← back to Ticket System
Repair TK-11215 evidence replay
873f9144093a965ca797c8ed4c6db23cb03de153 · 2026-09-04 05:18:10 -0700 · Steve Abrams
Files touched
M data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/README.mdA data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/build-evidence.jsM data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/manifest.sha256M data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/negative/manifest.tampered.sha256A data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/agents-panel.shA data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/agents-post-decision-codex.shM data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/audit-report.jsonA data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/claude-panel.shA data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/codex-yoloforever.shM data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/e2e-proof.jsonM data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/provenance.jsonM data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/ticketmaster-latest.jsonM data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/replay-output.txtA data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/replay-verifier.js
Diff
commit 873f9144093a965ca797c8ed4c6db23cb03de153
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Fri Sep 4 05:18:10 2026 -0700
Repair TK-11215 evidence replay
---
.../TK-11215-20260904T0912Z-vpops/README.md | 13 +-
.../build-evidence.js | 142 +++++++++++
.../TK-11215-20260904T0912Z-vpops/manifest.sha256 | 9 +-
.../negative/manifest.tampered.sha256 | 9 +-
.../payload/agents-panel.sh | 107 ++++++++
.../payload/agents-post-decision-codex.sh | 68 +++++
.../payload/audit-report.json | 29 ++-
.../payload/claude-panel.sh | 273 +++++++++++++++++++++
.../payload/codex-yoloforever.sh | 131 ++++++++++
.../payload/e2e-proof.json | 19 +-
.../payload/provenance.json | 12 +-
.../payload/ticketmaster-latest.json | 116 ++++-----
.../replay-output.txt | 2 +-
.../replay-verifier.js | 56 +++++
14 files changed, 884 insertions(+), 102 deletions(-)
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/README.md b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/README.md
index 440c92e5..ce3c3dc4 100644
--- a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/README.md
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/README.md
@@ -2,13 +2,12 @@
Correlation: `codex-yf-20260904T0912Z-vpops`.
-This locally checksummed bundle records the canonical ticketmaster snapshot at
-`2026-09-04T09:12:28.476Z`, metadata for an observed append-only prefix of the
-canonical events JSONL, the exact zero-cost guard, the runner that defines the
-STOPPED sentinel, and the three installed DTD entry points. It records the snapshot's 56 open/active
-and zero-actionable-pickup fields, and replay independently derives that its ranked
-`top[]` contains no execute/fast-local entry. The `top[]` array is explicitly a
-capped 25-entry ranked window, not complete coverage of all 56 tickets.
+This locally checksummed bundle records a fresh canonical ticketmaster snapshot,
+metadata for an observed append-only prefix of the canonical events JSONL, the
+exact zero-cost guard, the runner that defines the STOPPED sentinel, and the three
+installed DTD entry points. Replay independently derives the retained snapshot's
+counts and dispositions. Its `top[]` array is explicitly a capped ranked window,
+not proof of complete coverage of the open/active population.
The raw canonical events log is deliberately not present in this bundle. Its
recorded byte count, SHA-256, nonblank record count, parse result, observation
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/build-evidence.js b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/build-evidence.js
new file mode 100644
index 00000000..e49eaea4
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/build-evidence.js
@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const cp = require('child_process');
+
+const root = __dirname;
+const payload = path.join(root, 'payload');
+const negative = path.join(root, 'negative');
+const snapshotSource = '/Users/macstudio3/.claude/skills/ticketmaster/state/latest.json';
+const eventsSource = '/Users/macstudio3/.claude/tickets/events.jsonl';
+const guardSource = '/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode';
+const sentinel = '/Users/macstudio3/Projects/ticket-system/data/codex-yoloforever/STOPPED';
+const scripts = [
+ ['/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh', 'agents-panel.sh'],
+ ['/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-codex.sh', 'agents-post-decision-codex.sh'],
+ ['/Users/macstudio3/.claude/skills/dtd/scripts/panel.sh', 'claude-panel.sh'],
+];
+
+fs.mkdirSync(payload, {recursive: true});
+fs.mkdirSync(negative, {recursive: true});
+const sha = p => crypto.createHash('sha256').update(fs.readFileSync(p)).digest('hex');
+const copy = (src, dst) => fs.copyFileSync(src, path.join(payload, dst));
+copy(snapshotSource, 'ticketmaster-latest.json');
+copy(guardSource, 'dtd-cost-mode');
+copy('/Users/macstudio3/Projects/ticket-system/scripts/codex-yoloforever.sh', 'codex-yoloforever.sh');
+for (const [src, dst] of scripts) copy(src, dst);
+
+const commands = [];
+function run(label, command, args, opts = {}) {
+ const result = cp.spawnSync(command, args, {encoding: 'utf8', ...opts});
+ commands.push({label, argv: [command, ...args], rc: result.status, stdout: result.stdout, stderr: result.stderr});
+ return result;
+}
+
+const guard = fs.readFileSync(guardSource);
+const guardExact = guard.equals(Buffer.from('ZERO_COST_REQUIRED\n'));
+const snapshot = JSON.parse(fs.readFileSync(snapshotSource, 'utf8'));
+const expectedTs = snapshot.ts;
+// The canonical event log can contain sensitive ticket material. Fingerprint the
+// exact observed prefix, but never copy its contents into this evidence bundle.
+const eventBuffer = fs.readFileSync(eventsSource);
+const eventText = eventBuffer.toString('utf8');
+const eventsObservedAt = new Date().toISOString();
+let records = 0;
+for (const [i, line] of eventText.split('\n').entries()) {
+ if (!line.trim()) continue;
+ try { JSON.parse(line); records++; }
+ catch (error) { throw new Error(`events JSONL invalid at line ${i + 1}: ${error.message}`); }
+}
+
+const staticChecks = [];
+for (const [src, dst] of scripts) {
+ const text = fs.readFileSync(src, 'utf8');
+ const checks = {
+ canonical_guard_literal: text.includes('CANONICAL_DTD_COST_MODE_FILE="/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode"'),
+ rejects_noncanonical_override: text.includes('refusing non-canonical DTD cost-mode guard') && text.includes('exit 78'),
+ zero_cost_case_forces_one: /ZERO_COST_REQUIRED\) DTD_ZERO_COST=1/.test(text),
+ guard_read_precedes_provider_branch: text.indexOf('ZERO_COST_REQUIRED) DTD_ZERO_COST=1') >= 0 && text.indexOf('ZERO_COST_REQUIRED) DTD_ZERO_COST=1') < Math.min(...['api.openai.com','api.x.ai','api.moonshot.ai'].map(s => { const i=text.indexOf(s); return i < 0 ? Infinity : i; })),
+ paid_openai_guarded: !text.includes('api.openai.com') || text.includes('DTD_ZERO_COST') && (/DTD_ZERO_COST[^\n]*!= 1/.test(text) || /if \[\[ "\$DTD_ZERO_COST" == 1 \]\]/.test(text)),
+ paid_xai_guarded: !text.includes('api.x.ai') || /DTD_ZERO_COST[^\n]*!= 1/.test(text),
+ paid_moonshot_guarded: !text.includes('api.moonshot.ai') || /DTD_ZERO_COST[^\n]*!= 1/.test(text),
+ };
+ staticChecks.push({source: src, capture: `payload/${dst}`, sha256: sha(src), checks, verdict: Object.values(checks).every(Boolean) ? 'PASS' : 'FAIL'});
+}
+
+for (const [src] of scripts) run(`bash syntax: ${src}`, '/bin/bash', ['-n', src]);
+run('ticket urgency tests', process.execPath, ['/Users/macstudio3/.claude/skills/ticketmaster/test/urgency.test.js']);
+run('guard exact bytes', '/usr/bin/cmp', ['-s', guardSource, '/dev/stdin'], {input: 'ZERO_COST_REQUIRED\n'});
+
+const dispositions = {};
+for (const item of snapshot.top) dispositions[item.disposition] = (dispositions[item.disposition] || 0) + 1;
+const actionableTop = snapshot.top.filter(x => x.disposition === 'execute' || x.disposition === 'fast-track-local');
+const captureTime = new Date().toISOString();
+const audit = {
+ schema: 'codex-yoloforever-r0-evidence/v1', ticket: 'TK-11215', correlation: 'codex-yf-20260904T0912Z-vpops',
+ captured_at: captureTime, risk_tier: 'R0', cost_usd: 0,
+ capture_scope_notice: 'Payload files are locally checksummed. Canonical events are not retained; their recorded append-only prefix can be rechecked only while the canonical source remains available and preserves that prefix.',
+ guard: {source: guardSource, bytes: guard.length, hex: guard.toString('hex'), sha256: sha(guardSource), exact_expected_with_newline: guardExact, verdict: guardExact ? 'PASS' : 'FAIL'},
+ ticketmaster: {
+ source: snapshotSource, retained_as: 'payload/ticketmaster-latest.json', snapshot_ts: snapshot.ts, sha256: sha(path.join(payload, 'ticketmaster-latest.json')), open_or_active: snapshot.totals.open_or_active,
+ actionable_pickups: snapshot.orchestration_reasons.actionable_pickups, top_length: snapshot.top.length,
+ top_scope: 'top[] is a capped ranked window and is not necessarily the full open/active population.',
+ actionable_entries_in_top: actionableTop.length, dispositions,
+ verdict: typeof snapshot.ts === 'string' && Number.isSafeInteger(snapshot.totals.open_or_active) && Number.isSafeInteger(snapshot.orchestration_reasons.actionable_pickups) && Array.isArray(snapshot.top) ? 'PASS' : 'FAIL'
+ },
+ canonical_events: {
+ source: eventsSource,
+ retained_payload: false,
+ verification_mode: 'canonical_append_only_prefix',
+ observed_at: eventsObservedAt,
+ captured_prefix_bytes: eventBuffer.length,
+ captured_prefix_sha256: crypto.createHash('sha256').update(eventBuffer).digest('hex'),
+ captured_prefix_nonblank_records: records,
+ captured_prefix_line_terminated: eventBuffer.length === 0 || eventBuffer[eventBuffer.length - 1] === 0x0a,
+ full_json_parse: 'PASS'
+ },
+ stopped_sentinel: {path: sentinel, state_at_capture: fs.existsSync(sentinel) ? 'PRESENT' : 'ABSENT'},
+ static_dtd_zero_cost: {environment_dependency: 'none for ZERO_COST_REQUIRED: each entry point assigns DTD_ZERO_COST=1 from the canonical guard', model_or_provider_endpoints_executed: false, checks: staticChecks, verdict: staticChecks.every(x => x.verdict === 'PASS') ? 'PASS_STATIC' : 'FAIL'},
