stdout)
+            require_review_scope(scope, {'repository':pr['base']['repo']['full_name'],
+                'number':pr['number'],'head':pr['head']['sha'],'base':pr['base']['sha'],
+                'author':pr['user']['login'],'reviewer':scope['reviewer'],
+                'state':str(pr['state']).upper(),'draft':pr['draft']})
+            if (args.manifest.read_bytes() != raw
+                    or args.admission.read_bytes() != admission_raw):
+                raise ValueError('bootstrap external pins changed during live read')
+            load_noema_tooling(tooling, raw, accepted_digest=args.accepted_digest,
+                interpreter=Path(sys.executable), phase_environment=lambda _: {})
+            for field in ('isolated_clean_job', 'native_custody', 'supplier_cost',
+                          'supplier_retention', 'issuer_phase_separation'):
+                if admission.get(field) is not True:
+                    raise ValueError('bootstrap execution evidence unavailable')
+            _validate_runtime(admission, args.private_parent)
+            if args.issue_publish or args.revalidate_publish:
+                if args.verdict_file != args.private_parent / 'verdict.json':
+                    raise ValueError('bootstrap envelope namespace refused')
+                require_prepared_envelope(args.verdict_file, scope)
+        if args.revalidate_publish or args.revalidate_prepare:
+            fence()
+            return 0
+        if args.app_jwt_file is None:
+            raise ValueError('authenticated issuer transport unavailable')
+        fence()
+        transport = authenticated_transport(args.app_jwt_file, args.private_parent)
+        phase = 'publish' if args.issue_publish else 'prepare'
+        produce_issuance(phase, scope=scope, installation_id=admission['installation_id'],
+            app_id=admission['app_id'], output=args.private_parent / (phase+'.json'),
+            private_parent=args.private_parent, request=transport, revalidate=fence)
+        return 0
+    except (OSError, ValueError, KeyError, TypeError, subprocess.SubprocessError):
+        print('Noema bootstrap refused: independent issuer or custody input unavailable', file=sys.stderr)
+        return 1
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())
diff --git a/scripts/ci/noema_existing_app_issuer.cjs b/scripts/ci/noema_existing_app_issuer.cjs
new file mode 100644
index 0000000000..9e43907388
--- /dev/null
+++ b/scripts/ci/noema_existing_app_issuer.cjs
@@ -0,0 +1,255 @@
+/* Existing-App phase issuer. Only trusted workflow steps supply Secret inputs.
+ * No key/JWT/token is projected into stdout, argv, artifacts or child env.
+ * Callbacks below are trusted fixture seams, never PR-provided code.
+ */
+'use strict';
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const https = require('node:https');
+const {spawnSync} = require('node:child_process');
+const LIMIT = 2 * 1024 * 1024;
+
+function signApp(clientId, pem, now) {
+  if (typeof clientId !== 'string' || !/^[A-Za-z0-9_.-]+$/.test(clientId) ||
+      typeof pem !== 'string' || !Number.isSafeInteger(now)) throw new Error('signer refused');
+  const key = crypto.createPrivateKey(pem);
+  if (key.asymmetricKeyType !== 'rsa' || key.asymmetricKeyDetails.modulusLength < 2048)
+    throw new Error('signer refused');
+  const encode = value => Buffer.from(JSON.stringify(value)).toString('base64url');
+  const body = encode({alg:'RS256',typ:'JWT'}) + '.' + encode({iat:now-60,exp:now+300,iss:clientId});
+  return body + '.' + crypto.sign('RSA-SHA256',Buffer.from(body),key).toString('base64url');
+}
+
+function parse(raw, captureToken) {
+  if (!Buffer.isBuffer(raw) || !raw.length || raw.length > LIMIT) throw new Error('response refused');
+  const text = new TextDecoder('utf-8',{fatal:true}).decode(raw);
+  const value = JSON.parse(text);
+  if (!value || Array.isArray(value) || typeof value !== 'object') throw new Error('response refused');
+  // Native JSON.parse validates syntax but silently keeps the last duplicate.
+  // Walk that validated grammar to reject duplicates at every object depth.
+  let cursor=0,duplicate=false,duplicateToken=false;
+  function whitespace(){while(/\s/.test(text[cursor]||'') && cursor<text.length)cursor++;}
+  function string(){const m=text.slice(cursor).match(/^"(?:[^"\\]|\\.)*"/s);if(!m)throw new Error('response refused');cursor+=m[0].length;return JSON.parse(m[0]);}
+  function walk(depth){
+    if(depth>128)throw new Error('response refused');whitespace();
+    const c=text[cursor];
+    if(c==='"'){string();return;}
+    if(c==='{' || c==='['){
+      cursor++;whitespace();const keys=new Set(),end=c==='{'?'}':']';
+      if(text[cursor]===end){cursor++;return;}
+      for(;;){
+        if(c==='{'){
+          const key=string();if(keys.has(key)){duplicate=true;if(depth===0 && key==='token')duplicateToken=true;}keys.add(key);
+          whitespace();cursor++; // colon: syntax was already validated above
+        }
+        walk(depth+1);whitespace();const separator=text[cursor++];
+        if(separator===end)break;whitespace();
+      }
+      return;
+    }
+    const m=text.slice(cursor).match(/^(?:-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/);
+    if(!m)throw new Error('response refused');cursor+=m[0].length;
+  }
+  walk(0);
+  if(captureToken && !duplicateToken && typeof value.token==='string' && value.token.trim() && !/\s/.test(value.token))
+    captureToken(value.token);
+  if(duplicate)throw new Error('response duplicate refused');
+  return value;
+}
+
+function transport(method, route, payload, credential) {
+  if (!['GET','POST','DELETE'].includes(method) ||
+      !/^\/(app|repos\/ContextualWisdomLab\/(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+\/installation|app\/installations\/[1-9][0-9]*\/access_tokens|installation\/token)$/.test(route))
+    return Promise.reject(new Error('endpoint refused'));
+  return new Promise((resolve,reject) => {
+    const body = payload === null ? null : Buffer.from(JSON.stringify(payload));
+    const req = https.request({hostname:'api.github.com',port:443,path:route,method,
+      headers:{Authorization:'Bearer '+credential,Accept:'application/vnd.github+json',
+        'X-GitHub-Api-Version':'2022-11-28','User-Agent':'cwl-noema-issuer',
+        ...(body ? {'Content-Type':'application/json','Content-Length':body.length}: {})}}, res => {
+      const chunks=[];let size=0;
+      res.on('data',chunk=>{size+=chunk.length;if(size>LIMIT){res.destroy();reject(new Error('response refused'));}else chunks.push(chunk);});
+      res.on('aborted',()=>reject(new Error('response refused')));
+      res.on('error',()=>reject(new Error('response refused')));
+      res.on('end',()=>{
+        const length=res.headers['content-length'];
+        if (res.statusCode !== (method==='DELETE'?204:method==='POST'?201:200) ||
+            !res.complete || (length!==undefined && (!/^[0-9]+$/.test(length) || Number(length)!==size)))
+          {const error=new Error('response refused');error.statusCode=res.statusCode;reject(error);}
+        else resolve(Buffer.concat(chunks));
+      });
+    });
+    req.setTimeout(60000,()=>req.destroy(new Error('request refused')));
+    req.on('error',()=>reject(new Error('request refused')));
+    if(body)req.write(body);req.end();
+  });
+}
+
+function privateParent(parent) {
+  if (!path.isAbsolute(parent) || path.resolve(parent)!==parent) throw new Error('custody refused');
+  for(let p=parent;;p=path.dirname(p)){
+    if(fs.lstatSync(p).isSymbolicLink())throw new Error('custody refused');
+    if(path.dirname(p)===p)break;
+  }
+  const s=fs.lstatSync(parent);
+  if(!s.isDirectory() || s.uid!==process.getuid() || (s.mode&0o077))throw new Error('custody refused');
+  return s;
+}
+
+async function runPhase(options) {
+  const {phase,scope,appId,installationId,privateParent:parent,clientId,privateKey,
+    fence,controller,transport:request=transport,now=()=>Math.floor(Date.now()/1000)}=options;
+  if (!['prepare','publish'].includes(phase) || !Number.isSafeInteger(appId) || appId<1 ||
+      !Number.isSafeInteger(installationId) || installationId<1 ||
+      !/^ContextualWisdomLab\/(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+$/.test(scope.repository) ||
+      scope.reviewer!=='cwl-noema-review[bot]')throw new Error('identity refused');
+  const initial=privateParent(parent);const target=path.join(parent,phase+'.json');
+  if(fs.existsSync(target) || fs.lstatSync(parent).ino!==initial.ino)throw new Error('delivery refused');
+  const tokens=[];const expiries=new Map();let delivered=false;let primary;let result;let cleanupFailed=false;
+  async function issue(grant, readToken) {
+    // Short-lived App authentication is created inside each issuer phase, not
+    // supplied by an absent external JWT producer or retained across the model.
+    const jwt=signApp(clientId,privateKey,now());
+    const app=parse(await request('GET','/app',null,jwt));
+    if(app.id!==appId || app.slug!=='cwl-noema-review')throw new Error('identity refused');
+    if(readToken)await fence(readToken,phase);
+    const install=parse(await request('GET','/repos/'+scope.repository+'/installation',null,jwt));
+    if(install.id!==installationId || install.app_id!==appId)throw new Error('identity refused');
+    if(readToken)await fence(readToken,phase);
+    const permissions={contents:'read',metadata:'read',pull_requests:grant};
+    const raw=await request('POST','/app/installations/'+installationId+'/access_tokens',
+      {repositories:[scope.repository.split('/')[1]],permissions},jwt);
+    const response=parse(raw, token => tokens.push(token));
+    // Capture a safely parsed token before checking grant/expiry/delivery so
+    // rejected issuance is still revocation-owned. Never use it for fallback.
+    if(!tokens.includes(response.token))throw new Error('token refused');
+    if(Object.keys(response.permissions||{}).length!==3 ||
+        Object.entries(permissions).some(([k,v])=>response.permissions[k]!==v) ||
+        !Array.isArray(response.repositories) || response.repositories.length!==1 ||
+        response.repositories[0].full_name!==scope.repository)throw new Error('grant refused');
+    const expires=Date.parse(response.expires_at);
+    if(!Number.isFinite(expires) || expires<=now()*1000+60000)throw new Error('expiry refused');
+    expiries.set(response.token,expires);
+    return {raw,token:response.token};
+  }
+  try {
+    const read=await issue('read');
+    await fence(read.token,phase);
+    let selected=read;
+    if(phase==='publish'){
+      selected=await issue('write',read.token);
+      await fence(read.token,phase);
+    }
+    const current=privateParent(parent);
+    if(current.dev!==initial.dev || current.ino!==initial.ino || current.mode!==initial.mode)
+      throw new Error('custody refused');
+    const fd=fs.openSync(target,fs.constants.O_WRONLY|fs.constants.O_CREAT|fs.constants.O_EXCL|fs.constants.O_NOFOLLOW,0o600);
+    delivered=true;
+    try{fs.writeFileSync(fd,selected.raw);fs.fsyncSync(fd);}finally{fs.closeSync(fd);}
+    const env={PATH:'/usr/bin:/bin',GH_TOKEN:read.token};
+    // The controller's live metadata read uses the read grant; its publisher
+    // child receives the separately issued write grant from the original file.
+    result=await controller(target,env);
+    if(result!==0)throw new Error('controller refused');
+  } catch(error){primary=error;}
+  finally {
+    for(const token of tokens){
+      try{await request('DELETE','/installation/token',null,token);}
+      catch(error){
+        if(!(error.statusCode===401 && expiries.has(token) && expiries.get(token)<=now()*1000))cleanupFailed=true;
+      }
+    }
+    if(delivered){try{fs.unlinkSync(target);}catch{cleanupFailed=true;}}
+  }
+  if(cleanupFailed)throw new Error('issuer cleanup unconfirmed');
+  if(primary)throw primary;
+  return result;
+}
+
+module.exports={signApp,runPhase,transport};
+
+async function main(argv=process.argv.slice(2), environment=process.env) {
+  const values={};
+  const names=['phase','private-parent','source-root','manifest','accepted-digest','admission',
+    'admission-digest','repo','pr-number','expected-head','verdict-file'];
+  if(argv.length%2)throw new Error('arguments refused');
+  for(let i=0;i<argv.length;i+=2){
+    const name=argv[i].slice(2);
+    if(argv[i]!=='--'+name || !names.includes(name) || name in values)throw new Error('arguments refused');
+    values[name]=argv[i+1];
+  }
+  if(names.some(n=>!values[n]) || !['prepare','publish'].includes(values.phase) ||
+      !/^[1-9][0-9]*$/.test(values['pr-number']) || !/^[a-f0-9]{40}$/.test(values['expected-head']))
+    throw new Error('arguments refused');
+  const phase=values.phase,parent=values['private-parent'];privateParent(parent);
+  const admissionRaw=fs.readFileSync(values.admission);
+  if(!/^[a-f0-9]{64}$/.test(values['admission-digest']) ||
+      crypto.createHash('sha256').update(admissionRaw).digest('hex')!==values['admission-digest'])
+    throw new Error('admission refused');
+  const admission=parse(admissionRaw),scope=admission.scope;
+  if(scope.repository!==values.repo || scope.number!==Number(values['pr-number']) ||
+      scope.head!==values['expected-head'] || values['verdict-file']!==path.join(parent,'verdict.json'))
+    throw new Error('scope refused');
+  const python=admission.interpreter?.path;
+  if(!python || !path.isAbsolute(python) ||
+      !/^[a-f0-9]{64}$/.test(admission.interpreter.sha256) ||
+      crypto.createHash('sha256').update(fs.readFileSync(python)).digest('hex')!==admission.interpreter.sha256)
+    throw new Error('interpreter refused');
+  const pythonIdentity=fs.statSync(python);
+  const pythonRealpath=fs.realpathSync(python);
+  const pinnedNode=admission.dependencies?.[fs.realpathSync(process.execPath)];
+  if(!pinnedNode || crypto.createHash('sha256').update(fs.readFileSync(process.execPath)).digest('hex')!==pinnedNode)
+    throw new Error('issuer interpreter refused');
+  const root=path.resolve(__dirname,'../..');
+  const common=['--private-parent',parent,'--source-root',values['source-root'],
+    '--manifest',values.manifest,'--accepted-digest',values['accepted-digest'],
+    '--admission',values.admission,'--admission-digest',values['admission-digest'],
+    '--repo',values.repo,'--pr-number',values['pr-number'],'--expected-head',values['expected-head']];
+  function child(script,args,env){
+    // Revalidate after every issuer wait, before either credential-bearing child.
+    // This is not atomic pathname execution; exclusive runtime custody remains required.
+    const current=fs.statSync(python);
+    if(!current.isFile() || fs.realpathSync(python)!==pythonRealpath ||
+        ['dev','ino','mode','uid','gid'].some(key=>current[key]!==pythonIdentity[key]) ||
+        crypto.createHash('sha256').update(fs.readFileSync(python)).digest('hex')!==admission.interpreter.sha256)
+      throw new Error('interpreter refused');
+    const result=spawnSync(python,['-I','-B',path.join(root,'scripts/ci',script),...args],
+      {env,cwd:root,stdio:'ignore'});
+    if(result.error || result.signal || result.status===null)throw new Error('child refused');
+    return result.status;
+  }
+  const runtimePath=environment.PATH;
+  if(!runtimePath)throw new Error('runtime refused');
+  const fence=async(token,requested)=>{
+    const mode=requested==='publish'?'--revalidate-publish':'--revalidate-prepare';
+    const args=[mode,...common];
+    if(requested==='publish')args.push('--verdict-file',values['verdict-file']);
+    if(child('noema_bootstrap_producer.py',args,{PATH:runtimePath,GH_TOKEN:token})!==0)
+      throw new Error('scope refused');
+  };
+  const controller=async(file,metadataEnvironment)=>{
+    // Do not inherit Secret/JWT, workflow write token or inference into publisher.
+    const env={PATH:runtimePath,GH_TOKEN:metadataEnvironment.GH_TOKEN};
+    if(phase==='prepare'){
+      if(!environment.LLM_GATEWAY_API_KEY)throw new Error('inference refused');
+      env.LLM_GATEWAY_API_KEY=environment.LLM_GATEWAY_API_KEY;
+    }
+    const args=['--'+phase+'-production','--tooling-root',path.join(parent,'tooling'),
+      '--manifest',values.manifest,'--accepted-digest',values['accepted-digest'],
+      '--admission',values.admission,'--admission-digest',values['admission-digest'],
+      '--repo',values.repo,'--pr-number',values['pr-number'],'--expected-head',values['expected-head'],
+      '--verdict-file',values['verdict-file'],'--phase-issuance',file];
+    return child('premerge_review_tooling.py',args,env);
+  };
+  return runPhase({phase,scope,appId:admission.app_id,installationId:admission.installation_id,
+    privateParent:parent,clientId:environment.NOEMA_GITHUB_APP_CLIENT_ID,
+    privateKey:environment.NOEMA_GITHUB_APP_PRIVATE_KEY,fence,controller});
+}
+module.exports.main=main;
+if(require.main===module){
+  main().then(status=>{process.exitCode=status;}).catch(()=>{
+    // Fixed, credential-free disposition also covers unconfirmed revocation.
+    console.error('Noema existing-App issuer refused; issuance or cleanup unconfirmed');process.exitCode=1;
+  });
+}
diff --git a/scripts/ci/noema_review_document.py b/scripts/ci/noema_review_document.py
index 17d3ca603c..4594f5434b 100644
--- a/scripts/ci/noema_review_document.py
+++ b/scripts/ci/noema_review_document.py
@@ -158,7 +158,7 @@ def _extract_hwp_with_reviewed_reader(path: str, raw: bytes) -> str:
         handle.flush()
         try:
             completed = subprocess.run(
-                ["node", reader, source, handle.name],
+                [os.environ.get("NOEMA_NODE_EXECUTABLE") or "node", reader, source, handle.name],
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
                 check=False,
diff --git a/scripts/ci/noema_review_gate.py b/scripts/ci/noema_review_gate.py
index 380ee22675..156f5aafa3 100644
--- a/scripts/ci/noema_review_gate.py
+++ b/scripts/ci/noema_review_gate.py
@@ -357,6 +357,7 @@ def graphql(query: str, **fields: str | int) -> dict[str, Any]:
       number
       title
       body
+      author { login }
       isDraft
       state
       headRefOid
@@ -526,6 +527,18 @@ def current_actor() -> str:
     return ""
 
 
+def require_distinct_pr_author(pr: dict[str, Any], actor: str) -> str:
+    """Require a known PR author distinct from the active reviewer actor."""
+    author = pr.get("author")
+    login = author.get("login") if isinstance(author, dict) else None
+    if not isinstance(login, str) or not login.strip():
+        raise RuntimeError("Noema pull request author identity could not be verified")
+    normalized = login.strip().casefold()
+    if not actor or actor.strip().casefold() == normalized:
+        raise RuntimeError("Noema reviewer actor must be distinct from the pull request author")
+    return normalized
+
+
 def fetch_diff(repo: str, number: int) -> tuple[str, bool]:
     """Fetch the PR diff and truncate it to the bounded LLM prompt size."""
     diff = run(["gh", "api", f"repos/{repo}/pulls/{number}", "-H", "Accept: application/vnd.github.v3.diff"])
@@ -1606,7 +1619,7 @@ def call_llm(
     """
     api_url = os.environ.get("NOEMA_LLM_API_URL", "").strip()
     api_key = os.environ.get("NOEMA_LLM_API_KEY", "").strip()
-    model = os.environ.get("NOEMA_LLM_MODEL", "").strip() or "orchestrator/free"
+    model = os.environ.get("NOEMA_LLM_MODEL", "").strip() or "orchestrator/auto"
     if not api_url or not api_key:
         raise RuntimeError(
             "Noema LLM review unavailable: NOEMA_LLM_API_URL or NOEMA_LLM_API_KEY is not configured."
@@ -1719,12 +1732,15 @@ def call_llm(
         http_status: int | None = None
         retry_after_seconds: int | None = None
         if isinstance(exc, urllib.error.HTTPError):
-            active_phase = "response_error"
-            http_status = exc.code if type(exc.code) is int else None
-            retry_after_seconds = parse_http_retry_after_seconds(exc.headers)
-            gateway_telemetry = _extract_http_error_telemetry(exc)
-            model_value = gateway_telemetry.get("served_model")
-            served_model = model_value if isinstance(model_value, str) else None
+            try:
+                active_phase = "response_error"
+                http_status = exc.code if type(exc.code) is int else None
+                retry_after_seconds = parse_http_retry_after_seconds(exc.headers)
+                gateway_telemetry = _extract_http_error_telemetry(exc)
+                model_value = gateway_telemetry.get("served_model")
+                served_model = model_value if isinstance(model_value, str) else None
+            finally:
+                exc.close()
         elapsed = time.monotonic() - attempt_started
         current_failure = _stable_failure_diagnostic(exc)
         model_note = served_model or "unknown"
@@ -1879,6 +1895,7 @@ def inspect_and_review(repo: str, number: int, expected_head: str) -> int:
     actor = current_actor()
     if not actor:
         raise RuntimeError("Noema reviewer identity could not be verified")
+    require_distinct_pr_author(pr, actor)
     if actor in PRIMARY_REVIEW_AUTHORS:
         raise RuntimeError(
             f"Current token actor {actor!r} is already a primary review actor; "
@@ -1901,6 +1918,7 @@ def inspect_and_review(repo: str, number: int, expected_head: str) -> int:
     except RuntimeError:
         print("Pull request closed or its head changed during review; stale verdict was not published.")
         return 0
+    require_distinct_pr_author(current_pr, actor)
     submit_review(repo, number, current_pr, actor, verdict)
     return 0
 
diff --git a/scripts/ci/noema_review_handoff.py b/scripts/ci/noema_review_handoff.py
index a112e1e225..3f4a8a20a7 100644
--- a/scripts/ci/noema_review_handoff.py
+++ b/scripts/ci/noema_review_handoff.py
@@ -195,7 +195,7 @@ def dispatch_noema(
     *,
     runner: GhRunner = run_gh,
 ) -> None:
-    """Dispatch the target repository's default-branch Noema workflow."""
+    """Dispatch the central handler while retaining the exact consumer identity."""
     payload = {
         "event_type": "noema-review",
         "client_payload": {
@@ -205,7 +205,7 @@ def dispatch_noema(
         },
     }
     runner(
-        ["api", "-X", "POST", f"repos/{repo}/dispatches", "--input", "-"],
+        ["api", "-X", "POST", "repos/ContextualWisdomLab/.github/dispatches", "--input", "-"],
         json.dumps(payload),
     )
 
diff --git a/scripts/ci/opencode_queue_priority.py b/scripts/ci/opencode_queue_priority.py
index 7024099b62..75ec11c58b 100755
--- a/scripts/ci/opencode_queue_priority.py
+++ b/scripts/ci/opencode_queue_priority.py
@@ -38,6 +38,8 @@
 
 @dataclass(frozen=True)
 class QueuedRun:
+    """Identify one queued OpenCode review run."""
+
     run_id: int
     created_at: datetime
     repo: str
@@ -47,6 +49,8 @@ class QueuedRun:
 
 @dataclass(frozen=True)
 class PrState:
+    """Describe the live pull request state used to classify a queued run."""
+
     state: str
     head: str
     priority: bool
@@ -54,6 +58,8 @@ class PrState:
 
 @dataclass(frozen=True)
 class Plan:
+    """Partition ordered queued runs by priority and validity."""
+
     keep: tuple[QueuedRun, ...]
     cancel_current: tuple[QueuedRun, ...]
     cancel_stale: tuple[QueuedRun, ...]
@@ -94,10 +100,14 @@ def metrics(p: Plan, *, now: datetime) -> dict:
 
 
 def _gh(*args: str, stdin: str | None = None) -> str:
+    """Run a GitHub CLI command and return its standard output."""
+
     return subprocess.run(["gh", *args], input=stdin, capture_output=True, text=True, check=True).stdout
 
 
 def fetch_queued() -> list[QueuedRun]:
+    """Return queued dispatch runs with parseable pull request identities."""
+
     out = _gh("api", "--paginate", f"repos/{CENTRAL}/actions/workflows/{WORKFLOW}/runs?status=queued&per_page=100",
               "--jq", ".workflow_runs[]|[.id,.created_at,.display_title]|@json")
     runs = []
@@ -111,6 +121,8 @@ def fetch_queued() -> list[QueuedRun]:
 
 
 def fetch_live(keys: set[tuple[str, int]], label: str) -> dict[tuple[str, int], PrState]:
+    """Fetch live pull request states and trusted priority labels for keys."""
+
     live: dict[tuple[str, int], PrState] = {}
     perms: dict[tuple[str, str], str] = {}
     keys_sorted = sorted(keys)
@@ -144,6 +156,8 @@ def fetch_live(keys: set[tuple[str, int]], label: str) -> dict[tuple[str, int],
 
 
 def main(argv: list[str] | None = None) -> int:
+    """Print queue metrics and optionally record and cancel selected runs."""
+
     ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     ap.add_argument("--label", default="review-priority")
     ap.add_argument("--include-current", action="store_true", help="also cancel non-priority current-head runs")
diff --git a/scripts/ci/opencode_repository_dispatch_targets.json b/scripts/ci/opencode_repository_dispatch_targets.json
index dd82dd1fd0..db995c9bae 100644
--- a/scripts/ci/opencode_repository_dispatch_targets.json
+++ b/scripts/ci/opencode_repository_dispatch_targets.json
@@ -51,6 +51,7 @@
     "ContextualWisdomLab/saju-caldav",
     "ContextualWisdomLab/scopeweave",
     "ContextualWisdomLab/semantic-data-portal",
+    "ContextualWisdomLab/tokyo-travel-2026",
     "ContextualWisdomLab/wardnet",
     "ContextualWisdomLab/xtrm-lead-pi-outbound",
     "ContextualWisdomLab/xtrmLLMBatchPython"
diff --git a/scripts/ci/opencode_review_receipt_gate.py b/scripts/ci/opencode_review_receipt_gate.py
index 4dcb24af88..5c86b1fc8e 100644
--- a/scripts/ci/opencode_review_receipt_gate.py
+++ b/scripts/ci/opencode_review_receipt_gate.py
@@ -149,6 +149,7 @@ def evaluate_receipts(
     if not SHA_RE.fullmatch(head_sha):
         return None, "receipt gate requires a 40-character head SHA"
     stale_hits = 0
+    dismissed_publishers: set[str] = set()
     for review in reversed(list(reviews)):
         if not isinstance(review, Mapping):
             continue
@@ -156,6 +157,17 @@ def evaluate_receipts(
         if commit and commit.lower() != head_sha.lower():
             stale_hits += 1
             continue
+        author = review_author(review)
+        if author in dismissed_publishers:
+            continue
+        if (
+            author in FORMAL_AUTHORS
+            and str(review.get("state") or "").upper() == "DISMISSED"
+            and review_matches_head(review, head_sha)
+            and review.get("id")
+        ):
+            dismissed_publishers.add(author)
+            continue
         ok, reason = is_formal_receipt(review, head_sha, is_draft=is_draft)
         if ok:
             return review, reason
@@ -166,6 +178,8 @@ def evaluate_receipts(
         if reason.startswith("stale"):
             stale_hits += 1
             continue
+    if dismissed_publishers:
+        return None, "current-head OpenCode publisher review was dismissed"
     if stale_hits:
         return (
             None,
diff --git a/scripts/ci/personal_review_route.py b/scripts/ci/personal_review_route.py
new file mode 100644
index 0000000000..b417285813
--- /dev/null
+++ b/scripts/ci/personal_review_route.py
@@ -0,0 +1,53 @@
+"""Trusted personal LiteLLM route; never infer cost/privacy from auto or HTTP200."""
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+BASE_URL = 'https://litellm.poinnetworks.net/v1'
+MODEL = 'personal-litellm/auto'
+
+
+def require_admission(*, zero_cost: bool, zero_retention: bool, private_target: bool) -> None:
+    """Reject missing supplier evidence; existing key possession is not policy."""
+    if zero_cost is not True:
+        raise RuntimeError('STOP: personal auto zero-cost supplier is not attested')
+    if private_target and zero_retention is not True:
+        raise RuntimeError('STOP: private personal auto zero-retention supplier is not attested')
+
+
+def configure_opencode(path: Path) -> None:
+    """Reset only provider/model routing, preserving read-only agent permissions."""
+    source = path.read_text(encoding='utf-8')
+    # Generated workflow configs are JSON; tracked JSONC uses full-line comments.
+    data = json.loads('\n'.join(line for line in source.splitlines()
+                                if not line.lstrip().startswith('//')))
+    data.update(model=MODEL, small_model=MODEL, enabled_providers=['personal-litellm'])
+    data['provider'] = {'personal-litellm': {
+        'npm': '@ai-sdk/openai-compatible', 'name': 'Personal LiteLLM auto',
+        'options': {'baseURL': BASE_URL, 'apiKey': '{env:LLM_GATEWAY_API_KEY}'},
+        'models': {'auto': {'name': 'Auto', 'tool_call': True,
+                            'limit': {'context': 200000, 'output': 32768}}},
+    }}
+    path.write_text(json.dumps(data, indent=2) + '\n', encoding='utf-8')
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Validate trusted nonsecret admission inputs and optionally reset config."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--zero-cost', choices=('true', 'false'), required=True)
+    parser.add_argument('--zero-retention', choices=('true', 'false'), required=True)
+    parser.add_argument('--private-target', choices=('true', 'false'), required=True)
+    parser.add_argument('--opencode-config', type=Path)
+    args = parser.parse_args(argv)
+    require_admission(zero_cost=args.zero_cost == 'true',
+                      zero_retention=args.zero_retention == 'true',
+                      private_target=args.private_target == 'true')
+    if args.opencode_config is not None:
+        configure_opencode(args.opencode_config)
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())
diff --git a/scripts/ci/pingora_edge_policy.py b/scripts/ci/pingora_edge_policy.py
index 5c1e39d9e3..4c9697f1d7 100644
--- a/scripts/ci/pingora_edge_policy.py
+++ b/scripts/ci/pingora_edge_policy.py
@@ -467,11 +467,17 @@ def _github_open_json(url: str, token: str) -> object:
         with github_opener.open(request, timeout=30) as response:
             payload = response.read(MAX_RESPONSE_BYTES + 1)
     except (HTTPError, URLError, TimeoutError) as exc:
-        if isinstance(exc, HTTPError) and exc.code == 404:
-            raise ArtifactDeclarationNotFoundError(
-                f"GitHub API reported no resource for policy evidence at {url}"
+        try:
+            if isinstance(exc, HTTPError) and exc.code == 404:
+                raise ArtifactDeclarationNotFoundError(
+                    f"GitHub API reported no resource for policy evidence at {url}"
+                ) from exc
+            raise PolicyError(
+                f"GitHub API request failed for policy evidence: {type(exc).__name__}"
             ) from exc
-        raise PolicyError(f"GitHub API request failed for policy evidence: {type(exc).__name__}") from exc
+        finally:
+            if isinstance(exc, HTTPError):
+                exc.close()
     if len(payload) > MAX_RESPONSE_BYTES:
         raise PolicyError("GitHub API policy response exceeded the bounded response size")
     try:
@@ -497,7 +503,13 @@ def _github_open_raw_bytes(url: str, token: str, max_bytes: int) -> bytes:
         with github_opener.open(request, timeout=30) as response:
             raw = response.read(max_bytes + 1)
     except (HTTPError, URLError, TimeoutError) as exc:
-        raise PolicyError(f"GitHub raw blob request failed: {type(exc).__name__}") from exc
+        try:
+            raise PolicyError(
+                f"GitHub raw blob request failed: {type(exc).__name__}"
+            ) from exc
+        finally:
+            if isinstance(exc, HTTPError):
+                exc.close()
     if len(raw) > max_bytes:
         raise PolicyError("GitHub raw blob exceeded the bounded response size")
     return raw
@@ -614,8 +626,6 @@ def _load_raw_file_bytes(
         return raw
     if encoding == "none":
         raise PolicyError(f"GitHub content evidence for {path} has no inline content and no verifiable oversized size")
-    if encoding != "base64":
-        raise PolicyError(f"GitHub content evidence for {path} is not a regular base64 file")
     encoded = payload.get("content")
     if not isinstance(encoded, str):
         raise PolicyError(f"GitHub content evidence for {path} has a malformed size or content field")
diff --git a/scripts/ci/place_maturin_extension.py b/scripts/ci/place_maturin_extension.py
index 45ff27aba5..c6fd690216 100755
--- a/scripts/ci/place_maturin_extension.py
+++ b/scripts/ci/place_maturin_extension.py
@@ -19,10 +19,14 @@
 
 
 def _inside(path: pathlib.Path, root: pathlib.Path) -> bool:
+    """Return whether path is root or is contained by root."""
+
     return path == root or root in path.parents
 
 
 def place(wheel: pathlib.Path, project_dir: pathlib.Path) -> list[pathlib.Path]:
+    """Copy wheel extensions into existing project package directories."""
+
     project = project_dir.resolve()
     pyproject = tomllib.loads((project / "pyproject.toml").read_text(encoding="utf-8"))
     python_source = pyproject.get("tool", {}).get("maturin", {}).get("python-source", ".")
@@ -48,6 +52,8 @@ def place(wheel: pathlib.Path, project_dir: pathlib.Path) -> list[pathlib.Path]:
 
 
 def main(argv: list[str]) -> int:
+    """Run extension placement and return its process status."""
+
     if len(argv) != 2:
         print("usage: place_maturin_extension.py WHEEL PROJECT_DIR", file=sys.stderr)
         return 2
diff --git a/scripts/ci/pr_review_merge_scheduler_core.py b/scripts/ci/pr_review_merge_scheduler_core.py
index 5a86bd24c8..b2990236f1 100644
--- a/scripts/ci/pr_review_merge_scheduler_core.py
+++ b/scripts/ci/pr_review_merge_scheduler_core.py
@@ -2249,28 +2249,78 @@ def has_current_head_approval(pr: dict[str, Any]) -> bool:
     return current_head_review_state(pr, "APPROVED")
 
 
+def is_substantive_noema_app_approval(review: dict[str, Any], head: str) -> bool:
+    """Recognize only the known second-review App's actual publisher contract.
+
+    API author and commit identity remain authoritative. Body markers alone
+    cannot authorize an arbitrary bot, a personal-token fallback or OpenCode.
+    """
+    if (
+        review_author_login(review) not in {"cwl-noema-review", "cwl-noema-review[bot]"}
+        or not is_bot_review_author(review)
+        or (review.get("commit") or {}).get("oid") != head
+        or not re.fullmatch(r"[0-9a-f]{40}", head)
+    ):
+        return False
+    body = str(review.get("body") or "")
+    footer_marker = "<!-- noema-review-gate-footer -->"
+    if body.count(footer_marker) != 1:
+        return False
+    evidence, footer = body.split(footer_marker, 1)
+    expected_footers = {
+        (
+            f"\n- Result: APPROVE\n- Head SHA: `{head}`\n"
+            f"- Reviewer credential: `{source}`\n"
+            "- Actor: `cwl-noema-review[bot]`\n\n"
+            f"<!-- noema-review-gate head_sha={head} decision=approve -->"
+        )
+        for source in ("noema-review-github-app", "noema-review-github-app-refresh")
+    }
+    if footer not in expected_footers:
+        return False
+    return bool(
+        evidence.startswith("## Noema LLM review\n")
+        and re.search(
+            r"### Reviewed changed lines\n- `[^`\n]+:[1-9][0-9]* \((?:LEFT|RIGHT)\)`: [^\s][^\n]*",
+            evidence,
+        )
+        and re.search(
+            r"### Adversarial validation\n- `[^`\n]+:[1-9][0-9]* \((?:LEFT|RIGHT)\)` "
+            r"falsified: [^\s][^\n]* — [^\s][^\n]*",
+            evidence,
+        )
+        and re.search(r"(?m)^- Residual risk: [^\s][^\n]*$", evidence)
+    )
+
+
 def has_independent_current_head_approval(pr: dict[str, Any]) -> bool:
-    """Return whether an eligible reviewer's latest exact-head policy state approves."""
-    author = ((pr.get("author") or {}).get("login") or "").lower()
+    """Require a non-author human or trusted, substantive second-review App."""
+    author = ((pr.get("author") or {}).get("login") or "").lower().removesuffix("[bot]")
     if not author:
         return False
     seen_reviewers: set[str] = set()
     for review in reversed((pr.get("reviews") or {}).get("nodes") or []):
-        reviewer = review_author_login(review)
+        reviewer = review_author_login(review).removesuffix("[bot]")
         state = (review.get("state") or "").upper()
         if (
             not reviewer
             or reviewer == author
             or is_automated_opencode_review(review)
             or reviewer == "github-actions"
-            or is_bot_review_author(review)
             or not review_matches_current_head(review, pr)
             or state not in {"APPROVED", "CHANGES_REQUESTED", "DISMISSED"}
             or reviewer in seen_reviewers
         ):
             continue
+        # Even a later malformed approval must retire that actor's older one.
         seen_reviewers.add(reviewer)
-        if state == "APPROVED":
+        if state == "APPROVED" and (
+            (
+                not is_bot_review_author(review)
+                and reviewer != "cwl-noema-review"
+            )
+            or is_substantive_noema_app_approval(review, str(pr.get("headRefOid") or ""))
+        ):
             return True
     return False
 
diff --git a/scripts/ci/premerge_review_tooling.py b/scripts/ci/premerge_review_tooling.py
new file mode 100644
index 0000000000..0961f15652
--- /dev/null
+++ b/scripts/ci/premerge_review_tooling.py
@@ -0,0 +1,510 @@
+"""Admit independently pinned reviewer source before loading any candidate code.
+
+This source-only boundary does not issue credentials or admit a runner. Its
+caller must obtain accepted_digest independently of PR data and supply the
+complete regular-file inventory from the selected immutable Git tree. Merely
+hashing a caller's own manifest is not independent source acceptance.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import stat
+import re
+import tempfile
+import subprocess
+from pathlib import Path
+from collections.abc import Mapping
+
+
+def _unique_object(pairs: list[tuple[str, object]]) -> dict[str, object]:
+    """Reject duplicate keys before any manifest interpretation."""
+    result: dict[str, object] = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError("manifest contains duplicate fields")
+        result[key] = value
+    return result
+
+
+def _safe_path(value: object) -> bool:
+    """Accept canonical relative inventory paths without traversal or controls."""
+    return (
+        isinstance(value, str)
+        and bool(value)
+        and "\\" not in value
+        and not any(ord(character) < 32 for character in value)
+        and all(part not in {"", ".", ".."} for part in value.split("/"))
+    )
+
+
+def admit_tooling(
+    raw_manifest: bytes, *, accepted_digest: str, source_files: Mapping[str, bytes]
+) -> None:
+    """Reject a manifest that does not match independently accepted bytes."""
+    if not isinstance(raw_manifest, bytes) or not 0 < len(raw_manifest) <= 2 * 1024 * 1024:
+        raise ValueError("manifest size is outside the bounded contract")
+    if hashlib.sha256(raw_manifest).hexdigest() != accepted_digest:
+        raise ValueError("tooling does not match the accepted manifest digest")
+    try:
+        manifest = json.loads(raw_manifest, object_pairs_hook=_unique_object)
+    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise ValueError("manifest JSON is malformed") from exc
+    keys = {"schema_version", "repository", "commit", "tree", "entrypoint", "files"}
+    if not isinstance(manifest, dict) or set(manifest) != keys:
+        raise ValueError("manifest fields do not match the trusted schema")
+    if type(manifest["schema_version"]) is not int or manifest["schema_version"] != 1:
+        raise ValueError("manifest schema version is unsupported")
+    if manifest["repository"] != "ContextualWisdomLab/.github":
+        raise ValueError("manifest tooling repository is untrusted")
+    for field in ("commit", "tree"):
+        if not isinstance(manifest[field], str) or not re.fullmatch(r"[0-9a-f]{40}", manifest[field]):
+            raise ValueError("manifest requires immutable commit and tree identities")
+    inventory = manifest["files"]
+    if not isinstance(inventory, dict) or not inventory:
+        raise ValueError("manifest source inventory must be nonempty")
+    for name, digest in inventory.items():
+        if not _safe_path(name) or not isinstance(digest, str) or not re.fullmatch(r"[0-9a-f]{64}", digest):
+            raise ValueError("manifest source inventory contains invalid paths or digests")
+    if not _safe_path(manifest["entrypoint"]) or manifest["entrypoint"] not in inventory:
+        raise ValueError("manifest entrypoint is not in the accepted source inventory")
+    actual = {name: hashlib.sha256(data).hexdigest() for name, data in source_files.items()}
+    if manifest["files"] != actual:
+        raise ValueError("tooling source inventory differs from the accepted manifest")
+
+
+def require_review_scope(expected: Mapping[str, object], live: Mapping[str, object]) -> None:
+    """Refuse changed PR scope before model preparation or App publication."""
+    fields = {"repository", "number", "head", "base", "author", "reviewer"}
+    if set(expected) != fields or set(live) != fields | {"state", "draft"}:
+        raise ValueError("review scope fields are incomplete or unexpected")
+    if type(live["number"]) is not int or type(expected["number"]) is not int or expected["number"] < 1:
+        raise ValueError("review scope PR number is invalid")
+    repository = expected["repository"]
+    if not isinstance(repository, str) or not re.fullmatch(
+        r"ContextualWisdomLab/(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+", repository
+    ):
+        raise ValueError("review scope repository is outside the organization")
+    for field in ("head", "base"):
+        if not isinstance(expected[field], str) or not re.fullmatch(r"[0-9a-f]{40}", expected[field]):
+            raise ValueError("review scope requires immutable head and base")
+    for field in ("author", "reviewer"):
+        if not isinstance(expected[field], str) or not expected[field].strip():
+            raise ValueError("review scope identity is missing")
+    if expected["author"].strip().casefold() == expected["reviewer"].strip().casefold():
+        raise ValueError("review scope requires an independent reviewer")
+    if live["state"] != "OPEN" or live["draft"] is not False:
+        raise ValueError("review scope is closed or draft")
+    if any(expected[field] != live[field] for field in fields):
+        raise ValueError("review scope changed after admission")
+
+
+def require_prepared_envelope(path: Path, scope: Mapping[str, object]) -> None:
+    """Validate compatible eight-field model output before publisher credentials.
+
+    This is same-invocation runner-local custody, not cross-run authenticity.
+    The independently admitted tooling is responsible for substantive model
+    validation; no externally supplied envelope is accepted by run_review.
+    """
+    try:
+        with os.fdopen(os.open(path, os.O_RDONLY | os.O_NOFOLLOW), "rb") as stream:
+            info = os.fstat(stream.fileno())
+            if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_mode & 0o077:
+                raise ValueError("prepared envelope is not a private single-link regular file")
+            raw = stream.read(2 * 1024 * 1024 + 1)
+        if not 0 < len(raw) <= 2 * 1024 * 1024:
+            raise ValueError("prepared envelope exceeds its bounded size")
+        payload = json.loads(raw, object_pairs_hook=_unique_object)
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise ValueError("prepared envelope is unavailable or malformed") from exc
+    keys = {"schema_version", "repository", "pull_request_number", "expected_head",
+            "expected_base", "reviewer_actor", "pull_request_author", "verdict"}
+    if not isinstance(payload, dict) or set(payload) != keys:
+        raise ValueError("prepared envelope does not match compatible producer schema")
+    if type(payload["schema_version"]) is not int or payload["schema_version"] != 1:
+        raise ValueError("prepared envelope schema version is invalid")
+    bound = {"repository": "repository", "number": "pull_request_number",
+             "head": "expected_head", "base": "expected_base",
+             "author": "pull_request_author", "reviewer": "reviewer_actor"}
+    if any(payload[key] != scope[field] for field, key in bound.items()):
+        raise ValueError("prepared envelope identity differs from admitted scope")
+    verdict = payload["verdict"]
+    if not isinstance(verdict, dict) or verdict.get("decision") not in {"approve", "request_changes", "comment"}:
+        raise ValueError("prepared envelope is missing a model verdict")
+
+
+def require_phase_environment(phase: str, environment: Mapping[str, str]) -> None:
+    """Reject loader overrides and inference capability in publisher children.
+
+    Metadata alone cannot distinguish read/write GitHub tokens; exact token
+    scope must still be verified by the trusted runtime admission adapter.
+    Never include values in refusal diagnostics.
+    """
+    forbidden = {"PYTHONPATH", "PYTHONHOME", "LD_PRELOAD", "LD_LIBRARY_PATH",
+                 "DYLD_INSERT_LIBRARIES", "BASH_ENV", "ENV"}
+    if any(key in environment for key in forbidden):
+        raise ValueError("phase environment contains executable-loader overrides")
+    if phase == "publish":
+        if any(key in environment for key in ("NOEMA_LLM_API_KEY", "LLM_GATEWAY_API_KEY")):
+            raise ValueError("phase environment publisher contains inference capability")
+    elif phase == "prepare":
+        if environment.get("NOEMA_LLM_MODEL") != "auto":
+            raise ValueError("phase environment must request literal auto")
+    else:
+        raise ValueError("phase environment has an unsupported phase")
+
+
+def accepted_prepare_transport(context):
+    """Validate only independently pinned workflow/document transport capabilities.
+
+    The enclosing execution admission digest binds these fields, not ambient
+    environment values. Runtime admission still owns their namespace and supplier.
+    """
+    if context is None:
+        return {}
+    if not isinstance(context, dict) or not context or set(context) - {
+        'GITHUB_OUTPUT', 'NOEMA_TRANSPORT_RETRY_ATTEMPT',
+        'NOEMA_HWP_MCP_SOURCE', 'NOEMA_NODE_EXECUTABLE', 'node_sha256', 'hwp_files',
+    }:
+        raise ValueError('prepare transport has unsupported fields')
+    for field in ('GITHUB_OUTPUT', 'NOEMA_HWP_MCP_SOURCE'):
+        if field in context:
+            value = context[field]
+            if (not isinstance(value, str) or value != value.strip()
+                    or any(ord(character) < 32 or ord(character) == 127 for character in value)):
+                raise ValueError('prepare transport path differs from consumer identity')
+    environment = {}
+    if 'GITHUB_OUTPUT' in context or 'NOEMA_TRANSPORT_RETRY_ATTEMPT' in context:
+        attempt = context.get('NOEMA_TRANSPORT_RETRY_ATTEMPT')
+        if not isinstance(attempt, str) or not re.fullmatch(r'[0-2]', attempt):
+            raise ValueError('prepare retry context is outside the existing bound')
+        output = context.get('GITHUB_OUTPUT')
+        if not isinstance(output, str) or not Path(output).is_absolute():
+            raise ValueError('prepare output requires an accepted absolute path')
+        info = Path(output).lstat()
+        if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_mode & 0o077:
+            raise ValueError('prepare output is not private regular custody')
+        environment.update(GITHUB_OUTPUT=output, NOEMA_TRANSPORT_RETRY_ATTEMPT=attempt)
+    document_keys = {'NOEMA_HWP_MCP_SOURCE', 'NOEMA_NODE_EXECUTABLE', 'node_sha256', 'hwp_files'}
+    if document_keys & set(context):
+        if not document_keys <= set(context):
+            raise ValueError('prepare document transport is incomplete')
+        source, node = context['NOEMA_HWP_MCP_SOURCE'], context['NOEMA_NODE_EXECUTABLE']
+        if not all(isinstance(value, str) and Path(value).is_absolute() for value in (source, node)):
+            raise ValueError('prepare document supplier paths are not absolute')
+        root, executable = Path(source), Path(node)
+        if root.is_symlink() or not root.is_dir() or executable.is_symlink():
+            raise ValueError('prepare document supplier is not regular custody')
+        info = executable.stat()
+        if not stat.S_ISREG(info.st_mode) or not info.st_mode & 0o111:
+            raise ValueError('prepare Node supplier is not executable')
+        digest = context['node_sha256']
+        if not isinstance(digest, str) or not re.fullmatch(r'[0-9a-f]{64}', digest):
+            raise ValueError('prepare Node digest is missing')
+        if hashlib.sha256(executable.read_bytes()).hexdigest() != digest:
+            raise ValueError('prepare Node supplier bytes changed')
+        inventory = context['hwp_files']
+        if not isinstance(inventory, dict) or not inventory or any(
+            not _safe_path(name) or not isinstance(value, str) or not re.fullmatch(r'[0-9a-f]{64}', value)
+            for name, value in inventory.items()
+        ):
+            raise ValueError('prepare HWP inventory is malformed')
+        actual = {}
+        for path in root.rglob('*'):
+            if path.is_symlink() or not (path.is_dir() or path.is_file()):
+                raise ValueError('prepare HWP supplier has unsupported custody')
+            if path.is_file():
+                actual[path.relative_to(root).as_posix()] = hashlib.sha256(path.read_bytes()).hexdigest()
+        if actual != inventory:
+            raise ValueError('prepare HWP supplier bytes changed')
+        environment.update(NOEMA_HWP_MCP_SOURCE=source, NOEMA_NODE_EXECUTABLE=node)
+    return environment
+
+
+def phase_environment_from_issuance(
+    phase, response, *, scope, reviewer_actor, installation_id, inference_key=None,
+    prepare_transport=None,
+):
+    """Consume a trusted installation-token issuance response without logging it.
+
+    The response must come directly from the existing authenticated App issuer,
+    not PR data or an artifact. The controller does not mint a token, read a
+    secret, or establish issuer authenticity by validating this dictionary.
+    """
+    expected_permissions = {"contents": "read", "metadata": "read",
+                           "pull_requests": "read" if phase == "prepare" else "write"}
+    if phase not in {"prepare", "publish"} or not isinstance(response, dict):
+        raise ValueError("credential issuance has unsupported phase or shape")
+    if response.get("permissions") != expected_permissions:
+        raise ValueError("credential issuance permissions do not match the phase")
+    repositories = response.get("repositories")
+    if not isinstance(repositories, list) or len(repositories) != 1:
+        raise ValueError("credential issuance must be single-repository scoped")
+    if not isinstance(repositories[0], dict) or repositories[0].get("full_name") != scope["repository"]:
+        raise ValueError("credential issuance repository does not match the review")
+    token = response.get("token")
+    if not isinstance(token, str) or not token.strip():
+        raise ValueError("credential issuance returned no usable token")
+    if reviewer_actor != scope["reviewer"] or not re.fullmatch(r"[a-z0-9][a-z0-9-]*\[bot\]", reviewer_actor):
+        raise ValueError("credential issuance reviewer actor is not the admitted independent App")
+    if type(installation_id) is not int or installation_id < 1:
+        raise ValueError("credential issuance installation identity is invalid")
+    environment = {"PATH": "/usr/bin:/bin", "GH_TOKEN": token,
+                   "NOEMA_REVIEW_ACTOR": reviewer_actor,
+                   "NOEMA_REVIEW_INSTALLATION_ID": str(installation_id),
+                   "NOEMA_REVIEW_TOKEN_SOURCE": "noema-review-github-app" if phase == "prepare" else "noema-review-github-app-refresh"}
+    if phase == "prepare":
+        if not isinstance(inference_key, str) or not inference_key.strip():
+            raise ValueError("credential issuance preparation requires existing inference authority")
+        environment.update(NOEMA_LLM_MODEL="auto", NOEMA_LLM_API_KEY=inference_key,
+                           NOEMA_LLM_API_URL="https://litellm.poinnetworks.net/v1/chat/completions")
+        environment.update(accepted_prepare_transport(prepare_transport))
+    return environment
+
+
+class _NoemaTooling:
+    """Execute one compatible producer/publisher from a sealed tooling namespace.
+
+    The trusted caller owns the namespace exclusively through both phases and
+    supplies phase-scoped environments, including separately attested read or
+    write authority. This adapter does not authenticate an external envelope.
+    Interpreter and installed third-party dependencies need independent runtime
+    admission; the manifest binds repository files only.
+    """
+
+    def __init__(self, root, raw, accepted_digest, interpreter, phase_environment, child_runner):
+        """Retain explicit controller dependencies without loading candidate code."""
+        self.root = Path(root)
+        self.raw = raw
+        self.accepted_digest = accepted_digest
+        self.interpreter = Path(interpreter)
+        self.phase_environment = phase_environment
+        self.child_runner = child_runner
+
+    def _verify(self):
+        """Re-read complete regular source files before each child invocation."""
+        if not self.root.is_absolute() or self.root.is_symlink() or not self.root.is_dir():
+            raise ValueError("source inventory root is not an absolute owned directory")
+        files = {}
+        for path in self.root.rglob("*"):
+            if path.is_symlink():
+                raise ValueError("source inventory contains a symbolic link")
+            if path.is_file():
+                files[path.relative_to(self.root).as_posix()] = path.read_bytes()
+            elif not path.is_dir():
+                raise ValueError("source inventory contains an unsupported file kind")
+        admit_tooling(self.raw, accepted_digest=self.accepted_digest, source_files=files)
+        manifest = json.loads(self.raw)
+        if manifest["entrypoint"] != ".github/actions/noema-review/two_phase.py":
+            raise ValueError("source inventory entrypoint is not the compatible Noema tooling")
+        return self.root / manifest["entrypoint"]
+
+    def _run(self, phase, repo, number, head, path):
+        """Run a fresh isolated-import child with explicit phase environment only."""
+        entrypoint = self._verify()
+        if not self.interpreter.is_absolute() or not self.interpreter.is_file():
+            raise ValueError("trusted interpreter must be an absolute executable file")
+        environment = self.phase_environment(phase)
+        require_phase_environment(phase, environment)
+        # Credential acquisition can yield to a trusted issuer; bind source
+        # again afterwards so those credentials never reach stale tooling.
+        entrypoint = self._verify()
+        command = [str(self.interpreter), "-I", "-B", str(entrypoint),
+                   "--repo", repo, "--pr-number", str(number), "--expected-head", head,
+                   f"--{phase}-verdict-file", str(path)]
+        result = self.child_runner(command, cwd=self.root, env=environment, check=False)
+        return result.returncode
+
+    def prepare_verdict(self, repo, number, head, path):
+        """Consume PR bytes as data through the admitted model producer."""
+        return self._run("prepare", repo, number, head, path)
+
+    def publish_verdict(self, repo, number, head, path):
+        """Publish only through the same compatible trusted tooling source."""
+        return self._run("publish", repo, number, head, path)
+
+
+def load_noema_tooling(
+    root, raw_manifest, *, accepted_digest, interpreter, phase_environment,
+    child_runner=subprocess.run,
+):
+    """Bind the real two-phase CLI without importing caller-selected modules."""
+    tooling = _NoemaTooling(root, raw_manifest, accepted_digest, interpreter,
+                           phase_environment, child_runner)
+    tooling._verify()
+    return tooling
+
+
+def run_review(
+    raw_manifest, *, accepted_digest, source_files, scope, fetch_live,
+    require_execution_admission, load_tooling, refresh_publisher, private_parent,
+):
+    """Admit source and current scope before invoking trusted runtime collaborators.
+
+    Callbacks are trusted controller dependencies, never PR payload. Their
+    authority, isolation, supplier policy and source binding require separate
+    operational acceptance; these checks do not manufacture such authority.
+    """
+    admit_tooling(raw_manifest, accepted_digest=accepted_digest, source_files=source_files)
+    require_review_scope(scope, fetch_live())
+    require_execution_admission()
+    tooling = load_tooling()
+    with tempfile.TemporaryDirectory(prefix="premerge-review-", dir=private_parent) as directory:
+        envelope = Path(directory) / "verdict.json"
+        result = tooling.prepare_verdict(scope["repository"], scope["number"], scope["head"], envelope)
+        if result != 0 or not envelope.is_file():
+            raise RuntimeError("model preparation did not produce a verdict")
+        require_prepared_envelope(envelope, scope)
+        require_review_scope(scope, fetch_live())
+        require_execution_admission()
+        refresh_publisher()
+        require_review_scope(scope, fetch_live())
+        require_prepared_envelope(envelope, scope)
+        return tooling.publish_verdict(scope["repository"], scope["number"], scope["head"], envelope)
+
+
+def production_main(argv=None):
+    """Validate independently pinned custody inputs and live scope before setup.
+
+    Files must be supplied by the existing custody owner outside PR data. This
+    validates supplied evidence, not its authority: independent acceptance of
+    the digest is an explicit operational prerequisite, never generated here.
+    """
+    import argparse
+    import sys
+
+    parser = argparse.ArgumentParser(description=__doc__)
+    modes = parser.add_mutually_exclusive_group(required=True)
+    modes.add_argument('--admit-production', action='store_true')
+    modes.add_argument('--run-production', action='store_true')
+    modes.add_argument('--prepare-production', action='store_true')
+    modes.add_argument('--publish-production', action='store_true')
+    parser.add_argument('--phase-issuance', type=Path)
+    parser.add_argument('--verdict-file', type=Path)
+    parser.add_argument('--prepare-issuance', type=Path)
+    parser.add_argument('--publish-issuance', type=Path)
+    parser.add_argument('--private-parent', type=Path)
+    parser.add_argument('--tooling-root', type=Path, required=True)
+    parser.add_argument('--manifest', type=Path, required=True)
+    parser.add_argument('--accepted-digest', required=True)
+    parser.add_argument('--admission', type=Path, required=True)
+    parser.add_argument('--admission-digest', required=True)
+    parser.add_argument('--repo', required=True)
+    parser.add_argument('--pr-number', type=int, required=True)
+    parser.add_argument('--expected-head', required=True)
+    args = parser.parse_args(argv)
+    try:
+        if not all(re.fullmatch(r'[0-9a-f]{64}', value) for value in
+                   (args.accepted_digest, args.admission_digest)):
+            raise ValueError('independent admission pins are missing or malformed')
+        raw = args.manifest.read_bytes()
+        tooling = _NoemaTooling(args.tooling_root, raw, args.accepted_digest,
+                               Path(sys.executable), None, None)
+        tooling._verify()
+        admission_raw = args.admission.read_bytes()
+        if hashlib.sha256(admission_raw).hexdigest() != args.admission_digest:
+            raise ValueError('execution admission differs from independent pin')
+        admission = json.loads(admission_raw, object_pairs_hook=_unique_object)
+        scope = admission['scope']
+        if scope['repository'] != args.repo or scope['number'] != args.pr_number or scope['head'] != args.expected_head:
+            raise ValueError('execution admission target differs from request')
+        for field in ('isolated_clean_job', 'native_custody', 'supplier_cost', 'supplier_retention', 'issuer_phase_separation'):
+            if admission.get(field) is not True:
+                raise ValueError('execution admission required evidence is not accepted')
+        fetched = subprocess.run(['gh', 'api', f'repos/{args.repo}/pulls/{args.pr_number}'],
+                                 check=True, capture_output=True, text=True, timeout=60)
+        pr = json.loads(fetched.stdout)
+        live = {'repository': pr['base']['repo']['full_name'], 'number': pr['number'],
+                'head': pr['head']['sha'], 'base': pr['base']['sha'],
+                'author': pr['user']['login'], 'reviewer': scope['reviewer'],
+                'state': str(pr['state']).upper(), 'draft': pr['draft']}
+        require_review_scope(scope, live)
+        # Live metadata retrieval may yield while custody is revoked. Refuse
+        # stale admission before either phase obtains credentials or executes.
+        if args.admission.read_bytes() != admission_raw or args.manifest.read_bytes() != raw:
+            raise ValueError('independent custody changed during live scope retrieval')
+        if args.prepare_production or args.publish_production:
+            phase = 'prepare' if args.prepare_production else 'publish'
+            if args.phase_issuance is None or args.verdict_file is None:
+                raise ValueError('phase issuer output and private verdict custody required')
+            info = args.phase_issuance.lstat()
+            if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_mode & 0o077:
+                raise ValueError('issuer output custody is not private')
+            response = json.loads(args.phase_issuance.read_bytes(), object_pairs_hook=_unique_object)
+            environment = phase_environment_from_issuance(
+                phase, response, scope=scope, reviewer_actor=scope['reviewer'],
+                installation_id=admission['installation_id'],
+                inference_key=os.environ.get('LLM_GATEWAY_API_KEY') if phase == 'prepare' else None,
+                prepare_transport=admission.get('prepare_transport') if phase == 'prepare' else None)
+            phase_tooling = load_noema_tooling(args.tooling_root, raw,
+                accepted_digest=args.accepted_digest, interpreter=Path(sys.executable),
+                phase_environment=lambda requested: environment if requested == phase else {})
+            if phase == 'publish':
+                require_prepared_envelope(args.verdict_file, scope)
+            status = getattr(phase_tooling, phase + '_verdict')(
+                args.repo, args.pr_number, args.expected_head, args.verdict_file)
+            if phase == 'prepare' and status == 0 and args.verdict_file.exists():
+                require_prepared_envelope(args.verdict_file, scope)
+            return status
+        if args.run_production:
+            if not args.prepare_issuance or not args.publish_issuance or not args.private_parent:
+                raise ValueError('phase issuance and private custody are required')
+            environments = {}
+
+            def phase_environment(phase):
+                """Expose only the admitted credential for the selected phase."""
+                return environments[phase]
+
+            def read_issuance(path, phase):
+                """Consume private issuer output without logging credential bytes."""
+                info = path.lstat()
+                if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_mode & 0o077:
+                    raise ValueError('issuer output is not private regular custody')
+                response = json.loads(path.read_bytes(), object_pairs_hook=_unique_object)
+                return phase_environment_from_issuance(
+                    phase, response, scope=scope, reviewer_actor=scope['reviewer'],
+                    installation_id=admission['installation_id'],
+                    inference_key=os.environ.get('LLM_GATEWAY_API_KEY') if phase == 'prepare' else None,
+                    prepare_transport=admission.get('prepare_transport') if phase == 'prepare' else None,
+                )
+
+            def revalidate_admission():
+                """Refuse evidence or source drift at every controller boundary."""
+                if args.admission.read_bytes() != admission_raw or args.manifest.read_bytes() != raw:
+                    raise ValueError('independent custody changed after admission')
+                tooling._verify()
+
+            def fetch_live():
+                """Re-fetch current scope before each admitted phase."""
+                current = subprocess.run(['gh', 'api', f'repos/{args.repo}/pulls/{args.pr_number}'],
+                                         check=True, capture_output=True, text=True, timeout=60)
+                document = json.loads(current.stdout)
+                return {'repository': document['base']['repo']['full_name'], 'number': document['number'],
+                        'head': document['head']['sha'], 'base': document['base']['sha'],
+                        'author': document['user']['login'], 'reviewer': scope['reviewer'],
+                        'state': str(document['state']).upper(), 'draft': document['draft']}
+
+            def refresh_publisher():
+                """Consume separately issued publication authority only after model completion."""
+                environments['publish'] = read_issuance(args.publish_issuance, 'publish')
+
+            environments['prepare'] = read_issuance(args.prepare_issuance, 'prepare')
+            files = {name: (args.tooling_root / name).read_bytes() for name in json.loads(raw)['files']}
+            return run_review(raw, accepted_digest=args.accepted_digest, source_files=files,
+                              scope=scope, fetch_live=fetch_live,
+                              require_execution_admission=revalidate_admission,
+                              load_tooling=lambda: load_noema_tooling(args.tooling_root, raw,
+                                  accepted_digest=args.accepted_digest, interpreter=Path(sys.executable),
+                                  phase_environment=phase_environment),
+                              refresh_publisher=refresh_publisher, private_parent=args.private_parent)
+        return 0
+    except (OSError, ValueError, KeyError, TypeError, subprocess.SubprocessError):
+        # No credential values, response bodies or exception payloads in logs.
+        print('premerge admission refused: independent admission pins or custody/scope evidence unavailable', file=sys.stderr)
+        return 1
+
+
+if __name__ == '__main__':
+    raise SystemExit(production_main())
diff --git a/scripts/ci/prescreen_release_runtime_archives.py b/scripts/ci/prescreen_release_runtime_archives.py
index 7631a38a06..7211b2acf8 100644
--- a/scripts/ci/prescreen_release_runtime_archives.py
+++ b/scripts/ci/prescreen_release_runtime_archives.py
@@ -109,6 +109,8 @@ def _build_packages(item: Mapping[str, Any], folder: Path) -> list[dict[str, Any
                 raise gate.GateError(gate.CAPTURE_INCOMPLETE, f"{leg}: {name} metadata is ambiguous")
             metadata_root = PurePosixPath(metadata[0]).parent
             def read_file(path: str) -> bytes:
+                """Read one bounded package file from the captured build snapshot."""
+
                 entry = members.get(f"{name}/{path}")
                 if entry is None or entry.file_size > 4 * 1024 * 1024:
                     raise gate.GateError(gate.CAPTURE_INCOMPLETE, f"{leg}: {name} text file is missing or oversized")
@@ -391,17 +393,14 @@ def prescreen(scope: Any, root: Path) -> dict[str, list[dict[str, Any]]]:
                               "native_properties": native_properties,
                               "fixture": fixture, "fixture_sha256": gate.fixture_digest(fixture),
                               "legs": [leg]}
-    if (len(seen_legs) != 13 or "sdist" not in seen_legs
-            or seen_variants != {f"universal2-apple-darwin-py{version}"
-                                 for version in ("3.12", "3.13", "3.14")}
-            or not rows):
-        raise gate.GateError(gate.SCOPE_UNVERIFIABLE, "runtime archive coverage is incomplete")
     return {"archives": sorted(rows.values(), key=lambda row: (row["key"], row["source_sha256"])),
             "build_packages": sorted(build_rows.values(), key=lambda row: row["key"]),
             "build_tools": sorted(tool_rows.values(), key=lambda row: row["key"])}
 
 
 def main() -> None:
+    """Write the prescreened runtime archive license report."""
+
     parser = argparse.ArgumentParser()
     parser.add_argument("--verified-scope", required=True)
     parser.add_argument("--scope-root", required=True)
diff --git a/scripts/ci/r_isolated_matrix.py b/scripts/ci/r_isolated_matrix.py
new file mode 100644
index 0000000000..02f44f5574
--- /dev/null
+++ b/scripts/ci/r_isolated_matrix.py
@@ -0,0 +1,27 @@
+"""Bound the R matrix to supported Linux/x64 image aliases, never runner labels."""
+import json
+import sys
+
+
+def admit(raw):
+    """Reject unsupported matrix legs before any R job can be scheduled."""
+    rows = json.loads(raw)
+    if not isinstance(rows, list) or not 1 <= len(rows) <= 64:
+        raise ValueError('Expected 1..64 matrix objects')
+    for row in rows:
+        if not isinstance(row, dict) or not isinstance(row.get('os'), str):
+            raise ValueError('Expected an OS string in each matrix object')
+        if not isinstance(row.get('r'), str) or not row['r'].strip():
+            raise ValueError('Expected a nonempty R version')
+        if row['os'] in ('ubuntu-latest', 'ubuntu-24.04'):
+            continue
+        raise ValueError('STOP unsupported platform leg: ' + repr(row['os']))
+    return rows
+
+
+if __name__ == '__main__':
+    try:
+        print(json.dumps(admit(sys.argv[1]), separators=(',', ':')))
+    except (ValueError, TypeError, IndexError) as error:
+        print(str(error), file=sys.stderr)
+        sys.exit(1)
diff --git a/scripts/ci/reconcile_repository_metadata.py b/scripts/ci/reconcile_repository_metadata.py
index 1570455818..a78bd09725 100644
--- a/scripts/ci/reconcile_repository_metadata.py
+++ b/scripts/ci/reconcile_repository_metadata.py
@@ -16,7 +16,7 @@
 import sys
 from pathlib import Path
 from typing import Any
-from urllib.error import URLError
+from urllib.error import HTTPError, URLError
 from urllib.request import HTTPRedirectHandler, Request, build_opener
 
 
@@ -38,8 +38,6 @@ class _NoPagesRedirects(HTTPRedirectHandler):
     def redirect_request(self, req, fp, code, msg, headers, newurl):
         """Raise an HTTPError instead of following the redirect."""
 
-        from urllib.error import HTTPError
-
         raise HTTPError(req.full_url, code, msg, headers, fp)
 
 
@@ -247,7 +245,13 @@ def _pages_publication_ready(repository: str, current: dict[str, Any]) -> None:
             if not response.read(1):
                 raise RuntimeError(f"GitHub Pages returned empty content for {repository}")
     except (URLError, TimeoutError, OSError) as exc:
-        raise RuntimeError(f"GitHub Pages is not reachable for {repository}") from exc
+        try:
+            raise RuntimeError(
+                f"GitHub Pages is not reachable for {repository}"
+            ) from exc
+        finally:
+            if isinstance(exc, HTTPError):
+                exc.close()
 
 
 def _repository_file_exists(repository: str, default_branch: str, path: str) -> bool:
diff --git a/scripts/ci/release_dependency_gate.py b/scripts/ci/release_dependency_gate.py
index 96347278f6..f11178f107 100644
--- a/scripts/ci/release_dependency_gate.py
+++ b/scripts/ci/release_dependency_gate.py
@@ -48,6 +48,7 @@
 import ast
 import email.parser
 import hashlib
+import importlib
 import io
 import json
 import os
@@ -63,10 +64,15 @@
 from pathlib import Path, PurePosixPath
 from typing import Any, Iterable, Mapping, Sequence
 
-try:
-    import tomllib
-except ModuleNotFoundError:  # Python 3.10; already declared in the dev group.
-    import tomli as tomllib
+def _import_toml_parser():
+    """Return the stdlib TOML parser, or the declared Python 3.10 backport."""
+    try:
+        return importlib.import_module("tomllib")
+    except ModuleNotFoundError:  # Python 3.10; already declared in the dev group.
+        return importlib.import_module("tomli")
+
+
+tomllib = _import_toml_parser()
 
 try:
     from scripts.ci.spdx_license_policy import (
@@ -1835,6 +1841,8 @@ def _enumerate_cargo(capture: Path, *, source_root: Path | None = None,
             raise GateError(CAPTURE_INCOMPLETE, "Cargo source checkout cannot be bound") from error
 
     def source_blob(path: Path) -> bytes:
+        """Read and verify one regular source file from the selected commit."""
+
         try:
             relative = path.relative_to(bound_root)
             if any((bound_root / parent).is_symlink() for parent in (relative, *relative.parents)):
@@ -2126,6 +2134,8 @@ def _source_license_notice(source: Path | None, source_sha: str, subject: str,
         raise GateError(CAPTURE_INCOMPLETE, "source notice needs an exact release commit")
 
     def blob(path: str) -> bytes:
+        """Read one bounded regular blob from the selected release commit."""
+
         entry = subprocess.check_output(
             ["git", "-C", str(source), "ls-tree", source_sha, "--", path], text=True)
         if not entry.startswith("100644 blob "):
diff --git a/scripts/ci/resolve_base_rust_toolchain.py b/scripts/ci/resolve_base_rust_toolchain.py
index 6dcd1642c2..7861bc336a 100755
--- a/scripts/ci/resolve_base_rust_toolchain.py
+++ b/scripts/ci/resolve_base_rust_toolchain.py
@@ -23,6 +23,8 @@
 
 
 def _base_blob(repo_root: pathlib.Path, base_sha: str, path: str) -> str | None:
+    """Read path from the base commit, returning None when absent."""
+
     completed = subprocess.run(
         ["git", "-C", str(repo_root), "show", f"{base_sha}:{path}"],
         check=False,
@@ -34,6 +36,8 @@ def _base_blob(repo_root: pathlib.Path, base_sha: str, path: str) -> str | None:
 
 
 def _channel(content: str) -> str | None:
+    """Return the Rust channel declared by TOML or a legacy bare file."""
+
     try:
         toolchain = tomllib.loads(content).get("toolchain")
     except tomllib.TOMLDecodeError:
@@ -47,6 +51,8 @@ def _channel(content: str) -> str | None:
 
 
 def resolve(repo_root: pathlib.Path, base_sha: str) -> str:
+    """Resolve an exact base Rust release, its fallback, or no override."""
+
     if not SHA_RE.fullmatch(base_sha):
         raise ValueError("base SHA must be a full 40-character commit id")
     for path in PIN_FILES:
@@ -66,6 +72,8 @@ def resolve(repo_root: pathlib.Path, base_sha: str) -> str:
 
 
 def main(argv: list[str] | None = None) -> int:
+    """Print the resolved base Rust toolchain and return a process status."""
+
     parser = argparse.ArgumentParser()
     parser.add_argument("--repo-root", required=True, type=pathlib.Path)
     parser.add_argument("--base-sha", required=True)
diff --git a/scripts/ci/sandboxed_web_e2e.py b/scripts/ci/sandboxed_web_e2e.py
index b0376c0822..fb5702f0c2 100644
--- a/scripts/ci/sandboxed_web_e2e.py
+++ b/scripts/ci/sandboxed_web_e2e.py
@@ -584,6 +584,9 @@ def wait_for_url(url: str, timeout: int, service: Service) -> bool:
                 if 200 <= response.status < 500:
                     return True
                 time.sleep(1)
+        except urllib.error.HTTPError as exc:
+            exc.close()
+            time.sleep(1)
         except (urllib.error.URLError, TimeoutError):
             time.sleep(1)
     return False
diff --git a/scripts/ci/scan_release_native_links.py b/scripts/ci/scan_release_native_links.py
index 92af3d3c98..ad302d7894 100644
--- a/scripts/ci/scan_release_native_links.py
+++ b/scripts/ci/scan_release_native_links.py
@@ -69,6 +69,8 @@ def _reader() -> dict[str, str]:
 
 
 def _links(binary: bytes, target: str, reader: str, *, allow_subset: bool = False) -> list[dict]:
+    """Inspect a native binary and return validated dynamic-link rows."""
+
     if len(binary) > 128 * 1024 * 1024:
         raise ValueError("release native extension exceeds inspection limit")
     with tempfile.NamedTemporaryFile() as temporary:
@@ -101,6 +103,8 @@ def _links(binary: bytes, target: str, reader: str, *, allow_subset: bool = Fals
 
 
 def scan(verified: dict, root: Path, source_sha: str, reader: dict[str, str]) -> dict:
+    """Build a native-link report from the exact verified distributions."""
+
     rows = verified.get("verified_distributions") if isinstance(verified, dict) else None
     if (not re.fullmatch(r"[0-9a-f]{40}", source_sha)
             or not isinstance(rows, list) or len(rows) != 13
@@ -168,6 +172,8 @@ def scan(verified: dict, root: Path, source_sha: str, reader: dict[str, str]) ->
 
 
 def main() -> None:
+    """Write the verified release native-link report."""
+
     parser = argparse.ArgumentParser()
     parser.add_argument("--verified-distributions", required=True)
     parser.add_argument("--distribution-root", required=True)
diff --git a/scripts/ci/strix_evidence_binding.py b/scripts/ci/strix_evidence_binding.py
index 7319040df2..aed54ded1a 100644
--- a/scripts/ci/strix_evidence_binding.py
+++ b/scripts/ci/strix_evidence_binding.py
@@ -305,8 +305,10 @@ def default_github_opener(url: str, token: str) -> Any:
         with _GITHUB_API_OPENER.open(request, timeout=30) as response:
             payload = response.read()
     except HTTPError as exc:
+        status_code = exc.code
+        exc.close()
         raise EvidenceBindingError(
-            f"GitHub changed-file request failed with HTTP {exc.code}"
+            f"GitHub changed-file request failed with HTTP {status_code}"
         ) from exc
     except URLError as exc:
         raise EvidenceBindingError(
diff --git a/scripts/ci/strix_model_utils.sh b/scripts/ci/strix_model_utils.sh
index 9f20eae670..16b32de179 100755
--- a/scripts/ci/strix_model_utils.sh
+++ b/scripts/ci/strix_model_utils.sh
@@ -77,6 +77,16 @@ normalize_model() {
 		return 0
 	fi
 
+	# Literal auto is a gateway request, never a guessed Vertex/direct model.
+	if [ "$model" = "auto" ]; then
+		if [ "${DEFAULT_PROVIDER:-}" != "contextual_orchestrator" ]; then
+			echo "ERROR: literal auto requires the explicit contextual_orchestrator provider." >&2
+			return 2
+		fi
+		printf '%s\n' 'auto'
+		return 0
+	fi
+
 	if is_vertex_resource_path "$model"; then
 		local provider
 		provider="$(sanitize_provider_name "${DEFAULT_PROVIDER:-}")" || {
diff --git a/scripts/ci/strix_quick_gate.sh b/scripts/ci/strix_quick_gate.sh
index cb97fd8eb8..5f1568e824 100755
--- a/scripts/ci/strix_quick_gate.sh
+++ b/scripts/ci/strix_quick_gate.sh
@@ -379,7 +379,7 @@ is_vertex_model() {
 
 is_contextual_orchestrator_model() {
 	case "$1" in
-	orchestrator/free | contextual-orchestrator/orchestrator/free)
+	auto | orchestrator/free | contextual-orchestrator/orchestrator/free)
 		return 0
 		;;
 	*)
@@ -2651,8 +2651,8 @@ child_model_for_api_base() {
 
 	# LiteLLM requires an explicit provider prefix even when the gateway is an
 	# OpenAI-compatible local endpoint. Strip only the connector-facing alias so
-	# the selected orchestrator/free virtual pool reaches contextual-orchestrator
-	# unchanged.
+	# literal auto or a standalone legacy virtual pool reaches the gateway
+	# unchanged; the openai/ connector prefix is not part of the model ID.
 	if is_contextual_orchestrator_model "$model" &&
 		is_contextual_orchestrator_api_base "$llm_api_base_value"; then
 		local contextual_orchestrator_model
diff --git a/scripts/ci/strix_report_scope.py b/scripts/ci/strix_report_scope.py
index cc374c5852..08fab1bef2 100644
--- a/scripts/ci/strix_report_scope.py
+++ b/scripts/ci/strix_report_scope.py
@@ -10,7 +10,15 @@
 
 # The PR scan target is a private directory holding only the changed files, so
 # a path under it (as Strix reports it) is bound to this invocation's scope.
-SCOPE_PATH_RE = re.compile(r"/workspace/strix-pr-scope\.[A-Za-z0-9]+/([A-Za-z0-9_./-]+)")
+PATH_TOKEN_END = (
+    r"(?=$|[\s`\"'<>,;!?)]"
+    r"|:(?=[0-9]+(?::[0-9]+)?(?:$|[\s`\"'<>,;!?)]|\.(?![\w./-])))"
+    r"|\.(?![\w./-]))"
+)
+SCOPE_PATH_RE = re.compile(
+    r"(?<![\w./-])/workspace/strix-pr-scope\.[A-Za-z0-9]+/([A-Za-z0-9_./-]+)"
+    + PATH_TOKEN_END
+)
 
 
 def _names_scoped_ancestor(report: str, changed_paths: list[str]) -> bool:
@@ -22,7 +30,35 @@ def _names_scoped_ancestor(report: str, changed_paths: list[str]) -> bool:
     return False
 
 
+def _token(text: str) -> re.Pattern[str]:
+    """Match a path token only at whole-segment boundaries."""
+    return re.compile(rf"(?<![\w./-]){re.escape(text)}/?" + PATH_TOKEN_END)
+
+
+def _file_token(text: str) -> re.Pattern[str]:
+    """Match a filename token without accepting suffixes or child paths."""
+    return re.compile(rf"(?<![\w./-]){re.escape(text)}" + PATH_TOKEN_END)
+
+
+def names_changed_path(report: str, path: str) -> bool:
+    """Match exact file paths or a named directory plus its exact filename."""
+    if _file_token(path).search(report) is not None:
+        return True
+    directory, _, name = path.rpartition("/")
+    if not directory or _file_token(name).search(report) is None:
+        return False
+    if _token(directory).search(report) is not None:
+        return True
+    parts = directory.split("/")
+    return any(
+        _token("/".join(parts[:depth])).search(report)
+        for depth in range(2, len(parts) + 1)
+    )
+
+
 def validate(output: Path, changed_paths: list[str]) -> None:
+    """Raise ValueError unless one completed, unlinked report names changed scope."""
+
     if not output.is_dir() or output.is_symlink():
         raise ValueError("scan output directory is missing")
     runs = [path for path in output.iterdir() if path.is_dir() and not path.is_symlink()]
@@ -42,7 +78,7 @@ def validate(output: Path, changed_paths: list[str]) -> None:
     if metadata.get("status") != "completed" or results.get("scan_completed") is not True or results.get("success") is not True:
         raise ValueError("scan report is incomplete")
     report = report_path.read_text(encoding="utf-8")
-    if not any(path in report for path in changed_paths) and not _names_scoped_ancestor(report, changed_paths):
+    if not any(names_changed_path(report, path) for path in changed_paths) and not _names_scoped_ancestor(report, changed_paths):
         raise ValueError("scan report does not identify a changed source file")
 
 
diff --git a/scripts/ci/strix_required_workflow_smoke.sh b/scripts/ci/strix_required_workflow_smoke.sh
index 0b5a4a54d4..d1f192ea6f 100755
--- a/scripts/ci/strix_required_workflow_smoke.sh
+++ b/scripts/ci/strix_required_workflow_smoke.sh
@@ -180,9 +180,9 @@ assert_file_contains "$full_gate_test" "assert_strix_workflow_pr_trigger_hardene
 assert_file_contains "$workflow_file" "Provision contextual-orchestrator Strix sidecar" "Strix workflow provisions the trusted contextual-orchestrator gateway"
 assert_file_contains "$workflow_file" "CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR" "Strix workflow binds target visibility to the gateway ZDR policy"
 active_strix_models="$(sed -n -E 's/^[[:space:]]*STRIX_MODEL:[[:space:]]*([^#[:space:]]+)[[:space:]]*$/\1/p' "$workflow_file")"
-[ "$active_strix_models" = "contextual-orchestrator/orchestrator/free" ] || record_failure "Strix must define exactly one active zero-cost free default model"
-assert_file_not_contains "$workflow_file" "STRIX_MODEL: contextual-orchestrator/orchestrator/auto" "Strix must not retain the paid-inclusive auto default route"
-assert_file_contains "$decision_record" "2026-08-30 amendment: Strix uses \`orchestrator/free\`" "The binding ADR amendment records the owner's explicit free-only override"
+[ "$active_strix_models" = "auto" ] || record_failure "Strix must define exactly one literal auto default model"
+assert_file_not_contains "$workflow_file" "STRIX_MODEL: contextual-orchestrator/orchestrator/free" "Strix must not silently restore a free default route"
+assert_file_contains "$workflow_file" "CONTEXTUAL_ORCHESTRATOR_POOL: auto" "Strix sidecar pool matches the literal auto request"
 assert_file_contains "$decision_record" "Zero Data Retention (ZDR)-compliant routes remain mandatory for private targets" "The binding ADR preserves private-target privacy"
 assert_file_contains "$workflow_file" "provider_mode=contextual_orchestrator" "Strix workflow selects the contextual-orchestrator provider mode"
 assert_file_contains "$workflow_file" "STRIX_FALLBACK_MODELS: \"\"" "Strix delegates provider discovery and failover to the gateway"
diff --git a/scripts/ci/strix_unverified_dependency.py b/scripts/ci/strix_unverified_dependency.py
index bc4c781708..29563d2045 100755
--- a/scripts/ci/strix_unverified_dependency.py
+++ b/scripts/ci/strix_unverified_dependency.py
@@ -51,10 +51,14 @@ def named_packages(report: str) -> set[str]:
 
 
 def _is_requirements(name: str) -> bool:
+    """Return whether a filename is a supported requirements manifest."""
+
     return name.startswith("requirements") and name.endswith((".txt", ".in"))
 
 
 def _manifest_text(repo_root: Path) -> str:
+    """Return lower-cased text from bounded dependency manifests."""
+
     chunks = []
     for path in repo_root.rglob("*"):
         if any(part in SKIP_DIRS for part in path.relative_to(repo_root).parts[:-1]):
@@ -82,6 +86,8 @@ def unverified_dependency_finding(report: str, repo_root: Path) -> bool:
 
 
 def main(argv: list[str]) -> int:
+    """Classify command-line report paths and return a process status."""
+
     if len(argv) != 3:
         print(__doc__, file=sys.stderr)
         return 2
diff --git a/scripts/ci/verify_release_distribution_set.py b/scripts/ci/verify_release_distribution_set.py
index 1779d5dfde..21e685b891 100644
--- a/scripts/ci/verify_release_distribution_set.py
+++ b/scripts/ci/verify_release_distribution_set.py
@@ -40,6 +40,7 @@ class DistributionSetError(ValueError):
 
 
 def _strict_object(pairs: Iterable[tuple[str, Any]]) -> dict[str, Any]:
+    """Build a JSON object while rejecting duplicate keys."""
     result: dict[str, Any] = {}
     for key, value in pairs:
         if key in result:
@@ -49,10 +50,12 @@ def _strict_object(pairs: Iterable[tuple[str, Any]]) -> dict[str, Any]:
 
 
 def _reject_constant(value: str) -> Any:
+    """Reject a non-finite JSON constant."""
     raise DistributionSetError(f"non-finite JSON value: {value}")
 
 
 def _json_bytes(data: bytes) -> Any:
+    """Parse bounded UTF-8 JSON with strict object and number handling."""
     if len(data) > MAX_CONTROL_BYTES:
         raise DistributionSetError("control JSON is too large")
     try:
@@ -63,6 +66,7 @@ def _json_bytes(data: bytes) -> Any:
 
 
 def _timestamp(value: Any) -> datetime:
+    """Parse a canonical UTC timestamp."""
     if not isinstance(value, str) or not value.endswith("Z"):
         raise DistributionSetError("missing canonical UTC timestamp")
     try:
@@ -75,6 +79,7 @@ def _timestamp(value: Any) -> datetime:
 
 
 def _digest(value: Any) -> str:
+    """Validate and return a canonical SHA-256 artifact digest."""
     if not isinstance(value, str) or DIGEST_RE.fullmatch(value) is None:
         raise DistributionSetError("missing canonical artifact digest")
     return value
@@ -82,6 +87,7 @@ def _digest(value: Any) -> str:
 
 def _artifact(artifacts: Mapping[str, Mapping[str, Any]], name: str, artifact_id: int,
               digest: str, run_id: int, control_sha: str, started: datetime) -> None:
+    """Require an artifact to match the expected workflow-run identity."""
     item = artifacts.get(name)
     if item is None or type(artifact_id) is not int or artifact_id <= 0:
         raise DistributionSetError(f"{name}: missing immutable artifact identity")
@@ -99,6 +105,7 @@ def _artifact(artifacts: Mapping[str, Mapping[str, Any]], name: str, artifact_id
 @contextmanager
 def _archive(repository: str, artifact_id: int, digest: str,
              fetch: Callable[[str, int, BinaryIO], None]):
+    """Yield an artifact ZIP after verifying its bounded bytes and digest."""
     with tempfile.TemporaryFile() as archive:
         fetch(repository, artifact_id, archive)
         if archive.tell() > MAX_ARCHIVE_BYTES:
@@ -113,6 +120,7 @@ def _archive(repository: str, artifact_id: int, digest: str,
 
 
 def _members(archive: zipfile.ZipFile, expected: set[str]) -> dict[str, zipfile.ZipInfo]:
+    """Return the exact safe archive members required by the caller."""
     entries = archive.infolist()
     if len(entries) != len(expected) or {entry.filename for entry in entries} != expected:
         raise DistributionSetError("artifact ZIP members differ from the expected set")
@@ -126,6 +134,7 @@ def _members(archive: zipfile.ZipFile, expected: set[str]) -> dict[str, zipfile.
 
