chore(release): prepare the 9.6 Sol qualification profile

[vriesd]

Why

The handoff changes in #167 need a version-specific release campaign. This prepares 9.6.0 with all twelve existing cases and all five delivery cases, rather than treating exploratory pilots as release qualification.

Scope

• Pin GPT-6.1 Sol for manager and reviewer in all 72 primary and 17 reserve cells. Configure the native reviewer explicitly and reject ambient recovery/reviewer overrides.
• Reject known observed model-route substitutions in 9.6 reports. Verify every canary actor against the release route and retained native evidence. Unknown upstream identity stays unknown.
• Align package version, permanent installation references, changelog, and qualification policy. Preserve six historical catalogs and earlier scheduling behavior.
• Keep the CLI sealing integration test explicitly historical using its verified 9.5 artifact. Add current-profile and route-substitution regression checks.

Tradeoffs

The complete matrix schedules 90 primary workflow steps and up to 23 conditional reserve steps, plus one route probe. The cap is 114 top-level dispatches. Internal model requests and reviewer generation remain paid work inside those workflows, so this is not a dollar cap.

A reserve may replace only a retained retryable environment failure. Product failures do not activate reserves. Three attempts for the new cases are a small sample.

Blast Radius

This PR depends on #167 and prepares an unpublished candidate. It records no 9.6 qualification and makes no Jev decision-quality claim. All earlier paid verdicts remain unchanged. No paid calls, merge, tag, or publication are included.

A native canary still needs reviewed command routing, the pinned 1.18.31 executable, isolated fixture/reviewer configuration, and real session exports. The existing plain-message launcher does not establish that protocol. Its proposed one dispatch is separate from the matrix.

Verification

• Frozen install, typecheck, affected lint, metadata alignment, and 92 focused tests passed.
• Independent review passed. Five independent controls passed with 131 assertions. Final comment audit found no introduced comments or suppressions.
• A rerunnable offline check confirms 17 cases, 72 primary cells, 17 reserves, 90 primary steps, 23 reserve steps, explicit role pins, and all six unchanged historical catalog hashes.
• Full clean-commit push preflight passed at f2a7ef7. The main suite passed 2,240 tests, skipped 20 optional live tests, and failed none. The historical CLI seal and strict metadata flow passed. Package smoke and outgoing-path focused checks passed.
• All 13 gated replays reproduced. The final correction changes test fixtures only.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T09:12:39.366408Z	f2a7ef7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[vriesd]

Independent landing verdict for PR 168

PASS+NOTES at f2a7ef7 against parent 5d47750.

The release profile preserves every historical profile, catalog hash and prior threshold. It requires 17 cases, with all 89 scheduled cells explicitly assigning GPT-6.1 Sol to both manager and reviewer. Primary steps total 90, reserves total 23, and one route probe gives 114 maximum top-level dispatches. Internal model generation has separate cost.

Commands executed without live-call flags or the Jev API key:

• bun /tmp/flow-960-preparation/landing/168/check-profile.ts. Passed the parent/head comparison and grid counts.
• bun test tests/release-960.test.ts tests/eval-release-sampling.test.ts tests/eval-report.test.ts tests/eval-canary.test.ts tests/qualification-cli.test.ts tests/eval-reserve-cancellation.test.ts. 75 passed, 0 failed, 1271 assertions, 64.31 seconds.

The repository-native CLI harness exercised historical exact-artifact qualification, sealing and strict metadata verification. Route-substitution rejection, wrong-role canary rejection, environmental overrides and cancellation behavior passed. The historical CLI fixture extracts the actual artifact role from the verified archive. It never substitutes historical success for 9.6 measurements.

Source review confirmed the model pin reaches the reviewer plugin configuration for every release attempt. Report parsing rejects known manager or reviewer route substitutions. Canary verification checks every role actor and rederives claims from retained evidence, so forged unobserved identities cannot bypass retained transcript observations.

Notes. This is release preparation. No fresh 9.6 campaign, exact-package native canary, sealed qualification, tag or publication was performed. The current launcher still needs the separately identified pinned-host and isolated native workflow preparation before live execution. No paid calls were made. The checkout remains clean at the exact reviewed head.

Prove It Works changed the verification choice. I ran the actual qualification CLI harness and compared parent/head profiles directly instead of relying on prior test summaries or green CI.