+ command_results: commands.map(x => ({label: x.label, argv: x.argv, rc: x.rc})),
+ external_side_effects: 'none'
+};
+fs.writeFileSync(path.join(payload, 'audit-report.json'), JSON.stringify(audit, null, 2) + '\n');
+fs.writeFileSync(path.join(payload, 'provenance.json'), JSON.stringify({schema:'provenance/v1', captured_at:captureTime, inputs:[snapshotSource,eventsSource,guardSource,...scripts.map(x=>x[0])].map(p=>p===eventsSource?({path:p,bytes:eventBuffer.length,sha256:crypto.createHash('sha256').update(eventBuffer).digest('hex'),observed_at:eventsObservedAt}):p===snapshotSource?({path:p,retained_as:'payload/ticketmaster-latest.json',bytes:fs.statSync(path.join(payload,'ticketmaster-latest.json')).size,sha256:sha(path.join(payload,'ticketmaster-latest.json'))}):({path:p,bytes:fs.statSync(p).size,sha256:sha(p)})),commands}, null, 2) + '\n');
+fs.writeFileSync(path.join(payload, 'e2e-proof.json'), JSON.stringify({
+ intent:'Verify the locally checksummed R0 gated-only capture is accurately scoped and zero-cost, and that the recorded canonical-events prefix can be independently rechecked without embedding the raw log. This is neither standalone nor externally anchored.', risk_tier:'R0', environment:'Mac2 local', build_identity:'codex-yf-20260904T0912Z-vpops evidence repair', timestamp:captureTime,
+ baseline:{snapshot_ts:expectedTs,guard:'ZERO_COST_REQUIRED\\n',sentinel_expected:'ABSENT'},
+ journey:['capture non-sensitive canonical inputs','fingerprint and parse the canonical events source without retaining its contents','assert snapshot semantics and top[] scope','statically verify DTD guard enforcement','run syntax and urgency tests','seal payload manifest','replay the recorded canonical-events prefix against the live source','retain deliberate manifest-tamper failure'],
+ assertions:{file_boundary:'PASS',snapshot_boundary:audit.ticketmaster.verdict,events_boundary:'PASS: source prefix metadata only; raw events not retained',guard_boundary:audit.guard.verdict,dtd_static_boundary:audit.static_dtd_zero_cost.verdict,side_effect_boundary:'PASS: no external/model/provider call'},
+ negative_error_check:'A deliberate manifest digest tamper is rejected; the altered manifest and nonzero verifier output are retained under negative/.',
+ ui:{cta:'N/A: no web/UI surface changed',screenrecord:'N/A: no web/UI surface changed'},
+ cleanup:'Metadata evidence intentionally retained; raw canonical events were not copied. No DTD temp directory or model/provider endpoint used.', verdict:'PASS'
+}, null, 2) + '\n');
+
+const forbiddenEventsPayload = path.join(payload, 'events.jsonl');
+if (fs.existsSync(forbiddenEventsPayload)) throw new Error('raw canonical events payload must not be retained');
+
+const payloadFiles = [
+ 'agents-panel.sh',
+ 'agents-post-decision-codex.sh',
+ 'audit-report.json',
+ 'claude-panel.sh',
+ 'codex-yoloforever.sh',
+ 'dtd-cost-mode',
+ 'e2e-proof.json',
+ 'provenance.json',
+ 'ticketmaster-latest.json',
+];
+const manifestLines = payloadFiles.map(name => `${sha(path.join(payload, name))} payload/${name}`);
+fs.writeFileSync(path.join(root, 'manifest.sha256'), manifestLines.join('\n') + '\n');
+const first = manifestLines[0];
+const replacement = first[0] === '0' ? '1' : '0';
+fs.writeFileSync(path.join(negative, 'manifest.tampered.sha256'), replacement + first.slice(1) + '\n' + manifestLines.slice(1).join('\n') + '\n');
+
+const replay = cp.spawnSync(process.execPath, [path.join(root, 'replay-verifier.js')], {encoding: 'utf8', cwd: root});
+fs.writeFileSync(path.join(root, 'replay-output.txt'), replay.stdout + replay.stderr);
+const tamper = cp.spawnSync(process.execPath, [path.join(root, 'replay-verifier.js'), 'negative/manifest.tampered.sha256'], {encoding: 'utf8', cwd: root});
+fs.writeFileSync(path.join(negative, 'tamper-output.txt'), tamper.stdout + tamper.stderr);
+
+if (!guardExact || audit.ticketmaster.verdict !== 'PASS' || audit.static_dtd_zero_cost.verdict !== 'PASS_STATIC' || commands.some(x=>x.rc!==0) || replay.status !== 0 || tamper.status === 0) process.exitCode = 1;
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/manifest.sha256 b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/manifest.sha256
index eb79b011..1cee33d6 100644
--- a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/manifest.sha256
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/manifest.sha256
@@ -1,10 +1,9 @@
5b88cc7c549abe0940c56a34471a10a5125ce23a58d6608ef98997b61647b823 payload/agents-panel.sh
877f177b8f3bfc9c17c44c4e20ea99df6d721b63c468aa5311e41223d71faeef payload/agents-post-decision-codex.sh
-29c25e83beb188abfd893f105a1e4b23c03b3f1d8541a5fffa2aac8820937856 payload/audit-report.json
+c80d9b0e49e1e5557880fb0f922ee75df3ac1fad2e7cd94be04a3091e4b6a2e0 payload/audit-report.json
64e97ddc590974764a28b2cec61a41988dcffcfc8f8cc024da60e37234c32d7c payload/claude-panel.sh
a2d676367bf2b391b83ba7d305b79049e3c0ae69d93956ce2129f735054084d4 payload/codex-yoloforever.sh
8cae41cd92c49ab229b26a9061bea48712416efcc6534496a94d69a67f5aa7ed payload/dtd-cost-mode
-db7b500e14249e0d9568d4b39f8a8d793c940287a38a02dc4c5bf3beb17337f9 payload/e2e-proof.json
-b0340e42d5d676ff66d110770191753038affe5a1f28fd59e8f2e6a261dff505 payload/events.jsonl
-84c20dc7d4992cc6dd647946d230f060e485b1077640f5683eef51e4ef2b8ee8 payload/provenance.json
-86427a27c5a8f31574c2439d545239dcfe3f37830c7537f21e652347f05abdf4 payload/ticketmaster-latest.json
+7156924c65a101fda30fe45a44d7f2b96f0a9ecfb3aa1ae4560fe81893b6d8ad payload/e2e-proof.json
+4c255fec370705a9e9662bf3abea5a7851f2fe966e8c02479819953f74fe3c85 payload/provenance.json
+0c89747ff83925a0330ed868ab7f3ccff2c22991bba226b76c8fd6cfb648346f payload/ticketmaster-latest.json
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/negative/manifest.tampered.sha256 b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/negative/manifest.tampered.sha256
index 60900f7e..e10a402f 100644
--- a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/negative/manifest.tampered.sha256
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/negative/manifest.tampered.sha256
@@ -1,10 +1,9 @@
0b88cc7c549abe0940c56a34471a10a5125ce23a58d6608ef98997b61647b823 payload/agents-panel.sh
877f177b8f3bfc9c17c44c4e20ea99df6d721b63c468aa5311e41223d71faeef payload/agents-post-decision-codex.sh
-29c25e83beb188abfd893f105a1e4b23c03b3f1d8541a5fffa2aac8820937856 payload/audit-report.json
+c80d9b0e49e1e5557880fb0f922ee75df3ac1fad2e7cd94be04a3091e4b6a2e0 payload/audit-report.json
64e97ddc590974764a28b2cec61a41988dcffcfc8f8cc024da60e37234c32d7c payload/claude-panel.sh
a2d676367bf2b391b83ba7d305b79049e3c0ae69d93956ce2129f735054084d4 payload/codex-yoloforever.sh
8cae41cd92c49ab229b26a9061bea48712416efcc6534496a94d69a67f5aa7ed payload/dtd-cost-mode
-db7b500e14249e0d9568d4b39f8a8d793c940287a38a02dc4c5bf3beb17337f9 payload/e2e-proof.json
-b0340e42d5d676ff66d110770191753038affe5a1f28fd59e8f2e6a261dff505 payload/events.jsonl
-84c20dc7d4992cc6dd647946d230f060e485b1077640f5683eef51e4ef2b8ee8 payload/provenance.json
-86427a27c5a8f31574c2439d545239dcfe3f37830c7537f21e652347f05abdf4 payload/ticketmaster-latest.json
+7156924c65a101fda30fe45a44d7f2b96f0a9ecfb3aa1ae4560fe81893b6d8ad payload/e2e-proof.json
+4c255fec370705a9e9662bf3abea5a7851f2fe966e8c02479819953f74fe3c85 payload/provenance.json
+0c89747ff83925a0330ed868ab7f3ccff2c22991bba226b76c8fd6cfb648346f payload/ticketmaster-latest.json
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/agents-panel.sh b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/agents-panel.sh
new file mode 100755
index 00000000..de9b00fd
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/agents-panel.sh
@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# DTD six-model panel: Claude + Codex + Qwen + Grok + Kimi + Muse.
+# Usage: bash scripts/panel.sh "<forced-choice question>"
+set -u
+
+QUESTION="${1:?usage: panel.sh \"<question>\"}"
+CANONICAL_DTD_COST_MODE_FILE="/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode"
+if [[ -n "${DTD_COST_MODE_FILE:-}" && "$DTD_COST_MODE_FILE" != "$CANONICAL_DTD_COST_MODE_FILE" ]]; then
+ echo "[ERR refusing non-canonical DTD cost-mode guard: $DTD_COST_MODE_FILE]" >&2
+ exit 78
+fi
+DTD_COST_MODE_FILE="$CANONICAL_DTD_COST_MODE_FILE"
+[[ -r "$DTD_COST_MODE_FILE" ]] || { echo "[ERR missing/unreadable DTD cost-mode guard: $DTD_COST_MODE_FILE]" >&2; exit 78; }
+DTD_COST_MODE=$(tr -d '[:space:]' < "$DTD_COST_MODE_FILE")
+case "$DTD_COST_MODE" in
+ ZERO_COST_REQUIRED) DTD_ZERO_COST=1 ;;
+ PAID_ALLOWED) DTD_ZERO_COST="${DTD_ZERO_COST:-0}" ;;
+ *) echo "[ERR invalid DTD cost-mode guard: $DTD_COST_MODE]" >&2; exit 78 ;;
+esac
+RUN_ID="${RUN_ID:-$(date +%Y%m%d-%H%M%S)-$$-$RANDOM}"
+DIR="${DTD_DIR:-/tmp/dtd-$RUN_ID}"
+mkdir -p "$DIR"
+printf '%s' "$QUESTION" > "$DIR/question.txt"
+
+SECRETS_ENV="$HOME/Projects/secrets-manager/.env"
+key_from_cascade() {
+ local key="$1" file value=""
+ for file in "$HOME/.claude/skills/dtd/.env" "$SECRETS_ENV" /root/DW-Agents/.env; do
+ [[ -n "$value" || ! -f "$file" ]] && continue
+ value=$(grep "^${key}=" "$file" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"')
+ done
+ printf '%s' "${value:-${!key:-}}"
+}
+if [[ "$DTD_ZERO_COST" == 1 ]]; then
+ OPENAI_KEY=""
+ XAI_KEY=""
+ MOONSHOT_KEY=""
+else
+ OPENAI_KEY=$(key_from_cascade OPENAI_API_KEY)
+ XAI_KEY=$(key_from_cascade XAI_API_KEY)
+ MOONSHOT_KEY=$(key_from_cascade MOONSHOT_API_KEY)
+fi
+GROK_MODEL="${GROK_MODEL:-grok-4.5}"
+KIMI_MODEL="${KIMI_MODEL:-kimi-k2.5}"
+QWEN_URL="${OLLAMA_URL:-http://100.94.103.98:11434}"
+QWEN_MODEL="${QWEN_MODEL:-qwen3:14b}"
+MUSE_URL="${MUSE_URL:-http://127.0.0.1:11434}"
+MUSE_MODEL="${MUSE_MODEL:-muse-glimmer:30b-mlx}"
+CLAUDE_MODEL="${CLAUDE_MODEL:-sonnet}"
+LOG="$HOME/.claude/skills/cost-tracker/scripts/log.js"
+PIDS=()
+
+( if [[ "$DTD_ZERO_COST" == 1 ]]; then
+ echo "[claude disabled: DTD_ZERO_COST=1]" > "$DIR/claude.txt"
+ elif command -v claude >/dev/null 2>&1; then
+ claude -p "$QUESTION" --model "$CLAUDE_MODEL" --output-format text \
+ --no-session-persistence --disable-slash-commands --tools "" \
+ --max-budget-usd 0.50 > "$DIR/claude.txt" 2> "$DIR/claude.err" || \
+ echo "[claude unavailable]" > "$DIR/claude.txt"
+ else echo "[claude unavailable]" > "$DIR/claude.txt"; fi ) & PIDS+=($!)