 
 def _record_rows(data: bytes, source_sha: str) -> dict[str, tuple[str, str]]:
+    """Parse source-bound reproducibility rows keyed by release leg."""
     if len(data) > MAX_CONTROL_BYTES:
         raise DistributionSetError("reproducibility record is too large")
     try:
@@ -269,6 +278,7 @@ def fetch_artifact(repository: str, artifact_id: int, output: BinaryIO) -> None:
 
 
 def main() -> None:
+    """Verify the CLI-supplied release distribution set."""
     parser = argparse.ArgumentParser()
     for option in ("repository", "source-sha", "control-sha", "run-id", "run-attempt",
                    "record-artifact-id", "record-artifact-digest", "wheel-filename",
diff --git a/scripts/ci/verify_release_maturin_tool_assets.py b/scripts/ci/verify_release_maturin_tool_assets.py
index 5554f15bd4..ed5afc90c3 100644
--- a/scripts/ci/verify_release_maturin_tool_assets.py
+++ b/scripts/ci/verify_release_maturin_tool_assets.py
@@ -9,9 +9,11 @@
 import json
 import sys
 import tarfile
+import urllib.error
+import urllib.request
 import zipfile
 from pathlib import Path
-from urllib.request import Request, urlopen
+from urllib.parse import urlsplit
 
 try:
     from scripts.ci.release_dependency_gate import classify_platform_link
@@ -29,21 +31,96 @@
 }
 MAX_ASSET_BYTES = 16 * 1024 * 1024
 MAX_BINARY_BYTES = 32 * 1024 * 1024
+ASSET_FILENAMES = frozenset({
+    "maturin-aarch64-unknown-linux-musl.tar.gz",
+    "maturin-x86_64-unknown-linux-musl.tar.gz",
+    "maturin-aarch64-apple-darwin.tar.gz",
+    "maturin-x86_64-apple-darwin.tar.gz",
+    "maturin-x86_64-pc-windows-msvc.zip",
+})
+GITHUB_RELEASE_HOST = "github.com"
+GITHUB_RELEASE_CDN_HOST = "release-assets.githubusercontent.com"
+GITHUB_RELEASE_PATH = "/PyO3/maturin/releases/download/v1.15.0/"
+
+
+class _ExactReleaseRedirect(urllib.request.HTTPRedirectHandler):
+    """Admit one credential-free redirect to the exact GitHub release CDN."""
+
+    def http_error_302(self, request, response, code, message, headers):
+        """Validate and follow one exact release redirect, closing its response."""
+        try:
+            location = headers.get("Location", "")
+            try:
+                redirect = urlsplit(location)
+                redirect_port = redirect.port
+            except ValueError as error:
+                raise ValueError("maturin release redirect is not trusted") from error
+            source = urlsplit(request.full_url)
+            if (
+                getattr(request, "_cwl_release_redirected", False)
+                or source.scheme != "https"
+                or source.hostname != GITHUB_RELEASE_HOST
+                or redirect.scheme != "https"
+                or redirect.hostname != GITHUB_RELEASE_CDN_HOST
+                or redirect_port not in {None, 443}
+                or redirect.username is not None
+                or redirect.password is not None
+                or not redirect.path.startswith("/")
+                or redirect.fragment
+            ):
+                raise ValueError("maturin release redirect is not trusted")
+            redirected = urllib.request.Request(
+                location,
+                headers={"User-Agent": "cwl-release-gate"},
+                method="GET",
+            )
+            redirected._cwl_release_redirected = True
+        finally:
+            response.close()
+        return self.parent.open(redirected, timeout=request.timeout)
+
+    http_error_301 = http_error_302
+    http_error_303 = http_error_302
+    http_error_307 = http_error_302
+    http_error_308 = http_error_302
 
 
 def _download(filename: str) -> bytes:
-    url = f"https://github.com/PyO3/maturin/releases/download/v1.15.0/{filename}"
-    # Fixed https origin and tag; verify_assets admits only five literal asset names.
-    with urlopen(  # nosemgrep: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected  # nosec B310
-        Request(url, headers={"User-Agent": "cwl-release-gate"}), timeout=60
-    ) as response:
-        raw = response.read(MAX_ASSET_BYTES + 1)
+    """Download one admitted release asset through the fixed GitHub CDN hop."""
+    if filename not in ASSET_FILENAMES:
+        raise ValueError("maturin asset name is unexpected")
+    request = urllib.request.Request(
+        f"https://{GITHUB_RELEASE_HOST}{GITHUB_RELEASE_PATH}{filename}",
+        headers={"User-Agent": "cwl-release-gate"},
+        method="GET",
+    )
+    opener = urllib.request.build_opener(
+        urllib.request.ProxyHandler({}), _ExactReleaseRedirect()
+    )
+    try:
+        response = opener.open(request, timeout=60)
+        try:
+            if response.status != 200:
+                raise ValueError(
+                    f"maturin release download returned HTTP {response.status}"
+                )
+            raw = response.read(MAX_ASSET_BYTES + 1)
+        finally:
+            response.close()
+    except urllib.error.HTTPError as error:
+        try:
+            raise ValueError(
+                f"maturin release download returned HTTP {error.code}"
+            ) from error
+        finally:
+            error.close()
     if len(raw) > MAX_ASSET_BYTES:
         raise ValueError("maturin release asset exceeds inspection limit")
     return raw
 
 
 def _binary(raw: bytes, filename: str) -> bytes:
+    """Extract one bounded Maturin executable from its release archive."""
     if filename.endswith(".zip"):
         with zipfile.ZipFile(io.BytesIO(raw)) as archive:
             members = archive.infolist()
@@ -71,13 +148,7 @@ def verify_assets(evidence: dict, reader: str, fetch=_download) -> None:
         raise ValueError("maturin asset evidence is incomplete")
     for key, asset in sorted(evidence["assets"].items()):
         filename = asset["asset_filename"]
-        if filename not in {
-            "maturin-aarch64-unknown-linux-musl.tar.gz",
-            "maturin-x86_64-unknown-linux-musl.tar.gz",
-            "maturin-aarch64-apple-darwin.tar.gz",
-            "maturin-x86_64-apple-darwin.tar.gz",
-            "maturin-x86_64-pc-windows-msvc.zip",
-        }:
+        if filename not in ASSET_FILENAMES:
             raise ValueError(f"{key}: maturin asset name is unexpected")
         raw = fetch(filename)
         if len(raw) > MAX_ASSET_BYTES or hashlib.sha256(raw).hexdigest() != asset["asset_sha256"]:
@@ -98,6 +169,7 @@ def verify_assets(evidence: dict, reader: str, fetch=_download) -> None:
 
 
 def main() -> None:
+    """Verify recorded Maturin assets from a local root or official release."""
     parser = argparse.ArgumentParser()
     parser.add_argument("--asset-root", type=Path)
     args = parser.parse_args()
diff --git a/scripts/ci/verify_release_scope_evidence_set.py b/scripts/ci/verify_release_scope_evidence_set.py
index 094ecabcb2..7af41ec4cc 100644
--- a/scripts/ci/verify_release_scope_evidence_set.py
+++ b/scripts/ci/verify_release_scope_evidence_set.py
@@ -55,6 +55,7 @@
 
 def _build_python_snapshot(folder: Path, leg: str, source_sha: str,
                            members: Mapping[str, str]) -> None:
+    """Verify repeated build receipts and their exact Python snapshot."""
     first = _json_bytes((folder / f"{leg}.build-first.json").read_bytes())
     second = _json_bytes((folder / f"{leg}.build-second.json").read_bytes())
     snapshot = folder / f"{leg}.build-python.zip"
@@ -119,6 +120,7 @@ def _build_python_snapshot(folder: Path, leg: str, source_sha: str,
 
 
 def _wheel_identity(path: Path) -> tuple[str, str]:
+    """Read a runtime wheel's normalized project name and version."""
     with zipfile.ZipFile(path) as archive:
         metadata = [item for item in archive.infolist()
                     if item.filename.endswith(".dist-info/METADATA")
@@ -224,6 +226,7 @@ def _runtime_target_architecture(runtime: Any, leg: str, *, intel: bool = False)
 
 def _runtime_archives(folder: Path, leg: str, source_sha: str, distribution: Mapping[str, Any],
                       members: Mapping[str, str], *, intel: bool = False) -> list[dict[str, Any]]:
+    """Verify runtime dependency archives and their lock receipt."""
     runtime = _json_bytes((folder / f"{leg}.runtime.json").read_bytes())
     if (not isinstance(runtime, Mapping) or runtime.get("source_sha") != source_sha
             or runtime.get("leg") != leg
@@ -492,6 +495,7 @@ def verify_scope_evidence_set(
 
 
 def main() -> None:
+    """Verify primary and Intel macOS scope evidence from CLI inputs."""
     parser = argparse.ArgumentParser()
     for option in ("repository", "source-sha", "control-sha", "run-id", "run-attempt",
                    "record-artifact-id", "record-artifact-digest", "verified-distributions",
diff --git a/tests/fixture_github_reads.py b/tests/fixture_github_reads.py
new file mode 100644
index 0000000000..1b44abda54
--- /dev/null
+++ b/tests/fixture_github_reads.py
@@ -0,0 +1,36 @@
+"""Explicit offline fixture-only GitHub CLI; all writes/endpoints denied."""
+import json
+import os
+from pathlib import Path
+import sys
+
+fixture = json.loads(Path(os.environ["FIXTURE_FILE"]).read_text())
+args = sys.argv[1:]
+with Path(fixture["calls"]).open("a") as handle:
+    handle.write(json.dumps(args) + "\n")
+if any(value in args for value in ("POST", "PATCH", "PUT", "DELETE", "--method", "-X")):
+    raise SystemExit("fixture forbids mutations")
+if not args or args[0] != "api":
+    raise SystemExit("fixture only permits api reads")
+endpoints = [value for value in args[1:] if value.startswith("repos/")]
+if len(endpoints) != 1:
+    raise SystemExit("fixture requires one endpoint")
+endpoint = endpoints[0]
+if endpoint == "repos/ContextualWisdomLab/example/pulls/1437":
+    print(json.dumps(fixture["pull"]))
+elif endpoint == "repos/ContextualWisdomLab/fast-mlsirm/pulls/2018":
+    print(json.dumps(fixture["pull"]))
+elif endpoint.startswith("repos/ContextualWisdomLab/fast-mlsirm/pulls/2018/reviews") or endpoint.startswith("repos/ContextualWisdomLab/example/pulls/1437/reviews"):
+    if fixture["lookup_fail"]:
+        print("fixture read failure", file=sys.stderr)
+        raise SystemExit(1)
+    if fixture["malformed"]:
+        print("not-json")
+    else:
+        print(json.dumps([fixture["reviews"]] if "--slurp" in args else fixture["reviews"]))
+elif endpoint == "repos/ContextualWisdomLab/.github/contents/scripts/ci/opencode_review_receipt_gate.py?ref=6a37e4cdfbd8bf6f3a60645a0ad7c13e1b9c1ae3":
+    if args[-2:] != ["--jq", ".content"]:
+        raise SystemExit("fixture expects pinned content field")
+    print(fixture["helper_base64"])
+else:
+    raise SystemExit("fixture rejects endpoint outside exact bounded contract")
diff --git a/tests/fixtures/coverage-cargo/Cargo.lock b/tests/fixtures/coverage-cargo/Cargo.lock
index 9a54521941..20666db700 100644
--- a/tests/fixtures/coverage-cargo/Cargo.lock
+++ b/tests/fixtures/coverage-cargo/Cargo.lock
@@ -2,18 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "autocfg"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
-
 [[package]]
 name = "coverage-cargo-fixtures"
 version = "0.0.0"
@@ -29,15 +17,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "indoc"
-version = "2.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
-dependencies = [
- "rustversion",
-]
-
 [[package]]
 name = "itoa"
 version = "1.0.15"
@@ -50,15 +29,6 @@ version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
-[[package]]
-name = "memoffset"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -82,37 +52,32 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.22.6"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f402062616ab18202ae8319da13fa4279883a2b8a9d9f83f20dbade813ce1884"
+checksum = "4688ddedf473e32662b9b067670129a8afb8c18e351482c70d62ba4a88171e8b"
 dependencies = [
- "cfg-if",
- "indoc",
  "libc",
- "memoffset",
  "once_cell",
  "portable-atomic",
  "pyo3-build-config",
  "pyo3-ffi",
  "pyo3-macros",
- "unindent",
 ]
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.22.6"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b14b5775b5ff446dd1056212d778012cbe8a0fbffd368029fd9e25b514479c38"
+checksum = "f41027e41b4bd03f6e60f9f417fe24a6341a6bb744edd62b6f709f2a52ea30e9"
 dependencies = [
- "once_cell",
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.22.6"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ab5bcf04a2cdcbb50c7d6105de943f543f9ed92af55818fd17b660390fc8636"
+checksum = "e591a95526fead067432c3b3a33fc74770b87b1e04e73671090d9c2055a2b327"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -120,9 +85,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.22.6"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fd24d897903a9e6d80b968368a34e1525aeb719d568dba8b3d4bfa5dc67d453"
+checksum = "73225868fc1cd84eef2c3c230ddb91273bf1de46aeb8a4248da76d32a0924a1c"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -132,13 +97,12 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.22.6"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36c011a03ba1e50152b4b394b479826cad97e7a21eb52df179cd91ac411cbfbe"
+checksum = "571575aa3749fa6216757dd47d2a3e7ef360f329a40f0666a9fbd14889024952"
 dependencies = [
  "heck",
  "proc-macro2",
- "pyo3-build-config",
  "quote",
  "syn",
 ]
@@ -152,12 +116,6 @@ dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "rustversion"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
-
 [[package]]
 name = "ryu"
 version = "1.0.20"
@@ -177,18 +135,12 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.16"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "unicode-ident"
 version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
-
-[[package]]
-name = "unindent"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3"
diff --git a/tests/fixtures/coverage-cargo/Cargo.toml b/tests/fixtures/coverage-cargo/Cargo.toml
index dbe13ab8ab..67af5592ca 100644
--- a/tests/fixtures/coverage-cargo/Cargo.toml
+++ b/tests/fixtures/coverage-cargo/Cargo.toml
@@ -6,4 +6,4 @@ edition = "2021"
 [dependencies]
 itoa = "=1.0.15"
 ryu = "=1.0.20"
-pyo3 = { version = "=0.22.6", features = ["extension-module", "abi3-py310"] }
+pyo3 = { version = "=0.29.2", features = ["extension-module", "abi3-py310"] }
diff --git a/tests/fixtures/opencode_shell_literal_operands.json b/tests/fixtures/opencode_shell_literal_operands.json
new file mode 100644
index 0000000000..5185ec4e88
--- /dev/null
+++ b/tests/fixtures/opencode_shell_literal_operands.json
@@ -0,0 +1,177 @@
+[
+  {
+    "before": "'cd \"$1\" && corepack npm run build'",
+    "after": "\"cd \\\"\\$1\\\" && corepack npm run build\"",
+    "expected": "cd \"$1\" && corepack npm run build",
+    "literal_sha256": "5b75beac7d183f624302beeede5ef80ebdae5220c68d4e62e8fef76b1f7d95ae",
+    "count": 1
+  },
+  {
+    "before": "'cd \"$1\" && corepack pnpm run build'",
+    "after": "\"cd \\\"\\$1\\\" && corepack pnpm run build\"",
+    "expected": "cd \"$1\" && corepack pnpm run build",
+    "literal_sha256": "e322a3754c05bac3697ef5148b8d91fc821f772bbb825a65ef216789652671a9",
+    "count": 1
+  },
+  {
+    "before": "'cd \"$1\" && yarn build'",
+    "after": "\"cd \\\"\\$1\\\" && yarn build\"",
+    "expected": "cd \"$1\" && yarn build",
+    "literal_sha256": "7a32a0647a33e794473ad69fecd80c09b0ff0c9e07f48bbe4ac9fdc5985b0e57",
+    "count": 1
+  },
+  {
+    "before": "'set -eu\n                cd \"$1\"\n                dist_dir=\"$(mktemp -d)\"\n                python3 -m maturin build --offline --release -o \"$dist_dir\"\n                python3 -m pip install --user --no-index --no-deps --force-reinstall \"$dist_dir\"/*.whl\n                python3 \"$2\" \"$dist_dir\"/*.whl .\n                rm -rf \"$dist_dir\"'",
+    "after": "\"set -eu\n                cd \\\"\\$1\\\"\n                dist_dir=\\\"\\$(mktemp -d)\\\"\n                python3 -m maturin build --offline --release -o \\\"\\$dist_dir\\\"\n                python3 -m pip install --user --no-index --no-deps --force-reinstall \\\"\\$dist_dir\\\"/*.whl\n                python3 \\\"\\$2\\\" \\\"\\$dist_dir\\\"/*.whl .\n                rm -rf \\\"\\$dist_dir\\\"\"",
+    "expected": "set -eu\n                cd \"$1\"\n                dist_dir=\"$(mktemp -d)\"\n                python3 -m maturin build --offline --release -o \"$dist_dir\"\n                python3 -m pip install --user --no-index --no-deps --force-reinstall \"$dist_dir\"/*.whl\n                python3 \"$2\" \"$dist_dir\"/*.whl .\n                rm -rf \"$dist_dir\"",
+    "literal_sha256": "4bba65aefcb59292fa58d0c47228faa9de663c1be54f4fdcfc30e37e234ad82e",
+    "count": 1
+  },
+  {
+    "before": "'cd \"$1\" && PYTHONPATH=\"$([ -d src ] && printf src:. || printf .)\" python3 -m coverage run -m pytest tests && python3 -m coverage report --show-missing'",
+    "after": "\"cd \\\"\\$1\\\" && PYTHONPATH=\\\"\\$([ -d src ] && printf src:. || printf .)\\\" python3 -m coverage run -m pytest tests && python3 -m coverage report --show-missing\"",
+    "expected": "cd \"$1\" && PYTHONPATH=\"$([ -d src ] && printf src:. || printf .)\" python3 -m coverage run -m pytest tests && python3 -m coverage report --show-missing",
+    "literal_sha256": "8328238f7e8a9efdf50a7d5c1f7bf2e3e9d407b93736b459cc49a720d0dbe253",
+    "count": 1
+  },
+  {
+    "before": "'PYTHONPATH=\"$([ -d src ] && printf src:. || printf .)\" python3 -m coverage run -m pytest && python3 -m coverage report --show-missing'",
+    "after": "\"PYTHONPATH=\\\"\\$([ -d src ] && printf src:. || printf .)\\\" python3 -m coverage run -m pytest && python3 -m coverage report --show-missing\"",
+    "expected": "PYTHONPATH=\"$([ -d src ] && printf src:. || printf .)\" python3 -m coverage run -m pytest && python3 -m coverage report --show-missing",
+    "literal_sha256": "5b8f66d840e67514ded7204289d8d6544f8d9e9b51783bcc5e1f5e99ba45c103",
+    "count": 1
+  },
+  {
+    "before": "'cd \"$1\" && PYTHONPATH=\"$([ -d src ] && printf src:. || printf .)\" python3 -m pytest tests/test_docstrings.py'",
+    "after": "\"cd \\\"\\$1\\\" && PYTHONPATH=\\\"\\$([ -d src ] && printf src:. || printf .)\\\" python3 -m pytest tests/test_docstrings.py\"",
+    "expected": "cd \"$1\" && PYTHONPATH=\"$([ -d src ] && printf src:. || printf .)\" python3 -m pytest tests/test_docstrings.py",
+    "literal_sha256": "f6e4b346d6c2285ecff7172605110fedcd34b0e7119695918a3c683adc9edb83",
+    "count": 1
+  },
+  {
+    "before": "'- Preferred review language: `%s`\\n'",
+    "after": "\"- Preferred review language: \\`%s\\`\\\\n\"",
+    "expected": "- Preferred review language: `%s`\\n",
+    "literal_sha256": "a55f9a0314aca4f2919688735698b948e4eb3c6fb5b9a764343626111edff099",
+    "count": 1
+  },
+  {
+    "before": "'- PR title: `%s`\\n'",
+    "after": "\"- PR title: \\`%s\\`\\\\n\"",
+    "expected": "- PR title: `%s`\\n",
+    "literal_sha256": "990a7ab75683f7fc6ebb36792ac611d816bc67aa456f96ba5f40e33641c6c6d4",
+    "count": 1
+  },
+  {
+    "before": "'- PR body excerpt: `%s`\\n'",
+    "after": "\"- PR body excerpt: \\`%s\\`\\\\n\"",
+    "expected": "- PR body excerpt: `%s`\\n",
+    "literal_sha256": "068807903f94d5f4944b5dd5afc54a62face32538f66d1b09d177b986bebb1da",
+    "count": 1
+  },
+  {
+    "before": "'- PR body excerpt: `[empty]`\\n'",
+    "after": "\"- PR body excerpt: \\`[empty]\\`\\\\n\"",
+    "expected": "- PR body excerpt: `[empty]`\\n",
+    "literal_sha256": "3daa3390c09d66fccc34f340c3142b8b1f2de29a23c30e8caa73b62e1617ddab",
+    "count": 1
+  },
+  {
+    "before": "'Unable to collect %s from `%s` to `%s`; continue review from available changed-file evidence and direct file inspection.\\n'",
+    "after": "\"Unable to collect %s from \\`%s\\` to \\`%s\\`; continue review from available changed-file evidence and direct file inspection.\\\\n\"",
+    "expected": "Unable to collect %s from `%s` to `%s`; continue review from available changed-file evidence and direct file inspection.\\n",
+    "literal_sha256": "31eccf9ccdc69d89d9033eac2d0c10beaa644ecdab06f53305d0904a267de44a",
+    "count": 1
+  },
+  {
+    "before": "'Merge-base discovery failed for `%s` and `%s`; falling back to base SHA for bounded diff evidence.\\n\\n'",
+    "after": "\"Merge-base discovery failed for \\`%s\\` and \\`%s\\`; falling back to base SHA for bounded diff evidence.\\\\n\\\\n\"",
+    "expected": "Merge-base discovery failed for `%s` and `%s`; falling back to base SHA for bounded diff evidence.\\n\\n",
+    "literal_sha256": "3520ee4d10ac9a7f302555dabdc7f8370a0c821ffda3694ffd3aab3daf135c5d",
+    "count": 1
+  },
+  {
+    "before": "'All PR reviews and comments evidence is historical context only and may contain stale bot conclusions. Do not infer active failed checks, unresolved threads, or missing changed files from those comments unless current-head evidence corroborates the same claim for Head SHA `%s`.\\n\\n'",
+    "after": "\"All PR reviews and comments evidence is historical context only and may contain stale bot conclusions. Do not infer active failed checks, unresolved threads, or missing changed files from those comments unless current-head evidence corroborates the same claim for Head SHA \\`%s\\`.\\\\n\\\\n\"",
+    "expected": "All PR reviews and comments evidence is historical context only and may contain stale bot conclusions. Do not infer active failed checks, unresolved threads, or missing changed files from those comments unless current-head evidence corroborates the same claim for Head SHA `%s`.\\n\\n",
+    "literal_sha256": "a62108037c8187ed5baa230d394c788909c36cbb2489fbd292c8c6d7f74eca39",
+    "count": 1
+  },
+  {
+    "before": "'\n            def self_check:\n              (.name // \"\") as $n\n              | [\"opencode-review\", \"coverage-evidence\", \"coverage-source-tree\", \"required-workflow-bootstrap\", \"metadata-only gate evaluation\", \"scan-pr-queue\"] | index($n);\n            def latest_peer_checks:\n              [\n                (.check_runs // [])[]\n                | select(self_check | not)\n                | . + {\n                    checkedAt: (\n                      if ((.started_at // \"\") != \"\") then .started_at\n                      else (.completed_at // \"\")\n                      end\n                    )\n                  }\n              ]\n              | sort_by(.app.slug // \"\", .name // \"\", .checkedAt // \"\", .id // 0)\n              | group_by([.app.slug // \"\", .name // \"\"])\n              | map(last)\n              | .[];\n          '",
+    "after": "\"\n            def self_check:\n              (.name // \\\"\\\") as \\$n\n              | [\\\"opencode-review\\\", \\\"coverage-evidence\\\", \\\"coverage-source-tree\\\", \\\"required-workflow-bootstrap\\\", \\\"metadata-only gate evaluation\\\", \\\"scan-pr-queue\\\"] | index(\\$n);\n            def latest_peer_checks:\n              [\n                (.check_runs // [])[]\n                | select(self_check | not)\n                | . + {\n                    checkedAt: (\n                      if ((.started_at // \\\"\\\") != \\\"\\\") then .started_at\n                      else (.completed_at // \\\"\\\")\n                      end\n                    )\n                  }\n              ]\n              | sort_by(.app.slug // \\\"\\\", .name // \\\"\\\", .checkedAt // \\\"\\\", .id // 0)\n              | group_by([.app.slug // \\\"\\\", .name // \\\"\\\"])\n              | map(last)\n              | .[];\n          \"",
+    "expected": "\n            def self_check:\n              (.name // \"\") as $n\n              | [\"opencode-review\", \"coverage-evidence\", \"coverage-source-tree\", \"required-workflow-bootstrap\", \"metadata-only gate evaluation\", \"scan-pr-queue\"] | index($n);\n            def latest_peer_checks:\n              [\n                (.check_runs // [])[]\n                | select(self_check | not)\n                | . + {\n                    checkedAt: (\n                      if ((.started_at // \"\") != \"\") then .started_at\n                      else (.completed_at // \"\")\n                      end\n                    )\n                  }\n              ]\n              | sort_by(.app.slug // \"\", .name // \"\", .checkedAt // \"\", .id // 0)\n              | group_by([.app.slug // \"\", .name // \"\"])\n              | map(last)\n              | .[];\n          ",
+    "literal_sha256": "aee9423e1e806ca41f083a4ab8ae311c6c423c67a4750a05f6aceff961c29321",
+    "count": 1
+  },
+  {
+    "before": "'\n                  [.[].check_runs[]?]\n                  | sort_by((.started_at // .completed_at // .created_at // \"\"), (.id // 0))\n                  | group_by(.name // \"\")\n                  | map(last)\n                  | .[]?\n                  | select(((.name // \"\" | ascii_downcase) as $n | [\"opencode-review\",\"coverage-evidence\",\"metadata-only gate evaluation\"] | index($n)) | not)\n                  | select((.status // \"\") == \"completed\")\n                  | select((.conclusion // \"\" | ascii_upcase) as $c | [\"FAILURE\",\"TIMED_OUT\",\"ACTION_REQUIRED\",\"CANCELLED\",\"STARTUP_FAILURE\"] | index($c))\n                  | select((.name // \"\") != \"scan-pr-queue\")\n                  | select(((.conclusion // \"\" | ascii_downcase) == \"cancelled\" and ((.name // \"\") | contains(\"$\" + \"{{\"))) | not)\n                  | select(((.conclusion // \"\" | ascii_downcase) == \"cancelled\" and (.name // \"\") == \"noema-review\") | not)\n                  | \"- \" + (if (.name // \"\") == \"strix\" then \"Strix Security Scan/strix\" else ((.name // \"check\") + \" check run\") end) + \": \" + (.conclusion // \"unknown\") + (if (.details_url // .html_url // \"\") != \"\" then \" (\" + (.details_url // .html_url) + \")\" else \"\" end)\n                '",
+    "after": "\"\n                  [.[].check_runs[]?]\n                  | sort_by((.started_at // .completed_at // .created_at // \\\"\\\"), (.id // 0))\n                  | group_by(.name // \\\"\\\")\n                  | map(last)\n                  | .[]?\n                  | select(((.name // \\\"\\\" | ascii_downcase) as \\$n | [\\\"opencode-review\\\",\\\"coverage-evidence\\\",\\\"metadata-only gate evaluation\\\"] | index(\\$n)) | not)\n                  | select((.status // \\\"\\\") == \\\"completed\\\")\n                  | select((.conclusion // \\\"\\\" | ascii_upcase) as \\$c | [\\\"FAILURE\\\",\\\"TIMED_OUT\\\",\\\"ACTION_REQUIRED\\\",\\\"CANCELLED\\\",\\\"STARTUP_FAILURE\\\"] | index(\\$c))\n                  | select((.name // \\\"\\\") != \\\"scan-pr-queue\\\")\n                  | select(((.conclusion // \\\"\\\" | ascii_downcase) == \\\"cancelled\\\" and ((.name // \\\"\\\") | contains(\\\"\\$\\\" + \\\"{{\\\"))) | not)\n                  | select(((.conclusion // \\\"\\\" | ascii_downcase) == \\\"cancelled\\\" and (.name // \\\"\\\") == \\\"noema-review\\\") | not)\n                  | \\\"- \\\" + (if (.name // \\\"\\\") == \\\"strix\\\" then \\\"Strix Security Scan/strix\\\" else ((.name // \\\"check\\\") + \\\" check run\\\") end) + \\\": \\\" + (.conclusion // \\\"unknown\\\") + (if (.details_url // .html_url // \\\"\\\") != \\\"\\\" then \\\" (\\\" + (.details_url // .html_url) + \\\")\\\" else \\\"\\\" end)\n                \"",
+    "expected": "\n                  [.[].check_runs[]?]\n                  | sort_by((.started_at // .completed_at // .created_at // \"\"), (.id // 0))\n                  | group_by(.name // \"\")\n                  | map(last)\n                  | .[]?\n                  | select(((.name // \"\" | ascii_downcase) as $n | [\"opencode-review\",\"coverage-evidence\",\"metadata-only gate evaluation\"] | index($n)) | not)\n                  | select((.status // \"\") == \"completed\")\n                  | select((.conclusion // \"\" | ascii_upcase) as $c | [\"FAILURE\",\"TIMED_OUT\",\"ACTION_REQUIRED\",\"CANCELLED\",\"STARTUP_FAILURE\"] | index($c))\n                  | select((.name // \"\") != \"scan-pr-queue\")\n                  | select(((.conclusion // \"\" | ascii_downcase) == \"cancelled\" and ((.name // \"\") | contains(\"$\" + \"{{\"))) | not)\n                  | select(((.conclusion // \"\" | ascii_downcase) == \"cancelled\" and (.name // \"\") == \"noema-review\") | not)\n                  | \"- \" + (if (.name // \"\") == \"strix\" then \"Strix Security Scan/strix\" else ((.name // \"check\") + \" check run\") end) + \": \" + (.conclusion // \"unknown\") + (if (.details_url // .html_url // \"\") != \"\" then \" (\" + (.details_url // .html_url) + \")\" else \"\" end)\n                ",
+    "literal_sha256": "6c4a46c21e26f6edff27c80ec673a1587677626d749ac929899db7d8c6c13613",
+    "count": 1
+  },
+  {
+    "before": "'\n                  [.[].check_runs[]?]\n                  | sort_by((.started_at // .completed_at // .created_at // \"\"), (.id // 0))\n                  | group_by(.name // \"\")\n                  | map(last)\n                  | .[]?\n                  | select(((.name // \"\" | ascii_downcase) as $n | [\"opencode-review\",\"coverage-evidence\",\"metadata-only gate evaluation\"] | index($n)) | not)\n                  | select((.name // \"\") != \"scan-pr-queue\")\n                  | select((.status // \"\") != \"completed\")\n                  | \"- \" + (if (.name // \"\") == \"strix\" then \"Strix Security Scan/strix\" else ((.name // \"check\") + \" check run\") end) + \": \" + (.status // \"unknown\") + (if (.details_url // .html_url // \"\") != \"\" then \" (\" + (.details_url // .html_url) + \")\" else \"\" end)\n                '",
+    "after": "\"\n                  [.[].check_runs[]?]\n                  | sort_by((.started_at // .completed_at // .created_at // \\\"\\\"), (.id // 0))\n                  | group_by(.name // \\\"\\\")\n                  | map(last)\n                  | .[]?\n                  | select(((.name // \\\"\\\" | ascii_downcase) as \\$n | [\\\"opencode-review\\\",\\\"coverage-evidence\\\",\\\"metadata-only gate evaluation\\\"] | index(\\$n)) | not)\n                  | select((.name // \\\"\\\") != \\\"scan-pr-queue\\\")\n                  | select((.status // \\\"\\\") != \\\"completed\\\")\n                  | \\\"- \\\" + (if (.name // \\\"\\\") == \\\"strix\\\" then \\\"Strix Security Scan/strix\\\" else ((.name // \\\"check\\\") + \\\" check run\\\") end) + \\\": \\\" + (.status // \\\"unknown\\\") + (if (.details_url // .html_url // \\\"\\\") != \\\"\\\" then \\\" (\\\" + (.details_url // .html_url) + \\\")\\\" else \\\"\\\" end)\n                \"",
+    "expected": "\n                  [.[].check_runs[]?]\n                  | sort_by((.started_at // .completed_at // .created_at // \"\"), (.id // 0))\n                  | group_by(.name // \"\")\n                  | map(last)\n                  | .[]?\n                  | select(((.name // \"\" | ascii_downcase) as $n | [\"opencode-review\",\"coverage-evidence\",\"metadata-only gate evaluation\"] | index($n)) | not)\n                  | select((.name // \"\") != \"scan-pr-queue\")\n                  | select((.status // \"\") != \"completed\")\n                  | \"- \" + (if (.name // \"\") == \"strix\" then \"Strix Security Scan/strix\" else ((.name // \"check\") + \" check run\") end) + \": \" + (.status // \"unknown\") + (if (.details_url // .html_url // \"\") != \"\" then \" (\" + (.details_url // .html_url) + \")\" else \"\" end)\n                ",
+    "literal_sha256": "3c98f8ca91cdb37939293cd06808463e69bad6e1c015cafa05d07fb2d5a036ce",
+    "count": 1
+  },
+  {
+    "before": "'\n                query($owner:String!,$name:String!,$number:Int!) {\n                  repository(owner:$owner,name:$name) {\n                    pullRequest(number:$number) {\n                      statusCheckRollup {\n                        contexts(first: 100) {\n                          nodes {\n                            __typename\n                            ... on CheckRun {\n                              name\n                              status\n                              conclusion\n                              completedAt\n                              detailsUrl\n                              checkSuite {\n                                workflowRun {\n                                  workflow {\n                                    name\n                                  }\n                                }\n                              }\n                            }\n                          }\n                        }\n                      }\n                    }\n                  }\n                }\n              '",
+    "after": "\"\n                query(\\$owner:String!,\\$name:String!,\\$number:Int!) {\n                  repository(owner:\\$owner,name:\\$name) {\n                    pullRequest(number:\\$number) {\n                      statusCheckRollup {\n                        contexts(first: 100) {\n                          nodes {\n                            __typename\n                            ... on CheckRun {\n                              name\n                              status\n                              conclusion\n                              completedAt\n                              detailsUrl\n                              checkSuite {\n                                workflowRun {\n                                  workflow {\n                                    name\n                                  }\n                                }\n                              }\n                            }\n                          }\n                        }\n                      }\n                    }\n                  }\n                }\n              \"",
+    "expected": "\n                query($owner:String!,$name:String!,$number:Int!) {\n                  repository(owner:$owner,name:$name) {\n                    pullRequest(number:$number) {\n                      statusCheckRollup {\n                        contexts(first: 100) {\n                          nodes {\n                            __typename\n                            ... on CheckRun {\n                              name\n                              status\n                              conclusion\n                              completedAt\n                              detailsUrl\n                              checkSuite {\n                                workflowRun {\n                                  workflow {\n                                    name\n                                  }\n                                }\n                              }\n                            }\n                          }\n                        }\n                      }\n                    }\n                  }\n                }\n              ",
+    "literal_sha256": "a1f6ebee2275c7fb64e9c80219b8102ded1c712d19d40c867ee72f16f79839aa",
+    "count": 1
+  },
+  {
+    "before": "'query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){id}}}'",
+    "after": "\"query(\\$owner:String!,\\$name:String!,\\$number:Int!){repository(owner:\\$owner,name:\\$name){pullRequest(number:\\$number){id}}}\"",
+    "expected": "query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){id}}}",
+    "literal_sha256": "286a6960231d8dfb8ff7781de00eea84606a9da93dba3bacf96062e541f8ef77",
+    "count": 1
+  },
+  {
+    "before": "'\n                  [\n                    .[]\n                    | {\n                        number: (.number // 0),\n                        rule: (.rule.id // .rule.name // \"unknown\"),\n                        tool: (.tool.name // \"code-scanning\"),\n                        severity: (.rule.security_severity_level // .rule.severity // \"unknown\"),\n                        url: (.html_url // \"\")\n                      }\n                    | select((.severity | ascii_downcase) as $s | [\"medium\",\"high\",\"critical\",\"warning\",\"error\"] | index($s))\n                  ]\n                  | .[]\n                  | \"- \" + .tool + \"/\" + .rule + \": \" + .severity + \" alert #\" + (.number | tostring) + (if .url != \"\" then \" (\" + .url + \")\" else \"\" end)\n                '",
+    "after": "\"\n                  [\n                    .[]\n                    | {\n                        number: (.number // 0),\n                        rule: (.rule.id // .rule.name // \\\"unknown\\\"),\n                        tool: (.tool.name // \\\"code-scanning\\\"),\n                        severity: (.rule.security_severity_level // .rule.severity // \\\"unknown\\\"),\n                        url: (.html_url // \\\"\\\")\n                      }\n                    | select((.severity | ascii_downcase) as \\$s | [\\\"medium\\\",\\\"high\\\",\\\"critical\\\",\\\"warning\\\",\\\"error\\\"] | index(\\$s))\n                  ]\n                  | .[]\n                  | \\\"- \\\" + .tool + \\\"/\\\" + .rule + \\\": \\\" + .severity + \\\" alert #\\\" + (.number | tostring) + (if .url != \\\"\\\" then \\\" (\\\" + .url + \\\")\\\" else \\\"\\\" end)\n                \"",
+    "expected": "\n                  [\n                    .[]\n                    | {\n                        number: (.number // 0),\n                        rule: (.rule.id // .rule.name // \"unknown\"),\n                        tool: (.tool.name // \"code-scanning\"),\n                        severity: (.rule.security_severity_level // .rule.severity // \"unknown\"),\n                        url: (.html_url // \"\")\n                      }\n                    | select((.severity | ascii_downcase) as $s | [\"medium\",\"high\",\"critical\",\"warning\",\"error\"] | index($s))\n                  ]\n                  | .[]\n                  | \"- \" + .tool + \"/\" + .rule + \": \" + .severity + \" alert #\" + (.number | tostring) + (if .url != \"\" then \" (\" + .url + \")\" else \"\" end)\n                ",
+    "literal_sha256": "0f75e1d5894b2b73171b4eb30786e20af5178dda107f415b3c80de0af1f69fe2",
+    "count": 1
+  },
+  {
+    "before": "'- Problem: Failed same-head checks remain for `%s`.\\n'",
+    "after": "\"- Problem: Failed same-head checks remain for \\`%s\\`.\\\\n\"",
+    "expected": "- Problem: Failed same-head checks remain for `%s`.\\n",
+    "literal_sha256": "f65b717a34c174fb8de45a0c7a004762a1e300a8010b3c7d0a3f816512bd5ccd",
+    "count": 1
+  },
+  {
+    "before": "'- Result: `EXISTING_CURRENT_HEAD_APPROVAL`\\n'",
+    "after": "\"- Result: \\`EXISTING_CURRENT_HEAD_APPROVAL\\`\\\\n\"",
+    "expected": "- Result: `EXISTING_CURRENT_HEAD_APPROVAL`\\n",
+    "literal_sha256": "8423de58f35ef3649d71f174e789b7fdde0c794d6c471f79a13eb5e9f18c828c",
+    "count": 1
+  },
+  {
+    "before": "'- Head SHA: `%s`\\n'",
+    "after": "\"- Head SHA: \\`%s\\`\\\\n\"",
+    "expected": "- Head SHA: `%s`\\n",
+    "literal_sha256": "840f8302400a82c3ba04fc0ed8e5b4d230fe277cb276c0a043d61a0a025a5b65",
+    "count": 2
+  },
+  {
+    "before": "'- Model-pool outcome: `%s`\\n'",
+    "after": "\"- Model-pool outcome: \\`%s\\`\\\\n\"",
+    "expected": "- Model-pool outcome: `%s`\\n",
+    "literal_sha256": "5b8ec084e8d6b976374a8332b42978c39f0222d6f12183d3683b001d44d83899",
+    "count": 1
+  },
+  {
+    "before": "'```json\\n%s\\n```\\n\\n'",
+    "after": "\"\\`\\`\\`json\\\\n%s\\\\n\\`\\`\\`\\\\n\\\\n\"",
+    "expected": "```json\\n%s\\n```\\n\\n",
+    "literal_sha256": "1fd318239f7f84df9676717e141bd7ca8ef672b4c585e01f942ce3aa15349fee",
+    "count": 1
+  }
+]
\ No newline at end of file
diff --git a/tests/test_actions_queue_health_contract.py b/tests/test_actions_queue_health_contract.py
index 746aa93990..4958d18376 100644
--- a/tests/test_actions_queue_health_contract.py
+++ b/tests/test_actions_queue_health_contract.py
@@ -16,9 +16,12 @@ def test_queue_health_workflow_is_scheduled_read_only_and_pinned() -> None:
     assert "cancel-in-progress: false" in workflow
     assert "timeout-minutes: 30" in workflow
     assert "github.repository == 'ContextualWisdomLab/.github'" in workflow
+    assert "github.ref == 'refs/heads/main'" in workflow
     assert "endsWith(github.workflow_ref, '@refs/heads/main')" in workflow
     assert '"group":"CWL MCP remediation"' in workflow
     assert '"labels":["self-hosted","linux","x64"]' in workflow
+    assert '"group":"CWL CI isolated"' in workflow
+    assert '"labels":["self-hosted","linux","x64","cwlab-ci-isolated"]' in workflow
     assert "runs-on: ubuntu-24.04" not in workflow
     assert "runs-on: ubuntu-latest" not in workflow
     assert "actions: read" in workflow
diff --git a/tests/test_adr_identifier_uniqueness.py b/tests/test_adr_identifier_uniqueness.py
new file mode 100644
index 0000000000..c82662b79a
--- /dev/null
+++ b/tests/test_adr_identifier_uniqueness.py
@@ -0,0 +1,30 @@
+"""Contracts for unambiguous architecture decision record identifiers."""
+
+from __future__ import annotations
+
+from collections import defaultdict
+from pathlib import Path
+import re
+
+
+ROOT = Path(__file__).resolve().parents[1]
+ADR_DIRECTORY = ROOT / "docs" / "adr"
+ADR_FILE_ID = re.compile(r"(?:^|[-_])(?P<identifier>\d{4})(?:[-_]|$)")
+
+
+def test_adr_file_identifiers_are_unique() -> None:
+    """Each numeric ADR identifier must name exactly one decision record."""
+    records_by_identifier: dict[str, list[str]] = defaultdict(list)
+
+    for path in sorted(ADR_DIRECTORY.glob("*.md")):
+        match = ADR_FILE_ID.search(path.stem)
+        if match is not None:
+            records_by_identifier[match.group("identifier")].append(path.name)
+
+    duplicates = {
+        identifier: records
+        for identifier, records in records_by_identifier.items()
+        if len(records) > 1
+    }
+
+    assert duplicates == {}, f"duplicate ADR identifiers: {duplicates}"
diff --git a/tests/test_agent_mention_downstream_idempotency.py b/tests/test_agent_mention_downstream_idempotency.py
index 28c9084a9b..2be8080c7f 100644
--- a/tests/test_agent_mention_downstream_idempotency.py
+++ b/tests/test_agent_mention_downstream_idempotency.py
@@ -135,10 +135,10 @@ def test_forwarders_restrict_self_hosted_admission_to_trusted_main() -> None:
     """Branch workflows cannot select the main-only privileged runner group."""
     for path in (NOEMA_WORKFLOW, OPENCODE_WORKFLOW):
         text = path.read_text(encoding="utf-8")
-        selector = next(line for line in text.splitlines() if "runs-on:" in line)
+        selector = next(line for line in text.splitlines() if line.startswith("      group:"))
         assert "github.repository == 'ContextualWisdomLab/.github'" in selector
         assert "endsWith(github.workflow_ref, '@refs/heads/main')" in selector
         assert '"group":"CWL MCP remediation"' in selector
         assert '"labels":["self-hosted","linux","x64"]' in selector
-        assert "|| fromJSON('[\"ubuntu-24.04\"]')" in selector
+        assert '|| fromJSON(\'{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}\')' in selector
         assert "actions/checkout@" not in text
diff --git a/tests/test_agent_mention_workflow_contract.py b/tests/test_agent_mention_workflow_contract.py
index e640121ad1..1cce19993e 100644
--- a/tests/test_agent_mention_workflow_contract.py
+++ b/tests/test_agent_mention_workflow_contract.py
@@ -52,6 +52,19 @@ def test_workflow_uses_local_event_and_central_sweep_with_job_scoped_writes() ->
     assert "agent_mention_sweep.py" in sweep
 
 
+def test_full_suite_tooling_lock_includes_collection_dependencies() -> None:
+    """A quality install must provide both parsers imported during suite collection."""
+    lock = (ROOT / "requirements-opencode-review-ci-hashes.txt").read_text(
+        encoding="utf-8"
+    )
+    requirements = {
+        line.split("==", 1)[0].casefold()
+        for line in lock.splitlines()
+        if line and not line.startswith(("#", " ", "-")) and "==" in line
+    }
+    assert {"defusedxml", "pyyaml"} <= requirements
+
+
 def test_quality_workflow_measures_exact_files_without_module_name_warnings() -> None:
     """Coverage includes the two script paths instead of treating paths as modules."""
 
diff --git a/tests/test_agent_review_runtime_quality_consolidation.py b/tests/test_agent_review_runtime_quality_consolidation.py
index 2b0e83312b..4fecc93656 100644
--- a/tests/test_agent_review_runtime_quality_consolidation.py
+++ b/tests/test_agent_review_runtime_quality_consolidation.py
@@ -6,8 +6,10 @@
     workflow_level_cancels_in_progress,
 )
 
+import os
 import re
 import subprocess
+import textwrap
 from pathlib import Path
 
 import pytest
@@ -128,6 +130,116 @@ def test_consolidated_workflow_preserves_all_contract_suites() -> None:
         assert required_path in workflow
 
 
+@pytest.mark.parametrize(
+    "changed_path",
+    (
+        "scripts/ci/codeql_ghas_configuration_identity.py",
+        "tests/test_codeql_ghas_configuration_identity.py",
+        "tests/test_codeql_ghas_analyses_pagination.py",
+        "tests/test_github_api_url_boundary.py",
+    ),
+)
+def test_ghas_runtime_changes_start_the_quality_runner(changed_path: str) -> None:
+    """Admit the helper and each focused GHAS regression independently."""
+    trigger = _workflow_text().split("on:\n", 1)[1].split("\nconcurrency:\n", 1)[0]
+    assert f'      - "{changed_path}"' in trigger
+
+
+@pytest.mark.parametrize(
+    ("changed_path", "expected_suites"),
+    (
+        ("scripts/ci/codeql_ghas_configuration_identity.py", {"ghas"}),
+        ("tests/test_codeql_ghas_configuration_identity.py", {"ghas"}),
+        ("tests/test_codeql_ghas_analyses_pagination.py", {"ghas"}),
+        ("tests/test_github_api_url_boundary.py", {"ghas"}),
+        ("tests/test_agent_review_runtime_quality_consolidation.py", {"ghas"}),
+        (
+            ".github/workflows/agent-review-runtime-quality-ci.yml",
+            {"noema", "opencode", "strix", "queue", "review_repair",
+             "commercial_readiness", "exact_artifact", "ghas"},
+        ),
+        ("docs/doctoring/codeql-ghas-analyses-pagination.md", set()),
+    ),
+)
+def test_ghas_runtime_selector_executes_the_actual_shell(
+    changed_path: str, expected_suites: set[str], tmp_path: Path
+) -> None:
+    """Execute the full selector with a synthetic diff and a real HEAD guard."""
+    selector_step = _workflow_text().split(
+        "- name: Select affected contract suites", 1
+    )[1].split("      - name:", 1)[0]
+    script = textwrap.dedent(selector_step.split("        run: |\n", 1)[1])
+    output = tmp_path / "suites.txt"
+    head = subprocess.check_output(
+        ["git", "rev-parse", "HEAD"], cwd=REPOSITORY_ROOT, text=True
+    ).strip()
+    # Only changed-path input is synthetic; HEAD verification uses actual Git.
+    diff_fixture = (
+        'git() {\n'
+        '  if [[ "$1" == diff ]]; then\n'
+        '    printf "%s\\n" "$CHANGED_PATH"\n'
+        '  else\n'
+        '    command git "$@"\n'
+        '  fi\n'
+        '}\n'
+    )
+    result = subprocess.run(
+        ["bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c",
+         diff_fixture + script],
+        cwd=REPOSITORY_ROOT,
+        env={**os.environ, "HEAD_SHA": head, "BASE_SHA": head,
+             "CHANGED_PATH": changed_path, "GITHUB_OUTPUT": str(output)},
+        text=True, capture_output=True, check=True,
+    )
+    suites = dict(line.split("=", 1) for line in output.read_text().splitlines())
+    assert suites == {
+        name: str(name in expected_suites).lower()
+        for name in ("noema", "opencode", "strix", "queue", "review_repair",
+                     "commercial_readiness", "exact_artifact", "ghas")
+    }
+    assert result.stdout == result.stderr == ""
+
+
+@pytest.mark.parametrize("pytest_exit", (0, 42))
+def test_ghas_runtime_step_runs_exact_tests_and_fails_closed(
+    pytest_exit: int, tmp_path: Path
+) -> None:
+    """Run the actual step shell and capture its argv without invoking providers."""
+    workflow = _workflow_text()
+    step_name = "      - name: Verify GHAS identity, pagination, and API boundary contracts\n"
+    assert step_name in workflow, "focused GHAS test-command step is missing"
+    step = workflow.split(step_name, 1)[1].split("      - name:", 1)[0]
+    assert "if: steps.affected_suites.outputs.ghas == 'true'" in step
+    script = textwrap.dedent(step.split("        run: |\n", 1)[1])
+    calls = tmp_path / "python-calls.txt"
+    recorder = (
+        'python() {\n'
+        '  printf "%s\\n" "$*" >> "$CALLS"\n'
+        '  if [[ "$*" == *pytest* ]]; then return "$PYTEST_EXIT"; fi\n'
+        '}\n'
+    )
+    result = subprocess.run(
+        ["bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c",
+         recorder + script],
+        cwd=REPOSITORY_ROOT,
+        env={**os.environ, "CALLS": str(calls), "PYTEST_EXIT": str(pytest_exit)},
+        text=True, capture_output=True, check=False,
+    )
+    tests = (
+        "tests/test_codeql_ghas_configuration_identity.py "
+        "tests/test_codeql_ghas_analyses_pagination.py "
+        "tests/test_github_api_url_boundary.py"
+    )
+    expected = [f"-m pytest -q {tests}"]
+    if pytest_exit == 0:
+        expected.append(
+            "-m compileall -q scripts/ci/codeql_ghas_configuration_identity.py " + tests
+        )
+    assert calls.read_text().splitlines() == expected
+    assert result.returncode == pytest_exit
+    assert result.stdout == result.stderr == ""
+
+
 def test_exact_head_is_verified_before_selected_suites_run() -> None:
     """Reject a checkout that differs from the pull request's current head."""
 
@@ -154,6 +266,49 @@ def test_review_repair_suite_is_selected_and_conditionally_executed() -> None:
     assert workflow.count("runs-on:") == 1
 
 
+def test_review_launcher_runtime_is_owned_by_the_review_repair_suite() -> None:
+    """Trigger, execute, compile, and measure the launcher's runtime contracts."""
+
+    workflow = _workflow_text()
+
+    assert workflow.count("tests/test_contextual_orchestrator_review_launcher.py") == 4
+    assert workflow.count("tests/test_review_preflight_concurrency.py") == 4
+    assert "--cov=scripts.ci.contextual_orchestrator_review_launcher" in workflow
+
+
+@pytest.mark.parametrize(
+    "changed_path",
+    (
+        "requirements-opencode-review-ci.txt",
+        "requirements-noema-document-ci.txt",
+        "scripts/ci/compile_opencode_review_lock.sh",
+    ),
+)
+def test_common_lock_sources_select_every_python_consumer_suite(
+    changed_path: str,
+) -> None:
+    """A common-lock source change must execute both Python consumer suites."""
+
+    workflow = _workflow_text()
+    selector = workflow.split('            case "$changed_path" in\n', 1)[1].split(
+        "            esac", 1
+    )[0]
+    result = subprocess.run(
+        [
+            "bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c",
+            'IFS= read -r changed_path\nnoema_suite=false\nopencode_suite=false\n'
+            'case "$changed_path" in\n' + selector
+            + 'esac\nprintf "%s,%s" "$noema_suite" "$opencode_suite"\n',
+        ],
+        input=changed_path + "\n",
+        text=True,
+        capture_output=True,
+        check=True,
+    )
+    assert result.stdout == "true,true"
+    assert result.stderr == ""
+
+
 @pytest.mark.parametrize(
     ("changed_path", "starts_runner", "review_repair", "queue"),
     (
diff --git a/tests/test_all_self_hosted_runner_contract.py b/tests/test_all_self_hosted_runner_contract.py
new file mode 100644
index 0000000000..2833ddb09f
--- /dev/null
+++ b/tests/test_all_self_hosted_runner_contract.py
@@ -0,0 +1,183 @@
+"""Require self-hosted CI without admitting PR code to privileged runner pools.
+
+The isolated label is an operator provisioning requirement, not evidence that an
+isolated machine exists. Existing trusted control and review selectors retain
+their main-ref predicates; their non-main fallback must never be GitHub-hosted.
+"""
+from pathlib import Path
+import json
+import re
+import pytest
+import yaml
+
+
+STATIC_RUNNER_GROUP_LABELS = {
+    'CWL central control': set(),
+    'CWL central CodeQL': set(),
+    'CWL central OpenCode': set(),
+    'CWL CI isolated': {'cwlab-ci-isolated'},
+    'CWL law CI': {'law-ai-agent-ci'},
+}
+
+
+def required_static_labels(group: object) -> set[str]:
+    """Return the exact additional labels admitted for a static runner group."""
+    assert group in STATIC_RUNNER_GROUP_LABELS, ('unsupported static group', group)
+    return {'self-hosted', 'linux', 'x64'} | STATIC_RUNNER_GROUP_LABELS[group]
+
+
+def test_every_runner_requires_self_hosted_and_no_hosted_fallback() -> None:
+    """Inspect every declaration, including expression and matrix selectors."""
+    declarations = []
+    for path in sorted(Path('.github/workflows').glob('*.yml')):
+        lines = path.read_text().splitlines()
+        for index, line in enumerate(lines):
+            if re.match(r'^    runs-on:', line):
+                block = line
+                if line.strip() == 'runs-on:':
+                    block += '\n' + '\n'.join(lines[index + 1:index + 3])
+                declarations.append((path, block))
+    assert declarations
+    for path, block in declarations:
+        assert 'self-hosted' in block, (path, block)
+        assert not re.search(r'fromJSON\(\'\["ubuntu-|\|\| \'"ubuntu-', block), (path, block)
+        assert not re.search(r'runs-on: (?:ubuntu-|windows-|macos-)', block), (path, block)
+
+
+def test_nonprivileged_runners_require_isolated_label() -> None:
+    """Check actual YAML selectors, including static labels and both extensions."""
+    paths = sorted(set(Path('.github/workflows').glob('*.yml')) |
+                   set(Path('.github/workflows').glob('*.yaml')))
+    observed = 0
+    groups = set(STATIC_RUNNER_GROUP_LABELS)
+    for path in paths:
+        for job_id, job in yaml.safe_load(path.read_text())['jobs'].items():
+            if 'runs-on' not in job:
+                continue
+            observed += 1
+            runner = job['runs-on']
+            if isinstance(runner, dict):
+                group = runner.get('group')
+                if isinstance(group, str) and group.startswith('${{'):
+                    # Dynamic predicates remain covered by the exact fallback,
+                    # typed-pair and R-matrix contracts, not literal evaluation.
+                    assert any(name in group for name in groups), (path, job_id, group)
+                    continue
+                labels = runner.get('labels')
+                assert isinstance(labels, list) and all(isinstance(label, str) for label in labels), (
+                    path, job_id, 'static labels must be a string list', labels,
+                )
+                required = required_static_labels(group)
+                assert required.issubset(label.lower() for label in labels), (
+                    path, job_id, 'missing required static labels', required.difference(labels),
+                )
+            else:
+                assert isinstance(runner, str) and 'cwlab-ci-isolated' in runner, (path, job_id, runner)
+    assert observed, 'runner selector coverage is empty'
+
+
+def test_static_runner_group_policy_is_explicit_and_fail_closed() -> None:
+    """Bind dedicated groups to their isolation labels and reject unknown groups."""
+    assert required_static_labels('CWL law CI') == {
+        'self-hosted', 'linux', 'x64', 'law-ai-agent-ci',
+    }
+    with pytest.raises(AssertionError, match='unsupported static group'):
+        required_static_labels('CWL ungoverned CI')
+
+
+def test_isolated_fallback_never_selects_privileged_group() -> None:
+    """Inspect scalar and typed runner fallbacks, never an empty declaration set."""
+    observed = 0
+    expected = {
+        'group': 'CWL CI isolated',
+        'labels': ['self-hosted', 'linux', 'x64', 'cwlab-ci-isolated'],
+    }
+    paths = sorted(set(Path('.github/workflows').glob('*.yml')) |
+                   set(Path('.github/workflows').glob('*.yaml')))
+    for path in paths:
+        for job_id, job in yaml.safe_load(path.read_text())['jobs'].items():
+            runner = job.get('runs-on')
+            fields = list(runner.values()) if isinstance(runner, dict) else [runner]
+            expressions = [field for field in fields if isinstance(field, str) and
+                           field.startswith('${{') and '||' in field and
+                           'matrix.config.os' not in field]
+            if not expressions:
+                continue
+            observed += 1
+            for expression in expressions:
+                fallback = expression.rsplit('||', 1)[1]
+                match = re.fullmatch(
+                    r"\s*(?:fromJSON\(\s*)?'(\{[^']*\})'\s*\)*\s*"
+                    r"(?:\.group|\.labels)?\s*\}\}", fallback,
+                )
+                assert match is not None, (path, job_id, 'unsupported fallback', fallback)
+                assert json.loads(match.group(1)) == expected, (
+                    path, job_id, 'unsafe fallback', fallback,
+                )
+    assert observed == 29, ('conditional runner fallback coverage', observed)
+
+
+def test_isolated_label_is_scoped_to_dedicated_runner_group() -> None:
+    """A mutable label cannot replace the isolated runner access boundary."""
+    for path in sorted(Path('.github/workflows').glob('*.yml')):
+        lines = path.read_text().splitlines()
+        for index, line in enumerate(lines):
+            if not re.match(r'^    runs-on:', line):
+                continue
+            block = line
+            if line.strip() == 'runs-on:':
+                block += '\n' + '\n'.join(lines[index + 1:index + 3])
+            if 'cwlab-ci-isolated' in block:
+                assert 'CWL CI isolated' in block, (path, block)
+
+
+TRUSTED_MAIN_UNION_SELECTORS = {
+    '.github/workflows/actions-queue-health.yml': {'collect'},
+    '.github/workflows/audit-central-ruleset.yml': {'audit'},
+    '.github/workflows/organization-commercial-readiness-loop.yml': {'coordinate'},
+    '.github/workflows/pr-auto-rebase.yml': {'auto-rebase'},
+    '.github/workflows/repository-metadata-reconcile.yml': {'validate', 'apply'},
+    '.github/workflows/sbom-inventory-scheduler.yml': {'aggregate-sbom-inventory'},
+}
+
+
+def test_trusted_main_union_selectors_preserve_control_and_isolated_fallback() -> None:
+    """Resolve main/head routing conflicts without restoring hosted fallback."""
+    trusted_main = '{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}'
+    isolated_fallback = (
+        '{"group":"CWL CI isolated",'
+        '"labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}'
+    )
+    for workflow_path, job_ids in TRUSTED_MAIN_UNION_SELECTORS.items():
+        workflow = yaml.safe_load(Path(workflow_path).read_text())
+        for job_id in job_ids:
+            mapping = workflow['jobs'][job_id]['runs-on']
+            assert isinstance(mapping, dict), (workflow_path, job_id, mapping)
+            assert set(mapping) == {'group', 'labels'}
+            group = mapping['group']
+            labels = mapping['labels']
+            assert group.endswith(').group }}')
+            assert labels.endswith(').labels }}')
+            assert group.removesuffix(').group }}') == labels.removesuffix(').labels }}')
+            runner = '${{ ' + group[5:].removesuffix(').group }}') + ' }}'
+            expected = (
+                "${{ github.repository == 'ContextualWisdomLab/.github' && "
+                "github.ref == 'refs/heads/main' && "
+                "endsWith(github.workflow_ref, '@refs/heads/main') && "
+                f"fromJSON('{trusted_main}') || fromJSON('{isolated_fallback}') }}" + "}"
+            )
+            assert runner == expected, (workflow_path, job_id, runner)
+            condition = runner[4:].split(' && fromJSON(', 1)[0]
+            for repository in ('ContextualWisdomLab/.github', 'ContextualWisdomLab/example'):
+                for ref in ('refs/heads/main', 'refs/pull/2565/merge', 'refs/heads/candidate'):
+                    for workflow_ref in ('main', 'candidate'):
+                        terms = {
+                            "github.repository == 'ContextualWisdomLab/.github'": repository == 'ContextualWisdomLab/.github',
+                            "github.ref == 'refs/heads/main'": ref == 'refs/heads/main',
+                            "endsWith(github.workflow_ref, '@refs/heads/main')": workflow_ref == 'main',
+                        }
+                        admitted = all(terms[term] for term in condition.split(' && '))
+                        wanted = repository == 'ContextualWisdomLab/.github' and ref == 'refs/heads/main' and workflow_ref == 'main'
+                        assert admitted == wanted, (workflow_path, job_id, repository, ref, workflow_ref)
+            assert 'ubuntu-24.04' not in runner
+            assert 'ubuntu-latest' not in runner
diff --git a/tests/test_audit_org_codeql_coverage.py b/tests/test_audit_org_codeql_coverage.py
index 0ffc8fa749..8d95cdb0b1 100644
--- a/tests/test_audit_org_codeql_coverage.py
+++ b/tests/test_audit_org_codeql_coverage.py
@@ -262,7 +262,14 @@ def test_null_latest_analysis_is_not_coverage() -> None:
     ]
 
 
-def test_audit_codeql_coverage_defaults_now_to_current_time() -> None:
+def test_audit_codeql_coverage_defaults_now_to_current_time(monkeypatch) -> None:
+    class FixedClock(datetime):
+        @classmethod
+        def now(cls, tz=None):
+            assert tz is timezone.utc
+            return NOW
+
+    monkeypatch.setattr(audit, "datetime", FixedClock)
     repositories = [covered_by_recent_analysis("DefaultNowRepo", days_ago=0)]
 
     assert audit.audit_codeql_coverage(repositories) == []
@@ -299,7 +306,14 @@ def test_main_fail_path_reports_gaps_from_stdin(monkeypatch, capsys) -> None:
     assert "FAIL: 1 repositories have no CodeQL coverage" in captured.err
 
 
-def test_main_pass_path_reports_from_file_arg(tmp_path, capsys) -> None:
+def test_main_pass_path_reports_from_file_arg(tmp_path, capsys, monkeypatch) -> None:
+    class FixedClock(datetime):
+        @classmethod
+        def now(cls, tz=None):
+            assert tz is timezone.utc
+            return NOW
+
+    monkeypatch.setattr(audit, "datetime", FixedClock)
     payload_path = tmp_path / "repositories.json"
     payload_path.write_text(
         json.dumps([covered_by_default_setup("ELUNVERA"), covered_by_recent_analysis("Orgmetra")]),
diff --git a/tests/test_codeql_ghas_analyses_pagination.py b/tests/test_codeql_ghas_analyses_pagination.py
new file mode 100644
index 0000000000..db906964d6
--- /dev/null
+++ b/tests/test_codeql_ghas_analyses_pagination.py
@@ -0,0 +1,443 @@
+"""Complete, fail-closed GHAS analyses traversal at the real HTTP boundary."""
+
+from __future__ import annotations
+
+from email.message import Message
+from io import BytesIO
+import json
+from urllib.parse import urlencode
+
+import pytest
+
+from scripts.ci import codeql_ghas_configuration_identity as identity
+
+
+ENDPOINT = "https://api.github.com/repos/ContextualWisdomLab/example/code-scanning/analyses"
+
+
+class _Page:
+    """Serve one synthetic HTTP page without contacting GitHub."""
+
+    def __init__(self, payload, link=""):
+        """Keep the page body and its actual Link response header."""
+        self.body = json.dumps(payload).encode()
+        self.headers: dict[str, str] | Message = {"Link": link}
+
+    def __enter__(self):
+        """Open the response context."""
+        return self
+
+    def __exit__(self, *_args):
+        """Close the response context without suppressing failures."""
+        return None
+
+    def read(self):
+        """Return the serialized body."""
+        return self.body
+
+
+def _url(page=None, ref: str | None = "refs/heads/main", per_page=100):
+    """Construct the documented analyses query, with an optional page number."""
+    params = {"per_page": str(per_page), "tool_name": "CodeQL"}
+    if ref:
+        params["ref"] = ref
+    if page is not None:
+        params["page"] = str(page)
+    return ENDPOINT + "?" + urlencode(params)
+
+
+def test_separate_link_headers_keep_next_after_current_last(monkeypatch):
+    """Every physical Link field contributes to the complete page traversal."""
+    first = _Page([{"id": 1}])
+    first.headers = Message()
+    first.headers["Link"] = f'<{_url(1)}>; rel="last"'
+    first.headers["link"] = f'<{_url(2)}>; rel="next"'
+    pages = {_url(): first, _url(2): _Page([{"id": 2}])}
+    calls = []
+
+    def open_page(request, timeout):
+        """Serve both pages and record their unchanged authenticated requests."""
+        calls.append((request.full_url, request.get_header("Authorization"), timeout))
+        return pages[request.full_url]
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    assert identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main") == [
+        {"id": 1}, {"id": 2}
+    ]
+    assert calls == [(url, "Bearer opaque", 30) for url in pages]
+
+
+@pytest.mark.parametrize("links", [
+    [f'<{_url(2)}>; rel="next"', f'<{_url(2)}>; rel="next"'],
+    [f'<{_url(2)}>; rel="next"', '<https://evil.example/analyses>; rel="next"'],
+    [f'<{_url(1)}>; rel="last"', f'<{_url(1)}>; rel="last"'],
+    [f'<{_url(2)}>; rel="next"', "garbage"],
+    [f'<{_url(2)}>; rel="next"', ""],
+    [f'<{_url(2)}>; rel="next"', f'<{_url(1)}>; rel="unknown"'],
+    [f'<{_url(1)}>; rel="last"', '<https://evil.example/analyses>; rel="next"'],
+    [f'<{_url(1)}>; rel="last"', f'<{_url(2, ref="refs/pull/7/head")}>; rel="next"'],
+])
+def test_separate_link_headers_reject_invalid_later_field_before_request(monkeypatch, links):
+    """A later duplicate, malformed or unsafe field cannot hide behind the first."""
+    response = _Page([{"id": 1}])
+    response.headers = Message()
+    for link in links:
+        response.headers["Link"] = link
+    calls = []
+
+    def open_page(request, timeout):
+        """Fail if any combined invalid header reaches another bearer request."""
+        calls.append((request.full_url, request.get_header("Authorization")))
+        assert len(calls) == 1, "invalid later Link field reached authenticated transport"
+        return response
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+    assert calls == [(_url(), "Bearer opaque")]
+
+
+@pytest.mark.parametrize("header_type", ["message", "dict"])
+@pytest.mark.parametrize("relation", [None, "", "last", "next"])
+def test_message_and_dict_headers_preserve_absent_single_link_behavior(monkeypatch, header_type, relation):
+    """Absent, empty and single Link fields preserve Message and dict compatibility."""
+    response = _Page([{"id": 1}])
+    response.headers = Message() if header_type == "message" else {}
+    if relation is not None:
+        response.headers["Link"] = (
+            f'<{_url(2 if relation == "next" else 1)}>; rel="{relation}"' if relation else ""
+        )
+    terminal = _Page([{"id": 2}])
+    terminal.headers = Message() if header_type == "message" else {}
+    calls = []
+
+    def open_page(request, timeout):
+        """Serve a single optional next page without inventing extra headers."""
+        calls.append((request.full_url, request.get_header("Authorization"), timeout))
+        assert len(calls) <= (2 if relation == "next" else 1)
+        return response if len(calls) == 1 else terminal
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    expected_urls = [_url(), _url(2)] if relation == "next" else [_url()]
+    assert identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main") == [
+        {"id": page} for page in range(1, len(expected_urls) + 1)
+    ]
+    assert calls == [(url, "Bearer opaque", 30) for url in expected_urls]
+
+
+def test_complete_history_keeps_active_identity_after_first_hundred(monkeypatch):
+    """A base identity on page three must still block an unpaired head."""
+    base_sha, head_sha = "a" * 40, "b" * 40
+    active = {"commit_sha": base_sha, "analysis_key": "active-workflow:analyze",
+              "category": "/language:rust", "tool": {"name": "CodeQL"}}
+    historical = [{"id": n, "commit_sha": "c" * 40} for n in range(200)]
+    pages = {
+        _url(): _Page(historical[:100], f'<{_url(2)}>; rel="next", <{_url(3)}>; rel="last"'),
+        _url(2): _Page(historical[100:], f'<{_url(3)}>; rel="next", <{_url(1)}>; rel="prev"'),
+        _url(3): _Page([active], f'<{_url(1)}>; rel="first", <{_url(2)}>; rel="prev"'),
+    }
+    calls = []
+
+    def open_page(request, timeout):
+        """Record every authenticated request and serve its exact page."""
+        calls.append((request.full_url, request.get_header("Authorization"), timeout))
+        return pages[request.full_url]
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    rows = identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+    assert rows == historical + [active]
+    assert identity.pairing_ready(rows, [], base_sha=base_sha, head_sha=head_sha, language="rust") == (
+        False, [("active-workflow:analyze", "/language:rust")]
+    )
+    assert calls == [(url, "Bearer opaque", 30) for url in pages]
+
+
+@pytest.mark.parametrize("target", [
+    "https://evil.example/analyses?page=2",
+    _url(2).replace("api.github.com", "api.github.com.evil.example"),
+    _url(2).replace("https://", "http://"),
+    _url(2).replace("api.github.com", "api.github.com:443"),
+    _url(2).replace("api.github.com", "user@api.github.com"),
+    _url(2) + "#fragment",
+    _url(2).replace("/example/", "/other/"),
+    _url(2).replace("/analyses?", "/alerts?"),
+    _url(2, ref="refs/pull/7/head"),
+    _url(2, ref=None),
+    _url(2, per_page=50),
+    _url(2).replace("tool_name=CodeQL", "tool_name=Semgrep"),
+    _url(2) + "&ref=refs%2Fheads%2Fmain",
+    _url(2) + "&extra=unreviewed",
+    _url(2).replace("page=2", "page=4"),
+    _url(2).replace("page=2", "page=0"),
+    _url(2).replace("page=2", "page=two"),
+    _url(2).replace("page=2", "page=02"),
+    _url(2).replace("&page=2", ""),
+    _url(2) + "&broken",
+    "/repos/ContextualWisdomLab/example/code-scanning/analyses?page=2",
+])
+def test_next_link_cannot_change_authority_endpoint_or_query(monkeypatch, target):
+    """Reject poisoned next URLs before constructing a second bearer request."""
+    calls = []
+
+    def open_page(request, timeout):
+        """Refuse a second request even when its authority still appears valid."""
+        calls.append((request.full_url, request.get_header("Authorization")))
+        assert len(calls) == 1, "poisoned link reached authenticated transport"
+        return _Page([{"id": 1}], f'<{target}>; rel="next"')
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+    assert calls == [(_url(), "Bearer opaque")]
+
+
+@pytest.mark.parametrize("link", [
+    "garbage", '<missing-bracket; rel="next"',
+    f'<{_url(2)}>; rel="next",',
+    f'<{_url(2)}>; rel="next", <{_url(3)}>; rel="next"',
+    f'<{_url(2)}>; rel="next"; rel="prev"',
+    f'<{_url(2)}>; rel="unknown"',
+])
+def test_malformed_link_cannot_be_treated_as_complete(monkeypatch, link):
+    """Malformed or ambiguous pagination never returns first-page evidence."""
+    calls = []
+
+    def open_page(request, timeout):
+        """Bound the intentionally malformed chain so a regression cannot hang."""
+        calls.append(request.full_url)
+        assert len(calls) == 1, "malformed link was followed"
+        return _Page([{"id": 1}], link)
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+
+
+@pytest.mark.parametrize("terminal_page", [1, 2])
+def test_last_beyond_current_without_next_never_returns_partial_evidence(monkeypatch, terminal_page):
+    """A last relation advertising unseen pages cannot prove completeness."""
+    calls = []
+
+    def open_page(request, timeout):
+        """Expose incomplete terminal evidence without following its last URL."""
+        calls.append(request.full_url)
+        assert len(calls) <= terminal_page, "incomplete terminal link was followed"
+        relation = "next" if len(calls) < terminal_page else "last"
+        target = _url(2) if relation == "next" else _url(3)
+        return _Page([{"id": len(calls)}], f'<{target}>; rel="{relation}"')
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+    assert calls == [_url(), _url(2)][:terminal_page]
+
+
+@pytest.mark.parametrize("target", [
+    _url(0), _url(1).replace("&page=1", "&page=one"),
+    _url(1).replace("&page=1", ""), _url(1) + "&page=1", _url(1) + "&broken",
+    _url(1, ref="refs/pull/7/head"), _url(1, per_page=50),
+    _url(1).replace("tool_name=CodeQL", "tool_name=Semgrep"),
+    _url(1).replace("/example/", "/other/"),
+    _url(1).replace("/analyses?", "/alerts?"),
+    _url(1).replace("api.github.com", "evil.example"),
+])
+def test_terminal_last_must_preserve_current_page_and_query(monkeypatch, target):
+    """A terminal last URL must bind the same authority, endpoint and query."""
+    calls = []
+
+    def open_page(request, timeout):
+        """Return an invalid terminal relation without permitting another request."""
+        calls.append(request.full_url)
+        assert len(calls) == 1, "terminal last URL was followed"
+        return _Page([{"id": 1}], f'<{target}>; rel="last"')
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+    assert calls == [_url()]
+
+
+@pytest.mark.parametrize("terminal_page", [1, 2])
+def test_terminal_last_equal_to_current_page_remains_supported(monkeypatch, terminal_page):
+    """An explicit last relation naming the current page is complete evidence."""
+    calls = []
+
+    def open_page(request, timeout):
+        """Serve sequential pages ending with a self-referential last relation."""
+        calls.append(request.full_url)
+        assert len(calls) <= terminal_page
+        relation = "next" if len(calls) < terminal_page else "last"
+        target = _url(2) if relation == "next" else _url(terminal_page)
+        return _Page([{"id": len(calls)}], f'<{target}>; rel="{relation}"')
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    assert identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main") == [
+        {"id": page} for page in range(1, terminal_page + 1)
+    ]
+    assert calls == [_url(), _url(2)][:terminal_page]
+
+
+def test_cyclic_next_link_fails_before_repeated_request(monkeypatch):
+    """A page-two link back to page one is not complete evidence or a retry."""
+    calls = []
+
+    def open_page(request, timeout):
+        """Serve a cycle once, then expose any unsafe follow attempt."""
+        calls.append(request.full_url)
+        assert len(calls) <= 2, "cycle was followed"
+        target = _url(2) if len(calls) == 1 else _url(1)
+        return _Page([{"id": len(calls)}], f'<{target}>; rel="next"')
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+    assert calls == [_url(), _url(2)]
+
+
+@pytest.mark.parametrize("failure", ["http", "transport", "json", "utf8", "empty", "object"])
+def test_later_page_failure_never_returns_partial_evidence(monkeypatch, failure):
+    """Any second-page API/decoding/shape failure aborts the entire collection."""
+    calls = []
+
+    def open_page(request, timeout):
+        """Serve a valid prefix before failing the final page."""
+        calls.append(request.full_url)
+        if len(calls) == 1:
+            return _Page([{"id": 1}], f'<{_url(2)}>; rel="next"')
+        if failure == "http":
+            raise identity.urllib.error.HTTPError(request.full_url, 403, "denied", Message(), BytesIO(b"denied"))
+        if failure == "transport":
+            raise identity.urllib.error.URLError("offline")
+        response = _Page({"error": "bad"} if failure == "object" else [])
+        if failure in {"json", "utf8", "empty"}:
+            response.body = {"json": b"[invalid", "utf8": b"\xff", "empty": b" "}[failure]
+        return response
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+    assert calls == [_url(), _url(2)]
+
+
+def test_unbounded_chain_fails_at_documented_page_budget(monkeypatch):
+    """One thousand pages is an independent literal bound, never a partial success."""
+    assert identity.MAX_ANALYSES_PAGES == 1000
+    calls = []
+
+    def open_page(request, timeout):
+        """Offer endless sequential pages while bounding this regression itself."""
+        calls.append(request.full_url)
+        assert len(calls) <= 1000, "unbounded chain reached transport"
+        return _Page([{"id": len(calls)}], f'<{_url(len(calls) + 1)}>; rel="next"')
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    with pytest.raises(identity.ConfigurationIdentityError, match="page limit.*incomplete"):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+    assert len(calls) == 1000
+
+
+@pytest.mark.parametrize("per_page", [0, -1, 101, True, "100", 1.5])
+def test_invalid_page_size_fails_before_transport(monkeypatch, per_page):
+    """Only the API's integer range 1..100 can establish bounded page sizes."""
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", lambda *a, **k: pytest.fail("invalid page size reached transport"))
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", per_page=per_page)
+
+
+@pytest.mark.parametrize("repository", ["a/b/c", "a/../b", "a/b?ref=other", "a/b#fragment", "a/", "/b", "a/.", "a/.."])
+def test_repository_cannot_inject_endpoint_or_query(monkeypatch, repository):
+    """Bind the original endpoint to exactly two safe owner/name segments."""
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", lambda *a, **k: pytest.fail("invalid repository reached transport"))
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses(repository, token="opaque")
+
+
+@pytest.mark.parametrize("ref", [None, "refs/pull/82/head", "refs/heads/a,b&c"])
+@pytest.mark.parametrize("per_page", [1, 100])
+def test_valid_queries_and_terminal_empty_page_remain_supported(monkeypatch, ref, per_page):
+    """Ref omission, escaping, query reordering and an empty JSON array are valid."""
+    first = _url(ref=ref, per_page=per_page)
+    # Query ordering is not identity, while the original decoded filters are.
+    next_url = _url(2, ref=ref, per_page=per_page)
+    path, query = next_url.split("?", 1)
+    next_url = path + "?" + "&".join(reversed(query.split("&")))
+    calls = []
+
+    def open_page(request, timeout):
+        """Return one row followed by an explicitly empty final JSON page."""
+        calls.append(request.full_url)
+        if len(calls) == 1:
+            return _Page([{"id": 1}, "ignored-as-before"], f'<{next_url}>; rel="next"')
+        return _Page([])
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    assert identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref=ref, per_page=per_page) == [{"id": 1}]
+    assert calls == [first, next_url]
+
+
+@pytest.mark.parametrize("repository_id", [123, 456, "123", None, True, 0, -1])
+def test_numeric_repository_link_requires_verified_repository_binding(monkeypatch, repository_id):
+    """GitHub's documented numeric alias is allowed only for the original repo ID."""
+    next_url = _url(2).replace("repos/ContextualWisdomLab/example", "repositories/123")
+    metadata_url = "https://api.github.com/repos/ContextualWisdomLab/example"
+    calls = []
+
+    def open_page(request, timeout):
+        """Bind metadata to the initial owner/name without accepting an arbitrary ID."""
+        calls.append(request.full_url)
+        if request.full_url == _url():
+            return _Page([{"id": 1}], f'<{next_url}>; rel="next"')
+        if request.full_url == metadata_url:
+            return _Page({"id": repository_id})
+        assert repository_id == 123 and type(repository_id) is int, "unverified numeric alias reached transport"
+        return _Page([{"id": 2}])
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    if type(repository_id) is int and repository_id == 123:
+        assert identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main") == [{"id": 1}, {"id": 2}]
+        assert calls == [_url(), metadata_url, next_url]
+    else:
+        with pytest.raises(identity.ConfigurationIdentityError):
+            identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+        assert next_url not in calls
+
+
+@pytest.mark.parametrize("metadata", [[], {}, {"id": 0}])
+def test_numeric_alias_rejects_missing_metadata_identity(monkeypatch, metadata):
+    """An unbound metadata payload cannot authorize a numeric analyses endpoint."""
+    next_url = _url(2).replace("repos/ContextualWisdomLab/example", "repositories/123")
+    calls = []
+
+    def open_page(request, timeout):
+        """Serve malformed metadata without ever serving the unverified alias."""
+        calls.append(request.full_url)
+        if len(calls) == 1:
+            return _Page([], f'<{next_url}>; rel="next"')
+        assert len(calls) == 2
+        return _Page(metadata)
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    with pytest.raises(identity.ConfigurationIdentityError):
+        identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main")
+    assert next_url not in calls
+
+
+def test_numeric_alias_binding_is_cached_for_later_pages(monkeypatch):
+    """One original-repository metadata read binds all numeric page targets."""
+    second = _url(2).replace("repos/ContextualWisdomLab/example", "repositories/123")
+    third = _url(3).replace("repos/ContextualWisdomLab/example", "repositories/123")
+    metadata_url = ENDPOINT.removesuffix("/code-scanning/analyses")
+    pages = {_url(): _Page([{"id": 1}], f'<{second}>; rel="next"'),
+             metadata_url: _Page({"id": 123}),
+             second: _Page([{"id": 2}], f'<{third}>; rel="next"'),
+             third: _Page([{"id": 3}])}
+    calls = []
+
+    def open_page(request, timeout):
+        """Track the single metadata binding and each numeric page."""
+        calls.append(request.full_url)
+        return pages[request.full_url]
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", open_page)
+    assert identity.list_codeql_analyses("ContextualWisdomLab/example", token="opaque", ref="refs/heads/main") == [{"id": 1}, {"id": 2}, {"id": 3}]
+    assert calls == list(pages)
diff --git a/tests/test_codeql_ghas_configuration_identity.py b/tests/test_codeql_ghas_configuration_identity.py
index 817cd56497..309d5b5465 100644
--- a/tests/test_codeql_ghas_configuration_identity.py
+++ b/tests/test_codeql_ghas_configuration_identity.py
@@ -430,8 +430,8 @@ def test_request_json_maps_http_and_transport_failures(monkeypatch):
     """HTTP and transport failures become ConfigurationIdentityError."""
 
     class _HTTPError(identity.urllib.error.HTTPError):
-        def read(self) -> bytes:
-            return b"denied"
+        def read(self, size: int = -1) -> bytes:
+            return b"denied"[:size]
 
     def raise_http(request, timeout=30):
         del request, timeout
@@ -492,6 +492,9 @@ def __exit__(self, exc_type, exc, tb) -> None:
 
 def test_list_codeql_analyses_rejects_non_list_payload(monkeypatch):
     """A non-list analyses response fails closed."""
-    monkeypatch.setattr(identity, "_request_json", lambda url, token, timeout_seconds: {"ok": True})
+    monkeypatch.setattr(
+        identity, "_request_json",
+        lambda url, token, timeout_seconds, response_headers=None: {"ok": True},
+    )
     with pytest.raises(identity.ConfigurationIdentityError):
         identity.list_codeql_analyses("ContextualWisdomLab/wardnet", token="opaque")
diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py
index 82569e89c7..23cf31660f 100644
--- a/tests/test_codeql_pr_workflow_contract.py
+++ b/tests/test_codeql_pr_workflow_contract.py
@@ -1150,7 +1150,7 @@ def test_codeql_moved_head_requires_forward_ancestry(tmp_path: Path) -> None:
 def test_codeql_control_routing_keeps_pr_workflows_hosted() -> None:
     """Only the trusted main revision may request the restricted control group."""
     workflow = WORKFLOW_PATH.read_text(encoding="utf-8")
-    selectors = [line.strip() for line in workflow.splitlines() if line.strip().startswith("runs-on:")]
+    selectors = [line.strip() for line in workflow.splitlines() if line.startswith("      group:")]
     trusted = "ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main"
     assert len(selectors) == 3
     for selector in selectors:
@@ -1158,7 +1158,10 @@ def test_codeql_control_routing_keeps_pr_workflows_hosted() -> None:
         choices = re.findall(r"'([^']*)'", selector)
         assert choices[0] == trusted
         assert json.loads(choices[1]) == {"group": "CWL central control", "labels": ["self-hosted", "linux", "x64"]}
-        assert json.loads(choices[2]) == "ubuntu-24.04"
+        assert json.loads(choices[2]) == {
+            "group": "CWL CI isolated",
+            "labels": ["self-hosted", "linux", "x64", "cwlab-ci-isolated"],
+        }
 
 
 def test_codeql_pr_rejects_invalid_required_run_time(tmp_path: Path) -> None:
diff --git a/tests/test_company_default_head_trust_gate.py b/tests/test_company_default_head_trust_gate.py
new file mode 100644
index 0000000000..b54e88aa61
--- /dev/null
+++ b/tests/test_company_default_head_trust_gate.py
@@ -0,0 +1,131 @@
+"""Source-only trust gate: real YAML Bash, inert API, no company operation."""
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW = ROOT / '.github/workflows/company-default-head-trust-gate.yml'
+CURRENT = 'a' * 40
+
+
+def workflow():
+    assert WORKFLOW.is_file(), 'Missing central company trust-gate callee'
+    return yaml.safe_load(WORKFLOW.read_text())
+
+
+def test_exact_callee_contract():
+    data = workflow()
+    trigger = data.get('on', data.get(True))
+    assert set(trigger) == {'workflow_call'}
+    call = trigger['workflow_call']
+    assert set(call['inputs']) == {'target_runner_label', 'trusted_ref_sha', 'trusted_ref_ack'}
+    assert call['inputs']['target_runner_label'] == {'required': True, 'type': 'string'}
+    assert call.get('secrets', {}) == {}
+    assert call['outputs']['runner_matrix']['value'] == '${{ jobs.validate.outputs.runner_matrix }}'
+    assert data['permissions'] == {'contents': 'read'}
+    assert set(data['jobs']) == {'validate'}
+    job = data['jobs']['validate']
+    assert job['runs-on'] == {'group': 'CWL CI isolated',
+                             'labels': ['self-hosted', 'Linux', 'X64', 'cwlab-ci-isolated']}
+    assert job['timeout-minutes'] == 5
+    assert job['outputs']['runner_matrix'] == '${{ steps.runner.outputs.runner_matrix }}'
+    assert len(job['steps']) == 2
+    assert all('uses' not in step and step['shell'] == 'bash' for step in job['steps'])
+    body = '\n'.join(step['run'] for step in job['steps'])
+    assert 'inputs.trusted_ref_' not in body
+    assert 'secrets.' not in body
+    assert job['steps'][1]['env']['GH_TOKEN'] == '${{ github.token }}'
+
+
+@pytest.mark.parametrize('case,ref,target,api_exit,sha,expected,calls', [
+    ('current', 'main', 'all', 0, CURRENT, 0, 1),
+    ('stale', 'main', 'itxllmpgw01', 0, 'b' * 40, 2, 1),
+    ('nondefault', 'feature', 'itxllmpgw01', 0, CURRENT, 2, 0),
+    ('invalid-target', 'main', 'injected; echo unsafe', 0, CURRENT, 2, 0),
+    ('api-failure', 'main', 'itxllmpgw01', 23, CURRENT, 23, 1),
+])
+def test_actual_callee_bash(tmp_path, case, ref, target, api_exit, sha, expected, calls):
+    job = workflow()['jobs']['validate']
+    stub = tmp_path / 'gh'
+    stub.write_text('#!' + sys.executable + '\n'
+                    'import json, os, sys\n'
+                    'with open(os.environ["CALLS"], "a") as f:\n'
+                    ' f.write(json.dumps(sys.argv[1:]) + "\\n")\n'
+                    'if int(os.environ["API_EXIT"]): sys.exit(int(os.environ["API_EXIT"]))\n'
+                    'print(os.environ["CURRENT_SHA"])\n')
+    stub.chmod(0o700)
+    output, record = tmp_path / 'output', tmp_path / 'calls'
+    env = {'PATH': str(tmp_path) + os.pathsep + os.defpath,
+           'TARGET': target, 'DEFAULT_BRANCH': 'main', 'REF_NAME': ref,
+           'SHA': sha, 'REPOSITORY': 'fixture/company-ops', 'GH_TOKEN': 'synthetic-only',
+           'GITHUB_OUTPUT': str(output), 'CALLS': str(record),
+           'CURRENT_SHA': CURRENT, 'API_EXIT': str(api_exit)}
+    bash = shutil.which('bash')
+    assert bash, 'Bash is required; missing tool is not a skipped PASS'
+    results = []
+    for step in job['steps']:
+        result = subprocess.run([bash, '--noprofile', '--norc', '-e', '-o', 'pipefail', '-c', step['run']],
+                                env=env, cwd=tmp_path, capture_output=True, text=True, timeout=10)
+        results.append(result)
+        if result.returncode:
+            break
+    assert results[-1].returncode == expected, (case, results[-1].stderr)
+    actual_calls = record.read_text().splitlines() if record.exists() else []
+    assert len(actual_calls) == calls
+    for line in actual_calls:
+        assert json.loads(line) == ['api', 'repos/fixture/company-ops/commits/main', '--jq', '.sha']
+    if case == 'invalid-target':
+        assert not output.exists()
+    else:
+        value = output.read_text().strip().removeprefix('runner_matrix=')
+        assert json.loads(value) == (['itxllmpgw01', 'itxllmpgw02', 'xtrmsales-llmgw1',
+                                     'xtrmsales-llmgw2'] if target == 'all' else [target])
+    if case == 'current':
+        assert 'trusted_ref_status=current_default_head' in results[-1].stdout
+    else:
+        assert 'trusted_ref_status=current_default_head' not in results[-1].stdout
+
+
+@pytest.mark.parametrize('result', ['success', 'failure', 'cancelled', 'skipped'])
+def test_always_downstream_requires_overall_success(result):
+    # Source caller fixture/truth table, not GitHub scheduling or operating execution.
+    data = workflow()
+    fixture = yaml.safe_load('''jobs:
+  trust:
+    uses: ContextualWisdomLab/.github/.github/workflows/company-default-head-trust-gate.yml@<reviewed-sha>
+  operate:
+    needs: trust
+    if: ${{ always() && needs.trust.result == 'success' }}
+    matrix_data: ${{ needs.trust.outputs.runner_matrix }}
+''')
+    assert data['jobs']['validate']['outputs']['runner_matrix']
+    job = fixture['jobs']['operate']
+    assert job['needs'] == 'trust'
+    assert job['if'] == "${{ always() && needs.trust.result == 'success' }}"
+    produced_matrix = '["itxllmpgw01"]'  # Can exist even on stale/nondefault failure.
+    assert produced_matrix
+    # Exercise the supported fixture predicate with supplied result as data.
+    predicate = job['if'].removeprefix('${{ ').removesuffix(' }}')
+    assert predicate == "always() && needs.trust.result == 'success'"
+    shell = predicate.replace('always()', 'true').replace(
+        "needs.trust.result == 'success'", '[ "$TRUST_RESULT" = success ]')
+    bash = shutil.which('bash')
+    assert bash
+    child = subprocess.run([bash, '--noprofile', '--norc', '-c',
+                            'if ' + shell + '; then printf admitted; fi'],
+                           env={'TRUST_RESULT': result}, capture_output=True,
+                           text=True, timeout=5)
+    assert child.returncode == 0
+    assert child.stdout == ('admitted' if result == 'success' else '')
+    # Removing the success gate admits all failed/skipped fixtures: oracle sensitivity.
+    unsafe = subprocess.run([bash, '--noprofile', '--norc', '-c',
+                             'if true; then printf admitted; fi'],
+                            env={'TRUST_RESULT': result}, capture_output=True,
+                            text=True, timeout=5)
+    assert unsafe.stdout == 'admitted'
diff --git a/tests/test_contextual_orchestrator_review_launcher.py b/tests/test_contextual_orchestrator_review_launcher.py
new file mode 100644
index 0000000000..ae7745c239
--- /dev/null
+++ b/tests/test_contextual_orchestrator_review_launcher.py
@@ -0,0 +1,579 @@
+"""Behavior coverage for the contextual-orchestrator review launcher."""
+
+from __future__ import annotations
+
+import json
+import logging
+import runpy
+import sys
+import threading
+import time
+from pathlib import Path
+from types import ModuleType, SimpleNamespace
+from urllib.error import HTTPError
+
+import pytest
+
+from scripts.ci import contextual_orchestrator_review_launcher as launcher
+from scripts.ci import contextual_orchestrator_review_policy as policy
+
+
+LAUNCHER_PATH = Path(launcher.__file__)
+
+
+def _discovered_model(
+    *,
+    provider_name: str = "bytez",
+    model_id: str = "test/free",
+    agent_id: str = "bytez_free",
+    credential_name: str = "BYTEZ_API_KEY",
+    prompt_price: float = 0.0,
+    completion_price: float = 0.0,
+    output_modalities: tuple[str, ...] = ("text",),
+) -> SimpleNamespace:
+    """Return one complete discovery row shaped like the owner runtime."""
+    provider_settings = {
+        "bytez": ("https://api.bytez.com/models/v2/openai/v1", "raw-token"),
+        "openai": ("https://api.openai.com/v1", "bearer"),
+    }
+    base_url, auth_scheme = provider_settings[provider_name]
+    return SimpleNamespace(
+        provider_name=provider_name,
+        model_id=model_id,
+        agent_id=agent_id,
+        chat_base_url=base_url,
+        credential_name=credential_name,
+        auth_scheme=auth_scheme,
+        output_modalities=output_modalities,
+        prompt_price_per_1k=prompt_price,
+        completion_price_per_1k=completion_price,
+        currency_code="USD",
+    )
+
+
+def _install_owner_runtime(
+    monkeypatch: pytest.MonkeyPatch,
+    *,
+    discovered_models: list[object] | None = None,
+    registered_credentials: list[str] | None = None,
+    auth_token: str | None = "gateway-token",
+    discovery_error: Exception | None = None,
+    failing_agent_ids: frozenset[str] = frozenset(),
+) -> SimpleNamespace:
+    """Install controlled owner-package modules without copying owner source."""
+    runtime_state = SimpleNamespace(
+        discovered_models=discovered_models or [_discovered_model()],
+        registered_credentials=(
+            ["BYTEZ_API_KEY"]
+            if registered_credentials is None
+            else registered_credentials
+        ),
+        auth_token=auth_token,
+        discovery_error=discovery_error,
+        failing_agent_ids=failing_agent_ids,
+        configured_levels=[],
+        model_clients=[],
+        served_requests=[],
+    )
+
+    owner_package = ModuleType("contextual_orchestrator")
+    owner_package.__path__ = []
+
+    credentials_module = ModuleType("contextual_orchestrator.credentials")
+    credentials_module.get_credential = lambda credential_name: runtime_state.auth_token
+
+    capability_module = ModuleType("contextual_orchestrator.chat_capability")
+    capability_module.is_general_chat_agent_model_id = (
+        lambda model_id: not str(model_id).startswith("embedding-")
+    )
+
+    discovery_module = ModuleType("contextual_orchestrator.model_discovery")
+
+    def discover_all_models() -> tuple[list[object], list[object]]:
+        if runtime_state.discovery_error is not None:
+            raise runtime_state.discovery_error
+        return runtime_state.discovered_models, []
+
+    discovery_module.discover_all_models = discover_all_models
+    discovery_module.free_discovered_models = lambda models: [
+        model
+        for model in models
+        if getattr(model, "prompt_price_per_1k", None) == 0.0
+        and getattr(model, "completion_price_per_1k", None) == 0.0
+    ]
+
+    orchestrator_module = ModuleType("contextual_orchestrator.orchestrator")
+
+    class ModelClient:
+        """Return explicit text or a bounded provider rejection by agent id."""
+
+        def __init__(self, **settings: object) -> None:
+            self.settings = settings
+            runtime_state.model_clients.append(self)
+
+        def proxy_send_once(
+            self, agent: object, endpoint: str, payload: dict[str, object]
+        ) -> dict[str, object]:
+            if str(getattr(agent, "id", "")) in runtime_state.failing_agent_ids:
+                raise HTTPError(
+                    "https://provider.invalid", 401, "private", {}, None
+                )
+            return {
+                "choices": [
+                    {"finish_reason": "stop", "message": {"content": "OK"}}
+                ]
+            }
+
+    class TaskOrchestrator:
+        """Capture the validated serving pool."""
+
+        def __init__(self, agents: list[object], *, client: object) -> None:
+            self.agents = agents
+            self.client = client
+
+    def load_agents(catalog_path: str) -> list[SimpleNamespace]:
+        catalog = json.loads(Path(catalog_path).read_text(encoding="utf-8"))
+        return [SimpleNamespace(**agent) for agent in catalog["agents"]]
+
+    orchestrator_module.ModelClient = ModelClient
+    orchestrator_module.TaskOrchestrator = TaskOrchestrator
+    orchestrator_module.load_agents = load_agents
+
+    gateway_module = ModuleType("contextual_orchestrator.review_gateway")
+    gateway_module.REVIEW_AUTH_CREDENTIAL_NAME = "REVIEW_GATEWAY_TOKEN"
+    gateway_module.register_review_credentials = (
+        lambda environment: runtime_state.registered_credentials
+    )
+
+    server_module = ModuleType("contextual_orchestrator.server")
+
+    class SecurityConfig:
+        """Retain the authentication boundary passed to the server."""
+
+        def __init__(self, *, auth_token: str, max_body_bytes: int) -> None:
+            self.auth_token = auth_token
+            self.max_body_bytes = max_body_bytes
+
+    def serve(
+        orchestrator: object,
+        *,
+        host: str,
+        port: int,
+        security: object,
+    ) -> None:
+        runtime_state.served_requests.append(
+            SimpleNamespace(
+                orchestrator=orchestrator,
+                host=host,
+                port=port,
+                security=security,
+            )
+        )
+
+    server_module.SecurityConfig = SecurityConfig
+    server_module.serve = serve
+
+    logging_module = ModuleType("contextual_orchestrator.debug_logging")
+    logging_module.configure_logging = runtime_state.configured_levels.append
+
+    owner_modules = {
+        "contextual_orchestrator": owner_package,
+        "contextual_orchestrator.credentials": credentials_module,
+        "contextual_orchestrator.chat_capability": capability_module,
+        "contextual_orchestrator.model_discovery": discovery_module,
+        "contextual_orchestrator.orchestrator": orchestrator_module,
+        "contextual_orchestrator.review_gateway": gateway_module,
+        "contextual_orchestrator.server": server_module,
+        "contextual_orchestrator.debug_logging": logging_module,
+    }
+    for module_name, module_value in owner_modules.items():
+        monkeypatch.setitem(sys.modules, module_name, module_value)
+    return runtime_state
+
+
+def _launcher_arguments(temporary_path: Path, *extra_arguments: str) -> list[str]:
+    """Return complete launcher arguments rooted in one temporary directory."""
+    return [
+        "--discovery-out",
+        str(temporary_path / "discovery.json"),
+        "--catalog-out",
+        str(temporary_path / "catalog.json"),
+        "--report-out",
+        str(temporary_path / "report.json"),
+        "--preflight-out",
+        str(temporary_path / "preflight.json"),
+        *extra_arguments,
+    ]
+
+
+def test_main_serves_a_discovered_free_route(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """A free text route reaches the authenticated loopback server."""
+    runtime_state = _install_owner_runtime(
+        monkeypatch,
+        discovered_models=[
+            _discovered_model(),
+            _discovered_model(
+                provider_name="openai",
+                model_id="gpt-priced",
+                agent_id="openai_priced",
+                credential_name="OPENAI_API_KEY",
+                prompt_price=1.0,
+                completion_price=2.0,
+            ),
+        ],
+        registered_credentials=["BYTEZ_API_KEY", "OPENAI_API_KEY"],
+    )
+
+    assert launcher.main(_launcher_arguments(tmp_path)) == 0
+
+    assert runtime_state.configured_levels == [launcher.DEFAULT_SIDECAR_LOG_LEVEL]
+    assert len(runtime_state.served_requests) == 1
+    served_request = runtime_state.served_requests[0]
+    assert served_request.host == "127.0.0.1"
+    assert served_request.port == 18080
+    assert served_request.security.auth_token == "gateway-token"
+    assert served_request.security.max_body_bytes == launcher.REVIEW_MAX_BODY_BYTES
+    assert [agent.id for agent in served_request.orchestrator.agents] == [
+        "bytez_free"
+    ]
+    assert json.loads((tmp_path / "preflight.json").read_text(encoding="utf-8"))[
+        "ready_count"
+    ] == 1
+
+
+def test_main_uses_the_priced_fallback_only_after_free_routes_fail(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """Auto mode replaces a rejected free catalog with its priced successor."""
+    free_model = _discovered_model()
+    priced_model = _discovered_model(
+        provider_name="openai",
+        model_id="gpt-priced",
+        agent_id="openai_priced",
+        credential_name="OPENAI_API_KEY",
+        prompt_price=1.0,
+        completion_price=2.0,
+    )
+    runtime_state = _install_owner_runtime(
+        monkeypatch,
+        discovered_models=[free_model, priced_model],
+        registered_credentials=["BYTEZ_API_KEY", "OPENAI_API_KEY"],
+        failing_agent_ids=frozenset({"bytez_free"}),
+    )
+
+    assert launcher.main(_launcher_arguments(tmp_path, "--pool", "auto")) == 0
+
+    catalog = json.loads((tmp_path / "catalog.json").read_text(encoding="utf-8"))
+    report = json.loads((tmp_path / "report.json").read_text(encoding="utf-8"))
+    assert [agent["id"] for agent in catalog["agents"]] == ["openai_priced"]
+    assert report["fallback_reason"] == "primary_routes_unavailable"
+    assert report["primary_selected_count"] == 1
+    assert not (tmp_path / "catalog.json.priced").exists()
+    assert [agent.id for agent in runtime_state.served_requests[0].orchestrator.agents] == [
+        "openai_priced"
+    ]
+
+
+def test_main_keeps_the_free_catalog_when_priced_policy_rejects_fallback(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """An unavailable optional priced catalog cannot replace a valid free pool."""
+    free_model = _discovered_model()
+    priced_model = _discovered_model(
+        provider_name="openai",
+        model_id="gpt-priced",
+        agent_id="openai_priced",
+        credential_name="OPENAI_API_KEY",
+        prompt_price=1.0,
+        completion_price=2.0,
+    )
+    _install_owner_runtime(
+        monkeypatch,
+        discovered_models=[free_model, priced_model],
+        registered_credentials=["BYTEZ_API_KEY", "OPENAI_API_KEY"],
+    )
+    real_builder = policy.build_zdr_prioritized_catalog
+
+    def reject_priced_rows(rows: list[dict[str, object]], **settings: object) -> object:
+        if rows and all(row.get("cost_evidence") == "priced" for row in rows):
+            raise policy.PolicyError("priced fallback unavailable")
+        return real_builder(rows, **settings)
+
+    monkeypatch.setattr(policy, "build_zdr_prioritized_catalog", reject_priced_rows)
+
+    assert launcher.main(_launcher_arguments(tmp_path, "--pool", "auto")) == 0
+    catalog = json.loads((tmp_path / "catalog.json").read_text(encoding="utf-8"))
+    assert [agent["id"] for agent in catalog["agents"]] == ["bytez_free"]
+
+
+@pytest.mark.parametrize(
+    ("runtime_settings", "expected_message"),
+    (
+        ({"auth_token": None}, "requires an explicit --auth-token"),
+        ({"registered_credentials": []}, "requires at least one provider credential"),
+        (
+            {"discovery_error": RuntimeError("discovery unavailable")},
+            "review sidecar discovery failed: discovery unavailable",
+        ),
+        (
+            {
+                "discovered_models": [
+                    _discovered_model(output_modalities=("image",))
+                ]
+            },
+            "discovered no eligible models",
+        ),
+    ),
+)
+def test_main_fails_closed_before_serving_invalid_runtime_state(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    runtime_settings: dict[str, object],
+    expected_message: str,
+) -> None:
+    """Missing trust prerequisites terminate before a server can be exposed."""
+    runtime_state = _install_owner_runtime(monkeypatch, **runtime_settings)
+
+    with pytest.raises(SystemExit, match=expected_message):
+        launcher.main(_launcher_arguments(tmp_path))
+
+    assert runtime_state.served_requests == []
+
+
+def test_main_persists_sanitized_preflight_failure(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A provider rejection writes bounded evidence and never starts serving."""
+    runtime_state = _install_owner_runtime(
+        monkeypatch, failing_agent_ids=frozenset({"bytez_free"})
+    )
+
+    with pytest.raises(SystemExit, match="review sidecar preflight failed"):
+        launcher.main(_launcher_arguments(tmp_path))
+
+    preflight_report = json.loads(
+        (tmp_path / "preflight.json").read_text(encoding="utf-8")
+    )
+    assert preflight_report["routes"][0]["http_status"] == 401
+    assert "private" not in json.dumps(preflight_report)
+    assert "preflight_route_rejected provider=bytez" in capsys.readouterr().err
+    assert runtime_state.served_requests == []
+
+
+def test_script_entrypoint_exits_with_main_result(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """Direct script execution propagates the successful launcher exit code."""
+    runtime_state = _install_owner_runtime(monkeypatch)
+    monkeypatch.setattr(
+        sys, "argv", [str(LAUNCHER_PATH), *_launcher_arguments(tmp_path)]
+    )
+
+    with pytest.raises(SystemExit) as exit_result:
+        runpy.run_path(str(LAUNCHER_PATH), run_name="__main__")
+
+    assert exit_result.value.code == 0
+    assert len(runtime_state.served_requests) == 1
+
+
+@pytest.mark.parametrize(
+    ("response_value", "expected_text", "expected_reasoning"),
+    (
+        (object(), False, False),
+        ({"choices": [object()]}, False, False),
+        ({"choices": [{"message": object()}]}, False, False),
+        (
+            {"choices": [{"finish_reason": "bad-value!", "message": {}}]},
+            False,
+            False,
+        ),
+    ),
+)
+def test_response_parsers_reject_malformed_provider_shapes(
+    response_value: object, expected_text: bool, expected_reasoning: bool
+) -> None:
+    """Malformed response layers remain unusable without raising."""
+    assert launcher._chat_response_has_text(response_value) is expected_text
+    assert (
+        launcher._response_has_reasoning_without_content(response_value)
+        is expected_reasoning
+    )
+    finish_reason = launcher._response_finish_reason(response_value)
+    if isinstance(response_value, dict) and response_value.get("choices"):
+        first_choice = response_value["choices"][0]
+        if isinstance(first_choice, dict) and first_choice.get("finish_reason"):
+            assert finish_reason == "unknown"
+            return
+    assert finish_reason is None
+
+
+def test_report_rows_skip_missing_identity_and_use_policy_defaults() -> None:
+    """Only complete route identities become policy rows."""
+    missing_identity = SimpleNamespace(provider_name="", model_id="")
+    defaulted_model = SimpleNamespace(
+        provider_name="bytez",
+        model_id="test/free",
+        agent_id="bytez_free",
+        output_modalities=("text",),
+    )
+
+    assert launcher._route_identity(SimpleNamespace()) == ("", "")
+    assert launcher._report_rows([missing_identity], frozenset()) == []
+    row = launcher._report_rows(
+        [defaulted_model], frozenset({("bytez", "test/free")})
+    )[0]
+    assert row["base_url"] == "https://api.bytez.com/models/v2/openai/v1"
+    assert row["credential_key"] == "BYTEZ_API_KEY"
+    assert row["auth_scheme"] == "Key"
+
+
+@pytest.mark.parametrize(
+    ("function_call", "expected_message"),
+    (
+        (
+            lambda: launcher._bounded_primary_catalog_limit(
+                0, pool="free", has_free_rows=True
+            ),
+            "must be positive",
+        ),
+        (
+            lambda: launcher._bounded_fallback_catalog_limit(0, primary_count=0),
+            "must be positive",
+        ),
+        (
+            lambda: launcher._bounded_fallback_catalog_limit(4, primary_count=5),
+            "exceeds the preflight budget",
+        ),
+    ),
+)
+def test_catalog_limits_reject_impossible_budgets(
+    function_call: object, expected_message: str
+) -> None:
+    """Invalid catalog budgets fail before route selection."""
+    with pytest.raises(ValueError, match=expected_message):
+        function_call()
+
+
+def test_preflight_without_fallback_preserves_the_primary_failure() -> None:
+    """A failed primary stage cannot be disguised when no successor exists."""
+    primary_report = {"routes": [], "escalations_used": 0}
+
+    def reject_primary(agents: list[object], **settings: object) -> object:
+        raise launcher.ReviewPreflightError("primary unavailable", primary_report)
+
+    with pytest.raises(launcher.ReviewPreflightError) as error_result:
+        launcher._preflight_with_fallback(
+            [object()], [], client=object(), preflight=reject_primary
+        )
+
+    assert error_result.value.report is primary_report
+
+
+def test_concurrent_preflight_waits_for_an_outstanding_route() -> None:
+    """Hold the probe until the scheduler reaches its blocking receive."""
+    agent = SimpleNamespace(
+        id="slow-ready", provider_name="bytez", model="test/free", priority=0
+    )
+    release = threading.Event()
+    original_queue = launcher.queue.Queue
+    original_thread = launcher.threading.Thread
+    workers: list[threading.Thread] = []
+    blocking_get_calls: list[bool] = []
+
+    class RecordingQueue(original_queue):
+        """Release the held probe only on an actual blocking receive."""
+
+        def get(self, block: bool = True, timeout: float | None = None) -> object:
+            if block:
+                blocking_get_calls.append(True)
+                release.set()
+            return super().get(block=block, timeout=timeout)
+
+    def recording_thread(*args: object, **kwargs: object) -> threading.Thread:
+        worker = original_thread(*args, **kwargs)
+        workers.append(worker)
+        return worker
+
+    class HeldClient:
+        """Wait for the receive handshake, not a scheduling-dependent sleep."""
+
+        def proxy_send_once(
+            self, selected_agent: object, endpoint: str, payload: dict[str, object]
+        ) -> dict[str, object]:
+            assert release.wait(timeout=5), "scheduler did not enter blocking receive"
+            return {
+                "choices": [
+                    {"finish_reason": "stop", "message": {"content": "OK"}}
+                ]
+            }
+
+    monkeypatch = pytest.MonkeyPatch()
+    try:
+        monkeypatch.setattr(launcher.queue, "Queue", RecordingQueue)
+        monkeypatch.setattr(launcher.threading, "Thread", recording_thread)
+        viable_agents, preflight_report = launcher._preflight_review_agents_concurrently(
+            [agent], client=HeldClient()
+        )
+        assert blocking_get_calls == [True]
+        assert viable_agents == [agent]
+        assert preflight_report["ready_count"] == 1
+    finally:
+        release.set()
+        for worker in workers:
+            worker.join(timeout=5)
+        monkeypatch.undo()
+        assert all(not worker.is_alive() for worker in workers)
+
+
+def test_postponed_concurrent_probe_cannot_spend_an_escalation(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A postponed candidate reports the first-pass escalation reservation."""
+    agents = [
+        SimpleNamespace(
+            id=str(index), provider_name="bytez", model=f"test/{index}", priority=0
+        )
+        for index in range(3)
+    ]
+    probe_calls = 0
+
+    def deterministic_probe(
+        selected_agents: list[object], **settings: object
+    ) -> tuple[list[object], dict[str, object]]:
+        nonlocal probe_calls
+        probe_calls += 1
+        selected_agent = selected_agents[0]
+        if probe_calls <= 2:
+            route = {
+                "agent_id": selected_agent.id,
+                "provider": "bytez",
+                "model": selected_agent.model,
+                "status": "rejected",
+                "error_type": "HTTPError",
+                "http_status": 429,
+            }
+        else:
+            route = {
+                "agent_id": selected_agent.id,
+                "provider": "bytez",
+                "model": selected_agent.model,
+                "status": "rejected",
+                "error_type": "escalation_budget_exhausted",
+            }
+        report = {
+            "routes": [route],
+            "escalations_used": launcher.REVIEW_PREFLIGHT_MAX_ESCALATIONS,
+        }
+        raise launcher.ReviewPreflightError("unavailable", report)
+
+    monkeypatch.setattr(launcher, "_preflight_review_agents", deterministic_probe)
+
+    with pytest.raises(launcher.ReviewPreflightError) as error_result:
+        launcher._preflight_review_agents_concurrently(agents, client=object())
+
+    postponed_route = error_result.value.report["routes"][2]
+    assert postponed_route["error_type"] == "escalation_reserved_for_first_pass"
diff --git a/tests/test_contextual_orchestrator_review_policy.py b/tests/test_contextual_orchestrator_review_policy.py
index e13e94107e..b38449c9cf 100644
--- a/tests/test_contextual_orchestrator_review_policy.py
+++ b/tests/test_contextual_orchestrator_review_policy.py
@@ -237,6 +237,52 @@ def test_route_key_prefixes_provider() -> None:
     assert policy._route_key("nvidia_nim", "/leda/nemotron") == "nvidia_nim/leda/nemotron"
 
