fix(evals): distinguish deferred capture from reviewed completion

[vriesd]

Why

Qualification rejected a truthful deferred handoff. The grader treated a recorded local command pass as reviewed completion proof and could not represent the unavailable external command.

What changed

• Attest deferred local pass claims against native arm, Bash, status and archive records. Completed workflows retain their stronger review requirements.
• Parse unavailable command proof separately from execution results and bind its target and host to native evidence.
• Compose archived session modifiers and verify explicit review claims and finding qualifiers.

Scope

Evaluator code and focused regression fixtures. Runtime prompts, package behavior, release cases and qualification requirements remain unchanged.

Tradeoffs

The new captured route conservatively requires genuine native records. The grammar remains bounded. It does not attest the workspace after capture or infer completion and external authority.

Blast Radius

Deferred summary grading gains the missing proof level. Missing, counterfeit and contradictory evidence stays rejected. Marker identity compatibility remains unchanged.

Verification

• The exact unchanged native failing input passes after the repair. Parent focused checks passed 591 delivery and replay tests. Original reports and stopped outcomes remain immutable.
• All 340 gradable retained inputs pass across eight campaigns. One historical host failure remains excluded and all original hashes stay unchanged. Parent full preflight passed 2,821 tests with 20 existing skips and zero failures. Independent exact-head review returned PASS+NOTES.
• This repair is offline evidence. Fresh qualification and the package canary remain required before release.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T17:15:31.930052Z	aa506f4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[vriesd]

Independent source-author-distinct review is PASS+NOTES for head aa506f4 against base 22ece33. Stable patch ID is 4983f9fa56879d21180af63189e52bf821a6c4c7.

The reviewer reproduced the exact unchanged native failing input through the whole grader, with three baseline issues and zero head issues. All 340 gradable inputs from eight retained campaigns pass. The historical host exclusion and all original report hashes remain unchanged.

Fresh independent counterexamples found a mismatched optional marker digest. That failing verdict was retained. Red tests and the bounded comparison now reject the mismatch. Renewed independent review passes 42 adversarial controls, with overlap explicitly excluded from any aggregate claim. Completed gate/review/source requirements, marker compatibility, and native provenance checks remain intact.

Parent focused delivery/replay verification passed 567 tests. Full contribution preflight passed 2,797 tests, 20 existing skips and zero failures. Exact-head Comment Sicko audit passed with zero findings.

This is offline repair evidence. No fresh qualification or canary pass is claimed. Review used an independent inherited Sol role without model-family diversity.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aa506f4eac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[vriesd]

Earlier head reviews were superseded after the supported completeness mismatch. This exact-head PASS+NOTES includes the P2 fix and current comment audit.

Independent source-author-distinct review is PASS+NOTES for head 0ac5f42 against base 22ece33. Stable patch ID is 9c3972aa01517dc8f3c6eb6e0ebf9297234ad9c3.

The reviewer reproduced the exact unchanged native failing input through the whole grader, with three baseline issues and zero head issues. All 340 gradable inputs from eight retained campaigns pass. The historical host exclusion and all original report hashes remain unchanged.

Fresh independent counterexamples found a mismatched optional marker digest. That failing verdict was retained. Red tests and the bounded comparison now reject the mismatch. Renewed independent review passes the 64-case completeness matrix and 42 adversarial controls, plus 20 maintained runtime capture tests. Counts are separated from the parent suite. Completed gate/review/source requirements, marker compatibility, and native provenance checks remain intact.

Parent focused delivery/replay verification passed 591 tests. Full contribution preflight passed 2,821 tests, 20 existing skips and zero failures. Exact-head Comment Sicko audit passed with zero findings.

This is offline repair evidence. No fresh qualification or canary pass is claimed. Review used an independent inherited Sol role without model-family diversity.