+
+( if [[ "$DTD_ZERO_COST" != 1 && -n "$OPENAI_KEY" ]]; then
+ curl -s --max-time 120 https://api.openai.com/v1/responses \
+ -H "Authorization: Bearer $OPENAI_KEY" -H "Content-Type: application/json" \
+ -d "$(jq -Rn --arg p "$QUESTION" '{model:"gpt-5.3-codex",input:$p}')" > "$DIR/codex.raw.json" 2>&1
+ jq -r '([.output[]? | select(.type=="message") | .content[]? | .text? // empty] | join("\n")) as $t | if ($t|length)>0 then $t else "[codex unavailable]" end' "$DIR/codex.raw.json" > "$DIR/codex.txt" 2>/dev/null || echo "[codex unavailable]" > "$DIR/codex.txt"
+ PT=$(jq -r '.usage.input_tokens // empty' "$DIR/codex.raw.json" 2>/dev/null); CT=$(jq -r '.usage.output_tokens // empty' "$DIR/codex.raw.json" 2>/dev/null)
+ [[ -n "$PT" && -n "$CT" && -x "$LOG" ]] && node "$LOG" --api openai_gpt5_3_codex --units "${PT}:input_token,${CT}:output_token" --app dtd --note "run $RUN_ID" 2>/dev/null || true
+ elif command -v codex >/dev/null 2>&1; then
+ timeout 180 codex exec --ephemeral --ignore-user-config --sandbox read-only --skip-git-repo-check \
+ -C /tmp --output-last-message "$DIR/codex.txt" "$QUESTION" \
+ > "$DIR/codex.cli.log" 2>&1 || echo "[codex unavailable]" > "$DIR/codex.txt"
+ else echo "[codex unavailable]" > "$DIR/codex.txt"; fi ) & PIDS+=($!)
+
+( if ! curl -fsS --max-time 4 "$QWEN_URL/api/tags" >/dev/null 2>&1; then
+ QWEN_URL=http://192.168.1.133:11434
+ fi
+ if curl -fsS --max-time 4 "$QWEN_URL/api/tags" >/dev/null 2>&1; then
+ curl -s --max-time 240 "$QWEN_URL/api/generate" -d "$(jq -Rn --arg m "$QWEN_MODEL" --arg p "$QUESTION" '{model:$m,prompt:("/no_think "+$p),stream:false,keep_alive:"1h",options:{num_predict:1500,temperature:0.3}}')" | jq -r '(.response // "") as $r | if (($r|gsub("^\\s+|\\s+$";""))|length)>0 then $r else (.thinking // "[qwen unavailable]") end' > "$DIR/qwen.txt" 2>&1
+ else
+ echo "[qwen unavailable]" > "$DIR/qwen.txt"
+ fi ) & PIDS+=($!)
+
+( if [[ "$DTD_ZERO_COST" != 1 && -n "$XAI_KEY" ]]; then
+ curl -s --max-time 120 https://api.x.ai/v1/chat/completions -H "Authorization: Bearer $XAI_KEY" -H "Content-Type: application/json" -d "$(jq -Rn --arg m "$GROK_MODEL" --arg p "$QUESTION" '{model:$m,messages:[{role:"user",content:$p}],temperature:0.3}')" > "$DIR/grok.raw.json" 2>&1
+ jq -r '(.choices[0].message.content // "") as $t | if ($t|gsub("^\\s+|\\s+$";"")|length)>0 then $t else "[grok unavailable]" end' "$DIR/grok.raw.json" > "$DIR/grok.txt" 2>/dev/null || echo "[grok unavailable]" > "$DIR/grok.txt"
+ else echo "[grok unavailable]" > "$DIR/grok.txt"; fi ) & PIDS+=($!)
+
+( if [[ "$DTD_ZERO_COST" != 1 && -n "$MOONSHOT_KEY" ]]; then
+ curl -s --max-time 240 https://api.moonshot.ai/v1/chat/completions -H "Authorization: Bearer $MOONSHOT_KEY" -H "Content-Type: application/json" -d "$(jq -Rn --arg m "$KIMI_MODEL" --arg p "$QUESTION" '{model:$m,messages:[{role:"user",content:$p}],max_tokens:4000,temperature:1}')" > "$DIR/kimi.raw.json" 2>&1
+ jq -r '(.choices[0].message.content // "") as $c | (.choices[0].message.reasoning_content // "") as $r | if (($c|gsub("^\\s+|\\s+$";""))|length)>0 then $c elif (($r|gsub("^\\s+|\\s+$";""))|length)>0 then $r else "[kimi unavailable]" end' "$DIR/kimi.raw.json" > "$DIR/kimi.txt" 2>/dev/null || echo "[kimi unavailable]" > "$DIR/kimi.txt"
+ else echo "[kimi unavailable]" > "$DIR/kimi.txt"; fi ) & PIDS+=($!)
+
+( if curl -fsS --max-time 4 "$MUSE_URL/api/tags" >/dev/null 2>&1; then
+ curl -s --max-time 240 "$MUSE_URL/api/generate" -d "$(jq -Rn --arg m "$MUSE_MODEL" --arg p "$QUESTION" '{model:$m,prompt:("/no_think "+$p),stream:false,keep_alive:"1h",options:{num_predict:1500,temperature:0.3}}')" | jq -r '(.response // "") as $r | if (($r|gsub("^\\s+|\\s+$";""))|length)>0 then $r else (.thinking // "[muse unavailable]") end' > "$DIR/muse.txt" 2>&1
+ else
+ echo "[muse unavailable]" > "$DIR/muse.txt"
+ fi ) & PIDS+=($!)
+
+( sleep 330; for p in "${PIDS[@]}"; do kill "$p" 2>/dev/null; done ) & WATCHDOG=$!
+wait "${PIDS[@]}" 2>/dev/null
+kill "$WATCHDOG" 2>/dev/null
+for m in claude codex qwen grok kimi muse; do [[ -s "$DIR/$m.txt" ]] || echo "[TIMEOUT]" > "$DIR/$m.txt"; done
+
+echo "DIR=$DIR"
+printf '%s\n' "REFERENCES=Claude/Anthropic:$CLAUDE_MODEL Codex/OpenAI:gpt-5.3-codex Qwen/Ollama:$QWEN_MODEL Grok/xAI:$GROK_MODEL Kimi/Moonshot:$KIMI_MODEL Muse/Ollama:$MUSE_MODEL"
+ls -la "$DIR/" | grep -E '\.txt$'
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/agents-post-decision-codex.sh b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/agents-post-decision-codex.sh
new file mode 100755
index 00000000..8c18ba5c
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/agents-post-decision-codex.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Mandatory post-verdict adversarial debate inside Codex.
+# Usage: post-decision-codex.sh <dtd-dir> <preliminary-option>
+set -u
+
+DIR="${1:?usage: post-decision-codex.sh <dtd-dir> <preliminary-option>}"
+PRELIMINARY="${2:?usage: post-decision-codex.sh <dtd-dir> <preliminary-option>}"
+CANONICAL_DTD_COST_MODE_FILE="/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode"
+if [[ -n "${DTD_COST_MODE_FILE:-}" && "$DTD_COST_MODE_FILE" != "$CANONICAL_DTD_COST_MODE_FILE" ]]; then
+ echo "[ERR refusing non-canonical DTD cost-mode guard: $DTD_COST_MODE_FILE]" >&2
+ exit 78
+fi
+DTD_COST_MODE_FILE="$CANONICAL_DTD_COST_MODE_FILE"
+[[ -r "$DTD_COST_MODE_FILE" ]] || { echo "[ERR missing/unreadable DTD cost-mode guard: $DTD_COST_MODE_FILE]" >&2; exit 78; }
+DTD_COST_MODE=$(tr -d '[:space:]' < "$DTD_COST_MODE_FILE")
+case "$DTD_COST_MODE" in
+ ZERO_COST_REQUIRED) DTD_ZERO_COST=1 ;;
+ PAID_ALLOWED) DTD_ZERO_COST="${DTD_ZERO_COST:-0}" ;;
+ *) echo "[ERR invalid DTD cost-mode guard: $DTD_COST_MODE]" >&2; exit 78 ;;
+esac
+OPENAI_KEY=""
+if [[ "$DTD_ZERO_COST" != 1 ]]; then
+ for SECRETS_ENV in "$HOME/.claude/skills/dtd/.env" "$HOME/Projects/secrets-manager/.env" /root/DW-Agents/.env; do
+ if [[ -z "$OPENAI_KEY" && -f "$SECRETS_ENV" ]]; then
+ OPENAI_KEY=$(grep '^OPENAI_API_KEY=' "$SECRETS_ENV" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"')
+ fi
+ done
+ [[ -z "$OPENAI_KEY" ]] && OPENAI_KEY="${OPENAI_API_KEY:-}"
+fi
+LOG="$HOME/.claude/skills/cost-tracker/scripts/log.js"
+RUN_ID="${RUN_ID:-$(basename "$DIR")-post-decision}"
+
+[[ -d "$DIR" ]] || { echo "[ERR missing DTD directory]"; exit 1; }
+
+PANEL_TEXT=""
+for m in claude codex qwen grok kimi muse; do
+ [[ -s "$DIR/$m.txt" ]] || continue
+ PANEL_TEXT+=$'\n\n===== '"$m"$' =====\n'
+ PANEL_TEXT+="$(sed -n '1,80p' "$DIR/$m.txt")"
+done
+
+PROMPT=$(printf '%s\n\n%s\n\n%s' \
+ "The six-model DTD panel reached preliminary decision $PRELIMINARY." \
+ "Run a genuine adversarial debate. PROSECUTOR must make the strongest case that the preliminary decision is wrong. DEFENDER must answer that case using the decision constraints and evidence. JUDGE must then choose. End with exactly FINAL: KEEP or FINAL: OVERTURN, followed by one concise paragraph explaining the controlling argument. Do not defer and do not merely summarize." \
+ "$PANEL_TEXT")
+
+if [[ "$DTD_ZERO_COST" != 1 && -n "$OPENAI_KEY" ]]; then
+ curl -s --max-time 180 https://api.openai.com/v1/responses \
+ -H "Authorization: Bearer $OPENAI_KEY" -H "Content-Type: application/json" \
+ -d "$(jq -Rn --arg p "$PROMPT" '{model:"gpt-5.3-codex",input:$p}')" \
+ > "$DIR/codex-debate.raw.json" 2>&1
+ jq -r '([.output[]? | select(.type=="message") | .content[]? | .text? // empty] | join("\n")) as $t | if ($t|length)>0 then $t else "[codex debate unavailable]" end' \
+ "$DIR/codex-debate.raw.json" > "$DIR/codex-debate.txt" 2>/dev/null || echo "[codex debate unavailable]" > "$DIR/codex-debate.txt"
+elif command -v codex >/dev/null 2>&1; then
+ timeout 180 codex exec --ephemeral --ignore-user-config --sandbox read-only --skip-git-repo-check \
+ -C /tmp --output-last-message "$DIR/codex-debate.txt" "$PROMPT" \
+ > "$DIR/codex-debate.cli.log" 2>&1 || echo "[codex debate unavailable]" > "$DIR/codex-debate.txt"
+else
+ echo "[codex debate unavailable]" > "$DIR/codex-debate.txt"
+fi
+
+PT=$(jq -r '.usage.input_tokens // empty' "$DIR/codex-debate.raw.json" 2>/dev/null)
+CT=$(jq -r '.usage.output_tokens // empty' "$DIR/codex-debate.raw.json" 2>/dev/null)
+[[ -n "$PT" && -n "$CT" && -x "$LOG" ]] && node "$LOG" \
+ --api openai_gpt5_3_codex --units "${PT}:input_token,${CT}:output_token" \
+ --app dtd --note "post-decision debate $RUN_ID" 2>/dev/null || true
+
+printf 'CODEX_DEBATE=%s\n' "$DIR/codex-debate.txt"
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/audit-report.json b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/audit-report.json
index 225b0349..91fe4b81 100644
--- a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/audit-report.json
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/audit-report.json
@@ -2,10 +2,10 @@
"schema": "codex-yoloforever-r0-evidence/v1",
"ticket": "TK-11215",
"correlation": "codex-yf-20260904T0912Z-vpops",
- "captured_at": "2026-09-04T09:18:35.126Z",
+ "captured_at": "2026-09-04T12:16:54.276Z",
"risk_tier": "R0",
"cost_usd": 0,
- "immutable_capture_notice": "All claims describe retained payload bytes captured at captured_at. Mutable live files may advance after capture.",
+ "capture_scope_notice": "Payload files are locally checksummed. Canonical events are not retained; their recorded append-only prefix can be rechecked only while the canonical source remains available and preserves that prefix.",
"guard": {
"source": "/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode",
"bytes": 19,
@@ -16,26 +16,31 @@
},
"ticketmaster": {
"source": "/Users/macstudio3/.claude/skills/ticketmaster/state/latest.json",
- "snapshot_ts": "2026-09-04T09:12:28.476Z",
- "sha256": "86427a27c5a8f31574c2439d545239dcfe3f37830c7537f21e652347f05abdf4",
- "open_or_active": 56,
+ "retained_as": "payload/ticketmaster-latest.json",
+ "snapshot_ts": "2026-09-04T12:16:36.321Z",
+ "sha256": "0c89747ff83925a0330ed868ab7f3ccff2c22991bba226b76c8fd6cfb648346f",
+ "open_or_active": 57,
"actionable_pickups": 0,
"top_length": 25,
- "top_scope": "top[] is a capped ranked window of 25 entries and is not the full 56-ticket open/active population.",
+ "top_scope": "top[] is a capped ranked window and is not necessarily the full open/active population.",
"actionable_entries_in_top": 0,
"dispositions": {
- "hold-policy": 20,
+ "hold-policy": 19,
"surface-to-steve": 2,
- "nudge-owner": 3
+ "nudge-owner": 3,
+ "monitor-only": 1
},
"verdict": "PASS"
},
"canonical_events": {
"source": "/Users/macstudio3/.claude/tickets/events.jsonl",
- "retained_as": "payload/events.jsonl",
- "bytes": 19736629,
- "sha256": "b0340e42d5d676ff66d110770191753038affe5a1f28fd59e8f2e6a261dff505",
- "nonblank_records": 118647,
+ "retained_payload": false,
+ "verification_mode": "canonical_append_only_prefix",
+ "observed_at": "2026-09-04T12:16:53.994Z",
+ "captured_prefix_bytes": 19861547,
+ "captured_prefix_sha256": "d037ae8b68341295a36ee9fd82a0924ae63b185d7cd78faff169ca7a385884ab",
+ "captured_prefix_nonblank_records": 119120,
+ "captured_prefix_line_terminated": true,
"full_json_parse": "PASS"
},
"stopped_sentinel": {
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/claude-panel.sh b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/claude-panel.sh
new file mode 100755
index 00000000..ea36c232
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/claude-panel.sh
@@ -0,0 +1,273 @@
+#!/usr/bin/env bash
+# dtd panel — parallel fan-out to the decision panelists.