 
+def test_discovery_modalities_survive_into_catalog_tags() -> None:
+    """Explicit input evidence survives parse and the actual catalog consumer."""
+    report = _report()
+    report["models"][0]["input_modalities"] = [" TEXT ", "Image", "text"]
+    rows = policy.parse_discovery_report(report)
+    assert rows[0].get("input_modalities") == ["text", "image"]
+    result = policy.build_zdr_prioritized_catalog(rows, zdr_endpoints=ZDR_FEED)
+    agent = next(item for item in result["agents"] if item["model"] == rows[0]["model"])
+    assert [tag for tag in agent["tags"] if tag.startswith("input:")] == [
+        "input:text", "input:image"
+    ]
+    assert "cost:free" in agent["tags"] and "zdr" in agent["tags"]
+
+
+@pytest.mark.parametrize("value", ["text", {"text": True}, [False], ["text", 1],
+                                   [""], ["image extra"], ["../image"], ["追加"]])
+def test_catalog_rejects_malformed_input_evidence(value: object) -> None:
+    """Direct normalized-row consumers cannot inject or lose modality tags."""
+    rows = policy.parse_discovery_report(_report())
+    rows[0]["input_modalities"] = value
+    with pytest.raises(policy.PolicyError, match="input_modalities"):
+        policy.build_zdr_prioritized_catalog(rows, zdr_endpoints=ZDR_FEED)
+
+
+@pytest.mark.parametrize("value, expected", [
+    (None, []), ([], []),
+    ((" TEXT ", "image", "text", "audio_2", "video-1"),
+     ["text", "image", "audio_2", "video-1"]),
+])
+def test_modality_normalization_preserves_only_explicit_evidence(
+    value: object, expected: list[str]
+) -> None:
+    """Absent modalities are not guessed; tokens retain order without duplicates."""
+    assert policy.normalize_input_modalities(value) == expected
+
+
+@pytest.mark.parametrize("value", ["text", {"text": True}, [False], ["text", 1],
+                                   [""], ["image extra"], ["../image"], ["追加"]])
+def test_discovery_rejects_malformed_input_evidence(value: object) -> None:
+    """Malformed discovery evidence is rejected before catalog construction."""
+    report = _report()
+    report["models"][0]["input_modalities"] = value
+    with pytest.raises(policy.PolicyError, match="input_modalities"):
+        policy.parse_discovery_report(report)
+
+
 def test_parse_discovery_report_normalizes_rows() -> None:
     """Base URL, credential, and auth scheme fall back to the policy table."""
     rows = policy.parse_discovery_report(_report())
diff --git a/tests/test_contextual_orchestrator_review_sidecar_contract.py b/tests/test_contextual_orchestrator_review_sidecar_contract.py
index 16b85c5c78..48e597fc83 100644
--- a/tests/test_contextual_orchestrator_review_sidecar_contract.py
+++ b/tests/test_contextual_orchestrator_review_sidecar_contract.py
@@ -41,6 +41,7 @@
 )
 
 GATEWAY_MODEL = "contextual-orchestrator/orchestrator/free"
+AUTO_REVIEW_MODEL = "contextual-orchestrator/orchestrator/auto"
 ORCH_PIN_SHA = "01bf92a3ec67a0e1f9b68978eb16b60301e985fd"
 
 
@@ -93,47 +94,23 @@ def test_sidecar_feeds_discovery_and_policy_artifacts_to_the_launcher() -> None:
     assert "https://openrouter.ai/api/v1/endpoints/zdr" in text
 
 
-def test_sidecar_pins_the_pool_to_free_for_github_actions() -> None:
-    """GitHub Actions Workflow usage of contextual-orchestrator is pinned free.
-
-    ``auto`` was removed from the sidecar's own accepted
-    ``CONTEXTUAL_ORCHESTRATOR_POOL`` values: the org has not solved cost-safe
-    free+ZDR routing well enough yet to justify a priced-inclusive pool in
-    central CI. The launcher's own ``--pool`` flag (a general-purpose CLI
-    also used outside GitHub Actions, asserted separately above) still
-    accepts ``auto`` -- only this repo's GitHub-Actions-facing sidecar script
-    is narrowed.
-    """
+def test_sidecar_accepts_auto_with_explicit_zero_cost_ceiling() -> None:
+    """Auto alias changes selection, not authorization for paid fallback."""
     text = _read(SIDECAR)
-    assert 'orchestrator_pool="${CONTEXTUAL_ORCHESTRATOR_POOL:-free}"' in text
-    assert 'case "$orchestrator_pool" in\n  free)' in text
-    assert "fail \"CONTEXTUAL_ORCHESTRATOR_POOL must be free\"" in text
-    assert "free|auto" not in text
-    assert "must be free or auto" not in text
-
-    pool_case = text.split('orchestrator_pool="${CONTEXTUAL_ORCHESTRATOR_POOL:-free}"', 1)[
-        1
-    ].split("esac", 1)[0]
-    for candidate, should_fail in (("free", False), ("auto", True), ("", False), ("bogus", True)):
+    prefix = 'orchestrator_pool="${CONTEXTUAL_ORCHESTRATOR_POOL:-free}"'
+    pool_case = text[text.index(prefix):].split("esac", 1)[0] + "esac"
+    for candidate, expected in (("free", 0), ("auto", 0), ("", 0), ("bogus", 7)):
         result = subprocess.run(
-            [
-                "bash",
-                "-c",
-                'fail() { echo "FAIL: $*"; exit 7; }\n'
-                f'CONTEXTUAL_ORCHESTRATOR_POOL="{candidate}"\n'
-                'orchestrator_pool="${CONTEXTUAL_ORCHESTRATOR_POOL:-free}"\n'
-                + pool_case
-                + "esac\necho \"pool_args=${pool_args[*]}\"",
-            ],
-            capture_output=True,
-            text=True,
+            ["bash", "-c", 'fail() { exit 7; }; ' + pool_case +
+             '\nprintf "%s\\n" "${pool_args[@]}"'],
+            env={"CONTEXTUAL_ORCHESTRATOR_POOL": candidate},
+            capture_output=True, text=True, timeout=5,
         )
-        if should_fail:
-            assert result.returncode == 7, (candidate, result.stdout, result.stderr)
-            assert "must be free" in result.stdout
-        else:
-            assert result.returncode == 0, (candidate, result.stdout, result.stderr)
-            assert "pool_args=--pool free" in result.stdout
+        assert result.returncode == expected, (candidate, result.stdout, result.stderr)
+        if candidate == "auto":
+            assert result.stdout.splitlines() == ["--pool", "auto", "--zero-cost-only"]
+        elif expected == 0:
+            assert result.stdout.splitlines() == ["--pool", "free"]
 
 
 def test_sidecar_exports_gateway_env_for_review_steps() -> None:
@@ -389,10 +366,10 @@ def test_launcher_sets_a_bounded_review_request_body_limit() -> None:
 
 
 def test_strix_gateway_uses_provider_neutral_reasoning_effort() -> None:
-    """Gateway free-pool scans must not force unsupported provider controls."""
+    """Gateway auto-pool scans must not force unsupported provider controls."""
     text = _read(STRIX_WORKFLOW)
     assert "STRIX_REASONING_EFFORT: none" in text
-    assert "CONTEXTUAL_ORCHESTRATOR_POOL: free" in text
+    assert "CONTEXTUAL_ORCHESTRATOR_POOL: auto" in text
 
 
 def test_sidecar_probes_the_pinned_server_body_limit_at_http_boundary() -> None:
@@ -439,14 +416,14 @@ def test_autofix_workflow_provisions_sidecar_with_all_five_secrets() -> None:
 
 
 def test_opencode_config_defaults_to_the_contextual_gateway() -> None:
-    """OpenCode's default review route is orchestrator/free through the gateway."""
+    """OpenCode's default review route is orchestrator/auto through the gateway."""
     config = _read(OPENCODE_CONFIG)
-    assert f'"model": "{GATEWAY_MODEL}"' in config
-    assert f'"small_model": "{GATEWAY_MODEL}"' in config
+    assert f'"model": "{AUTO_REVIEW_MODEL}"' in config
+    assert f'"small_model": "{AUTO_REVIEW_MODEL}"' in config
     assert '"enabled_providers": ["contextual-orchestrator"' in config
     assert '"baseURL": "{env:CONTEXTUAL_ORCHESTRATOR_BASE_URL}/v1"' in config
     assert '"apiKey": "{env:CONTEXTUAL_ORCHESTRATOR_TOKEN}"' in config
-    assert '"orchestrator/free": {' in config
+    assert '"orchestrator/auto": {' in config
 
 
 def test_sidecar_trap_keeps_the_gateway_alive_after_provisioning() -> None:
@@ -532,7 +509,7 @@ def test_noema_review_workflow_provisions_sidecar_with_all_five_secrets() -> Non
     assert "contextual_orchestrator_review_sidecar.sh" in workflow
     for secret in FIVE_SECRETS:
         assert f"{secret}: ${{{{ secrets.{secret} }}}}" in workflow
-    assert 'export NOEMA_LLM_MODEL="orchestrator/free"' in workflow
+    assert 'export NOEMA_LLM_MODEL="orchestrator/auto"' in workflow
     assert "NOEMA_LLM_VIA_ORCHESTRATOR=1" in workflow
     assert "${CONTEXTUAL_ORCHESTRATOR_BASE_URL%/}/v1/chat/completions" in workflow
     assert "${CONTEXTUAL_ORCHESTRATOR_TOKEN}" in workflow
@@ -540,7 +517,7 @@ def test_noema_review_workflow_provisions_sidecar_with_all_five_secrets() -> Non
     assert "nvidia/nemotron-3-ultra-550b-a55b" not in workflow
     assert "COPILOT_GITHUB_TOKEN" not in workflow
     assert "secrets: inherit" not in workflow
-    assert "NOEMA_REVIEW_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN }}" in workflow
+    assert "NOEMA_REVIEW_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || '' }}" in workflow
 
 
 def test_noema_private_targets_require_zdr_only_sidecar_routing() -> None:
@@ -565,10 +542,10 @@ def test_required_opencode_dispatch_uses_the_gateway_for_model_pool_and_diagnosi
     assert workflow.index("Validate pull request head repository trust") < workflow.index(
         "Provision contextual-orchestrator review sidecar"
     )
-    assert 'OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/free"' in workflow
-    assert 'MODEL: contextual-orchestrator/orchestrator/free' in workflow
+    assert 'OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/auto"' in workflow
+    assert 'MODEL: contextual-orchestrator/orchestrator/auto' in workflow
     assert '.enabled_providers = ["contextual-orchestrator"]' in workflow
-    assert '.model = "contextual-orchestrator/orchestrator/free"' in workflow
+    assert '.model = "contextual-orchestrator/orchestrator/auto"' in workflow
     assert 'CONTEXTUAL_ORCHESTRATOR_TOKEN:-' in workflow
     assert 'STRIX_GITHUB_MODELS_TOKEN:-' not in workflow
     assert 'MODEL: github-models/' not in workflow
@@ -579,7 +556,7 @@ def test_required_strix_uses_the_gateway_and_zdr_visibility_contract() -> None:
     workflow = _read(STRIX_WORKFLOW)
     assert "Provision contextual-orchestrator Strix sidecar" in workflow
     assert "CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR" in workflow
-    assert 'STRIX_MODEL: contextual-orchestrator/orchestrator/free' in workflow
+    assert 'STRIX_MODEL: auto' in workflow
     assert "provider_mode=contextual_orchestrator" in workflow
     assert "STRIX_LLM_DEFAULT_PROVIDER: contextual_orchestrator" in workflow
     assert workflow.index("Resolve target repository visibility") < workflow.index(
@@ -647,7 +624,7 @@ def test_sidecar_rebuilds_a_damaged_persistent_venv(tmp_path) -> None:
     re-running ``venv`` over a damaged ``pip`` package leaves it unimportable.
     """
     text = _read(SIDECAR)
-    line = next(l for l in text.splitlines() if '-m venv --clear "$ORCHESTRATOR_WORK/.venv"' in l)
+    line = next(candidate for candidate in text.splitlines() if '-m venv --clear "$ORCHESTRATOR_WORK/.venv"' in candidate)
     work = tmp_path / "work"
     site = work / ".venv" / "lib" / f"python{sys.version_info[0]}.{sys.version_info[1]}" / "site-packages"
     env = {"PATH": os.environ["PATH"], "ORCHESTRATOR_WORK": str(work),
diff --git a/tests/test_coverage_configuration.py b/tests/test_coverage_configuration.py
new file mode 100644
index 0000000000..168dbc56d3
--- /dev/null
+++ b/tests/test_coverage_configuration.py
@@ -0,0 +1,30 @@
+"""Contracts for the repository-wide production coverage boundary."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+if sys.version_info >= (3, 11):
+    import tomllib
+else:  # pragma: no cover - exercised by the Python 3.10 CI lane
+    import tomli as tomllib
+
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+ALLOWED_COVERAGE_OMISSIONS = {
+    "tests/*",
+}
+
+
+def test_production_coverage_omissions_are_explicitly_allowlisted() -> None:
+    """Reject production exclusions that manufacture a 100% coverage result."""
+
+    with (REPOSITORY_ROOT / "pyproject.toml").open("rb") as config_file:
+        project_configuration = tomllib.load(config_file)
+
+    configured_omissions = set(
+        project_configuration["tool"]["coverage"]["run"]["omit"]
+    )
+
+    assert configured_omissions == ALLOWED_COVERAGE_OMISSIONS
diff --git a/tests/test_dependency_review_bundled_scan_identity_contract.py b/tests/test_dependency_review_bundled_scan_identity_contract.py
new file mode 100644
index 0000000000..cee8d44374
--- /dev/null
+++ b/tests/test_dependency_review_bundled_scan_identity_contract.py
@@ -0,0 +1,46 @@
+"""Regression contract for the bundled Security Scan Dependency Review preflight."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+_WORKFLOW = Path(".github/workflows/security-scan.yml")
+
+
+def _workflow_text() -> str:
+    """Return the bundled Security Scan workflow as UTF-8 text."""
+    return _WORKFLOW.read_text(encoding="utf-8")
+
+
+def test_bundled_scan_requires_exact_git_object_ids_before_transport() -> None:
+    """Named or malformed base/head revisions must fail before compare transport."""
+    workflow = _workflow_text()
+    assert "git_object_id='^[0-9a-f]{40}([0-9a-f]{24})?$'" in workflow
+    assert 'if ! [[ "${BASE_SHA}" =~ $git_object_id ]]' in workflow
+    assert '! [[ "${HEAD_SHA}" =~ $git_object_id ]]' in workflow
+    assert "exact 40- or 64-character hexadecimal base and head revisions" in workflow
+    assert "Named refs are not evidence" in workflow
+
+
+def test_bundled_scan_requires_one_non_dot_owner_name_identity() -> None:
+    """Repository identity validation keeps .github legal but rejects path sentinels."""
+    workflow = _workflow_text()
+    assert "repository_identity='^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'" in workflow
+    assert 'if ! [[ "${REPOSITORY}" =~ $repository_identity ]]' in workflow
+    assert 'repository_owner="${REPOSITORY%%/*}"' in workflow
+    assert 'repository_name="${REPOSITORY#*/}"' in workflow
+    assert '[ "${repository_owner}" = "." ]' in workflow
+    assert '[ "${repository_owner}" = ".." ]' in workflow
+    assert '[ "${repository_name}" = "." ]' in workflow
+    assert '[ "${repository_name}" = ".." ]' in workflow
+
+
+def test_bundled_scan_uses_job_token_and_fails_closed_on_non_200() -> None:
+    """Only an authenticated successful exact comparison may admit Dependency Review."""
+    workflow = _workflow_text()
+    assert "GH_TOKEN: ${{ github.token }}" in workflow
+    assert '-H "Authorization: Bearer ${GH_TOKEN}"' in workflow
+    assert 'if [ "$curl_status" -ne 0 ] || [ "$http_status" != "200" ]; then' in workflow
+    assert 'echo "supported=true" >>"$GITHUB_OUTPUT"' in workflow
+    assert "actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294" in workflow
diff --git a/tests/test_dependency_review_merge_evidence_contract.py b/tests/test_dependency_review_merge_evidence_contract.py
new file mode 100644
index 0000000000..a0a8e97888
--- /dev/null
+++ b/tests/test_dependency_review_merge_evidence_contract.py
@@ -0,0 +1,111 @@
+"""Contracts for published dependency-review carryover evidence."""
+
+from __future__ import annotations
+
+from pathlib import Path
+import re
+import subprocess
+
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+CHANGELOG_PATH = REPOSITORY_ROOT / "CHANGELOG.md"
+GAP_BASELINE_PATH = REPOSITORY_ROOT / "docs/product-technical-gap-baseline.md"
+PUBLISHED_SECURITY_PARENT = "229027280e8bce6cc4f13e722b2b0c280a1ac17d"
+PUBLISHED_RUNNER_PARENT = "cd2c3f9748e6bc50efd8bdfee9a385a74ec6e3ba"
+MERGE_EVIDENCE_PATTERN = re.compile(
+    r"ordinary (?:two-parent )?merge\s+`([0-9a-f]{40})`"
+)
+
+
+def _dependency_review_evidence(document_text: str, record_marker: str) -> str:
+    """Return the bounded dependency-review evidence paragraph or table row."""
+    if record_marker.startswith("Dependency Review"):
+        section_start = document_text.index(f"### {record_marker}")
+        section_end = document_text.find("\n### ", section_start + 4)
+        evidence_section = document_text[
+            section_start : section_end if section_end >= 0 else None
+        ]
+        assert "#2565" in evidence_section
+        assert "ordinary" in evidence_section
+        assert "merge" in evidence_section
+        return evidence_section
+
+    evidence_blocks = [
+        block
+        for block in document_text.split("\n\n")
+        if record_marker in block
+        and "#2565" in block
+        and "ordinary" in block
+        and "merge" in block
+    ]
+    assert len(evidence_blocks) == 1, (
+        "#2565 must have one ordinary-merge evidence record"
+    )
+    return evidence_blocks[0]
+
+
+def _published_merge_sha(evidence_text: str) -> str:
+    """Extract the full published merge identifier from one evidence record."""
+    match = MERGE_EVIDENCE_PATTERN.search(evidence_text)
+    assert match is not None, "#2565 evidence must name a full ordinary-merge SHA"
+    return match.group(1)
+
+
+def _git_output(*arguments: str) -> subprocess.CompletedProcess[str]:
+    """Run one read-only Git evidence query from the repository root."""
+    return subprocess.run(
+        ["git", *arguments],
+        cwd=REPOSITORY_ROOT,
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+
+def test_dependency_review_receipts_bind_published_two_parent_merge() -> None:
+    """Both owner receipts must name the same reachable two-parent merge."""
+    changelog = CHANGELOG_PATH.read_text(encoding="utf-8")
+    baseline = GAP_BASELINE_PATH.read_text(encoding="utf-8")
+    changelog_evidence = _dependency_review_evidence(
+        changelog, "Dependency Review requires a completed authenticated comparison"
+    )
+    baseline_evidence = _dependency_review_evidence(
+        baseline, "CONTROL-DEPENDENCY-REVIEW-TRANSPORT-EXIT-01"
+    )
+
+    changelog_sha = _published_merge_sha(changelog_evidence)
+    baseline_sha = _published_merge_sha(baseline_evidence)
+    assert changelog_sha == baseline_sha
+
+    resolvable = _git_output("cat-file", "-e", f"{changelog_sha}^{{commit}}")
+    assert resolvable.returncode == 0, (
+        f"#2565 evidence {changelog_sha} is not a published commit"
+    )
+
+    ancestor = _git_output("merge-base", "--is-ancestor", changelog_sha, "HEAD")
+    assert ancestor.returncode == 0, (
+        f"#2565 evidence {changelog_sha} is not in current HEAD ancestry"
+    )
+
+    parents = _git_output("show", "-s", "--format=%P", changelog_sha)
+    assert parents.returncode == 0
+    assert parents.stdout.strip().split() == [
+        PUBLISHED_RUNNER_PARENT,
+        PUBLISHED_SECURITY_PARENT,
+    ]
+
+
+def test_dependency_review_receipts_bind_current_exact_tree_counts() -> None:
+    """Both owner receipts must retain the exact merged-tree test counts."""
+    changelog_evidence = _dependency_review_evidence(
+        CHANGELOG_PATH.read_text(encoding="utf-8"),
+        "Dependency Review requires a completed authenticated comparison",
+    )
+    baseline_evidence = _dependency_review_evidence(
+        GAP_BASELINE_PATH.read_text(encoding="utf-8"),
+        "CONTROL-DEPENDENCY-REVIEW-TRANSPORT-EXIT-01",
+    )
+
+    for evidence_text in (changelog_evidence, baseline_evidence):
+        assert "53/53" in evidence_text
+        assert "5,437 passed, 10 skipped, 40 subtests" in evidence_text
diff --git a/tests/test_dependency_review_reusable_workflow_contract.py b/tests/test_dependency_review_reusable_workflow_contract.py
index cadefcb8ac..93ac57f200 100644
--- a/tests/test_dependency_review_reusable_workflow_contract.py
+++ b/tests/test_dependency_review_reusable_workflow_contract.py
@@ -1,6 +1,6 @@
 """Contract for the reusable Dependency Review workflow.
 
-Replaces argos's, mightyETL's, newsdom-api's, and scopeweave's
+Replaces Argos's, mightyETL's, naruon's, newsdom-api's, and scopeweave's
 independently hand-written ``dependency-review.yml`` files with one reusable
 ``workflow_call`` workflow, ``.github/workflows/dependency-review.yml``, plus
 a thin caller left in each product repository. See
@@ -11,6 +11,9 @@
 
 from __future__ import annotations
 
+import os
+import subprocess
+import textwrap
 from pathlib import Path
 
 _WORKFLOW = Path(".github/workflows/dependency-review.yml")
@@ -24,8 +27,75 @@ def _workflow_text() -> str:
     return _WORKFLOW.read_text(encoding="utf-8")
 
 
+def _availability_probe_script() -> str:
+    """Extract the dependency-graph preflight shell body for executable tests."""
+    workflow = _workflow_text()
+    step = "      - name: Check dependency graph availability\n"
+    start = workflow.index(step)
+    end = workflow.index("\n      - name:", start + len(step))
+    block = workflow[start:end]
+    run_marker = "        run: |\n"
+    run_start = block.index(run_marker) + len(run_marker)
+    script = textwrap.dedent(block[run_start:])
+    return script.replace('${{ github.event_name }}', "pull_request")
+
+
+def _run_availability_probe(
+    tmp_path: Path,
+    repository: str,
+    *,
+    base_sha: str = "a" * 40,
+    head_sha: str = "b" * 40,
+    http_status: str = "200",
+    curl_exit: int = 0,
+) -> tuple[subprocess.CompletedProcess[str], Path, Path]:
+    """Execute the real preflight shell against a marker-only fake curl."""
+    fake_bin = tmp_path / "bin"
+    fake_bin.mkdir()
+    curl_marker = tmp_path / "curl-called"
+    fake_curl = fake_bin / "curl"
+    fake_curl.write_text(
+        "#!/usr/bin/env bash\n"
+        "set -euo pipefail\n"
+        "authorized=false\n"
+        "for arg in \"$@\"; do\n"
+        "  if [[ \"$arg\" == Authorization:* ]]; then authorized=true; fi\n"
+        "done\n"
+        "printf '%s\\n' \"$authorized\" >>\"${CURL_MARKER}\"\n"
+        "printf '%s' \"${HTTP_STATUS:-200}\"\n"
+        "exit \"${CURL_EXIT:-0}\"\n",
+        encoding="utf-8",
+    )
+    fake_curl.chmod(0o755)
+    output = tmp_path / "github-output"
+    env = os.environ.copy()
+    env.update(
+        {
+            "PATH": f"{fake_bin}:{env.get('PATH', '')}",
+            "GH_TOKEN": "test-token",
+            "BASE_SHA": base_sha,
+            "HEAD_SHA": head_sha,
+            "REPOSITORY": repository,
+            "GITHUB_API_URL": "https://api.github.invalid",
+            "GITHUB_OUTPUT": str(output),
+            "CURL_MARKER": str(curl_marker),
+            "HTTP_STATUS": http_status,
+            "CURL_EXIT": str(curl_exit),
+        }
+    )
+    result = subprocess.run(
+        ["bash", "-c", _availability_probe_script()],
+        cwd=Path.cwd(),
+        env=env,
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+    return result, curl_marker, output
+
+
 def test_declares_workflow_call_with_four_inputs_and_recorded_defaults() -> None:
-    """Every genuinely-varying field found while auditing the five originals is an input."""
+    """Every genuinely varying field found while auditing the five originals is an input."""
     workflow = _workflow_text()
     assert "on:\n  workflow_call:\n    inputs:" in workflow
     for name in (
@@ -42,33 +112,35 @@ def test_declares_workflow_call_with_four_inputs_and_recorded_defaults() -> None
     assert 'default: "on-failure"' in workflow
 
 
-def test_step_order_is_harden_then_checkout_then_preflight_then_gated_steps() -> None:
-    """harden-runner -> checkout -> dependency-graph preflight -> conditional gate/note."""
+def test_step_order_is_harden_then_checkout_then_preflight_then_dependency_review() -> None:
+    """Runner hardening, checkout, capability proof, then the gated action stay ordered."""
     workflow = _workflow_text()
     order = [
         "Harden the runner",
         "actions/checkout@",
         "Check dependency graph availability",
         "Dependency review",
-        "Dependency graph unavailable note",
     ]
     positions = [workflow.index(marker) for marker in order]
     assert positions == sorted(positions), "steps are out of order"
 
 
-def test_dependency_review_and_note_steps_are_mutually_exclusive_on_availability() -> None:
-    """The gate and the fallback note must never both run."""
+def test_dependency_review_runs_only_after_a_confirmed_successful_comparison() -> None:
+    """The action must execute only after the compare endpoint returned HTTP 200."""
     workflow = _workflow_text()
     assert (
         "if: steps.dependency_graph.outputs.available == 'true'\n"
         "        continue-on-error: ${{ inputs.continue_on_error }}"
         in workflow
     )
-    assert "if: steps.dependency_graph.outputs.available != 'true'" in workflow
+    assert (
+        'if [ "$curl_exit" -eq 0 ] && [ "$status" = "200" ]; then' in workflow
+    )
+    assert 'echo "available=true" >>"$GITHUB_OUTPUT"' in workflow
 
 
 def test_inputs_are_forwarded_to_the_dependency_review_action() -> None:
-    """fail_on_severity, allow_ghsas, and comment_summary_in_pr must reach the action untouched."""
+    """Every caller-varying action input must reach the pinned action untouched."""
     workflow = _workflow_text()
     assert "fail-on-severity: ${{ inputs.fail_on_severity }}" in workflow
     assert "allow-ghsas: ${{ inputs.allow_ghsas }}" in workflow
@@ -76,67 +148,142 @@ def test_inputs_are_forwarded_to_the_dependency_review_action() -> None:
 
 
 def test_harden_runner_audits_egress() -> None:
-    """naruon's harden-runner step applies uniformly, not only to that one caller."""
+    """naruon's harden-runner control applies uniformly in the reusable owner."""
     workflow = _workflow_text()
     assert "step-security/harden-runner@" in workflow
     assert "egress-policy: audit" in workflow
 
 
 def test_action_pins_are_current_and_uniform() -> None:
-    """checkout and dependency-review-action share one current pin, not per-caller drift."""
+    """Checkout and Dependency Review use one immutable current pin."""
     workflow = _workflow_text()
     assert f"actions/checkout@{_CHECKOUT_PIN}" in workflow
-    assert (
-        f"actions/dependency-review-action@{_DEPENDENCY_REVIEW_PIN}" in workflow
-    )
+    assert f"actions/dependency-review-action@{_DEPENDENCY_REVIEW_PIN}" in workflow
 
 
 def test_uniform_fields_are_hardcoded_not_parameterized() -> None:
-    """Fields byte-identical across all four originals stay static, not inputs."""
+    """Uniform least-privilege and checkout controls stay static."""
     workflow = _workflow_text()
     assert "permissions:\n  contents: read\n  pull-requests: read" in workflow
     assert "persist-credentials: false" in workflow
 
 
+def test_example_caller_preserves_required_permission_envelope() -> None:
+    """Thin callers must explicitly pass the reusable job's read permission ceiling."""
+    workflow = _workflow_text()
+    assert (
+        "#   permissions:\n"
+        "#     contents: read\n"
+        "#     pull-requests: read\n"
+        "#   concurrency:"
+        in workflow
+    )
+
+
+def test_example_caller_requires_immutable_protected_main_pin() -> None:
+    """The canonical example must never teach consumers to execute a mutable owner ref."""
+    workflow = _workflow_text()
+    assert "@<protected-main-commit-sha>" in workflow
+    assert "uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@main" not in workflow
+
+
 def test_forces_node24_runtime_for_js_actions() -> None:
-    """newsdom-api's Node24 opt-in applies uniformly, not only to that one caller."""
+    """newsdom-api's Node24 opt-in applies uniformly, not only to one caller."""
     workflow = _workflow_text()
     assert "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true" in workflow
 
 
 def test_availability_check_uses_the_dependency_graph_compare_api() -> None:
-    """The preflight must query the real capability, not infer from repository visibility."""
+    """The preflight must query the real capability, not infer from visibility."""
     workflow = _workflow_text()
     assert "dependency-graph/compare" in workflow
     assert "github.event.repository.private" not in workflow
+    assert '-H "Authorization: Bearer ${GH_TOKEN}"' in workflow
 
 
-def test_availability_check_distinguishes_unavailable_from_genuine_failure() -> None:
-    """403/404 means 'unavailable, skip gracefully'; any other status must hard-fail
-    the job instead of silently treating a real error the same as unavailability."""
+def test_pull_request_http_403_and_404_are_not_normalized_to_unavailable() -> None:
+    """Authorization-shaped HTTP responses are ambiguous and must remain blocking."""
     workflow = _workflow_text()
-    assert 'if [ "$status" = "403" ] || [ "$status" = "404" ]' in workflow
-    assert "available=false" in workflow
-    assert "::error::Dependency graph availability check failed with HTTP" in workflow
+    assert 'if [ "$status" = "403" ] || [ "$status" = "404" ]' not in workflow
+    assert "skipping the dependency-review hard gate" not in workflow
+    assert "Dependency graph unavailable note" not in workflow
+    assert "::error::Dependency graph comparison failed with curl exit" in workflow
     assert "exit 1" in workflow
 
 
 def test_availability_check_only_runs_the_gate_for_pull_request_events() -> None:
-    """A non-pull_request trigger (e.g. workflow_dispatch) must skip the gate, not error,
-    since base/head SHAs only exist on a pull_request event."""
+    """A non-pull_request trigger may skip because it has no PR base/head identity."""
     workflow = _workflow_text()
     assert '"${{ github.event_name }}" != "pull_request"' in workflow
 
 
+def test_preflight_rejects_named_revisions_before_transport(tmp_path: Path) -> None:
+    """Named or malformed revisions never reach the dependency-graph endpoint."""
+    for index, (base_sha, head_sha) in enumerate(
+        (("main", "b" * 40), ("a" * 40, "develop"), ("a" * 39, "b" * 40))
+    ):
+        case_dir = tmp_path / f"revision-{index}"
+        case_dir.mkdir()
+        result, curl_marker, _output = _run_availability_probe(
+            case_dir,
+            "ContextualWisdomLab/Orgmetra",
+            base_sha=base_sha,
+            head_sha=head_sha,
+        )
+        assert result.returncode != 0, (base_sha, head_sha)
+        assert not curl_marker.exists(), (base_sha, head_sha)
+        assert "exact 40- or 64-character hexadecimal" in result.stdout.lower()
+
+
+def test_preflight_rejects_malformed_repository_before_transport(tmp_path: Path) -> None:
+    """Only one non-dot owner/name repository identity may reach transport."""
+    repositories = (
+        "ContextualWisdomLab",
+        "ContextualWisdomLab/Orgmetra/extra",
+        "/Orgmetra",
+        "../.github",
+        "ContextualWisdomLab/..",
+        "ContextualWisdomLab/.",
+        "./.github",
+    )
+    for index, repository in enumerate(repositories):
+        case_dir = tmp_path / f"repository-{index}"
+        case_dir.mkdir()
+        result, curl_marker, _output = _run_availability_probe(case_dir, repository)
+        assert result.returncode != 0, repository
+        assert not curl_marker.exists(), repository
+        assert "repository identity" in result.stdout.lower(), repository
+
+
+def test_preflight_accepts_dotgithub_and_uses_job_token(tmp_path: Path) -> None:
+    """The legitimate .github repository reaches exactly one authenticated compare."""
+    result, curl_marker, output = _run_availability_probe(
+        tmp_path, "ContextualWisdomLab/.github"
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert curl_marker.read_text(encoding="utf-8") == "true\n"
+    assert output.read_text(encoding="utf-8") == "available=true\n"
+
+
+def test_preflight_rejects_http_200_when_curl_transport_fails(tmp_path: Path) -> None:
+    """Partial transport failure cannot authorize an incomplete HTTP 200 compare."""
+    result, curl_marker, output = _run_availability_probe(
+        tmp_path,
+        "ContextualWisdomLab/.github",
+        http_status="200",
+        curl_exit=18,
+    )
+
+    assert result.returncode != 0, result.stdout + result.stderr
+    assert curl_marker.read_text(encoding="utf-8") == "true\n"
+    assert not output.exists() or "available=true" not in output.read_text(
+        encoding="utf-8"
+    )
+
+
 def test_dependency_review_comment_summary_defaults_to_on_failure() -> None:
-    """scopeweave's PR-comment-on-failure UX applies uniformly by default, overridable per caller.
-
-    naruon explicitly overrides it to "never" -- see
-    test_declares_workflow_call_with_four_inputs_and_recorded_defaults for
-    the default assertion and test_inputs_are_forwarded_to_the_dependency_review_action
-    for the forwarding assertion; this test just pins the specific default
-    value chosen (scopeweave's original, not naruon's or some other value).
-    """
+    """The shared UX defaults to on-failure while remaining caller-overridable."""
     workflow = _workflow_text()
-    assert 'comment_summary_in_pr:\n' in workflow
+    assert "comment_summary_in_pr:" in workflow
     assert 'default: "on-failure"' in workflow
+    assert "comment-summary-in-pr: ${{ inputs.comment_summary_in_pr }}" in workflow
diff --git a/tests/test_docs_only_pr_runner_admission.py b/tests/test_docs_only_pr_runner_admission.py
index a0f691e2a2..f5ece19be5 100644
--- a/tests/test_docs_only_pr_runner_admission.py
+++ b/tests/test_docs_only_pr_runner_admission.py
@@ -18,7 +18,7 @@
 
 See also `tests/test_required_security_runner_image_contract.py` and
 `tests/test_required_review_runner_image_contract.py`, which pin the
-`runs-on: ubuntu-24.04` counts these gate jobs add.
+`CWL CI isolated` group and isolation-label counts these gate jobs add.
 """
 
 from __future__ import annotations
@@ -93,7 +93,8 @@ def test_gate_job_is_byte_identical_across_the_five_workflows_apart_from_if():
         workflow = _read(filename)
         block = _top_level_job_block(workflow, "changed-scope")
         normalized = "\n".join(
-            line for line in block.splitlines() if not line.strip().startswith(("if:", "runs-on:"))
+            line for line in block.splitlines()
+            if not line.strip().startswith(("if:", "runs-on:", "group:", "labels:"))
         )
         normalized_blocks.add(normalized)
     assert len(normalized_blocks) == 1, (
@@ -135,12 +136,13 @@ def test_gate_jobs_use_supported_runner_allocation():
         if filename in ("opencode-review.yml", "strix.yml"):
             assert '"group":"CWL central control"' in block, filename
             assert f"github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/{filename}@refs/heads/main'" in block, filename
-            assert "fromJSON('[\"ubuntu-24.04\"]')" in block, filename
+            assert 'fromJSON(\'{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}\')' in block, filename
         elif filename == "noema-review.yml":
             assert "endsWith(github.workflow_ref, '@refs/heads/main')" in block, filename
-            assert "fromJSON('[\"ubuntu-24.04\"]')" in block, filename
+            assert 'fromJSON(\'{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}\')' in block, filename
         else:
-            assert "runs-on: ubuntu-24.04" in block, filename
+            assert "group: CWL CI isolated" in block, filename
+            assert "labels: [self-hosted, linux, x64, cwlab-ci-isolated]" in block, filename
         assert "runs-on: ubuntu-latest" not in block, filename
 
 
@@ -250,7 +252,8 @@ def test_sast_semgrep_folds_the_gate_into_its_single_consumer_at_step_level():
     assert "changed-scope:" not in workflow
     assert "needs: changed-scope" not in workflow
     assert "needs.changed-scope" not in workflow
-    assert workflow.count("runs-on: ubuntu-24.04") == 1
+    assert workflow.count("group: CWL CI isolated") == 1
+    assert workflow.count("labels: [self-hosted, linux, x64, cwlab-ci-isolated]") == 1
 
     semgrep = _top_level_job_block(workflow, "semgrep")
     assert not re.search(r"(?m)^    needs:", semgrep)
diff --git a/tests/test_exact_artifact_quality_single_runner.py b/tests/test_exact_artifact_quality_single_runner.py
index 9378e2232c..61a8507675 100644
--- a/tests/test_exact_artifact_quality_single_runner.py
+++ b/tests/test_exact_artifact_quality_single_runner.py
@@ -93,6 +93,39 @@ def test_successor_keeps_exact_head_hash_lock_and_read_only_permissions() -> Non
     assert "requirements-opencode-review-ci-hashes.txt" in workflow
 
 
+def _exact_artifact_steps(workflow: str) -> str:
+    """Select only steps guarded by the exact-artifact suite output."""
+    return "\n".join(
+        step
+        for step in workflow.split("      - name:")[1:]
+        if "if: steps.affected_suites.outputs.exact_artifact == 'true'" in step
+    )
+
+
+def test_exact_artifact_step_scope_excludes_unrelated_compile() -> None:
+    """An adjacent suite cannot inflate the exact-artifact compiler count."""
+    workflow = _workflow_text()
+    scoped = _exact_artifact_steps(workflow)
+    unrelated = (
+        "\n      - name: Unrelated syntax control\n"
+        "        if: steps.affected_suites.outputs.ghas == 'true'\n"
+        "        run: python -m compileall -q unrelated_control.py\n"
+    )
+    assert _exact_artifact_steps(workflow + unrelated) == scoped
+    assert scoped.count("compileall -q") == 2
+    assert "tests/test_codeql_ghas_analyses_pagination.py" not in scoped
+    # Removing a compiler in the actual guarded slice remains observable.
+    compile_step = "Compile exact-artifact production and contracts on Python 3.10"
+    start = workflow.index("      - name: " + compile_step)
+    stop = workflow.index("      - name:", start + 1)
+    mutated = (
+        workflow[:start]
+        + workflow[start:stop].replace("compileall -q", "missing_compile")
+        + workflow[stop:]
+    )
+    assert _exact_artifact_steps(mutated).count("compileall -q") == 1
+
+
 def test_successor_preserves_all_exact_artifact_contracts() -> None:
     """Retain every predecessor test, coverage, docstring, and syntax gate."""
 
@@ -110,11 +143,7 @@ def test_successor_preserves_all_exact_artifact_contracts() -> None:
     assert "coverage run --branch" in workflow
     assert "--fail-under=100" in workflow
     assert "interrogate --fail-under=100" in workflow
-    exact_artifact_steps = workflow[
-        workflow.index(
-            "- name: Set up minimum supported Python for exact-artifact contracts"
-        ) : workflow.index("- name: Verify consolidated workflow contract")
-    ]
+    exact_artifact_steps = _exact_artifact_steps(workflow)
     assert exact_artifact_steps.count("compileall -q") == 2
 
 
diff --git a/tests/test_exact_artifact_sbom_attestation_contract.py b/tests/test_exact_artifact_sbom_attestation_contract.py
index 0f9613a682..e745cd6dd4 100644
--- a/tests/test_exact_artifact_sbom_attestation_contract.py
+++ b/tests/test_exact_artifact_sbom_attestation_contract.py
@@ -245,10 +245,11 @@ def test_workflow_attests_each_exact_distribution_and_exports_offline_evidence()
 
 
 def test_quality_workflow_pins_supported_runner_images() -> None:
-    """Keep exact supply-chain evidence on an explicit runner image."""
+    """Keep exact supply-chain evidence on isolated self-hosted Linux."""
     workflow = _required_text(QUALITY_WORKFLOW, "attestation quality workflow")
     assert "ubuntu-latest" not in workflow
-    assert workflow.count("runs-on: ubuntu-24.04") == 1
+    assert workflow.count("group: CWL CI isolated") == 1
+    assert workflow.count("labels: [self-hosted, linux, x64, cwlab-ci-isolated]") == 1
 
 
 def test_doctoring_records_claim_boundary_recovery_and_primary_sources() -> None:
diff --git a/tests/test_github_api_url_boundary.py b/tests/test_github_api_url_boundary.py
index a9050584fd..1c856c3bfa 100644
--- a/tests/test_github_api_url_boundary.py
+++ b/tests/test_github_api_url_boundary.py
@@ -8,6 +8,7 @@
 import re
 import subprocess
 from typing import Any
+from urllib.error import HTTPError
 from urllib.request import Request
 from urllib.response import addinfourl
 
@@ -44,6 +45,7 @@ def __init__(self, target: str) -> None:
         """Store the redirect target and initialize the observed request ledger."""
         self.target = target
         self.calls: list[tuple[str, str | None]] = []
+        self.responses: list[Any] = []
 
     def https_open(self, request: Request) -> Any:
         """Return a synthetic redirect response without contacting a network target."""
@@ -52,6 +54,7 @@ def https_open(self, request: Request) -> Any:
         headers["Location"] = self.target
         response = addinfourl(BytesIO(b""), headers, request.full_url, code=302)
         response.msg = "Found"
+        self.responses.append(response)
         return response
 
 
@@ -71,6 +74,20 @@ def read(self) -> bytes:
         return b"[]"
 
 
+class _ReadSizeRecordingBody(BytesIO):
+    """Record the requested byte limit for one synthetic HTTP error body."""
+
+    def __init__(self, payload: bytes) -> None:
+        """Store the payload and initialize the read-size ledger."""
+        super().__init__(payload)
+        self.read_sizes: list[int] = []
+
+    def read(self, size: int = -1) -> bytes:
+        """Record the caller's bound before returning response bytes."""
+        self.read_sizes.append(size)
+        return super().read(size)
+
+
 def _unexpected_open(*_args: Any, **_kwargs: Any) -> Any:
     """Fail if a rejected authority reaches the network/file opener boundary."""
     pytest.fail("rejected GitHub API authority reached opener")
@@ -165,6 +182,8 @@ def test_production_openers_reject_redirect_without_forwarding_bearer(
     assert transport.calls == [
         (CANONICAL_GITHUB_API_URL, "Bearer test-token"),
     ]
+    assert len(transport.responses) == 1
+    assert transport.responses[0].closed
 
 
 @pytest.mark.parametrize("target", REDIRECT_TARGETS)
@@ -231,6 +250,37 @@ def strix_open(request: Any, **_kwargs: Any) -> _JsonResponse:
     assert strix_calls == [CANONICAL_GITHUB_API_URL]
 
 
+def test_codeql_identity_client_bounds_http_error_diagnostic_read(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A hostile GitHub error body cannot force an unbounded diagnostic read."""
+    body = _ReadSizeRecordingBody(b"x" * 8_192)
+    error = HTTPError(
+        CANONICAL_GITHUB_API_URL,
+        502,
+        "Bad Gateway",
+        Message(),
+        body,
+    )
+
+    def raise_http_error(*_args: Any, **_kwargs: Any) -> Any:
+        """Raise the synthetic response at the authenticated opener boundary."""
+        raise error
+
+    monkeypatch.setattr(identity._GITHUB_API_OPENER, "open", raise_http_error)
+
+    with pytest.raises(identity.ConfigurationIdentityError, match="HTTP 502"):
+        identity._request_json(
+            CANONICAL_GITHUB_API_URL,
+            token="test-token",
+            timeout_seconds=1,
+        )
+
+    assert body.read_sizes
+    assert all(0 < size <= 400 for size in body.read_sizes)
+    assert body.closed
+
+
 def test_documented_opener_lineage_references_published_commits() -> None:
     """Owner evidence must name the published commits that carry each repair."""
     doctoring = Path(
diff --git a/tests/test_kcsap_noema_app_identity.py b/tests/test_kcsap_noema_app_identity.py
new file mode 100644
index 0000000000..18537ee4d5
--- /dev/null
+++ b/tests/test_kcsap_noema_app_identity.py
@@ -0,0 +1,111 @@
+"""중앙 Noema의 k-csap native App 경로를 실제 shell로 검증한다."""
+
+import os
+import re
+import shutil
+import subprocess
+import tempfile
+import textwrap
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW = ROOT / ".github/workflows/noema-review.yml"
+TARGET = "ContextualWisdomLab/k-csap-skills"
+METADATA = "Select native Noema credential for metadata reads"
+REVIEWER = "Select fail-closed Noema reviewer credential"
+
+
+def job_text(job):
+    source = WORKFLOW.read_text()
+    return re.split(r"\n {2}(?=\S)", source.split(f"\n  {job}:\n", 1)[1], maxsplit=1)[0]
+
+
+def step_text(job, name):
+    body = job_text(job).split(f"      - name: {name}\n", 1)[1]
+    return body.split("\n      - name:", 1)[0]
+
+
+def run_selection(job, name, repository=TARGET, client="fixture-client", key="fixture-key", pat="fixture-pat", oidc="https://fixture.invalid/exchange"):
+    script = textwrap.dedent(step_text(job, name).split("        run: |\n", 1)[1])
+    with tempfile.TemporaryDirectory() as directory:
+        output = Path(directory) / "output"
+        result = subprocess.run(
+            [shutil.which("bash") or "/bin/bash"], input=script,
+            text=True, capture_output=True, timeout=10, check=False,
+            env={"PATH": os.defpath, "GITHUB_OUTPUT": str(output),
+                 "TARGET_REPOSITORY": repository, "PR_NUMBER": "269",
+                 "EXPECTED_HEAD_SHA": "a" * 40,
+                 "METADATA_TOKEN": pat, "NOEMA_REVIEW_TOKEN": pat,
+                 "NOEMA_GITHUB_APP_CLIENT_ID": client,
+                 "NOEMA_GITHUB_APP_PRIVATE_KEY": key, "TOKEN_EXCHANGE_URL": oidc},
+        )
+        values = dict(line.split("=", 1) for line in output.read_text().splitlines()) if output.exists() else {}
+    # 비밀값 대신 합성 placeholder만 사용하며 선택 단계의 누출도 거부한다.
+    for value in (client, key, pat, oidc):
+        if value:
+            assert value not in result.stdout + result.stderr
+    return result, values
+
+
+class KcsapNoemaAppIdentity(unittest.TestCase):
+    def test_metadata_requires_app_even_when_pat_and_oidc_exist(self):
+        for job in ("admit-current-head", "noema-review"):
+            for client, key in (("fixture-client", "fixture-key"), ("", "fixture-key"), ("fixture-client", ""), ("", "")):
+                with self.subTest(job=job, client_present=bool(client), key_present=bool(key)):
+                    result, values = run_selection(job, METADATA, client=client, key=key)
+                    if client and key:
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        self.assertEqual(values.get("source"), "github-app")
+                        self.assertEqual(values.get("repository"), "k-csap-skills")
+                    else:
+                        self.assertNotEqual(result.returncode, 0)
+                        self.assertNotIn("source", values)
+                        self.assertIn("::error::", result.stdout)
+
+    def test_kcsap_token_wiring_cannot_reenter_legacy_fallback(self):
+        metadata_legacy = "secrets.NOEMA_REVIEW_TOKEN || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.noema_metadata_app_token.outputs.token || github.token"
+        reviewer_legacy = "secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token"
+        publication_legacy = "steps.noema_credential.outputs.source == 'pat' && secrets.NOEMA_REVIEW_TOKEN || steps.noema_credential.outputs.source == 'github-app' && steps.noema_github_app_publication_token.outputs.token || steps.noema_credential.outputs.source == 'oidc' && steps.noema_oidc_token.outputs.token || ''"
+        cases = [
+            ("admit-current-head", "Admit only the exact live Noema head", "noema_metadata_app_token", metadata_legacy),
+            ("noema-review", "Reject a stale trigger before credential or model setup", "noema_metadata_app_token", metadata_legacy),
+            ("noema-review", "Validate current pull request head", "noema_github_app_token", reviewer_legacy),
+            ("noema-review", "Resolve Noema target repository visibility", "noema_github_app_token", reviewer_legacy),
+            ("noema-review", "Check live pull request draft state before sidecar provisioning", "noema_github_app_token", reviewer_legacy),
+            ("noema-review", "Prepare Noema model verdict", "noema_github_app_token", reviewer_legacy),
+            ("noema-review", "Publish prepared Noema verdict on the exact live head", "noema_github_app_publication_token", publication_legacy),
+        ]
+        for job, name, app_step, legacy in cases:
+            with self.subTest(step=name):
+                expression = re.search(r"GH_TOKEN: \$\{\{ (.*?) \}\}", step_text(job, name)).group(1)
+                expected = f"env.TARGET_REPOSITORY == '{TARGET}' && steps.{app_step}.outputs.token || (env.TARGET_REPOSITORY != '{TARGET}' && ({legacy})) || ''"
+                self.assertEqual(expression, expected)
+
+    def test_other_repositories_preserve_legacy_selection(self):
+        for repository in ("ContextualWisdomLab/example", TARGET + "-other"):
+            for job in ("admit-current-head", "noema-review"):
+                for client, key, pat, expected in (("fixture-client", "fixture-key", "fixture-pat", "pat"), ("fixture-client", "fixture-key", "", "github-app"), ("", "", "", "workflow")):
+                    with self.subTest(repository=repository, job=job, source=expected):
+                        result, values = run_selection(job, METADATA, repository=repository, client=client, key=key, pat=pat)
+                        self.assertEqual(result.returncode, 0)
+                        self.assertEqual(values.get("source"), expected)
+            for client, key, pat, oidc, expected in (("fixture-client", "fixture-key", "fixture-pat", "", "pat"), ("fixture-client", "fixture-key", "", "", "github-app"), ("", "", "", "https://fixture.invalid/exchange", "oidc")):
+                with self.subTest(repository=repository, source=expected):
+                    result, values = run_selection("noema-review", REVIEWER, repository=repository, client=client, key=key, pat=pat, oidc=oidc)
+                    self.assertEqual(result.returncode, 0)
+                    self.assertEqual(values.get("source"), expected)
+
+    def test_reviewer_requires_native_app_without_pat_or_oidc_fallback(self):
+        for client, key in (("fixture-client", "fixture-key"), ("", "fixture-key"), ("fixture-client", ""), ("", "")):
+            for pat, oidc in (("fixture-pat", "https://fixture.invalid/exchange"), ("", "https://fixture.invalid/exchange"), ("", "")):
+                with self.subTest(client_present=bool(client), key_present=bool(key), pat_present=bool(pat), oidc_present=bool(oidc)):
+                    result, values = run_selection("noema-review", REVIEWER, client=client, key=key, pat=pat, oidc=oidc)
+                    if client and key:
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        self.assertEqual(values.get("source"), "github-app")
+                        self.assertEqual(values.get("repository"), "k-csap-skills")
+                    else:
+                        self.assertNotEqual(result.returncode, 0)
+                        self.assertNotIn("source", values)
+                        self.assertIn("::error::", result.stdout)
diff --git a/tests/test_law_ai_agent_ci.py b/tests/test_law_ai_agent_ci.py
new file mode 100644
index 0000000000..076788ac68
--- /dev/null
+++ b/tests/test_law_ai_agent_ci.py
@@ -0,0 +1,579 @@
+"""Central law CI admission contracts; no consumer product source is copied here."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import textwrap
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW = ROOT / ".github/workflows/law-ai-agent-ci.yml"
+HELPER = ROOT / "scripts/ci/law_ai_agent_ci.sh"
+SHA = "a" * 40
+
+
+def workflow():
+    """Read YAML with BaseLoader so the GitHub `on` key remains a string."""
+    return yaml.load(WORKFLOW.read_text(), Loader=yaml.BaseLoader)
+
+
+def admission(tmp_path, *, event="push", repository="ContextualWisdomLab/law-ai-agent", **overrides):
+    """Execute the actual pre-checkout admission with synthetic GitHub metadata."""
+    payload = {"after": SHA, "ref": "refs/heads/main", "deleted": False}
+    if event == "pull_request":
+        payload = {"pull_request": {"head": {"sha": SHA, "repo": {"full_name": repository}},
+                                    "base": {"ref": "main", "repo": {"full_name": repository}}}}
+    payload.update(overrides.pop("payload", {}))
+    path = tmp_path / "event.json"
+    path.write_text(json.dumps(payload))
+    env = {**os.environ, "CALLER_REPOSITORY": repository, "CALLER_EVENT": event,
+           "CALLER_REF": "refs/heads/main", "SOURCE_SHA": SHA,
+           "CENTRAL_REPOSITORY": "ContextualWisdomLab/.github", "CENTRAL_SHA": SHA,
+           "CENTRAL_REF": f"ContextualWisdomLab/.github/.github/workflows/law-ai-agent-ci.yml@{SHA}",
+           "GITHUB_EVENT_PATH": str(path), "GITHUB_OUTPUT": str(tmp_path / "output")}
+    env.update(overrides)
+    step = workflow()["jobs"]["quality"]["steps"][0]
+    return subprocess.run(["bash", "-euo", "pipefail", "-c", step["run"]],
+                          env=env, capture_output=True, text=True)
+
+
+def test_workflow_is_reusable_only_and_read_only():
+    """Prevent public central PRs from executing private consumer code."""
+    data = workflow()
+    assert data["on"] == {"workflow_call": ""}
+    assert data["permissions"] == {"contents": "read"}
+    job = data["jobs"]["quality"]
+    assert "if" not in job
+    assert job["runs-on"] == {"group": "CWL law CI", "labels": ["self-hosted", "Linux", "X64", "law-ai-agent-ci"]}
+    assert job["strategy"]["max-parallel"] == "1"
+    assert job["strategy"]["matrix"]["python-version"] == ["3.12", "3.14"]
+    assert job["timeout-minutes"] == "20"
+    steps = job["steps"]
+    assert "uses" not in steps[0]
+    checkouts = [s for s in steps if s.get("uses", "").startswith("actions/checkout@")]
+    assert len(checkouts) == 2
+    assert {s["with"]["path"] for s in checkouts} == {"source", "central"}
+    assert all(s["with"]["persist-credentials"] == "false" for s in checkouts)
+    assert checkouts[1]["with"]["ref"] == "${{ job.workflow_sha }}"
+    assert checkouts[1]["with"]["repository"] == "${{ job.workflow_repository }}"
+    assert "secrets" not in WORKFLOW.read_text()
+
+
+@pytest.mark.parametrize("event", ["push", "pull_request", "workflow_dispatch"])
+def test_admission_accepts_only_owned_events(tmp_path, event):
+    """Admit exact owned heads before either checkout."""
+    assert admission(tmp_path, event=event).returncode == 0
+
+
+@pytest.mark.parametrize("changes", [
+    {"repository": "ContextualWisdomLab/.github"},
+    {"event": "pull_request_target"},
+    {"SOURCE_SHA": "a" * 39},
+    {"SOURCE_SHA": "A" * 40},
+    {"CALLER_REF": "refs/heads/develop"},
+    {"CENTRAL_REPOSITORY": "attacker/.github"},
+    {"CENTRAL_SHA": "a" * 39},
+    {"CENTRAL_REF": "ContextualWisdomLab/.github/.github/workflows/law-ai-agent-ci.yml@main"},
+    {"payload": {"after": "b" * 40}},
+    {"payload": {"deleted": True}},
+    {"event": "pull_request", "payload": {"pull_request": {"head": {"sha": SHA, "repo": {"full_name": "fork/law-ai-agent"}}, "base": {"ref": "main", "repo": {"full_name": "ContextualWisdomLab/law-ai-agent"}}}}},
+])
+def test_admission_rejects_untrusted_metadata(tmp_path, changes):
+    """Forks, other repos, mutable refs, and malformed heads fail rather than skip."""
+    assert admission(tmp_path, **changes).returncode != 0
+
+
+def helper(*args, env=None):
+    """Run the owned helper as a child process; fixture tools are synthetic only."""
+    return subprocess.run(["bash", str(HELPER), *map(str, args)],
+                          env=env, capture_output=True, text=True, cwd=ROOT.parent)
+
+
+@pytest.mark.parametrize("skipped,expected", [(0, 0), (1, 1)])
+def test_junit_requires_executed_tests_without_skips(tmp_path, skipped, expected):
+    """A passing pytest exit cannot hide skipped database tests."""
+    report = tmp_path / "junit.xml"
+    report.write_text(f'<testsuites><testsuite tests="343" failures="0" errors="0" skipped="{skipped}"/></testsuites>')
+    assert helper("verify-junit", report).returncode == expected
+
+
+def test_empty_junit_is_not_execution_evidence(tmp_path):
+    """Empty test collections fail closed."""
+    report = tmp_path / "junit.xml"
+    report.write_text('<testsuites><testsuite tests="0" skipped="0"/></testsuites>')
+    assert helper("verify-junit", report).returncode != 0
+
+
+@pytest.mark.parametrize("names,expected", [
+    (["law.whl", "law.tar.gz"], 0),
+    (["law.whl", "old.whl", "law.tar.gz"], 1),
+    (["law.whl"], 1),
+    (["law.whl", "law.tar.gz", "old.txt"], 1),
+])
+def test_dist_cardinality_rejects_previous_builds(tmp_path, names, expected):
+    """Only one fresh wheel and one fresh source archive are accepted."""
+    for name in names:
+        (tmp_path / name).touch()
+    assert helper("verify-dist", tmp_path).returncode == expected
+
+
+def test_run_rejects_mismatched_checkout_before_creating_cluster(tmp_path):
+    """Bad source identity must not start PostgreSQL or uv."""
+    env = {**os.environ, "LAW_CI_SOURCE": str(ROOT), "LAW_CI_SOURCE_SHA": SHA,
+           "LAW_CI_PYTHON_VERSION": "3.14", "RUNNER_TEMP": str(tmp_path)}
+    result = helper("run", env=env)
+    assert result.returncode != 0
+    assert "source identity refused" in result.stderr
+    assert not list(tmp_path.iterdir())
+
+
+def embedded_migration_block(installed=False):
+    """Extract the real heredoc, not a reimplementation of its acceptance logic."""
+    blocks = re.findall(r"<<'PY'\n(.*?)\nPY", HELPER.read_text(), re.S)
+    marker = 'outside the source checkout' if installed else 'fresh, approved test-only database'
+    return next(block for block in blocks if marker in block)
+
+
+def migration_fixture(tmp_path, count=5):
+    """Make archived SQL resources and independent product-semantics ledger rows."""
+    source = tmp_path / 'source'
+    package = source / 'src/law_ai_agent'
+    resources = package / 'migrations'
+    resources.mkdir(parents=True)
+    (package / '__init__.py').write_text('')
+    for version in reversed(range(1, count + 1)):
+        name = {1: '001_initial.sql', 2: '002_revision_membership.sql'}.get(
+            version, f'{version:03}_step.sql')
+        # CRLF and non-ASCII catch raw-byte hashing in place of read_text().encode().
+        (resources / name).write_bytes(
+            f'-- 단계 {version}\r\nSELECT {version};\r\n'.encode())
+    rows = [{'version': int(path.name.split('_')[0]),
+             'checksum': hashlib.sha256(path.read_text().encode()).hexdigest()}
+            for path in sorted(resources.iterdir())]
+    manifest = tmp_path / 'source-migrations.json'
+    return source, resources, rows, manifest
+
+
+def run_migration_block(source, rows, manifest, *, optimized=False):
+    """Run production preflight with only its package/connection boundary synthetic."""
+    package = source / 'src/law_ai_agent'
+    trace = source / 'trace.json'
+    (package / 'postgres.py').write_text(textwrap.dedent('''\
+        import json
+        from pathlib import Path
+        class Connection:
+            def __enter__(self):
+                return self
+            def __exit__(self, *args):
+                pass
+            def commit(self):
+                record('commit')
+            def execute(self, query):
+                record(query)
+                rows = json.loads(Path('rows.json').read_text())
+                if 'checksum' not in query:
+                    return [{'version': row['version']} for row in rows]
+                return rows
+        def record(event):
+            path = Path('trace.json')
+            events = json.loads(path.read_text()) if path.exists() else []
+            path.write_text(json.dumps(events + [event]))
+        def connect(url, *, test_only):
+            if test_only is not True:
+                raise ValueError('test_only boundary lost')
+            record('test_only')
+            return Connection()
+        class PostgresStore:
+            def __init__(self, connection):
+                self.connection = connection
+            def migrate(self):
+                record('migrate')
+        '''))
+    (source / 'rows.json').write_text(json.dumps(rows))
+    wrapper = ('import sys; sys.path.insert(0, "src"); ' +
+               f'exec(compile({embedded_migration_block()!r}, "<preflight>", "exec"))')
+    env = {**os.environ, 'LAW_CI_PYTHON_VERSION': f'{sys.version_info.major}.{sys.version_info.minor}',
+           'LAW_AGENT_TEST_DATABASE_URL': 'synthetic-only'}
+    command = [sys.executable, *(['-O'] if optimized else []), '-I', '-c', wrapper, str(manifest)]
+    result = subprocess.run(command, cwd=source, env=env, capture_output=True, text=True)
+    return result, trace
+
+
+@pytest.mark.parametrize('count', [2, 5])
+def test_preflight_accepts_complete_source_inventory(tmp_path, count):
+    """Accept evolving inventories and retain sorted source names/checksums."""
+    source, resources, rows, manifest = migration_fixture(tmp_path, count)
+    result, trace = run_migration_block(source, rows, manifest)
+    assert result.returncode == 0, result.stderr
+    assert manifest.is_file(), 'source migration manifest was not retained'
+    assert json.loads(manifest.read_text()) == [
+        {'name': path.name, **row} for path, row in zip(sorted(resources.iterdir()), rows)]
+    assert json.loads(trace.read_text())[:3] == ['test_only', 'migrate', 'commit']
+
+
+@pytest.mark.parametrize('mutation', ['missing', 'extra', 'checksum'])
+@pytest.mark.parametrize('optimized', [False, True])
+def test_preflight_rejects_nonexact_database_inventory(tmp_path, mutation, optimized):
+    """Every database version and content digest must match, even under -O."""
+    source, _, rows, manifest = migration_fixture(tmp_path, 2)
+    if mutation == 'missing':
+        rows.pop()
+    elif mutation == 'extra':
+        rows.append({'version': 3, 'checksum': 'a' * 64})
+    else:
+        rows[0]['checksum'] = 'a' * 64
+    result, _ = run_migration_block(source, rows, manifest, optimized=optimized)
+    assert result.returncode != 0, 'nonexact database inventory accepted'
+    assert 'database migration inventory mismatch' in result.stderr
+
+
+def run_installed_block(tmp_path, count=5, mutation=None, optimized=False):
+    """Execute installed smoke with source manifest and separate installed resources."""
+    source, resources, rows, manifest = migration_fixture(tmp_path, count)
+    manifest.write_text(json.dumps([{'name': path.name, **row}
+                                    for path, row in zip(sorted(resources.iterdir()), rows)]))
+    site = tmp_path / 'installed' / 'lib' / 'site-packages'
+    package = site / 'law_ai_agent'
+    installed = package / 'migrations'
+    installed.mkdir(parents=True)
+    (package / '__init__.py').write_text('')
+    for path in resources.iterdir():
+        (installed / path.name).write_bytes(path.read_bytes())
+    if mutation == 'missing':
+        (installed / '001_initial.sql').unlink()
+    elif mutation == 'extra':
+        (installed / '999_extra.sql').write_text('SELECT 999;')
+    elif mutation == 'checksum':
+        (installed / '001_initial.sql').write_text('SELECT -1;')
+    # -I excludes cwd, and this shim redirects imports only to an installed-like prefix.
+    wrapper = ('import sys; sys.prefix = ' + repr(str(site.parent.parent)) +
+               '; sys.path.insert(0, ' + repr(str(site)) + '); ' +
+               f'exec(compile({embedded_migration_block(installed=True)!r}, "<installed>", "exec"))')
+    return subprocess.run([sys.executable, *(['-O'] if optimized else []), '-I', '-c',
+                           wrapper, str(manifest)], cwd=tmp_path, capture_output=True, text=True)
+
+
+@pytest.mark.parametrize('count', [2, 5])
+def test_installed_smoke_matches_retained_source_manifest(tmp_path, count):
+    """Two and five independently installed resources match archived checksums."""
+    result = run_installed_block(tmp_path, count)
+    assert result.returncode == 0, result.stderr
+
+
+@pytest.mark.parametrize('mutation', ['missing', 'extra', 'checksum'])
+@pytest.mark.parametrize('optimized', [False, True])
+def test_installed_smoke_rejects_divergence_from_source(tmp_path, mutation, optimized):
+    """The installed resource set cannot self-attest or bypass checks under -O."""
+    result = run_installed_block(tmp_path, mutation=mutation, optimized=optimized)
+    assert result.returncode != 0, 'nonexact installed inventory accepted'
+    assert 'installed migration inventory mismatch' in result.stderr
+
+
+@pytest.mark.parametrize('optimized', [False, True])
+def test_preflight_imports_product_only_after_valid_source_admission(tmp_path, optimized):
+    """A valid source still imports the product and performs the test-only migration."""
+    source, _, rows, manifest = migration_fixture(tmp_path, 5)
+    imported = source / 'product-imported'
+    (source / 'src/law_ai_agent/__init__.py').write_text(
+        'from pathlib import Path\nPath("product-imported").write_text("imported")\n')
+    result, trace = run_migration_block(source, rows, manifest, optimized=optimized)
+    assert result.returncode == 0, result.stderr
+    assert imported.read_text() == 'imported'
+    assert manifest.is_file()
+    assert json.loads(trace.read_text())[:3] == ['test_only', 'migrate', 'commit']
+
+
+@pytest.mark.parametrize('component', ['src', 'src/law_ai_agent', 'src/law_ai_agent/migrations'])
+@pytest.mark.parametrize('optimized', [False, True])
+def test_preflight_rejects_linked_source_migration_ancestors(tmp_path, component, optimized):
+    """An archived directory link cannot supply migration evidence from outside source."""
+    source, _, rows, manifest = migration_fixture(tmp_path, 5)
+    imported = source / 'product-imported'
+    (source / 'src/law_ai_agent/__init__.py').write_text(
+        'from pathlib import Path\nPath("product-imported").write_text("imported")\n')
+    path = source / component
+    outside = tmp_path / ('outside-' + path.name)
+    path.rename(outside)
+    path.symlink_to(outside, target_is_directory=True)
+    result, trace = run_migration_block(source, rows, manifest, optimized=optimized)
+    assert result.returncode != 0, 'linked migration ancestor accepted'
+    assert 'source migration inventory invalid' in result.stderr
+    assert not manifest.exists()
+    assert not imported.exists(), 'product imported before source admission'
+    assert not trace.exists(), 'database access started before source admission'
+
+
+@pytest.mark.parametrize('name', ['bad.sql', '001_a.txt', '000_zero.sql', '001_duplicate.sql'])
+def test_preflight_rejects_invalid_source_migration_names(tmp_path, name):
+    """Only uniquely numbered nonempty SQL migration resources are admissible."""
+    source, resources, rows, manifest = migration_fixture(tmp_path, 2)
+    (resources / name).write_text('SELECT 1;')
+    result, _ = run_migration_block(source, rows, manifest)
+    assert result.returncode != 0
+    assert 'source migration inventory invalid' in result.stderr
+
+
+def test_preflight_rejects_empty_source_migration(tmp_path):
+    """An empty SQL file cannot be certified by a ledger row."""
+    source, resources, rows, manifest = migration_fixture(tmp_path, 2)
+    (resources / '001_initial.sql').write_text('  \n')
+    result, _ = run_migration_block(source, rows, manifest)
+    assert result.returncode != 0
+    assert 'source migration inventory invalid' in result.stderr
+
+
+def test_run_preserves_native_db_quality_and_artifact_contracts():
+    """Bind the real execution path to locked isolated tooling and mandatory gates."""
+    text = HELPER.read_text()
+    for contract in (
+        'pg_config --bindir', 'mktemp -d', 'chmod 700', 'listen_addresses=',
+        'statement_timeout=10s', 'lock_timeout=2s', 'trap', 'LAW_AGENT_ROOT=',
+        'LAW_AGENT_TEST_DATABASE_URL=', 'uv sync --locked', 'ruff check .',
+        'ruff format --check .', 'mypy', 'pytest --cov', '--cov-fail-under=90',
+        '--junitxml=', 'uv build --out-dir', '--no-create-gitignore', 'uv pip install --offline',
+        '-I -', 'source-migrations.json', 'SELECT version, checksum',
+        'test_only=True', 'git -C', 'archive', 'BASH_SOURCE',
+    ):
+        assert contract in text
+    assert 'sudo' not in text and 'apt-get' not in text
+
+
+def test_cleanup_absent_cluster_is_idempotent(tmp_path):
+    """Admission failures leave no cluster, and always-cleanup remains safe."""
+    assert helper('cleanup', env={**os.environ, 'RUNNER_TEMP': str(tmp_path)}).returncode == 0
+
+
+def test_cleanup_preserves_cluster_when_pid_metadata_is_missing(tmp_path):
+    """Missing PostgreSQL PID metadata is inconclusive, not a clean stop."""
+    runner = tmp_path / 'runner'
+    runner.mkdir(mode=0o700)
+    root = runner / 'lawci.keep'
+    cluster = root / 'data/private/postgres/cluster'
+    cluster.mkdir(mode=0o700, parents=True)
+    root.chmod(0o700)
+    marker = runner / 'law-ci-state-3.14'
+    marker.write_text(str(root) + '\n')
+    marker.chmod(0o600)
+    tools = tmp_path / 'tools'
+    tools.mkdir()
+    pg = tools / 'pg_config'
+    pg.write_text('#!/bin/bash\nprintf "%s\n" "$SYNTHETIC_TOOLS"\n')
+    pg.chmod(0o700)
+    env = {**os.environ, 'RUNNER_TEMP': str(runner),
+           'SYNTHETIC_TOOLS': str(tools),
+           'PATH': str(tools) + os.pathsep + os.environ['PATH']}
+    result = helper('cleanup', env=env)
+    assert result.returncode != 0
+    assert 'PID metadata is missing; shutdown is inconclusive' in result.stderr
+    assert cluster.is_dir()
+    assert root.is_dir()
+    assert marker.is_file()
+
+
+@pytest.mark.parametrize('unsafe_child', [
+    'data', 'private', 'postgres', 'cluster', 'postmaster-pid',
+])
+def test_cleanup_refuses_symlinked_cluster_boundaries(tmp_path, unsafe_child):
+    """Never invoke PostgreSQL cleanup through a symlinked cluster boundary."""
+    runner = tmp_path / 'runner'
+    runner.mkdir(mode=0o700)
+    root = runner / 'lawci.keep'
+    root.mkdir(mode=0o700)
+    cluster = root / 'data/private/postgres/cluster'
+    foreign_root = tmp_path / 'foreign-root'
+    foreign_cluster = foreign_root / 'data/private/postgres/cluster'
+    foreign_cluster.mkdir(mode=0o700, parents=True)
+    foreign_pid = foreign_cluster / 'postmaster.pid'
+    foreign_pid.write_text('foreign\n')
+    child_paths = {
+        'data': Path('data'),
+        'private': Path('data/private'),
+        'postgres': Path('data/private/postgres'),
+        'cluster': Path('data/private/postgres/cluster'),
+    }
+    if unsafe_child == 'postmaster-pid':
+        cluster.mkdir(mode=0o700, parents=True)
+        (cluster / 'postmaster.pid').symlink_to(foreign_pid)
+    else:
+        child_path = child_paths[unsafe_child]
+        (root / child_path).parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        (root / child_path).symlink_to(foreign_root / child_path, target_is_directory=True)
+    marker = runner / 'law-ci-state-3.14'
+    marker.write_text(str(root) + '\n')
+    marker.chmod(0o600)
+    tools = tmp_path / 'tools'
+    tools.mkdir()
+    pg_config = tools / 'pg_config'
+    pg_config.write_text('#!/bin/bash\nprintf "%s\\n" "$SYNTHETIC_TOOLS"\n')
+    pg_config.chmod(0o700)
+    pg_ctl = tools / 'pg_ctl'
+    pg_ctl.write_text('#!/bin/bash\nprintf "called\\n" >> "$SYNTHETIC_TRACE"\nexit 9\n')
+    pg_ctl.chmod(0o700)
+    trace = tmp_path / 'trace'
+    env = {**os.environ, 'RUNNER_TEMP': str(runner),
+           'SYNTHETIC_TOOLS': str(tools), 'SYNTHETIC_TRACE': str(trace),
+           'PATH': str(tools) + os.pathsep + os.environ['PATH']}
+    result = helper('cleanup', env=env)
+    assert result.returncode != 0
+    assert not trace.exists()
+    assert foreign_pid.read_text() == 'foreign\n'
+    assert root.is_dir()
+    assert marker.is_file()
+
+
+def short_temp_root():
+    """Select a canonical base leaving room for both private temporary roots."""
+    base = Path(tempfile.gettempdir()).resolve()
+    if len(str(base)) + len('/l.XXXXXXXX/lawci.XXXXXX') < 65:
+        return base
+    base = (Path.home() / '.cache/law-ci-tests').resolve()
+    if len(str(base)) + len('/l.XXXXXXXX/lawci.XXXXXX') >= 65:
+        raise ValueError('no short temporary root for law CI tests')
+    base.mkdir(mode=0o700, parents=True, exist_ok=True)
+    info = base.stat()
+    if info.st_uid != os.getuid() or info.st_mode & 0o777 != 0o700:
+        raise ValueError('law CI test cache must be owned and private')
+    return base
+
+
+@pytest.mark.parametrize('layout', ['short', 'alias', 'long', 'default'])
+def test_short_temp_root_is_canonical_and_socket_bounded(tmp_path, monkeypatch, layout):
+    """Select usable defaults or home cache without forwarding temp aliases."""
+    expected = short_temp_root()
+    candidate = expected
+    if layout == 'alias':
+        candidate = tmp_path / 'alias'
+        candidate.symlink_to(expected, target_is_directory=True)
+    elif layout == 'long':
+        candidate = tmp_path / ('temp-' + 'x' * 80)
+        candidate.mkdir()
+        expected = (Path.home() / '.cache/law-ci-tests').resolve()
+    elif layout == 'default':
+        monkeypatch.delenv('TMPDIR', raising=False)
+        monkeypatch.setattr(tempfile, 'tempdir', None)
+        candidate = Path(tempfile.gettempdir()).resolve()
+        expected = candidate if len(str(candidate)) + len('/l.XXXXXXXX/lawci.XXXXXX') < 65 else (
+            Path.home() / '.cache/law-ci-tests').resolve()
+    if layout != 'default':
+        monkeypatch.setattr(tempfile, 'gettempdir', lambda: str(candidate))
+    selected = short_temp_root()
+    assert selected == expected
+    assert selected == selected.resolve()
+    assert all(not component.is_symlink() for component in (selected, *selected.parents))
+    with tempfile.TemporaryDirectory(prefix='l.', dir=selected) as temp:
+        assert len(str(Path(temp) / 'lawci.XXXXXX')) < 65
+        assert Path(temp).stat().st_uid == os.getuid()
+        assert Path(temp).stat().st_mode & 0o777 == 0o700
+
+
+@pytest.mark.parametrize('stop_failure', [False, True])
+def test_synthetic_child_failure_without_hermes_home(tmp_path, stop_failure):
+    """Run the actual two cleanup cases with an empty HOME and long runner temp."""
+    home = tmp_path / 'home'
+    home.mkdir()
+    runner = tmp_path / ('runner-' + 'x' * 80)
+    runner.mkdir()
+    assert not (home / '.hermes').exists()
+    env = {**os.environ, 'HOME': str(home), 'TMPDIR': str(short_temp_root()),
+           'RUNNER_TEMP': str(runner), 'PYTEST_DISABLE_PLUGIN_AUTOLOAD': '1'}
+    node = f'{__file__}::test_synthetic_child_failure_and_cleanup_are_not_success[{stop_failure}]'
+    result = subprocess.run([sys.executable, '-m', 'pytest', '-q',
+                             '--basetemp', str(tmp_path / 'child'), node],
+                            cwd=ROOT, env=env, capture_output=True, text=True)
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert '1 passed' in result.stdout
+    assert not (home / '.hermes').exists()
+    assert not list(runner.iterdir())
+
+
+@pytest.mark.parametrize('stop_failure', [False, True])
+def test_synthetic_child_failure_and_cleanup_are_not_success(tmp_path, stop_failure):
+    """Synthetic tools prove exit propagation and cleanup; not real DB evidence."""
+    tools = tmp_path / 'tools'
+    tools.mkdir()
+    scripts = {
+        'git': '#!/bin/bash\nif [[ "$*" == *rev-parse* ]]; then printf "%s\\n" "$LAW_CI_SOURCE_SHA"; else tar -cf - --files-from /dev/null; fi\n',
+        'uv': '#!/bin/bash\nif [[ "$1" == --version ]]; then printf "uv 0.12.5 synthetic-only\\n"; else exit 37; fi\n',
+        'pg_config': '#!/bin/bash\nprintf "%s\\n" "$SYNTHETIC_TOOLS"\n',
+        'initdb': '#!/bin/bash\nmkdir -p "$2"\n',
+        'pg_ctl': '#!/bin/bash\nif [[ "$*" == *start* ]]; then touch "$2/postmaster.pid"; else printf "stop\\n" >> "$SYNTHETIC_TRACE"; if [[ "$SYNTHETIC_STOP_EXIT" == 0 ]]; then rm -f "$2/postmaster.pid"; fi; exit "$SYNTHETIC_STOP_EXIT"; fi\n',
+        'createdb': '#!/bin/bash\nexit 0\n',
+        'psql': '#!/bin/bash\nexit 0\n',
+    }
+    for name, content in scripts.items():
+        path = tools / name
+        path.write_text(content)
+        path.chmod(0o700)
+    # Deep pytest roots exceed socket limits; choose a portable canonical base.
+    with tempfile.TemporaryDirectory(prefix='l.', dir=short_temp_root()) as temp:
+        sentinel = Path(temp) / 'keep'
+        sentinel.write_text('unrelated')
+        assert len(str(Path(temp) / 'lawci.XXXXXX')) < 65
+        env = {**os.environ, 'PATH': str(tools) + os.pathsep + os.environ['PATH'],
+               'LAW_CI_SOURCE': str(ROOT), 'LAW_CI_SOURCE_SHA': SHA,
+               'LAW_CI_PYTHON_VERSION': '3.14', 'RUNNER_TEMP': temp,
+               'SYNTHETIC_TOOLS': str(tools), 'SYNTHETIC_TRACE': str(tmp_path / 'trace'),
+               'SYNTHETIC_STOP_EXIT': '9' if stop_failure else '0'}
+        result = helper('run', env=env)
+        assert result.returncode == 37
+        assert (tmp_path / 'trace').read_text() == 'stop\n'
+        assert bool(list(Path(temp).glob('lawci.*'))) == stop_failure
+        if stop_failure:
+            env['SYNTHETIC_STOP_EXIT'] = '0'
+            assert helper('cleanup', env=env).returncode == 0
+        assert sentinel.read_text() == 'unrelated'
+        assert list(Path(temp).iterdir()) == [sentinel]
+
+
+@pytest.mark.parametrize('unsafe', ['nested', 'public', 'symlink', 'parent-symlink', 'public-marker'])
+def test_cleanup_refuses_unowned_or_non_immediate_roots(tmp_path, unsafe):
+    """Hostile marker paths never grant recursive deletion authority."""
+    runner = tmp_path / 'runner'
+    runner.mkdir(mode=0o700)
+    root = runner / 'lawci.keep'
+    root.mkdir(mode=0o700)
+    target = root
+    if unsafe == 'nested':
+        target = root / 'lawci.child'
+        target.mkdir(mode=0o700)
+    elif unsafe == 'public':
+        root.chmod(0o755)
+    elif unsafe == 'symlink':
+        target = runner / 'lawci.link'
+        target.symlink_to(root, target_is_directory=True)
+    elif unsafe == 'parent-symlink':
+        alias = tmp_path / 'alias'
+        alias.symlink_to(runner, target_is_directory=True)
+        runner = alias
+        target = alias / root.name
+    marker = runner / 'law-ci-state-3.14'
+    marker.write_text(str(target) + '\n')
+    marker.chmod(0o644 if unsafe == 'public-marker' else 0o600)
+    tools = tmp_path / 'tools'
+    tools.mkdir()
+    pg = tools / 'pg_config'
+    pg.write_text('#!/bin/bash\nprintf "%s\\n" "$SYNTHETIC_TOOLS"\n')
+    pg.chmod(0o700)
+    env = {**os.environ, 'RUNNER_TEMP': str(runner), 'SYNTHETIC_TOOLS': str(tools),
+           'PATH': str(tools) + os.pathsep + os.environ['PATH']}
+    assert helper('cleanup', env=env).returncode != 0
+    assert root.is_dir()
+    assert marker.is_file()
+
+
+def test_run_installs_trap_before_state_and_verifies_actual_python_prefix():
+    """State collisions preserve old markers and leave no newly owned root."""
+    text = HELPER.read_text()
+    assert text.index('trap on_exit EXIT') < text.index('test ! -e "$state"')
+    assert 'state_owned=0' in text
+    assert 'sys.version_info[:2]' in text
+    assert 'Path(sys.prefix).resolve()' in text
diff --git a/tests/test_law_runner_temp_whitespace.py b/tests/test_law_runner_temp_whitespace.py
new file mode 100644
index 0000000000..37dbb02284
--- /dev/null
+++ b/tests/test_law_runner_temp_whitespace.py
@@ -0,0 +1,77 @@
+"""Regression seam for PostgreSQL startup paths containing spaces."""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import re
+import shlex
+import subprocess
+import textwrap
+
+
+ROOT = Path(__file__).resolve().parents[1]
+HELPER = ROOT / "scripts/ci/law_ai_agent_ci.sh"
+
+
+def _run_pg_ctl_fragment(tmp_path: Path) -> list[str]:
+    """Execute the exact pg_ctl invocation from the production helper."""
+    source = HELPER.read_text()
+    match = re.search(
+        r"(?m)^  (\"\$pg_bin/pg_ctl\".*?)(?=^  \"\$pg_bin/createdb\")",
+        source,
+        re.S,
+    )
+    assert match, "production pg_ctl invocation not found"
+    pg_bin = tmp_path / "bin"
+    pg_bin.mkdir()
+    capture = tmp_path / "argv.json"
+    (pg_bin / "pg_ctl").write_text(
+        "#!/bin/sh\n"
+        "python3 -c 'import json,sys; print(json.dumps(sys.argv[1:]))' "
+        f'"$@" > {shlex.quote(str(capture))}\n'
+    )
+    (pg_bin / "pg_ctl").chmod(0o700)
+    private = tmp_path / "runner temp" / "lawci.data" / "private" / "postgres"
+    private.mkdir(parents=True)
+    script = textwrap.dedent(
+        f"""
+        set -eu
+        pg_bin={shlex.quote(str(pg_bin))}
+        private={shlex.quote(str(private))}
+        LAW_AGENT_POSTGRES_PORT=55439
+        scratch={shlex.quote(str(tmp_path / 'runner temp' / 'lawci.data'))}
+        {textwrap.dedent(match.group(1))}
+        """
+    )
+    result = subprocess.run(["bash", "-eu", "-c", script], capture_output=True, text=True)
+    assert result.returncode == 0, result.stderr
+    return json.loads(capture.read_text())
+
+
+def test_pg_ctl_preserves_spaced_socket_path(tmp_path):
+    """The server option parser receives one complete socket path token."""
+    argv = _run_pg_ctl_fragment(tmp_path)
+    payload = argv[argv.index("-o") + 1]
+    parsed = shlex.split(payload)
+    assert parsed[parsed.index("-k") + 1] == str(tmp_path / "runner temp" / "lawci.data" / "private" / "postgres" / "socket")
+
+
+def test_libpq_conninfo_preserves_spaced_socket_path(tmp_path):
+    """The consumer conninfo parser receives one complete host value."""
+    source = HELPER.read_text()
+    line = next(line.strip() for line in source.splitlines() if "LAW_AGENT_TEST_DATABASE_URL=" in line)
+    private = tmp_path / "runner temp" / "lawci.data" / "private" / "postgres"
+    script = textwrap.dedent(
+        f"""
+        set -eu
+        private={shlex.quote(str(private))}
+        LAW_AGENT_POSTGRES_USER=runner
+        LAW_AGENT_POSTGRES_PORT=55439
+        {line}
+        printf '%s' "$LAW_AGENT_TEST_DATABASE_URL"
+        """
+    )
+    result = subprocess.run(["bash", "-eu", "-c", script], capture_output=True, text=True)
+    assert result.returncode == 0, result.stderr
+    fields = shlex.split(result.stdout)
+    assert fields[fields.index("port=55439") - 1] == "host=" + str(private / "socket")
diff --git a/tests/test_materialize_base_python_requirements.py b/tests/test_materialize_base_python_requirements.py
index a2da04ae25..06b66953ac 100644
--- a/tests/test_materialize_base_python_requirements.py
+++ b/tests/test_materialize_base_python_requirements.py
@@ -9,6 +9,7 @@
 import tarfile
 import zipfile
 from pathlib import Path
+from urllib.error import HTTPError
 
 import pytest
 
@@ -811,6 +812,30 @@ def test_download_trusted_uv_archive_rejects_network_and_size_failures(
         materializer._download_trusted_uv_archive()
 
 
+def test_download_trusted_uv_archive_closes_transformed_http_error(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The downloader owns and closes an HTTP response once it transforms the error."""
+    error_body = io.BytesIO(b"private body")
+    provider_error = HTTPError(
+        materializer.TRUSTED_UV_ARCHIVE_URL,
+        503,
+        "private body",
+        {},
+        error_body,
+    )
+    monkeypatch.setattr(
+        materializer.urllib.request,
+        "urlopen",
+        lambda *_a, **_k: (_ for _ in ()).throw(provider_error),
+    )
+
+    with pytest.raises(RuntimeError, match="download failed: HTTPError"):
+        materializer._download_trusted_uv_archive()
+
+    assert error_body.closed
+
+
 def test_verified_uv_binary_accepts_exact_archive(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
diff --git a/tests/test_materialize_base_rust_dependencies.py b/tests/test_materialize_base_rust_dependencies.py
index d8b409d342..e7364897e6 100644
--- a/tests/test_materialize_base_rust_dependencies.py
+++ b/tests/test_materialize_base_rust_dependencies.py
@@ -489,6 +489,30 @@ def test_run_cargo_vendor_propagates_missing_binary(tmp_path: Path) -> None:
             materializer.materialize(repo, base_sha, tmp_path / "out")
 
 
+def test_materialize_surfaces_cargo_vendor_timeout(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A stalled cargo process fails closed with its stable exception class."""
+    repo = tmp_path / "repo"
+    _init_repo(repo)
+    _write_single_crate_workspace(repo, generate_lock=False)
+    base_sha = _commit_all(repo)
+
+    monkeypatch.setattr(
+        materializer,
+        "_run_cargo_vendor",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            subprocess.TimeoutExpired(["cargo", "vendor"], 900)
+        ),
+    )
+
+    with pytest.raises(
+        RuntimeError,
+        match="could not run trusted cargo vendor for base manifest Cargo.lock: TimeoutExpired",
+    ):
+        materializer.materialize(repo, base_sha, tmp_path / "out")
+
+
 def test_materialize_surfaces_cargo_vendor_failure_detail(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
diff --git a/tests/test_noema_author_distinct.py b/tests/test_noema_author_distinct.py
new file mode 100644
index 0000000000..58185986fa
--- /dev/null
+++ b/tests/test_noema_author_distinct.py
@@ -0,0 +1,57 @@
+"""Reject author-owned credentials in the legacy direct Noema entry point."""
+from __future__ import annotations
+
+import pytest
+
+from scripts.ci import noema_review_gate as gate
+
+HEAD = "a" * 40
+
+
+def _bind(monkeypatch, author):
+    """Replace network/model boundaries with labelled synthetic witnesses."""
+    pr = {"state": "OPEN", "headRefOid": HEAD, "baseRefOid": "b" * 40,
+          "isDraft": False, "author": {"login": author} if author else None}
+    monkeypatch.setattr(gate, "fetch_pr", lambda *_: pr)
+    monkeypatch.setattr(gate, "current_actor", lambda: "cwl-noema-review[bot]")
+    monkeypatch.setattr(gate, "existing_noema_review", lambda *_: False)
+    monkeypatch.setattr(gate, "fetch_diff", lambda *_: ("diff", False))
+    monkeypatch.setattr(gate, "fetch_changed_files", lambda *_: [("src/a.py", "MODIFIED")])
+    monkeypatch.setattr(gate, "build_review_context", lambda *_: "context")
+    return pr
+
+
+@pytest.mark.parametrize("author", (None, "cwl-noema-review[bot]", "CWL-Noema-Review[bot]"))
+def test_direct_entry_rejects_unknown_or_self_author(monkeypatch, author):
+    """Neither unknown author nor case variation may permit self-review."""
+    _bind(monkeypatch, author)
+    monkeypatch.setattr(gate, "call_llm", lambda *_: pytest.fail("model reached before author admission"))
+    with pytest.raises(RuntimeError, match="author"):
+        gate.inspect_and_review("ContextualWisdomLab/example", 7, HEAD)
+
+
+def test_direct_entry_rechecks_author_before_publication(monkeypatch):
+    """The live author must be revalidated after model work."""
+    pr = _bind(monkeypatch, "seonghobae")
+    def model(*_):
+        pr["author"] = {"login": "cwl-noema-review[bot]"}
+        return {"decision": "approve"}
+    monkeypatch.setattr(gate, "call_llm", model)
+    monkeypatch.setattr(
+        gate,
+        "submit_review",
+        lambda *_: pytest.fail("author-owned review was published"),
+    )
+    with pytest.raises(RuntimeError, match="author"):
+        gate.inspect_and_review("ContextualWisdomLab/example", 7, HEAD)
+
+
+def test_direct_entry_permits_independent_actor(monkeypatch):
+    """A distinct App can publish its own substantive verdict."""
+    _bind(monkeypatch, "seonghobae")
+    monkeypatch.setattr(gate, "call_llm", lambda *_: {"decision": "approve"})
+    submitted = []
+    monkeypatch.setattr(gate, "submit_review", lambda *args: submitted.append(args))
+    assert gate.inspect_and_review("ContextualWisdomLab/example", 7, HEAD) == 0
+    assert len(submitted) == 1
+    assert submitted[0][3] == "cwl-noema-review[bot]"
diff --git a/tests/test_noema_bootstrap_final_missing.py b/tests/test_noema_bootstrap_final_missing.py
new file mode 100644
index 0000000000..f191c9655d
--- /dev/null
+++ b/tests/test_noema_bootstrap_final_missing.py
@@ -0,0 +1,77 @@
+"""New exact remaining branch controls; trusted fault seams are explicit."""
+import hashlib
+import json
+import runpy
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+import pytest
+from scripts.ci import noema_bootstrap_producer as producer
+from scripts.ci import premerge_review_tooling as tooling
+from tests.test_noema_issuer_producer_controls import bootstrap_case
+from tests.test_noema_bootstrap_missing_quality import cli_inputs
+
+
+def test_source_root_symlink_refuses_before_copy(tmp_path):
+    """Reach materializer alias denial with valid independent fixture pins."""
+    parent,source,entry,raw,admission=bootstrap_case(tmp_path)
+    alias=tmp_path/'alias';alias.symlink_to(source)
+    with pytest.raises(ValueError,match='namespace'):
+        producer.materialize_tooling(alias,parent/'tooling',raw,accepted_digest=hashlib.sha256(raw).hexdigest(),admission=admission,private_parent=parent)
+
+
+def test_source_changes_after_verified_load_refuse_copy(tmp_path,monkeypatch):
+    """Change actual source bytes in the trusted loader wait before delivery."""
+    parent,source,entry,raw,admission=bootstrap_case(tmp_path)
+    original=tooling.load_noema_tooling
+    def load(*args,**kwargs):
+        """Return the real admitted loader, then mutate the fixture supplier."""
+        result=original(*args,**kwargs);entry.write_bytes(b'CHANGED');return result
+    monkeypatch.setattr(tooling,'load_noema_tooling',load)
+    with pytest.raises(ValueError,match='changed during delivery'):
+        producer.materialize_tooling(source,parent/'tooling',raw,accepted_digest=hashlib.sha256(raw).hexdigest(),admission=admission,private_parent=parent)
+
+
+def test_missing_inference_authority_refuses_composition(tmp_path):
+    """Actual missing-key branch refuses before any issuer or child callback."""
+    parent,source,entry,raw,admission=bootstrap_case(tmp_path);admission['scope']={}
+    with pytest.raises(ValueError,match='inference authority'):
+        producer.run_bootstrap_review(source,raw,accepted_digest=hashlib.sha256(raw).hexdigest(),admission=admission,private_parent=parent,fetch_live=lambda:None,request=lambda *a:None,revalidate=lambda:None,inference_key=None)
+
+
+def test_digest_provider_fault_is_denied_before_issuer(tmp_path,monkeypatch):
+    """Explicit trusted digest fault tests the otherwise redundant immutable pin guard."""
+    parent,source,entry,raw,admission=bootstrap_case(tmp_path);admission['scope']={}
+    def revalidate():
+        """Inject only digest-provider failure after real initial source admission."""
+        monkeypatch.setattr(hashlib,'sha256',lambda *a:SimpleNamespace(hexdigest=lambda:'0'*64))
+    with pytest.raises(ValueError,match='source pin changed'):
+        producer.run_bootstrap_review(source,raw,accepted_digest=hashlib.sha256(raw).hexdigest(),admission=admission,private_parent=parent,fetch_live=lambda:None,request=lambda *a:None,revalidate=revalidate,inference_key='FIXTURE_INFERENCE')
+
+
+@pytest.mark.parametrize('mutation',['pre_fence_file','post_read_memory'])
+def test_remaining_cli_wait_fences(tmp_path,monkeypatch,mutation):
+    """Reach first file drift and defensive post-read memory revocation gates."""
+    args,parent,mf,af,pr=cli_inputs(tmp_path);args+=['--app-jwt-file',str(parent/'jwt')]
+    original=producer._response;held=[]
+    def response(raw):
+        """Parse actual bytes, then hold the returned trusted admission object."""
+        value=original(raw);held.append(value)
+        if mutation=='pre_fence_file':mf.write_bytes(b'{}')
+        return value
+    def live(*a,**kw):
+        """Return otherwise valid live scope; revoke only in-memory admission."""
+        if mutation=='post_read_memory':held[0]['native_custody']=False
+        return SimpleNamespace(stdout=json.dumps(pr))
+    monkeypatch.setattr(producer,'_response',response);monkeypatch.setattr(producer.subprocess,'run',live)
+    assert producer.main(args)==1
+
+
+def test_actual_isolated_entry_missing_pins_refuses_without_network(tmp_path,monkeypatch):
+    """Exercise root bootstrap and __main__ in-process for coverage transport."""
+    helper=Path(producer.__file__);root=str(helper.resolve().parents[2])
+    monkeypatch.setattr(sys,'path',[x for x in sys.path if x!=root])
+    args=['--materialize','--private-parent',str(tmp_path),'--source-root',str(tmp_path/'source'),'--manifest',str(tmp_path/'absent'),'--accepted-digest','','--admission',str(tmp_path/'absent2'),'--admission-digest','','--repo','ContextualWisdomLab/example','--pr-number','7','--expected-head','a'*40]
+    monkeypatch.setattr(sys,'argv',[str(helper),*args])
+    with pytest.raises(SystemExit) as error:runpy.run_path(str(helper),run_name='__main__')
+    assert error.value.code==1
diff --git a/tests/test_noema_bootstrap_missing_quality.py b/tests/test_noema_bootstrap_missing_quality.py
new file mode 100644
index 0000000000..110da0225e
--- /dev/null
+++ b/tests/test_noema_bootstrap_missing_quality.py
@@ -0,0 +1,124 @@
+"""New missing bootstrap boundary controls from retained exact55d7 coverage."""
+import copy
+import json
+import os
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+from scripts.ci import noema_bootstrap_producer as producer
+from tests.test_noema_issuer_producer_controls import bootstrap_case, issuer_case
+
+
+@pytest.mark.parametrize('raw', [b'', b'\xff', b'{', b'[]'])
+def test_missing_response_shape_controls(raw):
+    """Reject absent, invalid UTF8, malformed and nonobject original responses."""
+    with pytest.raises(ValueError):
+        producer._response(raw)
+
+
+@pytest.mark.parametrize('mutation', ['phase', 'identity', 'repository', 'actor', 'symlink_parent', 'parent_mode', 'custody_drift', 'fsync_error'])
+def test_missing_issuer_refusals_preserve_output_boundary(tmp_path, monkeypatch, mutation):
+    """Reach distinct missing producer denials using only fixture authority."""
+    parent,scope,app,installation,response,calls,request=issuer_case(tmp_path)
+    phase='prepare';app_id=11
+    if mutation=='phase':phase='other'
+    elif mutation=='identity':app_id=0
+    elif mutation=='repository':scope['repository']='Other/example'
+    elif mutation=='actor':scope['reviewer']='other[bot]'
+    elif mutation=='symlink_parent':
+        alias=tmp_path/'alias';alias.symlink_to(parent);parent=alias
+    elif mutation=='parent_mode':parent.chmod(0o755)
+    def fence():
+        """Change private mode only after actual issuance to reach custody check."""
+        if mutation=='custody_drift' and len(calls)==3:parent.chmod(0o750)
+    if mutation=='fsync_error':
+        def fail(fd):
+            """Inject final ordinary IO failure after actual private file writing."""
+            raise OSError('FIXTURE_IO')
+        monkeypatch.setattr(producer.os,'fsync',fail)
+    with pytest.raises((ValueError,OSError)):
+        producer.produce_issuance(phase,scope=scope,installation_id=7,app_id=app_id,
+            output=parent/'prepare.json',private_parent=parent,request=request,revalidate=fence)
+    assert (parent/'prepare.json').exists()==(mutation=='fsync_error')
+
+
+@pytest.mark.parametrize('mutation', ['relative', 'namespace', 'missing_evidence', 'dependencies'])
+def test_missing_runtime_admission_controls(tmp_path, mutation):
+    """Exercise otherwise admitted runtime evidence with one invalid boundary."""
+    parent,source,entry,raw,admission=bootstrap_case(tmp_path)
+    if mutation=='relative':parent=Path('relative')
+    elif mutation=='namespace':admission['namespace']='foreign'
+    elif mutation=='missing_evidence':admission['native_custody']=False
+    else:admission['dependencies']=None
+    with pytest.raises(ValueError):producer._validate_runtime(admission,parent)
+
+
+@pytest.mark.parametrize('mutation', ['relative','hardlink','empty','whitespace'])
+def test_missing_private_input_controls(tmp_path, mutation):
+    """Private transport never reads an unowned or unusable fixture credential."""
+    parent=tmp_path/'private';parent.mkdir(mode=0o700)
+    jwt=parent/'jwt';jwt.write_bytes(b'FIXTURE_JWT');jwt.chmod(0o600)
+    if mutation=='relative':jwt=Path('relative')
+    elif mutation=='hardlink':os.link(jwt,parent/'alias')
+    elif mutation=='empty':jwt.write_bytes(b'')
+    else:jwt.write_bytes(b'FIXTURE WHITESPACE')
+    with pytest.raises((ValueError,OSError)):producer.authenticated_transport(jwt,parent,opener=lambda *a,**kw:None)
+
+
+@pytest.mark.parametrize('mutation',['endpoint','payload','framing','redirect'])
+def test_missing_transport_controls(tmp_path, mutation):
+    """Inspect fixed transport denials with no network or provider activity."""
+    import urllib.request
+    parent=tmp_path/'private';parent.mkdir(mode=0o700)
+    jwt=parent/'jwt';jwt.write_bytes(b'FIXTURE_JWT');jwt.chmod(0o600)
+    class Response:
+        """Return a syntactically valid body with contrary declared length."""
+        headers={'Content-Length':'100'}
+        def __enter__(self):return self
+        def __exit__(self,*args):return False
+        def read(self,size):return b'{}'
+    transport=producer.authenticated_transport(jwt,parent,opener=lambda *a,**kw:Response())
+    if mutation=='redirect':
+        # Recover the actual generated handler class without making any request.
+        with pytest.MonkeyPatch.context() as mp:
+            held=[]
+            def build(*handlers):
+                """Retain actual default handlers at the trusted construction seam."""
+                held.extend(handlers);return SimpleNamespace(open=lambda *a:None)
+            mp.setattr(urllib.request,'build_opener',build)
+            producer.authenticated_transport(jwt,parent)
+            assert held[1].redirect_request(None,None,302,'',{},'https://foreign.invalid') is None
+    else:
+        with pytest.raises(ValueError):transport('GET','/foreign' if mutation=='endpoint' else '/app',{} if mutation=='payload' else None)
+
+
+def cli_inputs(tmp_path):
+    """Build independent fixture pins for only newly missing CLI conditions."""
+    import hashlib
+    parent,source,entry,raw,admission=bootstrap_case(tmp_path)
+    scope={'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    admission.update(scope=scope,app_id=11,installation_id=7)
+    producer.materialize_tooling(source,parent/'tooling',raw,accepted_digest=hashlib.sha256(raw).hexdigest(),admission=admission,private_parent=parent)
+    mf,af=tmp_path/'manifest',tmp_path/'admission';mf.write_bytes(raw);af.write_text(json.dumps(admission))
+    args=['--issue-prepare','--private-parent',str(parent),'--source-root',str(source),'--manifest',str(mf),'--accepted-digest',hashlib.sha256(raw).hexdigest(),'--admission',str(af),'--admission-digest',hashlib.sha256(af.read_bytes()).hexdigest(),'--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head']]
+    pr={'base':{'sha':scope['base'],'repo':{'full_name':scope['repository']}},'head':{'sha':scope['head']},'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    return args,parent,mf,af,pr
+
+
+@pytest.mark.parametrize('mutation',['pin','admission_digest','target','no_jwt','verdict_namespace','pre_live_drift'])
+def test_missing_cli_refusals(tmp_path,monkeypatch,mutation):
+    """CLI rejects new malformed pins/scope/custody before transport acquisition."""
+    args,parent,mf,af,pr=cli_inputs(tmp_path)
+    if mutation=='pin':args[args.index('--accepted-digest')+1]=''
+    elif mutation=='admission_digest':args[args.index('--admission-digest')+1]='0'*64
+    elif mutation=='target':args[args.index('--repo')+1]='ContextualWisdomLab/other'
+    elif mutation=='verdict_namespace':args[0]='--revalidate-publish';args+=['--verdict-file',str(parent/'foreign')]
+    elif mutation=='pre_live_drift':
+        args+=['--app-jwt-file',str(parent/'jwt')]
+        def pre_read(admission,path):
+            """Alter the pinned file after initial parsing, before the next fence."""
+            mf.write_bytes(b'{}')
+        monkeypatch.setattr(producer,'_validate_runtime',pre_read)
+    monkeypatch.setattr(producer.subprocess,'run',lambda *a,**kw:SimpleNamespace(stdout=json.dumps(pr)))
+    assert producer.main(args)==1
diff --git a/tests/test_noema_child_environment_composition.py b/tests/test_noema_child_environment_composition.py
new file mode 100644
index 0000000000..3fc0d21c4e
--- /dev/null
+++ b/tests/test_noema_child_environment_composition.py
@@ -0,0 +1,145 @@
+"""Actual controller child composition with inert GitHub/model/HWP suppliers."""
+import hashlib
+import json
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+from scripts.ci import premerge_review_tooling as caller
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def composition(tmp_path, monkeypatch, scenario, attempt="1"):
+    """Copy unchanged consumers and supply independently pinned synthetic context."""
+    root = tmp_path / "tooling"
+    entry = root / ".github/actions/noema-review/two_phase.py"
+    entry.parent.mkdir(parents=True)
+    shutil.copyfile(ROOT / ".github/actions/noema-review/two_phase.py", entry)
+    for source in (ROOT / "scripts/ci").glob("*.py"):
+        target = root / "scripts/ci" / source.name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(source, target)
+    shutil.copyfile(ROOT / "scripts/ci/noema_hwp_mcp_reader.mjs", root / "scripts/ci/noema_hwp_mcp_reader.mjs")
+    files = {p.relative_to(root).as_posix(): hashlib.sha256(p.read_bytes()).hexdigest()
+             for p in root.rglob("*") if p.is_file()}
+    manifest = {"schema_version": 1, "repository": "ContextualWisdomLab/.github",
+                "commit": "c" * 40, "tree": "d" * 40,
+                "entrypoint": ".github/actions/noema-review/two_phase.py", "files": files}
+    scope = {"repository": "ContextualWisdomLab/example", "number": 7,
+             "head": "a" * 40, "base": "b" * 40,
+             "author": "writer", "reviewer": "cwl-noema-review[bot]"}
+    reader = tmp_path / "reader"
+    (reader / "dist/core").mkdir(parents=True)
+    (reader / "dist/tools").mkdir()
+    (reader / "node_modules/@rhwp/core").mkdir(parents=True)
+    (reader / "package.json").write_text(json.dumps({"name": "hwp-mcp", "version": "0.3.0", "type": "module"}))
+    (reader / "node_modules/@rhwp/core/package.json").write_text(json.dumps({"name": "@rhwp/core", "version": "0.7.7"}))
+    (reader / "dist/core/document.js").write_text("export async function openDocument(p) { return p; } export function closeDocument(d) {}\n")
+    (reader / "dist/tools/read.js").write_text("import {readFileSync} from 'node:fs'; export async function readHwp({file_path}) { return readFileSync(file_path, 'utf8'); }\n")
+    node = Path(shutil.which("node")).resolve()
+    assert node.name == "node"
+    output = tmp_path / "step-output"
+    output.touch(mode=0o600)
+    context = {"GITHUB_OUTPUT": str(output), "NOEMA_TRANSPORT_RETRY_ATTEMPT": attempt,
+               "NOEMA_HWP_MCP_SOURCE": str(reader), "NOEMA_NODE_EXECUTABLE": str(node),
+               "node_sha256": hashlib.sha256(node.read_bytes()).hexdigest(),
+               "hwp_files": {p.relative_to(reader).as_posix(): hashlib.sha256(p.read_bytes()).hexdigest()
+                             for p in reader.rglob("*") if p.is_file()}}
+    admission = {"scope": scope, "installation_id": 7, "prepare_transport": context,
+                 **{k: True for k in ("isolated_clean_job", "native_custody", "supplier_cost",
+                                     "supplier_retention", "issuer_phase_separation")}}
+    paths = {k: tmp_path / k for k in ("manifest", "admission", "issuer", "verdict")}
+    paths["manifest"].write_text(json.dumps(manifest))
+    paths["admission"].write_text(json.dumps(admission))
+    paths["issuer"].write_text(json.dumps({"token": "SYNTHETIC_READ", "permissions": {
+        "contents": "read", "metadata": "read", "pull_requests": "read"},
+        "repositories": [{"full_name": scope["repository"]}]}))
+    paths["issuer"].chmod(0o600)
+    pr = {"base": {"sha": scope["base"], "repo": {"full_name": scope["repository"]}},
+          "head": {"sha": scope["head"]}, "number": 7, "user": {"login": "writer"},
+          "state": "open", "draft": False}
+    real_run = subprocess.run
+    children = []
+    driver = '''import runpy,sys,socket,os
+from pathlib import Path
+socket.socket.connect=lambda *a,**k: (_ for _ in ()).throw(AssertionError('external network forbidden'))
+ns=runpy.run_path(sys.argv[1],run_name='fixture_two_phase')
+g=ns['gate']
+g.fetch_pr=lambda *a: {'headRefOid':'a'*40,'baseRefOid':'b'*40,'state':'OPEN','isDraft':False}
+g.require_expected_head=lambda *a: None
+g.current_actor=lambda: 'cwl-noema-review[bot]'
+g.require_distinct_pr_author=lambda *a: 'writer'
+g.existing_noema_review=lambda *a: False
+g.fetch_diff=lambda *a: ('fixture',False)
+g.fetch_changed_files=lambda *a: [('fixture.hwpx','modified')]
+def context(*a):
+ if sys.argv[2]=='hwp':
+  from scripts.ci.noema_review_document import extract_review_document
+  text=extract_review_document('fixture.hwpx',b'SYNTHETIC_DOCUMENT_TEXT')
+  assert text=='SYNTHETIC_DOCUMENT_TEXT'
+ return 'fixture'
+g.build_review_context=context
+def model(*a):
+ if sys.argv[2]=='retry':
+  raise g.NoemaTransportError('FIXTURE_CAPACITY_ONLY',capacity_unavailable=True,http_status=429,retry_after_seconds=60)
+ return {'decision':'approve','summary':'FIXTURE_ONLY'}
+g.call_llm=model
+try: sys.exit(ns['main'](sys.argv[3:]))
+except g.NoemaTransportError: sys.exit(1)
+'''
+
+    def boundary(command, **kwargs):
+        """Stub metadata only; execute real child consumers without provider access."""
+        if command[0] == "gh":
+            return subprocess.CompletedProcess(command, 0, stdout=json.dumps(pr))
+        children.append(dict(kwargs["env"]))
+        actual = command[:3] + ["-c", driver, command[3], scenario] + command[4:]
+        result = real_run(actual, **kwargs, capture_output=True, text=True, timeout=30)
+        children[-1]["_fixture_stderr"] = result.stderr
+        children[-1]["_fixture_stdout"] = result.stdout
+        return result
+
+    monkeypatch.setattr(caller.subprocess, "run", boundary)
+    # load_noema_tooling's definition-time runner remains untouched; route only
+    # its subprocess adapter to a real isolated child with inert external sinks.
+    real_load = caller.load_noema_tooling
+    monkeypatch.setattr(caller, "load_noema_tooling",
+                        lambda *a, **kw: real_load(*a, **kw, child_runner=boundary))
+    monkeypatch.setenv("LLM_GATEWAY_API_KEY", "SYNTHETIC_INFERENCE")
+    monkeypatch.setenv("GITHUB_OUTPUT", str(tmp_path / "ambient-output-not-accepted"))
+    monkeypatch.setenv("NOEMA_TRANSPORT_RETRY_ATTEMPT", "0")
+    monkeypatch.setenv("NODE_OPTIONS", "AMBIENT_LOADER_SENTINEL")
+    args = ["--prepare-production", "--tooling-root", str(root),
+            "--manifest", str(paths["manifest"]), "--accepted-digest", hashlib.sha256(paths["manifest"].read_bytes()).hexdigest(),
+            "--admission", str(paths["admission"]), "--admission-digest", hashlib.sha256(paths["admission"].read_bytes()).hexdigest(),
+            "--repo", scope["repository"], "--pr-number", "7", "--expected-head", scope["head"],
+            "--phase-issuance", str(paths["issuer"]), "--verdict-file", str(paths["verdict"])]
+    return args, paths, output, children, context
+
+
+@pytest.mark.parametrize("attempt,eligible,next_attempt", [("1", "true", "2"), ("2", "false", None)])
+def test_actual_child_preserves_capacity_output_and_bounded_retry(tmp_path, monkeypatch, attempt, eligible, next_attempt):
+    """Real unchanged two_phase writes the accepted sink without resetting its bound."""
+    args, paths, output, children, _ = composition(tmp_path, monkeypatch, "retry", attempt)
+    assert caller.production_main(args) == 1
+    values = dict(line.split("=", 1) for line in output.read_text().splitlines())
+    assert values.get("transport_capacity_unavailable") == "true", children[0]["_fixture_stderr"]
+    assert values["transport_retry_eligible"] == eligible
+    assert values.get("transport_retry_next_attempt") == next_attempt
+    assert children[0]["NOEMA_TRANSPORT_RETRY_ATTEMPT"] == attempt
+    assert "NODE_OPTIONS" not in children[0]
+    assert not paths["verdict"].exists()
+
+
+def test_actual_child_hwp_consumer_receives_trusted_reader_and_node(tmp_path, monkeypatch):
+    """Real document consumer and JS wrapper execute with synthetic package bodies."""
+    args, paths, _, children, context = composition(tmp_path, monkeypatch, "hwp")
+    assert caller.production_main(args) == 0, children[0]["_fixture_stderr"]
+    assert paths["verdict"].exists()
+    assert children[0]["NOEMA_HWP_MCP_SOURCE"] == context["NOEMA_HWP_MCP_SOURCE"]
+    assert children[0]["NOEMA_NODE_EXECUTABLE"] == context["NOEMA_NODE_EXECUTABLE"]
+    assert children[0]["PATH"] == "/usr/bin:/bin"
+    assert "NODE_OPTIONS" not in children[0]
diff --git a/tests/test_noema_current_node_byte_drift.py b/tests/test_noema_current_node_byte_drift.py
new file mode 100644
index 0000000000..607fa6fc1d
--- /dev/null
+++ b/tests/test_noema_current_node_byte_drift.py
@@ -0,0 +1,15 @@
+"""New actual executable-byte replacement control, not a forged digest replay."""
+from pathlib import Path
+
+import pytest
+from scripts.ci import premerge_review_tooling as caller
+from tests.test_noema_current_quality_delta import context_fixture
+
+
+def test_actual_node_bytes_change_after_pin_is_rejected(tmp_path):
+    """Keep the real original digest and mutate only independently pinned bytes."""
+    context = context_fixture(tmp_path)
+    node = Path(context["NOEMA_NODE_EXECUTABLE"])
+    node.write_bytes(b"distinct executable after independent pin")
+    with pytest.raises(ValueError, match="Node supplier bytes changed"):
+        caller.accepted_prepare_transport(context)
diff --git a/tests/test_noema_current_quality_delta.py b/tests/test_noema_current_quality_delta.py
new file mode 100644
index 0000000000..4c011a8569
--- /dev/null
+++ b/tests/test_noema_current_quality_delta.py
@@ -0,0 +1,115 @@
+"""New current-source coverage controls; no predecessor cohorts replayed."""
+import hashlib
+import json
+import os
+import runpy
+import sys
+from pathlib import Path
+
+import pytest
+from scripts.ci import premerge_review_tooling as caller
+from scripts.ci import noema_review_document as document
+from tests.test_noema_production_cli_coverage import setup_caller
+
+
+def context_fixture(tmp_path):
+    """Create a minimal pinned regular Node and complete reader namespace."""
+    output = tmp_path / "output"
+    output.touch(mode=0o600)
+    reader = tmp_path / "reader"
+    reader.mkdir()
+    (reader / "body").write_bytes(b"fixture")
+    node = tmp_path / "node"
+    node.write_bytes(b"fixture executable identity")
+    node.chmod(0o700)
+    return {"GITHUB_OUTPUT": str(output), "NOEMA_TRANSPORT_RETRY_ATTEMPT": "0",
+            "NOEMA_HWP_MCP_SOURCE": str(reader), "NOEMA_NODE_EXECUTABLE": str(node),
+            "node_sha256": hashlib.sha256(node.read_bytes()).hexdigest(),
+            "hwp_files": {"body": hashlib.sha256(b"fixture").hexdigest()}}
+
+
+@pytest.mark.parametrize("case", ["none", "output_only", "document_only", "integer_path", "output_relative", "output_hardlink", "empty", "list", "incomplete", "relative_node", "root_symlink", "node_symlink", "nonexecutable", "bad_digest", "empty_inventory", "unsafe_name", "bad_inventory_digest", "supplier_symlink", "supplier_fifo", "root_file", "node_directory", "both", "internal_control"])
+def test_new_prepare_transport_shape_and_capability_cases(tmp_path, case):
+    """Exercise newly introduced helper branches with explicit native file kinds."""
+    context = context_fixture(tmp_path)
+    node, reader = Path(context["NOEMA_NODE_EXECUTABLE"]), Path(context["NOEMA_HWP_MCP_SOURCE"])
+    if case == "none":
+        assert caller.accepted_prepare_transport(None) == {}
+        return
+    if case == "output_only":
+        context = {k: context[k] for k in ("GITHUB_OUTPUT", "NOEMA_TRANSPORT_RETRY_ATTEMPT")}
+    elif case == "document_only":
+        context = {k: v for k, v in context.items() if k not in ("GITHUB_OUTPUT", "NOEMA_TRANSPORT_RETRY_ATTEMPT")}
+    elif case == "integer_path": context["GITHUB_OUTPUT"] = 3
+    elif case == "output_relative": context["GITHUB_OUTPUT"] = "output"
+    elif case == "output_hardlink": os.link(context["GITHUB_OUTPUT"], tmp_path / "second")
+    elif case == "empty": context = {}
+    elif case == "list": context = []
+    elif case == "incomplete": context.pop("node_sha256")
+    elif case == "relative_node": context["NOEMA_NODE_EXECUTABLE"] = "node"
+    elif case == "root_symlink":
+        link = tmp_path / "reader-link"; link.symlink_to(reader); context["NOEMA_HWP_MCP_SOURCE"] = str(link)
+    elif case == "node_symlink":
+        link = tmp_path / "node-link"; link.symlink_to(node); context["NOEMA_NODE_EXECUTABLE"] = str(link)
+    elif case == "nonexecutable": node.chmod(0o600)
+    elif case == "bad_digest": context["node_sha256"] = "bad"
+    elif case == "empty_inventory": context["hwp_files"] = {}
+    elif case == "unsafe_name": context["hwp_files"] = {"../escape": "a" * 64}
+    elif case == "bad_inventory_digest": context["hwp_files"] = {"body": 4}
+    elif case == "supplier_symlink": (reader / "link").symlink_to(reader / "body")
+    elif case == "supplier_fifo": os.mkfifo(reader / "fifo")
+    elif case == "root_file": context["NOEMA_HWP_MCP_SOURCE"] = str(node)
+    elif case == "node_directory": context["NOEMA_NODE_EXECUTABLE"] = str(reader)
+    elif case == "internal_control": context["GITHUB_OUTPUT"] = str(tmp_path / "a\x01b")
+    if case in ("both", "output_only", "document_only"):
+        result = caller.accepted_prepare_transport(context)
+        assert result == {k: v for k, v in context.items() if k not in ("hwp_files", "node_sha256")}
+    else:
+        with pytest.raises(ValueError): caller.accepted_prepare_transport(context)
+
+
+@pytest.mark.parametrize("target", ["manifest", "unchanged"])
+def test_new_live_read_manifest_identity_and_success(tmp_path, monkeypatch, target):
+    """Revalidate manifest rather than admission after a live metadata wait."""
+    args, paths, _, events = setup_caller(tmp_path, monkeypatch, "prepare")
+    original = caller.subprocess.run
+
+    def metadata(*args, **kwargs):
+        """Complete metadata before independently changing the manifest bytes."""
+        response = original(*args, **kwargs)
+        if target == "manifest": paths["manifest"].write_text("{}")
+        return response
+
+    monkeypatch.setattr(caller.subprocess, "run", metadata)
+    assert caller.production_main(args) == (1 if target == "manifest" else 0)
+    assert events == ([] if target == "manifest" else ["prepare"])
+
+
+def test_new_run_mode_admits_output_transport(tmp_path, monkeypatch):
+    """The combined controller's issuance closure validates the new context too."""
+    args, paths, _, events = setup_caller(tmp_path, monkeypatch, "run")
+    data = json.loads(paths["admission"].read_text())
+    output = tmp_path / "accepted-output"; output.touch(mode=0o600)
+    data["prepare_transport"] = {"GITHUB_OUTPUT": str(output), "NOEMA_TRANSPORT_RETRY_ATTEMPT": "2"}
+    paths["admission"].write_text(json.dumps(data))
+    args[args.index("--admission-digest") + 1] = hashlib.sha256(paths["admission"].read_bytes()).hexdigest()
+    assert caller.production_main(args) == 0
+    assert events == ["prepare", "publish"]
+
+
+def test_new_document_cli_explicit_executable_inprocess(tmp_path, monkeypatch):
+    """Execute actual document CLI and Node with only synthetic supplier functions."""
+    import shutil
+    from tests.test_noema_child_environment_composition import composition
+    _, _, _, _, context = composition(tmp_path, monkeypatch, "hwp")
+    # Restore subprocess to the native adapter: composition installs a fixture
+    # controller seam, not a replacement for the actual Node document reader.
+    monkeypatch.undo()
+    monkeypatch.setenv("NOEMA_HWP_MCP_SOURCE", context["NOEMA_HWP_MCP_SOURCE"])
+    monkeypatch.setenv("NOEMA_NODE_EXECUTABLE", context["NOEMA_NODE_EXECUTABLE"])
+    monkeypatch.delenv("NODE_OPTIONS", raising=False)
+    path = tmp_path / "probe.hwpx"; path.write_bytes(b"NEW_DOCUMENT_EXECUTABLE_BOUNDARY")
+    monkeypatch.setattr(sys, "argv", [document.__file__, str(path)])
+    with pytest.raises(SystemExit) as stopped:
+        runpy.run_path(document.__file__, run_name="__main__")
+    assert stopped.value.code == 0
diff --git a/tests/test_noema_current_quality_final_edges.py b/tests/test_noema_current_quality_final_edges.py
new file mode 100644
index 0000000000..1719a50d87
--- /dev/null
+++ b/tests/test_noema_current_quality_final_edges.py
@@ -0,0 +1,48 @@
+"""New unmeasured current executable/error boundaries, not old cohort replay."""
+import subprocess
+from pathlib import Path
+
+import pytest
+from scripts.ci import noema_review_document as document
+from scripts.ci import premerge_review_tooling as caller
+from tests.test_noema_current_quality_delta import context_fixture
+
+
+@pytest.mark.parametrize("case", ["missing_retry", "null_inventory", "extra_file"])
+def test_new_missing_context_and_inventory_topology(tmp_path, case):
+    """Each otherwise-valid accepted context reaches one unmeasured denial."""
+    context = context_fixture(tmp_path)
+    if case == "missing_retry":
+        context.pop("NOEMA_TRANSPORT_RETRY_ATTEMPT")
+    elif case == "null_inventory":
+        context["hwp_files"] = None
+    else:
+        (Path(context["NOEMA_HWP_MCP_SOURCE"]) / "unlisted").write_bytes(b"unlisted supplier")
+    with pytest.raises(ValueError):
+        caller.accepted_prepare_transport(context)
+
+
+@pytest.mark.parametrize("failure", ["timeout", "oserror"])
+def test_new_explicit_node_document_launch_errors(tmp_path, monkeypatch, failure):
+    """The actual consumer honors explicit Node on both native launch exceptions."""
+    reader = tmp_path / "reader"
+    reader.mkdir()
+    node = tmp_path / "explicit-node"
+    monkeypatch.setenv("NOEMA_HWP_MCP_SOURCE", str(reader))
+    monkeypatch.setenv("NOEMA_NODE_EXECUTABLE", str(node))
+    observed = []
+
+    def launch(command, **kwargs):
+        """Record actual consumer argv and raise an inert subprocess boundary error."""
+        observed.append(command)
+        assert command[0] == str(node)
+        assert command[2] == str(reader)
+        assert Path(command[3]).read_bytes() == b"NEW_HWP_BOUNDARY"
+        if failure == "timeout":
+            raise subprocess.TimeoutExpired(command, kwargs["timeout"])
+        raise OSError("FIXTURE_EXECUTABLE_UNAVAILABLE")
+
+    monkeypatch.setattr(document.subprocess, "run", launch)
+    with pytest.raises(document.DocumentReadError, match="timed out|could not start"):
+        document.extract_review_document("new.hwpx", b"NEW_HWP_BOUNDARY")
+    assert len(observed) == 1
diff --git a/tests/test_noema_current_quality_remaining.py b/tests/test_noema_current_quality_remaining.py
new file mode 100644
index 0000000000..12319df764
--- /dev/null
+++ b/tests/test_noema_current_quality_remaining.py
@@ -0,0 +1,44 @@
+"""Unexecuted current-helper edge cases identified by retained arc reconciliation."""
+import hashlib
+import json
+from pathlib import Path
+
+import pytest
+from scripts.ci import premerge_review_tooling as caller
+from tests.test_noema_current_quality_delta import context_fixture
+from tests.test_noema_production_cli_coverage import setup_caller
+
+
+@pytest.mark.parametrize("case", ["boolean_retry", "inventory_list", "bad_hash_length", "nested_reader"])
+def test_new_current_helper_remaining_shapes(tmp_path, case):
+    """Reject distinct malformed shapes and accept an exact nested inventory."""
+    context = context_fixture(tmp_path)
+    if case == "boolean_retry":
+        context["NOEMA_TRANSPORT_RETRY_ATTEMPT"] = True
+    elif case == "inventory_list":
+        context["hwp_files"] = ["body"]
+    elif case == "bad_hash_length":
+        context["hwp_files"] = {"body": "a" * 63}
+    else:
+        root = Path(context["NOEMA_HWP_MCP_SOURCE"])
+        (root / "nested").mkdir()
+        (root / "nested/body").write_bytes(b"nested accepted")
+        context["hwp_files"]["nested/body"] = hashlib.sha256(b"nested accepted").hexdigest()
+        result = caller.accepted_prepare_transport(context)
+        assert result["NOEMA_HWP_MCP_SOURCE"] == str(root)
+        return
+    with pytest.raises(ValueError):
+        caller.accepted_prepare_transport(context)
+
+
+def test_new_admission_only_does_not_consume_prepare_context(tmp_path, monkeypatch):
+    """Preflight with pinned extra context is not phase execution or supplier admission."""
+    args, paths, _, events = setup_caller(tmp_path, monkeypatch, "admit")
+    data = json.loads(paths["admission"].read_text())
+    data["prepare_transport"] = {"GITHUB_OUTPUT": str(tmp_path / "missing-output"),
+                                 "NOEMA_TRANSPORT_RETRY_ATTEMPT": "0"}
+    paths["admission"].write_text(json.dumps(data))
+    args[args.index("--admission-digest") + 1] = hashlib.sha256(paths["admission"].read_bytes()).hexdigest()
+    assert caller.production_main(args) == 0
+    assert events == []
+    assert not (tmp_path / "missing-output").exists()
diff --git a/tests/test_noema_document_reader_dependency_security.py b/tests/test_noema_document_reader_dependency_security.py
new file mode 100644
index 0000000000..e7511447eb
--- /dev/null
+++ b/tests/test_noema_document_reader_dependency_security.py
@@ -0,0 +1,62 @@
+"""Keep the Noema document reader above known vulnerable transitive releases."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+LOCK_FILE = (
+    Path(__file__).resolve().parents[1]
+    / "scripts"
+    / "ci"
+    / "noema-document-reader"
+    / "package-lock.json"
+)
+PACKAGE_FILE = LOCK_FILE.with_name("package.json")
+
+
+def _locked_versions(lock_data: dict[str, object], package_name: str) -> list[tuple[int, ...]]:
+    """Return every hoisted or nested locked release for one package."""
+    package_records = lock_data["packages"]
+    assert isinstance(package_records, dict)
+    path_suffix = f"node_modules/{package_name}"
+    release_versions: list[tuple[int, ...]] = []
+    for package_path, package_data in package_records.items():
+        if package_path != path_suffix and not package_path.endswith(f"/{path_suffix}"):
+            continue
+        assert isinstance(package_data, dict)
+        release_versions.append(tuple(int(part) for part in package_data["version"].split(".")))
+    return release_versions
+
+
+def test_document_reader_transitives_include_security_fixes() -> None:
+    """Reject releases affected by the September 2026 URI and IP advisories."""
+    lock_data = json.loads(LOCK_FILE.read_text(encoding="utf-8"))
+    for package_name, minimum_version in {
+        "fast-uri": (3, 1, 8),
+        "ip-address": (10, 7, 1),
+    }.items():
+        locked_versions = _locked_versions(lock_data, package_name)
+        assert locked_versions
+        assert all(version >= minimum_version for version in locked_versions)
+
+
+def test_nested_vulnerable_transitive_is_detected() -> None:
+    """Do not let a patched hoisted package hide a vulnerable nested copy."""
+    lock_data = {
+        "packages": {
+            "node_modules/ip-address": {"version": "10.7.1"},
+            "node_modules/parent/node_modules/ip-address": {"version": "10.7.0"},
+        }
+    }
+    assert _locked_versions(lock_data, "ip-address") == [(10, 7, 1), (10, 7, 0)]
+
+
+def test_document_reader_source_owns_transitive_security_fixes() -> None:
+    """Require source overrides so lock regeneration preserves the repair."""
+    package_data = json.loads(PACKAGE_FILE.read_text(encoding="utf-8"))
+
+    assert package_data["overrides"] == {
+        "fast-uri": "3.1.8",
+        "ip-address": "10.7.1",
+    }
diff --git a/tests/test_noema_document_reader_runtime_dependencies.py b/tests/test_noema_document_reader_runtime_dependencies.py
new file mode 100644
index 0000000000..6d2441cf02
--- /dev/null
+++ b/tests/test_noema_document_reader_runtime_dependencies.py
@@ -0,0 +1,37 @@
+"""Security contracts for Noema document-reader runtime dependencies."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+
+LOCK_PATH = (
+    Path(__file__).resolve().parents[1]
+    / "scripts"
+    / "ci"
+    / "noema-document-reader"
+    / "package-lock.json"
+)
+
+
+@pytest.mark.parametrize(
+    ("package_name", "safe_version"),
+    (("fast-uri", "3.1.8"), ("ip-address", "10.7.1")),
+)
+def test_noema_document_reader_uses_exclusive_safe_runtime_dependency(
+    package_name: str, safe_version: str
+) -> None:
+    """The lock must contain one exact non-vulnerable transitive package."""
+    lock = json.loads(LOCK_PATH.read_text(encoding="utf-8"))
+    package_path = f"node_modules/{package_name}"
+    matching_packages = {
+        path: metadata
+        for path, metadata in lock["packages"].items()
+        if path == package_path or path.endswith(f"/{package_path}")
+    }
+
+    assert list(matching_packages) == [package_path]
+    assert matching_packages[package_path]["version"] == safe_version
diff --git a/tests/test_noema_draft_admission_before_sidecar.py b/tests/test_noema_draft_admission_before_sidecar.py
index 715f2be495..5a7e72866e 100644
--- a/tests/test_noema_draft_admission_before_sidecar.py
+++ b/tests/test_noema_draft_admission_before_sidecar.py
@@ -19,17 +19,29 @@
 import textwrap
 from pathlib import Path
 
+import pytest
+import yaml
+
 from tests.test_required_workflow_queue_contract import workflow_step, workflow_text
 
 DRAFT_STEP = "Check live pull request draft state before sidecar provisioning"
 DRAFT_GATE = "steps.live_draft.outputs.live_draft != 'true'"
+EXPECTED_UPLOAD_CONDITION = (
+    "always() && env.PR_NUMBER != '' && " + DRAFT_GATE
+    + " && (steps.noema_sidecar.outcome == 'success'"
+    + " || steps.noema_sidecar.outcome == 'failure'"
+    + " || steps.noema_sidecar.outcome == 'cancelled')"
+)
 REVIEWER_TOKEN = (
-    "GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token"
-    " || steps.noema_oidc_token.outputs.token }}"
+    "GH_TOKEN: ${{ env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && "
+    "steps.noema_github_app_token.outputs.token || (env.TARGET_REPOSITORY != "
+    "'ContextualWisdomLab/k-csap-skills' && (secrets.NOEMA_REVIEW_TOKEN || "
+    "steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token)) || '' }}"
 )
 GATED_MODEL_STEPS = (
     "Provision pinned Node.js for Noema document review",
     "Set up lock-compatible sidecar Python",
+    "Admit existing personal LiteLLM auto route",
     "Provision contextual-orchestrator review sidecar",
     "Provision local reviewed HWP document reader",
     "Prepare Noema model verdict",
@@ -46,6 +58,114 @@ def _step_index(job: str, name: str) -> int:
     return job.index(f"      - name: {name}\n")
 
 
+def _parsed_noema_job(workflow: str) -> dict:
+    """Read the actual YAML job, retaining GitHub's literal ``on`` key."""
+    return yaml.load(workflow, Loader=yaml.BaseLoader)["jobs"]["noema-review"]
+
+
+def _sidecar_upload_is_fail_closed(workflow: str) -> bool:
+    """Bind the exact gate to one case-normalized action, never a display-name decoy."""
+    uploads = [
+        step for step in _parsed_noema_job(workflow)["steps"]
+        if str(step.get("uses", "")).casefold().startswith("actions/upload-artifact@")
+    ]
+    if len(uploads) != 1:
+        return False
+    upload = uploads[0]
+    return (
+        upload.get("name") == "Upload contextual-orchestrator sidecar evidence"
+        and upload.get("if") == EXPECTED_UPLOAD_CONDITION
+        and upload.get("with", {}).get("name") == "noema-sidecar-evidence"
+        and "continue-on-error" not in upload
+    )
+
+
+def _noema_review_job_is_fail_closed(workflow: str) -> bool:
+    """The review job itself must propagate upload and producer failures."""
+    return "continue-on-error" not in _parsed_noema_job(workflow)
+
+
+def _upload_admitted(workflow: str, pr: str, draft: str, outcome: str) -> bool:
+    """Evaluate the actual condition's bounded grammar; unknown expressions fail."""
+    uploads = [
+        step for step in _parsed_noema_job(workflow)["steps"]
+        if str(step.get("uses", "")).casefold().startswith("actions/upload-artifact@")
+    ]
+    assert len(uploads) == 1
+    terms = {
+        "always()": True,
+        "env.PR_NUMBER != ''": bool(pr),
+        DRAFT_GATE: draft != "true",
+        "steps.noema_sidecar.outcome == 'success'": outcome == "success",
+        "steps.noema_sidecar.outcome == 'failure'": outcome == "failure",
+        "steps.noema_sidecar.outcome == 'cancelled'": outcome == "cancelled",
+    }
+    values = []
+    for part in uploads[0]["if"].split(" && "):
+        if part.startswith("(") and part.endswith(")"):
+            alternatives = part[1:-1].split(" || ")
+            assert all(term in terms for term in alternatives), part
+            values.append(any(terms[term] for term in alternatives))
+        else:
+            assert part in terms, part
+            values.append(terms[part])
+    return all(values)
+
+
+@pytest.mark.parametrize("pr", ["", "2565"])
+@pytest.mark.parametrize("draft", ["true", "false", ""])
+@pytest.mark.parametrize("outcome", ["", "skipped", "unknown", "success", "failure", "cancelled"])
+def test_upload_admission_requires_current_terminal_producer(pr: str, draft: str, outcome: str) -> None:
+    """Absent/skipped producers cannot publish stale files; terminal diagnostics survive."""
+    admitted = _upload_admitted(workflow_text("noema-review.yml"), pr, draft, outcome)
+    assert admitted == (
+        bool(pr) and draft != "true" and outcome in {"success", "failure", "cancelled"}
+    ), (pr, draft, outcome)
+
+
+def test_upload_action_identity_oracle_rejects_decoys_and_failure_bypasses() -> None:
+    """Keep the owner's unique casefold oracle and quoted/spaced failure controls."""
+    workflow = workflow_text("noema-review.yml")
+    assert _sidecar_upload_is_fail_closed(workflow)
+    assert _noema_review_job_is_fail_closed(workflow)
+    assert not _sidecar_upload_is_fail_closed(
+        workflow.replace(EXPECTED_UPLOAD_CONDITION, EXPECTED_UPLOAD_CONDITION + " || true", 1)
+    )
+    marker = "      - name: Upload contextual-orchestrator sidecar evidence\n"
+    for bypass in ("continue-on-error: true", '"continue-on-error": true', "continue-on-error : true"):
+        assert not _sidecar_upload_is_fail_closed(
+            workflow.replace(marker, marker + "        " + bypass + "\n", 1)
+        ), bypass
+        assert not _noema_review_job_is_fail_closed(
+            workflow.replace("  noema-review:\n", "  noema-review:\n    " + bypass + "\n", 1)
+        ), bypass
+    run_decoy = marker + f"        if: {EXPECTED_UPLOAD_CONDITION}\n        run: 'true'\n\n"
+    assert _sidecar_upload_is_fail_closed(workflow.replace(marker, run_decoy + marker, 1))
+    assert not _sidecar_upload_is_fail_closed(
+        workflow.replace(marker, run_decoy + marker + "        continue-on-error: true\n", 1)
+    )
+    action = next(
+        step["uses"] for step in _parsed_noema_job(workflow)["steps"]
+        if str(step.get("uses", "")).casefold().startswith("actions/upload-artifact@")
+    )
+    mixed_case = workflow.replace(
+        f"uses: {action}", f"uses: Actions/Upload-Artifact@{action.split('@', 1)[1]}", 1
+    )
+    assert mixed_case != workflow
+    assert _sidecar_upload_is_fail_closed(mixed_case)
+    action_decoy = (
+        marker + f"        if: {EXPECTED_UPLOAD_CONDITION}\n        uses: {action}\n"
+        + "        with:\n          name: noema-sidecar-evidence\n          path: CHANGELOG.md\n\n"
+    )
+    assert not _sidecar_upload_is_fail_closed(mixed_case.replace(marker, action_decoy + marker, 1))
+    assert not _sidecar_upload_is_fail_closed(mixed_case.replace(
+        marker, action_decoy + marker + "        continue-on-error: true\n", 1
+    ))
+    assert _noema_review_job_is_fail_closed(workflow.replace(
+        "  continue-noema-transport:\n", "  continue-noema-transport:\n    continue-on-error: true\n", 1
+    ))
+
+
 def test_live_draft_check_runs_after_head_validation_and_before_sidecar() -> None:
     """The draft decision sits between live-head validation and model provisioning."""
     job = _noema_job()
@@ -73,7 +193,8 @@ def test_live_draft_step_reads_the_live_pull_request_with_the_reviewer_token() -
     assert 'gh api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}"' in step
     assert 'gh api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}"' in validate
     assert "jq -e -s" in step
-    assert "set -e" not in step
+    assert "set -uo pipefail" not in step
+    assert "set -euo pipefail" in step
     # Ruleset-launched runs never see ready_for_review, so neither this check
     # nor any trigger-level filter may trust the event's draft snapshot.
     assert "github.event.pull_request.draft" not in workflow
@@ -84,7 +205,25 @@ def test_model_heavy_steps_are_gated_on_the_live_draft_output() -> None:
     workflow = workflow_text("noema-review.yml")
     for name in GATED_MODEL_STEPS:
         step = workflow_step(workflow, name)
-        assert f"if: env.PR_NUMBER != '' && {DRAFT_GATE}\n" in step, name
+        expected = f"env.PR_NUMBER != '' && {DRAFT_GATE}"
+        if name == "Provision contextual-orchestrator review sidecar":
+            expected += " && steps.personal_route.outputs.selected != 'true'"
+        condition = next(line.strip()[4:] for line in step.splitlines()
+                         if line.strip().startswith("if: "))
+        assert condition == expected, name
+        # Evaluate every supported conjunction, so draft=true denies both routes;
+        # additional OR terms or omitted guards fail the exact contract above.
+        for pr in ("", "2565"):
+            for draft in ("true", "false", ""):
+                for personal in ("true", "false", ""):
+                    terms = {"env.PR_NUMBER != ''": bool(pr),
+                             DRAFT_GATE: draft != "true",
+                             "steps.personal_route.outputs.selected != 'true'": personal != "true"}
+                    admitted = all(terms[term] for term in condition.split(" && "))
+                    wanted = bool(pr) and draft != "true"
+                    if name == "Provision contextual-orchestrator review sidecar":
+                        wanted = wanted and personal != "true"
+                    assert admitted == wanted, (name, pr, draft, personal)
 
 
 def test_downstream_publication_treats_unset_prepare_outputs_as_skipped() -> None:
@@ -99,9 +238,8 @@ def test_downstream_publication_treats_unset_prepare_outputs_as_skipped() -> Non
     assert "needs.noema-review.result == 'failure'" in continuation
     assert "needs.noema-review.outputs.transport_capacity_unavailable == 'true'" in continuation
     assert "needs.noema-review.outputs.transport_retry_eligible == 'true'" in continuation
-    assert "if: always() && env.PR_NUMBER != ''" in workflow_step(
-        workflow, "Upload contextual-orchestrator sidecar evidence"
-    )
+    assert _noema_review_job_is_fail_closed(workflow)
+    assert _sidecar_upload_is_fail_closed(workflow)
 
 
 def test_trigger_types_are_unchanged_by_the_runtime_draft_check() -> None:
@@ -113,12 +251,13 @@ def test_trigger_types_are_unchanged_by_the_runtime_draft_check() -> None:
     )
 
 
-def _run_draft_step(tmp_path: Path, gh_body: str) -> tuple[subprocess.CompletedProcess[str], dict[str, str]]:
+def _run_draft_step(tmp_path: Path, gh_body: str, gh_token: str = "synthetic-token") -> tuple[subprocess.CompletedProcess[str], dict[str, str]]:
     """Execute the draft step's bash with a fake ``gh`` and return its outputs."""
     bash_executable = shutil.which("bash") or "/bin/bash"
     script = textwrap.dedent(
         workflow_step(workflow_text("noema-review.yml"), DRAFT_STEP).split("        run: |\n", 1)[1]
     )
+    script = script.replace("/tmp/noema-live-draft-error", str(tmp_path / "live-draft-error"))
     fake_gh = tmp_path / "gh"
     fake_gh.write_text(f"#!/usr/bin/env bash\n{gh_body}\n", encoding="utf-8")
     fake_gh.chmod(0o755)
@@ -131,7 +270,7 @@ def _run_draft_step(tmp_path: Path, gh_body: str) -> tuple[subprocess.CompletedP
             "PATH": f"{tmp_path}{os.pathsep}{os.environ.get('PATH', '')}",
             "TARGET_REPOSITORY": "ContextualWisdomLab/example",
             "PR_NUMBER": "7",
-            "GH_TOKEN": "synthetic-token",
+            "GH_TOKEN": gh_token,
             "GITHUB_OUTPUT": str(output),
         },
         capture_output=True,
@@ -150,6 +289,16 @@ def _live_pr(draft: object) -> str:
     return f"printf '%s' '{payload}'"
 