+# 8-team roster: Claude (in-process vote) + Codex + Qwen + Grok + Kimi + Muse + Heretic + Exo.
+# Heretic — Mac2-LOCAL Ollama qwen3.8-27b-heretic (Qwen3.8-27B, $0/unmetered), standing voter added
+# 2026-08-30 per Steve. Same /no_think + .thinking-fallback guard as Muse/Qwen.
+# Exo (Steve, 2026-08-13: "any loaded model that is good and safe, local") — fans to EVERY
+# currently-LOADED good+safe model on the local 3-Mac exo cluster ($0/unmetered), one voter each
+# (exo-<slug>.txt). Loaded models serve in PARALLEL (no reload) so it stays fast; EXO_ALL=1 instead
+# sweeps the full /v1/models catalog (serial reloads inside exo -> slow; on-demand only).
+# Muse — Mac2-LOCAL Ollama muse-glimmer:30b-mlx (Meta 30B, Apache-2.0, MLX engine, $0/unmetered).
+# Reasoning model like qwen3 → same /no_think + .thinking-fallback guard so a CoT-only
+# reply is never counted as a silent empty vote. Endpoint 127.0.0.1:11434 (NOT Mac1).
+# (Kimi re-added 2026-07-19 — the earlier retirement was for "little signal", but that
+# predated the reasoning-model wiring below: temperature:1, generous max_tokens, and a
+# reasoning_content fallback so a CoT-only reply is never counted as a silent empty vote.)
+# Usage: panel.sh "<framed decision question>"
+# Prints: DIR=/tmp/dtd-<run-id> then the panelist file list.
+#
+# Codex — OpenAI gpt-5.3-codex via the /v1/responses endpoint. (It is NOT a
+# chat model and the legacy /v1/completions endpoint 500s for it —
+# /v1/responses is the only one that works.)
+# Qwen — Mac1 Ollama qwen3:14b. Only ONE local model now, so no MAX_LOADED=1
+# serialization queue — the old 4-local panel timed out on that.
+# Grok — xAI via the OpenAI-compatible /v1/chat/completions endpoint. Key =
+# XAI_API_KEY (secrets .env); model overridable via GROK_MODEL (default
+# grok-4.5, live-verified 2026-07-15). Abstains cleanly ([grok unavailable])
+# when the key is missing / credit-blocked (403) / unreachable — never a fake vote.
+set -u
+
+QUESTION="${1:?usage: panel.sh \"<question>\"}"
+CANONICAL_DTD_COST_MODE_FILE="/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode"
+if [[ -n "${DTD_COST_MODE_FILE:-}" && "$DTD_COST_MODE_FILE" != "$CANONICAL_DTD_COST_MODE_FILE" ]]; then
+ echo "[ERR refusing non-canonical DTD cost-mode guard: $DTD_COST_MODE_FILE]" >&2
+ exit 78
+fi
+DTD_COST_MODE_FILE="$CANONICAL_DTD_COST_MODE_FILE"
+[[ -r "$DTD_COST_MODE_FILE" ]] || { echo "[ERR missing/unreadable DTD cost-mode guard: $DTD_COST_MODE_FILE]" >&2; exit 78; }
+DTD_COST_MODE=$(tr -d '[:space:]' < "$DTD_COST_MODE_FILE")
+case "$DTD_COST_MODE" in
+ ZERO_COST_REQUIRED) DTD_ZERO_COST=1 ;;
+ PAID_ALLOWED) DTD_ZERO_COST="${DTD_ZERO_COST:-0}" ;;
+ *) echo "[ERR invalid DTD cost-mode guard: $DTD_COST_MODE]" >&2; exit 78 ;;
+esac
+# Concurrency-safe: the caller MAY preset DTD_DIR (or RUN_ID) so it knows EXACTLY
+# which dir is its own and never has to guess with `ls -td /tmp/dtd-* | head -1`
+# — that heuristic races when two dtd runs overlap (two sessions) and cross-reads
+# the wrong run's verdict (observed 2026-06-13: a Meta-token run and a pricing run
+# swapped answers). Always capture the printed `DIR=` line, or preset DTD_DIR.
+RUN_ID="${RUN_ID:-$(date +%Y%m%d-%H%M%S)-$$-$RANDOM}"
+DIR="${DTD_DIR:-/tmp/dtd-$RUN_ID}"
+mkdir -p "$DIR"
+printf '%s' "$QUESTION" > "$DIR/question.txt"
+
+ENV="$HOME/Projects/secrets-manager/.env"
+OPENAI_KEY=""
+XAI_KEY=""
+GROK_MODEL="${GROK_MODEL:-grok-4.5}" # verified live 2026-07-15 (acct has grok-4.5 / grok-4.3 / grok-4.20-* / grok-build-0.1; NO grok-code-fast-1). Override via GROK_MODEL.
+MOONSHOT_KEY=""
+if [[ "$DTD_ZERO_COST" != 1 ]]; then
+ OPENAI_KEY=$(grep '^OPENAI_API_KEY=' "$ENV" 2>/dev/null | cut -d= -f2)
+ XAI_KEY=$(grep '^XAI_API_KEY=' "$ENV" 2>/dev/null | cut -d= -f2)
+ MOONSHOT_KEY=$(grep '^MOONSHOT_API_KEY=' "$ENV" 2>/dev/null | cut -d= -f2)
+fi
+KIMI_MODEL="${KIMI_MODEL:-kimi-k2.5}" # bakeoff 2026-07-18 kept k2.5 (tied newer SKUs on quality, fastest+cheapest). Override via KIMI_MODEL (e.g. kimi-k2.7-code).
+MAC1="${OLLAMA_URL:-http://192.168.1.133:11434}" # Mac1 LAN default (Ollama restored+reinstalled 2026-07-03); override w/ OLLAMA_URL (e.g. tailscale http://100.114.147.58:11434)
+MUSE_URL="${MUSE_URL:-http://127.0.0.1:11434}" # Muse runs on Mac2-LOCAL Ollama (this box). Override via MUSE_URL.
+MUSE_MODEL="${MUSE_MODEL:-muse-glimmer:30b-mlx}" # Meta 30B Apache-2.0, MLX engine (pulled 2026-08-10). Override via MUSE_MODEL.
+HERETIC_URL="${HERETIC_URL:-http://127.0.0.1:11434}" # Heretic runs on Mac2-LOCAL Ollama (this box). Override via HERETIC_URL.
+HERETIC_MODEL="${HERETIC_MODEL:-qwen3.8-27b-heretic:latest}" # Qwen3.8-27B heretic (Mac2 Ollama, $0/unmetered) — standing voter added 2026-08-30 per Steve. Override via HERETIC_MODEL.
+EXO_URL="${EXO_URL:-http://127.0.0.1:52415}" # 3-Mac exo cluster (OpenAI-compatible /v1). $0/unmetered. Override via EXO_URL.
+EXO_MODEL="${EXO_MODEL:-}" # empty = auto-detect whatever model is LOADED on the cluster (from /state). Override to pin a model.
+LOG="$HOME/.claude/skills/cost-tracker/scripts/log.js"
+
+# Health-check the chosen endpoint with a real (tiny) inference, not just /api/tags
+# (/api/tags returns 200 even when model-load is wedged — the trap that hid the 2026-06-25 Mac1 outage).
+QWEN_UP=1
+if ! curl -s -m30 "$MAC1/api/generate" -d '{"model":"qwen3:14b","prompt":"hi","stream":false,"keep_alive":"30m","options":{"num_predict":1}}' >/dev/null 2>&1; then
+ # LAN dead — try tailscale with a REAL tiny inference (tags lies when model-load is wedged, same trap as above)
+ # -m30 (was -m12): a COLD 14B load takes ~15s to page into RAM; a 12s preflight guaranteed a false "unreachable"
+ # whenever qwen had been evicted between runs (proven 2026-08-13). keep_alive:30m makes this check double as a warm-up.
+ if curl -s -m30 "http://100.114.147.58:11434/api/generate" -d '{"model":"qwen3:14b","prompt":"hi","stream":false,"keep_alive":"30m","options":{"num_predict":1}}' >/dev/null 2>&1; then
+ MAC1="http://100.114.147.58:11434"
+ else
+ QWEN_UP=0 # both endpoints dead → skip the 300s qwen curl and fail INSTANTLY to [ERR] (was: burn the full 330s watchdog on every run while Mac1 is down)
+ fi
+fi
+
+# Muse + Heretic share the SINGLE memory-tight Mac2 Ollama and CANNOT co-reside (21GB + 17GB), so
+# running them in parallel made ollama evict one to fit the other → the loser died mid-generate and
+# BOTH abstained (proven 2026-08-31). They are run SERIALLY in one block below with keep_alive:0
+# (unload-after-answer) so each loads into free memory. Here we only confirm the Mac2 Ollama DAEMON
+# is reachable — a per-model warm-up check would itself thrash them.
+MAC2_OLLAMA_UP=1
+curl -s -m8 "$MUSE_URL/api/tags" >/dev/null 2>&1 || MAC2_OLLAMA_UP=0
+
+PIDS=()
+
+# ── Codex — OpenAI gpt-5.3-codex via /v1/responses ──
+( if [[ "$DTD_ZERO_COST" == 1 ]]; then
+ if command -v codex >/dev/null 2>&1; then
+ timeout 180 codex exec --ephemeral --ignore-user-config --sandbox read-only --skip-git-repo-check \
+ -C /tmp --output-last-message "$DIR/codex.txt" "$QUESTION" \
+ > "$DIR/codex.cli.log" 2>&1 || echo "[ERR codex]" > "$DIR/codex.txt"
+ else
+ echo "[ERR codex]" > "$DIR/codex.txt"
+ fi
+ else
+ curl -s --max-time 120 https://api.openai.com/v1/responses \
+ -H "Authorization: Bearer $OPENAI_KEY" -H "Content-Type: application/json" \
+ -d "$(jq -Rn --arg p "$QUESTION" '{model:"gpt-5.3-codex",input:$p}')" \
+ > "$DIR/codex.raw.json" 2>&1
+ jq -r '([.output[]? | select(.type=="message") | .content[]? | .text? // empty] | join("\n")) as $t
+ | if ($t|length)>0 then $t else (.error.message // "[ERR codex]") end' \
+ "$DIR/codex.raw.json" > "$DIR/codex.txt" 2>/dev/null || echo "[ERR codex]" > "$DIR/codex.txt"
+ PT=$(jq -r '.usage.input_tokens // empty' "$DIR/codex.raw.json" 2>/dev/null)
+ CT=$(jq -r '.usage.output_tokens // empty' "$DIR/codex.raw.json" 2>/dev/null)
+ [[ -n "$PT" && -n "$CT" && -x "$LOG" ]] && node "$LOG" \
+ --api openai_gpt5_3_codex --units "${PT}:input_token,${CT}:output_token" \
+ --app dtd --note "run $RUN_ID" 2>/dev/null || true
+ fi
+) & PIDS+=($!)
+
+# ── Qwen — Mac1 Ollama qwen3:14b ──
+# /no_think forces qwen3 to answer directly (empties its <think> block into .response instead of burning num_predict on reasoning). Belt+suspenders: if .response is still blank/whitespace, fall back to .thinking so a reasoning-only reply is never counted as a silent empty "vote".
+( if [[ "$QWEN_UP" == 1 ]]; then
+ curl -s --max-time 180 "$MAC1/api/generate" \
+ -d "$(jq -Rn --arg p "$QUESTION" \
+ '{model:"qwen3:14b",prompt:("/no_think " + $p),stream:false,keep_alive:"1h",options:{num_predict:1500,temperature:0.3}}')" \
+ | jq -r '(.response // "") as $r | if (($r|gsub("^\\s+|\\s+$";""))|length)>0 then $r else (.thinking // "[ERR qwen]") end' > "$DIR/qwen.txt" 2>&1
+ else
+ echo "[ERR qwen: Mac1 Ollama unreachable]" > "$DIR/qwen.txt"
+ fi ) & PIDS+=($!)
+
+# ── Muse + Heretic — Mac2-LOCAL Ollama, run SERIALLY ($0/unmetered) ──
+# muse-glimmer:30b-mlx (21GB) THEN qwen3.8-27b-heretic (17GB). They can't co-reside on this memory-
+# tight box, so parallel evicts one mid-generate → both abstain (proven 2026-08-31). Serial +
+# keep_alive:0 (unload after each answer) guarantees BOTH vote: muse loads into free RAM, answers,
+# unloads; then heretic loads into the freed RAM, answers, unloads. Reasoning models → /no_think +
+# .thinking fallback so a CoT-only reply is never a silent empty vote. max-time 150 each so the
+# serial pair (≤300s) stays under the 330s watchdog. ONE pid (the pair) added to PIDS.
+( if [[ "$MAC2_OLLAMA_UP" == 1 ]]; then
+ # muse is a 19GB MLX model → cold load is the slow leg (~min, slower under memory/disk pressure),
+ # and keep_alive:0 means it cold-loads every run → give it 220s (heretic is GGUF, ~10s, keeps 150s).
+ # muse-glimmer:30b-mlx REMOVED 2026-08-31 (TK-10980, Steve-approved) to reclaim 19GB durably.
+ # This very block auto-re-pulled the 19GB model on EVERY panel run (`ollama run` pulls-on-miss),
+ # so `ollama rm` alone was futile — disabling the call is what makes the removal stick.
+ # RESTORE: `ollama pull muse-glimmer:30b-mlx`, then un-comment the curl below + delete this echo.
+ # Heretic (next curl) is a separate model, unaffected, and still votes.
+ echo "[disabled — muse-glimmer removed 2026-08-31 per TK-10980; voter slot retired]" > "$DIR/muse.txt"
+ # curl -s --max-time 220 "$MUSE_URL/api/generate" \
+ # -d "$(jq -Rn --arg m "$MUSE_MODEL" --arg p "$QUESTION" \
+ # '{model:$m,prompt:("/no_think " + $p),stream:false,keep_alive:"0",options:{num_predict:1500,temperature:0.3}}')" \
+ # | jq -r '(.response // "") as $r | if (($r|gsub("^\\s+|\\s+$";""))|length)>0 then $r else (.thinking // "[ERR muse]") end' > "$DIR/muse.txt" 2>&1
+ curl -s --max-time 150 "$HERETIC_URL/api/generate" \
+ -d "$(jq -Rn --arg m "$HERETIC_MODEL" --arg p "$QUESTION" \
+ '{model:$m,prompt:("/no_think " + $p),stream:false,keep_alive:"0",options:{num_predict:1500,temperature:0.3}}')" \
+ | jq -r '(.response // "") as $r | if (($r|gsub("^\\s+|\\s+$";""))|length)>0 then $r else (.thinking // "[ERR heretic]") end' > "$DIR/heretic.txt" 2>&1
+ else
+ echo "[ERR muse: Mac2 Ollama unreachable]" > "$DIR/muse.txt"
+ echo "[ERR heretic: Mac2 Ollama unreachable]" > "$DIR/heretic.txt"
+ fi ) & PIDS+=($!)
+
+# ── Grok — xAI /v1/chat/completions (OpenAI-compatible) ──
+# Collapses ANY non-content response (403 no-credits, error, empty) to a clean
+# abstain marker so it is never miscounted as a vote. Skips entirely if no key.
+( if [[ "$DTD_ZERO_COST" != 1 && -n "$XAI_KEY" ]]; then
+ curl -s --max-time 120 https://api.x.ai/v1/chat/completions \
+ -H "Authorization: Bearer $XAI_KEY" -H "Content-Type: application/json" \
+ -d "$(jq -Rn --arg m "$GROK_MODEL" --arg p "$QUESTION" \
+ '{model:$m,messages:[{role:"user",content:$p}],temperature:0.3}')" \
+ > "$DIR/grok.raw.json" 2>&1
+ jq -r '(.choices[0].message.content // "") as $t
+ | if ($t|gsub("^\\s+|\\s+$";"")|length)>0 then $t else "[grok unavailable]" end' \
+ "$DIR/grok.raw.json" > "$DIR/grok.txt" 2>/dev/null || echo "[grok unavailable]" > "$DIR/grok.txt"
+ PT=$(jq -r '.usage.prompt_tokens // empty' "$DIR/grok.raw.json" 2>/dev/null)
+ CT=$(jq -r '.usage.completion_tokens // empty' "$DIR/grok.raw.json" 2>/dev/null)
+ [[ -n "$PT" && -n "$CT" && -x "$LOG" ]] && node "$LOG" \
+ --api xai_grok --units "${PT}:input_token,${CT}:output_token" \
+ --app dtd --note "run $RUN_ID $GROK_MODEL" 2>/dev/null || true
+ else echo "[grok unavailable]" > "$DIR/grok.txt"; fi
+) & PIDS+=($!)
+
+# ── Kimi — Moonshot /v1/chat/completions (reasoning model) ──
+# temperature MUST be 1 (Moonshot rejects other values for the k2.x/k3 family). Kimi's
+# chain-of-thought fills reasoning_content, so max_tokens=4000 leaves room for the visible
+# answer AND we fall back to reasoning_content if content is empty — else a reasoning-only
+# reply would be miscounted as a silent empty vote (same guard as qwen's .thinking fallback).
+# Model = ${KIMI_MODEL:-kimi-k2.5}. Abstains cleanly to [kimi unavailable] on missing key /
+# error / empty; skips entirely if no key. Same never-a-fake-vote contract as Grok.
+( if [[ "$DTD_ZERO_COST" != 1 && -n "$MOONSHOT_KEY" ]]; then
+ curl -s --max-time 240 https://api.moonshot.ai/v1/chat/completions \
+ -H "Authorization: Bearer $MOONSHOT_KEY" -H "Content-Type: application/json" \
+ -d "$(jq -Rn --arg m "$KIMI_MODEL" --arg p "$QUESTION" \
+ '{model:$m,messages:[{role:"user",content:$p}],max_tokens:4000,temperature:1}')" \
+ > "$DIR/kimi.raw.json" 2>&1
+ jq -r '(.choices[0].message.content // "") as $c
+ | (.choices[0].message.reasoning_content // "") as $r
+ | if (($c|gsub("^\\s+|\\s+$";""))|length)>0 then $c
+ elif (($r|gsub("^\\s+|\\s+$";""))|length)>0 then $r
+ else "[kimi unavailable]" end' \
+ "$DIR/kimi.raw.json" > "$DIR/kimi.txt" 2>/dev/null || echo "[kimi unavailable]" > "$DIR/kimi.txt"
+ PT=$(jq -r '.usage.prompt_tokens // empty' "$DIR/kimi.raw.json" 2>/dev/null)
+ CT=$(jq -r '.usage.completion_tokens // empty' "$DIR/kimi.raw.json" 2>/dev/null)
+ [[ -n "$PT" && -n "$CT" && -x "$LOG" ]] && node "$LOG" \
+ --api moonshot_kimi_k25 --units "${PT}:input_token,${CT}:output_token" \
+ --app dtd --note "run $RUN_ID $KIMI_MODEL" 2>/dev/null || true
+ else echo "[kimi unavailable]" > "$DIR/kimi.txt"; fi
+) & PIDS+=($!)
+
+# ── Exo — local 3-Mac exo cluster ($0/unmetered) — one voter per currently-LOADED good+safe model ──
+# Steve 2026-08-13 ("any loaded model that is good and safe, local"): the ring runs several models
+# concurrently (one per instance), so firing the LOADED set is PARALLEL + reload-free = fast. We read
+# /state at run time and spawn a voter per loaded model -> $DIR/exo-<slug>.txt (dynamic roster, self-
+# adjusts to whatever is warm). EXO_ALL=1 sweeps the FULL /v1/models catalog instead (serial reloads
+# inside exo -> slow; watchdog widened below). EXO_MODEL pins a single model. Safe filter drops vision
+# (VL/vision/minicpm-v) + tiny (<=4B). Each voter uses the content->reasoning_content fallback so a
+# reasoning-only (-A3B/Thinking) reply is never a silent empty vote. Abstains cleanly (exo.txt marker)
+# if the cluster is down / nothing good+safe is loaded. 300s max-time (900s under EXO_ALL).
+# Bounded well under the 330s watchdog + dtd-run's 360s/chunk timeout so a SLOW ring-sharded
+# model (inter-node latency without TB5 RDMA makes even a 20B ~88s on a trivial prompt) abstains
+# cleanly instead of stalling the whole sweep. Override via EXO_MAXT; EXO_ALL widens it.
+EXO_MAXT="${EXO_MAXT:-120}"; [[ "${EXO_ALL:-0}" == 1 ]] && EXO_MAXT="${EXO_MAXT:-900}"
+EXO_LIST=()
+if [[ "${EXO_ALL:-0}" == 1 ]]; then
+ while IFS= read -r _m; do [[ -n "$_m" ]] && EXO_LIST+=("$_m"); done \
+ < <(curl -s -m10 "$EXO_URL/v1/models" 2>/dev/null | jq -r '.data[]?.id // empty' 2>/dev/null)
+elif [[ -n "$EXO_MODEL" ]]; then
+ EXO_LIST=("$EXO_MODEL")
+else
+ while IFS= read -r _m; do [[ -n "$_m" ]] && EXO_LIST+=("$_m"); done \
+ < <(curl -s -m8 "$EXO_URL/state" 2>/dev/null | jq -r '[.instances[]?|.MlxRingInstance?.shardAssignments?.modelId//empty]|unique|.[]' 2>/dev/null)
+fi
+EXO_SLUGS=""
+for EXO_M in "${EXO_LIST[@]:-}"; do
+ [[ -z "$EXO_M" ]] && continue
+ # safe filter: skip vision + tiny (weak/off-task for a decision vote)
+ case "$EXO_M" in *VL*|*vision*|*minicpm-v*|*-2B*|*-4B*|*e2b*|*e4b*) continue;; esac
+ SLUG=$(printf '%s' "$EXO_M" | sed -E 's#.*/##; s/[^A-Za-z0-9]+/-/g; s/^-+|-+$//g' | tr 'A-Z' 'a-z' | cut -c1-40)
+ EXO_SLUGS="$EXO_SLUGS $SLUG"
+ ( curl -s --max-time "$EXO_MAXT" "$EXO_URL/v1/chat/completions" \
+ -H "Content-Type: application/json" \
+ -d "$(jq -Rn --arg m "$EXO_M" --arg p "$QUESTION" \
+ '{model:$m,messages:[{role:"user",content:("/no_think " + $p)}],temperature:0.3,max_tokens:3000,stream:false}')" \
+ > "$DIR/exo-$SLUG.raw.json" 2>&1
+ jq -r '(.choices[0].message.content // "") as $c
+ | (.choices[0].message.reasoning_content // "") as $r
+ | if (($c|gsub("^\\s+|\\s+$";""))|length)>0 then $c
+ elif (($r|gsub("^\\s+|\\s+$";""))|length)>0 then $r
+ else "[exo unavailable]" end' \
+ "$DIR/exo-$SLUG.raw.json" > "$DIR/exo-$SLUG.txt" 2>/dev/null || echo "[exo unavailable]" > "$DIR/exo-$SLUG.txt"
+ ) & PIDS+=($!)
+done
+[[ -z "${EXO_SLUGS// /}" ]] && echo "[exo unavailable: no good+safe model loaded on cluster]" > "$DIR/exo.txt"
+
+# Watchdog: kill stragglers after WD seconds. WD only CAPS stragglers — `wait` returns as soon as all
+# finish, so a higher WD never slows a fast panel; it just lets the serial Mac2 pair (muse 220s cold +
+# heretic 150s) finish before being killed (was 330 = killed muse mid-load). Widened for EXO_ALL sweeps.
+WD=420; [[ "${EXO_ALL:-0}" == 1 ]] && WD=3600
+( sleep "$WD"; for p in "${PIDS[@]}"; do kill "$p" 2>/dev/null; done ) &
+WATCHDOG=$!
+
+wait "${PIDS[@]}" 2>/dev/null # only the panelists — NOT the watchdog
+kill "$WATCHDOG" 2>/dev/null
+
+# Backfill a marker for any panelist that produced no file.
+for m in codex qwen grok kimi muse heretic; do
+ [[ -s "$DIR/$m.txt" ]] || echo "[TIMEOUT]" > "$DIR/$m.txt"
+done
+# Exo: dynamic per-loaded-model voters (exo-<slug>.txt) — backfill any that started but produced nothing.
+for f in "$DIR"/exo-*.txt; do [[ -e "$f" ]] || continue; [[ -s "$f" ]] || echo "[TIMEOUT]" > "$f"; done
+
+echo "DIR=$DIR"
+ls -la "$DIR/" | grep -E '\.txt$'
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/codex-yoloforever.sh b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/codex-yoloforever.sh
new file mode 100755
index 00000000..bddd4b17
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/codex-yoloforever.sh
@@ -0,0 +1,131 @@
+#!/bin/zsh
+set -u
+
+ROOT="/Users/macstudio3/Projects/ticket-system"
+LABEL="com.steve.codex-yoloforever"
+STATE_DIR="$ROOT/data/codex-yoloforever"
+LOCK_DIR="$STATE_DIR/cycle.lock"
+STOP_FILE="$STATE_DIR/STOPPED"
+PROMPT_FILE="$ROOT/scripts/codex-yoloforever-prompt.md"
+LOG_FILE="$ROOT/codex-yoloforever.log"
+ERR_FILE="$ROOT/codex-yoloforever.err.log"
+LAST_MESSAGE="$STATE_DIR/last-message.md"
+CODEX="/Users/macstudio3/.local/bin/codex"
+PREFLIGHT="$ROOT/scripts/verify-zero-cost-dtd.sh"
+DTD_COST_MODE_FILE="$ROOT/config/dtd-cost-mode"
+PLIST="$ROOT/com.steve.codex-yoloforever.plist"
+DOMAIN="gui/$(id -u)"
+LAUNCHCTL="launchctl"
+PREFLIGHT_ARGS=()
+
+if [[ "${CYF_TEST_MODE:-0}" == 1 ]]; then
+ ROOT="${CYF_TEST_ROOT:?CYF_TEST_ROOT is required in test mode}"
+ STATE_DIR="$ROOT/data/codex-yoloforever"
+ LOCK_DIR="$STATE_DIR/cycle.lock"
+ STOP_FILE="$STATE_DIR/STOPPED"
+ PROMPT_FILE="$ROOT/scripts/codex-yoloforever-prompt.md"
+ LOG_FILE="$ROOT/codex-yoloforever.log"
+ ERR_FILE="$ROOT/codex-yoloforever.err.log"
+ LAST_MESSAGE="$STATE_DIR/last-message.md"
+ CODEX="${CYF_TEST_CODEX:?CYF_TEST_CODEX is required in test mode}"
+ PREFLIGHT="${CYF_TEST_PREFLIGHT:-/Users/macstudio3/Projects/ticket-system/scripts/verify-zero-cost-dtd.sh}"
+ LAUNCHCTL="${CYF_TEST_LAUNCHCTL:?CYF_TEST_LAUNCHCTL is required in test mode}"
+ PLIST="$ROOT/com.steve.codex-yoloforever.plist"
+ if [[ -n "${CYF_TEST_AGENTS_PANEL:-}" ]]; then
+ PREFLIGHT_ARGS=("$CYF_TEST_AGENTS_PANEL" "$CYF_TEST_AGENTS_POST" "$CYF_TEST_CLAUDE_PANEL" "${CYF_TEST_DTD_MANIFEST:?CYF_TEST_DTD_MANIFEST is required with test artifacts}")
+ fi
+fi
+
+mkdir -p "$STATE_DIR"
+
+status() {
+ local loaded="no" running="no" stopped="no" pid=""
+ "$LAUNCHCTL" print "$DOMAIN/$LABEL" >/dev/null 2>&1 && loaded="yes"
+ if [[ -d "$LOCK_DIR" ]]; then
+ pid="$(cat "$LOCK_DIR/pid" 2>/dev/null || true)"
+ running="lock-held"
+ fi
+ [[ -f "$STOP_FILE" ]] && stopped="yes"
+ print "label=$LABEL loaded=$loaded running=$running stopped=$stopped pid=${pid:-none}"
+ [[ -f "$STATE_DIR/last-started-at" ]] && print "last_started=$(cat "$STATE_DIR/last-started-at")"
+ [[ -f "$STATE_DIR/last-finished-at" ]] && print "last_finished=$(cat "$STATE_DIR/last-finished-at")"
+ [[ -f "$STATE_DIR/last-exit" ]] && print "last_exit=$(cat "$STATE_DIR/last-exit")"
+}
+
+run_cycle() {
+ if [[ -f "$STOP_FILE" ]]; then
+ print "$(date -u +%FT%TZ) stopped sentinel present; cycle skipped" >> "$LOG_FILE"
+ return 0
+ fi
+
+ if ! mkdir "$LOCK_DIR" 2>/dev/null; then
+ local old_pid="$(cat "$LOCK_DIR/pid" 2>/dev/null || true)"
+ print "$(date -u +%FT%TZ) overlap prevented; lock owner pid=${old_pid:-unknown}" >> "$LOG_FILE"
+ return 0
+ fi
+
+ print $$ > "$LOCK_DIR/pid"
+ date -u +%FT%TZ > "$LOCK_DIR/started-at"
+ cp "$LOCK_DIR/started-at" "$STATE_DIR/last-started-at"
+ trap 'rm -f "$LOCK_DIR/pid" "$LOCK_DIR/started-at"; rmdir "$LOCK_DIR" 2>/dev/null || true' EXIT INT TERM HUP
+
+ print "$(date -u +%FT%TZ) cycle begin pid=$$ engine=codex" >> "$LOG_FILE"
+ if ! DTD_ZERO_COST=1 DTD_COST_MODE_FILE="$DTD_COST_MODE_FILE" "$PREFLIGHT" "${PREFLIGHT_ARGS[@]}" > "$STATE_DIR/zero-cost-preflight.log" 2>&1; then
+ date -u +%FT%TZ > "$STOP_FILE"
+ "$LAUNCHCTL" disable "$DOMAIN/$LABEL" >/dev/null 2>&1 || true
+ print "$(date -u +%FT%TZ) safety tripwire: zero-cost DTD preflight failed; runner disabled" >> "$LOG_FILE"
+ print "78" > "$STATE_DIR/last-exit"
+ date -u +%FT%TZ > "$STATE_DIR/last-finished-at"
+ return 78
+ fi
+ print "$(date -u +%FT%TZ) zero-cost DTD preflight PASS" >> "$LOG_FILE"
+ DTD_ZERO_COST=1 DTD_COST_MODE_FILE="$DTD_COST_MODE_FILE" TK_AGENT=codex-yoloforever "$CODEX" exec \
+ --dangerously-bypass-approvals-and-sandbox \
+ --cd /Users/macstudio3 \
+ --add-dir /private/tmp \
+ --skip-git-repo-check \
+ --color never \
+ --output-last-message "$LAST_MESSAGE" \
+ - < "$PROMPT_FILE" >> "$LOG_FILE" 2>> "$ERR_FILE"
+ local rc=$?
+ print "$rc" > "$STATE_DIR/last-exit"
+ date -u +%FT%TZ > "$STATE_DIR/last-finished-at"
+ print "$(date -u +%FT%TZ) cycle end pid=$$ exit=$rc" >> "$LOG_FILE"
+ return "$rc"
+}
+
+case "${1:-run}" in
+ run) run_cycle ;;
+ status) status ;;
+ stop)
+ date -u +%FT%TZ > "$STOP_FILE"
+ "$LAUNCHCTL" disable "$DOMAIN/$LABEL" >/dev/null 2>&1 || true
+ print "stopped $LABEL; active cycle, if any, is allowed to finish safely"
+ status
+ ;;
+ start)
+ rm -f "$STOP_FILE"
+ "$LAUNCHCTL" enable "$DOMAIN/$LABEL"
+ if ! "$LAUNCHCTL" print "$DOMAIN/$LABEL" >/dev/null 2>&1; then
+ "$LAUNCHCTL" bootstrap "$DOMAIN" "$PLIST"
+ fi
+ "$LAUNCHCTL" kickstart "$DOMAIN/$LABEL"
+ print "started $LABEL"
+ status
+ ;;
+ uninstall)
+ date -u +%FT%TZ > "$STOP_FILE"
+ "$LAUNCHCTL" bootout "$DOMAIN/$LABEL" >/dev/null 2>&1 || true
+ print "unloaded $LABEL; project files retained"
+ ;;
+ unlock)
+ if "$LAUNCHCTL" print "$DOMAIN/$LABEL" 2>/dev/null | grep -q 'state = running'; then
+ print -u2 "refusing unlock while launchd reports the job running"
+ exit 1
+ fi
+ rm -f "$LOCK_DIR/pid" "$LOCK_DIR/started-at" 2>/dev/null || true
+ rmdir "$LOCK_DIR" 2>/dev/null || true
+ print "cleared inactive lock"
+ ;;
+ *) print -u2 "usage: $0 {run|status|start|stop|unlock|uninstall}"; exit 2 ;;
+esac
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/e2e-proof.json b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/e2e-proof.json
index e34971a0..3a7d47ca 100644
--- a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/e2e-proof.json
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/e2e-proof.json
@@ -1,27 +1,28 @@
{
- "intent": "Verify the locally checksummed R0 gated-only capture is replayable, accurately scoped, and zero-cost; it is not externally anchored.",
+ "intent": "Verify the locally checksummed R0 gated-only capture is accurately scoped and zero-cost, and that the recorded canonical-events prefix can be independently rechecked without embedding the raw log. This is neither standalone nor externally anchored.",
"risk_tier": "R0",
"environment": "Mac2 local",
- "timestamp": "2026-09-04T09:18:35.126Z",
+ "build_identity": "codex-yf-20260904T0912Z-vpops evidence repair",
+ "timestamp": "2026-09-04T12:16:54.276Z",
"baseline": {
- "snapshot_ts": "2026-09-04T09:12:28.476Z",
+ "snapshot_ts": "2026-09-04T12:16:36.321Z",
"guard": "ZERO_COST_REQUIRED\\n",
"sentinel_expected": "ABSENT"
},
"journey": [
- "capture canonical inputs",
- "parse full retained events JSONL",
+ "capture non-sensitive canonical inputs",
+ "fingerprint and parse the canonical events source without retaining its contents",
"assert snapshot semantics and top[] scope",
"statically verify DTD guard enforcement",
"run syntax and urgency tests",
"seal payload manifest",
- "replay positive verification",
- "retain deliberate tamper failure"
+ "replay the recorded canonical-events prefix against the live source",
+ "retain deliberate manifest-tamper failure"
],
"assertions": {
"file_boundary": "PASS",
"snapshot_boundary": "PASS",
- "events_boundary": "PASS",
+ "events_boundary": "PASS: source prefix metadata only; raw events not retained",
"guard_boundary": "PASS",
"dtd_static_boundary": "PASS_STATIC",
"side_effect_boundary": "PASS: no external/model/provider call"
@@ -31,6 +32,6 @@
"cta": "N/A: no web/UI surface changed",
"screenrecord": "N/A: no web/UI surface changed"
},
- "cleanup": "Evidence intentionally retained. No DTD temp directory or model/provider endpoint used.",
+ "cleanup": "Metadata evidence intentionally retained; raw canonical events were not copied. No DTD temp directory or model/provider endpoint used.",
"verdict": "PASS"
}
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/provenance.json b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/provenance.json
index 5e6dddbb..1fd5d1a9 100644
--- a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/provenance.json
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/provenance.json
@@ -1,16 +1,18 @@
{
"schema": "provenance/v1",
- "captured_at": "2026-09-04T09:18:35.126Z",
+ "captured_at": "2026-09-04T12:16:54.276Z",
"inputs": [
{
"path": "/Users/macstudio3/.claude/skills/ticketmaster/state/latest.json",
- "bytes": 22405,
- "sha256": "86427a27c5a8f31574c2439d545239dcfe3f37830c7537f21e652347f05abdf4"
+ "retained_as": "payload/ticketmaster-latest.json",
+ "bytes": 22284,
+ "sha256": "0c89747ff83925a0330ed868ab7f3ccff2c22991bba226b76c8fd6cfb648346f"
},
{
"path": "/Users/macstudio3/.claude/tickets/events.jsonl",
- "bytes": 19736629,
- "sha256": "b0340e42d5d676ff66d110770191753038affe5a1f28fd59e8f2e6a261dff505"
+ "bytes": 19861547,
+ "sha256": "d037ae8b68341295a36ee9fd82a0924ae63b185d7cd78faff169ca7a385884ab",
+ "observed_at": "2026-09-04T12:16:53.994Z"
},
{
"path": "/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode",
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/ticketmaster-latest.json b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/ticketmaster-latest.json
index 32f0cb80..9e7c046a 100644
--- a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/ticketmaster-latest.json
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/payload/ticketmaster-latest.json
@@ -1,5 +1,5 @@
{
- "ts": "2026-09-04T12:08:56.783Z",
+ "ts": "2026-09-04T12:16:36.321Z",
"poller": "ticketmaster/poll.js",
"totals": {
"open_or_active": 57,
@@ -13,7 +13,7 @@
"orchestration_reasons": {
"p0_p1": 4,
"stale_dead": 1,
- "actionable_pickups": 1,
+ "actionable_pickups": 0,
"inbox_dms": 0
},
"nudges_sent_this_tick": [],
@@ -24,7 +24,7 @@
"score": 141,
"status": "doing",
"assignee": "claude-mail-companion",
- "ageH": 44.7,
+ "ageH": 44.9,
"stale": true,
"live": false,
"buildVerdict": "done-candidate",
@@ -50,11 +50,11 @@
"score": 96,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 40.5,
+ "ageH": 40.6,
"stale": true,
"live": true,
"buildVerdict": "nudge",
- "buildReason": "alive (owner active/worker up) but no ticket update in 40h — ask owner to update or dispose",
+ "buildReason": "alive (owner active/worker up) but no ticket update in 41h — ask owner to update or dispose",
"disposition": "hold-policy",
"collide": false,
"steveGated": true,
@@ -65,7 +65,7 @@
],
"why": [
"P1-keyword",
- "stale-build-40h"
+ "stale-build-41h"
],
"title": "SKU dw_sku code-RECOVERY program (15,577 blank, NO minting) — re-scrape/link/dedup"
},
@@ -75,7 +75,7 @@
"score": 66,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 43.9,
+ "ageH": 44,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -97,7 +97,7 @@
"score": 66,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 43.6,
+ "ageH": 43.7,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -119,7 +119,7 @@
"score": 41,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 66.6,
+ "ageH": 66.8,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -140,7 +140,7 @@
"score": 41,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 58.6,
+ "ageH": 58.7,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -163,7 +163,7 @@
"score": 41,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 45.3,
+ "ageH": 45.4,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -188,7 +188,7 @@
"score": 141,
"status": "doing",
"assignee": "claude-mail-companion",
- "ageH": 44.7,
+ "ageH": 44.9,
"stale": true,
"live": false,
"buildVerdict": "done-candidate",
@@ -214,7 +214,7 @@
"score": 106,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 0.3,
+ "ageH": 0.5,
"stale": false,
"live": true,
"buildVerdict": "ok",
@@ -237,7 +237,7 @@
"score": 103,
"status": "blocked",
"assignee": "claude-run-11155",
- "ageH": 11.2,
+ "ageH": 11.3,
"stale": false,
"live": true,
"buildVerdict": "ok",
@@ -258,7 +258,7 @@
"score": 100,
"status": "stopped",
"assignee": "claude-run-10045",
- "ageH": 88.7,
+ "ageH": 88.9,
"stale": false,
"live": false,
"buildVerdict": "ok",
@@ -281,11 +281,11 @@
"score": 96,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 40.5,
+ "ageH": 40.6,
"stale": true,
"live": true,
"buildVerdict": "nudge",
- "buildReason": "alive (owner active/worker up) but no ticket update in 40h — ask owner to update or dispose",
+ "buildReason": "alive (owner active/worker up) but no ticket update in 41h — ask owner to update or dispose",
"disposition": "hold-policy",
"collide": false,
"steveGated": true,
@@ -296,7 +296,7 @@
],
"why": [
"P1-keyword",
- "stale-build-40h"
+ "stale-build-41h"
],
"title": "SKU dw_sku code-RECOVERY program (15,577 blank, NO minting) — re-scrape/link/dedup"
},
@@ -306,7 +306,7 @@
"score": 66,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 43.9,
+ "ageH": 44,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -328,7 +328,7 @@
"score": 66,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 43.6,
+ "ageH": 43.7,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -350,7 +350,7 @@
"score": 61,
"status": "doing",
"assignee": "showroom-line-steward",
- "ageH": 16.3,
+ "ageH": 16.5,
"stale": false,
"live": true,
"buildVerdict": "ok",
@@ -373,7 +373,7 @@
"score": 58,
"status": "blocked",
"assignee": "claude-run-10573",
- "ageH": 90.7,
+ "ageH": 90.9,
"stale": false,
"live": false,
"buildVerdict": "ok",
@@ -397,7 +397,7 @@
"score": 58,
"status": "blocked",
"assignee": "vp-dw-marketing",
- "ageH": 90.7,
+ "ageH": 90.9,
"stale": false,
"live": false,
"buildVerdict": "ok",
@@ -421,7 +421,7 @@
"score": 58,
"status": "blocked",
"assignee": "approval-officer",
- "ageH": 90.7,
+ "ageH": 90.9,
"stale": false,
"live": false,
"buildVerdict": "ok",
@@ -446,7 +446,7 @@
"score": 58,
"status": "blocked",
"assignee": "claude-run-11050",
- "ageH": 17.2,
+ "ageH": 17.4,
"stale": false,
"live": false,
"buildVerdict": "ok",
@@ -469,7 +469,7 @@
"score": 58,
"status": "blocked",
"assignee": "claude-run-10993",
- "ageH": 9,
+ "ageH": 9.1,
"stale": false,
"live": true,
"buildVerdict": "ok",
@@ -493,7 +493,7 @@
"score": 58,
"status": "blocked",
"assignee": "claude-run-10387",
- "ageH": 8.8,
+ "ageH": 8.9,
"stale": false,
"live": true,
"buildVerdict": "ok",
@@ -517,7 +517,7 @@
"score": 55,
"status": "stopped",
"assignee": "vp-dw-commerce",
- "ageH": 90.8,
+ "ageH": 90.9,
"stale": false,
"live": true,
"buildVerdict": "ok",
@@ -538,7 +538,7 @@
"score": 55,
"status": "stopped",
"assignee": "cra-app",
- "ageH": 88.7,
+ "ageH": 88.9,
"stale": false,
"live": false,
"buildVerdict": "ok",
@@ -561,7 +561,7 @@
"score": 41,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 66.6,
+ "ageH": 66.8,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -582,7 +582,7 @@
"score": 41,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 58.6,
+ "ageH": 58.7,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -605,7 +605,7 @@
"score": 41,
"status": "doing",
"assignee": "vp-dw-commerce",
- "ageH": 45.3,
+ "ageH": 45.4,
"stale": true,
"live": true,
"buildVerdict": "nudge",
@@ -628,7 +628,7 @@
"score": 38,
"status": "open",
"assignee": "vp-dw-commerce",
- "ageH": 0.9,
+ "ageH": 1,
"stale": false,
"live": true,
"buildVerdict": "ok",
@@ -646,13 +646,34 @@
],
"title": "SDG publish cadence (launchd com.steve.sdg-publish-cadence) — track the daily 04:30 auto-drain of the SHZ backlog"
},
+ {
+ "id": "TK-11215-yoloforever-cycle-gated-only-backlog-mon",
+ "tier": "P2",
+ "score": 31,
+ "status": "doing",
+ "assignee": "codex-yoloforever",
+ "ageH": 0.1,
+ "stale": false,
+ "live": true,
+ "buildVerdict": "ok",
+ "buildReason": "",
+ "disposition": "monitor-only",
+ "collide": true,
+ "steveGated": false,
+ "approvalLane": "standard",
+ "approvalReasons": [],
+ "why": [
+ "P2-keyword"
+ ],
+ "title": "yoloforever cycle: gated-only backlog monitoring 2026-09-04 02:12 PT"
+ },
{
"id": "TK-11127-resolve-5-held-catalog-forks-carnegie-ne",
"tier": "P2",
"score": 28,
"status": "blocked",
"assignee": "claude-run-11050",
- "ageH": 36.8,
+ "ageH": 36.9,
"stale": false,
"live": false,
"buildVerdict": "ok",
@@ -669,34 +690,13 @@
],
"title": "Resolve 5 held catalog forks (Carnegie/Newwall/PhilRomano/Harlequin/Novasuede) — per-vendor keep-rule + canonical direction"
},
- {
- "id": "TK-11215-yoloforever-cycle-gated-only-backlog-mon",
- "tier": "P2",
- "score": 28,
- "status": "blocked",
- "assignee": "codex-yoloforever",
- "ageH": 2.4,
- "stale": false,
- "live": true,
- "buildVerdict": "ok",
- "buildReason": "",
- "disposition": "fast-track-local",
- "collide": false,
- "steveGated": false,
- "approvalLane": "fast-local-review",
- "approvalReasons": [],
- "why": [
- "P2-keyword"
- ],
- "title": "yoloforever cycle: gated-only backlog monitoring 2026-09-04 02:12 PT"
- },
{
"id": "TK-10484-re-onboard-jeffrey-stevens-peel-and-stic",
"tier": "P2",
"score": 25,
"status": "stopped",
"assignee": "jstevens-reonboard",
- "ageH": 86.6,
+ "ageH": 86.8,
"stale": false,
"live": false,
"buildVerdict": "ok",
@@ -719,7 +719,7 @@
"score": 25,
"status": "stopped",
"assignee": "vp-dw-commerce",
- "ageH": 58.5,
+ "ageH": 58.7,
"stale": false,
"live": true,
"buildVerdict": "ok",
@@ -743,7 +743,7 @@
"score": 25,
"status": "open",
"assignee": "codex-yoloforever",
- "ageH": 0.6,
+ "ageH": 0.7,
"stale": false,
"live": true,
"buildVerdict": "ok",
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/replay-output.txt b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/replay-output.txt
index 53110d4f..fde8d51c 100644
--- a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/replay-output.txt
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/replay-output.txt
@@ -1 +1 @@
-PASS strict payload=10 full_allowlist=18 events=118647 snapshot=2026-09-04T09:12:28.476Z mutable-live-state-not-asserted
+PASS strict payload=9 full_allowlist=17 canonical_events_prefix_records=119120 snapshot=2026-09-04T12:16:36.321Z nonstandalone-source-dependent
diff --git a/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/replay-verifier.js b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/replay-verifier.js
new file mode 100644
index 00000000..5751b7e5
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11215-20260904T0912Z-vpops/replay-verifier.js
@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+'use strict';
+const fs=require('fs'), path=require('path'), crypto=require('crypto');
+const root=__dirname;
+const manifestArg=process.argv[2] || 'manifest.sha256';
+const expectedControls=['README.md','allowlist.txt','build-evidence.js','manifest.sha256','negative/manifest.tampered.sha256','negative/tamper-output.txt','replay-output.txt','replay-verifier.js'];
+const expectedPayload=['payload/agents-panel.sh','payload/agents-post-decision-codex.sh','payload/audit-report.json','payload/claude-panel.sh','payload/codex-yoloforever.sh','payload/dtd-cost-mode','payload/e2e-proof.json','payload/provenance.json','payload/ticketmaster-latest.json'];
+const expected=[...expectedControls,...expectedPayload].sort();
+function walk(d,prefix=''){return fs.readdirSync(d,{withFileTypes:true}).flatMap(e=>e.isDirectory()?walk(path.join(d,e.name),`${prefix}${e.name}/`):[`${prefix}${e.name}`]);}
+const actual=walk(root).sort();
+const allow=fs.readFileSync(path.join(root,'allowlist.txt'),'utf8').trim().split('\n').sort();
+function same(a,b){return a.length===b.length&&a.every((x,i)=>x===b[i]);}
+if(!same(actual,expected)||!same(allow,expected)){console.error('FAIL full-directory allowlist mismatch',{actual,allow,expected});process.exit(2);}
+const lines=fs.readFileSync(path.join(root,manifestArg),'utf8').trim().split('\n');
+const manifestFiles=[];let failed=false;
+for(const line of lines){const m=line.match(/^([0-9a-f]{64}) (payload\/.+)$/);if(!m){console.error('FAIL malformed manifest line',line);failed=true;continue;}manifestFiles.push(m[2]);const got=crypto.createHash('sha256').update(fs.readFileSync(path.join(root,m[2]))).digest('hex');if(got!==m[1]){console.error(`FAIL digest ${m[2]} expected=${m[1]} got=${got}`);failed=true;}}
+if(!same(manifestFiles.sort(),expectedPayload)){console.error('FAIL strict payload coverage mismatch',{manifestFiles,expectedPayload});failed=true;}
+const audit=JSON.parse(fs.readFileSync(path.join(root,'payload/audit-report.json')));
+const snapshot=JSON.parse(fs.readFileSync(path.join(root,'payload/ticketmaster-latest.json')));
+const snapshotDigest=crypto.createHash('sha256').update(fs.readFileSync(path.join(root,'payload/ticketmaster-latest.json'))).digest('hex');
+const actionableTop=snapshot.top.filter(x=>x.disposition==='execute'||x.disposition==='fast-track-local');
+if(audit.ticketmaster.retained_as!=='payload/ticketmaster-latest.json'||audit.ticketmaster.sha256!==snapshotDigest||audit.ticketmaster.top_scope!=='top[] is a capped ranked window and is not necessarily the full open/active population.'||audit.ticketmaster.snapshot_ts!==snapshot.ts||audit.ticketmaster.open_or_active!==snapshot.totals.open_or_active||audit.ticketmaster.actionable_pickups!==snapshot.orchestration_reasons.actionable_pickups||audit.ticketmaster.top_length!==snapshot.top.length||audit.ticketmaster.actionable_entries_in_top!==actionableTop.length) {console.error('FAIL snapshot semantics');failed=true;}
+if(!fs.readFileSync(path.join(root,'payload/dtd-cost-mode')).equals(Buffer.from('ZERO_COST_REQUIRED\n'))) {console.error('FAIL guard bytes');failed=true;}
+const canonicalEvents='/Users/macstudio3/.claude/tickets/events.jsonl';
+const eventMeta=audit.canonical_events;
+if(eventMeta.source!==canonicalEvents||eventMeta.retained_payload!==false||eventMeta.verification_mode!=='canonical_append_only_prefix'||eventMeta.full_json_parse!=='PASS'){console.error('FAIL canonical events metadata contract');failed=true;}
+const prefixBytes=eventMeta.captured_prefix_bytes;
+if(!Number.isSafeInteger(prefixBytes)||prefixBytes<0){console.error('FAIL canonical events byte count');failed=true;}
+let records=0;
+if(!failed){
+ const fd=fs.openSync(canonicalEvents,'r');
+ try {
+ const currentBytes=fs.fstatSync(fd).size;
+ if(currentBytes<prefixBytes){console.error('FAIL canonical events source shorter than recorded prefix');failed=true;}
+ else {
+ const prefix=Buffer.alloc(prefixBytes);
+ let offset=0;
+ while(offset<prefix.length){const n=fs.readSync(fd,prefix,offset,prefix.length-offset,offset);if(n===0)break;offset+=n;}
+ if(offset!==prefixBytes){console.error('FAIL canonical events prefix short read');failed=true;}
+ const digest=crypto.createHash('sha256').update(prefix).digest('hex');
+ if(digest!==eventMeta.captured_prefix_sha256){console.error('FAIL canonical events prefix digest');failed=true;}
+ if((prefix.length===0||prefix[prefix.length-1]===0x0a)!==eventMeta.captured_prefix_line_terminated){console.error('FAIL canonical events line-boundary metadata');failed=true;}
+ for(const [i,line] of prefix.toString('utf8').split('\n').entries()){if(!line.trim())continue;try{JSON.parse(line);records++;}catch(e){console.error(`FAIL canonical events prefix JSON at line ${i+1}`);failed=true;break;}}
+ if(records!==eventMeta.captured_prefix_nonblank_records){console.error('FAIL canonical events prefix record count');failed=true;}
+ }
+ } finally { fs.closeSync(fd); }
+}
+const provenance=JSON.parse(fs.readFileSync(path.join(root,'payload/provenance.json')));
+const provenanceEvents=provenance.inputs.find(x=>x.path===canonicalEvents);
+if(!provenanceEvents||provenanceEvents.bytes!==eventMeta.captured_prefix_bytes||provenanceEvents.sha256!==eventMeta.captured_prefix_sha256){console.error('FAIL canonical events provenance mismatch');failed=true;}
+const provenanceSnapshot=provenance.inputs.find(x=>x.path===audit.ticketmaster.source);
+if(!provenanceSnapshot||provenanceSnapshot.retained_as!=='payload/ticketmaster-latest.json'||provenanceSnapshot.sha256!==snapshotDigest){console.error('FAIL snapshot provenance mismatch');failed=true;}
+const dtdFiles=['payload/agents-panel.sh','payload/agents-post-decision-codex.sh','payload/claude-panel.sh'];
+for(const file of dtdFiles){const text=fs.readFileSync(path.join(root,file),'utf8');const force=text.indexOf('ZERO_COST_REQUIRED) DTD_ZERO_COST=1');const firstPaid=Math.min(...['api.openai.com','api.x.ai','api.moonshot.ai'].map(s=>{const i=text.indexOf(s);return i<0?Infinity:i;}));if(!text.includes('CANONICAL_DTD_COST_MODE_FILE="/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode"')||!text.includes('refusing non-canonical DTD cost-mode guard')||!text.includes('exit 78')||force<0||force>=firstPaid){console.error(`FAIL independently derived zero-cost enforcement ${file}`);failed=true;}}
+if(!['ABSENT','PRESENT'].includes(audit.stopped_sentinel.state_at_capture)||audit.command_results.some(x=>x.rc!==0)){console.error('FAIL captured assertions');failed=true;}
+if(failed)process.exit(1);console.log(`PASS strict payload=${expectedPayload.length} full_allowlist=${expected.length} canonical_events_prefix_records=${records} snapshot=${snapshot.ts} nonstandalone-source-dependent`);
← 1c014026 auto-data-snapshot: 2026-09-04T05:15:13 (12 data files) — da
·
back to Ticket System
·
Strengthen TK-11215 evidence reconstruction 99e4e93c →