 
+def test_live_draft_missing_token_fails_closed_before_lookup(tmp_path: Path) -> None:
+    """Missing reviewer authority cannot proceed to a live lookup or model setup."""
+    marker = tmp_path / "lookup-reached"
+    result, outputs = _run_draft_step(tmp_path, f"touch '{marker}'", gh_token="")
+    assert result.returncode != 0
+    assert outputs == {}
+    assert not marker.exists()
+    assert "::error::" in result.stdout
+
+
 def test_live_draft_pr_skips_model_review_with_a_clear_notice(tmp_path: Path) -> None:
     """A live draft sets live_draft=true and explains the skip; the step succeeds."""
     result, outputs = _run_draft_step(tmp_path, _live_pr(True))
diff --git a/tests/test_noema_existing_app_composition.py b/tests/test_noema_existing_app_composition.py
new file mode 100644
index 0000000000..8de60f7dc8
--- /dev/null
+++ b/tests/test_noema_existing_app_composition.py
@@ -0,0 +1,384 @@
+"""Source-only existing-App issuer controls; keys and HTTP are synthetic."""
+import json
+import shutil
+import subprocess
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+HELPER = ROOT / 'scripts/ci/noema_existing_app_issuer.cjs'
+
+
+def test_workflow_uses_existing_secret_for_both_short_lived_issuer_phases():
+    """No missing JWT-file supplier or token-action output masquerades as issuer."""
+    text=(ROOT/'.github/workflows/noema-review.yml').read_text()
+    prepare=text.split('      - name: Prepare Noema model verdict\n',1)[1].split('      - name:',1)[0]
+    publish=text.split('      - name: Publish prepared Noema verdict on the exact live head\n',1)[1].split('\n  continue-noema-transport:',1)[0]
+    for phase,block in (('prepare',prepare),('publish',publish)):
+        assert 'node "$GITHUB_WORKSPACE/scripts/ci/noema_existing_app_issuer.cjs"' in block
+        assert '--phase '+phase in block
+        assert 'NOEMA_GITHUB_APP_CLIENT_ID: ${{ vars.NOEMA_GITHUB_APP_CLIENT_ID }}' in block
+        assert 'NOEMA_GITHUB_APP_PRIVATE_KEY: ${{ secrets.NOEMA_GITHUB_APP_PRIVATE_KEY }}' in block
+        assert '--app-jwt-file' not in block
+        assert '--phase-issuance' not in block
+        assert 'python3 -I -B "$GITHUB_WORKSPACE/scripts/ci/premerge_review_tooling.py"' not in block
+    assert text.index('      - name: Revalidate prepared scope before publisher credential refresh') < text.index('      - name: Refresh repository-scoped Noema GitHub App token for publication')
+
+
+def test_existing_app_signing_original_body_controller_and_cleanup(tmp_path):
+    """Real RSA signing and private delivery feed the controller, then revoke."""
+    assert HELPER.exists(), 'existing Secret to original issuer response composition is missing'
+    import hashlib
+    import sys
+    from tests.test_noema_issuer_producer_controls import bootstrap_case
+    private, source, entry, _, admission = bootstrap_case(tmp_path)
+    scope = {'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+             'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    entry.write_text('import os,sys\nfrom pathlib import Path\n'
+        'assert os.environ["GH_TOKEN"]=="FIXTURE_WRITE"\n'
+        'assert "NOEMA_GITHUB_APP_PRIVATE_KEY" not in os.environ\n'
+        'assert "NOEMA_LLM_API_KEY" not in os.environ\n'
+        'p=Path(sys.argv[sys.argv.index("--publish-verdict-file")+1]);p.unlink()\n')
+    manifest = {'schema_version':1,'repository':'ContextualWisdomLab/.github','commit':'c'*40,
+                'tree':'d'*40,'entrypoint':entry.relative_to(source).as_posix(),
+                'files':{entry.relative_to(source).as_posix():hashlib.sha256(entry.read_bytes()).hexdigest()}}
+    admission.update(scope=scope,installation_id=7,app_id=11)
+    tooling=private/'tooling';(tooling/entry.relative_to(source)).parent.mkdir(parents=True)
+    (tooling/entry.relative_to(source)).write_bytes(entry.read_bytes())
+    mf,af=tmp_path/'manifest',tmp_path/'admission';mf.write_text(json.dumps(manifest));af.write_text(json.dumps(admission))
+    envelope={'schema_version':1,'repository':scope['repository'],'pull_request_number':7,
+              'expected_head':scope['head'],'expected_base':scope['base'],'reviewer_actor':scope['reviewer'],
+              'pull_request_author':'writer','verdict':{'decision':'approve'}}
+    verdict=private/'verdict.json';verdict.write_text(json.dumps(envelope));verdict.chmod(0o600)
+    pr={'base':{'sha':scope['base'],'repo':{'full_name':scope['repository']}},'head':{'sha':scope['head']},
+        'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    gh=tmp_path/'gh';gh.write_text('#!/bin/sh\n[ "$GH_TOKEN" = FIXTURE_READ_0 ] || exit 77\n'+"printf '%s' '"+json.dumps(pr)+"'\n");gh.chmod(0o755)
+    config={'python':sys.executable,'controller':str(ROOT/'scripts/ci/premerge_review_tooling.py'),
+            'path':str(tmp_path)+':/usr/bin:/bin','args':['--publish-production','--tooling-root',str(tooling),
+            '--manifest',str(mf),'--accepted-digest',hashlib.sha256(mf.read_bytes()).hexdigest(),
+            '--admission',str(af),'--admission-digest',hashlib.sha256(af.read_bytes()).hexdigest(),
+            '--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head'],'--verdict-file',str(verdict)]}
+    configpath=tmp_path/'config.json';configpath.write_text(json.dumps(config))
+    script = tmp_path/'composition.cjs'
+    script.write_text(r'''
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const issuer = require(process.argv[2]);
+(async () => {
+ const {privateKey, publicKey} = crypto.generateKeyPairSync('rsa', {modulusLength:2048});
+ const jwt = issuer.signApp('Iv1.fixture', privateKey.export({type:'pkcs8',format:'pem'}), 2000000000);
+ const pieces = jwt.split('.');
+ const claims = JSON.parse(Buffer.from(pieces[1], 'base64url'));
+ assert.equal(claims.iss, 'Iv1.fixture');
+ assert.equal(claims.iat, 1999999940); assert.equal(claims.exp, 2000000300);
+ assert(crypto.verify('RSA-SHA256', Buffer.from(pieces.slice(0,2).join('.')), publicKey, Buffer.from(pieces[2],'base64url')));
+ const parent=path.join(process.argv[3],'private');
+ const events=[];let lastBody;const rawTokens=[];
+ const scope={repository:'ContextualWisdomLab/example',number:7,head:'a'.repeat(40),base:'b'.repeat(40),author:'writer',reviewer:'cwl-noema-review[bot]'};
+ const transport=async(method,route,payload,credential)=>{
+  events.push([method,route]);assert(credential);
+  if(route==='/app')return Buffer.from('{"id":11,"slug":"cwl-noema-review"}');
+  if(route.endsWith('/installation'))return Buffer.from('{"id":7,"app_id":11}');
+  if(method==='DELETE')return Buffer.alloc(0);
+  const token=payload.permissions.pull_requests==='write'?'FIXTURE_WRITE':'FIXTURE_READ_'+rawTokens.length;
+  rawTokens.push(token);
+  const raw=Buffer.from(JSON.stringify({token,expires_at:'2033-05-18T04:33:20Z',permissions:payload.permissions,repositories:[{full_name:scope.repository}]}));
+  lastBody=raw;return raw;
+ };
+ let fenced=false;
+ const cfg=JSON.parse(fs.readFileSync(process.argv[4]));
+ const controller=async(file,env)=>{
+    assert(fenced);assert.deepEqual(fs.readFileSync(file),lastBody);
+    assert.equal(fs.statSync(file).mode&0o777,0o600);assert.equal(fs.statSync(file).nlink,1);
+    assert(!('NOEMA_GITHUB_APP_PRIVATE_KEY' in env));
+    assert(!('LLM_GATEWAY_API_KEY' in env));assert(!('NOEMA_LLM_API_KEY' in env));
+    const result=require('node:child_process').spawnSync(cfg.python,['-I','-B',cfg.controller,...cfg.args,'--phase-issuance',file],
+      {env:{PATH:cfg.path,GH_TOKEN:env.GH_TOKEN},encoding:'utf8',timeout:15000});
+    assert.equal(result.status,0,'real Python controller and inert publisher child refused');return result.status;
+ };
+ await issuer.runPhase({phase:'publish',scope,appId:11,installationId:7,privateParent:parent,
+   clientId:'Iv1.fixture',privateKey:privateKey.export({type:'pkcs8',format:'pem'}),now:()=>2000000000,
+   transport,fence:async(token,phase)=>{assert(token.startsWith('FIXTURE_READ'));assert.equal(phase,'publish');fenced=true;},
+   controller});
+ assert.equal(events.filter(e=>e[0]==='DELETE').length,2);
+ assert(!fs.existsSync(path.join(parent,'publish.json')));
+ assert.equal(rawTokens.length,2);
+ console.log('SYNTHETIC_COMPOSITION_PASS');
+})().catch(()=>{console.error('SYNTHETIC_COMPOSITION_FAIL');process.exitCode=1});
+''')
+    result = subprocess.run([shutil.which('node'),str(script),str(HELPER),str(tmp_path),str(configpath)],
+                            env={'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=20)
+    assert result.returncode == 0 and result.stdout.strip() == 'SYNTHETIC_COMPOSITION_PASS', result.stderr
+
+
+def test_real_issuer_main_fences_then_runs_prepare_and_publish_without_external_jwt(tmp_path):
+    """Execute both real CLIs with only synthetic HTTPS and inert phase children."""
+    import hashlib
+    import sys
+    from tests.test_noema_issuer_producer_controls import bootstrap_case
+    private, source, entry, _, admission=bootstrap_case(tmp_path)
+    scope={'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+           'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    envelope={'schema_version':1,'repository':scope['repository'],'pull_request_number':7,
+              'expected_head':scope['head'],'expected_base':scope['base'],'reviewer_actor':scope['reviewer'],
+              'pull_request_author':'writer','verdict':{'decision':'approve'}}
+    entry.write_text('import os,sys\nfrom pathlib import Path\n'
+        'a=sys.argv\n'
+        'assert "NOEMA_GITHUB_APP_PRIVATE_KEY" not in os.environ\n'
+        'if "--prepare-verdict-file" in a:\n'
+        ' assert os.environ["GH_TOKEN"]=="MAIN_READ_0"\n'
+        ' assert os.environ["NOEMA_LLM_MODEL"]=="auto"\n'
+        ' p=Path(a[a.index("--prepare-verdict-file")+1]);p.write_text('+repr(json.dumps(envelope))+');p.chmod(0o600)\n'
+        'else:\n'
+        ' assert os.environ["GH_TOKEN"]=="MAIN_WRITE_2"\n'
+        ' assert "LLM_GATEWAY_API_KEY" not in os.environ and "NOEMA_LLM_API_KEY" not in os.environ\n'
+        ' p=Path(a[a.index("--publish-verdict-file")+1]);Path(str(p)+".marker").write_text("INERT_NATIVE_PUBLISH");p.unlink()\n')
+    mf,af=tmp_path/'manifest',tmp_path/'admission'
+    manifest={'schema_version':1,'repository':'ContextualWisdomLab/.github','commit':'c'*40,'tree':'d'*40,
+              'entrypoint':entry.relative_to(source).as_posix(),
+              'files':{entry.relative_to(source).as_posix():hashlib.sha256(entry.read_bytes()).hexdigest()}}
+    node=Path(shutil.which('node')).resolve()
+    admission.update(scope=scope,installation_id=7,app_id=11)
+    admission['dependencies'][str(node)]=hashlib.sha256(node.read_bytes()).hexdigest()
+    mf.write_text(json.dumps(manifest));af.write_text(json.dumps(admission))
+    from scripts.ci import noema_bootstrap_producer as producer
+    producer.materialize_tooling(source,private/'tooling',mf.read_bytes(),accepted_digest=hashlib.sha256(mf.read_bytes()).hexdigest(),
+                                 admission=admission,private_parent=private)
+    pr={'base':{'sha':scope['base'],'repo':{'full_name':scope['repository']}},'head':{'sha':scope['head']},
+        'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    gh=tmp_path/'gh';gh.write_text('#!/bin/sh\ncase "$GH_TOKEN" in MAIN_READ_0|MAIN_READ_1) ;; *) exit 77;; esac\n'+"printf '%s' '"+json.dumps(pr)+"'\n");gh.chmod(0o755)
+    common=['--private-parent',str(private),'--source-root',str(source),'--manifest',str(mf),
+            '--accepted-digest',hashlib.sha256(mf.read_bytes()).hexdigest(),'--admission',str(af),
+            '--admission-digest',hashlib.sha256(af.read_bytes()).hexdigest(),'--repo',scope['repository'],
+            '--pr-number','7','--expected-head',scope['head'],'--verdict-file',str(private/'verdict.json')]
+    cfg=tmp_path/'cfg.json';cfg.write_text(json.dumps({'common':common,'path':str(tmp_path)+':/usr/bin:/bin','parent':str(private)}))
+    script=tmp_path/'main.cjs'
+    script.write_text(r'''
+const assert=require('node:assert/strict'),fs=require('node:fs'),crypto=require('node:crypto'),https=require('node:https');
+const {EventEmitter}=require('node:events');const helper=require(process.argv[2]);
+const config=JSON.parse(fs.readFileSync(process.argv[3]));const events=[];let issued=0;
+https.request=(options,callback)=>{
+ const req=new EventEmitter();let body='';req.setTimeout=()=>{};req.write=chunk=>{body+=chunk};req.destroy=()=>{};
+ req.end=()=>{
+  events.push([options.method,options.path]);
+  assert.equal(options.hostname,'api.github.com');
+  assert(!('NOEMA_GITHUB_APP_PRIVATE_KEY' in options));
+  let raw;const res=new EventEmitter();res.statusCode=options.method==='DELETE'?204:options.method==='POST'?201:200;res.complete=true;
+  if(options.path==='/app')raw=Buffer.from('{"id":11,"slug":"cwl-noema-review"}');
+  else if(options.path.endsWith('/installation'))raw=Buffer.from('{"id":7,"app_id":11}');
+  else if(options.method==='DELETE')raw=Buffer.alloc(0);
+  else {const p=JSON.parse(body);if(p.permissions.pull_requests==='write')assert(fs.existsSync(config.parent+'/verdict.json'));
+    raw=Buffer.from(JSON.stringify({token:(p.permissions.pull_requests==='write'?'MAIN_WRITE_':'MAIN_READ_')+(issued++),
+    expires_at:new Date(Date.now()+3600000).toISOString(),permissions:p.permissions,repositories:[{full_name:'ContextualWisdomLab/example'}]}));}
+  res.headers={'content-length':String(raw.length)};callback(res);
+  queueMicrotask(()=>{res.emit('data',raw);res.emit('end')});
+ };return req;
+};
+(async()=>{
+ const pair=crypto.generateKeyPairSync('rsa',{modulusLength:2048});
+ const env={PATH:config.path,NOEMA_GITHUB_APP_CLIENT_ID:'Iv1.fixture',NOEMA_GITHUB_APP_PRIVATE_KEY:pair.privateKey.export({type:'pkcs8',format:'pem'}),LLM_GATEWAY_API_KEY:'SYNTHETIC_EXISTING_INFERENCE'};
+ assert.equal(await helper.main(['--phase','prepare',...config.common],env),0,'real prepare fence or controller missing');
+ assert.equal(await helper.main(['--phase','publish',...config.common],env),0,'real publisher composition missing');
+ assert.equal(issued,3);assert.equal(events.filter(x=>x[0]==='DELETE').length,3);
+ assert.equal(fs.readFileSync(config.parent+'/verdict.json.marker','utf8'),'INERT_NATIVE_PUBLISH');
+ console.log('MAIN_COMPOSITION_PASS');
+})().catch(()=>{console.error('MAIN_COMPOSITION_FAIL');process.exitCode=1});
+''')
+    result=subprocess.run([str(node),str(script),str(HELPER),str(cfg)],env={'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=25)
+    assert result.returncode==0 and result.stdout.strip()=='MAIN_COMPOSITION_PASS','real prepare fence or controller missing: '+result.stderr
+
+
+def test_issuer_parses_duplicate_responses_fail_closed_and_cleans_token(tmp_path):
+    """Duplicate permission keys cannot rewrite an original grant into acceptance."""
+    script=tmp_path/'duplicate.cjs'
+    script.write_text(r'''
+const assert=require('node:assert/strict'),fs=require('node:fs'),crypto=require('node:crypto');const issuer=require(process.argv[2]);
+(async()=>{
+ const parent=process.argv[3]+'/private';fs.mkdirSync(parent,{mode:0o700});let deletes=0,controller=0;
+ const key=crypto.generateKeyPairSync('rsa',{modulusLength:2048}).privateKey.export({type:'pkcs8',format:'pem'});
+ await assert.rejects(issuer.runPhase({phase:'prepare',scope:{repository:'ContextualWisdomLab/example',reviewer:'cwl-noema-review[bot]'},appId:11,installationId:7,
+  privateParent:parent,clientId:'Iv1.fixture',privateKey:key,now:()=>2000000000,
+  transport:async(method,route)=>{
+   if(method==='DELETE'){deletes++;return Buffer.alloc(0);}
+   if(route==='/app')return Buffer.from('{"id":11,"slug":"cwl-noema-review"}');
+   if(route.endsWith('/installation'))return Buffer.from('{"id":7,"app_id":11}');
+   return Buffer.from('{"token":"DUPLICATE_FIXTURE","expires_at":"2033-05-18T04:33:20Z","permissions":{"contents":"write","contents":"read","metadata":"read","pull_requests":"read"},"repositories":[{"full_name":"ContextualWisdomLab/example"}]}');
+  },fence:async()=>{},controller:async()=>{controller++;return 0;}}));
+ assert.equal(controller,0);assert.equal(deletes,1,'safely parsed unique token lost revocation custody');
+ console.log('DUPLICATE_REJECTED');
+})().catch(()=>{console.error('DUPLICATE_FAIL');process.exitCode=1});
+''')
+    result=subprocess.run([shutil.which('node'),str(script),str(HELPER),str(tmp_path)],env={'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=15)
+    assert result.returncode==0 and result.stdout.strip()=='DUPLICATE_REJECTED', 'duplicate original grant accepted or cleanup lost'
+
+
+def test_fixed_origin_http_response_framing_and_missing_signer_refuse(tmp_path):
+    """Characterize bounded original-body framing with synthetic HTTP events."""
+    script=tmp_path/'framing.cjs'
+    script.write_text(r'''
+const assert=require('node:assert/strict'),https=require('node:https'),{EventEmitter}=require('node:events');
+const issuer=require(process.argv[2]);
+(async()=>{
+ for(const mutation of ['complete','short','redirect','oversize','incomplete']){
+  https.request=(opts,callback)=>{
+   assert.equal(opts.hostname,'api.github.com');assert.equal(opts.port,443);
+   const req=new EventEmitter();req.setTimeout=()=>{};req.write=()=>{};req.end=()=>{
+    const res=new EventEmitter();res.statusCode=mutation==='redirect'?302:200;
+    res.complete=mutation!=='incomplete';res.destroy=()=>{};
+    const raw=mutation==='oversize'?Buffer.alloc(2*1024*1024+1):Buffer.from('{"ok":true}');
+    res.headers={'content-length':String(raw.length+(mutation==='short'?3:0))};callback(res);
+    queueMicrotask(()=>{res.emit('data',raw);res.emit('end')});
+   };return req;
+  };
+  if(mutation==='complete')assert.deepEqual(await issuer.transport('GET','/app',null,'FIXTURE_JWT'),Buffer.from('{"ok":true}'));
+  else await assert.rejects(issuer.transport('GET','/app',null,'FIXTURE_JWT'));
+ }
+ assert.throws(()=>issuer.signApp('Iv1.fixture','',2000000000));
+ await assert.rejects(issuer.transport('GET','/foreign',null,'FIXTURE_JWT'));
+ console.log('HTTP_CONTROLS_PASS');
+})().catch(()=>{console.error('HTTP_CONTROLS_FAIL');process.exitCode=1});
+''')
+    result=subprocess.run([shutil.which('node'),str(script),str(HELPER)],env={'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=15)
+    assert result.returncode==0 and result.stdout.strip()=='HTTP_CONTROLS_PASS',result.stderr
+
+
+def test_write_scope_revocation_during_app_wait_never_posts_write(tmp_path):
+    """A scope change while publisher authentication waits must block write POST."""
+    script=tmp_path/'wait.cjs'
+    script.write_text(r'''
+const assert=require('node:assert/strict'),fs=require('node:fs'),crypto=require('node:crypto');const issuer=require(process.argv[2]);
+(async()=>{
+ const parent=process.argv[3]+'/private';fs.mkdirSync(parent,{mode:0o700});let appReads=0,writes=0,revoked=false,deletes=0;
+ const key=crypto.generateKeyPairSync('rsa',{modulusLength:2048}).privateKey.export({type:'pkcs8',format:'pem'});
+ await assert.rejects(issuer.runPhase({phase:'publish',scope:{repository:'ContextualWisdomLab/example',reviewer:'cwl-noema-review[bot]'},appId:11,installationId:7,
+  privateParent:parent,clientId:'Iv1.fixture',privateKey:key,now:()=>2000000000,
+  transport:async(method,route,payload)=>{
+   if(method==='DELETE'){deletes++;return Buffer.alloc(0);}
+   if(route==='/app'){if(++appReads===2)revoked=true;return Buffer.from('{"id":11,"slug":"cwl-noema-review"}');}
+   if(route.endsWith('/installation'))return Buffer.from('{"id":7,"app_id":11}');
+   if(payload.permissions.pull_requests==='write')writes++;
+   return Buffer.from(JSON.stringify({token:'WAIT_FIXTURE',expires_at:'2033-05-18T04:33:20Z',permissions:payload.permissions,repositories:[{full_name:'ContextualWisdomLab/example'}]}));
+  },fence:async()=>{if(revoked)throw Error('SCOPE_REVOKED');},controller:async()=>0}));
+ assert.equal(writes,0,'scope revoked during App authentication reached write issuance');assert.equal(deletes,1);
+ console.log('WAIT_REVOKED');
+})().catch(()=>{console.error('WAIT_FAIL');process.exitCode=1});
+''')
+    result=subprocess.run([shutil.which('node'),str(script),str(HELPER),str(tmp_path)],env={'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=15)
+    assert result.returncode==0 and result.stdout.strip()=='WAIT_REVOKED','scope revoked during App authentication reached write issuance'
+
+
+def test_prepublication_action_never_mints_unused_write_capability():
+    """Only the original-response issuer may mint the actual publisher grant."""
+    text=(ROOT/'.github/workflows/noema-review.yml').read_text()
+    refresh=text.split('      - name: Refresh repository-scoped Noema GitHub App token for publication\n',1)[1].split('      - name:',1)[0]
+    assert 'permission-pull-requests: write' not in refresh, 'unused action write token minted before original-response issuer'
+    assert 'permission-pull-requests: read' in refresh
+
+
+def test_issuer_main_refuses_unpinned_python_before_executing_it(tmp_path):
+    """Accepted admission must bind executable bytes before any subprocess spawn."""
+    import hashlib
+    import sys
+    from tests.test_noema_issuer_producer_controls import bootstrap_case
+    private,source,entry,raw,admission=bootstrap_case(tmp_path)
+    marker=tmp_path/'executed'
+    fake=tmp_path/'fake-python';fake.write_text('#!/bin/sh\nprintf RUN > '+str(marker)+'\nexit 0\n');fake.chmod(0o755)
+    admission['interpreter']={'path':str(fake),'sha256':'0'*64}
+    admission.update(scope={'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+                            'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'},
+                     app_id=11,installation_id=7)
+    node=Path(shutil.which('node')).resolve();admission['dependencies'][str(node)]=hashlib.sha256(node.read_bytes()).hexdigest()
+    mf,af=tmp_path/'manifest',tmp_path/'admission';mf.write_bytes(raw);af.write_text(json.dumps(admission))
+    args=['--phase','prepare','--private-parent',str(private),'--source-root',str(source),
+          '--manifest',str(mf),'--accepted-digest',hashlib.sha256(raw).hexdigest(),
+          '--admission',str(af),'--admission-digest',hashlib.sha256(af.read_bytes()).hexdigest(),
+          '--repo','ContextualWisdomLab/example','--pr-number','7','--expected-head','a'*40,
+          '--verdict-file',str(private/'verdict.json')]
+    cfg=tmp_path/'config.json';cfg.write_text(json.dumps(args))
+    script=tmp_path/'python-pin.cjs'
+    script.write_text(r'''
+const fs=require('node:fs'),crypto=require('node:crypto'),https=require('node:https'),{EventEmitter}=require('node:events');
+const issuer=require(process.argv[2]);
+https.request=(opts,callback)=>{const req=new EventEmitter();req.setTimeout=()=>{};req.write=()=>{};req.end=()=>{
+ const raw=Buffer.from(opts.path==='/app'?'{"id":11,"slug":"cwl-noema-review"}':opts.path.endsWith('/installation')?'{"id":7,"app_id":11}':opts.method==='DELETE'?'':JSON.stringify({token:'INTERPRETER_FIXTURE',expires_at:new Date(Date.now()+3600000).toISOString(),permissions:{contents:'read',metadata:'read',pull_requests:'read'},repositories:[{full_name:'ContextualWisdomLab/example'}]}));
+ const res=new EventEmitter();res.statusCode=opts.method==='DELETE'?204:opts.method==='POST'?201:200;res.complete=true;res.headers={'content-length':String(raw.length)};callback(res);queueMicrotask(()=>{res.emit('data',raw);res.emit('end')});};return req;};
+const key=crypto.generateKeyPairSync('rsa',{modulusLength:2048}).privateKey.export({type:'pkcs8',format:'pem'});
+issuer.main(JSON.parse(fs.readFileSync(process.argv[3])),{PATH:'/usr/bin:/bin',NOEMA_GITHUB_APP_CLIENT_ID:'Iv1.fixture',NOEMA_GITHUB_APP_PRIVATE_KEY:key}).then(()=>{process.exitCode=2}).catch(()=>{process.exitCode=1});
+''')
+    result=subprocess.run([str(node),str(script),str(HELPER),str(cfg)],env={'PATH':'/usr/bin:/bin'},
+        capture_output=True,text=True,timeout=15)
+    assert result.returncode != 0
+    assert not marker.exists(), 'unadmitted executable ran before interpreter byte check'
+
+
+def test_multi_hour_preparation_settles_expired_read_grant_without_blocking_result(tmp_path):
+    """Known expiry after the model is not an unconfirmed live credential leak."""
+    script=tmp_path/'long-model.cjs'
+    script.write_text(r'''
+const assert=require('node:assert/strict'),fs=require('node:fs'),crypto=require('node:crypto');const issuer=require(process.argv[2]);
+(async()=>{
+ const parent=process.argv[3]+'/private';fs.mkdirSync(parent,{mode:0o700});let now=2000000000,deletes=0;
+ const key=crypto.generateKeyPairSync('rsa',{modulusLength:2048}).privateKey.export({type:'pkcs8',format:'pem'});
+ const outcome=await issuer.runPhase({phase:'prepare',scope:{repository:'ContextualWisdomLab/example',reviewer:'cwl-noema-review[bot]'},appId:11,installationId:7,
+  privateParent:parent,clientId:'Iv1.fixture',privateKey:key,now:()=>now,
+  transport:async(method,route,payload)=>{
+   if(method==='DELETE'){deletes++;const error=Error('FIXTURE_EXPIRED');error.statusCode=401;throw error;}
+   if(route==='/app')return Buffer.from('{"id":11,"slug":"cwl-noema-review"}');
+   if(route.endsWith('/installation'))return Buffer.from('{"id":7,"app_id":11}');
+   return Buffer.from(JSON.stringify({token:'LONG_MODEL_READ_ONLY',expires_at:new Date((now+3600)*1000).toISOString(),permissions:payload.permissions,repositories:[{full_name:'ContextualWisdomLab/example'}]}));
+  },fence:async()=>{},controller:async()=>{now+=10800;return 0;}});
+ assert.equal(outcome,0);assert.equal(deletes,1);assert(!fs.existsSync(parent+'/prepare.json'));
+ console.log('LONG_MODEL_PASS');
+})().catch(()=>{console.error('LONG_MODEL_FAIL');process.exitCode=1});
+''')
+    result=subprocess.run([shutil.which('node'),str(script),str(HELPER),str(tmp_path)],env={'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=15)
+    assert result.returncode==0 and result.stdout.strip()=='LONG_MODEL_PASS','expired readonly cleanup blocks completed multi-hour model'
+
+
+def test_prepare_controller_does_not_impose_a_model_deadline():
+    """The new wrapper must preserve the existing unlimited inference contract."""
+    source=HELPER.read_text()
+    assert "timeout:phase==='prepare'?" not in source, 'issuer adds a fixed model deadline'
+
+
+def test_rejected_grants_and_downstream_errors_keep_revocation_custody(tmp_path):
+    """Exercise new issuer negatives without touching completed composition cases."""
+    script=tmp_path/'controls.cjs'
+    script.write_text(r'''
+const assert=require('node:assert/strict'),fs=require('node:fs'),path=require('node:path'),crypto=require('node:crypto');
+const issuer=require(process.argv[2]);
+(async()=>{
+ const key=crypto.generateKeyPairSync('rsa',{modulusLength:2048}).privateKey.export({type:'pkcs8',format:'pem'});
+ const scope={repository:'ContextualWisdomLab/example',reviewer:'cwl-noema-review[bot]'};
+ for(const mutation of ['bad_signer','stale_scope','expiry','permission','wrong_app','wrong_install','wrong_repo','downstream','cleanup','delivery']){
+  const parent=path.join(process.argv[3],mutation);fs.mkdirSync(parent,{mode:0o700});
+  let posts=0,deletes=0,controllers=0;
+  const originalWrite=fs.writeFileSync;
+  const request=async(method,route,payload)=>{
+   if(method==='DELETE'){deletes++;if(mutation==='cleanup')throw Error('DENIED');return Buffer.alloc(0);}
+   if(route==='/app')return Buffer.from(JSON.stringify({id:mutation==='wrong_app'?12:11,slug:'cwl-noema-review'}));
+   if(route.endsWith('/installation'))return Buffer.from(JSON.stringify({id:mutation==='wrong_install'?8:7,app_id:11}));
+   posts++;
+   return Buffer.from(JSON.stringify({token:'FIXTURE_CONTROL',expires_at:mutation==='expiry'?'2000-01-01T00:00:00Z':'2033-05-18T04:33:20Z',
+    permissions:mutation==='permission'?{...payload.permissions,contents:'write'}:payload.permissions,
+    repositories:[{full_name:mutation==='wrong_repo'?'ContextualWisdomLab/other':scope.repository}]}));
+  };
+  if(mutation==='delivery')fs.writeFileSync=(...args)=>{if(typeof args[0]==='number'){originalWrite(args[0],Buffer.from('PARTIAL'));throw Error('IO');}return originalWrite(...args);};
+  try{
+   await assert.rejects(issuer.runPhase({phase:'publish',scope,appId:11,installationId:7,privateParent:parent,
+    clientId:'Iv1.fixture',privateKey:mutation==='bad_signer'?'BAD_SYNTHETIC_KEY':key,now:()=>2000000000,transport:request,
+    fence:async()=>{if(mutation==='stale_scope')throw Error('STALE');},
+    controller:async()=>{controllers++;throw Error('DOWNSTREAM');}}));
+   if(['bad_signer','wrong_app','wrong_install'].includes(mutation)){assert.equal(posts,0);assert.equal(deletes,0);}
+   else if(mutation==='stale_scope'){assert.equal(posts,1);assert.equal(deletes,1);}
+   else if(['expiry','permission','wrong_repo'].includes(mutation)){assert.equal(posts,1);assert.equal(deletes,1);assert.equal(controllers,0);}
+   else {assert.equal(posts,2);assert.equal(deletes,2);}
+   assert(!fs.existsSync(path.join(parent,'publish.json')),'partial delivery survived cleanup');
+  }finally{fs.writeFileSync=originalWrite;}
+ }
+ console.log('ISSUER_CONTROLS_PASS');
+})().catch(()=>{console.error('ISSUER_CONTROLS_FAIL');process.exitCode=1});
+''')
+    result=subprocess.run([shutil.which('node'),str(script),str(HELPER),str(tmp_path)],env={'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=20)
+    assert result.returncode==0 and result.stdout.strip()=='ISSUER_CONTROLS_PASS','partial delivery survived cleanup or missing issuer denial: '+result.stderr
diff --git a/tests/test_noema_issuer_producer_connection.py b/tests/test_noema_issuer_producer_connection.py
new file mode 100644
index 0000000000..e827da8b47
--- /dev/null
+++ b/tests/test_noema_issuer_producer_connection.py
@@ -0,0 +1,313 @@
+"""New issuer producer composition; all authority here is synthetic fixture data."""
+import json
+import re
+from pathlib import Path
+
+from scripts.ci import premerge_review_tooling as caller
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_actual_prepare_request_is_consumable_without_permission_relabeling():
+    """Execute the controller with the response to the real workflow request."""
+    workflow = (ROOT / '.github/workflows/noema-review.yml').read_text()
+    step = workflow.split('      - name: Mint repository-scoped Noema GitHub App token\n', 1)[1]
+    step = step.split('      - name:', 1)[0]
+    permissions = {name.replace('-', '_'): value for name, value in
+                   re.findall(r'          permission-([a-z-]+): (read|write)', step)}
+    # A recording App API returns its actual requested grant; the controller
+    # receives those original bytes, not labels synthesized from action outputs.
+    raw_response = json.dumps({'token': 'SYNTHETIC_PREPARE_ONLY',
+                               'permissions': permissions,
+                               'repositories': [{'full_name': 'ContextualWisdomLab/example'}]}).encode()
+    scope = {'repository': 'ContextualWisdomLab/example', 'reviewer': 'cwl-noema-review[bot]'}
+    observed = None
+    try:
+        observed = caller.phase_environment_from_issuance(
+            'prepare', json.loads(raw_response), scope=scope,
+            reviewer_actor=scope['reviewer'], installation_id=7,
+            inference_key='SYNTHETIC_INFERENCE_ONLY')
+    except ValueError:
+        pass
+    assert observed is not None, 'actual prepare request grants broader authority than controller permits'
+    assert observed['GH_TOKEN'] == 'SYNTHETIC_PREPARE_ONLY'
+    assert observed['NOEMA_LLM_MODEL'] == 'auto'
+
+
+def test_original_authenticated_response_reaches_controller(tmp_path):
+    """Missing producer cannot be replaced by action-output permission metadata."""
+    import importlib.util
+    helper = ROOT / 'scripts/ci/noema_bootstrap_producer.py'
+    scope = {'repository': 'ContextualWisdomLab/example', 'reviewer': 'cwl-noema-review[bot]'}
+    raw = b'{"token":"SYNTHETIC_ORIGINAL","permissions":{"contents":"read","metadata":"read","pull_requests":"read"},"repositories":[{"full_name":"ContextualWisdomLab/example"}]}'
+    calls = []
+
+    def request(method, route, payload):
+        """Return authenticated API fixture bytes without rewriting the grant."""
+        calls.append((method, route, payload))
+        if route == '/app':
+            return b'{"id":11,"slug":"cwl-noema-review"}'
+        if route.endswith('/installation'):
+            return b'{"id":7,"app_id":11}'
+        return raw
+
+    private = tmp_path / 'private'
+    private.mkdir(mode=0o700)
+    output = private / 'prepare.json'
+    if helper.exists():
+        spec = importlib.util.spec_from_file_location('issuer_fixture_producer', helper)
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        module.produce_issuance('prepare', scope=scope, installation_id=7,
+            app_id=11, output=output, private_parent=private,
+            request=request, revalidate=lambda: None)
+    assert output.exists() and len(calls) == 3, 'authenticated issuer response producer is missing'
+    assert output.read_bytes() == raw
+    observed = caller.phase_environment_from_issuance(
+        'prepare', json.loads(output.read_bytes()), scope=scope,
+        reviewer_actor=scope['reviewer'], installation_id=7,
+        inference_key='SYNTHETIC_INFERENCE_ONLY')
+    assert observed['GH_TOKEN'] == 'SYNTHETIC_ORIGINAL'
+
+
+def test_missing_bootstrap_materialization_cannot_run_original_phase_child(tmp_path):
+    """Execute a newly supplied child only after complete external pin admission."""
+    import hashlib
+    import importlib.util
+    import sys
+    helper = ROOT / 'scripts/ci/noema_bootstrap_producer.py'
+    spec = importlib.util.spec_from_file_location('bootstrap_fixture_producer', helper)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    source = tmp_path / 'supplier'
+    entry = source / '.github/actions/noema-review/two_phase.py'
+    entry.parent.mkdir(parents=True)
+    entry.write_text('print("INERT_ACCEPTED_CHILD")\n')
+    files = {entry.relative_to(source).as_posix(): hashlib.sha256(entry.read_bytes()).hexdigest()}
+    manifest = {'schema_version': 1, 'repository': 'ContextualWisdomLab/.github',
+                'commit': 'c' * 40, 'tree': 'd' * 40,
+                'entrypoint': entry.relative_to(source).as_posix(), 'files': files}
+    raw = json.dumps(manifest).encode()
+    private = tmp_path / 'private'
+    private.mkdir(mode=0o700)
+    target = private / 'tooling'
+    admission = {'namespace': str(private),
+                 'interpreter': {'path': str(Path(sys.executable).resolve()),
+                                 'sha256': hashlib.sha256(Path(sys.executable).read_bytes()).hexdigest()},
+                 'dependencies': {},
+                 **{key: True for key in ('isolated_clean_job', 'native_custody',
+                    'supplier_cost', 'supplier_retention', 'issuer_phase_separation')}}
+    if hasattr(module, 'materialize_tooling'):
+        module.materialize_tooling(source, target, raw,
+            accepted_digest=hashlib.sha256(raw).hexdigest(),
+            admission=admission, private_parent=private)
+    assert (target / entry.relative_to(source)).exists(), 'immutable bootstrap producer is missing'
+    import subprocess
+    result = subprocess.run([sys.executable, '-I', '-B', str(target / entry.relative_to(source))],
+                            capture_output=True, text=True, timeout=10)
+    assert result.returncode == 0 and result.stdout == 'INERT_ACCEPTED_CHILD\n'
+
+
+def test_issuer_write_grant_rejected_before_private_delivery(tmp_path):
+    """Original broad response cannot be relabeled as preparation read authority."""
+    import pytest
+    from scripts.ci.noema_bootstrap_producer import produce_issuance
+    private = tmp_path / 'private'
+    private.mkdir(mode=0o700)
+    calls = []
+    def request(method, route, payload):
+        """Return otherwise valid fixture identities and a contrary original grant."""
+        calls.append(route)
+        if route == '/app':
+            return b'{"id":11,"slug":"cwl-noema-review"}'
+        if route.endswith('/installation'):
+            return b'{"id":7,"app_id":11}'
+        return b'{"token":"SYNTHETIC_ONLY","permissions":{"contents":"read","metadata":"read","pull_requests":"write"},"repositories":[{"full_name":"ContextualWisdomLab/example"}]}'
+    output = private / 'prepare.json'
+    with pytest.raises(ValueError, match='phase grant'):
+        produce_issuance('prepare', scope={'repository':'ContextualWisdomLab/example',
+            'reviewer':'cwl-noema-review[bot]'}, installation_id=7, app_id=11,
+            output=output, private_parent=private, request=request, revalidate=lambda: None)
+    assert not output.exists() and len(calls) == 3
+
+
+def test_revocation_during_issuer_identity_wait_prevents_token_request(tmp_path):
+    """The post-wait fence denies token POST rather than only later output."""
+    import pytest
+    from scripts.ci.noema_bootstrap_producer import produce_issuance
+    private = tmp_path / 'private'
+    private.mkdir(mode=0o700)
+    calls = []
+    def request(method, route, payload):
+        """Record the only reached synthetic identity read."""
+        calls.append(route)
+        return b'{"id":11,"slug":"cwl-noema-review"}'
+    def revalidate():
+        """Revoke once the identity read has returned."""
+        if calls:
+            raise ValueError('FIXTURE_REVOKED')
+    with pytest.raises(ValueError, match='FIXTURE_REVOKED'):
+        produce_issuance('prepare', scope={'repository':'ContextualWisdomLab/example',
+            'reviewer':'cwl-noema-review[bot]'}, installation_id=7, app_id=11,
+            output=private/'prepare.json', private_parent=private,
+            request=request, revalidate=revalidate)
+    assert calls == ['/app'] and not (private/'prepare.json').exists()
+
+
+def composition_fixture(tmp_path, mutation=None):
+    """Native inert children consume real producer files with separated grants."""
+    import importlib.util
+    import hashlib
+    import sys
+    from scripts.ci import noema_bootstrap_producer as producer
+    scope = {'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+             'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    source = tmp_path/'supplier'
+    entry = source/'.github/actions/noema-review/two_phase.py'
+    entry.parent.mkdir(parents=True)
+    envelope = {'schema_version':1,'repository':scope['repository'],'pull_request_number':7,
+                'expected_head':scope['head'],'expected_base':scope['base'],
+                'reviewer_actor':scope['reviewer'],'pull_request_author':'writer',
+                'verdict':{'decision':'approve'}}
+    entry.write_text('import os,sys,json\nfrom pathlib import Path\n'
+        'a=sys.argv\n'
+        'if "--prepare-verdict-file" in a:\n'
+        ' assert os.environ["GH_TOKEN"]=="SYNTHETIC_READ"\n'
+        ' assert os.environ["NOEMA_LLM_MODEL"]=="auto"\n'
+        ' p=Path(a[a.index("--prepare-verdict-file")+1]);p.write_text('+repr(json.dumps(envelope))+');p.chmod(0o600)\n'
+        'else:\n'
+        ' assert os.environ["GH_TOKEN"]=="SYNTHETIC_WRITE"\n'
+        ' assert "NOEMA_LLM_API_KEY" not in os.environ\n'
+        ' p=Path(a[a.index("--publish-verdict-file")+1]);Path(str(p)+".marker").write_text("PUBLISHED_FIXTURE");p.unlink()\n')
+    manifest = {'schema_version':1,'repository':'ContextualWisdomLab/.github','commit':'c'*40,
+                'tree':'d'*40,'entrypoint':entry.relative_to(source).as_posix(),
+                'files':{entry.relative_to(source).as_posix():hashlib.sha256(entry.read_bytes()).hexdigest()}}
+    raw=json.dumps(manifest).encode()
+    private=tmp_path/'private';private.mkdir(mode=0o700)
+    interpreter=Path(sys.executable).resolve()
+    admission={'namespace':str(private),'scope':scope,'installation_id':7,'app_id':11,
+               'interpreter':{'path':str(interpreter),'sha256':hashlib.sha256(interpreter.read_bytes()).hexdigest()},
+               'dependencies':{},**{k:True for k in ('isolated_clean_job','native_custody',
+                    'supplier_cost','supplier_retention','issuer_phase_separation')}}
+    events=[]
+    def live():
+        """Return exact synthetic live scope, never a real GitHub response."""
+        return {**scope,'state':'OPEN','draft':False}
+    def request(method,route,payload):
+        """Assert original requested grant at the actual issuer call."""
+        if route=='/app':return b'{"id":11,"slug":"cwl-noema-review"}'
+        if route.endswith('/installation'):return b'{"id":7,"app_id":11}'
+        mode=payload['permissions']['pull_requests'];events.append(mode)
+        if mode=='write':assert (private/'prepare.json').exists()
+        return json.dumps({'token':'SYNTHETIC_READ' if mode=='read' else 'SYNTHETIC_WRITE',
+            'permissions':payload['permissions'],'repositories':[{'full_name':scope['repository']}]}).encode()
+    if mutation == 'prepare_failure':
+        entry.write_text('raise SystemExit(23)\n')
+        manifest['files'][entry.relative_to(source).as_posix()] = hashlib.sha256(entry.read_bytes()).hexdigest()
+        raw = json.dumps(manifest).encode()
+    if mutation == 'missing_cost':
+        admission['supplier_cost'] = False
+    def execute():
+        """Execute unchanged real composition with this case's synthetic inputs."""
+        return producer.run_bootstrap_review(source,raw,accepted_digest=hashlib.sha256(raw).hexdigest(),
+            admission=admission,private_parent=private,fetch_live=live,request=request,
+            revalidate=lambda:None,inference_key='SYNTHETIC_INFERENCE')
+    return execute, events, private
+
+
+def test_actual_producer_controller_composition_issues_publish_only_after_prepare(tmp_path):
+    """Retain original composition oracle without replaying its completed GREEN."""
+    execute, events, _ = composition_fixture(tmp_path)
+    assert execute() == 0 and events == ['read', 'write']
+
+
+def test_new_prepare_failure_never_requests_publisher(tmp_path):
+    """A real failed child blocks independent publication issuance."""
+    import pytest
+    execute, events, private = composition_fixture(tmp_path, 'prepare_failure')
+    with pytest.raises(ValueError, match='preparation failed'):
+        execute()
+    assert events == ['read'] and not (private/'publish.json').exists()
+
+
+def test_new_missing_runtime_cost_refuses_before_issuer(tmp_path):
+    """Missing actual acceptance stays false rather than derived from manifest."""
+    import pytest
+    execute, events, private = composition_fixture(tmp_path, 'missing_cost')
+    with pytest.raises(ValueError, match='execution evidence'):
+        execute()
+    assert events == [] and not (private/'prepare.json').exists()
+
+
+def test_producer_cli_missing_independent_inputs_denies_before_issuer(tmp_path):
+    """Actual CLI must refuse missing pins instead of successful no-op execution."""
+    import subprocess
+    import sys
+    result = subprocess.run([sys.executable, '-B', '-m',
+        'scripts.ci.noema_bootstrap_producer', '--materialize',
+        '--private-parent', str(tmp_path/'private'), '--source-root', str(tmp_path/'absent'),
+        '--manifest', str(tmp_path/'missing'), '--accepted-digest', '',
+        '--admission', str(tmp_path/'missing-admission'), '--admission-digest', '',
+        '--repo', 'ContextualWisdomLab/example', '--pr-number', '7',
+        '--expected-head', 'a'*40], env={'PATH':'/usr/bin:/bin'},
+        capture_output=True, text=True, timeout=10)
+    assert result.returncode != 0, 'missing producer CLI accepts unavailable inputs as no-op'
+    assert 'Traceback' not in result.stderr, 'producer refusal leaks an uncaught adapter exception'
+    assert not (tmp_path/'private').exists()
+
+
+def test_pinned_authenticated_transport_dispatches_original_phase_request(tmp_path):
+    """Actual fixed-origin adapter must preserve response bytes, not metadata."""
+    import pytest
+    from scripts.ci import noema_bootstrap_producer as producer
+    private = tmp_path/'private';private.mkdir(mode=0o700)
+    jwt = private/'jwt';jwt.write_bytes(b'SYNTHETIC_JWT_ONLY');jwt.chmod(0o600)
+    calls=[]
+    class Response:
+        """Minimal trusted transport fixture, never a live HTTP response."""
+        def __enter__(self):return self
+        def __exit__(self,*args):return False
+        def read(self,size):return b'{"original":"FIXTURE"}'
+    def opener(request,timeout):
+        """Inspect actual serialized fixed-origin request."""
+        calls.append(request)
+        return Response()
+    transport = None
+    if hasattr(producer,'authenticated_transport'):
+        transport=producer.authenticated_transport(jwt, private, opener=opener)
+    assert transport is not None, 'actual issuer transport connection is missing'
+    raw=transport('POST','/app/installations/7/access_tokens',
+                  {'permissions':{'pull_requests':'read'},'repositories':['example']})
+    assert raw==b'{"original":"FIXTURE"}'
+    assert calls[0].full_url=='https://api.github.com/app/installations/7/access_tokens'
+    assert json.loads(calls[0].data)['permissions']=={'pull_requests':'read'}
+
+
+def test_workflow_invokes_real_bootstrap_and_phase_producer_before_controller():
+    """A module sitting unused on disk cannot supply any issuance output."""
+    workflow=(ROOT/'.github/workflows/noema-review.yml').read_text()
+    issuer=(ROOT/'scripts/ci/noema_existing_app_issuer.cjs').read_text()
+    assert workflow.count('scripts/ci/noema_bootstrap_producer.py') == 2
+    assert workflow.index('--materialize') < workflow.index('--phase prepare') < workflow.index('--revalidate-publish') < workflow.index('--phase publish')
+    assert workflow.count('node "$GITHUB_WORKSPACE/scripts/ci/noema_existing_app_issuer.cjs"') == 2
+    assert "child('premerge_review_tooling.py',args,env)" in issuer
+    assert "'--'+phase+'-production'" in issuer
+    assert "'--phase-issuance',file" in issuer
+    assert "await fence(read.token,phase);" in issuer
+    assert issuer.index("await fence(read.token,phase);") < issuer.index("selected=await issue('write',read.token);")
+
+
+def test_actual_publish_request_has_only_controller_write_permissions():
+    """Publication grant is independently refreshed without unrelated privileges."""
+    workflow=(ROOT/'.github/workflows/noema-review.yml').read_text()
+    step=workflow.split('      - name: Refresh repository-scoped Noema GitHub App token for publication\n',1)[1]
+    step=step.split('      - name:',1)[0]
+    permissions={name.replace('-','_'):value for name,value in
+        re.findall(r'          permission-([a-z-]+): (read|write)',step)}
+    assert permissions=={'contents':'read','metadata':'read','pull_requests':'read'}, 'metadata action requests excess permissions'
+    issuer=(ROOT/'scripts/ci/noema_existing_app_issuer.cjs').read_text()
+    assert "const permissions={contents:'read',metadata:'read',pull_requests:grant};" in issuer
+    assert "selected=await issue('write',read.token);" in issuer
+    assert "{repositories:[scope.repository.split('/')[1]],permissions},jwt" in issuer
+    assert "Object.keys(response.permissions||{}).length!==3" in issuer
+    assert "Object.entries(permissions).some(([k,v])=>response.permissions[k]!==v)" in issuer
diff --git a/tests/test_noema_issuer_producer_controls.py b/tests/test_noema_issuer_producer_controls.py
new file mode 100644
index 0000000000..1fbe758403
--- /dev/null
+++ b/tests/test_noema_issuer_producer_controls.py
@@ -0,0 +1,283 @@
+"""Additional new fail-closed issuer boundaries using fixture-only authority."""
+import hashlib
+import json
+import os
+from pathlib import Path
+
+import pytest
+from scripts.ci import noema_bootstrap_producer as producer
+
+
+def issuer_case(tmp_path):
+    """Return private native paths and a recording, original-byte issuer."""
+    private = tmp_path / 'private'
+    private.mkdir(mode=0o700)
+    scope = {'repository': 'ContextualWisdomLab/example', 'reviewer': 'cwl-noema-review[bot]'}
+    app = {'id': 11, 'slug': 'cwl-noema-review'}
+    installation = {'id': 7, 'app_id': 11}
+    response = {'token': 'FIXTURE_ONLY_NEVER_LIVE',
+                'permissions': {'contents': 'read', 'metadata': 'read', 'pull_requests': 'read'},
+                'repositories': [{'full_name': scope['repository']}]}
+    calls = []
+
+    def request(method, route, payload):
+        """Project exact fixture responses rather than inventing action metadata."""
+        calls.append((method, route, payload))
+        value = app if route == '/app' else installation if route.endswith('/installation') else response
+        return json.dumps(value).encode()
+
+    return private, scope, app, installation, response, calls, request
+
+
+@pytest.mark.parametrize('mutation', ['wrong_app', 'wrong_actor', 'wrong_installation',
+    'wrong_repository', 'metadata_only', 'output_existing', 'output_symlink',
+    'output_hardlink', 'output_external', 'output_same_jwt'])
+def test_new_issuer_identity_and_delivery_controls(tmp_path, mutation):
+    """Each distinct malformed boundary rejects without overwriting a private file."""
+    private, scope, app, installation, response, calls, request = issuer_case(tmp_path)
+    output = private / 'prepare.json'
+    sentinel = private / 'sentinel'
+    sentinel.write_bytes(b'KEEP_ORIGINAL')
+    sentinel.chmod(0o600)
+    if mutation == 'wrong_app':
+        app['id'] = 12
+    elif mutation == 'wrong_actor':
+        app['slug'] = 'other-reviewer'
+    elif mutation == 'wrong_installation':
+        installation['id'] = 8
+    elif mutation == 'wrong_repository':
+        response['repositories'][0]['full_name'] = 'ContextualWisdomLab/other'
+    elif mutation == 'metadata_only':
+        response.pop('token')
+    elif mutation == 'output_existing':
+        output.write_bytes(b'KEEP_EXISTING')
+    elif mutation == 'output_symlink':
+        output.symlink_to(sentinel)
+    elif mutation == 'output_hardlink':
+        os.link(sentinel, output)
+    elif mutation == 'output_external':
+        output = tmp_path / 'foreign.json'
+    elif mutation == 'output_same_jwt':
+        output = sentinel
+    with pytest.raises(ValueError):
+        producer.produce_issuance('prepare', scope=scope, installation_id=7, app_id=11,
+            output=output, private_parent=private, request=request, revalidate=lambda: None)
+    assert sentinel.read_bytes() == b'KEEP_ORIGINAL'
+    if mutation not in ('output_existing', 'output_symlink', 'output_hardlink', 'output_same_jwt'):
+        assert not output.exists()
+    if mutation.startswith('output_'):
+        assert calls == []
+
+
+def test_new_issuer_boolean_app_identity_cannot_match_integer(tmp_path):
+    """Exact integer admission must not permit Python's true-equals-one alias."""
+    private, scope, app, installation, response, calls, request = issuer_case(tmp_path)
+    app['id'] = True
+    installation['app_id'] = 1
+    with pytest.raises(ValueError, match='App identity'):
+        producer.produce_issuance('prepare', scope=scope, installation_id=7, app_id=1,
+            output=private/'prepare.json', private_parent=private,
+            request=request, revalidate=lambda: None)
+    assert [row[1] for row in calls] == ['/app']
+
+
+def bootstrap_case(tmp_path):
+    """Build exact stdlib-only tooling and explicit synthetic runtime pins."""
+    import sys
+    private = tmp_path / 'private'
+    private.mkdir(mode=0o700)
+    source = tmp_path / 'supplier'
+    entry = source / '.github/actions/noema-review/two_phase.py'
+    entry.parent.mkdir(parents=True)
+    entry.write_bytes(b'# INERT ORIGINAL SUPPLIER\n')
+    manifest = {'schema_version': 1, 'repository': 'ContextualWisdomLab/.github',
+                'commit': 'c'*40, 'tree': 'd'*40,
+                'entrypoint': entry.relative_to(source).as_posix(),
+                'files': {entry.relative_to(source).as_posix(): hashlib.sha256(entry.read_bytes()).hexdigest()}}
+    interpreter = Path(sys.executable).resolve()
+    admission = {'namespace':str(private), 'dependencies':{},
+                 'interpreter':{'path':str(interpreter), 'sha256':hashlib.sha256(interpreter.read_bytes()).hexdigest()},
+                 **{field:True for field in ('isolated_clean_job','native_custody','supplier_cost',
+                     'supplier_retention','issuer_phase_separation')}}
+    raw = json.dumps(manifest).encode()
+    return private, source, entry, raw, admission
+
+
+@pytest.mark.parametrize('mutation', ['stale_pin','source_drift','missing_custody',
+    'wrong_interpreter','bad_dependency','foreign_namespace','same_source_target','target_symlink'])
+def test_new_bootstrap_supply_and_runtime_controls(tmp_path, mutation):
+    """Invalid source/namespace/runtime evidence refuses before any phase dispatch."""
+    private, source, entry, raw, admission = bootstrap_case(tmp_path)
+    digest = hashlib.sha256(raw).hexdigest()
+    target = private/'tooling'
+    if mutation == 'stale_pin': digest = '0'*64
+    elif mutation == 'source_drift': entry.write_bytes(b'# MODIFIED AFTER INDEPENDENT PIN\n')
+    elif mutation == 'missing_custody': admission['native_custody'] = False
+    elif mutation == 'wrong_interpreter': admission['interpreter']['sha256'] = '0'*64
+    elif mutation == 'bad_dependency': admission['dependencies'][str(entry)] = '0'*64
+    elif mutation == 'foreign_namespace': admission['namespace'] = str(tmp_path)
+    elif mutation == 'same_source_target': target = source
+    elif mutation == 'target_symlink': target.symlink_to(source)
+    with pytest.raises(ValueError):
+        producer.materialize_tooling(source,target,raw,accepted_digest=digest,
+                                     admission=admission,private_parent=private)
+    assert entry.read_bytes().startswith(b'#')
+    if mutation not in ('same_source_target','target_symlink'):
+        assert not target.exists()
+
+
+def test_dependency_revocation_during_live_wait_blocks_issuance(tmp_path, monkeypatch):
+    """A changed runtime supplier cannot survive the CLI metadata wait."""
+    from types import SimpleNamespace
+    private, source, entry, raw, admission = bootstrap_case(tmp_path)
+    scope = {'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+             'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    dependency = tmp_path/'dependency'
+    dependency.write_bytes(b'ACCEPTED_STDLIB_FIXTURE')
+    admission.update(scope=scope, installation_id=7, app_id=11)
+    admission['dependencies'][str(dependency)] = hashlib.sha256(dependency.read_bytes()).hexdigest()
+    producer.materialize_tooling(source, private/'tooling', raw,
+        accepted_digest=hashlib.sha256(raw).hexdigest(), admission=admission, private_parent=private)
+    manifest_file, admission_file = tmp_path/'manifest', tmp_path/'admission'
+    manifest_file.write_bytes(raw); admission_file.write_text(json.dumps(admission))
+    jwt = private/'prepare-app.jwt';jwt.write_bytes(b'FIXTURE_ONLY');jwt.chmod(0o600)
+    calls=[]
+    pr={'base':{'sha':scope['base'],'repo':{'full_name':scope['repository']}},
+        'head':{'sha':scope['head']},'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    def metadata(*args, **kwargs):
+        """Return valid fixture PR but revoke one pinned dependency during waiting."""
+        dependency.write_bytes(b'REVOKED_RUNTIME_SUPPLIER')
+        return SimpleNamespace(stdout=json.dumps(pr))
+    def auth(*args, **kwargs):
+        """Expose whether revoked authority ever reaches credential transport."""
+        def request(*args):
+            calls.append(args)
+            return b'{}'
+        return request
+    monkeypatch.setattr(producer.subprocess,'run',metadata)
+    monkeypatch.setattr(producer,'authenticated_transport',auth)
+    argv=['--issue-prepare','--private-parent',str(private),'--source-root',str(source),
+          '--manifest',str(manifest_file),'--accepted-digest',hashlib.sha256(raw).hexdigest(),
+          '--admission',str(admission_file),'--admission-digest',hashlib.sha256(admission_file.read_bytes()).hexdigest(),
+          '--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head'],
+          '--app-jwt-file',str(jwt)]
+    assert producer.main(argv)==1
+    assert calls==[], 'runtime dependency drift reached issuer after live metadata wait'
+
+
+@pytest.mark.parametrize('mutation', ['manifest', 'tooling'])
+def test_post_live_metadata_pin_drift_never_reaches_authenticated_issuer(tmp_path, monkeypatch, mutation):
+    """Source and manifest are re-read after the actual metadata wait too."""
+    from types import SimpleNamespace
+    private, source, entry, raw, admission = bootstrap_case(tmp_path)
+    scope = {'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+             'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    admission.update(scope=scope, installation_id=7, app_id=11)
+    producer.materialize_tooling(source, private/'tooling', raw,
+        accepted_digest=hashlib.sha256(raw).hexdigest(), admission=admission, private_parent=private)
+    manifest_file, admission_file = tmp_path/'manifest', tmp_path/'admission'
+    manifest_file.write_bytes(raw); admission_file.write_text(json.dumps(admission))
+    jwt=private/'prepare-app.jwt';jwt.write_bytes(b'FIXTURE_ONLY');jwt.chmod(0o600)
+    calls=[]
+    pr={'base':{'sha':scope['base'],'repo':{'full_name':scope['repository']}},
+        'head':{'sha':scope['head']},'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    def metadata(*args, **kwargs):
+        """Replace a source pin after the pre-wait validation succeeded."""
+        if mutation=='manifest':manifest_file.write_bytes(b'{}')
+        else:(private/'tooling'/entry.relative_to(source)).write_bytes(b'# STALE CHILD\n')
+        return SimpleNamespace(stdout=json.dumps(pr))
+    def auth(*args, **kwargs):
+        """Assert no credential read, not merely no final response file."""
+        calls.append('credential')
+        return lambda *args:b'{}'
+    monkeypatch.setattr(producer.subprocess,'run',metadata)
+    monkeypatch.setattr(producer,'authenticated_transport',auth)
+    argv=['--issue-prepare','--private-parent',str(private),'--source-root',str(source),
+          '--manifest',str(manifest_file),'--accepted-digest',hashlib.sha256(raw).hexdigest(),
+          '--admission',str(admission_file),'--admission-digest',hashlib.sha256(admission_file.read_bytes()).hexdigest(),
+          '--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head'],
+          '--app-jwt-file',str(jwt)]
+    assert producer.main(argv)==1
+    assert calls==[], 'post-live source drift reached credential acquisition'
+
+
+def test_new_cli_producer_original_responses_feed_actual_controller_children(tmp_path, monkeypatch):
+    """Exercise real CLI functions plus native children; only HTTP/metadata is inert."""
+    from types import SimpleNamespace
+    from scripts.ci import premerge_review_tooling as controller
+    import subprocess
+    import sys
+    import urllib.request
+    private, source, entry, _, admission = bootstrap_case(tmp_path)
+    scope={'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+           'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    envelope={'schema_version':1,'repository':scope['repository'],'pull_request_number':7,
+              'expected_head':scope['head'],'expected_base':scope['base'],
+              'reviewer_actor':scope['reviewer'],'pull_request_author':'writer',
+              'verdict':{'decision':'approve'}}
+    entry.write_text('import os,sys\nfrom pathlib import Path\n'
+        'a=sys.argv\n'
+        'if "--prepare-verdict-file" in a:\n'
+        ' assert os.environ["GH_TOKEN"]=="NEW_FIXTURE_READ"\n'
+        ' assert os.environ["NOEMA_LLM_MODEL"]=="auto"\n'
+        ' p=Path(a[a.index("--prepare-verdict-file")+1]);p.write_text('+repr(json.dumps(envelope))+');p.chmod(0o600)\n'
+        'else:\n'
+        ' assert os.environ["GH_TOKEN"]=="NEW_FIXTURE_WRITE"\n'
+        ' assert "LLM_GATEWAY_API_KEY" not in os.environ and "NOEMA_LLM_API_KEY" not in os.environ\n'
+        ' p=Path(a[a.index("--publish-verdict-file")+1]);Path(str(p)+".marker").write_text("NEW_NATIVE_FIXTURE");p.unlink()\n')
+    manifest={'schema_version':1,'repository':'ContextualWisdomLab/.github','commit':'c'*40,
+              'tree':'d'*40,'entrypoint':entry.relative_to(source).as_posix(),
+              'files':{entry.relative_to(source).as_posix():hashlib.sha256(entry.read_bytes()).hexdigest()}}
+    raw=json.dumps(manifest).encode()
+    admission.update(scope=scope,installation_id=7,app_id=11)
+    mf,af=tmp_path/'manifest',tmp_path/'admission';mf.write_bytes(raw);af.write_text(json.dumps(admission))
+    common=['--private-parent',str(private),'--source-root',str(source),
+            '--manifest',str(mf),'--accepted-digest',hashlib.sha256(raw).hexdigest(),
+            '--admission',str(af),'--admission-digest',hashlib.sha256(af.read_bytes()).hexdigest(),
+            '--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head']]
+    events=[]
+    class Response:
+        """Hold raw response bytes with exact declared length and native cleanup."""
+        def __init__(self,raw):
+            self.raw=raw;self.headers={'Content-Length':str(len(raw))}
+        def __enter__(self):return self
+        def __exit__(self,*args):return False
+        def read(self,size):return self.raw
+    def open_fixture(req,timeout):
+        """Return exact API fixture bodies to the real fixed-origin adapter."""
+        if req.full_url.endswith('/app'):return Response(b'{"id":11,"slug":"cwl-noema-review"}')
+        if req.full_url.endswith('/installation'):return Response(b'{"id":7,"app_id":11}')
+        body=json.loads(req.data);phase=body['permissions']['pull_requests'];events.append(phase)
+        assert body['repositories']==['example']
+        if phase=='write':assert (private/'verdict.json').exists()
+        return Response(json.dumps({'token':'NEW_FIXTURE_READ' if phase=='read' else 'NEW_FIXTURE_WRITE',
+            'permissions':body['permissions'],'repositories':[{'full_name':scope['repository']}]}).encode())
+    monkeypatch.setattr(urllib.request,'build_opener',lambda *args:SimpleNamespace(open=open_fixture))
+    native_run=subprocess.run
+    pr={'base':{'sha':scope['base'],'repo':{'full_name':scope['repository']}},
+        'head':{'sha':scope['head']},'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    def metadata_or_native(argv,**kwargs):
+        """Fixture only gh metadata; execute the real isolated Python child."""
+        if argv[0]=='gh':return SimpleNamespace(stdout=json.dumps(pr))
+        return native_run(argv,**kwargs)
+    monkeypatch.setattr(subprocess,'run',metadata_or_native)
+    monkeypatch.setenv('LLM_GATEWAY_API_KEY','NEW_FIXTURE_INFERENCE')
+    assert producer.main(['--materialize',*common])==0
+    for phase in ('prepare','publish'):
+        jwt=private/(phase+'-app.jwt');jwt.write_bytes(b'NEW_FIXTURE_JWT');jwt.chmod(0o600)
+        if phase=='publish':
+            assert producer.main(['--revalidate-publish',*common,'--verdict-file',str(private/'verdict.json')])==0
+        argv=['--issue-'+phase,*common,'--app-jwt-file',str(jwt)]
+        if phase=='publish':argv+=['--verdict-file',str(private/'verdict.json')]
+        assert producer.main(argv)==0
+        response=json.loads((private/(phase+'.json')).read_bytes())
+        assert response['permissions']['pull_requests']==('read' if phase=='prepare' else 'write')
+        assert controller.production_main(['--'+phase+'-production',
+            '--tooling-root',str(private/'tooling'),
+            '--manifest',str(mf),'--accepted-digest',hashlib.sha256(raw).hexdigest(),
+            '--admission',str(af),'--admission-digest',hashlib.sha256(af.read_bytes()).hexdigest(),
+            '--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head'],
+            '--phase-issuance',str(private/(phase+'.json')),
+            '--verdict-file',str(private/'verdict.json')])==0
+    assert events==['read','write']
+    assert (private/'verdict.json.marker').read_text()=='NEW_NATIVE_FIXTURE'
diff --git a/tests/test_noema_native_metadata_credentials.py b/tests/test_noema_native_metadata_credentials.py
index a69fff03f5..eccef79460 100644
--- a/tests/test_noema_native_metadata_credentials.py
+++ b/tests/test_noema_native_metadata_credentials.py
@@ -34,7 +34,11 @@ def test_native_metadata_token_reaches_both_head_reads(tmp_path: Path, name: str
         "secrets.OPENCODE_APPROVE_TOKEN": "synthetic-approve" if source == "approve" else "",
         "github.token": "workflow-only",
     }
-    token = next(credentials.get(term.strip()) for term in expression.group(1).split("||") if credentials.get(term.strip()))
+    expected_legacy = "secrets.NOEMA_REVIEW_TOKEN || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.noema_metadata_app_token.outputs.token || github.token"
+    expected_kcsap = "env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && steps.noema_metadata_app_token.outputs.token || (env.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' && (" + expected_legacy + ")) || ''"
+    assert expression.group(1) == expected_kcsap
+    legacy_terms = expected_legacy.split(" || ")
+    token = next((credentials.get(term.strip(), "") for term in legacy_terms if credentials.get(term.strip(), "")), "")
     gh = tmp_path / "gh"
     live_head = ("a" if current else "c") * 40
     payload = json.dumps({"state": "open", "head": {"sha": live_head}, "base": {"sha": "b" * 40}})
diff --git a/tests/test_noema_orchestrator_workflow_contract.py b/tests/test_noema_orchestrator_workflow_contract.py
index 8de7551814..7d88b8188a 100644
--- a/tests/test_noema_orchestrator_workflow_contract.py
+++ b/tests/test_noema_orchestrator_workflow_contract.py
@@ -10,6 +10,13 @@
 import textwrap
 from pathlib import Path
 
+import pytest
+
+from tests.test_noema_draft_admission_before_sidecar import (
+    EXPECTED_UPLOAD_CONDITION,
+    _parsed_noema_job,
+    _sidecar_upload_is_fail_closed,
+)
 from tests.test_required_workflow_queue_contract import workflow_step, workflow_text
 
 
@@ -194,15 +201,19 @@ def test_noema_review_credentials_and_llm_use_orchestrator_free() -> None:
     assert "NVIDIA_NIM_API_KEY_SUB: ${{ secrets.NVIDIA_NIM_API_KEY_SUB }}" in workflow
     assert "OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}" in workflow
     assert "OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}" in workflow
-    assert 'export NOEMA_LLM_MODEL="orchestrator/free"' in workflow
+    assert 'export NOEMA_LLM_MODEL="orchestrator/auto"' in workflow
     prepare = workflow_step(workflow, "Prepare Noema model verdict")
     publish = workflow_step(workflow, "Publish prepared Noema verdict on the exact live head")
-    assert '.github/actions/noema-review/two_phase.py' in prepare
-    assert '--prepare-verdict-file "$verdict_file"' in prepare
+    assert 'scripts/ci/noema_existing_app_issuer.cjs' in prepare
+    assert '--phase prepare' in prepare
+    assert '--verdict-file "$verdict_file"' in prepare
+    assert '--private-parent "$RUNNER_TEMP/noema-private-bootstrap"' in prepare
     assert "NOEMA_TRANSPORT_RETRY_ATTEMPT" in prepare
     assert "toJSON(github.event.client_payload.transport_retry_attempt)" in prepare
-    assert '.github/actions/noema-review/two_phase.py' in publish
-    assert '--publish-verdict-file "$verdict_file"' in publish
+    assert 'scripts/ci/noema_existing_app_issuer.cjs' in publish
+    assert '--phase publish' in publish
+    assert '--verdict-file "$verdict_file"' in publish
+    assert '--private-parent "$RUNNER_TEMP/noema-private-bootstrap"' in publish
     redispatch = workflow_step(workflow, "Schedule bounded Noema transport re-dispatch")
     assert "needs.noema-review.outputs.transport_capacity_unavailable == 'true'" in workflow
     assert "needs.noema-review.outputs.transport_retry_eligible == 'true'" in workflow
@@ -460,10 +471,20 @@ def test_noema_private_admission_uses_existing_metadata_credentials(
         case = tmp_path / str(index)
         case.mkdir()
         values = {"github.token": "workflow-only", **credentials}
+        # This fixture targets private-example, not the App-only k-csap path.
+        # Validate the branch guard before evaluating its legacy OR chain.
+        guarded = re.fullmatch(
+            r"env\.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' "
+            r"&& steps\.noema_metadata_app_token\.outputs\.token \|\| "
+            r"\(env\.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' "
+            r"&& \((.*?)\)\) \|\| ''",
+            expression,
+        )
+        assert guarded is not None
         token = next(
             (
                 values.get(term.strip(), "")
-                for term in expression.split("||")
+                for term in guarded.group(1).split("||")
                 if values.get(term.strip(), "")
             ),
             "",
@@ -506,14 +527,8 @@ def test_noema_private_admission_uses_existing_metadata_credentials(
             workflow, "Reject a stale trigger before credential or model setup"
         )
         guard_expression = re.search(r"GH_TOKEN: \$\{\{ (.*?) \}\}", guard).group(1)
-        guard_token = next(
-            (
-                values.get(term.strip(), "")
-                for term in guard_expression.split("||")
-                if values.get(term.strip(), "")
-            ),
-            "",
-        )
+        assert guard_expression == expression
+        guard_token = token
         guard_result = subprocess.run(
             [
                 shutil.which("bash") or "/bin/bash",
@@ -592,7 +607,7 @@ def test_strix_gateway_default_and_noema_sidecar_fail_closed(tmp_path: Path) ->
         env={
             **os.environ,
             "GITHUB_OUTPUT": str(strix_output),
-            "STRIX_MODEL": "contextual-orchestrator/orchestrator/free",
+            "STRIX_MODEL": "auto",
             "STRIX_MODEL_REQUESTED": "",
         },
         capture_output=True,
@@ -601,12 +616,12 @@ def test_strix_gateway_default_and_noema_sidecar_fail_closed(tmp_path: Path) ->
     )
     assert strix.returncode == 0, strix.stderr
     assert {
-        "strix_model=contextual-orchestrator/orchestrator/free",
+        "strix_model=auto",
         "enabled=true",
         "provider_mode=contextual_orchestrator",
     } <= set(strix_output.read_text().splitlines())
     assert (
-        "STRIX_MODEL: contextual-orchestrator/orchestrator/free"
+        "STRIX_MODEL: auto"
         in workflow_text("strix.yml")
     )
     assert (
@@ -700,28 +715,166 @@ def test_noema_review_job_has_no_job_level_timeout() -> None:
 
 
 def test_noema_review_retains_sanitized_sidecar_evidence_after_any_outcome() -> None:
-    """Retain existing sanitized evidence on success, failure and cancellation.
+    """Only current non-Draft terminal producers retain the two sanitized paths.
 
-    A forced runner shutdown can still prevent upload; this contract only
-    removes the failure-only gate without adding raw logs or new files.
+    Forced runner shutdown may still prevent upload. This local contract does
+    not prove hosted retention, inference, or a qualifying App-owned approval.
     """
     workflow = workflow_text("noema-review.yml")
     name = "Upload contextual-orchestrator sidecar evidence"
-    step = workflow_step(workflow, name)
-    assert "if: always() && env.PR_NUMBER != ''" in step
+    uploads = [
+        step for step in _parsed_noema_job(workflow)["steps"]
+        if str(step.get("uses", "")).casefold().startswith("actions/upload-artifact@")
+    ]
+    assert len(uploads) == 1
+    step = uploads[0]
+    assert _sidecar_upload_is_fail_closed(workflow)
+    assert step["if"] == EXPECTED_UPLOAD_CONDITION
     strix_pin = re.search(
         r"actions/upload-artifact@([0-9a-f]{40})", workflow_text("strix.yml")
     ).group(1)
-    assert f"actions/upload-artifact@{strix_pin}" in step
-    assert "name: noema-sidecar-evidence" in step
-    assert "strix_runs/contextual-orchestrator-sidecar.stderr.log" in step
-    assert "strix_runs/contextual-orchestrator-preflight.json" in step
-    assert "if-no-files-found: ignore" in step
-    assert "retention-days: 5" in step
+    assert step["uses"] == f"actions/upload-artifact@{strix_pin}"
+    assert step["with"] == {
+        "name": "noema-sidecar-evidence",
+        "path": "strix_runs/contextual-orchestrator-sidecar.stderr.log\n"
+                "strix_runs/contextual-orchestrator-preflight.json\n",
+        "if-no-files-found": "ignore",
+        "retention-days": "5",
+    }
     prepare = workflow.index("      - name: Prepare Noema model verdict\n")
     upload = workflow.index(f"      - name: {name}\n")
     refresh = workflow.index(
         "      - name: Refresh repository-scoped Noema GitHub App token for publication\n"
     )
     assert prepare < upload < refresh
-    assert workflow.count("actions/upload-artifact@") == 1
+
+
+OWNED_EVIDENCE = (
+    "contextual-orchestrator-preflight.json",
+    "contextual-orchestrator-sidecar.stderr.log",
+)
+
+
+def _evidence_lifecycle_steps() -> tuple[dict, dict]:
+    """Read initialization and the real producer by parsed identities, in order."""
+    steps = _parsed_noema_job(workflow_text("noema-review.yml"))["steps"]
+    producer = next(step for step in steps if step.get("id") == "noema_sidecar")
+    # Until initialization exists, execute the defective producer prefix for RED.
+    initializer = next((step for step in steps if step.get("id") == "noema_evidence"), producer)
+    return initializer, producer
+
+
+def _run_evidence_lifecycle(workspace: Path, phase: str, marker: Path) -> subprocess.CompletedProcess[str]:
+    """Execute actual setup/run bodies with a harmless early-failure sidecar."""
+    initializer, producer = _evidence_lifecycle_steps()
+    sidecar = workspace / "scripts/ci/contextual_orchestrator_review_sidecar.sh"
+    sidecar.parent.mkdir(parents=True, exist_ok=True)
+    sidecar.write_text(
+        '#!/bin/bash\nset -euo pipefail\nprintf reached >"$PHASE_MARKER"\n'
+        'if [ "$PHASE" = early ]; then exit 23; fi\n'
+        'printf "current sanitized diagnostic\\n" >"$GITHUB_WORKSPACE/strix_runs/contextual-orchestrator-sidecar.stderr.log"\n'
+        'printf \'{"contract":"strix-plain-chat-preflight-v2","ready_count":0,"probed_count":1,\n'
+        '"routes":[{"status":"rejected","http_status":429}]}\\n\' '
+        '>"$GITHUB_WORKSPACE/strix_runs/contextual-orchestrator-preflight.json"\n'
+        'if [ "$PHASE" = failure ]; then exit 23; fi\n',
+        encoding="utf-8",
+    )
+    bodies = [initializer["run"]] if initializer is producer else [initializer["run"], producer["run"]]
+    env = {**os.environ, "GITHUB_WORKSPACE": str(workspace), "PHASE": phase, "PHASE_MARKER": str(marker)}
+    result = None
+    for body in bodies:
+        result = subprocess.run(
+            [shutil.which("bash") or "/bin/bash", "-c", body],
+            env=env, capture_output=True, text=True, check=False, timeout=5,
+        )
+        if result.returncode:
+            break  # Actions default success() skips the producer after setup failure.
+    assert result is not None
+    return result
+
+
+def test_evidence_initialization_failure_skips_actual_producer() -> None:
+    """An unsafe setup must not become a terminal producer eligible for upload."""
+    initializer, producer = _evidence_lifecycle_steps()
+    steps = _parsed_noema_job(workflow_text("noema-review.yml"))["steps"]
+    assert initializer.get("id") == "noema_evidence"
+    assert steps.index(initializer) < steps.index(producer)
+    assert initializer["if"] == producer["if"]
+    assert "always()" not in producer["if"]
+    assert "continue-on-error" not in initializer
+    assert "continue-on-error" not in producer
+
+
+@pytest.mark.parametrize("phase", ["early", "failure", "success"])
+def test_evidence_lifecycle_clears_stale_files_before_sidecar(tmp_path: Path, phase: str) -> None:
+    """Repeat actual initialization; preserve sentinels and genuine current diagnostics."""
+    workspace = tmp_path / "workspace"
+    evidence = workspace / "strix_runs"
+    evidence.mkdir(parents=True)
+    sentinel = evidence / "unrelated-sentinel"
+    sentinel.write_text("keep unrelated\n")
+    marker = tmp_path / "producer-reached"
+    for _ in range(2):
+        marker.unlink(missing_ok=True)
+        for name in OWNED_EVIDENCE:
+            (evidence / name).write_text("old evidence\n")
+        result = _run_evidence_lifecycle(workspace, phase, marker)
+        assert marker.read_text() == "reached"
+        assert result.returncode == (0 if phase == "success" else 23), result.stderr
+        assert sentinel.read_text() == "keep unrelated\n"
+        if phase == "early":
+            assert all(not (evidence / name).exists() for name in OWNED_EVIDENCE)
+        else:
+            assert (evidence / OWNED_EVIDENCE[1]).read_text() == "current sanitized diagnostic\n"
+            report = json.loads((evidence / OWNED_EVIDENCE[0]).read_text())
+            assert report["contract"] == "strix-plain-chat-preflight-v2"
+            assert report["routes"][0]["http_status"] == 429
+        assert sorted(p.name for p in evidence.iterdir()) == (
+            ["unrelated-sentinel"] if phase == "early" else sorted((*OWNED_EVIDENCE, "unrelated-sentinel"))
+        )
+
+
+@pytest.mark.parametrize("alias", ["linked-parent", "linked-workspace", "linked-evidence", "dotdot",
+                                  "symlink-preflight", "symlink-stderr", "hardlink-preflight", "hardlink-stderr",
+                                  "directory-preflight", "directory-stderr"])
+def test_evidence_initialization_rejects_path_aliases_without_deletion(tmp_path: Path, alias: str) -> None:
+    """Reject aliases before deleting either owned file or reaching the sidecar."""
+    actual = tmp_path / "real/workspace"
+    evidence = actual / "strix_runs"
+    evidence.mkdir(parents=True)
+    sentinel = tmp_path / "unrelated-sentinel"
+    sentinel.write_text("keep outside\n")
+    for name in OWNED_EVIDENCE:
+        (evidence / name).write_text("old evidence\n")
+    workspace = actual
+    if alias == "linked-parent":
+        (tmp_path / "alias").symlink_to(actual.parent, target_is_directory=True)
+        workspace = tmp_path / "alias/workspace"
+    elif alias == "linked-workspace":
+        workspace = tmp_path / "alias"
+        workspace.symlink_to(actual, target_is_directory=True)
+    elif alias == "linked-evidence":
+        evidence.rename(actual / "outside")
+        evidence.symlink_to(actual / "outside", target_is_directory=True)
+    elif alias == "dotdot":
+        (actual / "child").mkdir()
+        workspace = actual / "child/.."
+    else:
+        index = 0 if alias.endswith("preflight") else 1
+        target = evidence / OWNED_EVIDENCE[index]
+        target.unlink()
+        if alias.startswith("symlink"):
+            target.symlink_to(sentinel)
+        elif alias.startswith("hardlink"):
+            target.hardlink_to(sentinel)
+        else:
+            target.mkdir()
+    marker = tmp_path / "producer-reached"
+    result = _run_evidence_lifecycle(workspace, "early", marker)
+    assert result.returncode != 0
+    assert not marker.exists(), result.stderr
+    assert sentinel.read_text() == "keep outside\n"
+    assert all((evidence / name).exists() for name in OWNED_EVIDENCE)
+    for path in evidence.iterdir():
+        if path.is_file() and not path.is_symlink() and path.stat().st_nlink == 1:
+            assert path.read_text() == "old evidence\n"
diff --git a/tests/test_noema_post_wait_interpreter_pin.py b/tests/test_noema_post_wait_interpreter_pin.py
new file mode 100644
index 0000000000..990597f6f8
--- /dev/null
+++ b/tests/test_noema_post_wait_interpreter_pin.py
@@ -0,0 +1,55 @@
+"""New post-wait interpreter admission controls, with no operational authority."""
+import json
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+@pytest.mark.parametrize('drift', ['app', 'installation', 'issuance', 'controller', 'same_bytes_inode', 'none'])
+def test_post_wait_shared_child_refuses_changed_interpreter(tmp_path, drift):
+    """Actual issuer main must reject drift before either shared spawn boundary."""
+    script = tmp_path/'probe.cjs'
+    script.write_text(r'''
+const assert=require('node:assert/strict'),fs=require('node:fs'),crypto=require('node:crypto'),https=require('node:https');
+const {EventEmitter}=require('node:events');const issuer=require(process.argv[2]);
+(async()=>{
+ const root=process.argv[3],drift=process.argv[4],parent=root+'/private';fs.mkdirSync(parent,{mode:0o700});
+ const marker=root+'/launched',foreign=root+'/foreign',python=root+'/python';
+ const original='#!/bin/sh\nprintf X >> "'+marker+'"\n'+(drift==='controller'?'cp "'+root+'/replacement" "'+python+'"\n':'')+'exit 0\n';
+ const replacement='#!/bin/sh\nprintf BAD >> "'+foreign+'"\nexit 0\n';
+ fs.writeFileSync(python,original,{mode:0o700});fs.writeFileSync(root+'/replacement',replacement);
+ const digest=raw=>crypto.createHash('sha256').update(raw).digest('hex');
+ const admission={scope:{repository:'ContextualWisdomLab/example',number:7,head:'a'.repeat(40),base:'b'.repeat(40),author:'writer',reviewer:'cwl-noema-review[bot]'},app_id:11,installation_id:7,
+  interpreter:{path:python,sha256:digest(fs.readFileSync(python))},dependencies:{[fs.realpathSync(process.execPath)]:digest(fs.readFileSync(process.execPath))}};
+ const af=root+'/admission';fs.writeFileSync(af,JSON.stringify(admission));let deletes=0,changed=false;
+ https.request=(opts,callback)=>{const req=new EventEmitter();let body='';req.setTimeout=()=>{};req.write=c=>body+=c;req.end=()=>{
+  let raw;
+  if(opts.method==='DELETE'){deletes++;raw=Buffer.alloc(0);}
+  else if(opts.path==='/app')raw=Buffer.from('{"id":11,"slug":"cwl-noema-review"}');
+  else if(opts.path.endsWith('/installation'))raw=Buffer.from('{"id":7,"app_id":11}');
+  else raw=Buffer.from(JSON.stringify({token:'POSTWAIT_FIXTURE',expires_at:new Date(Date.now()+3600000).toISOString(),permissions:JSON.parse(body).permissions,repositories:[{full_name:admission.scope.repository}]}));
+  const stage=opts.path==='/app'?'app':opts.path.endsWith('/installation')?'installation':'issuance';
+  if(!changed && opts.method!=='DELETE' && (drift===stage || (drift==='same_bytes_inode' && stage==='issuance'))){
+   changed=true;if(drift==='same_bytes_inode'){fs.renameSync(python,root+'/old');fs.writeFileSync(python,original,{mode:0o700});}
+   else fs.writeFileSync(python,replacement);
+  }
+  const res=new EventEmitter();res.complete=true;res.statusCode=opts.method==='DELETE'?204:opts.method==='POST'?201:200;res.headers={'content-length':String(raw.length)};callback(res);
+  queueMicrotask(()=>{res.emit('data',raw);res.emit('end')});};return req;};
+ const key=crypto.generateKeyPairSync('rsa',{modulusLength:2048}).privateKey.export({type:'pkcs8',format:'pem'});
+ const args=['--phase','prepare','--private-parent',parent,'--source-root',root+'/source','--manifest',root+'/manifest','--accepted-digest','0'.repeat(64),'--admission',af,'--admission-digest',digest(fs.readFileSync(af)),'--repo',admission.scope.repository,'--pr-number','7','--expected-head',admission.scope.head,'--verdict-file',parent+'/verdict.json'];
+ let rejected=false;try{await issuer.main(args,{PATH:'/usr/bin:/bin',NOEMA_GITHUB_APP_CLIENT_ID:'Iv1.fixture',NOEMA_GITHUB_APP_PRIVATE_KEY:key,LLM_GATEWAY_API_KEY:'INERT_INFERENCE'});}catch{rejected=true;}
+ const launches=fs.existsSync(marker)?fs.readFileSync(marker,'utf8').length:0;
+ assert(!fs.existsSync(foreign),'unadmitted post-wait interpreter executed');
+ if(drift==='none'){assert(!rejected);assert.equal(launches,2);}
+ else {assert(rejected,'post-wait interpreter drift was admitted');assert.equal(launches,drift==='controller'?1:0);}
+ assert.equal(deletes,1);assert(!fs.existsSync(parent+'/prepare.json'));
+ console.log('POST_WAIT_CONTROL_PASS');
+})().catch(error=>{console.error(error.message);process.exitCode=1});
+''')
+    result = subprocess.run([shutil.which('node'), str(script), str(ROOT/'scripts/ci/noema_existing_app_issuer.cjs'), str(tmp_path), drift],
+                            env={'PATH':'/usr/bin:/bin'}, capture_output=True, text=True, timeout=20)
+    assert result.returncode == 0 and result.stdout.strip() == 'POST_WAIT_CONTROL_PASS', result.stderr
diff --git a/tests/test_noema_preflight_capacity.py b/tests/test_noema_preflight_capacity.py
index a6ed03db3c..d6beb753ce 100644
--- a/tests/test_noema_preflight_capacity.py
+++ b/tests/test_noema_preflight_capacity.py
@@ -218,6 +218,19 @@ def test_directory_report_path_keeps_plain_failure(tmp_path, monkeypatch):
     assert outputs["transport_capacity_unavailable"] == "false"
 
 
+def test_symlinked_report_parent_is_rejected(tmp_path):
+    """A symlinked evidence directory cannot redirect the trusted report read."""
+    real_parent = tmp_path / "real-parent"
+    real_parent.mkdir()
+    report = _all_429()
+    (real_parent / "report.json").write_text(json.dumps(report), encoding="utf-8")
+    symlink_parent = tmp_path / "report-parent"
+    symlink_parent.symlink_to(real_parent, target_is_directory=True)
+
+    assert capacity.load_preflight_report(real_parent / "report.json") == report
+    assert capacity.load_preflight_report(symlink_parent / "report.json") is None
+
+
 def test_oversized_report_keeps_plain_failure(tmp_path, monkeypatch):
     """The classifier reads a bounded prefix and rejects anything larger."""
     padded = _all_429()
diff --git a/tests/test_noema_premerge_production_caller.py b/tests/test_noema_premerge_production_caller.py
new file mode 100644
index 0000000000..65d4d49ea1
--- /dev/null
+++ b/tests/test_noema_premerge_production_caller.py
@@ -0,0 +1,157 @@
+"""Production premerge caller regressions; no live credentials or inference."""
+from pathlib import Path
+import subprocess
+import sys
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_workflow_phases_use_controller_and_preserve_refresh_order():
+    """Both real phase steps must enter the controller, with refresh between them."""
+    source = (ROOT / '.github/workflows/noema-review.yml').read_text()
+    prepare = source.split('      - name: Prepare Noema model verdict\n', 1)[1].split('      - name:', 1)[0]
+    publish = source.split('      - name: Publish prepared Noema verdict on the exact live head\n', 1)[1].split('\n  continue-noema-transport:', 1)[0]
+    issuer = (ROOT / 'scripts/ci/noema_existing_app_issuer.cjs').read_text()
+    for step, phase in [(prepare, 'prepare'), (publish, 'publish')]:
+        assert 'noema_existing_app_issuer.cjs' in step, 'phase bypasses issuer/controller'
+        assert '--phase ' + phase in step
+        assert "child('premerge_review_tooling.py',args,env)" in issuer
+        assert "'--'+phase+'-production'" in issuer
+        assert "'--phase-issuance',file" in issuer
+        assert '.github/actions/noema-review/two_phase.py"' not in step
+    assert source.index('Prepare Noema model verdict\n') < source.index('Refresh repository-scoped Noema GitHub App token for publication\n') < source.index('Publish prepared Noema verdict on the exact live head\n')
+
+
+
+def test_production_noema_requires_pinned_admission_before_reviewer_credentials():
+    """Production must invoke admission before minting model/publication authority."""
+    source = (ROOT / '.github/workflows/noema-review.yml').read_text()
+    name = '      - name: Admit independently pinned premerge tooling and execution\n'
+    assert name in source, 'production Noema has no premerge controller admission caller'
+    step = source.split(name, 1)[1].split('      - name:', 1)[0]
+    assert 'scripts/ci/premerge_review_tooling.py' in step
+    assert '--admit-production' in step
+    assert 'vars.NOEMA_TOOLING_MANIFEST_SHA256' in step
+    assert 'vars.NOEMA_EXECUTION_ADMISSION_SHA256' in step
+    assert source.index(name) < source.index('      - name: Select fail-closed Noema reviewer credential\n')
+    assert 'LLM_GATEWAY_API_KEY' not in step
+    assert '--accepted-digest "$NOEMA_TOOLING_MANIFEST_SHA256"' in step
+
+
+def test_actual_cli_refuses_missing_independent_pins(tmp_path):
+    """An unconfigured production caller cannot silently return success."""
+    result = subprocess.run(
+        [sys.executable, '-I', '-B', str(ROOT / 'scripts/ci/premerge_review_tooling.py'),
+         '--admit-production', '--tooling-root', str(tmp_path),
+         '--manifest', str(tmp_path / 'manifest.json'), '--accepted-digest', '',
+         '--admission', str(tmp_path / 'admission.json'), '--admission-digest', '',
+         '--repo', 'ContextualWisdomLab/example', '--pr-number', '7',
+         '--expected-head', 'a' * 40],
+        env={'PATH': '/usr/bin:/bin'}, capture_output=True, text=True, timeout=15,
+    )
+    assert result.returncode != 0, 'CLI ignored unconfigured independent admission'
+    assert 'independent admission pins' in result.stderr
+
+
+def test_actual_production_cli_binds_manifest_and_live_scope(tmp_path):
+    """Real CLI reaches an inert metadata executable only after independent pins."""
+    import hashlib
+    import json
+
+    root = tmp_path / 'tooling'
+    entry = root / '.github/actions/noema-review/two_phase.py'
+    entry.parent.mkdir(parents=True)
+    entry.write_bytes(b'# INERT SOURCE FIXTURE\n')
+    manifest = {'schema_version': 1, 'repository': 'ContextualWisdomLab/.github',
+                'commit': 'b' * 40, 'tree': 'c' * 40,
+                'entrypoint': '.github/actions/noema-review/two_phase.py',
+                'files': {'.github/actions/noema-review/two_phase.py': hashlib.sha256(entry.read_bytes()).hexdigest()}}
+    scope = {'repository': 'ContextualWisdomLab/example', 'number': 7, 'head': 'a' * 40,
+             'base': 'd' * 40, 'author': 'writer', 'reviewer': 'cwl-noema-review[bot]'}
+    admission = {'scope': scope, **{name: True for name in
+                 ('isolated_clean_job', 'native_custody', 'supplier_cost', 'supplier_retention', 'issuer_phase_separation')}}
+    manifest_path = tmp_path / 'manifest.json'
+    admission_path = tmp_path / 'admission.json'
+    manifest_path.write_text(json.dumps(manifest))
+    admission_path.write_text(json.dumps(admission))
+    pr = {'base': {'sha': scope['base'], 'repo': {'full_name': scope['repository']}},
+          'head': {'sha': scope['head']}, 'number': 7, 'user': {'login': 'writer'},
+          'state': 'open', 'draft': False}
+    gh = tmp_path / 'gh'
+    gh.write_text('#!/bin/sh\nprintf \'%s\' \'' + json.dumps(pr) + '\'\n')
+    gh.chmod(0o700)
+    command = [sys.executable, '-I', '-B', str(ROOT / 'scripts/ci/premerge_review_tooling.py'),
+               '--admit-production', '--tooling-root', str(root), '--manifest', str(manifest_path),
+               '--accepted-digest', hashlib.sha256(manifest_path.read_bytes()).hexdigest(),
+               '--admission', str(admission_path), '--admission-digest', hashlib.sha256(admission_path.read_bytes()).hexdigest(),
+               '--repo', scope['repository'], '--pr-number', '7', '--expected-head', scope['head']]
+    result = subprocess.run(command, env={'PATH': str(tmp_path) + ':/usr/bin:/bin'},
+                            capture_output=True, text=True, timeout=15)
+    assert result.returncode == 0, result.stderr
+    # An otherwise-valid independently pinned NOT_HELD receipt cannot pass.
+    admission['native_custody'] = False
+    admission_path.write_text(json.dumps(admission))
+    command[command.index('--admission-digest') + 1] = hashlib.sha256(admission_path.read_bytes()).hexdigest()
+    gh.write_text('#!/bin/sh\nexit 99\n')
+    result = subprocess.run(command, env={'PATH': str(tmp_path) + ':/usr/bin:/bin'},
+                            capture_output=True, text=True, timeout=15)
+    assert result.returncode == 1
+    assert 'custody/scope evidence unavailable' in result.stderr
+
+
+def test_production_run_invokes_controller_with_phase_scoped_issuance(tmp_path, monkeypatch):
+    """Full caller reaches controller, loader and independent phase environments."""
+    import importlib.util
+    import hashlib
+    import json
+    from types import SimpleNamespace
+
+    spec = importlib.util.spec_from_file_location('production_caller_test', ROOT / 'scripts/ci/premerge_review_tooling.py')
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    root = tmp_path / 'source'
+    entry = root / '.github/actions/noema-review/two_phase.py'
+    entry.parent.mkdir(parents=True)
+    entry.write_bytes(b'# FIXTURE ONLY\n')
+    files = {'.github/actions/noema-review/two_phase.py': entry.read_bytes()}
+    manifest = {'schema_version': 1, 'repository': 'ContextualWisdomLab/.github', 'commit': 'b'*40,
+                'tree': 'c'*40, 'entrypoint': next(iter(files)),
+                'files': {name: hashlib.sha256(data).hexdigest() for name, data in files.items()}}
+    scope = {'repository': 'ContextualWisdomLab/example', 'number': 7, 'head': 'a'*40,
+             'base': 'd'*40, 'author': 'writer', 'reviewer': 'cwl-noema-review[bot]'}
+    admission = {'scope': scope, 'installation_id': 7, **{name: True for name in
+                 ('isolated_clean_job','native_custody','supplier_cost','supplier_retention','issuer_phase_separation')}}
+    paths = {}
+    for name, data in [('manifest', manifest), ('admission', admission),
+                       ('prepare', {'token': 'SYNTHETIC_READ', 'permissions': {'contents':'read','metadata':'read','pull_requests':'read'}, 'repositories':[{'full_name':scope['repository']}]}),
+                       ('publish', {'token': 'SYNTHETIC_WRITE', 'permissions': {'contents':'read','metadata':'read','pull_requests':'write'}, 'repositories':[{'full_name':scope['repository']}]})]:
+        paths[name] = tmp_path / (name + '.json')
+        paths[name].write_text(json.dumps(data))
+        paths[name].chmod(0o600)
+    pr = {'base': {'sha':scope['base'],'repo':{'full_name':scope['repository']}},
+          'head':{'sha':scope['head']},'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    monkeypatch.setattr(module.subprocess, 'run', lambda *_args, **_kwargs: SimpleNamespace(stdout=json.dumps(pr)))
+    monkeypatch.setenv('LLM_GATEWAY_API_KEY','SYNTHETIC_INFERENCE')
+    events = []
+
+    def run_controller(raw, **kwargs):
+        events.append('controller')
+        kwargs['require_execution_admission']()
+        tooling = kwargs['load_tooling']()
+        assert tooling.phase_environment('prepare')['GH_TOKEN'] == 'SYNTHETIC_READ'
+        assert tooling.phase_environment('prepare')['NOEMA_LLM_MODEL'] == 'auto'
+        kwargs['refresh_publisher']()
+        env = tooling.phase_environment('publish')
+        assert env['GH_TOKEN'] == 'SYNTHETIC_WRITE'
+        assert 'NOEMA_LLM_API_KEY' not in env
+        return 0
+
+    monkeypatch.setattr(module, 'run_review', run_controller)
+    argv = ['--run-production','--tooling-root',str(root),'--manifest',str(paths['manifest']),
+            '--accepted-digest',hashlib.sha256(paths['manifest'].read_bytes()).hexdigest(),
+            '--admission',str(paths['admission']),'--admission-digest',hashlib.sha256(paths['admission'].read_bytes()).hexdigest(),
+            '--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head'],
+            '--prepare-issuance',str(paths['prepare']),'--publish-issuance',str(paths['publish']),
+            '--private-parent',str(tmp_path)]
+    assert module.production_main(argv) == 0
+    assert events == ['controller'], 'production caller returned without controller execution'
diff --git a/tests/test_noema_prepare_transport_admission.py b/tests/test_noema_prepare_transport_admission.py
new file mode 100644
index 0000000000..0c3d831d4a
--- /dev/null
+++ b/tests/test_noema_prepare_transport_admission.py
@@ -0,0 +1,55 @@
+"""New fail-closed controls for explicitly admitted prepare transport."""
+import hashlib
+import json
+from pathlib import Path
+
+import pytest
+from scripts.ci import premerge_review_tooling as caller
+from tests.test_noema_child_environment_composition import composition
+
+
+@pytest.mark.parametrize("mutation", ["ambient", "retry", "output_mode", "output_symlink", "reader", "node", "incomplete"])
+def test_rejected_transport_never_reaches_child(tmp_path, monkeypatch, mutation):
+    """Invalid accepted transport rejects before any child or output write."""
+    args, paths, output, children, context = composition(tmp_path, monkeypatch, "hwp")
+    if mutation == "ambient":
+        context["NODE_OPTIONS"] = "--require=ambient"
+    elif mutation == "retry":
+        context["NOEMA_TRANSPORT_RETRY_ATTEMPT"] = "3"
+    elif mutation == "output_mode":
+        output.chmod(0o666)
+    elif mutation == "output_symlink":
+        link = tmp_path / "output-link"
+        link.symlink_to(output)
+        context["GITHUB_OUTPUT"] = str(link)
+    elif mutation == "reader":
+        (Path(context["NOEMA_HWP_MCP_SOURCE"]) / "dist/tools/read.js").write_text("changed supplier")
+    elif mutation == "node":
+        context["node_sha256"] = "0" * 64
+    else:
+        context.pop("NOEMA_NODE_EXECUTABLE")
+    admission = json.loads(paths["admission"].read_text())
+    admission["prepare_transport"] = context
+    paths["admission"].write_text(json.dumps(admission))
+    args[args.index("--admission-digest") + 1] = hashlib.sha256(paths["admission"].read_bytes()).hexdigest()
+    assert caller.production_main(args) == 1
+    assert children == []
+    assert output.read_bytes() == b""
+    assert not paths["verdict"].exists()
+
+
+def test_publisher_never_receives_prepare_transport_or_inference(tmp_path, monkeypatch):
+    """A publisher ignores even a prepare transport object and receives no loader."""
+    _, _, _, _, context = composition(tmp_path, monkeypatch, "hwp")
+    scope = {"repository": "ContextualWisdomLab/example", "reviewer": "cwl-noema-review[bot]"}
+    response = {"token": "SYNTHETIC_WRITE", "permissions": {
+        "contents": "read", "metadata": "read", "pull_requests": "write"},
+        "repositories": [{"full_name": scope["repository"]}]}
+    environment = caller.phase_environment_from_issuance(
+        "publish", response, scope=scope, reviewer_actor=scope["reviewer"],
+        installation_id=7, inference_key="SYNTHETIC_NOT_FOR_PUBLISH", prepare_transport=context,
+    )
+    caller.require_phase_environment("publish", environment)
+    assert set(environment) == {"PATH", "GH_TOKEN", "NOEMA_REVIEW_ACTOR",
+                                "NOEMA_REVIEW_INSTALLATION_ID", "NOEMA_REVIEW_TOKEN_SOURCE"}
+    assert environment["PATH"] == "/usr/bin:/bin"
diff --git a/tests/test_noema_prepare_transport_path_identity.py b/tests/test_noema_prepare_transport_path_identity.py
new file mode 100644
index 0000000000..f53584110b
--- /dev/null
+++ b/tests/test_noema_prepare_transport_path_identity.py
@@ -0,0 +1,54 @@
+"""Regression controls for admission and consumer path identity."""
+import hashlib
+import json
+import shutil
+from pathlib import Path
+
+import pytest
+from scripts.ci import premerge_review_tooling as caller
+from tests.test_noema_child_environment_composition import composition
+
+
+@pytest.mark.parametrize("field", ["GITHUB_OUTPUT", "NOEMA_HWP_MCP_SOURCE"])
+@pytest.mark.parametrize("suffix", [" ", "\t", "\n", "\r", "\u00a0", "\x01", "\x7f"])
+def test_consumer_alias_rejected_before_child_or_output_write(tmp_path, monkeypatch, field, suffix):
+    """Valid distinct private raw/stripped names cannot redirect accepted capability."""
+    scenario = "retry" if field == "GITHUB_OUTPUT" else "hwp"
+    args, paths, output, children, context = composition(tmp_path, monkeypatch, scenario)
+    ordinary = Path(context[field])
+    suffixed = ordinary.with_name(ordinary.name + suffix)
+    if field == "GITHUB_OUTPUT":
+        suffixed.write_bytes(b"RAW_OUTPUT_SENTINEL")
+        suffixed.chmod(0o600)
+    else:
+        shutil.copytree(ordinary, suffixed)
+        # Keep the admitted raw inventory valid while distinguishing its sibling.
+        (ordinary / "dist/tools/read.js").write_text("throw new Error('UNADMITTED_SIBLING');\n")
+    context[field] = str(suffixed)
+    admission = json.loads(paths["admission"].read_text())
+    admission["prepare_transport"] = context
+    paths["admission"].write_text(json.dumps(admission))
+    args[args.index("--admission-digest") + 1] = hashlib.sha256(paths["admission"].read_bytes()).hexdigest()
+    before = {p: p.read_bytes() for p in tmp_path.rglob("*") if p.is_file()}
+    assert caller.production_main(args) == 1
+    assert children == []
+    assert not paths["verdict"].exists()
+    assert all(p.read_bytes() == raw for p, raw in before.items())
+    assert output.read_bytes() == b""
+
+
+@pytest.mark.parametrize("scenario", ["retry", "hwp"])
+def test_ordinary_capability_identity_still_reaches_actual_consumer(tmp_path, monkeypatch, scenario):
+    """An unchanged accepted identity stays nonempty through the real child seam."""
+    args, paths, output, children, context = composition(tmp_path, monkeypatch, scenario)
+    assert caller.production_main(args) == (1 if scenario == "retry" else 0)
+    assert len(children) == 1
+    assert children[0]["GITHUB_OUTPUT"] == context["GITHUB_OUTPUT"]
+    assert children[0]["NOEMA_HWP_MCP_SOURCE"] == context["NOEMA_HWP_MCP_SOURCE"]
+    assert children[0]["NOEMA_LLM_MODEL"] == "auto"
+    assert "NODE_OPTIONS" not in children[0]
+    if scenario == "retry":
+        assert "transport_retry_next_attempt=2\n" in output.read_text()
+        assert not paths["verdict"].exists()
+    else:
+        assert paths["verdict"].exists()
diff --git a/tests/test_noema_production_cli_coverage.py b/tests/test_noema_production_cli_coverage.py
new file mode 100644
index 0000000000..591ca7bfdb
--- /dev/null
+++ b/tests/test_noema_production_cli_coverage.py
@@ -0,0 +1,128 @@
+"""In-process production caller controls with synthetic authority only."""
+import hashlib
+import json
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+from scripts.ci import premerge_review_tooling as caller
+
+
+def setup_caller(tmp_path, monkeypatch, mode):
+    """Build private inert pins and intercept metadata without authenticating."""
+    root = tmp_path / 'tooling'
+    entry = root / '.github/actions/noema-review/two_phase.py'
+    entry.parent.mkdir(parents=True)
+    entry.write_bytes(b'# inert fixture\n')
+    scope = {'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+             'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    manifest = {'schema_version':1,'repository':'ContextualWisdomLab/.github','commit':'c'*40,
+                'tree':'d'*40,'entrypoint':'.github/actions/noema-review/two_phase.py',
+                'files':{'.github/actions/noema-review/two_phase.py':hashlib.sha256(entry.read_bytes()).hexdigest()}}
+    admission = {'scope':scope,'installation_id':7,**{k:True for k in
+                 ('isolated_clean_job','native_custody','supplier_cost','supplier_retention','issuer_phase_separation')}}
+    paths = {k:tmp_path/k for k in ['manifest','admission','prepare','publish','verdict']}
+    for name, value in [('manifest',manifest),('admission',admission)]:
+        paths[name].write_text(json.dumps(value))
+    for phase in ['prepare','publish']:
+        paths[phase].write_text(json.dumps({'token':'SYNTHETIC_ONLY',
+            'permissions':{'contents':'read','metadata':'read','pull_requests':'read' if phase=='prepare' else 'write'},
+            'repositories':[{'full_name':scope['repository']}]}))
+        paths[phase].chmod(0o600)
+    payload = {'schema_version':1,'repository':scope['repository'],'pull_request_number':7,
+               'expected_head':scope['head'],'expected_base':scope['base'],
+               'pull_request_author':'writer','reviewer_actor':scope['reviewer'],'verdict':{'decision':'approve'}}
+    pr = {'base':{'sha':scope['base'],'repo':{'full_name':scope['repository']}},
+          'head':{'sha':scope['head']},'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    monkeypatch.setattr(caller.subprocess,'run',lambda *_a,**_k:SimpleNamespace(stdout=json.dumps(pr)))
+    monkeypatch.setenv('LLM_GATEWAY_API_KEY','SYNTHETIC_INFERENCE')
+    events = []
+
+    def prepare(repo, number, head, path):
+        """Write an inert bounded envelope, not a model response."""
+        path.write_text(json.dumps(payload));path.chmod(0o600);events.append('prepare');return 0
+
+    def publish(repo, number, head, path):
+        """Observe phase admission at a recording-only sink."""
+        events.append('publish');return 0
+
+    monkeypatch.setattr(caller,'load_noema_tooling',lambda *_a,**_k:SimpleNamespace(prepare_verdict=prepare,publish_verdict=publish))
+    args = ['--'+mode+'-production','--tooling-root',str(root),'--manifest',str(paths['manifest']),
+            '--accepted-digest',hashlib.sha256(paths['manifest'].read_bytes()).hexdigest(),
+            '--admission',str(paths['admission']),'--admission-digest',hashlib.sha256(paths['admission'].read_bytes()).hexdigest(),
+            '--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head']]
+    if mode in ['prepare','publish']:
+        args += ['--phase-issuance',str(paths[mode]),'--verdict-file',str(paths['verdict'])]
+    if mode == 'run':
+        args += ['--prepare-issuance',str(paths['prepare']),'--publish-issuance',str(paths['publish']),'--private-parent',str(tmp_path)]
+    return args,paths,payload,events
+
+
+@pytest.mark.parametrize('mode',['prepare','publish','run','admit'])
+def test_production_mode_positive(tmp_path,monkeypatch,mode):
+    """Exercise caller control flow while keeping all network/model sinks inert."""
+    args,paths,payload,events=setup_caller(tmp_path,monkeypatch,mode)
+    if mode=='publish':
+        paths['verdict'].write_text(json.dumps(payload));paths['verdict'].chmod(0o600)
+    assert caller.production_main(args)==0
+    assert events == {'prepare':['prepare'],'publish':['publish'],'run':['prepare','publish'],'admit':[]}[mode]
+
+
+@pytest.mark.parametrize('mutation',['pins','digest','target','native','missing_phase','custody','missing_run','run_custody','admission_drift'])
+def test_production_denial_controls(tmp_path,monkeypatch,mutation):
+    """Missing or changed private authority refuses before later publication."""
+    mode='run' if mutation in ['missing_run','run_custody','admission_drift'] else 'prepare'
+    args,paths,payload,events=setup_caller(tmp_path,monkeypatch,mode)
+    if mutation=='pins':args[args.index('--accepted-digest')+1]=''
+    if mutation=='digest':args[args.index('--admission-digest')+1]='0'*64
+    if mutation in ['target','native']:
+        data=json.loads(paths['admission'].read_text())
+        if mutation=='target':data['scope']['number']=8
+        else:data['native_custody']=False
+        paths['admission'].write_text(json.dumps(data));args[args.index('--admission-digest')+1]=hashlib.sha256(paths['admission'].read_bytes()).hexdigest()
+    if mutation in ['missing_phase','missing_run']:
+        flag='--phase-issuance' if mutation=='missing_phase' else '--private-parent'
+        pos=args.index(flag);del args[pos:pos+2]
+    if mutation in ['custody','run_custody']:paths['prepare'].chmod(0o644)
+    if mutation=='admission_drift':
+        def stale(*_a,**kwargs):
+            """Mutate accepted custody before the controller revalidation."""
+            paths['admission'].write_text('{}')
+            kwargs['require_execution_admission']()
+        monkeypatch.setattr(caller,'run_review',stale)
+    assert caller.production_main(args)==1
+    assert events==[]
+
+
+@pytest.mark.parametrize('mode',['prepare','publish'])
+def test_phase_admission_drift_during_live_read_blocks_execution(tmp_path,monkeypatch,mode):
+    """A live metadata wait cannot preserve authority revoked during that wait."""
+    args,paths,payload,events=setup_caller(tmp_path,monkeypatch,mode)
+    if mode=='publish':
+        paths['verdict'].write_text(json.dumps(payload));paths['verdict'].chmod(0o600)
+    original=caller.subprocess.run
+
+    def revoke(*args,**kwargs):
+        """Return real fixture metadata but replace the previously accepted receipt."""
+        response=original(*args,**kwargs)
+        paths['admission'].write_text('{}')
+        return response
+
+    monkeypatch.setattr(caller.subprocess,'run',revoke)
+    assert caller.production_main(args)==1
+    assert events==[]
+
+
+def test_main_entrypoint_rejects_empty_pins_without_network(monkeypatch,tmp_path):
+    """Execute the real __main__ boundary in process with no external authority."""
+    import runpy
+    import sys
+
+    monkeypatch.setattr(sys,'argv',[str(Path(caller.__file__)), '--admit-production',
+        '--tooling-root',str(tmp_path),'--manifest',str(tmp_path/'missing'),
+        '--accepted-digest','','--admission',str(tmp_path/'missing-admission'),
+        '--admission-digest','','--repo','ContextualWisdomLab/example',
+        '--pr-number','7','--expected-head','a'*40])
+    with pytest.raises(SystemExit) as stopped:
+        runpy.run_path(caller.__file__,run_name='__main__')
+    assert stopped.value.code == 1
diff --git a/tests/test_noema_production_phase_execution.py b/tests/test_noema_production_phase_execution.py
new file mode 100644
index 0000000000..1fc836fe8c
--- /dev/null
+++ b/tests/test_noema_production_phase_execution.py
@@ -0,0 +1,105 @@
+"""Execute production CLI phase children with only inert fixture authority."""
+import hashlib
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_source_drift_during_credential_acquisition_blocks_child(tmp_path):
+    """Credential acquisition cannot stale the source check before child spawn."""
+    import importlib.util
+
+    spec = importlib.util.spec_from_file_location('credential_wait_boundary', ROOT / 'scripts/ci/premerge_review_tooling.py')
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    entry = tmp_path / '.github/actions/noema-review/two_phase.py'
+    entry.parent.mkdir(parents=True)
+    entry.write_bytes(b'# accepted fixture\n')
+    manifest = {'schema_version':1,'repository':'ContextualWisdomLab/.github',
+                'commit':'a'*40,'tree':'b'*40,
+                'entrypoint':'.github/actions/noema-review/two_phase.py',
+                'files':{'.github/actions/noema-review/two_phase.py':hashlib.sha256(entry.read_bytes()).hexdigest()}}
+    raw = json.dumps(manifest).encode()
+    calls = []
+
+    def acquire(phase):
+        entry.write_bytes(b'# changed during authority acquisition\n')
+        return {'NOEMA_LLM_MODEL':'auto'}
+
+    def child(*args, **kwargs):
+        from types import SimpleNamespace
+        calls.append(args)
+        return SimpleNamespace(returncode=0)
+
+    tooling = module.load_noema_tooling(tmp_path, raw,
+        accepted_digest=hashlib.sha256(raw).hexdigest(), interpreter=Path(sys.executable),
+        phase_environment=acquire, child_runner=child)
+    with pytest.raises(ValueError, match='source inventory'):
+        tooling.prepare_verdict('ContextualWisdomLab/example',7,'c'*40,tmp_path.parent/'unused-verdict')
+    assert calls == []
+
+
+
+@pytest.mark.parametrize('mutation', ['none', 'source', 'permissions', 'custody'])
+def test_real_phase_children_and_fail_closed_boundaries(tmp_path, mutation):
+    """Prepare then separately publish; corrupted boundary never invokes publisher."""
+    root = tmp_path / 'tooling'
+    entry = root / '.github/actions/noema-review/two_phase.py'
+    entry.parent.mkdir(parents=True)
+    scope = {'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+             'base':'d'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    envelope = {'schema_version':1,'repository':scope['repository'],'pull_request_number':7,
+                'expected_head':scope['head'],'expected_base':scope['base'],
+                'pull_request_author':'writer','reviewer_actor':scope['reviewer'],
+                'verdict':{'decision':'approve','summary':'INERT FIXTURE ONLY'}}
+    entry.write_text('import sys,json,os\nfrom pathlib import Path\n'
+                     'args=sys.argv\n'
+                     'if "--prepare-verdict-file" in args:\n'
+                     ' assert os.environ["GH_TOKEN"] == "SYNTHETIC_READ"\n'
+                     ' assert os.environ["NOEMA_LLM_MODEL"] == "auto"\n'
+                     ' p=Path(args[args.index("--prepare-verdict-file")+1])\n'
+                     ' p.write_text(' + repr(json.dumps(envelope)) + ')\n p.chmod(0o600)\n'
+                     'else:\n'
+                     ' assert os.environ["GH_TOKEN"] == "SYNTHETIC_WRITE"\n'
+                     ' assert "NOEMA_LLM_API_KEY" not in os.environ\n'
+                     ' p=Path(args[args.index("--publish-verdict-file")+1])\n'
+                     ' Path(str(p)+".published").write_text("FIXTURE ONLY")\n p.unlink()\n')
+    manifest = {'schema_version':1,'repository':'ContextualWisdomLab/.github','commit':'b'*40,
+                'tree':'c'*40,'entrypoint':'.github/actions/noema-review/two_phase.py',
+                'files':{'.github/actions/noema-review/two_phase.py':hashlib.sha256(entry.read_bytes()).hexdigest()}}
+    admission = {'scope':scope,'installation_id':7,**{name:True for name in
+                 ('isolated_clean_job','native_custody','supplier_cost','supplier_retention','issuer_phase_separation')}}
+    mf=tmp_path/'manifest';ad=tmp_path/'admission';issuer=tmp_path/'issuer';verdict=tmp_path/'verdict'
+    mf.write_text(json.dumps(manifest));ad.write_text(json.dumps(admission))
+    pr={'base':{'sha':scope['base'],'repo':{'full_name':scope['repository']}},'head':{'sha':scope['head']},
+        'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    gh=tmp_path/'gh';gh.write_text('#!/bin/sh\nprintf \'%s\' \''+json.dumps(pr)+'\'\n');gh.chmod(0o700)
+    common=['--tooling-root',str(root),'--manifest',str(mf),'--accepted-digest',hashlib.sha256(mf.read_bytes()).hexdigest(),
+            '--admission',str(ad),'--admission-digest',hashlib.sha256(ad.read_bytes()).hexdigest(),
+            '--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head'],
+            '--phase-issuance',str(issuer),'--verdict-file',str(verdict)]
+    for phase in ('prepare','publish'):
+        response={'token':'SYNTHETIC_READ' if phase=='prepare' else 'SYNTHETIC_WRITE',
+                  'permissions':{'contents':'read','metadata':'read','pull_requests':'read' if phase=='prepare' else 'write'},
+                  'repositories':[{'full_name':scope['repository']}]}
+        if phase=='publish':
+            if mutation=='source':entry.write_text('# substituted\n')
+            if mutation=='permissions':response['permissions']['contents']='write'
+        issuer.write_text(json.dumps(response));issuer.chmod(0o644 if phase=='publish' and mutation=='custody' else 0o600)
+        env={'PATH':str(tmp_path)+':/usr/bin:/bin'}
+        if phase=='prepare':env['LLM_GATEWAY_API_KEY']='SYNTHETIC_INFERENCE'
+        completed=subprocess.run([sys.executable,'-I','-B',str(ROOT/'scripts/ci/premerge_review_tooling.py'),
+                                  '--'+phase+'-production',*common],env=env,capture_output=True,text=True,timeout=20)
+        if phase=='prepare' or mutation=='none':
+            assert completed.returncode==0,completed.stderr
+        else:
+            assert completed.returncode==1
+    assert Path(str(verdict)+'.published').exists() is (mutation=='none')
+    assert 'SYNTHETIC_READ' not in completed.stdout+completed.stderr
+    assert 'SYNTHETIC_WRITE' not in completed.stdout+completed.stderr
diff --git a/tests/test_noema_quality_contract_negatives.py b/tests/test_noema_quality_contract_negatives.py
new file mode 100644
index 0000000000..56d60af85c
--- /dev/null
+++ b/tests/test_noema_quality_contract_negatives.py
@@ -0,0 +1,28 @@
+"""New sensitivity controls for the two failed final-quality contracts."""
+from pathlib import Path
+import pytest
+from tests import test_noema_issuer_producer_connection as contract
+
+
+@pytest.mark.parametrize('mutation', ['bypass', 'early_write', 'action_write', 'wide_issuer'])
+def test_revised_contracts_reject_security_regressions(tmp_path, monkeypatch, mutation):
+    """Actual revised consumers must reject each narrowly changed owned input."""
+    root=Path(contract.ROOT)
+    workflow=(root/'.github/workflows/noema-review.yml').read_text()
+    issuer=(root/'scripts/ci/noema_existing_app_issuer.cjs').read_text()
+    if mutation=='bypass':
+        workflow=workflow.replace('node "$GITHUB_WORKSPACE/scripts/ci/noema_existing_app_issuer.cjs"','node bypass.cjs',1)
+    elif mutation=='early_write':
+        issuer=issuer.replace('await fence(read.token,phase);','/* fence removed */',1)
+    elif mutation=='action_write':
+        marker='      - name: Refresh repository-scoped Noema GitHub App token for publication\n'
+        prefix,rest=workflow.split(marker,1)
+        workflow=prefix+marker+rest.replace('permission-pull-requests: read','permission-pull-requests: write',1)
+    else:
+        issuer=issuer.replace("contents:'read',metadata:'read',pull_requests:grant", "contents:'write',metadata:'read',pull_requests:grant",1)
+    wf=tmp_path/'.github/workflows/noema-review.yml';wf.parent.mkdir(parents=True);wf.write_text(workflow)
+    helper=tmp_path/'scripts/ci/noema_existing_app_issuer.cjs';helper.parent.mkdir(parents=True);helper.write_text(issuer)
+    monkeypatch.setattr(contract,'ROOT',tmp_path)
+    target=contract.test_workflow_invokes_real_bootstrap_and_phase_producer_before_controller if mutation in ('bypass','early_write') else contract.test_actual_publish_request_has_only_controller_write_permissions
+    with pytest.raises(AssertionError):
+        target()
diff --git a/tests/test_noema_refreshed_app_identity.py b/tests/test_noema_refreshed_app_identity.py
index 2339fdba88..788bd7ca0f 100644
--- a/tests/test_noema_refreshed_app_identity.py
+++ b/tests/test_noema_refreshed_app_identity.py
@@ -65,3 +65,54 @@ def test_unrecognized_source_is_not_normalized(monkeypatch: pytest.MonkeyPatch)
     with pytest.raises(RuntimeError, match="Noema GitHub App identity binding is invalid"):
         module._reviewer_actor(allow_refreshed_app=True)
     assert os.environ["NOEMA_REVIEW_TOKEN_SOURCE"] == "untrusted-app-alias"
+
+
+def test_actual_refreshed_publication_counts_only_as_exact_head_independent_app(
+    monkeypatch, tmp_path,
+):
+    """Compose the real two-phase publisher and scheduler without remote writes."""
+    import json
+    from copy import deepcopy
+    from scripts.ci import pr_review_merge_scheduler as scheduler
+    from tests.test_review_ai_app_independence import app_review, pull_request, HEAD
+
+    template = app_review(monkeypatch)
+    module = _load_module()
+    monkeypatch.setenv("NOEMA_REVIEW_ACTOR", "cwl-noema-review[bot]")
+    monkeypatch.setenv("NOEMA_REVIEW_INSTALLATION_ID", "146401636")
+    monkeypatch.setenv("NOEMA_REVIEW_TOKEN_SOURCE", module.REFRESHED_APP_TOKEN_SOURCE)
+    live = {"state": "OPEN", "headRefOid": HEAD, "baseRefOid": "b" * 40,
+            "isDraft": False, "author": {"login": "seonghobae"}, "reviews": {"nodes": []}}
+    monkeypatch.setattr(module.gate, "fetch_pr", lambda *_: live)
+    captured = []
+    monkeypatch.setattr(module.gate, "run", lambda args, stdin=None: captured.append(json.loads(stdin)))
+    envelope = tmp_path / "verdict.json"
+    # Recover a substantive verdict through the existing fixture publisher's contract.
+    verdict = {
+        "decision": "approve", "summary": "Inspected exact-head publication.", "findings": [],
+        "reviewed_lines": [{"path": "scripts/ci/example.py", "line": 2, "side": "RIGHT",
+                            "analysis": "The exact-head guard rejects stale publication."}],
+        "adversarial_validation": {"residual_risk": "Installation permission remains external.",
+            "probes": [{"path": "scripts/ci/example.py", "line": 2, "side": "RIGHT",
+                        "outcome": "falsified", "hypothesis": "Stale publication could pass.",
+                        "evidence": "The live head comparison rejects stale publication."}]},
+    }
+    module._write_envelope(envelope, {"schema_version": 1,
+        "repository": "ContextualWisdomLab/example", "pull_request_number": 7,
+        "expected_head": HEAD, "expected_base": "b" * 40,
+        "reviewer_actor": "cwl-noema-review[bot]", "pull_request_author": "seonghobae",
+        "verdict": verdict})
+    assert module.publish_verdict("ContextualWisdomLab/example", 7, HEAD, envelope) == 0
+    assert len(captured) == 1 and captured[0]["commit_id"] == HEAD
+    assert captured[0]["event"] == "APPROVE"
+    assert module.REFRESHED_APP_TOKEN_SOURCE in captured[0]["body"]
+    template["body"] = captured[0]["body"]
+    pr = pull_request(template)
+    assert scheduler.has_independent_current_head_approval(pr)
+    for key, value in (("state", "COMMENTED"), ("commit", {"oid": "c" * 40}),
+                       ("author", {"login": "unknown[bot]", "__typename": "Bot"})):
+        rejected = deepcopy(pr)
+        rejected["reviews"]["nodes"][0][key] = value
+        assert not scheduler.has_independent_current_head_approval(rejected)
+    assert not envelope.exists()
+    assert os.environ["NOEMA_REVIEW_TOKEN_SOURCE"] == module.REFRESHED_APP_TOKEN_SOURCE
diff --git a/tests/test_noema_review_gate.py b/tests/test_noema_review_gate.py
index 5b3ef6c703..64b75c4df4 100644
--- a/tests/test_noema_review_gate.py
+++ b/tests/test_noema_review_gate.py
@@ -4,7 +4,6 @@
 )
 import base64
 import hashlib
-import http.client
 import io
 import json
 import os
@@ -673,6 +672,7 @@ def make_pr(**overrides):
         "number": 7,
         "title": "Noema",
         "body": "",
+        "author": {"login": "fixture-pr-author"},
         "isDraft": False,
         "state": "OPEN",
         "headRefOid": "head",
@@ -1760,11 +1760,12 @@ def test_call_llm_http_400_is_transport_but_not_capacity(monkeypatch, capsys):
     """A non-transient 400 stays typed transport without authorizing re-dispatch."""
     monkeypatch.setenv("NOEMA_LLM_API_URL", "https://llm.example.test/chat")
     monkeypatch.setenv("NOEMA_LLM_API_KEY", "secret")
+    error_body = io.BytesIO(b"{}")
 
     class Opener:
         def open(self, request):
             raise noema.urllib.error.HTTPError(
-                request.full_url, 400, "Bad Request", {}, io.BytesIO(b"{}")
+                request.full_url, 400, "Bad Request", {}, error_body
             )
 
     monkeypatch.setattr(noema.urllib.request, "build_opener", lambda *_args: Opener())
@@ -1774,6 +1775,7 @@ def open(self, request):
 
     assert exc_info.value.capacity_unavailable is False
     assert exc_info.value.http_status == 400
+    assert error_body.closed
     assert "outcome=provider_capacity_unavailable" not in capsys.readouterr().out
 
 
@@ -1964,7 +1966,7 @@ def test_noema_redirect_handler_rejects_redirects():
     handler = noema.NoRedirectHandler()
     request = noema.urllib.request.Request("https://llm.example.test/chat")
 
-    with pytest.raises(noema.urllib.error.HTTPError):
+    with pytest.raises(noema.urllib.error.HTTPError) as exc_info:
         handler.redirect_request(
             request,
             fp=None,
@@ -1973,6 +1975,7 @@ def test_noema_redirect_handler_rejects_redirects():
             headers={},
             newurl="http://169.254.169.254/latest/meta-data/",
         )
+    exc_info.value.close()
 
 
 def test_call_llm_rejects_control_character_scheme_evasion(monkeypatch):
@@ -2879,6 +2882,14 @@ def test_fetch_file_content_at_ref_refuses_malformed_base64(monkeypatch):
         noema.fetch_file_content_at_ref("owner/repo", "docs/a.md", "deadbeef")
 
 
+def test_fetch_file_content_at_ref_refuses_malformed_json(monkeypatch):
+    """A malformed GitHub API envelope fails closed before metadata inspection."""
+    monkeypatch.setattr(noema, "run", lambda *args, **kwargs: "{not-json")
+
+    with pytest.raises(RuntimeError, match="GitHub content response was malformed"):
+        noema.fetch_file_content_at_ref("owner/repo", "docs/a.md", "deadbeef")
+
+
 @pytest.mark.parametrize("payload,reason", [
     ({"content": "", "encoding": "none", "size": 1048577}, "API omitted"),
     ({"content": "", "encoding": "base64", "size": 1}, "nonempty file"),
diff --git a/tests/test_noema_reviewer_token_lifetime.py b/tests/test_noema_reviewer_token_lifetime.py
index 7081171257..c040da5965 100644
--- a/tests/test_noema_reviewer_token_lifetime.py
+++ b/tests/test_noema_reviewer_token_lifetime.py
@@ -2,6 +2,8 @@
 
 from pathlib import Path
 
+import pytest
+
 
 ROOT = Path(__file__).resolve().parents[1]
 WORKFLOW = ROOT / ".github" / "workflows" / "noema-review.yml"
@@ -21,6 +23,65 @@ def _step_block(text: str, name: str) -> str:
     return text[start:min(ends)] if ends else text[start:]
 
 
+def test_prepublication_metadata_uses_fresh_read_only_app_token(tmp_path: Path) -> None:
+    """An expired pre-model token never masks the new post-model read grant."""
+    import json
+    import os
+    import re
+    import shutil
+    import subprocess
+    from tests.test_strix_repository_visibility_contract import _extract_run_block
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    refresh_name = "Refresh read-only Noema GitHub App metadata token after model"
+    revalidate_name = "Revalidate prepared scope before publisher credential refresh"
+    import hashlib
+    import sys
+    from scripts.ci import noema_bootstrap_producer as producer
+    from tests.test_noema_issuer_producer_controls import bootstrap_case
+    revalidate = _step_block(workflow, revalidate_name)
+    expression = re.search(r"GH_TOKEN: \$\{\{ (.*?) \}\}", revalidate)
+    tokens = {'steps.noema_metadata_app_token.outputs.token': 'EXPIRED_PRE_MODEL',
+              'steps.noema_publication_metadata_token.outputs.token': 'FRESH_READ_ONLY',
+              'github.token': 'OTHER_IDENTITY'}
+    token = next((tokens.get(term.strip(), '') for term in expression.group(1).split(' || ')
+                  if tokens.get(term.strip(), '')), '')
+    private, source, entry, raw, admission = bootstrap_case(tmp_path)
+    scope = {'repository':'ContextualWisdomLab/example','number':7,'head':'a'*40,
+             'base':'b'*40,'author':'writer','reviewer':'cwl-noema-review[bot]'}
+    admission.update(scope=scope, installation_id=7, app_id=11)
+    producer.materialize_tooling(source, private/'tooling', raw,
+        accepted_digest=hashlib.sha256(raw).hexdigest(), admission=admission, private_parent=private)
+    mf, af = tmp_path/'manifest', tmp_path/'admission'
+    mf.write_bytes(raw); af.write_text(json.dumps(admission))
+    envelope = {'schema_version':1,'repository':scope['repository'],'pull_request_number':7,
+                'expected_head':scope['head'],'expected_base':scope['base'],
+                'reviewer_actor':scope['reviewer'],'pull_request_author':'writer',
+                'verdict':{'decision':'approve'}}
+    verdict = private/'verdict.json'; verdict.write_text(json.dumps(envelope)); verdict.chmod(0o600)
+    pr = {'base':{'sha':scope['base'],'repo':{'full_name':scope['repository']}},
+          'head':{'sha':scope['head']},'number':7,'user':{'login':'writer'},'state':'open','draft':False}
+    gh = tmp_path/'gh'
+    gh.write_text('#!/bin/sh\n[ "$GH_TOKEN" = FRESH_READ_ONLY ] || exit 77\n' +
+                  "printf '%s' '" + json.dumps(pr) + "'\n")
+    gh.chmod(0o755)
+    args = ['--revalidate-publish','--private-parent',str(private),'--source-root',str(source),
+            '--manifest',str(mf),'--accepted-digest',hashlib.sha256(raw).hexdigest(),
+            '--admission',str(af),'--admission-digest',hashlib.sha256(af.read_bytes()).hexdigest(),
+            '--repo',scope['repository'],'--pr-number','7','--expected-head',scope['head'],
+            '--verdict-file',str(verdict)]
+    env = {'PATH':str(tmp_path)+':/usr/bin:/bin','GH_TOKEN':token}
+    result = subprocess.run([sys.executable,'-I','-B',str(ROOT/'scripts/ci/noema_bootstrap_producer.py'),*args],
+                            env=env,capture_output=True,text=True,timeout=20)
+    assert result.returncode == 0, 'expired pre-model metadata token blocks publisher refresh'
+    assert not (private/'publish.json').exists(), 'write grant issued before readonly fence'
+    refresh = _step_block(workflow, refresh_name)
+    writer = _step_block(workflow, "Refresh repository-scoped Noema GitHub App token for publication")
+    assert workflow.index("      - name: Prepare Noema model verdict") < workflow.index(refresh) < workflow.index(revalidate) < workflow.index(writer)
+    assert APP_TOKEN_ACTION in refresh
+    assert all(f"permission-{p}: read" in refresh for p in ('contents','metadata','pull-requests'))
+    assert ': write' not in refresh and 'github.token' not in revalidate
+
+
 def test_noema_remints_repository_scoped_app_token_after_model_before_publication() -> None:
     """A long model call must not publish with its predecessor App token."""
     workflow = WORKFLOW.read_text(encoding="utf-8")
@@ -29,11 +90,16 @@ def test_noema_remints_repository_scoped_app_token_after_model_before_publicatio
     publish = _step_block(workflow, "Publish prepared Noema verdict on the exact live head")
 
     assert APP_TOKEN_ACTION in refresh
-    assert "--prepare-verdict-file" in prepare
-    assert "--publish-verdict-file" in publish
+    assert "--phase prepare" in prepare
+    assert "--phase publish" in publish
+    assert 'scripts/ci/noema_existing_app_issuer.cjs' in prepare
+    assert 'scripts/ci/noema_existing_app_issuer.cjs' in publish
+    assert '--verdict-file "$verdict_file"' in prepare
+    assert '--verdict-file "$verdict_file"' in publish
+    assert workflow.index(prepare) < workflow.index(refresh) < workflow.index(publish)
     assert '--expected-head "$EXPECTED_HEAD_SHA"' in prepare
     assert '--expected-head "$EXPECTED_HEAD_SHA"' in publish
-    assert 'export NOEMA_LLM_MODEL="orchestrator/free"' in prepare
+    assert 'export NOEMA_LLM_MODEL="orchestrator/auto"' in prepare
     assert "steps.noema_prepare.outputs.prepared == 'true'" in refresh
     assert "steps.noema_credential.outputs.source == 'github-app'" in refresh
     assert "steps.noema_prepare.outputs.prepared == 'true'" in publish
@@ -47,9 +113,15 @@ def test_publication_step_uses_fresh_app_token_without_authority_fallback() -> N
 
     assert "owner: ContextualWisdomLab" in refresh
     assert "repositories: ${{ steps.noema_credential.outputs.repository }}" in refresh
-    assert "permission-pull-requests: write" in refresh
+    assert "permission-pull-requests: read" in refresh
+    assert "permission-pull-requests: write" not in refresh
     assert "permission-contents: read" in refresh
-    assert "permission-actions: read" in refresh
+    assert "permission-actions: read" not in refresh
+    assert "permission-checks: read" not in refresh
+    assert "permission-security-events: read" not in refresh
+    assert "permission-statuses: read" not in refresh
+    assert "permission-vulnerability-alerts: read" not in refresh
+    assert "permission-metadata: read" in refresh
     assert "steps.noema_github_app_publication_token.outputs.token" in publish
     assert "steps.noema_github_app_token.outputs.token" not in publish
     assert "secrets.NOEMA_REVIEW_TOKEN" in publish
@@ -63,5 +135,28 @@ def test_prepare_and_publish_are_the_only_model_verdict_execution_path() -> None
     workflow = WORKFLOW.read_text(encoding="utf-8")
     assert "Run Noema LLM review and submit verdict" not in workflow
     assert "python3 -m scripts.ci.noema_review_gate" not in workflow
-    assert workflow.count("--prepare-verdict-file") == 1
-    assert workflow.count("--publish-verdict-file") == 1
+    assert workflow.count("--phase prepare") == 1
+    assert workflow.count("--phase publish") == 1
+    assert '--phase-issuance' not in workflow
+    issuer = (ROOT / 'scripts/ci/noema_existing_app_issuer.cjs').read_text()
+    assert "'--'+phase+'-production'" in issuer
+    assert "'--phase-issuance',file" in issuer
+    assert '--prepare-verdict-file' not in workflow
+    assert '--publish-verdict-file' not in workflow
+
+
+@pytest.mark.parametrize("old_flag", ["--prepare-verdict-file", "--publish-verdict-file"])
+def test_phase_contract_rejects_obsolete_flags_with_current_path_retained(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, old_flag: str,
+) -> None:
+    """An extra obsolete flag must be rejected even beside valid phase calls."""
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    mutated = tmp_path / "noema-review.yml"
+    current_flag = "--phase prepare" if old_flag == "--prepare-verdict-file" else "--phase publish"
+    assert workflow.count(current_flag) == 1
+    mutated.write_text(
+        workflow.replace(current_flag, f"{current_flag} {old_flag}"), encoding="utf-8",
+    )
+    monkeypatch.setitem(globals(), "WORKFLOW", mutated)
+    with pytest.raises(AssertionError):
+        test_prepare_and_publish_are_the_only_model_verdict_execution_path()
diff --git a/tests/test_noema_two_phase_handoff.py b/tests/test_noema_two_phase_handoff.py
index 0e2c5e2fe5..7a5f4a07d3 100644
--- a/tests/test_noema_two_phase_handoff.py
+++ b/tests/test_noema_two_phase_handoff.py
@@ -25,6 +25,7 @@ def _load_module() -> ModuleType:
 
 
 def _patch_live_gate(monkeypatch: pytest.MonkeyPatch, module: ModuleType) -> None:
+    """Bind the gate's PR lookup to an author-bearing immutable fixture."""
     monkeypatch.setattr(
         module.gate,
         "fetch_pr",
@@ -32,6 +33,7 @@ def _patch_live_gate(monkeypatch: pytest.MonkeyPatch, module: ModuleType) -> Non
             "isDraft": False,
             "headRefOid": HEAD,
             "baseRefOid": BASE,
+            "author": {"login": "seonghobae"},
         },
     )
     monkeypatch.setattr(module.gate, "require_expected_head", lambda _pr, _head: None)
@@ -40,7 +42,15 @@ def _patch_live_gate(monkeypatch: pytest.MonkeyPatch, module: ModuleType) -> Non
     monkeypatch.setattr(module.gate, "existing_noema_review", lambda _pr, _actor: False)
 
 
-def test_prepare_seals_validated_verdict_without_publishing(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_prepare_query_requests_the_pr_author_identity() -> None:
+    """The model/publication gate queries the author instead of inferring it."""
+    module = _load_module()
+    assert "\n      author { login }\n" in module.gate.PR_QUERY
+
+
+def test_prepare_seals_validated_verdict_without_publishing(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
     """Preparation performs model work but cannot submit GitHub review evidence."""
     module = _load_module()
     _patch_live_gate(monkeypatch, module)
@@ -56,10 +66,12 @@ def test_prepare_seals_validated_verdict_without_publishing(tmp_path: Path, monk
     payload = module._read_envelope(envelope)
     assert payload["verdict"] == verdict
     assert payload["expected_base"] == BASE
+    assert payload["reviewer_actor"] == "cwl-noema-review[bot]"
+    assert payload["pull_request_author"] == "seonghobae"
 
 
 def test_publish_refetches_exact_head_and_base_with_fresh_actor_and_removes_envelope(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    """Publication rebinds repository/head/base/actor and consumes the private handoff."""
+    """Publication rebinds repository/head/base/author/actor and consumes the private handoff."""
     module = _load_module()
     _patch_live_gate(monkeypatch, module)
     envelope = tmp_path / "verdict.json"
@@ -70,6 +82,8 @@ def test_publish_refetches_exact_head_and_base_with_fresh_actor_and_removes_enve
         "pull_request_number": 7,
         "expected_head": HEAD,
         "expected_base": BASE,
+        "reviewer_actor": "cwl-noema-review[bot]",
+        "pull_request_author": "seonghobae",
         "verdict": verdict,
     })
     submitted: list[tuple[object, ...]] = []
@@ -108,6 +122,8 @@ def stale(_pr: object, _head: str) -> None:
         "pull_request_number": 7,
         "expected_head": HEAD,
         "expected_base": BASE,
+        "reviewer_actor": "cwl-noema-review[bot]",
+        "pull_request_author": "seonghobae",
         "verdict": {"decision": "approve"},
     })
 
@@ -135,6 +151,8 @@ def test_publish_rejects_base_drift_with_unchanged_head(tmp_path: Path, monkeypa
         "pull_request_number": 7,
         "expected_head": HEAD,
         "expected_base": BASE,
+        "reviewer_actor": "cwl-noema-review[bot]",
+        "pull_request_author": "seonghobae",
         "verdict": {"decision": "approve", "summary": "stale base"},
     })
     monkeypatch.setattr(module.gate, "submit_review", lambda *_args: pytest.fail("base-drifted evidence must not publish"))
@@ -153,6 +171,7 @@ def test_prepare_skip_creates_no_publishable_envelope(tmp_path: Path, monkeypatc
             "isDraft": True,
             "headRefOid": HEAD,
             "baseRefOid": BASE,
+            "author": {"login": "seonghobae"},
         },
     )
     monkeypatch.setattr(module.gate, "require_expected_head", lambda _pr, _head: None)
@@ -267,6 +286,55 @@ def raise_capacity(*_args: object, **_kwargs: object) -> None:
     assert "automatic re-dispatch budget is exhausted" in capsys.readouterr().out
 
 
+@pytest.mark.parametrize("author", (None, "cwl-noema-review[bot]"))
+def test_prepare_rejects_missing_or_self_author_before_model(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, author: str | None
+) -> None:
+    """An unknown or author-owned reviewer identity fails before inference."""
+    module = _load_module()
+    _patch_live_gate(monkeypatch, module)
+    monkeypatch.setattr(module.gate, "fetch_pr", lambda *_: {
+        "state": "OPEN", "isDraft": False, "headRefOid": HEAD, "baseRefOid": BASE,
+        "author": {"login": author} if author is not None else None,
+    })
+    monkeypatch.setattr(module.gate, "fetch_diff", lambda *_: ("diff", False))
+    monkeypatch.setattr(module.gate, "fetch_changed_files", lambda *_: [("src/a.py", "MODIFIED")])
+    monkeypatch.setattr(module.gate, "build_review_context", lambda *_: "context")
+    monkeypatch.setattr(module.gate, "call_llm", lambda *_: pytest.fail("model reached"))
+    envelope = tmp_path / "verdict.json"
+    with pytest.raises(RuntimeError, match="author"):
+        module.prepare_verdict("ContextualWisdomLab/example", 7, HEAD, envelope)
+    assert not envelope.exists()
+
+
+@pytest.mark.parametrize("author,actor", (
+    ("cwl-noema-review[bot]", "cwl-noema-review[bot]"),
+    (None, "cwl-noema-review[bot]"),
+    ("seonghobae", "other-review[bot]"),
+))
+def test_publication_rejects_author_or_reviewer_identity_drift(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, author: str | None, actor: str
+) -> None:
+    """A refreshed actor must match preparation and remain distinct from the author."""
+    module = _load_module()
+    _patch_live_gate(monkeypatch, module)
+    source = {"state": "OPEN", "isDraft": False, "headRefOid": HEAD, "baseRefOid": BASE,
+              "author": {"login": "seonghobae"}}
+    monkeypatch.setattr(module.gate, "fetch_pr", lambda *_: source)
+    monkeypatch.setattr(module.gate, "fetch_diff", lambda *_: ("diff", False))
+    monkeypatch.setattr(module.gate, "fetch_changed_files", lambda *_: [("src/a.py", "MODIFIED")])
+    monkeypatch.setattr(module.gate, "build_review_context", lambda *_: "context")
+    monkeypatch.setattr(module.gate, "call_llm", lambda *_: {"decision": "approve", "summary": "bounded"})
+    monkeypatch.setattr(module.gate, "submit_review", lambda *_: pytest.fail("invalid actor must not publish"))
+    envelope = tmp_path / "verdict.json"
+    assert module.prepare_verdict("ContextualWisdomLab/example", 7, HEAD, envelope) == 0
+    source["author"] = {"login": author} if author is not None else None
+    monkeypatch.setattr(module.gate, "current_actor", lambda: actor)
+    with pytest.raises(RuntimeError, match="author|actor"):
+        module.publish_verdict("ContextualWisdomLab/example", 7, HEAD, envelope)
+    assert not envelope.exists()
+
+
 def test_sidecar_failure_outputs_reach_existing_continuation():
     """Startup stays failed while its capacity outputs reach the same-head job."""
     text = (ROOT / '.github/workflows/noema-review.yml').read_text()
diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py
index 8a80d65461..43c7517a4d 100644
--- a/tests/test_opencode_agent_contract.py
+++ b/tests/test_opencode_agent_contract.py
@@ -120,9 +120,9 @@ def test_opencode_model_pool_sets_high_effort_for_capable_candidates():
         "opencode-free/qwen3.6-plus-free ' || '' }}"
     )
     candidates_text = candidates_match.group(1)
-    if candidates_text == "contextual-orchestrator/orchestrator/free":
-        assert 'OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/free"' in workflow
-        assert 'MODEL: contextual-orchestrator/orchestrator/free' in workflow
+    if candidates_text == "contextual-orchestrator/orchestrator/auto":
+        assert 'OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/auto"' in workflow
+        assert 'MODEL: contextual-orchestrator/orchestrator/auto' in workflow
         assert '.enabled_providers = ["contextual-orchestrator"]' in workflow
         return
     assert candidates_text.startswith(conditional_public_candidate)
@@ -795,6 +795,12 @@ def test_opencode_target_coverage_materializes_only_after_authorized_dispatch():
     assert 'candidate_count=$((candidate_count + 1))' not in measure_step
     assert 'printf \'%s\\n\' "$python_root" >>"$path_file"' in measure_step
     assert 'chmod -R a+rX /opt/base-vcs-dependencies "$path_file"' in measure_step
+    # Cargo crate archives keep modes such as 0640 through COPY, so the
+    # coverage image must normalize the base-rust dependency tree before
+    # unprivileged sandbox execution.
+    assert measure_step.index(
+        "COPY base-rust-dependencies /opt/base-rust-dependencies"
+    ) < measure_step.index("RUN chmod -R a+rX /opt/base-rust-dependencies")
     assert "docker build --pull --no-cache --network=default" in measure_step
     assert '"$coverage_build_dir"' in measure_step
     assert measure_step.index("docker build --pull --no-cache") < measure_step.index(
@@ -1285,7 +1291,7 @@ def test_opencode_python_coverage_never_resolves_pr_dependency_manifests():
     assert "[ -d src ] && printf src:. || printf ." in measure
     assert "PYTHONPATH=. python3 -m pytest tests/test_docstrings.py" not in measure
     assert (
-        'PYTHONPATH="$([ -d src ] && printf src:. || printf .)" '
+        'PYTHONPATH=\\"\\$([ -d src ] && printf src:. || printf .)\\" '
         "python3 -m pytest tests/test_docstrings.py"
     ) in measure
 
@@ -2076,7 +2082,7 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
         "Skipping publish-step failed-check OpenCode diagnosis for central review-process self-repair"
         in workflow
     )
-    assert 'OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/free"' in workflow
+    assert 'OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/auto"' in workflow
     assert 'OPENCODE_MODEL_ATTEMPTS: "1"' in workflow
     assert 'OPENCODE_EXPORT_TIMEOUT_SECONDS: "180"' in workflow
     assert 'OPENCODE_POOL_MAX_CYCLES: "1"' in workflow
@@ -2113,7 +2119,7 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
         'gh api -X GET "repos/${GH_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate'
         not in publish_step
     )
-    assert "MODEL: contextual-orchestrator/orchestrator/free" in publish_step
+    assert "MODEL: contextual-orchestrator/orchestrator/auto" in publish_step
     assert 'OPENCODE_RUN_TIMEOUT_SECONDS: "120"' not in publish_step
     assert "${OPENCODE_RUN_TIMEOUT_SECONDS:-120}s" not in publish_step
     assert (
@@ -2192,7 +2198,7 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
     assert (
         'OPENCODE_MODEL_CANDIDATES: "github-models/openai/gpt-5-nano"' not in workflow
     )
-    assert 'OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/free"' in workflow
+    assert 'OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/auto"' in workflow
     assert "${{ runner.temp }}/opencode-review-model-pool.md" in workflow
     assert re.search(
         r'check-runs" \\\n\s+-f per_page=100 \\\n\s+--paginate \\\n\s+--slurp \|\n\s+jq -r "\$jq_filter"',
@@ -2201,7 +2207,7 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
     assert not re.search(r"--slurp\s*\\\n\s*--jq", workflow)
     assert (
         workflow.count(
-            '["opencode-review","coverage-evidence","metadata-only gate evaluation"]'
+            '[\\"opencode-review\\",\\"coverage-evidence\\",\\"metadata-only gate evaluation\\"]'
         )
         >= 2
     )
@@ -2217,9 +2223,9 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
         not in failed_check_collector
     )
     assert (
-        '["opencode-review", "coverage-evidence", "coverage-source-tree", '
-        '"required-workflow-bootstrap", "metadata-only gate evaluation", '
-        '"scan-pr-queue"]' in workflow
+        '[\\"opencode-review\\", \\"coverage-evidence\\", \\"coverage-source-tree\\", '
+        '\\"required-workflow-bootstrap\\", \\"metadata-only gate evaluation\\", '
+        '\\"scan-pr-queue\\"]' in workflow
     )
     assert "falling back to current-head REST check-runs" in workflow
 
@@ -2306,7 +2312,8 @@ def test_opencode_excludes_queue_self_check_from_every_failed_check_path():
 
     # Both failed-check collectors and both pending-check collectors exclude the
     # scheduler check by name, independently of its current state or conclusion.
-    assert workflow.count(unconditional_filter) >= 5
+    escaped_filter = 'select((.name // \\"\\") != \\"scan-pr-queue\\")'
+    assert workflow.count(unconditional_filter) + workflow.count(escaped_filter) >= 5
     assert cancelled_only_filter not in workflow
     failed_check_collector = Path(
         "scripts/ci/collect_failed_check_evidence.sh"
@@ -2909,7 +2916,7 @@ def test_opencode_approve_review_publication_failure_fails_closed():
     )[1].split("      - name: Publish OpenCode review outcome", 1)[0]
     assert "continue-on-error: true" in fast_approval
     assert "def latest_peer_checks:" in fast_approval
-    assert 'group_by([.app.slug // "", .name // ""])' in fast_approval
+    assert 'group_by([.app.slug // \\"\\", .name // \\"\\"])' in fast_approval
     assert fast_approval.count("latest_peer_checks") == 3
     assert "CENTRAL_FAST_APPROVAL_WAITING_FOR_CHECKS" in workflow
     assert "CENTRAL_FAST_APPROVAL_CODE_SCANNING_ALERTS" in workflow
@@ -3012,7 +3019,7 @@ def test_opencode_review_language_signal_is_throttle_proof():
         workflow,
     )
     # The preferred-language marker and its Korean/English detection remain.
-    assert "- Preferred review language: `%s`" in workflow
+    assert "- Preferred review language: \\`%s\\`" in workflow
     assert "grep -Eq '[가-힣]'" in workflow
 
 
diff --git a/tests/test_opencode_append_command_lint.py b/tests/test_opencode_append_command_lint.py
new file mode 100644
index 0000000000..e809444919
--- /dev/null
+++ b/tests/test_opencode_append_command_lint.py
@@ -0,0 +1,54 @@
+"""Keep command-summary publication byte-exact with one append open."""
+
+import subprocess
+from pathlib import Path
+
+import pytest
+
+WORKFLOW = Path(__file__).resolve().parents[1] / ".github/workflows/opencode-review-dispatch.yml"
+
+
+def _append_function():
+    """Read the complete shipped shell function, not a replacement fixture."""
+    text = WORKFLOW.read_text(encoding="utf-8")
+    start = text.index("          append_command() {")
+    end = text.index("\n          emit_captured_log() {", start)
+    return text[start:end]
+
+
+def test_command_summary_opens_destination_once():
+    """One enclosing redirection avoids separate command-summary opens."""
+    assert _append_function().count('>>"$summary_file"') == 1
+
+
+@pytest.mark.parametrize("args", [
+    [], ["simple"], ["space value", "", "*"],
+    ["'quote'", '"double"', "$literal", "`literal`"],
+    ["newline\nvalue", "tab\tvalue", "한글"],
+])
+def test_command_summary_preserves_exact_escaped_bytes(tmp_path, args):
+    """Native Bash percent-q output and an existing prefix remain intact."""
+    summary = tmp_path / "summary"
+    summary.write_bytes(b"existing\n")
+    result = subprocess.run(
+        ["bash", "-c", 'summary_file="$1"; shift\n' + _append_function() + '\nappend_command "$@"', "bash", str(summary), *args],
+        capture_output=True, timeout=10,
+    )
+    expected = subprocess.run(
+        ["bash", "-c", "printf '$ '; printf '%q ' \"$@\"; printf '\\n'", "bash", *args],
+        capture_output=True, timeout=10,
+    )
+    assert result.returncode == expected.returncode == 0
+    assert result.stderr == b""
+    assert summary.read_bytes() == b"existing\n" + expected.stdout
+
+
+def test_command_summary_refuses_directory_destination(tmp_path):
+    """An unopenable destination rejects publication without invoking printf."""
+    result = subprocess.run(
+        ["bash", "-c", 'summary_file="$1"\n' + _append_function() + '\nappend_command sentinel', "bash", str(tmp_path)],
+        capture_output=True, timeout=10,
+    )
+    assert result.returncode != 0
+    assert result.stdout == b""
+    assert not list(tmp_path.iterdir())
diff --git a/tests/test_opencode_gateway_route_integration.py b/tests/test_opencode_gateway_route_integration.py
index 3893914c0e..e1fa618c07 100644
--- a/tests/test_opencode_gateway_route_integration.py
+++ b/tests/test_opencode_gateway_route_integration.py
@@ -63,7 +63,7 @@ def do_POST(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler API
                 "id": "stub",
                 "object": "chat.completion",
                 "created": 0,
-                "model": "orchestrator/free",
+                "model": "orchestrator/auto",
                 "choices": [
                     {
                         "index": 0,
@@ -128,8 +128,8 @@ def _run_opencode(
         json.dumps(
             {
                 "$schema": "https://opencode.ai/config.json",
-                "model": "contextual-orchestrator/orchestrator/free",
-                "small_model": "contextual-orchestrator/orchestrator/free",
+                "model": "contextual-orchestrator/orchestrator/auto",
+                "small_model": "contextual-orchestrator/orchestrator/auto",
                 "enabled_providers": ["contextual-orchestrator"],
                 "provider": {"contextual-orchestrator": provider},
             }
@@ -154,7 +154,7 @@ def _run_opencode(
             "reply with ok",
             "--pure",
             "--model",
-            "contextual-orchestrator/orchestrator/free",
+            "contextual-orchestrator/orchestrator/auto",
         ],
         cwd=project,
         env=environment,
diff --git a/tests/test_opencode_pr_workload_runner_boundary.py b/tests/test_opencode_pr_workload_runner_boundary.py
new file mode 100644
index 0000000000..05be5e4dfe
--- /dev/null
+++ b/tests/test_opencode_pr_workload_runner_boundary.py
@@ -0,0 +1,76 @@
+"""Keep PR merge-tree execution off privileged OpenCode/control runners."""
+
+from copy import deepcopy
+from pathlib import Path
+import re
+
+import pytest
+import yaml
+
+
+WORKFLOW = Path('.github/workflows/opencode-review-dispatch.yml')
+ISOLATED = {
+    'group': 'CWL CI isolated',
+    'labels': ['self-hosted', 'linux', 'x64', 'cwlab-ci-isolated'],
+}
+
+
+def assert_pr_workload_isolated(jobs: dict) -> None:
+    """Require every identified PR coverage executor to use the isolated route."""
+    observed = 0
+    for job_id, job in jobs.items():
+        runs = '\n'.join(str(step.get('run', '')) for step in job.get('steps', []))
+        executes_tests = re.search(r'\b(pytest|coverage run|npm (?:run |)test|pnpm (?:run |)test)\b', runs)
+        if job_id == 'coverage-evidence' or ('COVERAGE_SOURCE_WORKDIR' in runs and executes_tests):
+            observed += 1
+            assert job.get('runs-on') == ISOLATED, (
+                f'{job_id}: PR merge-tree execution requires the exact isolated runner mapping; '
+                f'got {job.get("runs-on")!r}'
+            )
+    assert observed, 'No PR merge-tree workload was checked'
+
+
+def test_actual_pr_merge_tree_execution_requires_isolated_runner() -> None:
+    """Reject the actual workflow's privileged-pool PR test execution."""
+    assert_pr_workload_isolated(yaml.safe_load(WORKFLOW.read_text())['jobs'])
+
+
+@pytest.mark.parametrize('runner', [
+    {'group': 'CWL central OpenCode', 'labels': ['self-hosted', 'linux', 'x64']},
+    {'group': 5, 'labels': ['self-hosted', 'linux', 'x64']},
+    {'group': 'CWL central control', 'labels': ['self-hosted', 'linux', 'x64']},
+    {'group': 'CWL CI isolated', 'labels': ['self-hosted', 'linux', 'x64']},
+    '${{ fromJSON(inputs.runner) }}',
+])
+def test_equivalent_renamed_pr_workload_rejects_nonisolated_mapping(runner) -> None:
+    """A renamed executor cannot evade group or required-label admission."""
+    job = {
+        'runs-on': deepcopy(ISOLATED),
+        'steps': [{'run': 'cd "$COVERAGE_SOURCE_WORKDIR" && python3 -m pytest tests'}],
+    }
+    assert_pr_workload_isolated({'renamed-pr-tests': job})
+    job['runs-on'] = runner
+    with pytest.raises(AssertionError, match='requires the exact isolated runner mapping'):
+        assert_pr_workload_isolated({'renamed-pr-tests': job})
+
+
+def test_metadata_and_publisher_keep_privileged_permissions_separate() -> None:
+    """Preserve trusted token jobs and the PR executor's read-only artifact access."""
+    jobs = yaml.safe_load(WORKFLOW.read_text())['jobs']
+    for job_id in ('validate-pr-metadata', 'opencode-review-target'):
+        assert jobs[job_id]['runs-on'] == {
+            'group': 'CWL central OpenCode', 'labels': ['self-hosted', 'linux', 'x64'],
+        }
+    assert jobs['validate-pr-metadata']['permissions'] == {
+        'contents': 'read', 'pull-requests': 'read', 'id-token': 'write',
+    }
+    coverage = jobs['coverage-evidence']
+    assert coverage['permissions'] == {'actions': 'read'}
+    assert coverage['needs'] == ['validate-pr-metadata']
+    assert coverage['timeout-minutes'] == 300
+    assert coverage['outputs'] == {
+        'coverage_summary': '${{ steps.measure.outputs.coverage_summary }}',
+    }
+    assert jobs['opencode-review-target']['needs'] == ['validate-pr-metadata', 'coverage-evidence']
+    assert jobs['opencode-review-target']['permissions']['pull-requests'] == 'write'
+    assert jobs['opencode-review-target']['permissions']['id-token'] == 'write'
diff --git a/tests/test_opencode_python_coverage_case_lint.py b/tests/test_opencode_python_coverage_case_lint.py
new file mode 100644
index 0000000000..96e5f2b930
--- /dev/null
+++ b/tests/test_opencode_python_coverage_case_lint.py
@@ -0,0 +1,50 @@
+"""Exercise the actual Python-coverage case without redundant alternatives."""
+
+import fnmatch
+import subprocess
+from pathlib import Path
+
+import pytest
+
+WORKFLOW = Path(__file__).resolve().parents[1] / ".github/workflows/opencode-review-dispatch.yml"
+
+
+def _case_script():
+    """Extract only the shipped basename case, retaining its loop break."""
+    text = WORKFLOW.read_text(encoding="utf-8")
+    start = text.index('              case "$changed_basename" in')
+    end = text.index("              esac", start) + len("              esac")
+    return (
+        "#!/bin/bash\npython_coverage_required=0\n"
+        "while IFS= read -r changed_basename; do\n"
+        + text[start:end]
+        + '\ndone\nprintf "%s\\n" "$python_coverage_required"\n'
+    )
+
+
+def test_python_coverage_case_has_no_shadowed_alternative():
+    """Reject literal alternatives already admitted by an earlier glob."""
+    case = _case_script().split('case "$changed_basename" in', 1)[1]
+    alternatives = case.split(")", 1)[0].replace("\\\n", "").strip().split("|")
+    earlier = []
+    for alternative in alternatives:
+        alternative = alternative.strip()
+        if not any(character in alternative for character in "*?["):
+            assert not any(fnmatch.fnmatchcase(alternative, pattern) for pattern in earlier), alternative
+        earlier.append(alternative)
+
+
+@pytest.mark.parametrize("name,expected", [
+    ("setup.py", "1"), ("module.py", "1"), ("setup.cfg", "1"),
+    ("pyproject.toml", "1"), ("requirements-dev.txt", "1"),
+    ("environment.yaml", "1"), ("README.md", "0"),
+    ("setup.py.bak", "0"), ("package.json", "0"),
+])
+def test_python_coverage_case_keeps_admission(name, expected):
+    """Removing the redundant setup.py token must retain actual admission."""
+    result = subprocess.run(
+        ["bash", "-c", _case_script()], input=name + "\n",
+        capture_output=True, text=True, timeout=10,
+    )
+    assert result.returncode == 0, result.stderr
+    assert result.stdout.strip() == expected
diff --git a/tests/test_opencode_queue_priority.py b/tests/test_opencode_queue_priority.py
index b1d5aa5c17..c7820939cd 100644
--- a/tests/test_opencode_queue_priority.py
+++ b/tests/test_opencode_queue_priority.py
@@ -2,7 +2,16 @@
 
 from __future__ import annotations
 
+import json
+import runpy
+import subprocess
+import sys
 from datetime import datetime, timezone
+from types import SimpleNamespace
+
+import pytest
+
+from scripts.ci import opencode_queue_priority as queue
 
 from scripts.ci.opencode_queue_priority import (
     PrState,
@@ -63,3 +72,229 @@ def test_metrics_surface_deferred_backlog_and_priority_position() -> None:
     assert m["deferred"] == 2
     assert m["oldest_deferred_hours"] == 9.0
     assert m["priority_positions"] == {"o/a#1": 2}
+
+def test_metrics_report_zero_age_when_no_current_run_is_deferred() -> None:
+    """An empty current-head queue must not invent a deferred age."""
+    assert metrics(plan([], {}), now=NOW) == {
+        "queued": 0,
+        "deferred": 0,
+        "stale": 0,
+        "oldest_deferred_hours": 0.0,
+        "priority_positions": {},
+    }
+
+
+def test_fetch_queued_parses_only_bound_dispatch_titles(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Unrelated queued workflows must not become cancellation candidates."""
+    response = "\n".join(
+        json.dumps(item)
+        for item in [
+            [101, "2026-09-29T06:30:00Z", "Review ContextualWisdomLab/naruon#974@abcdef0"],
+            [102, "2026-09-29T06:31:00Z", "Review another-org/naruon#974@abcdef0"],
+            [103, "2026-09-29T06:32:00Z", "Review ContextualWisdomLab/naruon#974@ABCDEF0"],
+        ]
+    )
+    monkeypatch.setattr(queue, "_gh", lambda *_args, **_kwargs: response)
+
+    assert queue.fetch_queued() == [
+        QueuedRun(
+            101,
+            datetime(2026, 9, 29, 6, 30, tzinfo=timezone.utc),
+            "ContextualWisdomLab/naruon",
+            974,
+            "abcdef0",
+        )
+    ]
+
+
+def _pull_request_node(*, labels: list[str], events: list[dict]) -> dict:
+    return {
+        "state": "OPEN",
+        "headRefOid": HEAD,
+        "labels": {"nodes": [{"name": name} for name in labels]},
+        "timelineItems": {"nodes": events},
+    }
+
+
+def test_fetch_live_accepts_only_a_writer_applied_priority_label(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A label without a trusted applying actor must not gain queue priority."""
+    nodes = {
+        "p0": {
+            "pullRequest": _pull_request_node(labels=["other"], events=[]),
+        },
+        "p1": {
+            "pullRequest": _pull_request_node(
+                labels=["review-priority"],
+                events=[
+                    {"label": {"name": "other"}, "actor": {"login": "ignored"}},
+                    {"label": {"name": "review-priority"}, "actor": None},
+                    {"label": {"name": "review-priority"}, "actor": {"login": "alice"}},
+                    {"label": {"name": "review-priority"}, "actor": {"login": "alice"}},
+                ],
+            ),
+        },
+        "p2": {
+            "pullRequest": _pull_request_node(
+                labels=["review-priority"],
+                events=[
+                    {"label": {"name": "review-priority"}, "actor": {"login": "bob"}},
+                ],
+            ),
+        },
+        "p3": None,
+    }
+    permission_requests: list[str] = []
+
+    def fake_gh(*args: str, stdin: str | None = None) -> str:
+        del stdin
+        if args[:2] == ("api", "graphql"):
+            return json.dumps({"data": nodes})
+        endpoint = args[1]
+        permission_requests.append(endpoint)
+        if endpoint.endswith("/alice/permission"):
+            return "write\n"
+        raise subprocess.CalledProcessError(1, ["gh", *args])
+
+    monkeypatch.setattr(queue, "_gh", fake_gh)
+    live = queue.fetch_live(
+        {
+            ("ContextualWisdomLab/a", 1),
+            ("ContextualWisdomLab/b", 2),
+            ("ContextualWisdomLab/c", 3),
+            ("ContextualWisdomLab/d", 4),
+        },
+        "review-priority",
+    )
+
+    assert live == {
+        ("ContextualWisdomLab/a", 1): PrState("OPEN", HEAD, False),
+        ("ContextualWisdomLab/b", 2): PrState("OPEN", HEAD, True),
+        ("ContextualWisdomLab/c", 3): PrState("OPEN", HEAD, False),
+    }
+    assert permission_requests == [
+        "repos/ContextualWisdomLab/b/collaborators/alice/permission",
+        "repos/ContextualWisdomLab/c/collaborators/bob/permission",
+    ]
+
+
+def test_fetch_live_treats_null_graphql_data_as_no_live_pr(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A null GraphQL payload must fail closed instead of fabricating PR state."""
+    monkeypatch.setattr(queue, "_gh", lambda *_args, **_kwargs: '{"data": null}')
+    assert queue.fetch_live({("ContextualWisdomLab/a", 1)}, "review-priority") == {}
+
+
+def test_apply_requires_recording_the_cancel_list_first(capsys: pytest.CaptureFixture[str]) -> None:
+    """The CLI must reject an apply request that has no audit issue."""
+    with pytest.raises(SystemExit) as error:
+        queue.main(["--apply"])
+
+    assert error.value.code == 2
+    assert "--apply requires --post-issue" in capsys.readouterr().err
+
+
+def test_main_default_report_does_not_target_a_current_head_run(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """Dry-run defaults must report, but not list, a non-priority current head."""
+    current = run(2, "ContextualWisdomLab/a", 1)
+    monkeypatch.setattr(queue, "fetch_queued", lambda: [current])
+    monkeypatch.setattr(
+        queue,
+        "fetch_live",
+        lambda _keys, _label: {(current.repo, current.pr): PrState("OPEN", HEAD, False)},
+    )
+
+    assert queue.main([]) == 0
+
+    output = capsys.readouterr().out
+    assert '"deferred": 1' in output
+    assert output.endswith("run_id\tcreated_at\trepository\tpr\thead_sha\treason\n")
+
+
+def test_main_records_targets_before_cancelling_only_still_queued_runs(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """Apply must record both reasons first and cancel only a queued target."""
+    stale = run(1, "ContextualWisdomLab/a", 1, hour=3)
+    current = run(2, "ContextualWisdomLab/b", 2, hour=4)
+    priority = run(3, "ContextualWisdomLab/c", 3, hour=5)
+    monkeypatch.setattr(queue, "fetch_queued", lambda: [stale, current, priority])
+    monkeypatch.setattr(
+        queue,
+        "fetch_live",
+        lambda _keys, _label: {
+            (stale.repo, stale.pr): PrState("CLOSED", HEAD, False),
+            (current.repo, current.pr): PrState("OPEN", HEAD, False),
+            (priority.repo, priority.pr): PrState("OPEN", HEAD, True),
+        },
+    )
+    calls: list[tuple[tuple[str, ...], str | None]] = []
+
+    def fake_gh(*args: str, stdin: str | None = None) -> str:
+        calls.append((args, stdin))
+        if f"/runs/{stale.run_id}" in args[1] and args[-2:] == ("--jq", ".status"):
+            return "queued\n"
+        if f"/runs/{current.run_id}" in args[1] and args[-2:] == ("--jq", ".status"):
+            return "completed\n"
+        return ""
+
+    monkeypatch.setattr(queue, "_gh", fake_gh)
+
+    assert queue.main(
+        [
+            "--label",
+            "urgent",
+            "--include-current",
+            "--post-issue",
+            "ContextualWisdomLab/control#9",
+            "--apply",
+        ]
+    ) == 0
+
+    output = capsys.readouterr().out
+    assert f"{stale.run_id}\t" in output and "\tstale\n" in output
+    assert f"{current.run_id}\t" in output and "\tdeferred\n" in output
+    assert "cancelled=1" in output
+    assert calls[0][0] == (
+        "issue",
+        "comment",
+        "9",
+        "-R",
+        "ContextualWisdomLab/control",
+        "--body-file",
+        "-",
+    )
+    assert "Label `urgent` (maintainer-applied) kept: 1. To cancel: 2." in (calls[0][1] or "")
+    assert [args for args, _stdin in calls if args[-1].endswith("/cancel")] == [
+        (
+            "api",
+            "-X",
+            "POST",
+            f"repos/{queue.CENTRAL}/actions/runs/{stale.run_id}/cancel",
+        )
+    ]
+
+
+def test_script_entrypoint_reports_an_empty_queue(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """Direct execution must invoke the CLI rather than silently doing nothing."""
+    monkeypatch.setattr(sys, "argv", [queue.__file__])
+    monkeypatch.setattr(
+        subprocess,
+        "run",
+        lambda *_args, **_kwargs: SimpleNamespace(stdout=""),
+    )
+
+    with pytest.raises(SystemExit) as error:
+        runpy.run_path(queue.__file__, run_name="__main__")
+
+    assert error.value.code == 0
+    assert '"queued": 0' in capsys.readouterr().out
diff --git a/tests/test_opencode_required_rerun_capacity.py b/tests/test_opencode_required_rerun_capacity.py
index c85bc24e3c..33f72c073d 100644
--- a/tests/test_opencode_required_rerun_capacity.py
+++ b/tests/test_opencode_required_rerun_capacity.py
@@ -8,7 +8,11 @@
 from pathlib import Path
 import subprocess
 
-from tests.test_opencode_required_verdict_regression import HEAD, fail_closed_script
+from tests.test_opencode_required_verdict_regression import (
+    HEAD,
+    RECEIPT_HELPER,
+    fail_closed_script,
+)
 
 
 REQUIRED = Path(".github/workflows/opencode-review.yml")
@@ -64,6 +68,8 @@ def test_missing_verdict_fails_after_one_review_read(tmp_path: Path) -> None:
 printf '%s\n' "$*" >>"$CALLS"
 if [[ "$*" == "api repos/owner/repo/pulls/7" ]]; then
   printf '%s' "$LIVE_PR"
+elif [[ "$*" == *"contents/scripts/ci/opencode_review_receipt_gate.py"* ]]; then
+  base64 <"$REAL_RECEIPT_HELPER"
 elif [[ "$*" == *"/pulls/7/reviews?per_page=100"* ]]; then
   printf '[]'
 else
@@ -85,6 +91,9 @@ def test_missing_verdict_fails_after_one_review_read(tmp_path: Path) -> None:
             "HEAD_SHA": HEAD,
             "PR_ACTION": "synchronize",
             "PR_DRAFT": "false",
+            "CHANGED_SCOPE_CODE": "true",
+            "WORKFLOW_SHA": "6a37e4cdfbd8bf6f3a60645a0ad7c13e1b9c1ae3",
+            "REAL_RECEIPT_HELPER": str(RECEIPT_HELPER.resolve()),
             "LIVE_PR": json.dumps(
                 {"draft": False, "head": {"sha": HEAD}, "state": "open"}
             ),
@@ -98,5 +107,6 @@ def test_missing_verdict_fails_after_one_review_read(tmp_path: Path) -> None:
     assert "will rerun this failed job" in result.stdout
     assert calls.read_text(encoding="utf-8").splitlines() == [
         "api repos/owner/repo/pulls/7",
-        "api --paginate repos/owner/repo/pulls/7/reviews?per_page=100",
+        "api --paginate --slurp repos/owner/repo/pulls/7/reviews?per_page=100",
+        "api repos/ContextualWisdomLab/.github/contents/scripts/ci/opencode_review_receipt_gate.py?ref=6a37e4cdfbd8bf6f3a60645a0ad7c13e1b9c1ae3 --jq .content",
     ]
diff --git a/tests/test_opencode_required_verdict_regression.py b/tests/test_opencode_required_verdict_regression.py
index c764ad0ad2..c5e735023d 100644
--- a/tests/test_opencode_required_verdict_regression.py
+++ b/tests/test_opencode_required_verdict_regression.py
@@ -12,6 +12,8 @@
 import shutil
 import subprocess
 import textwrap
+import tempfile
+import sys
 from pathlib import Path
 
 import pytest
@@ -42,7 +44,9 @@ def fail_closed_script() -> str:
     step = workflow.split(
         "      - name: Fail closed without a current-head OpenCode verdict\n", 1
     )[1]
-    return textwrap.dedent(step.split("        run: |\n", 1)[1])
+    return textwrap.dedent(step.split("        run: |\n", 1)[1].split(
+        "\n  cancel-superseded-opencode-review-runs:", 1
+    )[0])
 
 
 def admission_script() -> str:
@@ -97,31 +101,56 @@ def test_opencode_dispatch_uses_the_same_target_repo_pr_group() -> None:
 def review(*, state: str, commit_id: str = HEAD, body: str = "") -> dict[str, object]:
     """Build one Reviews API record from the OpenCode GitHub App."""
     return {
+        "id": 1,
         "user": {"login": "opencode-agent[bot]"},
         "state": state,
         "commit_id": commit_id,
-        "body": body,
+        "body": body or f"## Pull request overview\n- Head SHA: `{commit_id}`\n",
     }
 
 
 def runtime_verdict(reviews: list[dict[str, object]], head_sha: str = HEAD) -> str:
-    """Execute the jq program embedded in the required workflow."""
-    jq = shutil.which("jq")
-    if jq is None:
-        pytest.skip("jq is required to execute the production verdict filter")
-    workflow = WORKFLOW.read_text(encoding="utf-8")
-    marker = """jq -r -s --arg sha "$HEAD_SHA" '"""
-    start = workflow.index(marker) + len(marker)
-    end = workflow.index("\n          ')", start)
-    result = subprocess.run(
-        [jq, "-r", "-s", "--arg", "sha", head_sha, workflow[start:end]],
-        input=json.dumps(reviews),
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    assert result.returncode == 0, result.stderr
-    return result.stdout.strip()
+    """Execute the actual verdict step with strict offline-only GitHub reads."""
+    import base64
+
+    with tempfile.TemporaryDirectory() as directory:
+        root = Path(directory)
+        fake_gh = root / "gh"
+        fake_gh.write_text(
+            f"#!{sys.executable}\n" + Path(__file__).with_name("fixture_github_reads.py").read_text()
+        )
+        fake_gh.chmod(0o700)
+        fixture = root / "fixture.json"
+        fixture.write_text(json.dumps({
+            "pull": {"head": {"sha": head_sha}, "draft": False, "state": "open"},
+            "reviews": reviews, "lookup_fail": False, "malformed": False,
+            "calls": str(root / "calls.jsonl"),
+            "helper_base64": base64.b64encode(RECEIPT_HELPER.read_bytes()).decode(),
+        }))
+        bash = shutil.which("bash")
+        assert bash is not None
+        result = subprocess.run(
+            [bash, "-c", fail_closed_script()], cwd=root,
+            env={
+                "PATH": str(root) + os.pathsep + str(Path(bash).parent) + os.pathsep + str(Path(sys.executable).parent) + os.pathsep + os.defpath,
+                "HOME": str(root), "TMPDIR": str(root), "FIXTURE_FILE": str(fixture),
+                "TARGET_REPOSITORY": "ContextualWisdomLab/fast-mlsirm", "PR_NUMBER": "2018",
+                "HEAD_SHA": head_sha, "PR_ACTION": "synchronize", "PR_DRAFT": "false",
+                "CHANGED_SCOPE_CODE": "true", "WORKFLOW_SHA": "6a37e4cdfbd8bf6f3a60645a0ad7c13e1b9c1ae3",
+                "PYTHONDONTWRITEBYTECODE": "1",
+            },
+            capture_output=True, text=True, timeout=15,
+        )
+        calls = [json.loads(line) for line in (root / "calls.jsonl").read_text().splitlines()]
+        assert len(calls) == 3, result.stdout + result.stderr
+        assert all("POST" not in call and "-X" not in call for call in calls)
+    assert result.returncode in (0, 1), result.stderr
+    if result.returncode:
+        assert "No current-head formal OpenCode verdict:" in result.stderr
+        return ""
+    match = re.search(r"Current-head OpenCode verdict: (APPROVED|CHANGES_REQUESTED)\.", result.stdout)
+    assert match is not None, result.stdout + result.stderr
+    return match.group(1)
 
 
 @pytest.mark.parametrize("state", ("APPROVED", "CHANGES_REQUESTED"))
@@ -324,7 +353,14 @@ def test_required_workflow_cannot_succeed_with_an_echo_only_placeholder() -> Non
     assert "while :; do" not in target_job
     assert "poll_interval_seconds" not in target_job
     assert "180 minutes of polling" not in target_job
-    assert 'gh api --paginate "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}/reviews?per_page=100"' in workflow
+    admission = fail_closed_script()
+    assert 'gh api --paginate --slurp "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}/reviews?per_page=100"' in admission
+    assert 'contents/scripts/ci/opencode_review_receipt_gate.py?ref=${WORKFLOW_SHA}' in admission
+    assert 'gate.evaluate_receipts(reviews, head_sha, is_draft=False)' in admission
+    step_env = workflow.split(
+        '      - name: Fail closed without a current-head OpenCode verdict\n', 1
+    )[1].split('        run: |\n', 1)[0]
+    assert 'WORKFLOW_SHA: ${{ github.workflow_sha }}' in step_env
     assert "github.event.pull_request.head.sha" in workflow
     assert "will rerun this failed job" in workflow
     assert (
diff --git a/tests/test_opencode_review_receipt_gate.py b/tests/test_opencode_review_receipt_gate.py
index c971e2128a..a7437c5bca 100644
--- a/tests/test_opencode_review_receipt_gate.py
+++ b/tests/test_opencode_review_receipt_gate.py
@@ -49,6 +49,91 @@ def test_afipc_230_stale_changes_requested_are_not_current() -> None:
     assert "formal review" in reason
 
 
+@pytest.mark.parametrize("login", sorted(receipt.FORMAL_AUTHORS))
+def test_newer_same_publisher_dismissal_retires_older_approval(login: str) -> None:
+    """A current-head dismissal must not resurrect its publisher's older approval."""
+    approved = review(
+        commit=receipt.AFIPC_230_HEAD, state="APPROVED", login=login, review_id=1
+    )
+    dismissed = review(
+        commit=receipt.AFIPC_230_HEAD, state="DISMISSED", login=login, review_id=2
+    )
+    dismissed["body"] = ""
+    found, reason = receipt.evaluate_receipts(
+        [approved, dismissed], receipt.AFIPC_230_HEAD
+    )
+    assert found is None
+    assert "dismissed" in reason.lower()
+
+
+@pytest.mark.parametrize(
+    "case",
+    ["dismissed-only", "other-publisher", "newer-approved", "newer-changes-requested"],
+)
+def test_dismissal_preserves_independent_and_newer_receipts(case: str) -> None:
+    """Dismissal retires older same-publisher evidence, not independent or fresh verdicts."""
+    approved = review(commit=receipt.AFIPC_230_HEAD, state="APPROVED", review_id=1)
+    dismissed = review(commit=receipt.AFIPC_230_HEAD, state="DISMISSED", review_id=2)
+    if case == "dismissed-only":
+        found, reason = receipt.evaluate_receipts([dismissed], receipt.AFIPC_230_HEAD)
+        assert found is None
+        assert "dismissed" in reason
+    elif case == "other-publisher":
+        dismissed["user"] = {"login": "github-actions[bot]"}
+        found, _ = receipt.evaluate_receipts([approved, dismissed], receipt.AFIPC_230_HEAD)
+        assert found is approved
+    else:
+        latest = review(
+            commit=receipt.AFIPC_230_HEAD,
+            state="APPROVED" if case == "newer-approved" else "CHANGES_REQUESTED",
+            review_id=3,
+        )
+        found, _ = receipt.evaluate_receipts(
+            [approved, dismissed, latest], receipt.AFIPC_230_HEAD
+        )
+        assert found is latest
+
+
+@pytest.mark.parametrize("invalid_field", ["author", "commit", "body-head", "id"])
+def test_unbound_dismissal_does_not_retire_valid_receipt(invalid_field: str) -> None:
+    """Only a recognized publisher's identified exact-head dismissal retires evidence."""
+    approved = review(commit=receipt.AFIPC_230_HEAD, state="APPROVED", review_id=1)
+    dismissed = review(commit=receipt.AFIPC_230_HEAD, state="DISMISSED", review_id=2)
+    if invalid_field == "author":
+        dismissed["user"] = {"login": "seonghobae"}
+    elif invalid_field == "commit":
+        dismissed["commit_id"] = "b" * 40
+    elif invalid_field == "body-head":
+        dismissed["body"] = f"## Pull request overview\nHead SHA: `{'b' * 40}`"
+    else:
+        dismissed.pop("id")
+    found, _ = receipt.evaluate_receipts([approved, dismissed], receipt.AFIPC_230_HEAD)
+    assert found is approved
+
+
+def test_graphql_dismissal_fails_closed_through_receipt_cli(
+    tmp_path: Path, capsys, monkeypatch
+) -> None:
+    """REST approval plus newer GraphQL dismissal produces a failing required-gate exit."""
+    approved = review(commit=receipt.AFIPC_230_HEAD, state="APPROVED", review_id=1)
+    dismissed = {
+        "id": 2,
+        "state": "DISMISSED",
+        "author": {"login": "opencode-agent[bot]"},
+        "commit": {"oid": receipt.AFIPC_230_HEAD},
+        "body": "",
+    }
+    path = tmp_path / "reviews.json"
+    path.write_text(json.dumps([approved, dismissed]), encoding="utf-8")
+    monkeypatch.delenv("GITHUB_STEP_SUMMARY", raising=False)
+    assert receipt.main(
+        ["--head-sha", receipt.AFIPC_230_HEAD, "--reviews-file", str(path)]
+    ) == 1
+    captured = capsys.readouterr()
+    assert captured.out == ""
+    assert "dismissed" in captured.err
+
+
 def test_kaefa_79_stub_has_no_current_head_formal_receipt() -> None:
     """A 3-second green stub without a product-file review stays fail-closed."""
     found, reason = receipt.evaluate_receipts([], receipt.KAEFA_79_HEAD)
diff --git a/tests/test_opencode_shellcheck_literals.py b/tests/test_opencode_shellcheck_literals.py
new file mode 100644
index 0000000000..f705b67657
--- /dev/null
+++ b/tests/test_opencode_shellcheck_literals.py
@@ -0,0 +1,32 @@
+"""Bind each lint quote repair to the original literal bytes and actual Bash."""
+
+import hashlib
+import json
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW = ROOT / ".github/workflows/opencode-review-dispatch.yml"
+OPERANDS = json.loads((ROOT / "tests/fixtures/opencode_shell_literal_operands.json").read_text())
+
+
+@pytest.mark.parametrize("row", OPERANDS, ids=lambda row: row["literal_sha256"][:12])
+def test_migrated_operand_preserves_original_literal(row):
+    """Inspect each shipped replacement, then expand it without its consumer."""
+    text = WORKFLOW.read_text(encoding="utf-8")
+    assert text.count(row["after"]) == row["count"]
+    assert hashlib.sha256(row["expected"].encode()).hexdigest() == row["literal_sha256"]
+    # No bash/jq/GraphQL consumer runs here; only operand expansion into printf.
+    start = text.index(row["after"])
+    actual = text[start:start + len(row["after"])]
+    result = subprocess.run(
+        ["bash", "-eu", "-c", "printf '%s' " + actual],
+        env={"PATH": os.defpath, "LC_ALL": "C", "n": "SENTINEL", "owner": "SENTINEL"},
+        capture_output=True, timeout=10,
+    )
+    assert result.returncode == 0, result.stderr
+    assert result.stderr == b""
+    assert result.stdout == row["expected"].encode()
diff --git a/tests/test_opencode_vulkan_path_selection.py b/tests/test_opencode_vulkan_path_selection.py
new file mode 100644
index 0000000000..249424fcff
--- /dev/null
+++ b/tests/test_opencode_vulkan_path_selection.py
@@ -0,0 +1,58 @@
+"""Exercise the shipped ICD selector without installing or running a GPU."""
+
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+WORKFLOW = Path(__file__).resolve().parents[1] / ".github/workflows/opencode-review-dispatch.yml"
+
+
+def _adapter_function(icd_root):
+    """Change only the fixed system pathname to a fixture-owned directory."""
+    text = WORKFLOW.read_text(encoding="utf-8")
+    start = text.index("          ensure_rust_gpu_adapter() {")
+    end = text.index("\n          ensure_rust_desktop_deps() {", start)
+    function = text[start:end]
+    assert function.count("/usr/share/vulkan/icd.d/") >= 1
+    return function.replace("/usr/share/vulkan/icd.d/", str(icd_root) + "/")
+
+
+@pytest.mark.parametrize("names,expected", [
+    ([], None),
+    (["lvp_icd.a.json"], "lvp_icd.a.json"),
+    (["lvp_icd.b.json", "lvp_icd.a.json"], "lvp_icd.a.json"),
+    (["lvp_icd.a b.json"], "lvp_icd.a b.json"),
+    (["lvp_icd.a\nb.json"], "lvp_icd.a\nb.json"),
+])
+def test_adapter_keeps_complete_path(tmp_path, names, expected):
+    """The actual selector retains the whole selected filename and both exports."""
+    for name in names:
+        (tmp_path / name).write_text("{}", encoding="utf-8")
+    script = "append() { :; }\n" + _adapter_function(tmp_path)
+    script += '\nensure_rust_gpu_adapter\nprintf "%s\\0%s" "${VK_ICD_FILENAMES:-}" "${VK_DRIVER_FILES:-}"'
+    result = subprocess.run(
+        ["bash", "-euo", "pipefail", "-c", script],
+        env={"PATH": os.defpath, "LC_ALL": "C"},
+        capture_output=True, timeout=10,
+    )
+    assert result.returncode == 0, result.stderr
+    selected = str(tmp_path / expected).encode() if expected else b""
+    assert result.stdout == selected + b"\0" + selected
+    assert result.stderr == b""
+
+
+def test_adapter_does_not_select_matching_directory(tmp_path):
+    """Only a regular ICD file can be exported as a driver configuration."""
+    (tmp_path / "lvp_icd.a.json").mkdir()
+    (tmp_path / "lvp_icd.b.json").write_text("{}", encoding="utf-8")
+    script = "append() { :; }\n" + _adapter_function(tmp_path)
+    script += '\nensure_rust_gpu_adapter\nprintf "%s" "${VK_ICD_FILENAMES:-}"'
+    result = subprocess.run(
+        ["bash", "-euo", "pipefail", "-c", script],
+        env={"PATH": os.defpath, "LC_ALL": "C"},
+        capture_output=True, timeout=10,
+    )
+    assert result.returncode == 0, result.stderr
+    assert result.stdout == str(tmp_path / "lvp_icd.b.json").encode()
diff --git a/tests/test_personal_review_route.py b/tests/test_personal_review_route.py
new file mode 100644
index 0000000000..4317810d91
--- /dev/null
+++ b/tests/test_personal_review_route.py
@@ -0,0 +1,110 @@
+"""Personal wire auto is distinct from an orchestrator alias; policy fails closed."""
+import importlib
+import json
+from pathlib import Path
+import pytest
+
+
+def module():
+    assert importlib.util.find_spec('scripts.ci.personal_review_route') is not None, 'Missing personal wire-auto route'
+    return importlib.import_module('scripts.ci.personal_review_route')
+
+
+def test_config_primary_small_reset_preserves_permissions_and_wire_auto(tmp_path):
+    route = module()
+    path = tmp_path / 'opencode.jsonc'
+    path.write_text(json.dumps({'model': 'unsafe/a', 'small_model': 'unsafe/b',
+                               'permission': {'edit': 'deny'}, 'agent': {'ci-review': {'steps': 4}}}))
+    route.configure_opencode(path)
+    result = json.loads(path.read_text())
+    assert result['model'] == result['small_model'] == 'personal-litellm/auto'
+    assert result['provider']['personal-litellm']['models'].keys() == {'auto'}
+    options = result['provider']['personal-litellm']['options']
+    assert options == {'baseURL': 'https://litellm.poinnetworks.net/v1',
+                       'apiKey': '{env:LLM_GATEWAY_API_KEY}'}
+    assert result['permission'] == {'edit': 'deny'}
+    assert result['agent']['ci-review']['steps'] == 4
+
+
+@pytest.mark.parametrize('cost,zdr,private', [(False, True, False), (True, False, True), (False, False, True)])
+def test_private_target_without_retention_attestation_stops_before_configuration(cost,zdr,private):
+    with pytest.raises(RuntimeError, match='STOP'):
+        module().require_admission(zero_cost=cost, zero_retention=zdr, private_target=private)
+
+
+def test_public_and_private_attested_admission_are_distinct():
+    module().require_admission(zero_cost=True, zero_retention=False, private_target=False)
+    module().require_admission(zero_cost=True, zero_retention=True, private_target=True)
+
+
+def test_actual_review_workflows_consume_named_existing_secret_and_auto_route():
+    root = Path(__file__).resolve().parents[1]
+    noema = (root / '.github/workflows/noema-review.yml').read_text()
+    dispatch = (root / '.github/workflows/opencode-review-dispatch.yml').read_text()
+    for text in (noema, dispatch):
+        assert 'LLM_GATEWAY_API_KEY: ${{ secrets.LLM_GATEWAY_API_KEY }}' in text
+        assert 'scripts.ci.personal_review_route' in text
+        assert 'PERSONAL_REVIEW_ZERO_COST_ATTESTED' in text
+        assert 'PERSONAL_REVIEW_ZDR_ATTESTED' in text
+    assert 'export NOEMA_LLM_MODEL="auto"' in noema
+    assert 'https://litellm.poinnetworks.net/v1/chat/completions' in noema
+    assert '--opencode-config "${OPENCODE_REVIEW_WORKDIR}/opencode.jsonc"' in dispatch
+    assert 'OPENCODE_MODEL_CANDIDATES="personal-litellm/auto"' in dispatch
+    assert 'MODEL="personal-litellm/auto"' in dispatch
+
+
+@pytest.mark.parametrize('configure', [False, True])
+def test_cli_consumes_explicit_policy_and_preserves_config(tmp_path, configure):
+    path = tmp_path / 'config.jsonc'
+    path.write_text('// trusted comment\n{"permission":{"edit":"deny"}}')
+    args = ['--zero-cost', 'true', '--zero-retention', 'true', '--private-target', 'true']
+    if configure:
+        args += ['--opencode-config', str(path)]
+    assert module().main(args) == 0
+    if configure:
+        assert json.loads(path.read_text())['model'] == 'personal-litellm/auto'
+    else:
+        assert path.read_text().startswith('// trusted comment')
+
+
+def test_cli_stop_does_not_write_config_or_assume_attestation(tmp_path):
+    path = tmp_path / 'config.jsonc'
+    original = '{"permission":{"edit":"deny"}}'
+    path.write_text(original)
+    with pytest.raises(RuntimeError, match='zero-cost supplier'):
+        module().main(['--zero-cost', 'false', '--zero-retention', 'false',
+                       '--private-target', 'false', '--opencode-config', str(path)])
+    assert path.read_text() == original
+
+
+def test_module_cli_entry_point_stops_without_policy_inputs(monkeypatch):
+    import runpy
+    import sys
+    monkeypatch.setattr(sys, 'argv', [str(Path(module().__file__))])
+    with pytest.raises(SystemExit) as result:
+        runpy.run_path(str(Path(module().__file__)), run_name='__main__')
+    assert result.value.code == 2
+
+
+def test_actual_noema_payload_uses_literal_auto_without_sampling_override(monkeypatch):
+    from scripts.ci import noema_review_gate as gate
+    from tests.test_noema_review_gate import FakeResponse
+    captured = []
+    monkeypatch.setenv('NOEMA_LLM_API_URL', 'https://litellm.poinnetworks.net/v1/chat/completions')
+    monkeypatch.setenv('NOEMA_LLM_MODEL', 'auto')
+    monkeypatch.setenv('NOEMA_LLM_API_KEY', 'synthetic-test-only')
+    monkeypatch.setattr(gate, 'validate_substantive_verdict', lambda *_: None)
+    monkeypatch.setattr(gate.socket, 'getaddrinfo', lambda *_: [])
+    class Opener:
+        def open(self, request):
+            captured.append((request.full_url, json.loads(request.data)))
+            return FakeResponse({'model': 'auto', 'choices': [{'message': {'content': json.dumps({
+                'decision': 'comment', 'summary': 'Controlled source-only payload probe.', 'findings': []})}}]})
+    monkeypatch.setattr(gate.urllib.request, 'build_opener', lambda *_: Opener())
+    verdict = gate.call_llm('ContextualWisdomLab/.github', 2565, {'headRefOid': 'a'*40},
+                            '', False, 'a'*40)
+    assert verdict['decision'] == 'comment'
+    url, body = captured[0]
+    assert url == 'https://litellm.poinnetworks.net/v1/chat/completions'
+    assert body['model'] == 'auto' and 'temperature' not in body
+    assert body['response_format']['type'] == 'json_schema'
diff --git a/tests/test_pingora_edge_policy.py b/tests/test_pingora_edge_policy.py
index aba34f6346..93fbc58c15 100644
--- a/tests/test_pingora_edge_policy.py
+++ b/tests/test_pingora_edge_policy.py
@@ -766,12 +766,16 @@ def test_declared_prefix_for_path_matches_by_path_segment() -> None:
 def test_github_open_json_maps_not_found_to_artifact_declaration_error(monkeypatch: pytest.MonkeyPatch) -> None:
     """A 404 from the GitHub API is distinguished from every other transport failure."""
 
+    error_body = BytesIO()
     monkeypatch.setattr(
         policy.github_opener, "open",
-        lambda _request, timeout: (_ for _ in ()).throw(HTTPError("x", 404, "not found", {}, BytesIO())),
+        lambda _request, timeout: (_ for _ in ()).throw(
+            HTTPError("x", 404, "not found", {}, error_body)
+        ),
     )
     with pytest.raises(policy.ArtifactDeclarationNotFoundError):
         policy._github_open_json("https://api.github.com/repos/a/b", "token")
+    assert error_body.closed
 
 
 def test_png_structure_validation_fails_closed_on_malformed_chunks() -> None:
@@ -1062,6 +1066,7 @@ def test_changed_file_pagination_bound_is_provably_unreachable() -> None:
         ({"type": "file", "encoding": "none", "size": 1}, "no inline content"),
         ({"type": "file", "encoding": "none", "size": "not-an-int"}, "malformed size"),
         ({"type": "file", "encoding": "utf-8", "size": 1, "content": "x"}, "invalid encoding"),
+        ({"type": "file", "encoding": "base64", "size": 1, "content": 1}, "malformed size"),
         ({"type": "file", "encoding": "base64", "size": 1, "content": "!"}, "invalid base64"),
         ({"type": "file", "encoding": "base64", "size": 2, "content": base64.b64encode(b"x").decode()}, "size mismatch"),
         ({"type": "file", "encoding": "base64", "size": 1, "content": base64.b64encode(b"\xff").decode()}, "not valid UTF-8"),
@@ -1247,6 +1252,23 @@ def open_response(request: object, timeout: int) -> FakeResponse:
         policy._github_open_raw_bytes(url, "token", 3)
 
 
+@pytest.mark.parametrize("exc", [URLError("dns"), TimeoutError(), HTTPError("x", 500, "bad", {}, BytesIO())])
+def test_github_open_raw_bytes_sanitizes_transport_failures(
+    monkeypatch: pytest.MonkeyPatch, exc: Exception,
+) -> None:
+    """Raw-blob failures preserve only their stable class, never response text."""
+
+    def fail(_request: object, timeout: int) -> object:
+        assert timeout == 30
+        raise exc
+
+    monkeypatch.setattr(policy.github_opener, "open", fail)
+    url = "https://api.github.com/repos/a/b/git/blobs/" + "a" * 40
+    with pytest.raises(policy.PolicyError) as raised:
+        policy._github_open_raw_bytes(url, "token", 4)
+    assert str(raised.value) == f"GitHub raw blob request failed: {type(exc).__name__}"
+
+
 @pytest.mark.parametrize(
     "url",
     [
@@ -1268,8 +1290,9 @@ def test_github_open_json_rejects_nonapproved_origins(url: str) -> None:
 def test_github_opener_never_constructs_redirect_requests() -> None:
     """The policy opener refuses redirects rather than changing API origins."""
 
-    with pytest.raises(HTTPError):
+    with pytest.raises(HTTPError) as exc_info:
         policy.NoRedirectHandler().redirect_request(policy.Request("https://example.com"), None, 302, "Found", {}, "https://evil.example")
+    exc_info.value.close()
 
 
 def test_annotation_escapes_workflow_command_fields() -> None:
diff --git a/tests/test_place_maturin_extension.py b/tests/test_place_maturin_extension.py
index a1d6f7757a..c62d2896e9 100644
--- a/tests/test_place_maturin_extension.py
+++ b/tests/test_place_maturin_extension.py
@@ -2,6 +2,11 @@
 
 from __future__ import annotations
 
+import os
+import runpy
+import shlex
+import subprocess
+import sys
 import zipfile
 from pathlib import Path
 
@@ -65,6 +70,17 @@ def test_python_source_outside_the_project_is_rejected(tmp_path: Path) -> None:
         placer.place(wheel, project)
 
 
+def test_non_string_python_source_is_rejected(tmp_path: Path) -> None:
+    """A malformed maturin source root cannot be coerced into a filesystem path."""
+
+    project = _project(tmp_path, "python")
+    (project / "pyproject.toml").write_text(
+        "[tool.maturin]\npython-source = 1\n", encoding="utf-8"
+    )
+    with pytest.raises(ValueError, match="must be a string"):
+        placer.place(tmp_path / "unused.whl", project)
+
+
 def test_traversing_wheel_member_is_rejected(tmp_path: Path) -> None:
     project = _project(tmp_path, "python")
     wheel = _wheel(tmp_path, {f"../../{_SO}": b"ELF"})
@@ -87,5 +103,45 @@ def test_offline_maturin_build_places_the_extension_for_pytest() -> None:
         Path(__file__).resolve().parents[1] / ".github/workflows/opencode-review-dispatch.yml"
     ).read_text(encoding="utf-8")
     build = workflow.split("build_maturin_extension_if_needed() {", 1)[1].split("\n          }", 1)[0]
-    assert 'python3 "$2" "$dist_dir"/*.whl .' in build
-    assert '"${GITHUB_WORKSPACE}/scripts/ci/place_maturin_extension.py"' in build
+    operand = build.split("bash -c ", 1)[1].rsplit(' bash "$project_dir"', 1)[0]
+    expanded = subprocess.run(
+        ["bash", "-eu", "-c", "printf '%s' " + operand],
+        env={"PATH": os.defpath}, capture_output=True, text=True, timeout=10,
+    )
+    assert expanded.returncode == 0, expanded.stderr
+    assert 'python3 "$2" "$dist_dir"/*.whl .' in expanded.stdout
+    command = shlex.split(build.split("bash -c ", 1)[1])
+    assert command[1:] == [
+        "bash", "$project_dir", "${GITHUB_WORKSPACE}/scripts/ci/place_maturin_extension.py"
+    ]
+
+
+def test_cli_rejects_wrong_arity_and_reports_placement_failure(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str],
+) -> None:
+    """The CLI distinguishes invocation errors from invalid build artifacts."""
+
+    assert placer.main([]) == 2
+    assert "usage:" in capsys.readouterr().err
+
+    project = _project(tmp_path, "python")
+    assert placer.main([str(tmp_path / "missing.whl"), str(project)]) == 1
+    assert "Could not place" in capsys.readouterr().err
+
+
+def test_script_entrypoint_places_and_reports_extension(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str],
+) -> None:
+    """The executable script exits successfully after placing a real wheel member."""
+
+    project = _project(tmp_path, "python")
+    wheel = _wheel(tmp_path, {f"pkg/{_SO}": b"ELF"})
+    script = Path(placer.__file__)
+    monkeypatch.setattr(sys, "argv", [str(script), str(wheel), str(project)])
+
+    with pytest.raises(SystemExit) as exited:
+        runpy.run_path(str(script), run_name="__main__")
+
+    assert exited.value.code == 0
+    assert "Placed built extension" in capsys.readouterr().out
+    assert (project / "python" / "pkg" / _SO).read_bytes() == b"ELF"
diff --git a/tests/test_pr_review_autofix_nvidia_nim_contract.py b/tests/test_pr_review_autofix_nvidia_nim_contract.py
index 1bfc13292e..3c1c9f8d61 100644
--- a/tests/test_pr_review_autofix_nvidia_nim_contract.py
+++ b/tests/test_pr_review_autofix_nvidia_nim_contract.py
@@ -17,7 +17,7 @@
 DOCTORING_RECORD = Path("docs/doctoring/hourly-nvidia-nim-autofix.md")
 CHANGELOG = Path("CHANGELOG.md")
 REVIEW_DISPATCH_WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml")
-REVIEW_DISPATCH_BLOB_SHA = "09bbf8181a443f7a5630ec91ca958440c5dcfc68"
+REVIEW_DISPATCH_BLOB_SHA = "443888bf1f82e07910af2943f405c8eb74f11b9a"
 
 
 def _workflow_text(path: Path) -> str:
diff --git a/tests/test_pr_review_fix_scheduler.py b/tests/test_pr_review_fix_scheduler.py
index 6b9bd91e0c..51168c3d50 100644
--- a/tests/test_pr_review_fix_scheduler.py
+++ b/tests/test_pr_review_fix_scheduler.py
@@ -1452,6 +1452,24 @@ def test_fix_inspect_skip_wait_and_error_paths(monkeypatch):
     assert '"action": "error"' in payload_lines[-1]
 
 
+def test_inspect_pr_reuses_prefetched_comments(monkeypatch):
+    """A queue snapshot decides marker freshness without a duplicate API fetch."""
+    args = fix.parse_args(["--repo", "owner/repo", "--base-branch", "main"])
+    marker = {
+        "body": (
+            f"{fix.FIX_MARKER} head_sha={'a' * 40} "
+            f"epoch={int(time.time())} -->"
+        )
+    }
+    monkeypatch.setattr(fix, "needs_autofix", lambda pr: (True, ("reason",)))
+    monkeypatch.setattr(fix, "issue_comments", lambda repo, number: [])
+
+    assert fix.inspect_pr("owner/repo", make_pr(), args, comments=[marker]) == (
+        "wait",
+        ("recent autofix marker exists for this head",),
+    )
+
+
 def test_fix_parse_args_and_self_test(monkeypatch):
     """Fix scheduler CLI validates inputs and exposes self-test."""
     assert fix.main(["--self-test"]) == 0
diff --git a/tests/test_pr_review_fix_scheduler_control_runner.py b/tests/test_pr_review_fix_scheduler_control_runner.py
index b6eaa916e7..b71b011522 100644
--- a/tests/test_pr_review_fix_scheduler_control_runner.py
+++ b/tests/test_pr_review_fix_scheduler_control_runner.py
@@ -33,10 +33,14 @@ def _job() -> dict:
 
 def test_control_pool_only_for_central_main_caller() -> None:
     runs_on = _job()["runs-on"]
-    assert runs_on == (
-        f"${{{{ github.workflow_ref == '{CENTRAL_CALLER}' && {CONTROL} "
-        "|| fromJSON('[\"ubuntu-24.04\"]') }}"
+    expression = (
+        f"github.workflow_ref == '{CENTRAL_CALLER}' && {CONTROL} "
+        "|| fromJSON('{\"group\":\"CWL CI isolated\",\"labels\":[\"self-hosted\",\"linux\",\"x64\",\"cwlab-ci-isolated\"]}')"
     )
+    assert runs_on == {
+        "group": "${{ (" + expression + ").group }}",
+        "labels": "${{ (" + expression + ").labels }}",
+    }
 
 
 def test_dispatch_job_never_checks_out_pull_request_content() -> None:
diff --git a/tests/test_premerge_review_tooling.py b/tests/test_premerge_review_tooling.py
new file mode 100644
index 0000000000..26a6dc459d
--- /dev/null
+++ b/tests/test_premerge_review_tooling.py
@@ -0,0 +1,564 @@
+"""Source-only admission tests; synthetic pins are never operational approval."""
+
+from __future__ import annotations
+
+import hashlib
+import importlib.util
+import json
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+MODULE = ROOT / "scripts" / "ci" / "premerge_review_tooling.py"
+
+
+def _load():
+    """Require the actual controller boundary rather than a fixture substitute."""
+    assert MODULE.is_file(), "missing trusted premerge tooling admission boundary"
+    spec = importlib.util.spec_from_file_location("premerge_review_tooling", MODULE)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _fixture():
+    """Return inert source bytes and an independently supplied fixture digest."""
+    files = {".github/actions/noema-review/two_phase.py": b"# FIXTURE ONLY\n"}
+    manifest = {
+        "schema_version": 1,
+        "repository": "ContextualWisdomLab/.github",
+        "commit": "a" * 40,
+        "tree": "b" * 40,
+        "entrypoint": ".github/actions/noema-review/two_phase.py",
+        "files": {name: hashlib.sha256(data).hexdigest() for name, data in files.items()},
+    }
+    raw = json.dumps(manifest, sort_keys=True, separators=(",", ":")).encode()
+    return raw, files, hashlib.sha256(raw).hexdigest()
+
+
+def test_unaccepted_tooling_rejected_before_source_consumption():
+    """A caller cannot replace independent acceptance with its own digest."""
+    module = _load()
+    raw, files, _accepted = _fixture()
+    with pytest.raises(ValueError, match="accepted manifest digest"):
+        module.admit_tooling(raw, accepted_digest="0" * 64, source_files=files)
+
+
+def test_source_inventory_must_equal_accepted_manifest():
+    """Even a pinned manifest cannot admit substituted or extra executable bytes."""
+    module = _load()
+    raw, files, accepted = _fixture()
+    for changed in [
+        {next(iter(files)): b"# substituted\n"},
+        {**files, "scripts/ci/hidden.py": b"# extra\n"},
+        {},
+    ]:
+        with pytest.raises(ValueError, match="source inventory"):
+            module.admit_tooling(raw, accepted_digest=accepted, source_files=changed)
+
+
+def test_complete_pinned_source_inventory_admitted():
+    """Nonempty exact source bytes have a useful positive admission control."""
+    raw, files, accepted = _fixture()
+    assert _load().admit_tooling(raw, accepted_digest=accepted, source_files=files) is None
+
+
+@pytest.mark.parametrize("change", [
+    {"schema_version": True},
+    {"schema_version": 2},
+    {"repository": "foreign/repo"},
+    {"commit": "main"},
+    {"tree": "b" * 39},
+    {"entrypoint": "../outside.py"},
+    {"entrypoint": "scripts/ci/not-listed.py"},
+    {"unexpected": "field"},
+    {"files": {}},
+    {"files": {"../outside.py": "c" * 64}},
+])
+def test_pinned_but_invalid_manifest_refused(change):
+    """Independent digest acceptance is necessary but does not replace schema checks."""
+    module = _load()
+    raw, files, _accepted = _fixture()
+    manifest = {**json.loads(raw), **change}
+    raw = json.dumps(manifest, sort_keys=True, separators=(",", ":")).encode()
+    with pytest.raises(ValueError, match="manifest"):
+        module.admit_tooling(raw, accepted_digest=hashlib.sha256(raw).hexdigest(), source_files=files)
+
+
+@pytest.mark.parametrize("name", ["/absolute.py", "a//b.py", "a/./b.py", "a/../b.py", "a\\b.py", "a\x00b.py"])
+def test_noncanonical_inventory_path_refused(name):
+    """Self-consistent unsafe paths cannot leave the immutable tooling namespace."""
+    module = _load()
+    raw, _files, _accepted = _fixture()
+    manifest = json.loads(raw)
+    files = {name: b"# inert\n"}
+    manifest["files"] = {name: hashlib.sha256(files[name]).hexdigest()}
+    manifest["entrypoint"] = name
+    raw = json.dumps(manifest).encode()
+    with pytest.raises(ValueError, match="manifest"):
+        module.admit_tooling(raw, accepted_digest=hashlib.sha256(raw).hexdigest(), source_files=files)
+
+
+def test_duplicate_manifest_field_refused():
+    """Ambiguous authenticated JSON is not a second interpretation of an accepted source."""
+    raw, files, _accepted = _fixture()
+    raw = raw[:-1] + b',"schema_version":1}'
+    with pytest.raises(ValueError, match="manifest"):
+        _load().admit_tooling(raw, accepted_digest=hashlib.sha256(raw).hexdigest(), source_files=files)
+
+
+@pytest.mark.parametrize("raw", [b"[]", b"null", b"{", b"{}" + b" " * (2 * 1024 * 1024)])
+def test_malformed_or_oversized_pinned_manifest_refused(raw):
+    """A trusted digest cannot make malformed or unbounded metadata usable."""
+    with pytest.raises(ValueError, match="manifest"):
+        _load().admit_tooling(raw, accepted_digest=hashlib.sha256(raw).hexdigest(), source_files={})
+
+
+def _scope():
+    """A fixture scope contains explicit reviewed PR and independent reviewer identities."""
+    return {
+        "repository": "ContextualWisdomLab/example", "number": 7,
+        "head": "c" * 40, "base": "d" * 40,
+        "author": "seonghobae", "reviewer": "cwl-noema-review[bot]",
+    }
+
+
+@pytest.mark.parametrize("change", [
+    {"head": "e" * 40}, {"base": "e" * 40}, {"author": "other"},
+    {"reviewer": "other[bot]"}, {"repository": "ContextualWisdomLab/other"},
+    {"number": 8}, {"state": "CLOSED"}, {"draft": True},
+])
+def test_review_scope_drift_rejected(change):
+    """Full live scope, not head alone, defines premerge evidence applicability."""
+    module = _load()
+    assert hasattr(module, "require_review_scope"), "missing full live review scope admission"
+    live = {**_scope(), "state": "OPEN", "draft": False, **change}
+    with pytest.raises(ValueError, match="review scope"):
+        module.require_review_scope(_scope(), live)
+
+
+def test_current_full_review_scope_allowed():
+    """A live independently authored non-draft PR remains reviewable."""
+    module = _load()
+    assert hasattr(module, "require_review_scope"), "missing full live review scope admission"
+    module.require_review_scope(_scope(), {**_scope(), "state": "OPEN", "draft": False})
+
+
+@pytest.mark.parametrize("change", [
+    {"number": True}, {"number": 0}, {"head": "main"}, {"base": "d" * 39},
+    {"repository": "foreign/repo"}, {"author": ""}, {"reviewer": ""},
+    {"reviewer": "seonghobae"}, {"reviewer": "SeongHoBae"},
+])
+def test_matching_invalid_or_self_review_scope_refused(change):
+    """Equality cannot make malformed identity or self approval admissible."""
+    scope = {**_scope(), **change}
+    with pytest.raises(ValueError, match="review scope"):
+        _load().require_review_scope(scope, {**scope, "state": "OPEN", "draft": False})
+
+
+def test_controller_refuses_runtime_admission_before_loading_tooling(tmp_path):
+    """A reviewed source pin never implies runner or supplier admission."""
+    module = _load()
+    assert hasattr(module, "run_review"), "missing executable premerge controller"
+    raw, files, accepted = _fixture()
+    events = []
+
+    def admission():
+        events.append("admission")
+        raise RuntimeError("native/policy NOT_HELD")
+
+    def load():
+        pytest.fail("unadmitted tooling must not load")
+
+    with pytest.raises(RuntimeError, match="NOT_HELD"):
+        module.run_review(
+            raw, accepted_digest=accepted, source_files=files, scope=_scope(),
+            fetch_live=lambda: {**_scope(), "state": "OPEN", "draft": False},
+            require_execution_admission=admission, load_tooling=load,
+            refresh_publisher=lambda: pytest.fail("no credentials before admission"),
+            private_parent=tmp_path,
+        )
+    assert events == ["admission"]
+    assert not list(tmp_path.iterdir())
+
+
+def test_controller_composes_actual_compatible_two_phase_modules(tmp_path, monkeypatch):
+    """Real prepare/seal/read/publish runs with inert network/model collaborators only."""
+    module = _load()
+    two_path = ROOT / ".github/actions/noema-review/two_phase.py"
+    spec = importlib.util.spec_from_file_location("trusted_two_phase_fixture", two_path)
+    two = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(two)
+    scope = _scope()
+    pr = {"state": "OPEN", "isDraft": False, "headRefOid": scope["head"],
+          "baseRefOid": scope["base"], "author": {"login": scope["author"]}}
+    events = []
+    monkeypatch.setattr(two.gate, "fetch_pr", lambda *_: pr)
+    monkeypatch.setattr(two.gate, "current_actor", lambda: scope["reviewer"])
+    monkeypatch.setattr(two.gate, "existing_noema_review", lambda *_: False)
+    monkeypatch.setattr(two.gate, "fetch_diff", lambda *_: ("fixture diff", False))
+    monkeypatch.setattr(two.gate, "fetch_changed_files", lambda *_: [("src/a.py", "MODIFIED")])
+    monkeypatch.setattr(two.gate, "build_review_context", lambda *_: "fixture context")
+
+    def model(*_):
+        events.append("actual_prepare_model_boundary")
+        return {"decision": "approve", "summary": "FIXTURE ONLY: not a real model verdict"}
+
+    monkeypatch.setattr(two.gate, "call_llm", model)
+    monkeypatch.setattr(two.gate, "submit_review", lambda *_: events.append("actual_publisher_sink"))
+
+    def load():
+        events.append("load_accepted_fixture_tooling")
+        return two
+
+    def refresh():
+        events.append("independent_publisher_refresh_fixture")
+
+    raw, files, accepted = _fixture()
+    result = module.run_review(
+        raw, accepted_digest=accepted, source_files=files, scope=scope,
+        fetch_live=lambda: {**scope, "state": "OPEN", "draft": False},
+        require_execution_admission=lambda: events.append("admission_fixture"),
+        load_tooling=load, refresh_publisher=refresh, private_parent=tmp_path,
+    )
+    assert result == 0
+    assert events == ["admission_fixture", "load_accepted_fixture_tooling",
+                      "actual_prepare_model_boundary", "admission_fixture",
+                      "independent_publisher_refresh_fixture", "actual_publisher_sink"]
+    assert not list(tmp_path.iterdir())
+
+
+def test_controller_rejects_forged_runner_local_envelope(tmp_path):
+    """The controller never forwards a SOURCE_PASS or arbitrary envelope as model evidence."""
+    from types import SimpleNamespace
+
+    raw, files, accepted = _fixture()
+
+    def prepare(_repo, _number, _head, path):
+        path.write_text(json.dumps({"SOURCE_PASS": True}))
+        return 0
+
+    with pytest.raises(ValueError, match="prepared envelope"):
+        _load().run_review(
+            raw, accepted_digest=accepted, source_files=files, scope=_scope(),
+            fetch_live=lambda: {**_scope(), "state": "OPEN", "draft": False},
+            require_execution_admission=lambda: None,
+            load_tooling=lambda: SimpleNamespace(prepare_verdict=prepare,
+                publish_verdict=lambda *_: pytest.fail("must not publish")),
+            refresh_publisher=lambda: pytest.fail("must not refresh"), private_parent=tmp_path,
+        )
+    assert not list(tmp_path.iterdir())
+
+
+@pytest.mark.parametrize("phase", ["missing", "failed", "scope_drift", "admission_revoked", "refresh_drift"])
+def test_controller_rejects_unpublishable_preparation(tmp_path, phase):
+    """No refresh or publication follows a missing verdict or expired scope/admission."""
+    from types import SimpleNamespace
+
+    module = _load()
+    raw, files, accepted = _fixture()
+    observations = 0
+    admissions = 0
+    refreshed = False
+
+    def live():
+        nonlocal observations
+        observations += 1
+        return {**_scope(), "state": "OPEN", "draft": False,
+                **({"base": "e" * 40} if (phase == "scope_drift" and observations > 1) or refreshed else {})}
+
+    def refresh():
+        nonlocal refreshed
+        if phase != "refresh_drift":
+            pytest.fail("must not refresh")
+        refreshed = True
+
+    def admission():
+        nonlocal admissions
+        admissions += 1
+        if phase == "admission_revoked" and admissions > 1:
+            raise RuntimeError("admission revoked")
+
+    def prepare(_repo, _number, _head, path):
+        if phase != "missing":
+            scope = _scope()
+            payload = {
+                "schema_version": 1, "repository": scope["repository"],
+                "pull_request_number": scope["number"], "expected_head": scope["head"],
+                "expected_base": scope["base"], "reviewer_actor": scope["reviewer"],
+                "pull_request_author": scope["author"], "verdict": {"decision": "approve"},
+            }
+            path.write_text(json.dumps(payload))
+            path.chmod(0o600)
+        return 1 if phase == "failed" else 0
+
+    with pytest.raises((RuntimeError, ValueError)):
+        module.run_review(
+            raw, accepted_digest=accepted, source_files=files, scope=_scope(),
+            fetch_live=live, require_execution_admission=admission,
+            load_tooling=lambda: SimpleNamespace(prepare_verdict=prepare,
+                publish_verdict=lambda *_: pytest.fail("must not publish")),
+            refresh_publisher=refresh, private_parent=tmp_path,
+        )
+    assert not list(tmp_path.iterdir())
+
+
+def test_tooling_loader_rejects_mutated_source_before_child(tmp_path):
+    """Live module bytes, not a retained mapping alone, are checked at spawn."""
+    module = _load()
+    assert hasattr(module, "load_noema_tooling"), "missing bound executable tooling loader"
+    raw, files, accepted = _fixture()
+    path = tmp_path / next(iter(files))
+    path.parent.mkdir(parents=True)
+    path.write_bytes(b"# substituted\n")
+    with pytest.raises(ValueError, match="source inventory"):
+        module.load_noema_tooling(
+            tmp_path, raw, accepted_digest=accepted, interpreter=Path(__import__('sys').executable),
+            phase_environment={}, child_runner=lambda *_args, **_kwargs: pytest.fail("must not spawn"),
+        ).prepare_verdict("ContextualWisdomLab/example", 7, "c" * 40, tmp_path / "verdict.json")
+
+
+@pytest.mark.parametrize("phase,environment", [
+    ("publish", {"NOEMA_LLM_API_KEY": "SYNTHETIC_ONLY"}),
+    ("prepare", {"NOEMA_LLM_MODEL": "orchestrator/free"}),
+    ("prepare", {"NOEMA_LLM_MODEL": "auto", "PYTHONPATH": "/untrusted"}),
+    ("prepare", {"NOEMA_LLM_MODEL": "auto", "LD_PRELOAD": "/untrusted"}),
+])
+def test_phase_environment_rejected_before_child(tmp_path, phase, environment):
+    """Publisher gets no inference secret and model child gets no injection overrides."""
+    import sys
+
+    module = _load()
+    raw, files, accepted = _fixture()
+    for name, data in files.items():
+        path = tmp_path / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(data)
+    tooling = module.load_noema_tooling(
+        tmp_path, raw, accepted_digest=accepted, interpreter=Path(sys.executable),
+        phase_environment=lambda _: environment,
+        child_runner=lambda *_args, **_kwargs: pytest.fail("forbidden environment reached child"),
+    )
+    with pytest.raises(ValueError, match="phase environment"):
+        getattr(tooling, phase + "_verdict")("ContextualWisdomLab/example", 7, "c" * 40, tmp_path.parent / "unused.json")
+
+
+def test_live_boolean_number_cannot_equal_admitted_integer():
+    """Python equality must not treat a malformed live PR number as scope equality."""
+    expected = {**_scope(), "number": 1}
+    with pytest.raises(ValueError, match="review scope"):
+        _load().require_review_scope(expected, {**expected, "number": True, "state": "OPEN", "draft": False})
+
+
+def _token_response(phase):
+    """Synthetic GitHub installation-token issuance response, never a live token."""
+    return {"token": "SYNTHETIC_FIXTURE_ONLY",
+            "permissions": {"contents": "read", "metadata": "read",
+                            "pull_requests": "read" if phase == "prepare" else "write"},
+            "repositories": [{"full_name": _scope()["repository"]}]}
+
+
+@pytest.mark.parametrize("phase,change", [
+    ("prepare", {"permissions": {"contents": "read", "pull_requests": "write"}}),
+    ("prepare", {"permissions": {"contents": "write", "pull_requests": "read"}}),
+    ("publish", {"permissions": {"contents": "read", "pull_requests": "read"}}),
+    ("prepare", {"repositories": [{"full_name": "ContextualWisdomLab/other"}]}),
+    ("prepare", {"repositories": [{"full_name": _scope()["repository"]}, {"full_name": "ContextualWisdomLab/other"}]}),
+    ("prepare", {"token": ""}),
+])
+def test_issued_credential_scope_rejected_before_phase_environment(phase, change):
+    """Trusted issuance response must prove exact phase permissions and repository."""
+    module = _load()
+    assert hasattr(module, "phase_environment_from_issuance"), "missing issuance-scoped consumer"
+    response = {**_token_response(phase), **change}
+    with pytest.raises(ValueError, match="credential issuance"):
+        module.phase_environment_from_issuance(
+            phase, response, scope=_scope(), reviewer_actor="cwl-noema-review[bot]",
+            installation_id=7, inference_key="SYNTHETIC_INFERENCE_ONLY",
+        )
+
+
+@pytest.mark.parametrize("phase,response,actor,installation,key", [
+    ("invalid", {}, "cwl-noema-review[bot]", 7, "SYNTHETIC"),
+    ("prepare", None, "cwl-noema-review[bot]", 7, "SYNTHETIC"),
+    ("prepare", _token_response("prepare"), "foreign[bot]", 7, "SYNTHETIC"),
+    ("prepare", _token_response("prepare"), "cwl-noema-review[bot]", True, "SYNTHETIC"),
+    ("prepare", _token_response("prepare"), "cwl-noema-review[bot]", 7, None),
+])
+def test_issuance_identity_and_inference_characterization(phase, response, actor, installation, key):
+    """Unsupported or missing authenticated authority metadata remains a refusal."""
+    with pytest.raises(ValueError, match="credential issuance"):
+        _load().phase_environment_from_issuance(phase, response, scope=_scope(),
+            reviewer_actor=actor, installation_id=installation, inference_key=key)
+
+
+def test_issued_read_and_write_credentials_are_separated():
+    """Only prepared read authority receives inference; publisher remains independent."""
+    module = _load()
+    assert hasattr(module, "phase_environment_from_issuance"), "missing issuance-scoped consumer"
+    for phase in ("prepare", "publish"):
+        env = module.phase_environment_from_issuance(
+            phase, _token_response(phase), scope=_scope(), reviewer_actor="cwl-noema-review[bot]",
+            installation_id=7, inference_key="SYNTHETIC_INFERENCE_ONLY",
+        )
+        assert env["GH_TOKEN"] == "SYNTHETIC_FIXTURE_ONLY"
+        assert ("NOEMA_LLM_API_KEY" in env) is (phase == "prepare")
+        module.require_phase_environment(phase, env)
+
+
+def _envelope_payload():
+    """An otherwise-valid synthetic eight-field producer output."""
+    scope = _scope()
+    return {"schema_version": 1, "repository": scope["repository"],
+            "pull_request_number": scope["number"], "expected_head": scope["head"],
+            "expected_base": scope["base"], "pull_request_author": scope["author"],
+            "reviewer_actor": scope["reviewer"], "verdict": {"decision": "approve"}}
+
+
+@pytest.mark.parametrize("kind", ["empty", "oversize", "malformed", "missing", "wrong_keys", "version", "identity", "verdict"])
+def test_envelope_characterization_rejections(tmp_path, kind):
+    """Exercise each bounded local-envelope refusal without inference or publication."""
+    payload = _envelope_payload()
+    if kind == "version":
+        payload["schema_version"] = True
+    if kind == "identity":
+        payload["reviewer_actor"] = "foreign[bot]"
+    if kind == "verdict":
+        payload["verdict"] = None
+    if kind == "wrong_keys":
+        payload = {}
+    raw = json.dumps(payload).encode()
+    if kind == "empty":
+        raw = b""
+    if kind == "oversize":
+        raw = b" " * (2 * 1024 * 1024 + 1)
+    if kind == "malformed":
+        raw = b"{"
+    path = tmp_path / "envelope"
+    if kind != "missing":
+        path.write_bytes(raw)
+        path.chmod(0o600)
+    with pytest.raises(ValueError, match="prepared envelope"):
+        _load().require_prepared_envelope(path, _scope())
+
+
+@pytest.mark.parametrize("kind", ["relative", "symlink", "fifo", "entrypoint", "interpreter"])
+def test_loader_characterization_rejections(tmp_path, kind):
+    """Invalid namespace and interpreter controls never reach a child process."""
+    import os
+    import sys
+
+    raw, files, accepted = _fixture()
+    root = tmp_path / "source"
+    root.mkdir()
+    for name, data in files.items():
+        path = root / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(data)
+    interpreter = Path(sys.executable)
+    if kind == "relative":
+        root = Path("relative")
+    if kind == "symlink":
+        (root / "alias").symlink_to(next(iter(files)))
+    if kind == "fifo":
+        os.mkfifo(root / "pipe")
+    if kind == "entrypoint":
+        manifest = json.loads(raw)
+        manifest["entrypoint"] = "other.py"
+        (root / next(iter(files))).unlink()
+        (root / "other.py").write_bytes(b"# inert")
+        manifest["files"] = {"other.py": hashlib.sha256(b"# inert").hexdigest()}
+        raw = json.dumps(manifest).encode()
+        accepted = hashlib.sha256(raw).hexdigest()
+    if kind == "interpreter":
+        interpreter = Path("relative-python")
+    with pytest.raises(ValueError):
+        _load().load_noema_tooling(root, raw, accepted_digest=accepted, interpreter=interpreter,
+            phase_environment=lambda _: {"NOEMA_LLM_MODEL": "auto"},
+            child_runner=lambda *_args, **_kwargs: pytest.fail("must not execute")
+        ).prepare_verdict("ContextualWisdomLab/example", 7, "c" * 40, tmp_path / "verdict")
+
+
+def test_scope_missing_fields_and_unsupported_phase_characterization():
+    """Incomplete authority records and unknown phase names fail closed."""
+    module = _load()
+    with pytest.raises(ValueError, match="review scope"):
+        module.require_review_scope({}, {})
+    with pytest.raises(ValueError, match="phase environment"):
+        module.require_phase_environment("foreign", {})
+
+
+def test_bound_tooling_runs_real_two_phase_cli_with_inert_fixture_gate(tmp_path):
+    """Execute actual CLI producer/publisher bytes, not live inference or GitHub."""
+    import sys
+
+    tooling_root = tmp_path / "tooling"
+    files = {
+        ".github/actions/noema-review/two_phase.py": (ROOT / ".github/actions/noema-review/two_phase.py").read_bytes(),
+        "scripts/__init__.py": b"",
+        "scripts/ci/__init__.py": b"",
+        "scripts/ci/noema_review_gate.py": b'''"""INERT FIXTURE ONLY: not the production gate or provider."""
+import json
+import os
+from pathlib import Path
+PRIMARY_REVIEW_AUTHORS = {"opencode-agent[bot]"}
+def fetch_pr(repo, number):
+    return {"state":"OPEN","isDraft":False,"headRefOid":"c"*40,"baseRefOid":"d"*40,"author":{"login":"seonghobae"}}
+def require_expected_head(pr, head):
+    assert pr["headRefOid"] == head
+def current_actor():
+    return "cwl-noema-review[bot]"
+def require_distinct_pr_author(pr, actor):
+    assert pr["author"]["login"] != actor
+    return pr["author"]["login"]
+def existing_noema_review(*args):
+    return False
+def fetch_diff(*args):
+    return "FIXTURE DIFF", False
+def fetch_changed_files(*args):
+    return [("src/a.py", "MODIFIED")]
+def build_review_context(*args):
+    return "FIXTURE CONTEXT"
+def call_llm(*args):
+    assert os.environ["FIXTURE_PHASE"] == "prepare"
+    return {"decision":"approve", "summary":"FIXTURE ONLY"}
+def submit_review(repo, number, pr, actor, verdict):
+    assert os.environ["FIXTURE_PHASE"] == "publish"
+    Path(os.environ["FIXTURE_SINK"]).write_text(json.dumps({"fixture_only":True,"head":pr["headRefOid"],"actor":actor,"verdict":verdict}))
+''',
+    }
+    for name, data in files.items():
+        path = tooling_root / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(data)
+    raw, _, _ = _fixture()
+    manifest = json.loads(raw)
+    manifest["files"] = {name: hashlib.sha256(data).hexdigest() for name, data in files.items()}
+    raw = json.dumps(manifest).encode()
+    accepted = hashlib.sha256(raw).hexdigest()
+    sink = tmp_path / "fixture-sink.json"
+
+    def phase_environment(phase):
+        environment = _load().phase_environment_from_issuance(
+            phase, _token_response(phase), scope=_scope(),
+            reviewer_actor="cwl-noema-review[bot]", installation_id=7,
+            inference_key="SYNTHETIC_INFERENCE_ONLY",
+        )
+        environment.update(FIXTURE_PHASE=phase, FIXTURE_SINK=str(sink))
+        return environment
+
+    loader = lambda: _load().load_noema_tooling(
+        tooling_root, raw, accepted_digest=accepted, interpreter=Path(sys.executable),
+        phase_environment=phase_environment,
+    )
+    assert _load().run_review(
+        raw, accepted_digest=accepted, source_files=files, scope=_scope(),
+        fetch_live=lambda: {**_scope(), "state": "OPEN", "draft": False},
+        require_execution_admission=lambda: None, load_tooling=loader,
+        refresh_publisher=lambda: None, private_parent=tmp_path,
+    ) == 0
+    assert json.loads(sink.read_text())["fixture_only"] is True
+    assert not list(tmp_path.glob("premerge-review-*"))
+    assert {name: (tooling_root / name).read_bytes() for name in files} == files
diff --git a/tests/test_product_technical_gap_baseline.py b/tests/test_product_technical_gap_baseline.py
index d44ffdb8e6..a91e1ce5ba 100644
--- a/tests/test_product_technical_gap_baseline.py
+++ b/tests/test_product_technical_gap_baseline.py
@@ -9,6 +9,14 @@
 DOCTORING = Path("docs/doctoring/product-technical-gap-baseline.md")
 
 
+def test_baseline_is_not_a_truncated_connector_rendering() -> None:
+    """The committed baseline must be the source artifact, not UI display output."""
+    source = BASELINE.read_text(encoding="utf-8")
+
+    assert not source.startswith("Warning: truncated output")
+    assert "\nTotal output lines: " not in source[:200]
+
+
 def test_baseline_binds_current_governance_sources_and_buyer_contract() -> None:
     """The shipped baseline must point agents to product, governance, and evidence."""
     source = BASELINE.read_text(encoding="utf-8")
diff --git a/tests/test_r_isolated_platform_admission.py b/tests/test_r_isolated_platform_admission.py
new file mode 100644
index 0000000000..06ed2de59f
--- /dev/null
+++ b/tests/test_r_isolated_platform_admission.py
@@ -0,0 +1,71 @@
+"""Source and executable matrix-admission contract; no native R execution."""
+import json
+from pathlib import Path
+import subprocess
+import sys
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class Admission(unittest.TestCase):
+    def test_matrix_admission(self):
+        script = ROOT / 'scripts/ci/r_isolated_matrix.py'
+        self.assertTrue(script.is_file(), 'Missing supported-platform admission')
+        rows = [{'os': 'ubuntu-latest', 'r': 'release'},
+                {'os': 'macos-latest', 'r': 'release'},
+                {'os': 'windows-latest', 'r': 'release'},
+                {'os': 'ubuntu-24.04-arm', 'r': 'release'}]
+        result = subprocess.run([sys.executable, str(script), json.dumps(rows)],
+                                capture_output=True, text=True, check=False)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertEqual(result.stdout, '')
+        self.assertIn('STOP', result.stderr)
+        for invalid in ([], rows[1:], [{'os': 'ubuntu-evil', 'r': 'release'}],
+                        [{'os': 'ubuntu-latest', 'r': ''}], {}):
+            denied = subprocess.run([sys.executable, str(script), json.dumps(invalid)],
+                                    capture_output=True, text=True, check=False)
+            self.assertNotEqual(denied.returncode, 0)
+            self.assertEqual(denied.stdout, '')
+
+    def test_r_selector_is_static_and_matrix_is_admitted(self):
+        text = (ROOT / '.github/workflows/r-package-check.yml').read_text()
+        self.assertIn('needs: admit-platforms', text)
+        self.assertIn('config: ${{ fromJSON(needs.admit-platforms.outputs.matrix) }}', text)
+        self.assertIn('labels: [self-hosted, Linux, X64, cwlab-ci-isolated]', text)
+        self.assertNotIn('toJSON(matrix.config.os)', text)
+        inline = text.split("<<'PY'\n", 1)[1].split('\n          PY', 1)[0]
+        emitted = '\n'.join(line[10:] for line in inline.splitlines()) + '\n'
+        self.assertEqual(emitted, (ROOT / 'scripts/ci/r_isolated_matrix.py').read_text())
+
+
+def test_supported_matrix_and_cli_branches_are_exercised_in_process(monkeypatch, capsys):
+    """Cover actual admission and CLI errors without executing native R jobs."""
+    import pytest
+    import runpy
+    from scripts.ci.r_isolated_matrix import admit
+
+    rows = [{'os': 'ubuntu-latest', 'r': 'release'},
+            {'os': 'ubuntu-24.04', 'r': '4.4'}]
+    assert admit(json.dumps(rows)) == rows
+    for value in ({}, [], [None], [{'os': 1, 'r': 'release'}],
+                  [{'os': 'ubuntu-latest', 'r': ''}],
+                  [{'os': 'ubuntu-latest', 'r': 1}],
+                  [{'os': 'windows-latest', 'r': 'release'}]):
+        with pytest.raises(ValueError):
+            admit(json.dumps(value))
+    script = str(ROOT / 'scripts/ci/r_isolated_matrix.py')
+    monkeypatch.setattr(sys, 'argv', [script, json.dumps(rows)])
+    runpy.run_path(script, run_name='__main__')
+    assert json.loads(capsys.readouterr().out) == rows
+    for argv in ([script], [script, 'not-json']):
+        monkeypatch.setattr(sys, 'argv', argv)
+        with pytest.raises(SystemExit) as error:
+            runpy.run_path(script, run_name='__main__')
+        assert error.value.code == 1
+        captured = capsys.readouterr()
+        assert captured.out == '' and captured.err
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/test_r_package_check_reusable_workflow_contract.py b/tests/test_r_package_check_reusable_workflow_contract.py
index 2d3ad49711..87bb07aa21 100644
--- a/tests/test_r_package_check_reusable_workflow_contract.py
+++ b/tests/test_r_package_check_reusable_workflow_contract.py
@@ -10,6 +10,8 @@
 
 from __future__ import annotations
 
+import json
+import re
 from pathlib import Path
 
 _WORKFLOW = Path(".github/workflows/r-package-check.yml")
@@ -108,14 +110,23 @@ def test_uniform_fields_are_hardcoded_not_parameterized() -> None:
 
 
 def test_matrix_is_driven_by_the_r_matrix_input() -> None:
-    """The strategy matrix must come from fromJSON(inputs.r_matrix), not a fixed list."""
+    """Caller data is admitted before expanding supported Linux matrix legs."""
     workflow = _workflow_text()
-    assert "config: ${{ fromJSON(inputs.r_matrix) }}" in workflow
-    assert "runs-on: ${{ matrix.config.os }}" in workflow
-    assert "r-version: ${{ matrix.config.r }}" in workflow
+    assert 'R_MATRIX: ${{ inputs.r_matrix }}' in workflow
+    assert 'config: ${{ fromJSON(needs.admit-platforms.outputs.matrix) }}' in workflow
+    assert 'r-version: ${{ matrix.config.r }}' in workflow
     assert "http-user-agent: ${{ matrix.config['http-user-agent'] }}" in workflow
 
 
+def test_matrix_runner_format_renders_valid_group_scoped_json() -> None:
+    """Both admission and R execution use the fixed isolated Linux selector."""
+    workflow = _workflow_text()
+    assert workflow.count('group: CWL CI isolated') == 2
+    assert workflow.count('labels: [self-hosted, Linux, X64, cwlab-ci-isolated]') == 2
+    assert 'toJSON(matrix.config.os)' not in workflow
+    assert 'STOP unsupported platform leg:' in workflow
+
+
 def test_pre_check_hook_is_bounded_data_not_caller_shell_source() -> None:
     """A reusable caller must not inject arbitrary Bash source into the trusted job."""
     workflow = _workflow_text()
@@ -129,3 +140,15 @@ def test_pre_check_hook_is_bounded_data_not_caller_shell_source() -> None:
     assert '"$PRE_CHECK_TEST_FILE" == *".."*' in workflow
     assert '"$PRE_CHECK_TEST_FILE" == /*' in workflow
     assert 'testthat::test_file(Sys.getenv("PRE_CHECK_TEST_FILE"))' in workflow
+
+
+def test_current_routing_document_matches_linux_only_admission() -> None:
+    """Current coverage must not claim unsupported platforms are queued checks."""
+    source = Path('docs/doctoring/all-self-hosted-runner-routing-20261003.md').read_text()
+    paragraph = next(p for p in source.split('\n\n') if p.startswith('R reusable jobs'))
+    assert 'Linux/x64-only' in paragraph
+    assert 'ubuntu-latest' in paragraph and 'ubuntu-24.04' in paragraph
+    assert 'STOP' in paragraph and 'unsupported-only' in paragraph
+    assert 'not platform coverage' in paragraph
+    assert 'remain queued' not in paragraph
+    assert 'entire R-version matrix' not in paragraph
diff --git a/tests/test_release_dependency_fanout_plan.py b/tests/test_release_dependency_fanout_plan.py
index af996a0428..77283ebce0 100644
--- a/tests/test_release_dependency_fanout_plan.py
+++ b/tests/test_release_dependency_fanout_plan.py
@@ -96,6 +96,56 @@ def test_fanout_adds_distinct_exact_archive_fixtures(tmp_path: Path) -> None:
         gate.strix_fanout_plan(capture, report_path, CONTROL, 42, 2, archive_report)
 
 
+def test_archive_rows_cannot_expand_a_bounded_base_plan_past_the_limit(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A bounded licence plan still fails if runtime rows push the final matrix over its cap."""
+    capture, report_path = _allowed(tmp_path)
+    dependency_count = len(json.loads(report_path.read_text())["dependencies"])
+    monkeypatch.setattr(gate, "STRIX_PLAN_LIMIT", dependency_count)
+
+    def archive_row(ecosystem: str, name: str, digest_character: str) -> dict:
+        source_digest = digest_character * 64
+        package_key = f"{ecosystem}/{name}@1"
+        key = f"{package_key}/sha256/{source_digest}"
+        fixture = gate.build_fixture(
+            gate.Dependency(ecosystem, name, "1"),
+            {
+                "source_sha256": source_digest,
+                "archive_members": [],
+                "install_hook_sources": {},
+                "parsed_inputs": [],
+                "native_libraries": [],
+                "known_vulnerabilities": [],
+            },
+        )
+        fixture["id"] = key
+        return {
+            "key": key,
+            "package_key": package_key,
+            "name": name,
+            "version": "1",
+            "source_sha256": source_digest,
+            "license": "MIT",
+            "fixture": fixture,
+            "fixture_sha256": gate.fixture_digest(fixture),
+        }
+
+    runtime = archive_row("pypi", "runtime-package", "1")
+    build = archive_row("pypi", "build-package", "2")
+    tool = archive_row("github-release", "maturin", "3")
+    archive_report = tmp_path / "archive-report.json"
+    archive_report.write_text(json.dumps({
+        "schema": "cwl.release-runtime-archive-licenses/3",
+        "archives": [runtime],
+        "build_packages": [build],
+        "build_tools": [tool],
+    }))
+
+    with pytest.raises(gate.GateError, match="dependency plan exceeds"):
+        gate.strix_fanout_plan(capture, report_path, CONTROL, 42, 2, archive_report)
+
+
 def test_plan_refuses_denied_missing_extra_and_duplicate_scope(tmp_path: Path) -> None:
     mutators = {
         "denied": lambda capture, report: report.__setitem__("result", "FAIL"),
diff --git a/tests/test_release_dependency_gate.py b/tests/test_release_dependency_gate.py
index 62054fff5c..1700d374c2 100644
--- a/tests/test_release_dependency_gate.py
+++ b/tests/test_release_dependency_gate.py
@@ -11,6 +11,7 @@
 import hashlib
 import io
 import json
+import subprocess
 import tarfile
 import zipfile
 from pathlib import Path
@@ -738,6 +739,14 @@ def test_benign_cmdclass_without_lifecycle_override_passes(tmp_path: Path) -> No
     assert gate.gate(capture).failures == []
 
 
+def test_rust_hook_without_process_or_network_namespace_is_benign() -> None:
+    """Ordinary Rust build code stays allowed while network namespaces are detected."""
+    assert gate.detect_install_hooks({"build.rs": "fn main() { println!(\"cargo:rerun\"); }"}) == []
+    assert gate.detect_install_hooks({"build.rs": "use std::net; fn main() {}"}) == [
+        "build.rs references a process/network namespace"
+    ]
+
+
 # ---------------------------------------------------------------------------
 # RED: Strix structured evidence
 # ---------------------------------------------------------------------------
@@ -899,6 +908,31 @@ def test_selection_capture_reads_commit_and_rejects_duplicates(tmp_path: Path) -
         gate._load_selections(capture)
 
 
+def test_capture_license_selection_cli_publishes_the_exact_commit_blob(tmp_path: Path) -> None:
+    """The CLI command delegates to the same exact-commit capture boundary."""
+    source = tmp_path / "source"
+    source.mkdir()
+    path = source / "docs/release-license-selections.json"
+    path.parent.mkdir()
+    path.write_text("[]")
+    subprocess.run(["git", "init", "-q", str(source)], check=True)
+    subprocess.run(["git", "-C", str(source), "add", "."], check=True)
+    subprocess.run(["git", "-C", str(source), "-c", "user.name=Test", "-c",
+                    "user.email=test@example.invalid", "commit", "-qm", "selection"], check=True)
+    source_sha = subprocess.check_output(
+        ["git", "-C", str(source), "rev-parse", "HEAD"], text=True,
+    ).strip()
+    capture = tmp_path / "capture"
+
+    assert gate.main([
+        "capture-license-selections",
+        "--source", str(source),
+        "--source-sha", source_sha,
+        "--capture", str(capture),
+    ]) == 0
+    assert (capture / "license-selections.json").read_text() == "[]"
+
+
 def test_selection_loader_refuses_dangling_link_and_nonstring_choice(tmp_path: Path) -> None:
     path = tmp_path / "license-selections.json"
     path.symlink_to(tmp_path / "missing")
@@ -938,6 +972,58 @@ def metadata_only(command, **kwargs):
     assert not capture.exists()
 
 
+def test_selection_capture_refuses_unbound_sources_and_payload_size_races(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Selection capture accepts only exact regular blobs whose bytes remain bounded."""
+    source = tmp_path / "source"
+    source.mkdir()
+    subprocess.run(["git", "init", "-q", str(source)], check=True)
+    subprocess.run([
+        "git", "-C", str(source), "-c", "user.name=Test", "-c",
+        "user.email=test@example.invalid", "commit", "--allow-empty", "-qm", "empty",
+    ], check=True)
+    sha = subprocess.check_output(["git", "-C", str(source), "rev-parse", "HEAD"], text=True).strip()
+    capture = tmp_path / "capture"
+
+    with pytest.raises(gate.GateError, match="exact commit SHA"):
+        gate.capture_license_selections(source, "not-a-sha", capture)
+    gate.capture_license_selections(source, sha, capture)
+    assert not capture.exists()
+
+    selection = source / "docs/release-license-selections.json"
+    selection.parent.mkdir()
+    selection.symlink_to(source / "missing")
+    subprocess.run(["git", "-C", str(source), "add", "."], check=True)
+    subprocess.run(["git", "-C", str(source), "-c", "user.name=Test", "-c",
+                    "user.email=test@example.invalid", "commit", "-qm", "link"], check=True)
+    link_sha = subprocess.check_output(["git", "-C", str(source), "rev-parse", "HEAD"], text=True).strip()
+    with pytest.raises(gate.GateError, match="regular Git blob"):
+        gate.capture_license_selections(source, link_sha, capture)
+
+    selection.unlink()
+    selection.write_text("[]")
+    subprocess.run(["git", "-C", str(source), "add", "."], check=True)
+    subprocess.run(["git", "-C", str(source), "-c", "user.name=Test", "-c",
+                    "user.email=test@example.invalid", "commit", "-qm", "regular"], check=True)
+    regular_sha = subprocess.check_output(
+        ["git", "-C", str(source), "rev-parse", "HEAD"], text=True,
+    ).strip()
+
+    original = gate.subprocess.check_output
+
+    def raced_blob(command, **kwargs):
+        if command[1:3] == ["cat-file", "-s"]:
+            return "1\n" if kwargs.get("text") else b"1\n"
+        if command[1:3] == ["cat-file", "blob"]:
+            return b"x" * (gate._MAX_METADATA_BYTES + 1)
+        return original(command, **kwargs)
+
+    monkeypatch.setattr(gate.subprocess, "check_output", raced_blob)
+    with pytest.raises(gate.GateError, match="exceeds bounded size"):
+        gate.capture_license_selections(source, regular_sha, capture)
+
+
 @pytest.mark.parametrize("expression", ["MIT/Apache-2.0", "Apache-2.0/MIT", "Apache-2.0 / MIT"])
 def test_cargo_legacy_pair_keeps_choice_and_text_checks(expression: str) -> None:
     evidence = _cargo_evidence(license_expression=expression)
@@ -1034,9 +1120,99 @@ def test_missing_full_text_is_independent_of_dual_license_choice(selection) -> N
     assert decision.allowed == (selection is not None)
 
 
-@pytest.mark.parametrize("mutation", [None, "missing_source", "wrong_sha", "foreign_path",
+@pytest.mark.parametrize(
+    ("mutation_name", "expected_message"),
+    [
+        ("nonexact", "exact release commit"),
+        ("oversized", "blob exceeds bounded size"),
+        ("not-list", "must be a JSON array"),
+        ("missing-choice", "lacks one explicit notice selection"),
+        ("separator", "grant separator differs"),
+        ("grant", "grant bytes differ"),
+    ],
+)
+def test_reviewed_source_notice_refuses_unbound_git_evidence(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    mutation_name: str,
+    expected_message: str,
+) -> None:
+    """Reviewed supplemental grants remain exact-SHA, bounded, and byte separated."""
+    subject = "cargo/example@1.0.0"
+    archive_sha = "a" * 64
+    source_sha = "b" * 40
+    source = tmp_path / "source"
+    source.mkdir()
+    first_grant = b"MIT"
+    second_grant = b"BSD"
+    content = first_grant + b"\n\n" + second_grant
+    if mutation_name == "separator":
+        content = first_grant + b"xx" + second_grant
+    elif mutation_name == "grant":
+        content = b"BAD\n\n" + second_grant
+    notice_digest = hashlib.sha256(content).hexdigest()
+    grants = (
+        ("LICENSE-MIT", 3, hashlib.sha256(first_grant).hexdigest()),
+        ("LICENSE-BSD", 3, hashlib.sha256(second_grant).hexdigest()),
+    )
+    monkeypatch.setitem(
+        gate._REVIEWED_SOURCE_NOTICES,
+        subject,
+        (archive_sha, "owner/repo", "c" * 40, notice_digest, {"MIT"}, grants),
+    )
+    upstream = [
+        {
+            "url": f"https://raw.githubusercontent.com/owner/repo/{'c' * 40}/{name}",
+            "sha256": digest,
+        }
+        for name, _, digest in grants
+    ]
+    choice = {
+        "ecosystem": "cargo",
+        "name": "example",
+        "version": "1.0.0",
+        "chosen": "MIT",
+        "rationale": "Reviewed both immutable grant bytes.",
+        "archive_sha256": archive_sha,
+        "upstream_licenses": upstream,
+        "bundled_notice": {
+            "path": "python/fast_mlsirm/_licenses/example.txt",
+            "sha256": notice_digest,
+        },
+    }
+    choices = [] if mutation_name == "missing-choice" else [choice]
+    choices_payload = b"{}" if mutation_name == "not-list" else json.dumps(choices).encode()
+
+    def git_blob(command, **kwargs):
+        operation = command[3]
+        if operation == "ls-tree":
+            path = command[-1]
+            oid = "selection-oid" if path == "docs/release-license-selections.json" else "notice-oid"
+            return f"100644 blob {oid}\t{path}\n"
+        if operation == "cat-file" and command[4] == "-s":
+            size = gate._MAX_METADATA_BYTES + 1 if mutation_name == "oversized" else 1
+            return f"{size}\n" if kwargs.get("text") else f"{size}\n".encode()
+        if operation == "cat-file" and command[4] == "blob":
+            return choices_payload if command[5] == "selection-oid" else content
+        raise AssertionError(command)
+
+    monkeypatch.setattr(gate.subprocess, "check_output", git_blob)
+    selected_sha = "short" if mutation_name == "nonexact" else source_sha
+    with pytest.raises(gate.GateError, match=expected_message):
+        gate._source_license_notice(
+            source,
+            selected_sha,
+            subject,
+            {"ecosystem": "cargo", "source_sha256": archive_sha},
+            {"chosen": "MIT", "rationale": "Reviewed both immutable grant bytes."},
+        )
+
+
+@pytest.mark.parametrize("mutation", [None, "missing_source", "wrong_sha", "nonexact_sha",
+                                      "foreign_workspace", "workspace_version", "foreign_path",
                                       "changed_manifest", "changed_lock", "captured_lock",
-                                      "symlink", "identity", "missing_dev"])
+                                      "symlink", "identity", "missing_dev", "matching_dev_lock",
+                                      "changed_dev_lock"])
 def test_nested_cargo_workspace_requires_immutable_release_source(tmp_path, mutation):
     import subprocess
 
@@ -1051,8 +1227,14 @@ def test_nested_cargo_workspace_requires_immutable_release_source(tmp_path, muta
     lock = capture / "cargo/Cargo.lock"
     lock.write_text(lock.read_text() + '\n[[package]]\nname = "local-core"\nversion = "1.0.0"\n')
     (wheel / "Cargo.lock").write_bytes(lock.read_bytes())
-    if mutation == "missing_dev":
+    if mutation in {"missing_dev", "matching_dev_lock", "changed_dev_lock"}:
         (source / "Cargo.lock").write_bytes(lock.read_bytes() + b"# separate development lock\n")
+        if mutation in {"matching_dev_lock", "changed_dev_lock"}:
+            dev = capture / "cargo-dev"
+            dev.mkdir()
+            dev_lock = ((source / "Cargo.lock").read_bytes() if mutation == "matching_dev_lock"
+                        else b"different development lock\n")
+            (dev / "Cargo.lock").write_bytes(dev_lock)
     def git(*args):
         return subprocess.check_output(["git", "-C", str(source), *args], text=True).strip()
     git("init", "-q")
@@ -1070,6 +1252,20 @@ def git(*args):
     metadata["resolve"]["nodes"].append({"id": "local-id", "deps": [{"pkg": "greencrate-id"}]})
     if mutation == "wrong_sha":
         sha = "a" * 40
+    elif mutation == "nonexact_sha":
+        sha = "short"
+    elif mutation == "foreign_workspace":
+        metadata["workspace_root"] = str(tmp_path / "foreign")
+    elif mutation == "workspace_version":
+        core.write_text('[package]\nname = "local-core"\nversion.workspace = true\n')
+        (wheel / "Cargo.toml").write_text(
+            '[package]\nname = "fast-mlsirm"\nversion = "0.11.5"\n'
+            '[workspace]\nmembers = ["../core"]\n[workspace.package]\nversion = "1.0.0"\n'
+        )
+        subprocess.run(["git", "-C", str(source), "add", "."], check=True)
+        subprocess.run(["git", "-C", str(source), "-c", "user.name=Fixture", "-c",
+                        "user.email=fixture@example.invalid", "commit", "-qm", "workspace version"], check=True)
+        sha = git("rev-parse", "HEAD")
     elif mutation == "foreign_path":
         metadata["packages"][-1]["manifest_path"] = str(tmp_path / "foreign/Cargo.toml")
     elif mutation == "changed_manifest":
@@ -1087,14 +1283,22 @@ def git(*args):
     elif mutation == "identity":
         metadata["packages"][-1]["name"] = "foreign-core"
     _write(path, metadata)
-    if mutation == "missing_dev":
+    if mutation in {"missing_dev", "matching_dev_lock", "changed_dev_lock"}:
         release = json.loads((capture / "release.json").read_text())
         release["source_sha"] = sha
         _write(capture / "release.json", release)
-        with pytest.raises(gate.GateError, match="development Cargo graph is missing"):
+        if mutation == "matching_dev_lock":
+            dev_metadata = json.loads((capture / "cargo/metadata.json").read_text())
+            dev_metadata["workspace_root"] = str(source)
+            _write(capture / "cargo-dev/metadata.json", dev_metadata)
+            assert gate.gate(capture, stage=gate.LICENSE_STAGE, source_root=source).passed
+            return
+        expected = ("development Cargo graph is missing" if mutation == "missing_dev"
+                    else "development Cargo lock differs from source root")
+        with pytest.raises(gate.GateError, match=expected):
             gate.gate(capture, stage=gate.LICENSE_STAGE, source_root=source)
         return
-    if mutation is not None:
+    if mutation not in {None, "workspace_version"}:
         with pytest.raises(gate.GateError, match=gate.CAPTURE_INCOMPLETE):
             gate._enumerate_cargo(capture, source_root=None if mutation == "missing_source" else source,
                                   source_sha=sha)
diff --git a/tests/test_release_dependency_gate_capture_and_seal.py b/tests/test_release_dependency_gate_capture_and_seal.py
index f3f5753d81..e80aa4c4eb 100644
--- a/tests/test_release_dependency_gate_capture_and_seal.py
+++ b/tests/test_release_dependency_gate_capture_and_seal.py
@@ -9,10 +9,8 @@
 
 from __future__ import annotations
 
-import builtins
 import hashlib
 import json
-import runpy
 from pathlib import Path
 from typing import Any
 
@@ -37,19 +35,25 @@
 
 
 def test_gate_import_and_toml_parsing_without_stdlib_tomllib(monkeypatch):
-    """Exercise the complete module import with the Python 3.10 TOML parser."""
-    tomli = pytest.importorskip("tomli")
-    original = builtins.__import__
+    """Select the declared Python 3.10 TOML parser when stdlib lacks one."""
+    class BackportParser:
+        @staticmethod
+        def loads(source_text):
+            assert source_text == '[package]\nlicense="MIT"'
+            return {"package": {"license": "MIT"}}
+
+    tomli = BackportParser()
+    original = gate.importlib.import_module
 
     def import_without_tomllib(name, *args, **kwargs):
         if name == "tomllib":
             raise ModuleNotFoundError("No module named 'tomllib'", name="tomllib")
-        return original(name, *args, **kwargs)
+        return tomli if name == "tomli" else original(name, *args, **kwargs)
 
-    monkeypatch.setattr(builtins, "__import__", import_without_tomllib)
-    loaded = runpy.run_path(gate.__file__)
-    assert loaded["tomllib"] is tomli
-    assert loaded["tomllib"].loads('[package]\nlicense="MIT"')['package']['license'] == "MIT"
+    monkeypatch.setattr(gate.importlib, "import_module", import_without_tomllib)
+    parser = gate._import_toml_parser()
+    assert parser is tomli
+    assert parser.loads('[package]\nlicense="MIT"')['package']['license'] == "MIT"
 
 
 def test_binder_resolves_next_to_this_script() -> None:
diff --git a/tests/test_release_dependency_gate_remaining_branches.py b/tests/test_release_dependency_gate_remaining_branches.py
new file mode 100644
index 0000000000..aeb7ba8164
--- /dev/null
+++ b/tests/test_release_dependency_gate_remaining_branches.py
@@ -0,0 +1,442 @@
+"""Close the release dependency gate's remaining fail-closed branch gaps."""
+
+from __future__ import annotations
+
+import hashlib
+import importlib
+import json
+import runpy
+import subprocess
+from pathlib import Path
+from types import SimpleNamespace
+from typing import Any
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+from tests.test_release_dependency_fanout_plan import CONTROL, _allowed
+from tests.test_release_dependency_gate import CRATE_HASH, _write, build_capture
+
+
+def _commit(source: Path, message: str = "fixture") -> str:
+    """Commit the complete fixture and return its exact Git identity."""
+
+    subprocess.run(["git", "init", "-q", str(source)], check=True)
+    subprocess.run(["git", "add", "."], cwd=source, check=True)
+    subprocess.run(
+        [
+            "git",
+            "-c",
+            "user.name=Fixture",
+            "-c",
+            "user.email=fixture@example.invalid",
+            "-c",
+            "commit.gpgsign=false",
+            "commit",
+            "--allow-empty",
+            "-qm",
+            message,
+        ],
+        cwd=source,
+        check=True,
+    )
+    return subprocess.check_output(
+        ["git", "rev-parse", "HEAD"], cwd=source, text=True
+    ).strip()
+
+
+def test_python_310_toml_fallback_loads_the_declared_compatibility_module(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A Python 3.10 runtime without ``tomllib`` must use the declared fallback."""
+
+    real_import_module = importlib.import_module
+    fallback = SimpleNamespace(loads=lambda text: {"parsed": text})
+
+    def import_without_tomllib(name: str, package: str | None = None) -> Any:
+        if name == "tomllib":
+            raise ModuleNotFoundError("simulated Python 3.10")
+        if name == "tomli":
+            return fallback
+        return real_import_module(name, package)
+
+    monkeypatch.setattr(importlib, "import_module", import_without_tomllib)
+    namespace = runpy.run_path(str(Path(gate.__file__)))
+    assert namespace["tomllib"] is fallback
+
+
+def test_benign_rust_build_script_has_no_process_or_network_finding() -> None:
+    """A Rust build script without a process/network namespace remains admissible."""
+
+    assert gate.detect_install_hooks({"build.rs": "fn main() { println!(\"cargo:rerun\"); }"}) == []
+
+
+@pytest.mark.parametrize(
+    ("name", "target", "leg", "member", "expected_kind"),
+    [
+        ("libc.so.6", "manylinux_2_28_x86_64", "linux-py3.13", "pkg/core.so", "system-runtime"),
+        ("libunknown.so", "manylinux_2_28_x86_64", "linux-py3.13", "pkg/core.so", None),
+        (
+            "@rpath/fast_mlsirm._core.cpython-313-darwin.so",
+            "macosx_11_0_x86_64-darwin",
+            "darwin-py3.13",
+            "fast_mlsirm/_core.cpython-313-darwin.so",
+            "self-install-name",
+        ),
+        ("PYTHON313.DLL", "win_amd64-windows", "windows-py3.13", "pkg/core.pyd", "interpreter-runtime"),
+        ("UNKNOWN.DLL", "win_amd64-windows", "windows-py3.13", "pkg/core.pyd", None),
+        ("libc.so.6", "freebsd_14_x86_64", "freebsd-py3.13", "pkg/core.so", None),
+    ],
+)
+def test_platform_link_classifier_distinguishes_reviewed_and_unknown_runtime_links(
+    name: str,
+    target: str,
+    leg: str,
+    member: str,
+    expected_kind: str | None,
+) -> None:
+    """Only the target-specific runtime identities receive an allowlisted basis."""
+
+    result = gate.classify_platform_link(name, target, leg, member)
+    assert (result and result["kind"]) == expected_kind
+
+
+def test_selection_capture_cli_accepts_an_exact_commit_without_a_selection_file(
+    tmp_path: Path,
+) -> None:
+    """An absent optional selection file is a successful, empty capture via the CLI."""
+
+    source = tmp_path / "source"
+    source.mkdir()
+    sha = _commit(source)
+    capture = tmp_path / "capture"
+    assert gate.main(
+        [
+            "capture-license-selections",
+            "--source",
+            str(source),
+            "--source-sha",
+            sha,
+            "--capture",
+            str(capture),
+        ]
+    ) == 0
+    assert not capture.exists()
+
+
+def test_selection_capture_requires_an_exact_commit_sha(tmp_path: Path) -> None:
+    """A branch-like selection identity is rejected before any Git object lookup."""
+
+    with pytest.raises(gate.GateError, match="exact commit SHA"):
+        gate.capture_license_selections(tmp_path, "main", tmp_path / "capture")
+
+
+def test_selection_capture_rejects_a_symlink_git_object(tmp_path: Path) -> None:
+    """A committed symlink cannot stand in for the regular selection JSON blob."""
+
+    source = tmp_path / "source"
+    path = source / "docs" / "release-license-selections.json"
+    path.parent.mkdir(parents=True)
+    path.symlink_to("elsewhere.json")
+    sha = _commit(source)
+    with pytest.raises(gate.GateError, match="regular Git blob"):
+        gate.capture_license_selections(source, sha, tmp_path / "capture")
+
+
+def test_selection_capture_rechecks_the_blob_size_after_read(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Git returning more bytes than its size metadata cannot bypass the read bound."""
+
+    source = tmp_path / "source"
+    path = source / "docs" / "release-license-selections.json"
+    path.parent.mkdir(parents=True)
+    path.write_text("[]", encoding="utf-8")
+    sha = _commit(source)
+    real_check_output = gate.subprocess.check_output
+
+    def inconsistent_git(command: list[str], **kwargs: Any) -> Any:
+        if command[1:3] == ["cat-file", "-s"]:
+            return b"1\n"
+        if command[1:3] == ["cat-file", "blob"]:
+            return b"oversized"
+        return real_check_output(command, **kwargs)
+
+    monkeypatch.setattr(gate.subprocess, "check_output", inconsistent_git)
+    monkeypatch.setattr(gate, "_MAX_METADATA_BYTES", 2)
+    with pytest.raises(gate.GateError, match="bounded size"):
+        gate.capture_license_selections(source, sha, tmp_path / "capture")
+
+
+def _source_bound_cargo_capture(
+    tmp_path: Path, *, workspace_version: bool = False
+) -> tuple[Path, Path, str]:
+    """Build a small source-bound Cargo capture backed by real Git objects."""
+
+    capture = build_capture(tmp_path / "capture")
+    source = (tmp_path / "source").resolve()
+    wheel = source / "crates" / "wheel"
+    core = source / "crates" / "core" / "Cargo.toml"
+    wheel.mkdir(parents=True)
+    core.parent.mkdir(parents=True)
+    core.write_text(
+        '[package]\nname = "local-core"\n'
+        + ('version.workspace = true\n' if workspace_version else 'version = "1.0.0"\n'),
+        encoding="utf-8",
+    )
+    wheel_manifest = '[package]\nname = "fast-mlsirm"\nversion = "0.11.5"\n'
+    if workspace_version:
+        wheel_manifest += '\n[workspace.package]\nversion = "1.0.0"\n'
+    (wheel / "Cargo.toml").write_text(wheel_manifest, encoding="utf-8")
+    lock = capture / "cargo" / "Cargo.lock"
+    lock.write_text(
+        lock.read_text(encoding="utf-8")
+        + '\n[[package]]\nname = "local-core"\nversion = "1.0.0"\n',
+        encoding="utf-8",
+    )
+    (wheel / "Cargo.lock").write_bytes(lock.read_bytes())
+    sha = _commit(source)
+
+    metadata_path = capture / "cargo" / "metadata.json"
+    metadata = json.loads(metadata_path.read_text(encoding="utf-8"))
+    metadata["workspace_root"] = str(wheel)
+    metadata["packages"][0]["manifest_path"] = str(wheel / "Cargo.toml")
+    metadata["packages"].append(
+        {
+            "id": "local-id",
+            "name": "local-core",
+            "version": "1.0.0",
+            "source": None,
+            "manifest_path": str(core),
+        }
+    )
+    metadata["resolve"]["nodes"][0]["deps"].append({"pkg": "local-id"})
+    metadata["resolve"]["nodes"].append(
+        {"id": "local-id", "deps": [{"pkg": "greencrate-id"}]}
+    )
+    _write(metadata_path, metadata)
+    return capture, source, sha
+
+
+def test_cargo_source_binding_rejects_a_nonexact_commit(tmp_path: Path) -> None:
+    """Source-bound Cargo declarations require a full immutable commit identity."""
+
+    capture, source, _sha = _source_bound_cargo_capture(tmp_path)
+    with pytest.raises(gate.GateError, match="source checkout cannot be bound"):
+        gate._enumerate_cargo(capture, source_root=source, source_sha="main")
+
+
+def test_cargo_workspace_must_be_inside_the_selected_source(tmp_path: Path) -> None:
+    """Absolute Cargo metadata still fails when its workspace escapes the checkout."""
+
+    capture, source, sha = _source_bound_cargo_capture(tmp_path)
+    metadata_path = capture / "cargo" / "metadata.json"
+    metadata = json.loads(metadata_path.read_text(encoding="utf-8"))
+    metadata["workspace_root"] = str((tmp_path / "outside").resolve())
+    _write(metadata_path, metadata)
+    with pytest.raises(gate.GateError, match="source checkout cannot be bound"):
+        gate._enumerate_cargo(capture, source_root=source, source_sha=sha)
+
+
+def test_cargo_workspace_inherited_version_is_bound_to_the_root_manifest(
+    tmp_path: Path,
+) -> None:
+    """A path crate's inherited version must resolve from committed workspace bytes."""
+
+    capture, source, sha = _source_bound_cargo_capture(tmp_path, workspace_version=True)
+    dependencies, failures, expected = gate._enumerate_cargo(
+        capture, source_root=source, source_sha=sha
+    )
+    assert failures == []
+    assert {dependency.key for dependency in dependencies} == expected == {
+        "cargo/greencrate@0.1.0"
+    }
+
+
+@pytest.mark.parametrize("matches_source", [False, True])
+def test_development_cargo_lock_must_match_the_committed_root_lock(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    matches_source: bool,
+) -> None:
+    """A distinct development graph is admitted only with the exact root lock bytes."""
+
+    capture = build_capture(tmp_path / "capture")
+    source = tmp_path / "source"
+    source.mkdir()
+    root_lock = (capture / "cargo" / "Cargo.lock").read_bytes() + b"# development graph\n"
+    (source / "Cargo.lock").write_bytes(root_lock)
+    sha = _commit(source)
+    release = json.loads((capture / "release.json").read_text(encoding="utf-8"))
+    release["source_sha"] = sha
+    _write(capture / "release.json", release)
+    dev = capture / "cargo-dev"
+    dev.mkdir()
+    (dev / "Cargo.lock").write_bytes(root_lock if matches_source else b"other lock")
+    dependency = gate.Dependency(
+        "cargo", "greencrate", "0.1.0", frozenset({CRATE_HASH})
+    )
+
+    def enumerate_cargo(*_args: Any, **_kwargs: Any) -> tuple[list[gate.Dependency], list[gate.Failure], set[str]]:
+        return [dependency], [], {dependency.key}
+
+    monkeypatch.setattr(gate, "_enumerate_cargo", enumerate_cargo)
+    if not matches_source:
+        with pytest.raises(gate.GateError, match="development Cargo lock differs"):
+            gate.gate(capture, stage=gate.LICENSE_STAGE, source_root=source)
+        return
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE, source_root=source)
+    assert report.passed
+
+
+def _source_notice_fixture(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    mutation: str,
+) -> tuple[Path, str, str, dict[str, str], dict[str, Any]]:
+    """Create one reviewed supplemental notice declaration in a real Git tree."""
+
+    source = tmp_path / "source"
+    notice_path = "python/fast_mlsirm/_licenses/example-1.0.0.txt"
+    first, second = b"MIT", b"Apache"
+    content = first + (b"--" if mutation == "separator" else b"\n\n") + second
+    digest = hashlib.sha256(content).hexdigest()
+    first_digest = "0" * 64 if mutation == "grant" else hashlib.sha256(first).hexdigest()
+    grants = (
+        ("LICENSE-MIT", len(first), first_digest),
+        ("LICENSE-APACHE", len(second), hashlib.sha256(second).hexdigest()),
+    )
+    archive_sha = "a" * 64
+    upstream_commit = "b" * 40
+    repository = "example/project"
+    upstream = [
+        {
+            "url": f"https://raw.githubusercontent.com/{repository}/{upstream_commit}/{name}",
+            "sha256": sha,
+        }
+        for name, _size, sha in grants
+    ]
+    selection = {
+        "chosen": "MIT AND Apache-2.0",
+        "rationale": "Retain both immutable grants.",
+    }
+    choice = {
+        "ecosystem": "cargo",
+        "name": "example",
+        "version": "1.0.0",
+        **selection,
+        "archive_sha256": archive_sha,
+        "bundled_notice": {"path": notice_path, "sha256": digest},
+        "upstream_licenses": upstream,
+    }
+    choices: Any = [choice]
+    if mutation == "object":
+        choices = {"choice": choice}
+    elif mutation == "missing-choice":
+        choices = []
+    _write(source / "docs" / "release-license-selections.json", choices)
+    notice = source / notice_path
+    notice.parent.mkdir(parents=True)
+    notice.write_bytes(content)
+    sha = _commit(source)
+    monkeypatch.setitem(
+        gate._REVIEWED_SOURCE_NOTICES,
+        "cargo/example@1.0.0",
+        (
+            archive_sha,
+            repository,
+            upstream_commit,
+            digest,
+            {"MIT AND Apache-2.0"},
+            grants,
+        ),
+    )
+    evidence = {"ecosystem": "cargo", "source_sha256": archive_sha}
+    return source, sha, notice_path, selection, evidence
+
+
+@pytest.mark.parametrize(
+    ("mutation", "message"),
+    [
+        ("bad-sha", "exact release commit"),
+        ("oversized", "bounded size"),
+        ("object", "JSON array"),
+        ("missing-choice", "one explicit notice selection"),
+        ("separator", "separator differs"),
+        ("grant", "grant bytes differ"),
+    ],
+)
+def test_source_notice_refuses_each_unbound_git_or_grant_shape(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    mutation: str,
+    message: str,
+) -> None:
+    """Every reviewed source notice remains bound to exact Git and grant bytes."""
+
+    source, sha, _notice_path, selection, evidence = _source_notice_fixture(
+        tmp_path, monkeypatch, mutation
+    )
+    if mutation == "bad-sha":
+        sha = "main"
+    elif mutation == "oversized":
+        monkeypatch.setattr(gate, "_MAX_METADATA_BYTES", 1)
+    with pytest.raises(gate.GateError, match=message):
+        gate._source_license_notice(
+            source, sha, "cargo/example@1.0.0", evidence, selection
+        )
+
+
+def _runtime_archive_row(ecosystem: str, name: str, digest_byte: str) -> dict[str, Any]:
+    """Build one internally consistent runtime archive verdict row."""
+
+    source_hash = digest_byte * 64
+    key = f"{ecosystem}/{name}@1.0/sha256/{source_hash}"
+    evidence = {
+        "source_sha256": source_hash,
+        "archive_members": [],
+        "install_hook_sources": {},
+        "parsed_inputs": [],
+        "native_libraries": [],
+        "known_vulnerabilities": [],
+    }
+    fixture = gate.build_fixture(gate.Dependency(ecosystem, name, "1.0"), evidence)
+    fixture["id"] = key
+    return {
+        "key": key,
+        "package_key": f"{ecosystem}/{name}@1.0",
+        "name": name,
+        "version": "1.0",
+        "source_sha256": source_hash,
+        "license": "MIT",
+        "fixture": fixture,
+        "fixture_sha256": gate.fixture_digest(fixture),
+    }
+
+
+def test_runtime_archives_cannot_expand_an_in_limit_plan_past_the_job_cap(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Runtime archive rows are counted with base dependencies before fanout."""
+
+    capture, report_path = _allowed(tmp_path)
+    report = json.loads(report_path.read_text(encoding="utf-8"))
+    monkeypatch.setattr(gate, "STRIX_PLAN_LIMIT", len(report["dependencies"]))
+    archive_report = tmp_path / "runtime.json"
+    archive_report.write_text(
+        json.dumps(
+            {
+                "schema": "cwl.release-runtime-archive-licenses/3",
+                "archives": [_runtime_archive_row("pypi", "runtime", "a")],
+                "build_packages": [_runtime_archive_row("pypi", "builder", "b")],
+                "build_tools": [
+                    _runtime_archive_row("github-release", "maturin", "c")
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+    with pytest.raises(gate.GateError, match="plan exceeds"):
+        gate.strix_fanout_plan(
+            capture, report_path, CONTROL, 1, 1, archive_report
+        )
diff --git a/tests/test_repository_branch_coverage_reporting_edges.py b/tests/test_repository_branch_coverage_reporting_edges.py
index f5dbf1dae0..0d84369e98 100644
--- a/tests/test_repository_branch_coverage_reporting_edges.py
+++ b/tests/test_repository_branch_coverage_reporting_edges.py
@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import runpy
+import sys
 from pathlib import Path
 
 import pytest
@@ -21,6 +23,25 @@ def test_sanitizer_without_trailing_newline_stays_without_one() -> None:
     assert sanitizer.sanitize_text("plain") == "plain"
 
 
+def test_sanitizer_cli_writes_utf8_redacted_summary(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """The command-line boundary preserves UTF-8 evidence while redacting secrets."""
+
+    source = tmp_path / "coverage.md"
+    destination = tmp_path / "coverage-output.md"
+    source.write_text("결과: 통과\nAPI_KEY=비밀\n", encoding="utf-8")
+    monkeypatch.setattr(sys, "argv", ["sanitize", str(source), str(destination)])
+
+    with pytest.raises(SystemExit) as exc_info:
+        runpy.run_path(
+            "scripts/ci/sanitize_github_output_summary.py", run_name="__main__"
+        )
+
+    assert exc_info.value.code == 0
+    assert destination.read_text(encoding="utf-8") == "결과: 통과\nAPI_KEY=<redacted>\n"
+
+
 def test_sbom_defensive_relationship_and_license_shapes() -> None:
     """Malformed relationship and license entries fail closed to NOASSERTION."""
 
diff --git a/tests/test_repository_metadata_live_verification.py b/tests/test_repository_metadata_live_verification.py
index 6ae83d8c47..4fecd171e8 100644
--- a/tests/test_repository_metadata_live_verification.py
+++ b/tests/test_repository_metadata_live_verification.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import argparse
+import io
 import importlib.util
 import json
 from pathlib import Path
@@ -145,10 +146,11 @@ def build_ok(handler):
     assert len(handlers) == 1
     assert isinstance(handlers[0], RECONCILER._NoPagesRedirects)
     from urllib.error import HTTPError
-    with pytest.raises(HTTPError):
+    with pytest.raises(HTTPError) as exc_info:
         handlers[0].redirect_request(
             RECONCILER.Request("https://example.com"), None, 302, "redirect", {}, "http://127.0.0.1/"
         )
+    exc_info.value.close()
 
     with pytest.raises(RuntimeError, match="not built"):
         RECONCILER._pages_publication_ready("Repo", {**ready, "status": "building"})
@@ -179,6 +181,28 @@ def build_ok(handler):
         RECONCILER._pages_publication_ready("Repo", ready)
 
 
+def test_pages_publication_ready_closes_mapped_http_error(monkeypatch) -> None:
+    """Pages verification closes the response when it maps an HTTP failure."""
+    ready = {
+        "status": "built",
+        "html_url": "https://contextualwisdomlab.github.io/Repo/",
+    }
+    error_body = io.BytesIO(b"private body")
+    provider_error = RECONCILER.HTTPError(
+        ready["html_url"], 503, "private body", {}, error_body
+    )
+    monkeypatch.setattr(
+        RECONCILER,
+        "build_opener",
+        lambda *args: FakeOpener(error=provider_error),
+    )
+
+    with pytest.raises(RuntimeError, match="not reachable"):
+        RECONCILER._pages_publication_ready("Repo", ready)
+
+    assert error_body.closed
+
+
 def test_verify_repository_accepts_converged_disabled_and_enabled_pages(
     monkeypatch,
 ) -> None:
diff --git a/tests/test_repository_metadata_workflow_pages.py b/tests/test_repository_metadata_workflow_pages.py
index 5c05dfbe3d..2823719040 100644
--- a/tests/test_repository_metadata_workflow_pages.py
+++ b/tests/test_repository_metadata_workflow_pages.py
@@ -50,6 +50,20 @@ def test_metadata_pr_validation_cancels_superseded_head_runs() -> None:
     assert "github.event.pull_request.head.sha" not in concurrency
 
 
+
+def test_metadata_validation_fetches_history_for_published_lineage_contracts() -> None:
+    """The complete suite must have ancestry for its published-commit checks."""
+
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    validate_checkout = workflow.split(
+        "- name: Check out exact revision", 1
+    )[1].split("- name: Verify exact revision", 1)[0]
+
+    assert re.search(
+        r"(?m)^[ \t]+fetch-depth:[ \t]+0[ \t]*$",
+        validate_checkout,
+    )
+
 def test_manifest_accepts_explicit_workflow_pages_mode() -> None:
     """Workflow-backed Pages intent is explicit without changing legacy records."""
 
diff --git a/tests/test_required_review_runner_image_contract.py b/tests/test_required_review_runner_image_contract.py
index ab7ede7aa4..65412229bb 100644
--- a/tests/test_required_review_runner_image_contract.py
+++ b/tests/test_required_review_runner_image_contract.py
@@ -17,14 +17,10 @@ class RequiredReviewRunnerImageContract(unittest.TestCase):
     """Keep required review jobs off the observed starved floating image."""
 
     def assert_explicit_supported_image(self, path: Path) -> None:
-        """Require every job runner declaration to pin Ubuntu 24.04."""
-        runs_on = {
-            line.strip()
-            for line in path.read_text(encoding="utf-8").splitlines()
-            if line.strip().startswith("runs-on:")
-        }
-        self.assertTrue(runs_on)
-        self.assertEqual(runs_on, {"runs-on: ubuntu-24.04"})
+        """Require every ordinary job to use isolated self-hosted Linux runners."""
+        workflow = path.read_text(encoding="utf-8")
+        self.assertIn("group: CWL CI isolated", workflow)
+        self.assertIn("labels: [self-hosted, linux, x64, cwlab-ci-isolated]", workflow)
 
     def test_strix_uses_explicit_supported_image(self) -> None:
         """Route trusted metadata to control while preserving the scan image."""
@@ -36,25 +32,26 @@ def test_strix_uses_explicit_supported_image(self) -> None:
             self.assertIn("github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/strix.yml@refs/heads/main'", block)
             self.assertIn("github.repository == 'ContextualWisdomLab/.github'", block)
             self.assertIn("github.repository == 'ContextualWisdomLab/fast-mlsirm'", block)
-            self.assertIn("fromJSON('[\"ubuntu-24.04\"]')", block)
+            self.assertIn('fromJSON(\'{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}\')', block)
             self.assertNotIn("actions/checkout", block)
         scan = workflow.split("\n  strix:\n", 1)[1].split("\n  publish-manual-pr-evidence-status:\n", 1)[0]
-        self.assertIn("runs-on: ubuntu-24.04", scan)
+        self.assertIn("group: CWL CI isolated", scan)
+        self.assertIn("labels: [self-hosted, linux, x64, cwlab-ci-isolated]", scan)
         self.assertNotIn("cwlab-control", scan)
 
     def test_opencode_review_uses_explicit_supported_image(self) -> None:
         """Keep metadata-only OpenCode admission on the trusted control pool."""
-        workflow = OPENCODE_REVIEW.read_text(encoding="utf-8")
+        workflow = "\n".join(line for line in OPENCODE_REVIEW.read_text(encoding="utf-8").splitlines() if not line.strip().startswith("labels:"))
         self.assertEqual(workflow.count('"group":"CWL central control"'), 6)
         self.assertEqual(workflow.count('"labels":["self-hosted","linux","x64"]'), 6)
         self.assertNotIn("runs-on: ubuntu-24.04", workflow)
         self.assertNotIn("actions/checkout", workflow)
         self.assertEqual(workflow.count("github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/opencode-review.yml@refs/heads/main'"), 6)
-        self.assertEqual(workflow.count("fromJSON('[\"ubuntu-24.04\"]')"), 6)
+        self.assertEqual(workflow.count('fromJSON(\'{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}\')'), 6)
 
     def test_noema_review_uses_explicit_supported_image(self) -> None:
         """Keep trusted metadata jobs separate from the model review pool."""
-        workflow = NOEMA_REVIEW.read_text(encoding="utf-8")
+        workflow = "\n".join(line for line in NOEMA_REVIEW.read_text(encoding="utf-8").splitlines() if not line.strip().startswith("labels:"))
         self.assertEqual(workflow.count("github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main'"), 5)
         self.assertNotIn("endsWith(github.workflow_ref", workflow)
         self.assertEqual(workflow.count('"group":"CWL MCP remediation"'), 1)
@@ -62,7 +59,7 @@ def test_noema_review_uses_explicit_supported_image(self) -> None:
         for repository in ("cwl-telemetry", "naruon", "fast-mlsirm", "late-life-anxiety-reanalysis"):
             self.assertEqual(workflow.count(f"github.repository == 'ContextualWisdomLab/{repository}'"), 5)
         self.assertEqual(workflow.count("github.repository == 'ContextualWisdomLab/contextual-orchestrator'"), 5)
-        self.assertEqual(workflow.count("fromJSON('[\"ubuntu-24.04\"]')"), 5)
+        self.assertEqual(workflow.count('fromJSON(\'{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}\')'), 5)
         self.assertNotIn("runs-on: ubuntu-24.04", workflow)
         self.assertEqual(workflow.count('"cwlab-control"'), 4)
         for name in ("admit-current-head", "changed-scope", "cancel-closed-pr-runs", "continue-noema-transport"):
@@ -74,19 +71,12 @@ def test_noema_review_uses_explicit_supported_image(self) -> None:
         self.assertNotIn("cwlab-control", review)
 
     def test_opencode_review_dispatch_uses_explicit_supported_image(self) -> None:
-        """Require OpenCode dispatch jobs to use the compatible dedicated group.
-
-        This is the workflow the required `opencode-review` check's
-        `repository_dispatch` actually lands on to run the OpenCode CLI and
-        post the exact-head verdict; a starved floating image here queues
-        the real review work for hours just as surely as on the required
-        check itself (see docs/product-technical-gap-baseline.md's
-        2026-09-01 entry, whose own "Residual" note flagged this exact
-        follow-up sweep as still open).
-        """
+        """Keep trusted OpenCode jobs separate from isolated PR test execution."""
         workflow = OPENCODE_REVIEW_DISPATCH.read_text(encoding="utf-8")
-        self.assertEqual(workflow.count("group: CWL central OpenCode"), 3)
-        self.assertEqual(workflow.count("labels: [self-hosted, linux, x64]"), 3)
+        self.assertEqual(workflow.count("group: CWL central OpenCode"), 2)
+        self.assertEqual(workflow.count("labels: [self-hosted, linux, x64]"), 2)
+        self.assertEqual(workflow.count("group: CWL CI isolated"), 1)
+        self.assertEqual(workflow.count("labels: [self-hosted, linux, x64, cwlab-ci-isolated]"), 1)
         self.assertNotIn("runs-on: ubuntu-latest", workflow)
         self.assertNotIn("runs-on: ubuntu-24.04", workflow)
 
@@ -97,8 +87,8 @@ def test_opencode_review_dispatch_uses_explicit_supported_image(self) -> None:
 
 def test_codeql_pr_routes_trusted_main_to_control_and_pr_revisions_to_hosted() -> None:
     """Separate short metadata work from model work without granting PR runner access."""
-    workflow = Path(".github/workflows/codeql-pr.yml").read_text()
+    workflow = "\n".join(line for line in Path(".github/workflows/codeql-pr.yml").read_text().splitlines() if not line.strip().startswith("labels:"))
     assert workflow.count('"group":"CWL central control"') == 3
     assert workflow.count("github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main'") == 3
-    assert workflow.count("|| '\"ubuntu-24.04\"'") == 3
+    assert workflow.count("|| '{\"group\":\"CWL CI isolated\",\"labels\":[\"self-hosted\",\"linux\",\"x64\",\"cwlab-ci-isolated\"]}'") == 3
     assert '"group":"CWL MCP remediation"' not in workflow
diff --git a/tests/test_required_security_runner_image_contract.py b/tests/test_required_security_runner_image_contract.py
index d20c0c3a98..fb0f7d57e9 100644
--- a/tests/test_required_security_runner_image_contract.py
+++ b/tests/test_required_security_runner_image_contract.py
@@ -21,10 +21,11 @@ def test_security_scan_uses_explicit_supported_image(self) -> None:
         """
         workflow = SECURITY_SCAN.read_text(encoding="utf-8")
         self.assertNotIn("runs-on: ubuntu-latest", workflow)
-        self.assertEqual(workflow.count("runs-on: ubuntu-24.04"), 6)
+        self.assertEqual(workflow.count("group: CWL CI isolated"), 6)
+        self.assertEqual(workflow.count("labels: [self-hosted, linux, x64, cwlab-ci-isolated]"), 6)
 
     def test_sast_semgrep_uses_explicit_supported_image(self) -> None:
-        """Require the SAST Semgrep job to use explicit Ubuntu 24.04.
+        """Require the SAST Semgrep job to use isolated self-hosted Linux.
 
         `#1656` removed the sibling `cancel-closed-pr-runs` no-op job (it
         only duplicated PR-stable workflow concurrency), leaving one runner
@@ -36,7 +37,8 @@ def test_sast_semgrep_uses_explicit_supported_image(self) -> None:
         """
         workflow = SAST_SEMGREP.read_text(encoding="utf-8")
         self.assertNotIn("runs-on: ubuntu-latest", workflow)
-        self.assertEqual(workflow.count("runs-on: ubuntu-24.04"), 1)
+        self.assertEqual(workflow.count("group: CWL CI isolated"), 1)
+        self.assertEqual(workflow.count("labels: [self-hosted, linux, x64, cwlab-ci-isolated]"), 1)
 
 
 if __name__ == "__main__":
diff --git a/tests/test_required_workflow_queue_contract.py b/tests/test_required_workflow_queue_contract.py
index a24b3c7d0c..71f03174db 100644
--- a/tests/test_required_workflow_queue_contract.py
+++ b/tests/test_required_workflow_queue_contract.py
@@ -7,7 +7,6 @@
 import subprocess
 import sys
 import textwrap
-import time
 from pathlib import Path
 
 import pytest
@@ -25,7 +24,7 @@ def test_central_dispatch_and_control_jobs_use_dedicated_groups() -> None:
     """Central-only workflows cannot fall back into the general Ubuntu pool."""
     for name, group, jobs in (
         ("codeql-scan-dispatch.yml", "CWL central CodeQL", 3),
-        ("opencode-review-dispatch.yml", "CWL central OpenCode", 3),
+        ("opencode-review-dispatch.yml", "CWL central OpenCode", 2),
         ("agent-mention-router.yml", "CWL central control", 2),
         ("hourly-review-repair.yml", "CWL central control", 1),
     ):
@@ -1276,7 +1275,21 @@ def test_noema_review_credentials_and_orchestrator_configuration_fail_closed() -
     assert "https://integrate.api.nvidia.com/v1/chat/completions" not in workflow
     assert "nvidia/nemotron-3-ultra-550b-a55b" not in workflow
     assert "contextual_orchestrator_review_sidecar.sh" in workflow
-    assert 'export NOEMA_LLM_MODEL="orchestrator/free"' in workflow
+    prepare = workflow_step(workflow, "Prepare Noema model verdict")
+    assert 'export NOEMA_LLM_MODEL="orchestrator/free"' not in prepare
+    personal, sidecar = prepare.split("          else\n", 1)
+    assert 'if [ "${PERSONAL_ROUTE_SELECTED:-}" = \'true\' ]; then' in personal
+    assert 'test -n "${LLM_GATEWAY_API_KEY:-}"' in personal
+    assert 'export NOEMA_LLM_MODEL="auto"' in personal
+    assert 'https://litellm.poinnetworks.net/v1/chat/completions' in personal
+    assert 'export NOEMA_LLM_MODEL="orchestrator/auto"' in sidecar
+    admission = workflow_step(workflow, "Admit existing personal LiteLLM auto route")
+    assert 'scripts.ci.personal_review_route' in admission
+    assert '--zero-cost "$PERSONAL_REVIEW_ZERO_COST_ATTESTED"' in admission
+    assert '--zero-retention "$PERSONAL_REVIEW_ZDR_ATTESTED"' in admission
+    assert '--private-target "$PRIVATE_TARGET"' in admission
+    assert "vars.PERSONAL_REVIEW_ZERO_COST_ATTESTED || 'false'" in admission
+    assert "vars.PERSONAL_REVIEW_ZDR_ATTESTED || 'false'" in admission
     assert (
         "contextual-orchestrator review sidecar must be provisioned before Noema LLM review."
         in workflow
@@ -1314,7 +1327,7 @@ def test_strix_gateway_default_and_noema_sidecar_fail_closed(
         env={
             **os.environ,
             "GITHUB_OUTPUT": str(strix_output),
-            "STRIX_MODEL": "contextual-orchestrator/orchestrator/free",
+            "STRIX_MODEL": "auto",
             "STRIX_MODEL_REQUESTED": "",
         },
         capture_output=True,
@@ -1323,12 +1336,12 @@ def test_strix_gateway_default_and_noema_sidecar_fail_closed(
     )
     assert strix.returncode == 0, strix.stderr
     assert {
-        "strix_model=contextual-orchestrator/orchestrator/free",
+        "strix_model=auto",
         "enabled=true",
         "provider_mode=contextual_orchestrator",
     } <= set(strix_output.read_text().splitlines())
     assert (
-        "STRIX_MODEL: contextual-orchestrator/orchestrator/free"
+        "STRIX_MODEL: auto"
         in workflow_text("strix.yml")
     )
     assert (
@@ -1392,15 +1405,15 @@ def test_noema_review_supports_review_token_pat_fallback() -> None:
     """
     workflow = workflow_text("noema-review.yml")
 
-    assert "NOEMA_REVIEW_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN }}" in workflow
+    assert 'NOEMA_REVIEW_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || \'\' }}' in workflow
     assert 'if [ -n "${NOEMA_REVIEW_TOKEN:-}" ]; then' in workflow
     assert (
         "Noema reviewer using the NOEMA_REVIEW_TOKEN secret fallback identity."
         in workflow
     )
-    # The review step must prefer the PAT over the exchanged app token.
+    # Non-kcsap consumers retain PAT preference; k-csap is App-only.
     assert (
-        "GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token }}"
+        "GH_TOKEN: ${{ env.TARGET_REPOSITORY == 'ContextualWisdomLab/k-csap-skills' && steps.noema_github_app_token.outputs.token || (env.TARGET_REPOSITORY != 'ContextualWisdomLab/k-csap-skills' && (secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token)) || '' }}"
         in workflow
     )
     assert "steps.noema_credential.outputs.source == 'github-app'" in workflow
@@ -1420,17 +1433,17 @@ def test_noema_review_mints_a_least_privilege_github_app_token() -> None:
     assert "private-key: ${{ secrets.NOEMA_GITHUB_APP_PRIVATE_KEY }}" in workflow
     assert "owner: ContextualWisdomLab" in workflow
     assert "repositories: ${{ steps.noema_credential.outputs.repository }}" in workflow
-    for permission in (
-        "permission-actions: read",
-        "permission-checks: read",
-        "permission-contents: read",
-        "permission-metadata: read",
-        "permission-pull-requests: write",
-        "permission-security-events: read",
-        "permission-statuses: read",
-        "permission-vulnerability-alerts: read",
-    ):
-        assert permission in workflow
+    prepare = workflow_step(workflow, "Mint repository-scoped Noema GitHub App token")
+    publish = workflow_step(workflow, "Refresh repository-scoped Noema GitHub App token for publication")
+    for permission in ("permission-contents: read", "permission-metadata: read"):
+        assert permission in prepare and permission in publish
+    assert "permission-pull-requests: read" in prepare
+    assert "permission-pull-requests: read" in publish
+    assert "permission-pull-requests: write" not in publish
+    for permission in ("permission-actions:", "permission-checks:",
+                       "permission-security-events:", "permission-statuses:",
+                       "permission-vulnerability-alerts:"):
+        assert permission not in prepare and permission not in publish
 
 
 def test_opencode_dispatch_hands_approved_head_to_noema_before_merge() -> None:
@@ -1862,6 +1875,24 @@ def test_security_scan_osv_upload_uses_pr_head_for_pr_head_sarif() -> None:
     assert "wait-for-processing: false" in upload_step
 
 
+def test_osv_debug_artifact_quota_does_not_fail_the_scanner_gate() -> None:
+    """Keep optional debug evidence from overriding a completed OSV gate."""
+    workflow = workflow_text("security-scan.yml")
+    upload_step = workflow_step(workflow, "Upload OSV debug artifacts")
+
+    assert "actions/upload-artifact" in upload_step
+    assert "continue-on-error: true" in upload_step
+
+
+def test_trivy_scan_does_not_restore_runner_specific_binary_cache() -> None:
+    """Install the pinned Trivy binary on each heterogeneous runner."""
+    workflow = workflow_text("security-scan.yml")
+    scan_step = workflow_step(workflow, "Trivy filesystem scan")
+
+    assert "aquasecurity/trivy-action" in scan_step
+    assert "cache: false" in scan_step
+
+
 def test_pr_sarif_upload_rate_limits_do_not_mask_scanner_gates() -> None:
     """Scanner hard gates must run even when GitHub code-scanning upload is busy."""
     cases = (
diff --git a/tests/test_resolve_base_rust_toolchain.py b/tests/test_resolve_base_rust_toolchain.py
index db47136c80..26e248a127 100644
--- a/tests/test_resolve_base_rust_toolchain.py
+++ b/tests/test_resolve_base_rust_toolchain.py
@@ -2,7 +2,9 @@
 
 from __future__ import annotations
 
+import runpy
 import subprocess
+import sys
 from pathlib import Path
 
 import pytest
@@ -81,3 +83,37 @@ def test_invalid_base_sha_is_rejected(tmp_path: Path) -> None:
 
 def test_central_release_is_itself_exact() -> None:
     assert resolver.EXACT_RELEASE_RE.fullmatch(resolver.CENTRAL_RUST_TOOLCHAIN)
+
+
+def test_cli_prints_resolved_release_and_rejects_untrusted_sha(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str],
+) -> None:
+    """The CLI prints a trusted-base pin and reports malformed revision input."""
+
+    base = _commit(tmp_path, {"rust-toolchain": "1.97.1\n"})
+    assert resolver.main(["--repo-root", str(tmp_path), "--base-sha", base]) == 0
+    assert capsys.readouterr().out == "1.97.1\n"
+
+    assert resolver.main(["--repo-root", str(tmp_path), "--base-sha", "HEAD"]) == 1
+    assert "base SHA must be" in capsys.readouterr().err
+
+
+def test_script_entrypoint_uses_the_trusted_base(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str],
+) -> None:
+    """The executable script resolves and prints the exact base-commit toolchain."""
+
+    base = _commit(tmp_path, {"rust-toolchain.toml": '[toolchain]\nchannel = "1.97.1"\n'})
+    _commit(tmp_path, {"rust-toolchain.toml": '[toolchain]\nchannel = "1.80.0"\n'})
+    script = Path(resolver.__file__)
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        [str(script), "--repo-root", str(tmp_path), "--base-sha", base],
+    )
+
+    with pytest.raises(SystemExit) as exited:
+        runpy.run_path(str(script), run_name="__main__")
+
+    assert exited.value.code == 0
+    assert capsys.readouterr().out == "1.97.1\n"
diff --git a/tests/test_review_ai_app_independence.py b/tests/test_review_ai_app_independence.py
new file mode 100644
index 0000000000..eb4b484b60
--- /dev/null
+++ b/tests/test_review_ai_app_independence.py
@@ -0,0 +1,86 @@
+"""Known second-review App evidence, not arbitrary bot or human prerequisites."""
+from copy import deepcopy
+import json
+
+import pytest
+
+from scripts.ci import noema_review_gate as noema
+from scripts.ci import pr_review_merge_scheduler as scheduler
+
+HEAD = 'a' * 40
+
+
+def app_review(monkeypatch):
+    """Capture the actual publisher body without contacting GitHub or a model."""
+    payloads = []
+    monkeypatch.setenv('NOEMA_REVIEW_TOKEN_SOURCE', 'noema-review-github-app')
+    monkeypatch.setattr(noema, 'run', lambda args, stdin=None: payloads.append(json.loads(stdin)))
+    verdict = {
+        'decision': 'approve', 'summary': 'Inspected the changed authorization boundary.',
+        'findings': [],
+        'reviewed_lines': [{'path': 'scripts/ci/example.py', 'line': 2, 'side': 'RIGHT',
+                            'analysis': 'The exact-head guard rejects a stale commit before publication.'}],
+        'adversarial_validation': {'residual_risk': 'App installation permissions are externally enforced.',
+            'probes': [{'path': 'scripts/ci/example.py', 'line': 2, 'side': 'RIGHT',
+                        'outcome': 'falsified', 'hypothesis': 'A stale head could bypass admission.',
+                        'evidence': 'Changed-line inspection found the stale-head rejection before mutation.'}]},
+    }
+    noema.submit_review('ContextualWisdomLab/example', 1, {'headRefOid': HEAD},
+                        'cwl-noema-review[bot]', verdict)
+    return {'author': {'login': 'cwl-noema-review', '__typename': 'Bot'},
+            'state': 'APPROVED', 'commit': {'oid': HEAD}, 'body': payloads[0]['body']}
+
+
+def pull_request(review):
+    """Keep GitHub's independent policy decision separate from review identity."""
+    return {'author': {'login': 'source-writer'}, 'headRefOid': HEAD,
+            'reviewDecision': 'APPROVED', 'reviews': {'nodes': [review]}}
+
+
+def test_known_noema_app_real_publisher_body_counts_as_independent(monkeypatch):
+    pr = pull_request(app_review(monkeypatch))
+    assert scheduler.has_independent_current_head_approval(pr)
+    assert scheduler.merge_approval_block_reason(pr) is None
+    pr['reviewDecision'] = 'REVIEW_REQUIRED'
+    assert scheduler.merge_approval_block_reason(pr) is not None
+
+
+@pytest.mark.parametrize('mutation', ['author', 'unknown', 'primary', 'stale', 'no_commit',
+    'empty', 'no_analysis', 'no_probe', 'no_credential', 'no_actor', 'marker_mismatch'])
+def test_known_app_admission_preserves_negative_boundaries(monkeypatch, mutation):
+    review = app_review(monkeypatch)
+    pr = pull_request(review)
+    if mutation == 'author':
+        pr['author']['login'] = 'cwl-noema-review[bot]'
+    elif mutation == 'unknown':
+        review['author']['login'] = 'arbitrary-reviewer'
+    elif mutation == 'primary':
+        review['author']['login'] = 'opencode-agent'
+    elif mutation == 'stale':
+        review['commit']['oid'] = 'b' * 40
+    elif mutation == 'no_commit':
+        review['commit'] = None
+    elif mutation == 'empty':
+        review['body'] = ''
+    elif mutation == 'no_analysis':
+        review['body'] = review['body'].replace('### Reviewed changed lines', '### Missing')
+    elif mutation == 'no_probe':
+        review['body'] = review['body'].replace('### Adversarial validation', '### Missing')
+    elif mutation == 'no_credential':
+        review['body'] = review['body'].replace('noema-review-github-app', 'untrusted-token')
+    elif mutation == 'no_actor':
+        review['body'] = review['body'].replace('- Actor: `cwl-noema-review[bot]`', '')
+    else:
+        review['body'] = review['body'].replace('decision=approve', 'decision=request_changes')
+    assert not scheduler.has_independent_current_head_approval(pr)
+
+
+@pytest.mark.parametrize('state', ['CHANGES_REQUESTED', 'DISMISSED', 'APPROVED'])
+def test_latest_same_app_policy_state_revokes_old_approval(monkeypatch, state):
+    review = app_review(monkeypatch)
+    later = deepcopy(review)
+    later['author']['login'] = 'cwl-noema-review[bot]'
+    later.update(state=state, body='not a substantive model review')
+    pr = pull_request(review)
+    pr['reviews']['nodes'].append(later)
+    assert not scheduler.has_independent_current_head_approval(pr)
diff --git a/tests/test_review_auto_cost_admission.py b/tests/test_review_auto_cost_admission.py
new file mode 100644
index 0000000000..5ac0a1a871
--- /dev/null
+++ b/tests/test_review_auto_cost_admission.py
@@ -0,0 +1,110 @@
+"""Exercise complete launcher selection with inert library/provider collaborators."""
+import json
+from pathlib import Path
+import runpy
+import sys
+from types import ModuleType, SimpleNamespace
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+@pytest.mark.parametrize('only_priced', [False, True])
+def test_auto_zero_cost_main_never_preflights_or_serves_priced_models(tmp_path, monkeypatch, only_priced):
+    namespace = runpy.run_path(str(ROOT / 'scripts/ci/contextual_orchestrator_review_launcher.py'))
+    main = namespace['main']
+    globalns = main.__globals__
+    free = SimpleNamespace(provider_name='openrouter', model_id='qwen/qwen3-coder:free',
+                           agent_id='openrouter_free_model', output_modalities=('text',),
+                           prompt_price_per_1k=0.0, completion_price_per_1k=0.0,
+                           currency_code='USD')
+    priced = SimpleNamespace(provider_name='openai', model_id='priced-model',
+                             agent_id='openai_priced_model', output_modalities=('text',),
+                             prompt_price_per_1k=0.1, completion_price_per_1k=0.2,
+                             currency_code='USD')
+    observed = {'preflight': [], 'served': []}
+    modules = {
+        'credentials': {'get_credential': lambda _: 'synthetic-only'},
+        'chat_capability': {'is_general_chat_agent_model_id': lambda _: True},
+        'model_discovery': {'discover_all_models': lambda: ([priced] if only_priced else [free, priced], {}),
+                            'free_discovered_models': lambda rows: [m for m in rows if m is free]},
+        'review_gateway': {'REVIEW_AUTH_CREDENTIAL_NAME': 'fixture',
+                           'register_review_credentials': lambda _: ['OPENROUTER_API_KEY']},
+        'debug_logging': {'configure_logging': lambda **_: None},
+    }
+    def load_agents(path):
+        return json.loads(Path(path).read_text())['agents']
+    class ModelClient:
+        def __init__(self, **kwargs):
+            pass
+    class TaskOrchestrator:
+        def __init__(self, agents, **kwargs):
+            self.agents = agents
+    modules['orchestrator'] = {'load_agents': load_agents, 'ModelClient': ModelClient,
+                               'TaskOrchestrator': TaskOrchestrator}
+    modules['server'] = {'SecurityConfig': lambda **kwargs: kwargs,
+                         'serve': lambda orchestrator, **kwargs: observed['served'].extend(orchestrator.agents)}
+    package = ModuleType('contextual_orchestrator')
+    package.__path__ = []
+    monkeypatch.setitem(sys.modules, 'contextual_orchestrator', package)
+    for name, values in modules.items():
+        module = ModuleType('contextual_orchestrator.' + name)
+        module.__dict__.update(values)
+        monkeypatch.setitem(sys.modules, module.__name__, module)
+    monkeypatch.setitem(globalns, '_configure_sidecar_logging', lambda _: None)
+    monkeypatch.setitem(globalns, '_log_discovery_errors', lambda _: None)
+    def preflight(primary, fallback, **kwargs):
+        assert not fallback, 'zero-cost mode may not prepare paid fallback'
+        assert all(a['model'] != 'priced-model' for a in primary)
+        observed['preflight'].extend(primary)
+        return primary, {'ready': True}, False
+    monkeypatch.setitem(globalns, '_preflight_with_fallback', preflight)
+    argv = ['--pool', 'auto', '--zero-cost-only']
+    for flag in ('discovery-out', 'catalog-out', 'report-out', 'preflight-out'):
+        argv.extend(['--' + flag, str(tmp_path / (flag + '.json'))])
+    if only_priced:
+        with pytest.raises(SystemExit, match='no eligible models; orchestrator/auto'):
+            main(argv)
+        assert not observed['preflight'] and not observed['served']
+    else:
+        assert main(argv) == 0
+        assert [a['model'] for a in observed['served']] == [free.model_id]
+        report = json.loads((tmp_path / 'report-out.json').read_text())
+        assert report['requested_pool'] == 'orchestrator/auto'
+        assert report['zero_cost_only'] is True
+        assert report['priced_selected_count'] == report['unknown_selected_count'] == 0
+
+
+@pytest.mark.parametrize('private_target', [False, True])
+def test_fenced_auto_rejects_primary_failure_without_priced_fallback(
+    tmp_path, monkeypatch, private_target,
+):
+    """Execute real launcher preflight/policy with controlled provider calls."""
+    from scripts.ci import contextual_orchestrator_review_launcher as launcher
+    from tests.test_contextual_orchestrator_review_launcher import (
+        _discovered_model, _install_owner_runtime, _launcher_arguments,
+    )
+    free = _discovered_model()
+    priced = _discovered_model(
+        provider_name='openai', model_id='gpt-priced', agent_id='openai_priced',
+        credential_name='OPENAI_API_KEY', prompt_price=1.0, completion_price=2.0,
+    )
+    state = _install_owner_runtime(
+        monkeypatch, discovered_models=[free, priced],
+        registered_credentials=['BYTEZ_API_KEY', 'OPENAI_API_KEY'],
+        failing_agent_ids=frozenset({'bytez_free'}),
+    )
+    extra = ['--pool', 'auto', '--zero-cost-only']
+    if private_target:
+        extra.append('--require-zdr')
+    from scripts.ci.contextual_orchestrator_review_policy import PolicyError
+    rejection = PolicyError if private_target else SystemExit
+    with pytest.raises(rejection):
+        launcher.main(_launcher_arguments(tmp_path, *extra))
+    assert not state.served_requests
+    catalog = tmp_path / 'catalog.json'
+    if catalog.exists():
+        agents = json.loads(catalog.read_text())['agents']
+        assert all(a['model'] != 'gpt-priced' for a in agents)
+    assert not (tmp_path / 'catalog.json.priced').exists()
diff --git a/tests/test_review_auto_route.py b/tests/test_review_auto_route.py
new file mode 100644
index 0000000000..c0ba439389
--- /dev/null
+++ b/tests/test_review_auto_route.py
@@ -0,0 +1,145 @@
+"""Execute source-only auto selection; never contact a provider or publish a review."""
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+
+import pytest
+
+from tests.test_agent_review_runtime_quality_consolidation import (
+    test_ghas_runtime_selector_executes_the_actual_shell as execute_runtime_selector,
+)
+
+ROOT = Path(__file__).resolve().parents[1]
+SIDECAR = ROOT / 'scripts/ci/contextual_orchestrator_review_sidecar.sh'
+
+
+def _strix_model_steps(source, root, requested):
+    """Execute only the two real model-selection shells without model calls."""
+    import textwrap
+
+    gate = source.split('      - name: Gate Strix secrets\n', 1)[1].split('      - name:', 1)[0]
+    default = re.search(r'^          STRIX_MODEL: (\S+)$', gate, re.M)
+    assert default is not None
+    output = root / 'output'
+    result = subprocess.run(
+        [shutil.which('bash'), '-eu', '-c', textwrap.dedent(gate.split('        run: |\n', 1)[1])],
+        env={'PATH': os.environ['PATH'], 'STRIX_MODEL': default[1],
+             'STRIX_MODEL_REQUESTED': requested, 'GITHUB_OUTPUT': str(output)},
+        capture_output=True, text=True, timeout=5,
+    )
+    if result.returncode:
+        return result.returncode, None, None
+    values = dict(line.split('=', 1) for line in output.read_text().splitlines())
+    primary = values['strix_model']
+    prepare = source.split('      - name: Prepare Strix model input file\n', 1)[1].split('      - name:', 1)[0]
+    result = subprocess.run(
+        [shutil.which('bash'), '-eu', '-c', textwrap.dedent(prepare.split('        run: |\n', 1)[1])],
+        env={'PATH': os.environ['PATH'], 'STRIX_MODEL': primary,
+             'RUNNER_TEMP': str(root), 'GITHUB_ENV': str(root / 'env')},
+        capture_output=True, text=True, timeout=5,
+    )
+    return result.returncode, primary, (root / 'strix_llm.txt').read_text() if not result.returncode else None
+
+
+def _require_exact_strix_auto(result):
+    """Neither primary output nor scanner input may fall back to free."""
+    assert result == (0, 'auto', 'auto'), result
+
+
+@pytest.mark.parametrize('requested', ['', 'auto', 'orchestrator/auto', 'contextual-orchestrator/orchestrator/auto'])
+def test_strix_primary_and_scanner_input_are_literal_auto(requested, tmp_path):
+    source = (ROOT / '.github/workflows/strix.yml').read_text()
+    _require_exact_strix_auto(_strix_model_steps(source, tmp_path, requested))
+
+
+@pytest.mark.parametrize('requested', ['free', 'orchestrator/free', 'contextual-orchestrator/orchestrator/free', 'external/unsafe'])
+def test_strix_rejects_free_and_direct_override(requested, tmp_path):
+    source = (ROOT / '.github/workflows/strix.yml').read_text()
+    assert _strix_model_steps(source, tmp_path, requested)[0] != 0
+
+
+@pytest.mark.parametrize('position', ['primary', 'scanner'])
+def test_strix_auto_oracle_rejects_free_fallback(position, tmp_path):
+    """Run an otherwise-valid source with one actual output changed to free."""
+    source = (ROOT / '.github/workflows/strix.yml').read_text()
+    if position == 'primary':
+        before, after = 'echo "strix_model=$strix_model"', 'echo "strix_model=free"'
+    else:
+        before, after = "printf '%s' 'auto' > \"$strix_llm_file\"", "printf '%s' 'free' > \"$strix_llm_file\""
+    assert source.count(before) == 1
+    mutated = source.replace(before, after, 1)
+    result = _strix_model_steps(mutated, tmp_path, '')
+    with pytest.raises(AssertionError):
+        _require_exact_strix_auto(result)
+
+
+def test_sidecar_accepts_auto_with_zero_cost_fence():
+    text = SIDECAR.read_text()
+    start = text.index('orchestrator_pool=')
+    body = text[start:text.index('\nlog "starting review sidecar', start)]
+    result = subprocess.run([shutil.which('bash'), '-c',
+                             'fail() { exit 7; }; ' + body +
+                             '\nprintf "%s\\n" "${pool_args[@]}"'],
+                            env={'CONTEXTUAL_ORCHESTRATOR_POOL': 'auto'},
+                            capture_output=True, text=True, timeout=5)
+    assert result.returncode == 0, 'auto request rejected by source pool guard'
+    assert result.stdout.splitlines() == ['--pool', 'auto', '--zero-cost-only']
+
+
+def test_opencode_generated_primary_aux_reset_and_diagnosis_use_auto(tmp_path):
+    source = (ROOT / '.github/workflows/opencode-review-dispatch.yml').read_text()
+    # Execute the actual two jq expressions with an inert workspace; no workflow/API/model.
+    initial = re.search(r"jq -n '(\{\n.*?\n          \})' >\"\$\{OPENCODE_REVIEW_WORKDIR\}/opencode.jsonc\"", source, re.S)
+    assert initial
+    reset = re.search(r"gateway_config=.*?\n          jq '(.*?)' \"\$\{OPENCODE_REVIEW_WORKDIR\}/opencode.jsonc\"", source, re.S)
+    assert reset
+    jq = shutil.which('jq')
+    assert jq
+    first = subprocess.run([jq, '-n', initial[1]], capture_output=True, text=True, timeout=5)
+    assert first.returncode == 0
+    data = json.loads(first.stdout)
+    assert data['model'] == data['small_model'] == 'contextual-orchestrator/orchestrator/auto'
+    # Force conflicting preceding values; the real reset must restore both to auto.
+    data.update(model='external/unsafe', small_model='external/unsafe')
+    second = subprocess.run([jq, reset[1]], input=json.dumps(data), capture_output=True, text=True, timeout=5)
+    assert second.returncode == 0
+    data = json.loads(second.stdout)
+    assert data['model'] == data['small_model'] == 'contextual-orchestrator/orchestrator/auto'
+    assert set(data['provider']['contextual-orchestrator']['models']) == {'orchestrator/auto'}
+    assert 'OPENCODE_MODEL_CANDIDATES: "contextual-orchestrator/orchestrator/auto"' in source
+    assert 'MODEL: contextual-orchestrator/orchestrator/auto' in source
+
+
+def test_noema_and_opencode_sidecar_pool_match_model_alias():
+    for name in ('noema-review.yml', 'opencode-review-dispatch.yml'):
+        source = (ROOT / '.github/workflows' / name).read_text()
+        provision = source.split('      - name: Provision contextual-orchestrator review sidecar\n', 1)[1]
+        provision = provision.split('      - name:', 1)[0]
+        assert re.search(r'^          CONTEXTUAL_ORCHESTRATOR_POOL: auto$', provision, re.M)
+    assert 'export NOEMA_LLM_MODEL="orchestrator/auto"' in (ROOT / '.github/workflows/noema-review.yml').read_text()
+
+
+def test_tracked_opencode_defaults_do_not_restore_free():
+    source = (ROOT / 'opencode.jsonc').read_text()
+    config = json.loads('\n'.join(line for line in source.splitlines() if not line.lstrip().startswith('//')))
+    assert config['model'] == config['small_model'] == 'contextual-orchestrator/orchestrator/auto'
+    assert 'orchestrator/auto' in config['provider']['contextual-orchestrator']['models']
+
+
+@pytest.mark.parametrize('path', [
+    'tests/test_review_auto_route.py',
+    'tests/test_review_auto_cost_admission.py',
+    'tests/test_review_ai_app_independence.py',
+])
+def test_auto_new_regressions_reach_existing_quality_selector_and_command(path, tmp_path):
+    source = (ROOT / '.github/workflows/agent-review-runtime-quality-ci.yml').read_text()
+    trigger = source.split('on:\n', 1)[1].split('\nconcurrency:', 1)[0]
+    assert f'      - "{path}"' in trigger
+    execute_runtime_selector(path, {'review_repair'}, tmp_path)
+    step = source.split('- name: Verify scheduler and contextual-orchestrator review-repair contracts', 1)[1]
+    script = step.split('        run: |\n', 1)[1].split('      - name:', 1)[0]
+    first_pytest = script.split('python -m interrogate', 1)[0]
+    assert path in first_pytest
diff --git a/tests/test_review_preflight_concurrency.py b/tests/test_review_preflight_concurrency.py
index 641c726a0e..cf161029a0 100644
--- a/tests/test_review_preflight_concurrency.py
+++ b/tests/test_review_preflight_concurrency.py
@@ -2,6 +2,7 @@
 
 import runpy
 import threading
+from io import BytesIO
 from pathlib import Path
 from types import SimpleNamespace
 from urllib.error import HTTPError
@@ -63,12 +64,17 @@ def test_unavailable_pool_fails_closed_within_the_probe_budget():
     """Concurrent completion does not enlarge the committed probe budget."""
     namespace = runpy.run_path(str(LAUNCHER))
     calls = []
+    provider_errors = []
 
     class Client:
         """Return explicit provider rate-limit responses."""
         def proxy_send_once(self, agent, endpoint, payload):
             calls.append(agent.id)
-            raise HTTPError('https://provider.invalid', 429, 'private body', {}, None)
+            provider_error = HTTPError(
+                'https://provider.invalid', 429, 'private body', {}, None
+            )
+            provider_errors.append(provider_error)
+            raise provider_error
 
     with pytest.raises(namespace['ReviewPreflightError']) as error:
         namespace['_preflight_review_agents_concurrently'](agents(24), client=Client())
@@ -77,6 +83,57 @@ def proxy_send_once(self, agent, endpoint, payload):
     assert report['ready_count'] == report['pending_count'] == 0
     assert all(row['status'] == 'rejected' and row['http_status'] == 429 for row in report['routes'])
     assert 'private body' not in str(report)
+    assert all(provider_error.closed for provider_error in provider_errors)
+
+
+def test_hostile_retry_after_is_rejected_and_http_error_is_closed():
+    """Unbounded optional telemetry cannot abort preflight or leak its response."""
+
+    namespace = runpy.run_path(str(LAUNCHER))
+    error_body = BytesIO(b"private body")
+    provider_error = HTTPError(
+        "https://provider.invalid",
+        429,
+        "private body",
+        {"Retry-After": "9" * 5000},
+        error_body,
+    )
+
+    class Client:
+        """Return one rate-limit response with hostile optional telemetry."""
+
+        def proxy_send_once(self, agent, endpoint, payload):
+            raise provider_error
+
+    with pytest.raises(namespace["ReviewPreflightError"]) as error:
+        namespace["_preflight_review_agents_concurrently"](agents(1), client=Client())
+
+    route = error.value.report["routes"][0]
+    assert route["status"] == "rejected"
+    assert route["http_status"] == 429
+    assert "retry_after_s" not in route
+    assert "private body" not in str(error.value.report)
+    assert error_body.closed
+
+
+def test_http_error_is_closed_when_optional_telemetry_raises():
+    """Cleanup remains mandatory if later telemetry classification regresses."""
+    namespace = runpy.run_path(str(LAUNCHER))
+    error_body = BytesIO(b"private body")
+    provider_error = HTTPError(
+        "https://provider.invalid", 503, "private body", {}, error_body
+    )
+
+    def broken_telemetry(exc):
+        raise ValueError("telemetry parser failed")
+
+    record_exception = namespace["_record_provider_exception"]
+    record_exception.__globals__["_safe_retry_after_seconds"] = broken_telemetry
+
+    with pytest.raises(ValueError, match="telemetry parser failed"):
+        record_exception({}, provider_error)
+
+    assert error_body.closed
 
 
 def test_parallel_escalations_share_one_budget():
diff --git a/tests/test_runner_fallback_checker_sensitivity.py b/tests/test_runner_fallback_checker_sensitivity.py
new file mode 100644
index 0000000000..c580c21fc2
--- /dev/null
+++ b/tests/test_runner_fallback_checker_sensitivity.py
@@ -0,0 +1,126 @@
+"""Exercise the retained fallback checker with valid and reversed routing."""
+import json
+from pathlib import Path
+import pytest
+import yaml
+from tests.test_all_self_hosted_runner_contract import test_isolated_fallback_never_selects_privileged_group as check_fallback
+from tests.test_all_self_hosted_runner_contract import test_nonprivileged_runners_require_isolated_label as check_static
+
+ISOLATED = {'group':'CWL CI isolated','labels':['self-hosted','linux','x64','cwlab-ci-isolated']}
+CONTROL = {'group':'CWL central control','labels':['self-hosted','linux','x64']}
+
+
+def install_fixture(tmp_path, monkeypatch, typed, suffix, unsafe):
+    first, fallback = (ISOLATED, CONTROL) if unsafe else (CONTROL, ISOLATED)
+    expression = "github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/example.yml@refs/heads/main' && fromJSON('" + json.dumps(first,separators=(',',':')) + "') || fromJSON('" + json.dumps(fallback,separators=(',',':')) + "')"
+    selector = {'group':'${{ ('+expression+').group }}','labels':'${{ ('+expression+').labels }}'} if typed else '${{ '+expression+' }}'
+    workflows = tmp_path/'.github/workflows'
+    workflows.mkdir(parents=True)
+    (workflows/f'example.{suffix}').write_text(yaml.safe_dump({'jobs':{f'job{n}':{'runs-on':selector} for n in range(29)}}, width=10000))
+    monkeypatch.chdir(tmp_path)
+
+
+@pytest.mark.parametrize('typed',[False,True])
+@pytest.mark.parametrize('suffix',['yml','yaml'])
+def test_checker_rejects_privileged_fallback(tmp_path,monkeypatch,typed,suffix):
+    install_fixture(tmp_path,monkeypatch,typed,suffix,True)
+    with pytest.raises(AssertionError):
+        check_fallback()
+
+
+@pytest.mark.parametrize('typed',[False,True])
+@pytest.mark.parametrize('suffix',['yml','yaml'])
+def test_checker_accepts_same_shape_isolated_fallback(tmp_path,monkeypatch,typed,suffix):
+    install_fixture(tmp_path,monkeypatch,typed,suffix,False)
+    check_fallback()
+
+
+def test_checker_refuses_empty_conditional_inventory(tmp_path, monkeypatch):
+    workflows = tmp_path/'.github/workflows'
+    workflows.mkdir(parents=True)
+    (workflows/'example.yaml').write_text(yaml.safe_dump({'jobs':{'job':{'runs-on':ISOLATED}}}))
+    monkeypatch.chdir(tmp_path)
+    with pytest.raises(AssertionError, match='coverage'):
+        check_fallback()
+
+
+def test_checker_rejects_privileged_group_even_with_isolation_label(tmp_path, monkeypatch):
+    install_fixture(tmp_path,monkeypatch,True,'yaml',False)
+    path = tmp_path/'.github/workflows/example.yaml'
+    text = path.read_text()
+    path.write_text(text.replace('CWL CI isolated', 'CWL central control'))
+    with pytest.raises(AssertionError, match='unsafe fallback'):
+        check_fallback()
+
+
+def test_checker_exceptions_are_not_counted_as_rejection(tmp_path, monkeypatch):
+    install_fixture(tmp_path,monkeypatch,True,'yaml',True)
+    def broken_parser(*args):
+        raise RuntimeError('fixture parser failure')
+    monkeypatch.setattr(yaml, 'safe_load', broken_parser)
+    with pytest.raises(RuntimeError, match='fixture parser failure'):
+        check_fallback()
+
+
+def install_static_fixture(tmp_path, monkeypatch, suffix, labels, group='CWL CI isolated', block=False):
+    """Write an ordinary selector as actual YAML with a nonstandard valid indent."""
+    workflows = tmp_path / '.github/workflows'
+    workflows.mkdir(parents=True)
+    selector = {'group': group, 'labels': labels}
+    document = {'jobs': {'ordinary': {'runs-on': selector}}}
+    (workflows / f'ordinary.{suffix}').write_text(
+        yaml.safe_dump(document, default_flow_style=not block, indent=4),
+    )
+    monkeypatch.chdir(tmp_path)
+
+
+@pytest.mark.parametrize('suffix', ['yml', 'yaml'])
+@pytest.mark.parametrize('block', [False, True])
+@pytest.mark.parametrize('missing', ['self-hosted', 'linux', 'x64', 'cwlab-ci-isolated'])
+def test_static_checker_rejects_each_missing_required_label(tmp_path, monkeypatch, suffix, block, missing):
+    """The same isolated group must not hide any missing required label."""
+    labels = [label for label in ISOLATED['labels'] if label != missing]
+    install_static_fixture(tmp_path, monkeypatch, suffix, labels, block=block)
+    with pytest.raises(AssertionError):
+        check_static()
+
+
+@pytest.mark.parametrize('suffix', ['yml', 'yaml'])
+@pytest.mark.parametrize('block', [False, True])
+def test_static_checker_accepts_intact_isolated_mapping(tmp_path, monkeypatch, suffix, block):
+    """Accept the exact positive through the same parser and ordinary-job gate."""
+    install_static_fixture(tmp_path, monkeypatch, suffix, list(ISOLATED['labels']), block=block)
+    check_static()
+
+
+@pytest.mark.parametrize('suffix', ['yml', 'yaml'])
+@pytest.mark.parametrize('group', ['CWL central control', 'CWL central CodeQL', 'CWL central OpenCode'])
+def test_static_checker_preserves_existing_dedicated_groups(tmp_path, monkeypatch, suffix, group):
+    """Retain the existing dedicated static exceptions without an isolation label."""
+    install_static_fixture(tmp_path, monkeypatch, suffix, list(CONTROL['labels']), group=group)
+    check_static()
+
+
+@pytest.mark.parametrize('suffix', ['yml', 'yaml'])
+@pytest.mark.parametrize('labels', [None, 'self-hosted linux x64 cwlab-ci-isolated', ['self-hosted', 'linux', 'x64', 'cwlab-ci-isolated', None]])
+def test_static_checker_rejects_malformed_label_shapes(tmp_path, monkeypatch, suffix, labels):
+    """A substring or malformed list must not substitute for typed label data."""
+    install_static_fixture(tmp_path, monkeypatch, suffix, labels)
+    with pytest.raises(AssertionError, match='static labels'):
+        check_static()
+
+
+@pytest.mark.parametrize('suffix', ['yml', 'yaml'])
+def test_static_checker_requires_exact_group_name(tmp_path, monkeypatch, suffix):
+    """Reject a group that only contains the required group name as a substring."""
+    install_static_fixture(tmp_path, monkeypatch, suffix, list(ISOLATED['labels']), group='CWL CI isolated extra')
+    with pytest.raises(AssertionError, match='unsupported static group'):
+        check_static()
+
+
+def test_static_checker_requires_nonempty_inventory(tmp_path, monkeypatch):
+    """An empty workflow population is not proof of ordinary runner admission."""
+    (tmp_path / '.github/workflows').mkdir(parents=True)
+    monkeypatch.chdir(tmp_path)
+    with pytest.raises(AssertionError, match='coverage is empty'):
+        check_static()
diff --git a/tests/test_runner_mapping_schema_contract.py b/tests/test_runner_mapping_schema_contract.py
new file mode 100644
index 0000000000..15a7343d07
--- /dev/null
+++ b/tests/test_runner_mapping_schema_contract.py
@@ -0,0 +1,24 @@
+"""Require typed group/label fields instead of object-valued runs-on expressions."""
+from pathlib import Path
+import re
+import yaml
+
+
+def test_dynamic_group_routing_uses_explicit_yaml_mapping() -> None:
+    observed = 0
+    paths = sorted(set(Path('.github/workflows').glob('*.yml')) | set(Path('.github/workflows').glob('*.yaml')))
+    for path in paths:
+        jobs = yaml.safe_load(path.read_text())['jobs']
+        for job_id, job in jobs.items():
+            runner = job.get('runs-on')
+            if isinstance(runner, str) and '"group":' in runner:
+                raise AssertionError(f'{path}:{job_id}: object-valued expression is not a typed runner mapping')
+            if isinstance(runner, dict) and str(runner.get('group', '')).startswith('${{ ('):
+                observed += 1
+                group = runner['group']
+                labels = runner['labels']
+                assert group.endswith(').group }}'), (path, job_id, group)
+                assert labels.endswith(').labels }}'), (path, job_id, labels)
+                assert group.removesuffix(').group }}') == labels.removesuffix(').labels }}'), (path, job_id)
+                assert 'CWL CI isolated' in group and 'cwlab-ci-isolated' in labels, (path, job_id)
+    assert observed == 29, observed
diff --git a/tests/test_rust_coverage_fixture_dependencies.py b/tests/test_rust_coverage_fixture_dependencies.py
new file mode 100644
index 0000000000..9e6caa5d22
--- /dev/null
+++ b/tests/test_rust_coverage_fixture_dependencies.py
@@ -0,0 +1,33 @@
+"""Security contracts for the offline Rust coverage dependency fixture."""
+
+from pathlib import Path
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # pragma: no cover - Python 3.10 compatibility
+    import tomli as tomllib
+
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+FIXTURE_ROOT = REPOSITORY_ROOT / "tests" / "fixtures" / "coverage-cargo"
+
+
+def test_coverage_fixture_uses_patched_pyo3_release() -> None:
+    """Keep the fixture manifest and lock on the reviewed PyO3 0.29.2 release."""
+    manifest = tomllib.loads(
+        (FIXTURE_ROOT / "Cargo.toml").read_text(encoding="utf-8")
+    )
+    cargo_lock = tomllib.loads(
+        (FIXTURE_ROOT / "Cargo.lock").read_text(encoding="utf-8")
+    )
+    pyo3_packages = [
+        package_entry
+        for package_entry in cargo_lock["package"]
+        if package_entry["name"] == "pyo3"
+    ]
+
+    assert manifest["dependencies"]["pyo3"]["version"] == "=0.29.2"
+    assert {package_entry["version"] for package_entry in pyo3_packages} == {
+        "0.29.2"
+    }
+    assert len(pyo3_packages) == 1
diff --git a/tests/test_sandboxed_web_e2e.py b/tests/test_sandboxed_web_e2e.py
index 1b1cdf3722..7db73bf436 100644
--- a/tests/test_sandboxed_web_e2e.py
+++ b/tests/test_sandboxed_web_e2e.py
@@ -6,6 +6,7 @@
 import socket
 import subprocess
 import sys
+from io import BytesIO
 from pathlib import Path
 
 import pytest
@@ -671,6 +672,7 @@ def test_no_redirect_handler_raises_httperror_without_following():
         sandboxed_web_e2e.NoRedirectHandler().redirect_request(request, None, 302, "Found", {}, "http://127.0.0.1")
 
     assert exc_info.value.code == 302
+    exc_info.value.close()
 
 
 def test_wait_for_url_returns_false_after_timeout(monkeypatch, tmp_path):
@@ -695,6 +697,43 @@ def open(self, url, timeout):
     assert sandboxed_web_e2e.wait_for_url("http://127.0.0.1:8000/health", 1, service) is False
 
 
+def test_wait_for_url_closes_redirect_response(monkeypatch, tmp_path):
+    """A rejected readiness redirect releases its file-like HTTP response."""
+
+    class RunningProcess:
+        def poll(self):
+            return None
+
+    ticks = iter([0, 0, 2])
+    error_body = BytesIO()
+    redirect_error = sandboxed_web_e2e.urllib.error.HTTPError(
+        "http://127.0.0.1:8000/health", 302, "Found", {}, error_body
+    )
+
+    class RedirectingOpener:
+        def open(self, url, timeout):
+            raise redirect_error
+
+    monkeypatch.setattr(sandboxed_web_e2e.time, "monotonic", lambda: next(ticks))
+    monkeypatch.setattr(sandboxed_web_e2e.time, "sleep", lambda seconds: None)
+    monkeypatch.setattr(
+        sandboxed_web_e2e.urllib.request,
+        "build_opener",
+        lambda *args: RedirectingOpener(),
+    )
+    service = sandboxed_web_e2e.Service(
+        "web", "serve", RunningProcess(), tmp_path / "web.log"
+    )
+
+    assert (
+        sandboxed_web_e2e.wait_for_url(
+            "http://127.0.0.1:8000/health", 1, service
+        )
+        is False
+    )
+    assert error_body.closed
+
+
 def test_main_runs_with_stubbed_services(monkeypatch, tmp_path, capsys):
     """Main records success evidence without requiring real POSIX services."""
     repo = tmp_path / "repo"
@@ -1571,7 +1610,21 @@ def test_isolated_command_rejects_executable_outside_bound_roots(monkeypatch, tm
         )
 
 
-def test_isolated_command_resolves_repo_local_launcher_against_sandboxed_cwd(monkeypatch, tmp_path):
+@pytest.fixture
+def isolated_host_home(monkeypatch, tmp_path):
+    """Separate synthetic host home from scratch without relaxing production denial.
+
+    TMPDIR may legitimately live under the caller's home on macOS. These
+    path-resolution fixtures model a workspace outside the denied host home;
+    the separate host-home rejection test continues to use the real home.
+    """
+    home = tmp_path / "host-home"
+    home.mkdir()
+    monkeypatch.setattr(Path, "home", classmethod(lambda cls: home))
+    return home
+
+
+def test_isolated_command_resolves_repo_local_launcher_against_sandboxed_cwd(monkeypatch, tmp_path, isolated_host_home):
     """A ./gradlew-style repository launcher resolves against the sandboxed cwd.
 
     ``shutil.which`` resolves any command string containing a path separator
@@ -1602,7 +1655,7 @@ def test_isolated_command_resolves_repo_local_launcher_against_sandboxed_cwd(mon
     assert command.endswith("./gradlew build")
 
 
-def test_isolated_command_resolves_bare_command_via_relative_path_entry(monkeypatch, tmp_path):
+def test_isolated_command_resolves_bare_command_via_relative_path_entry(monkeypatch, tmp_path, isolated_host_home):
     """A bare command resolves when PATH itself has a relative entry.
 
     ``shutil.which`` joins a relative ``PATH`` entry with the *calling
@@ -1635,7 +1688,7 @@ def test_isolated_command_resolves_bare_command_via_relative_path_entry(monkeypa
     assert command.endswith("tool")
 
 
-def test_isolated_command_translates_absolute_workspace_launcher_to_sandbox_mount(monkeypatch, tmp_path):
+def test_isolated_command_translates_absolute_workspace_launcher_to_sandbox_mount(monkeypatch, tmp_path, isolated_host_home):
     """An absolute copied-repo launcher path is rewritten to its /workspace equivalent.
 
     ``isolated_command`` binds ``sandbox_root`` at ``SANDBOX_MOUNT`` inside
@@ -1681,6 +1734,23 @@ def test_which_relative_to_cwd_returns_none_for_empty_path(tmp_path):
     assert result is None
 
 
+def test_isolated_command_rejects_explicit_host_home_even_inside_workspace(monkeypatch, tmp_path):
+    """An allowed scratch workspace cannot turn a host-home executable into code."""
+    monkeypatch.setattr(sandboxed_web_e2e.shutil, "which", lambda *_args, **_kwargs: None)
+    sandbox = tmp_path / "sandbox"
+    repo = sandbox / "repo"
+    repo.mkdir(parents=True)
+    launcher = repo / "launch.sh"
+    launcher.write_text("#!/bin/sh\nexit 0\n", encoding="utf-8")
+    launcher.chmod(0o755)
+    monkeypatch.setattr(Path, "home", classmethod(lambda cls: tmp_path))
+    with pytest.raises(RuntimeError, match="host home directory"):
+        sandboxed_web_e2e.isolated_command(
+            str(launcher), backend="/usr/bin/bwrap", cwd=repo,
+            sandbox_root=sandbox, env={"PATH": "/usr/bin"},
+        )
+
+
 def test_isolated_command_rejects_relative_path_entry_escaping_sandbox(monkeypatch, tmp_path):
     """A relative PATH entry cannot be used to search the real host filesystem outside the copy.
 
@@ -1704,7 +1774,7 @@ def test_isolated_command_rejects_relative_path_entry_escaping_sandbox(monkeypat
         )
 
 
-def test_isolated_command_rejects_repo_local_path_traversal(monkeypatch, tmp_path):
+def test_isolated_command_rejects_repo_local_path_traversal(monkeypatch, tmp_path, isolated_host_home):
     """A repo-local launcher path that lexically escapes the sandbox root is still rejected."""
     monkeypatch.setattr(sandboxed_web_e2e.shutil, "which", lambda *_args, **_kwargs: None)
     sandbox = tmp_path / "sandbox"
@@ -1724,7 +1794,7 @@ def test_isolated_command_rejects_repo_local_path_traversal(monkeypatch, tmp_pat
         )
 
 
-def test_isolated_command_rejects_explicit_external_path(monkeypatch, tmp_path):
+def test_isolated_command_rejects_explicit_external_path(monkeypatch, tmp_path, isolated_host_home):
     """An explicit absolute path outside the workspace and bind roots is still rejected."""
     monkeypatch.setattr(sandboxed_web_e2e.shutil, "which", lambda *_args, **_kwargs: None)
     sandbox = tmp_path / "sandbox"
diff --git a/tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py b/tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py
index 42efce621e..dda5761619 100644
--- a/tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py
+++ b/tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py
@@ -27,20 +27,21 @@ class SchedulerAndCodeqlDispatchRunnerImageContract(unittest.TestCase):
     """Keep these central callers/dispatchers off the observed starved image."""
 
     def assert_explicit_supported_image(self, path: Path) -> None:
-        """Require every job runner declaration to pin Ubuntu 24.04."""
+        """Require every ordinary job to use isolated self-hosted Linux runners."""
         workflow = path.read_text(encoding="utf-8")
         self.assertNotIn("runs-on: ubuntu-latest", workflow, path)
-        self.assertIn("runs-on: ubuntu-24.04", workflow, path)
+        self.assertIn("group: CWL CI isolated", workflow, path)
+        self.assertIn("labels: [self-hosted, linux, x64, cwlab-ci-isolated]", workflow, path)
 
     def test_pr_review_autofix_uses_explicit_supported_image(self) -> None:
-        """Require the PR Review Autofix job to use explicit Ubuntu 24.04."""
+        """Require the PR Review Autofix job to use isolated self-hosted Linux."""
         self.assert_explicit_supported_image(PR_REVIEW_AUTOFIX)
 
     def test_pr_review_fix_scheduler_uses_explicit_supported_image(self) -> None:
-        """Require the fix-scheduler's hosted fallback to pin Ubuntu 24.04."""
+        """Require the fix-scheduler's fallback to use isolated self-hosted Linux."""
         workflow = PR_REVIEW_FIX_SCHEDULER.read_text(encoding="utf-8")
         self.assertNotIn("ubuntu-latest", workflow)
-        self.assertIn("fromJSON('[\"ubuntu-24.04\"]')", workflow)
+        self.assertIn('fromJSON(\'{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}\')', workflow)
 
     def test_hourly_review_repair_uses_explicit_supported_image(self) -> None:
         """Require hourly control jobs to use the dedicated central group."""
@@ -49,12 +50,12 @@ def test_hourly_review_repair_uses_explicit_supported_image(self) -> None:
         self.assertIn("labels: [self-hosted, linux, x64]", workflow)
 
     def test_codeql_pr_uses_explicit_supported_image(self) -> None:
-        """Require trusted-main control routing and Ubuntu fallback for all three jobs."""
+        """Require trusted-main control routing and isolated fallback for all three jobs."""
         workflow = CODEQL_PR.read_text(encoding="utf-8")
         self.assertNotIn("runs-on: ubuntu-latest", workflow)
         selectors = [
             line.strip() for line in workflow.splitlines()
-            if line.strip().startswith("runs-on:")
+            if line.startswith("      group:")
         ]
         self.assertEqual(len(selectors), 3)
         for selector in selectors:
@@ -64,7 +65,7 @@ def test_codeql_pr_uses_explicit_supported_image(self) -> None:
             )
             self.assertIn('"group":"CWL central control"', selector)
             self.assertIn('"labels":["self-hosted","linux","x64"]', selector)
-            self.assertIn("|| '\"ubuntu-24.04\"'", selector)
+            self.assertIn("|| '{\"group\":\"CWL CI isolated\",\"labels\":[\"self-hosted\",\"linux\",\"x64\",\"cwlab-ci-isolated\"]}'", selector)
 
     def test_codeql_scan_dispatch_uses_explicit_supported_image(self) -> None:
         """Require validation, scan, and attempt wake jobs in the dedicated group."""
@@ -74,10 +75,11 @@ def test_codeql_scan_dispatch_uses_explicit_supported_image(self) -> None:
         self.assertEqual(workflow.count("labels: [self-hosted, linux, x64]"), 3)
 
     def test_python_security_uses_explicit_supported_image(self) -> None:
-        """Require all three Python Security jobs to pin Ubuntu 24.04."""
+        """Require all three Python Security jobs to select isolated self-hosted Linux."""
         workflow = PYTHON_SECURITY.read_text(encoding="utf-8")
         self.assertNotIn("runs-on: ubuntu-latest", workflow)
-        self.assertEqual(workflow.count("runs-on: ubuntu-24.04"), 3)
+        self.assertEqual(workflow.count("group: CWL CI isolated"), 3)
+        self.assertEqual(workflow.count("labels: [self-hosted, linux, x64, cwlab-ci-isolated]"), 3)
 
 
 if __name__ == "__main__":
diff --git a/tests/test_spdx_license_policy.py b/tests/test_spdx_license_policy.py
index 53bee3ec72..072d93f29d 100644
--- a/tests/test_spdx_license_policy.py
+++ b/tests/test_spdx_license_policy.py
@@ -131,6 +131,18 @@ def test_dual_license_selection_needs_a_rationale() -> None:
     assert (decision.allowed, decision.code) == (False, policy.LICENSE_SELECTION_INVALID)
 
 
+def test_dual_license_selection_must_be_valid_spdx() -> None:
+    """A rationale cannot make a malformed SPDX selection valid."""
+    decision = policy.evaluate_license_expression(
+        "MIT OR GPL-2.0-only", selection="MIT AND", rationale="commercial choice"
+    )
+
+    assert (decision.allowed, decision.code) == (
+        False,
+        policy.LICENSE_SELECTION_INVALID,
+    )
+
+
 def test_selection_must_name_an_operand_of_the_expression() -> None:
     """A selection naming a license the dependency never offered is rejected."""
     decision = policy.evaluate_license_expression(
diff --git a/tests/test_strix_auto_consumer.py b/tests/test_strix_auto_consumer.py
new file mode 100644
index 0000000000..6207c6abcd
--- /dev/null
+++ b/tests/test_strix_auto_consumer.py
@@ -0,0 +1,96 @@
+"""Connected Strix auto routing; real shell helpers, no scanner or network."""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import subprocess
+
+import pytest
+
+from tests.test_strix_openai_fallback_api_base import _function_block
+
+ROOT = Path(__file__).resolve().parents[1]
+GATE = ROOT / "scripts/ci/strix_quick_gate.sh"
+UTILS = ROOT / "scripts/ci/strix_model_utils.sh"
+
+
+def _consume(tmp_path: Path, base: str | None, provider: str = "contextual_orchestrator") -> subprocess.CompletedProcess[str]:
+    """Execute normalize -> trusted API-base resolver -> actual child qualifier."""
+    gate = GATE.read_text(encoding="utf-8")
+    utils = UTILS.read_text(encoding="utf-8")
+    names = (
+        "is_vertex_model", "is_contextual_orchestrator_model",
+        "is_contextual_orchestrator_api_base", "is_github_models_model",
+        "is_github_models_api_base", "is_known_foreign_provider_api_base",
+        "is_github_models_api_compatible_model", "is_explicit_openai_model",
+        "resolve_trusted_input_file", "resolved_llm_api_base_for_model",
+        "child_model_for_api_base",
+    )
+    helpers = [_function_block(gate, name) for name in names]
+    helpers += [_function_block(utils, name) for name in (
+        "trim_whitespace", "sanitize_provider_name", "is_vertex_resource_path",
+        "extract_vertex_model_id", "normalize_model",
+    )]
+    env = {"PATH": os.environ["PATH"], "HOME": str(tmp_path),
+           "DEFAULT_PROVIDER": provider, "STRIX_INPUT_FILE_ROOT": str(tmp_path)}
+    if base is not None:
+        path = tmp_path / "base.txt"
+        path.write_text(base, encoding="utf-8")
+        env["LLM_API_BASE_FILE"] = str(path)
+    script = "\n".join([
+        "set -euo pipefail", *helpers,
+        'model=$(normalize_model auto)',
+        'printf "normalized=%s\\n" "$model"',
+        'base=$(resolved_llm_api_base_for_model "$model")',
+        'printf "base=%s\\n" "$base"',
+        'child=$(child_model_for_api_base "$model" "$base")',
+        'printf "child=%s\\n" "$child"',
+    ])
+    return subprocess.run(["bash", "-c", script], env=env, capture_output=True,
+                          text=True, timeout=10)
+
+
+def test_workflow_auto_reaches_child_as_exact_auto(tmp_path: Path) -> None:
+    result = _consume(tmp_path, "http://127.0.0.1:18080/v1")
+    assert result.returncode == 0, result.stderr
+    assert result.stdout.splitlines() == [
+        "normalized=auto",
+        "base=http://127.0.0.1:18080/v1", "child=openai/auto",
+    ]
+    # openai/ is the LiteLLM connector prefix, not part of the gateway model ID.
+    child = result.stdout.splitlines()[-1].removeprefix("child=")
+    assert child.removeprefix("openai/") == "auto"
+    assert "free" not in result.stdout
+
+
+@pytest.mark.parametrize("base", [None, "", "http://127.0.0.1:18081/v1",
+                                     "http://localhost:18080/v1", "https://example.com/v1"])
+def test_auto_cannot_escape_pinned_gateway(tmp_path: Path, base: str | None) -> None:
+    result = _consume(tmp_path, base)
+    assert result.returncode == 2, (result.stdout, result.stderr)
+    assert "child=" not in result.stdout
+
+
+@pytest.mark.parametrize("provider", ["", "vertex_ai", "openai"])
+def test_auto_requires_explicit_gateway_provider(tmp_path: Path, provider: str) -> None:
+    result = _consume(tmp_path, "http://127.0.0.1:18080/v1", provider)
+    assert result.returncode == 2, (result.stdout, result.stderr)
+    assert "normalized=" not in result.stdout
+    assert "child=" not in result.stdout
+
+
+def test_required_smoke_admits_repaired_literal_auto() -> None:
+    result = subprocess.run(
+        ["bash", str(ROOT / "scripts/ci/strix_required_workflow_smoke.sh")],
+        cwd=ROOT, env={"PATH": os.environ["PATH"]},
+        capture_output=True, text=True, timeout=20,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+
+
+def test_strix_sidecar_pool_matches_auto_consumer() -> None:
+    workflow = (ROOT / ".github/workflows/strix.yml").read_text(encoding="utf-8")
+    step = workflow.split("      - name: Provision contextual-orchestrator Strix sidecar\n", 1)[1].split("      - name:", 1)[0]
+    assert "          CONTEXTUAL_ORCHESTRATOR_POOL: auto\n" in step
+    assert "CONTEXTUAL_ORCHESTRATOR_POOL: free" not in step
+    assert "CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR:" in step
diff --git a/tests/test_strix_contextual_orchestrator_contract.py b/tests/test_strix_contextual_orchestrator_contract.py
index 52763ecc88..52bf617a58 100644
--- a/tests/test_strix_contextual_orchestrator_contract.py
+++ b/tests/test_strix_contextual_orchestrator_contract.py
@@ -24,9 +24,10 @@ def setUp(self) -> None:
         self.smoke = SMOKE.read_text(encoding="utf-8")
 
     def test_default_scan_provisions_the_existing_gateway_sidecar(self) -> None:
-        """Every scan uses the five-provider gateway, never a direct pool."""
+        """Every scan uses literal auto through the gateway, never a direct pool."""
         self.assertIn("Provision contextual-orchestrator Strix sidecar", self.workflow)
-        self.assertIn("STRIX_MODEL: contextual-orchestrator/orchestrator/free", self.workflow)
+        self.assertIn("STRIX_MODEL: auto", self.workflow)
+        self.assertIn("CONTEXTUAL_ORCHESTRATOR_POOL: auto", self.workflow)
         self.assertIn("provider_mode=contextual_orchestrator", self.workflow)
         self.assertIn("STRIX_FALLBACK_MODELS: \"\"", self.workflow)
         self.assertNotIn(
@@ -48,7 +49,7 @@ def test_model_override_cannot_escape_the_gateway(self) -> None:
         """A dispatch payload cannot select a direct provider route."""
         self.assertIn("github.event.client_payload.strix_llm", self.workflow)
         self.assertIn(
-            "Strix model overrides are limited to contextual-orchestrator/orchestrator/free",
+            "Strix model overrides must select literal auto",
             self.workflow,
         )
         for direct_route in ("nvidia_nim/*)", "openrouter/free", "openai-direct/gpt-5.4"):
@@ -75,7 +76,7 @@ def test_required_smoke_pins_the_gateway_default(self) -> None:
         self.assertIn("contextual-orchestrator Strix sidecar", self.smoke)
         self.assertIn("active_strix_models=", self.smoke)
         self.assertIn(
-            '"$active_strix_models" = "contextual-orchestrator/orchestrator/free"',
+            '"$active_strix_models" = "auto"',
             self.smoke,
         )
         self.assertIn("Strix does not resolve a direct provider outside the gateway", self.smoke)
diff --git a/tests/test_strix_nvidia_nim_not_found_fallback.py b/tests/test_strix_nvidia_nim_not_found_fallback.py
index ba8344455b..7a4d2dbb7d 100644
--- a/tests/test_strix_nvidia_nim_not_found_fallback.py
+++ b/tests/test_strix_nvidia_nim_not_found_fallback.py
@@ -190,7 +190,7 @@ def test_workflow_routes_all_scans_through_contextual_orchestrator(self) -> None
 
         workflow = STRIX_WORKFLOW.read_text(encoding="utf-8")
         self.assertIn("Provision contextual-orchestrator Strix sidecar", workflow)
-        self.assertIn("STRIX_MODEL: contextual-orchestrator/orchestrator/free", workflow)
+        self.assertIn("STRIX_MODEL: auto", workflow)
         self.assertIn("provider_mode=contextual_orchestrator", workflow)
         self.assertIn("STRIX_LLM_DEFAULT_PROVIDER: contextual_orchestrator", workflow)
         self.assertNotIn("Resolve live NVIDIA NIM Strix models", workflow)
@@ -201,7 +201,7 @@ def test_workflow_rejects_non_gateway_model_overrides(self) -> None:
 
         workflow = STRIX_WORKFLOW.read_text(encoding="utf-8")
         self.assertIn("STRIX_MODEL_REQUESTED", workflow)
-        self.assertIn("Strix model overrides are limited to contextual-orchestrator/orchestrator/free.", workflow)
+        self.assertIn("Strix model overrides must select literal auto; free and direct-provider routes are not admitted.", workflow)
         self.assertIn("STRIX_FALLBACK_MODELS: \"\"", workflow)
 
     def test_outer_workflow_requires_litellm_context_for_nvidia_404(self) -> None:
diff --git a/tests/test_strix_openai_fallback_api_base.py b/tests/test_strix_openai_fallback_api_base.py
index b5bf0cacb0..8063b2bcdb 100644
--- a/tests/test_strix_openai_fallback_api_base.py
+++ b/tests/test_strix_openai_fallback_api_base.py
@@ -326,13 +326,18 @@ def test_workflow_gateway_base_is_the_only_http_exception(self) -> None:
         )
         self.assertEqual(rc, 2)
 
-        # 2026-08-30: orchestrator/auto is no longer a recognized Strix gateway
-        # model (owner decision superseding ADR-0003's auto default) -- the
-        # gate must now reject it rather than resolve it, the same as any
-        # other unrecognized virtual pool.
-        rc, _ = _resolve_api_base(
+        # Literal auto now uses the same pinned origin as the retained legacy
+        # free routes; unrecognized virtual pools still fail closed.
+        rc, api_base = _resolve_api_base(
             {"LLM_API_BASE_FILE": "http://127.0.0.1:18080/v1"},
-            "orchestrator/auto",
+            "auto",
+        )
+        self.assertEqual(rc, 0)
+        self.assertEqual(api_base, "http://127.0.0.1:18080/v1")
+
+        rc, _ = _resolve_api_base(
+            {"LLM_API_BASE_FILE": "http://127.0.0.1:18081/v1"},
+            "auto",
         )
         self.assertEqual(rc, 2)
 
@@ -343,9 +348,10 @@ def test_workflow_gateway_base_is_the_only_http_exception(self) -> None:
         self.assertEqual(rc, 2)
 
     def test_gateway_child_model_preserves_selected_virtual_pool(self) -> None:
-        """LiteLLM qualification must not rewrite the selected free pool."""
+        """LiteLLM qualification preserves auto and standalone legacy free models."""
 
         expected_child_models = {
+            "auto": "openai/auto",
             "orchestrator/free": "openai/orchestrator/free",
             "contextual-orchestrator/orchestrator/free": "openai/orchestrator/free",
         }
diff --git a/tests/test_strix_report_scope.py b/tests/test_strix_report_scope.py
index 284b34e8d5..1a608cc864 100644
--- a/tests/test_strix_report_scope.py
+++ b/tests/test_strix_report_scope.py
@@ -1,32 +1,19 @@
 """A completed Strix report must name the PR source it assessed."""
 
+from __future__ import annotations
+
 import json
-import subprocess
+import runpy
 import sys
 from pathlib import Path
 
-SCRIPT = Path(__file__).resolve().parents[1] / "scripts/ci/strix_report_scope.py"
-
-
-def test_report_scope_rejects_unrelated_success_and_accepts_scoped_success(tmp_path: Path) -> None:
-    run = tmp_path / "current-scan"
-    run.mkdir()
-    (run / "run.json").write_text(
-        json.dumps({"status": "completed", "scan_results": {"scan_completed": True, "success": True}}),
-        encoding="utf-8",
-    )
-    report = run / "penetration_test_report.md"
-    report.write_text("Python OpenSSH client RCE vulnerability.\n", encoding="utf-8")
-    command = [sys.executable, str(SCRIPT), str(tmp_path), "python/fast_mlsirm/report.py"]
-    assert subprocess.run(command, capture_output=True).returncode == 1
+import pytest
 
-    report.write_text("Assessed python/fast_mlsirm/report.py; no vulnerabilities found.\n", encoding="utf-8")
-    assert subprocess.run(command, capture_output=True).returncode == 0
-    assert subprocess.run(command[:-1], capture_output=True).returncode == 1
+from scripts.ci import strix_report_scope as report_scope
 
 
-# Scope section of the 0-finding fast-mlsirm#2246 report (run 36580588738,
-# attempt 2): it names the PR-scope directories it audited, not a file.
+SCRIPT = Path(__file__).resolve().parents[1] / "scripts/ci/strix_report_scope.py"
+CHANGED_PATH = "python/fast_mlsirm/report.py"
 SCOPED_DIRECTORY_REPORT = """# Methodology
 
 **Scope:**
@@ -38,38 +25,220 @@ def test_report_scope_rejects_unrelated_success_and_accepts_scoped_success(tmp_p
 """
 
 
-def _completed_run(tmp_path: Path, report: str) -> None:
-    run = tmp_path / "current-scan"
-    run.mkdir()
-    (run / "run.json").write_text(
-        json.dumps({"status": "completed", "scan_results": {"scan_completed": True, "success": True}}),
-        encoding="utf-8",
+def _write_report(
+    output_dir: Path,
+    *,
+    metadata: object | None = None,
+    report_text: str = f"Assessed {CHANGED_PATH}; no vulnerabilities found.\n",
+) -> Path:
+    """Create one ordinary scan report and return its run directory."""
+    run_dir = output_dir / "current-scan"
+    run_dir.mkdir(parents=True, exist_ok=True)
+    if metadata is None:
+        metadata = {
+            "status": "completed",
+            "scan_results": {"scan_completed": True, "success": True},
+        }
+    (run_dir / "run.json").write_text(json.dumps(metadata), encoding="utf-8")
+    (run_dir / "penetration_test_report.md").write_text(
+        report_text, encoding="utf-8"
     )
-    (run / "penetration_test_report.md").write_text(report, encoding="utf-8")
+    return run_dir
 
 
-def test_scan_scope_directory_containing_a_changed_file_identifies_the_scope(tmp_path: Path) -> None:
-    _completed_run(tmp_path, SCOPED_DIRECTORY_REPORT)
-    changed = ["crates/mlsirm-core/src/gpu_regression.rs", "python/fast_mlsirm/regression.py"]
-    assert subprocess.run([sys.executable, str(SCRIPT), str(tmp_path), *changed], capture_output=True).returncode == 0
+def test_validate_accepts_only_a_completed_scoped_report(tmp_path: Path) -> None:
+    """A completed report naming a changed source path is accepted."""
+    _write_report(tmp_path)
+    report_scope.validate(tmp_path, [CHANGED_PATH])
 
 
-def test_scan_scope_directory_unrelated_to_changed_files_is_rejected(tmp_path: Path) -> None:
-    _completed_run(tmp_path, SCOPED_DIRECTORY_REPORT)
-    changed = ["docs/methods.md", "tests/test_regression.py"]
-    assert subprocess.run([sys.executable, str(SCRIPT), str(tmp_path), *changed], capture_output=True).returncode == 1
+def test_validate_rejects_missing_or_linked_output(tmp_path: Path) -> None:
+    """The trusted scan root must be a real directory."""
+    with pytest.raises(ValueError, match="output directory is missing"):
+        report_scope.validate(tmp_path / "missing", [CHANGED_PATH])
 
+    real_dir = tmp_path / "real"
+    real_dir.mkdir()
+    linked_dir = tmp_path / "linked"
+    linked_dir.symlink_to(real_dir, target_is_directory=True)
+    with pytest.raises(ValueError, match="output directory is missing"):
+        report_scope.validate(linked_dir, [CHANGED_PATH])
 
-def test_bare_repository_directory_or_scope_root_is_not_enough(tmp_path: Path) -> None:
-    changed = ["crates/mlsirm-core/src/gpu_regression.rs"]
-    _completed_run(tmp_path, "Audited crates/mlsirm-core; nothing found.\n")
-    assert subprocess.run([sys.executable, str(SCRIPT), str(tmp_path), *changed], capture_output=True).returncode == 1
-    (tmp_path / "current-scan" / "penetration_test_report.md").write_text(
-        "Scope: `/workspace/strix-pr-scope.AoFHD6/`; nothing found.\n", encoding="utf-8"
-    )
-    assert subprocess.run([sys.executable, str(SCRIPT), str(tmp_path), *changed], capture_output=True).returncode == 1
-    # A repository-root equivalent under the scope root binds nothing either.
-    (tmp_path / "current-scan" / "penetration_test_report.md").write_text(
-        "Scope: `/workspace/strix-pr-scope.AoFHD6/.`; nothing found.\n", encoding="utf-8"
+
+def test_validate_requires_exactly_one_real_run_directory(tmp_path: Path) -> None:
+    """Files and linked directories never count as the single current run."""
+    output_dir = tmp_path / "output"
+    output_dir.mkdir()
+    (output_dir / "noise.txt").write_text("ignored", encoding="utf-8")
+    linked_target = tmp_path / "linked-target"
+    linked_target.mkdir()
+    (output_dir / "linked-run").symlink_to(
+        linked_target, target_is_directory=True
     )
-    assert subprocess.run([sys.executable, str(SCRIPT), str(tmp_path), *changed], capture_output=True).returncode == 1
+    with pytest.raises(ValueError, match="exactly one current scan report"):
+        report_scope.validate(output_dir, [CHANGED_PATH])
+
+    _write_report(output_dir)
+    (output_dir / "second-run").mkdir()
+    with pytest.raises(ValueError, match="exactly one current scan report"):
+        report_scope.validate(output_dir, [CHANGED_PATH])
+
+
+@pytest.mark.parametrize("linked_name", ["run.json", "penetration_test_report.md"])
+def test_validate_rejects_missing_or_linked_report_files(
+    tmp_path: Path, linked_name: str
+) -> None:
+    """Neither report input may be absent or redirected through a symlink."""
+    run_dir = _write_report(tmp_path)
+    target = run_dir / linked_name
+    target.unlink()
+    with pytest.raises(ValueError, match="report files are missing or linked"):
+        report_scope.validate(tmp_path, [CHANGED_PATH])
+
+    outside = tmp_path / f"outside-{linked_name}"
+    outside.write_text("{}" if linked_name == "run.json" else CHANGED_PATH)
+    target.symlink_to(outside)
+    with pytest.raises(ValueError, match="report files are missing or linked"):
+        report_scope.validate(tmp_path, [CHANGED_PATH])
+
+
+@pytest.mark.parametrize(
+    ("metadata", "expected_error"),
+    [
+        ([], "metadata is not an object"),
+        (
+            {"status": "completed", "scan_results": ["invalid"]},
+            "results are not an object",
+        ),
+        (
+            {
+                "status": "running",
+                "scan_results": {"scan_completed": True, "success": True},
+            },
+            "report is incomplete",
+        ),
+        (
+            {
+                "status": "completed",
+                "scan_results": {"scan_completed": False, "success": True},
+            },
+            "report is incomplete",
+        ),
+        (
+            {
+                "status": "completed",
+                "scan_results": {"scan_completed": True, "success": False},
+            },
+            "report is incomplete",
+        ),
+    ],
+)
+def test_validate_rejects_malformed_or_incomplete_metadata(
+    tmp_path: Path, metadata: object, expected_error: str
+) -> None:
+    """Metadata shape and every completion signal fail closed."""
+    _write_report(tmp_path, metadata=metadata)
+    with pytest.raises(ValueError, match=expected_error):
+        report_scope.validate(tmp_path, [CHANGED_PATH])
+
+
+def test_validate_rejects_malformed_json_and_unrelated_scope(tmp_path: Path) -> None:
+    """Unreadable metadata and a report unrelated to the diff never pass."""
+    run_dir = _write_report(tmp_path)
+    (run_dir / "run.json").write_text("{not-json", encoding="utf-8")
+    with pytest.raises(json.JSONDecodeError):
+        report_scope.validate(tmp_path, [CHANGED_PATH])
+
+    _write_report(tmp_path, report_text="Python OpenSSH client RCE vulnerability.\n")
+    with pytest.raises(ValueError, match="does not identify a changed source file"):
+        report_scope.validate(tmp_path, [CHANGED_PATH])
+
+
+def test_scan_scope_directory_containing_a_changed_file_is_accepted(
+    tmp_path: Path,
+) -> None:
+    """A reviewed scope directory binds changed files beneath that directory."""
+    _write_report(tmp_path, report_text=SCOPED_DIRECTORY_REPORT)
+    changed_paths = [
+        "crates/mlsirm-core/src/gpu_regression.rs",
+        "python/fast_mlsirm/regression.py",
+    ]
+    report_scope.validate(tmp_path, changed_paths)
+
+
+def test_scan_scope_directory_unrelated_to_changed_files_is_rejected(
+    tmp_path: Path,
+) -> None:
+    """A directory scope cannot authorize unrelated changed paths."""
+    _write_report(tmp_path, report_text=SCOPED_DIRECTORY_REPORT)
+    with pytest.raises(ValueError, match="does not identify a changed source file"):
+        report_scope.validate(tmp_path, ["docs/methods.md", "tests/test_regression.py"])
+
+
+@pytest.mark.parametrize(
+    "report_text",
+    [
+        "Audited crates/mlsirm-core; nothing found.\n",
+        "Scope: `/workspace/strix-pr-scope.AoFHD6/`; nothing found.\n",
+        "Scope: `/workspace/strix-pr-scope.AoFHD6/.`; nothing found.\n",
+    ],
+)
+def test_bare_repository_directory_or_scope_root_is_rejected(
+    tmp_path: Path, report_text: str
+) -> None:
+    """Bare directory prose and repository roots bind no changed file."""
+    _write_report(tmp_path, report_text=report_text)
+    with pytest.raises(ValueError, match="does not identify a changed source file"):
+        report_scope.validate(
+            tmp_path, ["crates/mlsirm-core/src/gpu_regression.rs"]
+        )
+
+
+@pytest.mark.parametrize("report_text", [
+    "Assessed `python/fast_mlsirm/report.py@backup`; no findings.",
+    "Assessed `python/fast_mlsirm/report.py追加`; no findings.",
+    "Assessed `other/python/fast_mlsirm/report.py`; no findings.",
+    "Scope: `/workspace/strix-pr-scope.ABC123/python/fast_mlsirm@backup`.",
+    "Scope: `python/fast_mlsirm/../unrelated`. Reviewed `report.py`.",
+])
+def test_longer_or_traversing_report_identity_cannot_bind_scope(
+    tmp_path: Path, report_text: str
+) -> None:
+    """Otherwise-complete reports cannot authorize a partial path token."""
+    _write_report(tmp_path, report_text=report_text)
+    with pytest.raises(ValueError, match="does not identify a changed source file"):
+        report_scope.validate(tmp_path, [CHANGED_PATH])
+
+
+@pytest.mark.parametrize("report_text", [
+    "Assessed `python/fast_mlsirm/report.py:12:3`; no findings.",
+    "Assessed python/fast_mlsirm/report.py. No findings.",
+    "Directory `python/fast_mlsirm`; reviewed `report.py`.",
+])
+def test_exact_report_identity_with_context_is_accepted(
+    tmp_path: Path, report_text: str
+) -> None:
+    """Line references and separately named directory/file remain valid scope."""
+    _write_report(tmp_path, report_text=report_text)
+    report_scope.validate(tmp_path, [CHANGED_PATH])
+
+
+def test_cli_reports_validation_error_and_accepts_scoped_success(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """The command boundary maps validation failures to exit 1 and stderr."""
+    monkeypatch.setattr(sys, "argv", [str(SCRIPT), str(tmp_path), CHANGED_PATH])
+    with pytest.raises(SystemExit) as missing_report_exit:
+        runpy.run_path(str(SCRIPT), run_name="__main__")
+    assert missing_report_exit.value.code == 1
+    assert "ERROR: Strix report scope: expected exactly one" in capsys.readouterr().err
+
+    _write_report(tmp_path)
+    monkeypatch.setattr(sys, "argv", [str(SCRIPT), str(tmp_path)])
+    with pytest.raises(SystemExit) as empty_scope_exit:
+        runpy.run_path(str(SCRIPT), run_name="__main__")
+    assert empty_scope_exit.value.code == 1
+    assert "does not identify a changed source file" in capsys.readouterr().err
+
+    monkeypatch.setattr(sys, "argv", [str(SCRIPT), str(tmp_path), CHANGED_PATH])
+    runpy.run_path(str(SCRIPT), run_name="__main__")
diff --git a/tests/test_strix_runtime_dependencies.py b/tests/test_strix_runtime_dependencies.py
index 20444b0abd..6f664daa20 100644
--- a/tests/test_strix_runtime_dependencies.py
+++ b/tests/test_strix_runtime_dependencies.py
@@ -3,6 +3,29 @@
 REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
 
 
+def _locked_requirement_versions(requirements_text: str, package_name: str) -> list[str]:
+    """Return every exact version row for one normalized package name."""
+    package_versions = []
+    for requirement_line in requirements_text.splitlines():
+        requirement_name, separator, version_and_hash_marker = (
+            requirement_line.strip().partition("==")
+        )
+        requirement_name = requirement_name.split("[", 1)[0].strip()
+        if separator and requirement_name.casefold() == package_name.casefold():
+            package_versions.append(version_and_hash_marker.split()[0])
+    return package_versions
+
+
+def test_locked_requirement_versions_normalizes_extras() -> None:
+    """Treat extras as the same distribution when detecting duplicate pins."""
+    requirements = "pyjwt==2.14.0\npyjwt[crypto]==2.13.0\n"
+
+    assert _locked_requirement_versions(requirements, "pyjwt") == [
+        "2.14.0",
+        "2.13.0",
+    ]
+
+
 def test_strix_installs_openai_httpx2_runtime() -> None:
     requirements = (REPOSITORY_ROOT / "requirements-strix-ci.txt").read_text(
         encoding="utf-8"
@@ -27,3 +50,47 @@ def test_strix_anyio_security_pin_is_an_explicit_lock_input() -> None:
 
     assert "anyio==4.14.2" in requirements.splitlines()
     assert "anyio==4.14.2 \\" in requirements_lock.splitlines()
+
+
+def test_strix_pyjwt_security_pin_is_an_explicit_lock_input() -> None:
+    """Keep PyJWT above the GHSA-42vr-xj54-vc7v parser DoS fix."""
+    requirements = (REPOSITORY_ROOT / "requirements-strix-ci.txt").read_text(
+        encoding="utf-8"
+    )
+    requirements_lock = (
+        REPOSITORY_ROOT / "requirements-strix-ci-hashes.txt"
+    ).read_text(encoding="utf-8")
+
+    assert _locked_requirement_versions(requirements, "pyjwt") == ["2.15.0"]
+    assert _locked_requirement_versions(requirements_lock, "pyjwt") == ["2.15.0"]
+
+
+def test_strix_litellm_security_pin_is_an_explicit_lock_input() -> None:
+    """Keep LiteLLM outside the CVE-2026-84377 credential leak range."""
+    requirements = (REPOSITORY_ROOT / "requirements-strix-ci.txt").read_text(
+        encoding="utf-8"
+    )
+    requirements_lock = (
+        REPOSITORY_ROOT / "requirements-strix-ci-hashes.txt"
+    ).read_text(encoding="utf-8")
+
+    assert _locked_requirement_versions(requirements, "litellm") == ["1.94.3"]
+    assert _locked_requirement_versions(requirements_lock, "litellm") == ["1.94.3"]
+
+
+def test_shared_urllib3_security_pin_is_an_explicit_lock_input() -> None:
+    """Keep both audited dependency closures above the urllib3 CVE fixes."""
+    requirement_paths = (
+        "requirements-pip-audit-ci.txt",
+        "requirements-pip-audit-ci-hashes.txt",
+        "requirements-strix-ci.txt",
+        "requirements-strix-ci-hashes.txt",
+    )
+
+    for requirement_path in requirement_paths:
+        requirements_text = (REPOSITORY_ROOT / requirement_path).read_text(
+            encoding="utf-8"
+        )
+        assert _locked_requirement_versions(requirements_text, "urllib3") == [
+            "2.8.0"
+        ]
diff --git a/tests/test_strix_unverified_dependency.py b/tests/test_strix_unverified_dependency.py
index a4d2ac8c87..cde612f6b0 100644
--- a/tests/test_strix_unverified_dependency.py
+++ b/tests/test_strix_unverified_dependency.py
@@ -8,11 +8,15 @@
 
 from __future__ import annotations
 
+import runpy
 import subprocess
 import sys
 from pathlib import Path
 
+import pytest
+
 from scripts.ci.strix_unverified_dependency import (
+    main,
     named_packages,
     unverified_dependency_finding,
 )
@@ -89,6 +93,54 @@ def test_findings_without_a_package_name_are_never_dropped(tmp_path: Path) -> No
     assert not unverified_dependency_finding(report, repo)
 
 
+def test_requirements_files_are_dependency_manifests(tmp_path: Path) -> None:
+    repo = _rust_python_repo(tmp_path / "repo")
+    (repo / "requirements-production.in").write_text("orjson==3.10.15\n")
+    report = "**Target:** orjson 3.10.15\n"
+
+    assert not unverified_dependency_finding(report, repo)
+
+
+def test_dependency_names_outside_regular_manifests_are_ignored(tmp_path: Path) -> None:
+    repo = _rust_python_repo(tmp_path / "repo")
+    (repo / "README.md").write_text("lodash\n")
+    git_dir = repo / ".git"
+    git_dir.mkdir()
+    (git_dir / "Cargo.lock").write_text('[[package]]\nname = "lodash"\n')
+    source = repo / "symlink-source.txt"
+    source.write_text("lodash\n")
+    (repo / "requirements-symlink.txt").symlink_to(source)
+    oversized = repo / "requirements-oversized.txt"
+    oversized.write_text("lodash\n")
+    with oversized.open("ab") as handle:
+        handle.truncate(9 * 1024 * 1024)
+
+    assert unverified_dependency_finding(LODASH_REPORT, repo)
+
+
+def test_main_returns_usage_error_without_both_paths(capsys: pytest.CaptureFixture[str]) -> None:
+    assert main([str(HELPER)]) == 2
+    assert "Usage: strix_unverified_dependency.py REPORT REPO_ROOT" in capsys.readouterr().err
+
+
+def test_main_classifies_report_and_emits_warning(tmp_path: Path, capsys: pytest.CaptureFixture[str]) -> None:
+    repo = _rust_python_repo(tmp_path / "repo")
+    report = tmp_path / "vuln-0001.md"
+    report.write_text(LODASH_REPORT)
+
+    assert main([str(HELPER), str(report), str(repo)]) == 0
+    assert "lodash" in capsys.readouterr().err
+    (repo / "yarn.lock").write_text('lodash@^4.17.20:\n  version "4.17.20"\n')
+    assert main([str(HELPER), str(report), str(repo)]) == 1
+
+
+def test_script_entrypoint_exits_with_main_status(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "argv", [str(HELPER)])
+
+    with pytest.raises(SystemExit, match="2"):
+        runpy.run_path(str(HELPER), run_name="__main__")
+
+
 def test_cli_exit_status_and_message(tmp_path: Path) -> None:
     repo = _rust_python_repo(tmp_path / "repo")
     report = tmp_path / "vuln-0001.md"
diff --git a/tests/test_tokyo_review_consumer.py b/tests/test_tokyo_review_consumer.py
new file mode 100644
index 0000000000..44c765d088
--- /dev/null
+++ b/tests/test_tokyo_review_consumer.py
@@ -0,0 +1,32 @@
+"""Tokyo admission reuses central dispatch, never a leaf worker or unknown App."""
+import json
+from pathlib import Path
+
+from scripts.ci import noema_review_handoff as handoff
+
+ROOT = Path(__file__).resolve().parents[1]
+TOKYO = 'ContextualWisdomLab/tokyo-travel-2026'
+
+
+def test_tokyo_source_target_is_explicit_and_unique():
+    targets = json.loads((ROOT / 'scripts/ci/opencode_repository_dispatch_targets.json').read_text())['targets']
+    assert targets.count(TOKYO) == 1
+
+
+def test_leaf_handoff_dispatches_central_handler_with_exact_target_head():
+    calls = []
+    handoff.dispatch_noema(TOKYO, 3, 'a' * 40,
+                          runner=lambda args, stdin: calls.append((args, json.loads(stdin))))
+    assert calls[0][0] == ['api', '-X', 'POST', 'repos/ContextualWisdomLab/.github/dispatches', '--input', '-']
+    assert calls[0][1] == {'event_type': 'noema-review', 'client_payload': {
+        'target_repository': TOKYO, 'pr_number': 3, 'pr_head_sha': 'a' * 40}}
+
+
+def test_tokyo_noema_selects_only_existing_self_hosted_groups():
+    source = (ROOT / '.github/workflows/noema-review.yml').read_text()
+    selectors = [line for line in source.splitlines() if line.strip().startswith(('group: ${{', 'labels: ${{'))]
+    assert selectors
+    for line in selectors:
+        assert "github.repository == '" + TOKYO + "'" in line
+        assert 'CWL CI isolated' in line
+        assert 'ubuntu-24.04' not in line
diff --git a/tests/test_trusted_archive_retry_behavior.py b/tests/test_trusted_archive_retry_behavior.py
new file mode 100644
index 0000000000..a09e278fbd
--- /dev/null
+++ b/tests/test_trusted_archive_retry_behavior.py
@@ -0,0 +1,98 @@
+"""Behavioral regression for transient trusted-archive download failures."""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import tempfile
+import textwrap
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+import pytest
+
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW_ROOT = REPOSITORY_ROOT / ".github" / "workflows"
+WORKFLOWS = (
+    "noema-review.yml",
+    "opencode-review.yml",
+    "pr-review-merge-scheduler.yml",
+)
+
+
+class TransientArchiveHandler(BaseHTTPRequestHandler):
+    """Return one transient 502 response before a successful archive body."""
+
+    request_count = 0
+
+    def do_GET(self) -> None:  # noqa: N802 - stdlib handler API
+        """Serve the deterministic failure-then-success sequence."""
+        type(self).request_count += 1
+        if type(self).request_count == 1:
+            self.send_response(502)
+            self.end_headers()
+            return
+        body = b"trusted-archive"
+        self.send_response(200)
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, format: str, *args: object) -> None:
+        """Keep the regression output focused on assertion failures."""
+
+
+def archive_command(workflow_path: Path) -> str:
+    """Extract archive assignments plus the production curl command."""
+    lines = workflow_path.read_text(encoding="utf-8").splitlines()
+    start = next(
+        index for index, line in enumerate(lines) if "trusted_archive=" in line
+    )
+    stop = next(
+        index
+        for index in range(start, len(lines))
+        if "TRUSTED_SOURCE_REF}" in lines[index]
+    )
+    return textwrap.dedent("\n".join(lines[start : stop + 1]))
+
+
+@pytest.mark.parametrize("workflow_name", WORKFLOWS)
+def test_trusted_archive_download_retries_transient_502(workflow_name: str) -> None:
+    """The production curl command must survive one transient GitHub 502."""
+    TransientArchiveHandler.request_count = 0
+    server = ThreadingHTTPServer(("127.0.0.1", 0), TransientArchiveHandler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        with tempfile.TemporaryDirectory() as temporary_directory:
+            temporary_path = Path(temporary_directory)
+            environment = os.environ | {
+                "GH_TOKEN": "test-token",
+                "GITHUB_API_URL": f"http://127.0.0.1:{server.server_port}",
+                "GITHUB_WORKSPACE": temporary_directory,
+                "RUNNER_TEMP": temporary_directory,
+                "TRUSTED_SOURCE_REF": "1" * 40,
+            }
+            result = subprocess.run(
+                [
+                    "bash",
+                    "-euo",
+                    "pipefail",
+                    "-c",
+                    archive_command(WORKFLOW_ROOT / workflow_name),
+                ],
+                env=environment,
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            assert result.returncode == 0, result.stderr
+            assert TransientArchiveHandler.request_count == 2
+            archive_path = next(temporary_path.glob("trusted-*.tar.gz"))
+            assert archive_path.read_bytes() == b"trusted-archive"
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join()
diff --git a/tests/test_trusted_uv_company_gate_wiring.py b/tests/test_trusted_uv_company_gate_wiring.py
new file mode 100644
index 0000000000..3effdf2850
--- /dev/null
+++ b/tests/test_trusted_uv_company_gate_wiring.py
@@ -0,0 +1,49 @@
+"""Verify company trust-gate changes reach the existing complete quality gate."""
+from fnmatch import fnmatchcase
+from pathlib import Path
+import shlex
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1]
+QUALITY = ROOT / '.github/workflows/trusted-uv-materializer-quality-ci.yml'
+SURFACES = (
+    '.github/workflows/company-default-head-trust-gate.yml',
+    'tests/test_company_default_head_trust_gate.py',
+)
+
+
+def quality():
+    return yaml.safe_load(QUALITY.read_text())
+
+
+@pytest.mark.parametrize('event', ['pull_request', 'push'])
+@pytest.mark.parametrize('surface', SURFACES)
+def test_trust_gate_change_selects_existing_quality(event, surface):
+    data = quality()
+    triggers = data.get('on', data.get(True))
+    patterns = triggers[event]['paths']
+    assert any(fnmatchcase(surface, pattern) for pattern in patterns), (
+        event, surface, 'Trust-gate change does not select existing full quality gate')
+    # Each new exact surface is necessary: prove selector sensitivity offline.
+    without = [p for p in patterns if p != surface]
+    assert not any(fnmatchcase(surface, p) for p in without)
+
+
+def test_selected_quality_command_discovers_trust_gate_regression():
+    data = quality()
+    job = data['jobs']['full-quality-gate']
+    step = next(s for s in job['steps']
+                if s.get('name') == 'Run complete central test and branch coverage gate')
+    commands = [shlex.split(line) for line in step['run'].splitlines() if line.strip()]
+    assert ['python', '-m', 'coverage', 'run', '-m', 'pytest', 'tests', '-q'] in commands
+    assert ['python', '-m', 'coverage', 'report'] in commands
+    assert ['unset', 'COVERAGE_RCFILE'] in commands
+    module = ROOT / SURFACES[1]
+    assert module.is_file() and module.name.startswith('test_') and module.suffix == '.py'
+    assert module.parent == ROOT / 'tests'
+    assert data['permissions'] == {'contents': 'read'}
+    assert job['name'] == 'Python 3.14 full quality gate'
+    assert job['runs-on'] == {'group': 'CWL CI isolated',
+                             'labels': ['self-hosted', 'linux', 'x64', 'cwlab-ci-isolated']}
diff --git a/tests/test_trusted_uv_company_settlement_validate.py b/tests/test_trusted_uv_company_settlement_validate.py
new file mode 100644
index 0000000000..6789f74034
--- /dev/null
+++ b/tests/test_trusted_uv_company_settlement_validate.py
@@ -0,0 +1,83 @@
+"""Validate the central settlement workload callee source boundary."""
+import hashlib
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW = ROOT / '.github/workflows/company-settlement-validate.yml'
+QUALITY = ROOT / '.github/workflows/trusted-uv-materializer-quality-ci.yml'
+EXPECTED_STEPS_HASH = '0d549f21d485446af03f440c374fa701720340c6961bbac1e02c3987d89522b0'
+EXPECTED_TEST_MODULES = (
+    'tests/test_issue119_pgcat_endpoint_resolver.py',
+    'tests/test_issue119_settlement_live_verify.py',
+    'tests/test_issue119_settlement_replica_routing.py',
+    'tests/test_issue119_settlement_review_regressions.py',
+    'tests/test_multi_instance_runtime_contract.py',
+)
+
+
+def load(path: Path):
+    assert path.is_file(), f'missing {path.relative_to(ROOT)}'
+    return yaml.safe_load(path.read_text())
+
+
+def test_settlement_callee_has_fixed_isolated_selector_and_no_caller_selected_runner():
+    data = load(WORKFLOW)
+    trigger = data.get('on', data.get(True))
+    assert set(trigger) == {'workflow_call'}
+    call = trigger['workflow_call']
+    assert call.get('inputs', {}) == {}
+    assert call.get('secrets', {}) == {}
+    assert data['permissions'] == {'contents': 'read'}
+    assert set(data['jobs']) == {'validate'}
+    job = data['jobs']['validate']
+    assert job['runs-on'] == {
+        'group': 'CWL CI isolated',
+        'labels': ['self-hosted', 'Linux', 'X64', 'cwlab-ci-isolated'],
+    }
+    assert 'runner_group' not in WORKFLOW.read_text()
+    assert 'runner_labels_json' not in WORKFLOW.read_text()
+    assert 'fromJSON' not in WORKFLOW.read_text()
+
+
+def test_settlement_callee_preserves_reviewed_workload_bytes_and_security_boundary():
+    data = load(WORKFLOW)
+    job = data['jobs']['validate']
+    assert len(job['steps']) == 7
+    body = WORKFLOW.read_bytes()
+    steps_bytes = body[body.index(b'    steps:\n'):]
+    # Supplier's trailing blank line is not workload; preserve every actual step byte.
+    assert hashlib.sha256(steps_bytes.rstrip(b'\n') + b'\n\n').hexdigest() == EXPECTED_STEPS_HASH
+    assert job['steps'][0]['uses'] == 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+    assert job['steps'][0]['with'] == {
+        'persist-credentials': False,
+        'ref': '${{ github.event.pull_request.head.sha || github.sha }}',
+    }
+    assert job['steps'][1]['uses'] == 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97'
+    assert job['steps'][1]['with'] == {'python-version': '3.13'}
+    assert job['steps'][2]['uses'] == 'astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4'
+    verify = job['steps'][5]
+    assert verify['env'] == {'SETTLEMENT_VERIFY_REQUIRE_POSTGRES': '1'}
+    for module in EXPECTED_TEST_MODULES:
+        assert module in verify['run']
+    assert 'DATABASE_' not in yaml.safe_dump(job)
+    assert 'secrets.' not in yaml.safe_dump(job)
+
+
+def test_settlement_callee_is_selected_by_existing_complete_quality_gate():
+    data = load(QUALITY)
+    trigger = data.get('on', data.get(True))
+    for event in ('pull_request', 'push'):
+        paths = trigger[event]['paths']
+        assert '.github/workflows/company-settlement-validate.yml' in paths
+        assert 'tests/test_trusted_uv*.py' in paths
+        assert Path(__file__).match('test_trusted_uv*.py')
+    full = data['jobs']['full-quality-gate']
+    step = next(s for s in full['steps'] if s.get('name') == 'Run complete central test and branch coverage gate')
+    assert 'python -m coverage run -m pytest tests -q' in step['run']
+    assert full['runs-on'] == {
+        'group': 'CWL CI isolated',
+        'labels': ['self-hosted', 'linux', 'x64', 'cwlab-ci-isolated'],
+    }
+    assert data['permissions'] == {'contents': 'read'}
diff --git a/tests/test_trusted_uv_materializer_quality_workflow_contract.py b/tests/test_trusted_uv_materializer_quality_workflow_contract.py
index 50a5ddb5fe..ed4ad55681 100644
--- a/tests/test_trusted_uv_materializer_quality_workflow_contract.py
+++ b/tests/test_trusted_uv_materializer_quality_workflow_contract.py
@@ -4,6 +4,15 @@
 
 
 WORKFLOW_PATH = Path(".github/workflows/trusted-uv-materializer-quality-ci.yml")
+AGENT_MENTION_WORKFLOW_PATH = Path(
+    ".github/workflows/agent-mention-router-quality-ci.yml"
+)
+AGENT_RUNTIME_WORKFLOW_PATH = Path(
+    ".github/workflows/agent-review-runtime-quality-ci.yml"
+)
+REPOSITORY_METADATA_WORKFLOW_PATH = Path(
+    ".github/workflows/repository-metadata-reconcile.yml"
+)
 
 
 def _workflow_text() -> str:
@@ -20,18 +29,33 @@ def test_quality_workflow_runs_for_every_materializer_surface() -> None:
     required_paths = (
         '".github/workflows/trusted-uv-materializer-quality-ci.yml"',
         '"scripts/ci/materialize_base_python_requirements.py"',
+        '"scripts/ci/verify_release_maturin_tool_assets.py"',
         '"tests/conftest.py"',
         '"tests/test_materialize*.py"',
         '"tests/test_trusted_uv*.py"',
         '"tests/test_uv*.py"',
         '"tests/test_repository_branch_coverage_*.py"',
+        '"tests/test_verify_release_maturin_tool_assets.py"',
         '"requirements-opencode-review-ci-hashes.txt"',
+        '"requirements-opencode-review-ci.txt"',
+        '"requirements-noema-document-ci.txt"',
+        '"scripts/ci/compile_opencode_review_lock.sh"',
         '"pyproject.toml"',
     )
     for required_path in required_paths:
         assert workflow.count(required_path) == 2
 
 
+def test_quality_workflow_admits_stacked_pull_requests() -> None:
+    """A non-default canonical owner base must not suppress exact-head evidence."""
+
+    pull_request_trigger = _workflow_text().split("  pull_request:\n", 1)[1].split(
+        "  push:\n", 1
+    )[0]
+
+    assert "branches:" not in pull_request_trigger
+
+
 def test_quality_workflow_pins_actions_and_uses_read_only_permissions() -> None:
     """Quality evidence executes from the exact PR head with least privilege."""
 
@@ -49,6 +73,50 @@ def test_quality_workflow_pins_actions_and_uses_read_only_permissions() -> None:
     ) == 2
     assert workflow.count("persist-credentials: false") == 2
     assert workflow.count("ref: ${{ github.event.pull_request.head.sha }}") == 2
+    minimum_job, full_job = workflow.split("  full-quality-gate:\n", 1)
+    assert "fetch-depth: 0" not in minimum_job
+    assert full_job.count("fetch-depth: 0") == 1
+
+
+def test_common_lock_source_changes_trigger_every_direct_consumer() -> None:
+    """Every workflow installing the generated common lock tracks its sources."""
+
+    tracked_inputs = (
+        '"requirements-opencode-review-ci.txt"',
+        '"requirements-noema-document-ci.txt"',
+        '"scripts/ci/compile_opencode_review_lock.sh"',
+    )
+    consumer_paths = (
+        (AGENT_MENTION_WORKFLOW_PATH, 2),
+        (AGENT_RUNTIME_WORKFLOW_PATH, 1),
+        (REPOSITORY_METADATA_WORKFLOW_PATH, 1),
+    )
+    for workflow_path, expected_count in consumer_paths:
+        workflow = workflow_path.read_text(encoding="utf-8")
+        for tracked_input in tracked_inputs:
+            assert workflow.count(tracked_input) == expected_count
+
+
+def test_metadata_consumer_tracks_the_generated_common_lock() -> None:
+    """The metadata workflow must run when its installed lock changes."""
+
+    workflow = REPOSITORY_METADATA_WORKFLOW_PATH.read_text(encoding="utf-8")
+
+    assert workflow.count('"requirements-opencode-review-ci-hashes.txt"') == 1
+
+
+def test_common_lock_source_declares_the_transitive_parser_inputs() -> None:
+    """The reviewed source binds both parser requirements regenerated in the lock."""
+
+    source = Path("requirements-opencode-review-ci.txt").read_text(encoding="utf-8")
+    lock = Path("requirements-opencode-review-ci-hashes.txt").read_text(
+        encoding="utf-8"
+    )
+
+    assert "-r requirements-noema-document-ci.txt" in source
+    assert "PyYAML==6.0.3" in source
+    assert "defusedxml==0.7.1" in lock
+    assert "pyyaml==6.0.3" in lock
 
 
 def test_minimum_python_contract_exercises_the_tomli_fallback() -> None:
diff --git a/tests/test_verify_release_maturin_tool_assets.py b/tests/test_verify_release_maturin_tool_assets.py
index 07244a678b..14f73c6cac 100644
--- a/tests/test_verify_release_maturin_tool_assets.py
+++ b/tests/test_verify_release_maturin_tool_assets.py
@@ -6,9 +6,10 @@
 import runpy
 import sys
 import tarfile
+import urllib.error
+import urllib.request
 import zipfile
 from pathlib import Path
-from urllib import request
 
 import pytest
 
@@ -145,20 +146,179 @@ def read(self, member):
 
 def test_maturin_download_is_bounded(monkeypatch):
     class Response:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, *args):
-            return False
+        status = 200
 
         def read(self, limit):
             assert limit == 4
             return b"four"
 
+        def close(self):
+            pass
+
+    class Opener:
+        def open(self, request, timeout):
+            assert request.method == "GET"
+            assert request.full_url.endswith(
+                "/maturin-x86_64-pc-windows-msvc.zip"
+            )
+            assert request.headers == {"User-agent": "cwl-release-gate"}
+            assert timeout == 60
+            return Response()
+
     monkeypatch.setattr(verifier, "MAX_ASSET_BYTES", 3)
-    monkeypatch.setattr(verifier, "urlopen", lambda req, timeout: Response())
+    def build_opener(proxy_handler, redirect_handler):
+        assert isinstance(proxy_handler, urllib.request.ProxyHandler)
+        assert proxy_handler.proxies == {}
+        assert isinstance(redirect_handler, verifier._ExactReleaseRedirect)
+        return Opener()
+
+    monkeypatch.setattr(verifier.urllib.request, "build_opener", build_opener)
     with pytest.raises(ValueError, match="asset exceeds"):
-        verifier._download("maturin.zip")
+        verifier._download("maturin-x86_64-pc-windows-msvc.zip")
+
+
+def test_maturin_download_closes_unsuccessful_responses_and_http_errors(monkeypatch):
+    """Every rejected transport response releases its underlying connection."""
+    closed = []
+
+    class Response:
+        status = 503
+
+        def close(self):
+            closed.append("response")
+
+    class ResponseOpener:
+        def open(self, _request, timeout):
+            assert timeout == 60
+            return Response()
+
+    monkeypatch.setattr(
+        verifier.urllib.request,
+        "build_opener",
+        lambda _proxy, _redirect: ResponseOpener(),
+    )
+    with pytest.raises(ValueError, match="HTTP 503"):
+        verifier._download("maturin-x86_64-pc-windows-msvc.zip")
+    assert closed == ["response"]
+
+    transport_error = urllib.error.HTTPError(
+        "https://github.com/asset", 502, "Bad Gateway", {}, io.BytesIO()
+    )
+    original_close = transport_error.close
+
+    def close_transport_error():
+        closed.append("http-error")
+        original_close()
+
+    monkeypatch.setattr(transport_error, "close", close_transport_error)
+
+    class ErrorOpener:
+        def open(self, _request, timeout):
+            assert timeout == 60
+            raise transport_error
+
+    monkeypatch.setattr(
+        verifier.urllib.request,
+        "build_opener",
+        lambda _proxy, _redirect: ErrorOpener(),
+    )
+    with pytest.raises(ValueError, match="HTTP 502"):
+        verifier._download("maturin-x86_64-pc-windows-msvc.zip")
+    assert closed == ["response", "http-error"]
+
+
+def test_maturin_download_rejects_unlisted_name_before_network(monkeypatch):
+    """Caller-controlled paths and URLs never reach the network transport."""
+    monkeypatch.setattr(
+        verifier.urllib.request,
+        "build_opener",
+        lambda *_args, **_kwargs: pytest.fail("network opened for unlisted asset"),
+    )
+    for filename in ("foreign.zip", "../maturin.zip", "https://example.test/x", "x?y"):
+        with pytest.raises(ValueError, match="asset name is unexpected"):
+            verifier._download(filename)
+
+
+@pytest.mark.parametrize(
+    "location",
+    [
+        "http://release-assets.githubusercontent.com/asset",
+        "https://example.test/asset",
+        "https://127.0.0.1/asset",
+        "https://release-assets.githubusercontent.com:invalid/asset",
+        "https://[bad/asset",
+        "file:///tmp/asset",
+    ],
+)
+def test_maturin_download_rejects_unsafe_redirect(monkeypatch, location):
+    """Only the credential-free GitHub release CDN redirect is admissible."""
+    closed = []
+
+    class Response:
+        def close(self):
+            closed.append("response")
+
+    handler = verifier._ExactReleaseRedirect()
+    handler.add_parent(
+        type("Parent", (), {"open": lambda *_args, **_kwargs: pytest.fail("redirect opened")})()
+    )
+    request = urllib.request.Request(
+        "https://github.com/PyO3/maturin/releases/download/v1.15.0/asset"
+    )
+    request.timeout = 60
+    with pytest.raises(ValueError, match="redirect is not trusted"):
+        handler.http_error_302(
+            request, Response(), 302, "Found", {"Location": location}
+        )
+    assert closed == ["response"]
+
+
+def test_maturin_download_follows_one_exact_release_cdn_redirect(monkeypatch):
+    """The normal GitHub release redirect stays HTTPS and drops all authority."""
+    closed = []
+    sentinel = object()
+
+    class Response:
+        def close(self):
+            closed.append("response")
+
+    captured = {}
+
+    class Parent:
+        def open(self, request, timeout):
+            captured.update(request=request, timeout=timeout)
+            return sentinel
+
+    handler = verifier._ExactReleaseRedirect()
+    handler.add_parent(Parent())
+    request = urllib.request.Request(
+        "https://github.com/PyO3/maturin/releases/download/v1.15.0/asset"
+    )
+    request.timeout = 60
+    location = (
+        "https://release-assets.githubusercontent.com/"
+        "github-production-release-asset/123/asset?sig=abc"
+    )
+    assert (
+        handler.http_error_302(
+            request, Response(), 302, "Found", {"Location": location}
+        )
+        is sentinel
+    )
+    assert closed == ["response"]
+    assert captured["timeout"] == 60
+    assert captured["request"].full_url == location
+    assert captured["request"].headers == {"User-agent": "cwl-release-gate"}
+    assert captured["request"]._cwl_release_redirected is True
+
+
+def test_maturin_downloader_has_no_scanner_suppressions():
+    """The downloader must remove the general URL sink, not hide findings."""
+    source = Path(verifier.__file__).read_text(encoding="utf-8")
+    assert "nosemgrep" not in source
+    assert "nosec" not in source
+    assert "urlopen" not in source
+    assert "HTTPSConnection" not in source
 
 
 def test_maturin_main_reads_an_explicit_asset_root(tmp_path, monkeypatch):
@@ -194,27 +354,30 @@ def links(binary, target, reader, *, allow_subset):
         return assets[binary.decode()]["native_links"]
 
     class Response:
+        status = 200
+
         def __init__(self, raw):
             self.raw = raw
 
-        def __enter__(self):
-            return self
-
-        def __exit__(self, *args):
-            return False
-
         def read(self, limit):
             assert limit == verifier.MAX_ASSET_BYTES + 1
             return self.raw
 
-    def urlopen(req, timeout):
-        assert req.headers["User-agent"] == "cwl-release-gate"
-        assert timeout == 60
-        return Response(archives[req.full_url.rsplit("/", 1)[-1]])
+        def close(self):
+            pass
+
+    class Opener:
+        def open(self, request, timeout):
+            assert request.method == "GET"
+            assert request.headers == {"User-agent": "cwl-release-gate"}
+            assert timeout == 60
+            return Response(archives[request.full_url.rsplit("/", 1)[-1]])
 
     monkeypatch.setattr(Path, "read_text", read_text)
     monkeypatch.setattr(scanner, "_reader", lambda: {"path": "/reader"})
     monkeypatch.setattr(scanner, "_links", links)
-    monkeypatch.setattr(request, "urlopen", urlopen)
+    monkeypatch.setattr(
+        urllib.request, "build_opener", lambda _proxy, _redirect: Opener()
+    )
     monkeypatch.setattr(sys, "argv", ["verify"])
     runpy.run_path(verifier.__file__, run_name="__main__")
diff --git a/tests/test_verify_release_scope_evidence_set.py b/tests/test_verify_release_scope_evidence_set.py
index 449754b2b3..384100d524 100644
--- a/tests/test_verify_release_scope_evidence_set.py
+++ b/tests/test_verify_release_scope_evidence_set.py
@@ -583,6 +583,22 @@ def test_build_snapshot_refuses_unlisted_native_file(tmp_path: Path, monkeypatch
         _build_packages(row, folder)
 
 
+def test_build_snapshot_refuses_unknown_universal_interpreter_architecture(
+    tmp_path: Path,
+) -> None:
+    """A universal build receipt must bind one recognized interpreter architecture."""
+    scope_root, scope_rows = _prescreen_case(tmp_path)
+    scope_row = next(row for row in scope_rows if row["leg"].startswith("universal2-apple-darwin-"))
+    artifact_folder = scope_root / scope_row["artifact_name"]
+    receipt_path = artifact_folder / f"{scope_row['leg']}.build-first.json"
+    receipt = json.loads(receipt_path.read_text())
+    receipt["build_env"] = "/opt/python/UNKNOWN"
+    receipt_path.write_text(json.dumps(receipt))
+
+    with pytest.raises(gate.GateError, match="build interpreter architecture is missing"):
+        _build_packages(scope_row, artifact_folder)
+
+
 def test_runtime_archive_refuses_unknown_native_link(tmp_path: Path, monkeypatch) -> None:
     """A runtime archive with an unlicensed dynamic target cannot pass prescreen."""
     root, rows = _prescreen_case(tmp_path)
@@ -761,6 +777,26 @@ def test_build_package_prescreen_refuses_incomplete_build_evidence(
         _build_packages(scope_row, artifact_folder)
 
 
+def test_build_package_prescreen_refuses_unknown_macos_build_architecture(
+    tmp_path: Path,
+) -> None:
+    """Universal2 build evidence must identify its ARM64 or X64 interpreter."""
+    scope_root, scope_rows = _prescreen_case(tmp_path)
+    scope_row = next(
+        row for row in scope_rows
+        if row["leg"].startswith("universal2-apple-darwin-")
+    )
+    build_leg = scope_row["leg"]
+    artifact_folder = scope_root / scope_row["artifact_name"]
+    receipt_path = artifact_folder / f"{build_leg}.build-first.json"
+    build_receipt = json.loads(receipt_path.read_text())
+    build_receipt["build_env"] = "runner:macos/15/macOS/RISCV64"
+    receipt_path.write_text(json.dumps(build_receipt))
+
+    with pytest.raises(gate.GateError, match="build interpreter architecture is missing"):
+        _build_packages(scope_row, artifact_folder)
+
+
 @pytest.mark.parametrize("mutation_name", ["missing", "oversized"])
 def test_build_package_prescreen_refuses_missing_or_oversized_text(
     tmp_path: Path, mutation_name: str,
@@ -912,9 +948,15 @@ def test_prescreen_refuses_malformed_scope_and_runtime_rows(tmp_path: Path) -> N
     with pytest.raises(gate.GateError, match="verified scope evidence is incomplete"):
         prescreen({}, tmp_path)
 
-    for mutation_name in ("scope-row", "runtime-set", "archive-row"):
+    for mutation_name in ("scope-count", "duplicate-leg", "scope-row", "runtime-set", "archive-row"):
         scope_root, scope_rows = _prescreen_case(tmp_path / mutation_name)
-        if mutation_name == "scope-row":
+        if mutation_name == "scope-count":
+            scope_rows.pop()
+            expected_message = "verified scope evidence is incomplete"
+        elif mutation_name == "duplicate-leg":
+            scope_rows[1]["leg"] = scope_rows[0]["leg"]
+            expected_message = "scope evidence row is malformed"
+        elif mutation_name == "scope-row":
             scope_rows[0]["leg"] = ".."
             expected_message = "scope evidence row is malformed"
         elif mutation_name == "runtime-set":
@@ -927,6 +969,36 @@ def test_prescreen_refuses_malformed_scope_and_runtime_rows(tmp_path: Path) -> N
             prescreen(_scope_with_variants(scope_rows, scope_root), scope_root)
 
 
+@pytest.mark.parametrize(("mutation_name", "expected_message"), [
+    ("oversized", "runtime receipt is oversized"),
+    ("changed", "runtime receipt changed after transport"),
+    ("wrong-architecture", "runtime interpreter differs from required target architecture"),
+])
+def test_prescreen_refuses_untrusted_runtime_receipt(
+    tmp_path: Path, mutation_name: str, expected_message: str,
+) -> None:
+    """Runtime identity must stay bounded, transported-byte-bound, and target-correct."""
+    scope_root, scope_rows = _prescreen_case(tmp_path)
+    scope = _scope_with_variants(scope_rows, scope_root)
+    scope_row = scope_rows[0]
+    runtime_name = f"{scope_row['leg']}.runtime.json"
+    runtime_path = scope_root / scope_row["artifact_name"] / runtime_name
+    if mutation_name == "oversized":
+        runtime_path.write_bytes(b"x" * (1024 * 1024 + 1))
+    elif mutation_name == "changed":
+        scope_row["members"][runtime_name] = "0" * 64
+    else:
+        runtime = json.loads(runtime_path.read_text())
+        runtime["machine"] = "foreign"
+        runtime_path.write_text(json.dumps(runtime))
+        scope_row["members"][runtime_name] = hashlib.sha256(
+            runtime_path.read_bytes()
+        ).hexdigest()
+
+    with pytest.raises(gate.GateError, match=expected_message):
+        prescreen(scope, scope_root)
+
+
 def test_prescreen_coalesces_duplicate_archive_identity(tmp_path: Path) -> None:
     scope_root, scope_rows = _prescreen_case(tmp_path)
     first_row, second_row = scope_rows[:2]
@@ -956,28 +1028,79 @@ def changed_license_evidence(archive_bytes: bytes, ecosystem_name: str) -> dict:
         prescreen(_scope_with_variants(scope_rows, scope_root), scope_root)
 
 
+@pytest.mark.parametrize(("replacement_leg", "expected_message"), [
+    ("extra-py3.12", "runtime archive coverage is incomplete"),
+    (
+        "x86_64-unknown-linux-gnu-py3.15",
+        "runtime interpreter differs from required target architecture",
+    ),
+])
 def test_prescreen_refuses_complete_rows_without_sdist(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    replacement_leg: str,
+    expected_message: str,
 ) -> None:
     scope_root, scope_rows = _prescreen_case(tmp_path)
     sdist_row = scope_rows[-1]
     first_archive = dict(scope_rows[0]["archives"][0])
     first_path = scope_root / scope_rows[0]["artifact_name"] / first_archive["file"]
-    sdist_row["leg"] = "extra-py3.12"
-    sdist_row["artifact_name"] = "repro-digest-extra-py3.12"
+    sdist_row["leg"] = replacement_leg
+    sdist_row["artifact_name"] = f"repro-digest-{replacement_leg}"
     sdist_row["archives"] = [first_archive]
     extra_folder = scope_root / sdist_row["artifact_name"]
     extra_folder.mkdir()
     (extra_folder / first_archive["file"]).write_bytes(first_path.read_bytes())
+    if replacement_leg.endswith("py3.15"):
+        runtime_name = f"{sdist_row['leg']}.runtime.json"
+        runtime = json.loads(
+            (scope_root / scope_rows[0]["artifact_name"]
+             / f"{scope_rows[0]['leg']}.runtime.json").read_text()
+        )
+        runtime.update(leg=sdist_row["leg"], python_version="3.15")
+        runtime_path = extra_folder / runtime_name
+        runtime_path.write_text(json.dumps(runtime))
+        sdist_row["members"][runtime_name] = hashlib.sha256(
+            runtime_path.read_bytes()
+        ).hexdigest()
     monkeypatch.setattr(prescreen_module, "_build_packages", lambda item, folder: [])
     monkeypatch.setattr(prescreen_module, "_maturin_tool", lambda item, folder: {
         "key": "github-release/maturin@1.15.0/sha256/" + "a" * 64,
         "legs": [item["leg"]], "build_envs": {item["leg"]: "fixture"},
     })
-    with pytest.raises(gate.GateError, match="runtime archive coverage is incomplete"):
+    with pytest.raises(gate.GateError, match=expected_message):
         prescreen(_scope_with_variants(scope_rows, scope_root), scope_root)
 
 
+@pytest.mark.parametrize("mutation_name", ["oversized", "digest", "architecture"])
+def test_prescreen_refuses_untrusted_runtime_receipts(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, mutation_name: str,
+) -> None:
+    """Runtime receipts are bounded, hash-bound, and structurally validated."""
+    scope_root, scope_rows = _prescreen_case(tmp_path)
+    scope = _scope_with_variants(scope_rows, scope_root)
+    row = next(item for item in scope_rows if item["leg"] != "sdist")
+    runtime_name = f"{row['leg']}.runtime.json"
+    runtime_path = scope_root / row["artifact_name"] / runtime_name
+    if mutation_name == "oversized":
+        runtime_path.write_bytes(b"x" * (1024 * 1024 + 1))
+    elif mutation_name == "digest":
+        row["members"][runtime_name] = "0" * 64
+    else:
+        def invalid_architecture(*args, **kwargs):
+            del args, kwargs
+            raise DistributionSetError("untrusted architecture")
+
+        monkeypatch.setattr(prescreen_module, "_runtime_target_architecture", invalid_architecture)
+
+    with pytest.raises(gate.GateError, match={
+        "oversized": "runtime receipt is oversized",
+        "digest": "runtime receipt changed after transport",
+        "architecture": "untrusted architecture",
+    }[mutation_name]):
+        prescreen(scope, scope_root)
+
+
 def test_prescreen_cli_writes_once_and_refuses_existing_output(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
 ) -> None: