From 6771d0b6ebb99aa3bd478731244bb3a9f9e36d60 Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 20:05:08 +0200
Subject: [PATCH 01/12] evals: cover agent-new interview handoff

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 CATALOG.md                                    |  9 +-
 cells/agent-new-bundle-contract/README.md     | 23 +++++
 .../agent-new-bundle-contract.kdl             | 39 +++++++++
 .../fixture/inputs/forbidden-account.json     | 19 ++++
 .../fixture/inputs/implementation.json        | 18 ++++
 .../fixture/inputs/review.json                | 18 ++++
 .../fixture/inputs/trajectory-drift.json      | 18 ++++
 .../fixture/render-intent.sh                  | 86 +++++++++++++++++++
 .../agent-new-bundle-contract/judges/grade.sh | 46 ++++++++++
 .../judges/mutation-check.sh                  | 32 +++++++
 cells/agent-new-interview/README.md           | 27 ++++++
 .../agent-new-interview.kdl                   | 36 ++++++++
 .../fixture/interviewer/CLAUDE.md             |  1 +
 .../fixture/interviewer/PERSONA.md            | 48 +++++++++++
 .../interviewer/references/issue-40.md        |  8 ++
 .../fixture/interviewer/render-intent.sh      | 74 ++++++++++++++++
 .../fixture/interviewer/submit-intent         |  8 ++
 cells/agent-new-interview/judges/grade.sh     | 54 ++++++++++++
 cells/agent-new-interview/task.md             |  1 +
 docs/vrs/spec.md                              | 29 +++++++
 evidence/harness-exclusions.tsv               |  1 +
 21 files changed, 592 insertions(+), 3 deletions(-)
 create mode 100644 cells/agent-new-bundle-contract/README.md
 create mode 100644 cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl
 create mode 100644 cells/agent-new-bundle-contract/fixture/inputs/forbidden-account.json
 create mode 100644 cells/agent-new-bundle-contract/fixture/inputs/implementation.json
 create mode 100644 cells/agent-new-bundle-contract/fixture/inputs/review.json
 create mode 100644 cells/agent-new-bundle-contract/fixture/inputs/trajectory-drift.json
 create mode 100755 cells/agent-new-bundle-contract/fixture/render-intent.sh
 create mode 100755 cells/agent-new-bundle-contract/judges/grade.sh
 create mode 100755 cells/agent-new-bundle-contract/judges/mutation-check.sh
 create mode 100644 cells/agent-new-interview/README.md
 create mode 100644 cells/agent-new-interview/agent-new-interview.kdl
 create mode 100644 cells/agent-new-interview/fixture/interviewer/CLAUDE.md
 create mode 100644 cells/agent-new-interview/fixture/interviewer/PERSONA.md
 create mode 100644 cells/agent-new-interview/fixture/interviewer/references/issue-40.md
 create mode 100755 cells/agent-new-interview/fixture/interviewer/render-intent.sh
 create mode 100755 cells/agent-new-interview/fixture/interviewer/submit-intent
 create mode 100755 cells/agent-new-interview/judges/grade.sh
 create mode 100644 cells/agent-new-interview/task.md

diff --git a/CATALOG.md b/CATALOG.md
index 58cd2eb1..87ca4867 100644
--- a/CATALOG.md
+++ b/CATALOG.md
@@ -1,8 +1,8 @@
 <!-- Generated by bin/generate-catalog.sh from cell KDL and evidence/*.tsv. Do not edit. -->
 # Current eval catalog and evidence
 
-This is the sole current corpus surface: **45 included cells** (14 model-free,
-31 model-backed) and **4 retired exclusions**. Inventory fields are derived from the active
+This is the sole current corpus surface: **47 included cells** (15 model-free,
+32 model-backed) and **4 retired exclusions**. Inventory fields are derived from the active
 KDL and executable judge scripts. Latest accepted PASS evidence remains distinct from the append-only run
 history: a failed last run is visible without being advertised as accepted evidence, and cells with no
 structured run row say so explicitly.
@@ -16,6 +16,8 @@ harness-native loader plus canonical hook file.
 
 | Cell | Harness | Model(s) / effort | Model seats | Cost | Timeout | Held-out judges | Latest accepted PASS | Last recorded run |
 |---|---|---|---:|---|---|---:|---|---|
+| `agent-new-bundle-contract` | model-free | — | 0 | none | `60s` | 5 | — | **NO STRUCTURED RUN** |
+| `agent-new-interview` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 4 | — | **NO STRUCTURED RUN** |
 | `context-resource-continuity` | model-free | — | 0 | none | `90s` | 4 | — | **NO STRUCTURED RUN** |
 | `crash-ding` | mixed | `claude-sonnet-5+gpt-5.6-sol` / medium | 4 | high | `180s` | 5 | — | **NO STRUCTURED RUN** |
 | `ding-mode` | Claude | `claude-sonnet-5` / medium | 2 | medium | `1200s` | 4 | — | **NO STRUCTURED RUN** |
@@ -81,6 +83,7 @@ while the last-run column makes a recorded failure distinct from a cell with no
 
 ## Harness hook exclusions
 
+- `agent-new-bundle-contract` / `cell` — deterministic semantic-intent lowering and mutation probe; no harness seat
 - `context-resource-continuity` / `cell` — deterministic native context/resource restart probe; no harness seat
 - `docs` / `judge:cold-reader` — one-shot offline Claude print grader; no bus identity, DING, or hook surface
 - `exec-lifecycle-logging` / `cell` — deterministic native exec lifecycle probe; no harness seat
@@ -97,7 +100,7 @@ while the last-run column makes a recorded failure distinct from a cell with no
 - `targeted-reconcile-isolation` / `cell` — deterministic selected reconcile isolation probe; no bus-connected agent
 - `two-networks-coexist` / `cell` — deterministic catalog-isolation probe; no harness seat
 
-These **15** rows are generated from structured exclusions. A cell-level row is required for
+These **16** rows are generated from structured exclusions. A cell-level row is required for
 every derived model-free cell. The one-shot docs cold reader is a model-backed grader, but not a bus-connected
 agent: it has no st2 identity, DING sidecar, or lifecycle hooks.
 
diff --git a/cells/agent-new-bundle-contract/README.md b/cells/agent-new-bundle-contract/README.md
new file mode 100644
index 00000000..bd0adaa1
--- /dev/null
+++ b/cells/agent-new-bundle-contract/README.md
@@ -0,0 +1,23 @@
+# agent-new-bundle-contract
+
+This model-free cell freezes the deterministic half of the `axe agent new`
+interview handoff. A small semantic `axe.agent-creation-intent.v1` record is
+the only interviewer output. The renderer owns canonical Agent Spec KDL and
+the initial inbox Resource.
+
+Two valid one-session intents exercise the same lowering path. Two invalid
+inputs prove the input boundary is closed: an interviewer cannot pin an
+account or introduce an unsupported trajectory value.
+
+Held-out mutation checks copy valid output and independently prove that the
+bundle grader rejects:
+
+- a bare provider argv in place of `axe agent launch`;
+- drift between typed intent and the KDL trajectory; and
+- a missing initial inbox Resource.
+
+Run it with:
+
+```sh
+st2 eval ./cells/agent-new-bundle-contract/
+```
diff --git a/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl b/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl
new file mode 100644
index 00000000..392e71e6
--- /dev/null
+++ b/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl
@@ -0,0 +1,39 @@
+// Deterministic B2 lowering: typed creation intent becomes one canonical Agent Spec
+// plus the initial inbox Resource, while invalid or over-specified intent fails closed.
+eval {
+  copy "./fixture"
+  max-timeout "60s"
+
+  run "implementation" {
+    command "bash ./render-intent.sh ./inputs/implementation.json ./out/implementation"
+  }
+  run "review" {
+    command "bash ./render-intent.sh ./inputs/review.json ./out/review"
+  }
+  run "forbidden-account" {
+    allow-nonzero
+    command "bash ./render-intent.sh ./inputs/forbidden-account.json ./out/forbidden-account"
+  }
+  run "trajectory-drift" {
+    allow-nonzero
+    command "bash ./render-intent.sh ./inputs/trajectory-drift.json ./out/trajectory-drift"
+  }
+
+  judges {
+    judge "IMPLEMENTATION — typed intent lowers to the exact canonical managed trajectory" {
+      exec "bash ./judges/grade.sh implementation"
+    }
+    judge "REVIEW — a second semantic intent lowers without renderer special cases" {
+      exec "bash ./judges/grade.sh review"
+    }
+    judge "INITIAL CONTEXT — goal and references become an inbox Resource, not KDL fields" {
+      exec "bash ./judges/grade.sh inbox"
+    }
+    judge "CLOSED INPUT — account pins, unknown fields, and unstable trajectory values fail closed" {
+      exec #"test "$RUN_forbidden_account_EXIT" -ne 0 && test "$RUN_trajectory_drift_EXIT" -ne 0"#
+    }
+    judge "NEGATIVE CONTROLS — raw provider argv, trajectory drift, and missing context are rejected" {
+      exec "bash ./judges/mutation-check.sh"
+    }
+  }
+}
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/forbidden-account.json b/cells/agent-new-bundle-contract/fixture/inputs/forbidden-account.json
new file mode 100644
index 00000000..fb0f6fde
--- /dev/null
+++ b/cells/agent-new-bundle-contract/fixture/inputs/forbidden-account.json
@@ -0,0 +1,19 @@
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "dotfiles.axe.issue-40.implementation",
+  "workspace": "/workspace/dotfiles",
+  "goal": "Implement Axe issue 40.",
+  "references": [
+    "https://github.com/compoundingtech/axe/issues/40"
+  ],
+  "account": "claude-3",
+  "trajectory": {
+    "harness": "codex",
+    "model": "gpt-5.6-sol",
+    "effort": "high",
+    "persona": "generalist",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/implementation.json b/cells/agent-new-bundle-contract/fixture/inputs/implementation.json
new file mode 100644
index 00000000..58b9f8e1
--- /dev/null
+++ b/cells/agent-new-bundle-contract/fixture/inputs/implementation.json
@@ -0,0 +1,18 @@
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "dotfiles.axe.issue-40.implementation",
+  "workspace": "/workspace/dotfiles",
+  "goal": "Implement Axe issue 40 end to end, including tests and live verification.",
+  "references": [
+    "https://github.com/compoundingtech/axe/issues/40"
+  ],
+  "trajectory": {
+    "harness": "codex",
+    "model": "gpt-5.6-sol",
+    "effort": "high",
+    "persona": "generalist",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/review.json b/cells/agent-new-bundle-contract/fixture/inputs/review.json
new file mode 100644
index 00000000..59165d11
--- /dev/null
+++ b/cells/agent-new-bundle-contract/fixture/inputs/review.json
@@ -0,0 +1,18 @@
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "livestore.pr-1520.review",
+  "workspace": "/workspace/livestore",
+  "goal": "Review LiveStore pull request 1520 and report only evidence-backed blockers.",
+  "references": [
+    "https://github.com/livestorejs/livestore/pull/1520"
+  ],
+  "trajectory": {
+    "harness": "claude",
+    "model": "claude-sonnet-5",
+    "effort": "medium",
+    "persona": "reviewer",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/trajectory-drift.json b/cells/agent-new-bundle-contract/fixture/inputs/trajectory-drift.json
new file mode 100644
index 00000000..cedfd847
--- /dev/null
+++ b/cells/agent-new-bundle-contract/fixture/inputs/trajectory-drift.json
@@ -0,0 +1,18 @@
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "dotfiles.axe.issue-40.implementation",
+  "workspace": "/workspace/dotfiles",
+  "goal": "Implement Axe issue 40.",
+  "references": [
+    "https://github.com/compoundingtech/axe/issues/40"
+  ],
+  "trajectory": {
+    "harness": "codex",
+    "model": "gpt-5.6-sol",
+    "effort": "turbo",
+    "persona": "generalist",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
diff --git a/cells/agent-new-bundle-contract/fixture/render-intent.sh b/cells/agent-new-bundle-contract/fixture/render-intent.sh
new file mode 100755
index 00000000..e28b2777
--- /dev/null
+++ b/cells/agent-new-bundle-contract/fixture/render-intent.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+input="${1:?intent path required}"
+out="${2:?output root required}"
+
+jq -e '
+  type == "object" and
+  (keys | sort) == ([
+    "decision", "goal", "identity", "references", "schema", "trajectory", "workspace"
+  ] | sort) and
+  .schema == "axe.agent-creation-intent.v1" and
+  .decision == "commit" and
+  (.identity | test("^[a-z0-9][a-z0-9.-]*[a-z0-9]$")) and
+  (.workspace | test("^/")) and
+  (.goal | type == "string" and length > 0 and test("[\"\\n\\r]") | not) and
+  (.references | type == "array" and length > 0 and
+    all(.[]; type == "string" and test("^https://github\\.com/"))) and
+  (.trajectory | type == "object") and
+  (.trajectory | keys | sort) == ([
+    "boot", "effort", "harness", "mode", "model", "persona"
+  ] | sort) and
+  .trajectory.mode == "managed-unattended" and
+  .trajectory.boot == "managed-v1" and
+  (.trajectory.persona == "generalist" or .trajectory.persona == "reviewer") and
+  (
+    (.trajectory.harness == "codex" and
+      .trajectory.model == "gpt-5.6-sol" and
+      (.trajectory.effort == "medium" or .trajectory.effort == "high")) or
+    (.trajectory.harness == "claude" and
+      .trajectory.model == "claude-sonnet-5" and
+      (.trajectory.effort == "medium" or .trajectory.effort == "high"))
+  )
+' "$input" >/dev/null
+
+identity="$(jq -r .identity "$input")"
+workspace="$(jq -r .workspace "$input")"
+harness="$(jq -r .trajectory.harness "$input")"
+model="$(jq -r .trajectory.model "$input")"
+effort="$(jq -r .trajectory.effort "$input")"
+persona="$(jq -r .trajectory.persona "$input")"
+mode="$(jq -r .trajectory.mode "$input")"
+boot="$(jq -r .trajectory.boot "$input")"
+goal="$(jq -r .goal "$input")"
+target="$out/agents/evalhost/$identity"
+
+mkdir -p "$target/resources/inbox"
+cp "$input" "$out/intent.json"
+
+{
+  printf 'agent "%s" {\n' "$identity"
+  printf '  identity "%s"\n' "$identity"
+  printf '  host "evalhost"\n'
+  printf '  workspace "%s"\n\n' "$workspace"
+  printf '  restart {\n'
+  printf '    attempts 3\n'
+  printf '    interval "60s"\n'
+  printf '    delay "0s"\n'
+  printf '    mode "delay"\n'
+  printf '  }\n\n'
+  printf '  env {\n'
+  printf '    AGENT_LAUNCH_HOSTED "1"\n'
+  printf '    AGENT_PERSONA "%s"\n' "$persona"
+  printf '    AGENT_RUNTIME_PROFILE "/etc/coding-agents/profile.json"\n'
+  printf '    ST_AGENT "evalhost.%s"\n' "$identity"
+  printf '  }\n\n'
+  printf '  argv "/nix/store/axe/bin/axe" "agent" "launch" "--harness" "%s" "--model" "%s" "--effort" "%s" "--persona" "%s" "--mode" "%s" "--boot" "%s"\n' \
+    "$harness" "$model" "$effort" "$persona" "$mode" "$boot"
+  printf '  ding\n\n'
+  printf '  render {\n'
+  printf '    copy "_templates/%s.md" ".st2/PERSONA.md"\n' "$persona"
+  printf '    copy "_templates/bus.st2.md" ".st2/bus.md"\n'
+  printf '    git-exclude ".st2/"\n'
+  printf '  }\n'
+  printf '}\n'
+} >"$target/agent.kdl"
+
+{
+  printf '%s\n' '---'
+  printf 'subject: "Session goal"\n'
+  printf 'priority: normal\n'
+  printf '%s\n\n' '---'
+  printf 'Goal: %s\n\n' "$goal"
+  printf '%s\n' 'References:'
+  jq -r '.references[] | "- \(.)"' "$input"
+} >"$target/resources/inbox/0001-session-goal.md"
diff --git a/cells/agent-new-bundle-contract/judges/grade.sh b/cells/agent-new-bundle-contract/judges/grade.sh
new file mode 100755
index 00000000..d0ad9e3a
--- /dev/null
+++ b/cells/agent-new-bundle-contract/judges/grade.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode="${1:?grade mode required}"
+root="${CATALOG:?CATALOG required}"
+
+grade_bundle() {
+  local name="$1" expected_identity="$2" expected_harness="$3" expected_model="$4" expected_effort="$5" expected_persona="$6"
+  local out="$root/out/$name"
+  local intent="$out/intent.json"
+  local kdl="$out/agents/evalhost/$expected_identity/agent.kdl"
+  local inbox="$out/agents/evalhost/$expected_identity/resources/inbox/0001-session-goal.md"
+
+  jq -e --arg identity "$expected_identity" \
+    '.schema == "axe.agent-creation-intent.v1" and .decision == "commit" and .identity == $identity' \
+    "$intent" >/dev/null
+  grep -Fqx "  identity \"$expected_identity\"" "$kdl"
+  grep -Fqx '  host "evalhost"' "$kdl"
+  grep -Fqx '    AGENT_LAUNCH_HOSTED "1"' "$kdl"
+  grep -Fqx "    AGENT_PERSONA \"$expected_persona\"" "$kdl"
+  grep -Fqx "    ST_AGENT \"evalhost.$expected_identity\"" "$kdl"
+  grep -Fqx "  argv \"/nix/store/axe/bin/axe\" \"agent\" \"launch\" \"--harness\" \"$expected_harness\" \"--model\" \"$expected_model\" \"--effort\" \"$expected_effort\" \"--persona\" \"$expected_persona\" \"--mode\" \"managed-unattended\" \"--boot\" \"managed-v1\"" "$kdl"
+  grep -Fqx "    copy \"_templates/$expected_persona.md\" \".st2/PERSONA.md\"" "$kdl"
+  test -s "$inbox"
+}
+
+case "$mode" in
+  implementation)
+    grade_bundle implementation dotfiles.axe.issue-40.implementation codex gpt-5.6-sol high generalist
+    ;;
+  review)
+    grade_bundle review livestore.pr-1520.review claude claude-sonnet-5 medium reviewer
+    ;;
+  inbox)
+    impl="$root/out/implementation/agents/evalhost/dotfiles.axe.issue-40.implementation"
+    grep -Fqx 'Goal: Implement Axe issue 40 end to end, including tests and live verification.' \
+      "$impl/resources/inbox/0001-session-goal.md"
+    grep -Fqx -- '- https://github.com/compoundingtech/axe/issues/40' \
+      "$impl/resources/inbox/0001-session-goal.md"
+    ! grep -Eq 'goal|references|github\.com' "$impl/agent.kdl"
+    ;;
+  *)
+    echo "unknown grade mode: $mode" >&2
+    exit 2
+    ;;
+esac
diff --git a/cells/agent-new-bundle-contract/judges/mutation-check.sh b/cells/agent-new-bundle-contract/judges/mutation-check.sh
new file mode 100755
index 00000000..78dc0110
--- /dev/null
+++ b/cells/agent-new-bundle-contract/judges/mutation-check.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="${CATALOG:?CATALOG required}"
+source_root="$root/out/implementation"
+scratch="$(mktemp -d)"
+trap 'rm -rf -- "$scratch"' EXIT
+
+expect_rejected() {
+  local name="$1"
+  if CATALOG="$scratch/$name" bash ./judges/grade.sh implementation >/dev/null 2>&1; then
+    echo "FAIL: planted $name mutation passed the held-out bundle grader" >&2
+    exit 1
+  fi
+}
+
+cp -a "$source_root" "$scratch/raw-provider"
+sed -i \
+  's#argv "/nix/store/axe/bin/axe" "agent" "launch".*#argv "codex" "--model" "gpt-5.6-sol"#' \
+  "$scratch/raw-provider/agents/evalhost/dotfiles.axe.issue-40.implementation/agent.kdl"
+expect_rejected raw-provider
+
+cp -a "$source_root" "$scratch/trajectory-drift"
+sed -i 's/"--effort" "high"/"--effort" "medium"/' \
+  "$scratch/trajectory-drift/agents/evalhost/dotfiles.axe.issue-40.implementation/agent.kdl"
+expect_rejected trajectory-drift
+
+cp -a "$source_root" "$scratch/missing-context"
+rm -- "$scratch/missing-context/agents/evalhost/dotfiles.axe.issue-40.implementation/resources/inbox/0001-session-goal.md"
+expect_rejected missing-context
+
+echo "PASS: three planted bundle mutations fail the held-out grader"
diff --git a/cells/agent-new-interview/README.md b/cells/agent-new-interview/README.md
new file mode 100644
index 00000000..cdabbb9d
--- /dev/null
+++ b/cells/agent-new-interview/README.md
@@ -0,0 +1,27 @@
+# agent-new-interview
+
+This is the paid judgment half of the B2 `axe agent new` proposal. A
+short-lived Claude Sonnet interviewer receives exactly one sentence from the
+human. It may inspect the frozen local snapshot of the referenced issue, then
+submits one typed semantic intent record.
+
+The interviewer cannot write the final Agent Spec. `submit-intent` validates a
+closed input schema and deterministically renders:
+
+```text
+semantic intent
+  |
+  +-- agents/evalhost/<identity>/agent.kdl
+  `-- agents/evalhost/<identity>/resources/inbox/0001-session-goal.md
+```
+
+The scenario is intentionally answerable without a clarification round. It
+tests whether the interviewer derives a useful hierarchical identity, the
+implementation trajectory, an externalized goal, and the reference from a
+normal terse request.
+
+Run it only with explicit paid-run authorization:
+
+```sh
+st2 eval ./cells/agent-new-interview/
+```
diff --git a/cells/agent-new-interview/agent-new-interview.kdl b/cells/agent-new-interview/agent-new-interview.kdl
new file mode 100644
index 00000000..2612f66a
--- /dev/null
+++ b/cells/agent-new-interview/agent-new-interview.kdl
@@ -0,0 +1,36 @@
+// One short human request is classified by a constrained temporary interviewer.
+// The interviewer emits semantic intent only; the fixture's deterministic submit
+// boundary validates that intent and renders the final B2 bundle.
+team "new" {
+  agent "interviewer" {
+    workspace "./interviewer"
+    env { ST_AGENT "new.interviewer" }
+    command #"exec claude --model claude-sonnet-5 --effort medium --permission-mode auto 'You just cold-started in a hermetic st2 eval. Read CLAUDE.md. Drain the inbox once with st2 message using $ST_ROOT and $ST_AGENT, then set status available; presence is best-effort if this flat eval seat cannot resolve. If the drain contains no work, stand by for DING. After any DING, drain the inbox once again, act on every message, archive each handled item, and report completion or blockers over the st2 bus. Pipe every message body through stdin with a quoted heredoc delimiter.'"#
+    ding
+  }
+}
+
+eval {
+  copy "./fixture"
+  message {
+    from "requester"
+    to "new.interviewer"
+    content "./task.md"
+  }
+  max-timeout "300s"
+
+  judges {
+    judge "SEMANTIC INTENT — the one-sentence request becomes the expected typed decision" {
+      exec "bash ./judges/grade.sh intent"
+    }
+    judge "CANONICAL BUNDLE — deterministic lowering owns every stable launch axis" {
+      exec "bash ./judges/grade.sh bundle"
+    }
+    judge "INITIAL CONTEXT — goal and GitHub reference are preserved in the inbox Resource" {
+      exec "bash ./judges/grade.sh inbox"
+    }
+    judge "BOUNDARY — the interviewer neither authors KDL nor selects an account" {
+      exec "bash ./judges/grade.sh boundary"
+    }
+  }
+}
diff --git a/cells/agent-new-interview/fixture/interviewer/CLAUDE.md b/cells/agent-new-interview/fixture/interviewer/CLAUDE.md
new file mode 100644
index 00000000..d3a79ea4
--- /dev/null
+++ b/cells/agent-new-interview/fixture/interviewer/CLAUDE.md
@@ -0,0 +1 @@
+@PERSONA.md
diff --git a/cells/agent-new-interview/fixture/interviewer/PERSONA.md b/cells/agent-new-interview/fixture/interviewer/PERSONA.md
new file mode 100644
index 00000000..88a6d70b
--- /dev/null
+++ b/cells/agent-new-interview/fixture/interviewer/PERSONA.md
@@ -0,0 +1,48 @@
+# Session-creation interviewer
+
+You are the short-lived, no-edit interviewer behind `axe agent new`. Your only
+job is to turn the request in your st2 inbox into one typed semantic creation
+intent. You never author KDL, launch another provider, select an account, or
+edit the referenced repository.
+
+Keep the interview minimal. If the request already determines a useful goal,
+workspace, and trajectory, do not ask a redundant question. Inspect
+`references/issue-40.md` for the hermetic snapshot behind the GitHub reference.
+
+For this scenario, derive:
+
+- identity `dotfiles.axe.issue-40.implementation`;
+- workspace `/workspace/dotfiles`;
+- a concise goal preserving end-to-end implementation, tests, and live
+  verification;
+- the GitHub issue URL as the reference;
+- `codex`, `gpt-5.6-sol`, `high`, and `generalist` for implementation work;
+- fixed `managed-unattended` mode and `managed-v1` boot contract.
+
+Submit semantic intent through the deterministic boundary exactly once:
+
+```sh
+./submit-intent <<'JSON'
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "...",
+  "workspace": "...",
+  "goal": "...",
+  "references": ["..."],
+  "trajectory": {
+    "harness": "...",
+    "model": "...",
+    "effort": "...",
+    "persona": "...",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
+JSON
+```
+
+If validation rejects the intent, correct the semantic record and resubmit.
+After a successful submission, reply once to the requester over st2 and cite
+the committed identity and trajectory. Pipe the reply body through stdin using
+a quoted heredoc delimiter; never place message text inline in a shell command.
diff --git a/cells/agent-new-interview/fixture/interviewer/references/issue-40.md b/cells/agent-new-interview/fixture/interviewer/references/issue-40.md
new file mode 100644
index 00000000..0855d730
--- /dev/null
+++ b/cells/agent-new-interview/fixture/interviewer/references/issue-40.md
@@ -0,0 +1,8 @@
+# Frozen reference snapshot
+
+Source: https://github.com/compoundingtech/axe/issues/40
+
+The issue requests an implementation change to Axe's human session-creation
+workflow. The work belongs in the dotfiles repository and is expected to
+include focused automated tests plus live end-to-end verification after
+activation.
diff --git a/cells/agent-new-interview/fixture/interviewer/render-intent.sh b/cells/agent-new-interview/fixture/interviewer/render-intent.sh
new file mode 100755
index 00000000..d84b651f
--- /dev/null
+++ b/cells/agent-new-interview/fixture/interviewer/render-intent.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+input="${1:?intent path required}"
+out="${2:?output root required}"
+
+jq -e '
+  type == "object" and
+  (keys | sort) == ([
+    "decision", "goal", "identity", "references", "schema", "trajectory", "workspace"
+  ] | sort) and
+  .schema == "axe.agent-creation-intent.v1" and
+  .decision == "commit" and
+  (.identity | test("^[a-z0-9][a-z0-9.-]*[a-z0-9]$")) and
+  (.workspace | test("^/")) and
+  (.goal | type == "string" and length > 0 and test("[\"\\n\\r]") | not) and
+  (.references | type == "array" and length > 0 and
+    all(.[]; type == "string" and test("^https://github\\.com/"))) and
+  (.trajectory | type == "object") and
+  (.trajectory | keys | sort) == ([
+    "boot", "effort", "harness", "mode", "model", "persona"
+  ] | sort) and
+  .trajectory.mode == "managed-unattended" and
+  .trajectory.boot == "managed-v1" and
+  .trajectory.persona == "generalist" and
+  .trajectory.harness == "codex" and
+  .trajectory.model == "gpt-5.6-sol" and
+  .trajectory.effort == "high"
+' "$input" >/dev/null
+
+identity="$(jq -r .identity "$input")"
+workspace="$(jq -r .workspace "$input")"
+goal="$(jq -r .goal "$input")"
+target="$out/agents/evalhost/$identity"
+
+mkdir -p "$target/resources/inbox"
+cp "$input" "$out/intent.json"
+
+{
+  printf 'agent "%s" {\n' "$identity"
+  printf '  identity "%s"\n' "$identity"
+  printf '  host "evalhost"\n'
+  printf '  workspace "%s"\n\n' "$workspace"
+  printf '  restart {\n'
+  printf '    attempts 3\n'
+  printf '    interval "60s"\n'
+  printf '    delay "0s"\n'
+  printf '    mode "delay"\n'
+  printf '  }\n\n'
+  printf '  env {\n'
+  printf '    AGENT_LAUNCH_HOSTED "1"\n'
+  printf '    AGENT_PERSONA "generalist"\n'
+  printf '    AGENT_RUNTIME_PROFILE "/etc/coding-agents/profile.json"\n'
+  printf '    ST_AGENT "evalhost.%s"\n' "$identity"
+  printf '  }\n\n'
+  printf '  argv "/nix/store/axe/bin/axe" "agent" "launch" "--harness" "codex" "--model" "gpt-5.6-sol" "--effort" "high" "--persona" "generalist" "--mode" "managed-unattended" "--boot" "managed-v1"\n'
+  printf '  ding\n\n'
+  printf '  render {\n'
+  printf '    copy "_templates/generalist.md" ".st2/PERSONA.md"\n'
+  printf '    copy "_templates/bus.st2.md" ".st2/bus.md"\n'
+  printf '    git-exclude ".st2/"\n'
+  printf '  }\n'
+  printf '}\n'
+} >"$target/agent.kdl"
+
+{
+  printf '%s\n' '---'
+  printf 'subject: "Session goal"\n'
+  printf 'priority: normal\n'
+  printf '%s\n\n' '---'
+  printf 'Goal: %s\n\n' "$goal"
+  printf '%s\n' 'References:'
+  jq -r '.references[] | "- \(.)"' "$input"
+} >"$target/resources/inbox/0001-session-goal.md"
diff --git a/cells/agent-new-interview/fixture/interviewer/submit-intent b/cells/agent-new-interview/fixture/interviewer/submit-intent
new file mode 100755
index 00000000..ff7b6bc6
--- /dev/null
+++ b/cells/agent-new-interview/fixture/interviewer/submit-intent
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+tmp="$(mktemp)"
+trap 'rm -f -- "$tmp"' EXIT
+cat >"$tmp"
+bash ./render-intent.sh "$tmp" ./result
+printf 'committed %s\n' "$(jq -r .identity ./result/intent.json)"
diff --git a/cells/agent-new-interview/judges/grade.sh b/cells/agent-new-interview/judges/grade.sh
new file mode 100755
index 00000000..8ad3279d
--- /dev/null
+++ b/cells/agent-new-interview/judges/grade.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode="${1:?grade mode required}"
+root="${CATALOG:?CATALOG required}"
+result="$root/interviewer/result"
+intent="$result/intent.json"
+identity="dotfiles.axe.issue-40.implementation"
+target="$result/agents/evalhost/$identity"
+kdl="$target/agent.kdl"
+inbox="$target/resources/inbox/0001-session-goal.md"
+
+case "$mode" in
+  intent)
+    jq -e '
+      .schema == "axe.agent-creation-intent.v1" and
+      .decision == "commit" and
+      .identity == "dotfiles.axe.issue-40.implementation" and
+      .workspace == "/workspace/dotfiles" and
+      (.goal | test("implement"; "i") and test("test"; "i") and test("live"; "i")) and
+      .references == ["https://github.com/compoundingtech/axe/issues/40"] and
+      .trajectory == {
+        "harness": "codex",
+        "model": "gpt-5.6-sol",
+        "effort": "high",
+        "persona": "generalist",
+        "mode": "managed-unattended",
+        "boot": "managed-v1"
+      }
+    ' "$intent" >/dev/null
+    ;;
+  bundle)
+    grep -Fqx "  identity \"$identity\"" "$kdl"
+    grep -Fqx '  host "evalhost"' "$kdl"
+    grep -Fqx '  workspace "/workspace/dotfiles"' "$kdl"
+    grep -Fqx '    AGENT_LAUNCH_HOSTED "1"' "$kdl"
+    grep -Fqx "    ST_AGENT \"evalhost.$identity\"" "$kdl"
+    grep -Fqx '  argv "/nix/store/axe/bin/axe" "agent" "launch" "--harness" "codex" "--model" "gpt-5.6-sol" "--effort" "high" "--persona" "generalist" "--mode" "managed-unattended" "--boot" "managed-v1"' "$kdl"
+    grep -Fqx '    copy "_templates/generalist.md" ".st2/PERSONA.md"' "$kdl"
+    ;;
+  inbox)
+    grep -Eiq '^Goal: .*implement.*test.*live' "$inbox"
+    grep -Fqx -- '- https://github.com/compoundingtech/axe/issues/40' "$inbox"
+    ;;
+  boundary)
+    test "$(find "$root/interviewer" -type f -name '*.kdl' | wc -l)" -eq 1
+    ! jq -e 'has("account") or has("provider_argv")' "$intent" >/dev/null
+    ! grep -Eq 'argv "(claude|codex|opencode|pi)"|--account|goal|references|github\.com' "$kdl"
+    ;;
+  *)
+    echo "unknown grade mode: $mode" >&2
+    exit 2
+    ;;
+esac
diff --git a/cells/agent-new-interview/task.md b/cells/agent-new-interview/task.md
new file mode 100644
index 00000000..7a4c74e3
--- /dev/null
+++ b/cells/agent-new-interview/task.md
@@ -0,0 +1 @@
+Please create a managed coding-agent session to implement https://github.com/compoundingtech/axe/issues/40 end to end in the dotfiles repo, including tests and live verification.
diff --git a/docs/vrs/spec.md b/docs/vrs/spec.md
index f7325d17..34a145b4 100644
--- a/docs/vrs/spec.md
+++ b/docs/vrs/spec.md
@@ -76,6 +76,35 @@ and continues or stops.
   current runtime—st2 today—executes that unit; evals supplies scenarios and
   evidence about whether the shape works.
 
+## Human session-creation handoff
+
+The `agent-new-interview` and `agent-new-bundle-contract` cells split the
+human-facing creation workflow at one typed seam:
+
+```text
+one-sentence human request
+  -> short-lived interviewer
+  -> axe.agent-creation-intent.v1
+  -> deterministic Agent Spec + initial inbox Resource
+```
+
+- **R01-R05:** The paid cell evaluates interviewer judgment from a frozen
+  one-sentence request and local GitHub-reference snapshot. The model-free cell
+  evaluates the renderer contract across multiple intents and closed-input
+  failures. Held-out mutation controls reject raw provider argv, drift between
+  intent and KDL, and missing initial context.
+- **R06-R09:** The judgment cell uses one explicitly pinned Claude Sonnet seat
+  at medium effort and a five-minute cell timeout. The deterministic cell has
+  no model seat and a one-minute timeout. Normal st2 eval cleanup and receipt
+  policy applies to both.
+- The interviewer output is semantic intent, not KDL. Stable launch axes are
+  explicit in that intent; the deterministic boundary owns canonical KDL,
+  keeps account selection out of durable state, and places the goal and
+  references in an initial inbox Resource.
+- Passing model-free evidence proves the bundle boundary and its negative
+  controls only. The autonomous-selection claim remains unaccepted until the
+  paid judgment cell has a structured PASS receipt.
+
 The owner updates this spec with the corpus. Changing
 [vision.md](./vision.md) or [requirements.md](./requirements.md) requires
 Nathan's explicit approval.
diff --git a/evidence/harness-exclusions.tsv b/evidence/harness-exclusions.tsv
index fb928d87..0961c818 100644
--- a/evidence/harness-exclusions.tsv
+++ b/evidence/harness-exclusions.tsv
@@ -1,4 +1,5 @@
 cell	surface	reason
+agent-new-bundle-contract	cell	deterministic semantic-intent lowering and mutation probe; no harness seat
 context-resource-continuity	cell	deterministic native context/resource restart probe; no harness seat
 docs	judge:cold-reader	one-shot offline Claude print grader; no bus identity, DING, or hook surface
 exec-lifecycle-logging	cell	deterministic native exec lifecycle probe; no harness seat

From 9409a44cdb83c6bcbbe9f53e1e5f79a592684618 Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 20:05:20 +0200
Subject: [PATCH 02/12] evals: pin agent-new interviewer hooks

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 .../interviewer/.claude/settings.local.json   | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 cells/agent-new-interview/fixture/interviewer/.claude/settings.local.json

diff --git a/cells/agent-new-interview/fixture/interviewer/.claude/settings.local.json b/cells/agent-new-interview/fixture/interviewer/.claude/settings.local.json
new file mode 100644
index 00000000..e0161fff
--- /dev/null
+++ b/cells/agent-new-interview/fixture/interviewer/.claude/settings.local.json
@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "async": true,
+            "asyncRewake": true,
+            "command": "$ST_HOOKS/claude-session-start.sh"
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "$ST_HOOKS/claude-pre-compact.sh"
+          }
+        ]
+      }
+    ],
+    "StopFailure": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "$ST_HOOKS/claude-stop-failure.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

From 181ab0e28ae6337feed85716bbce0aaf63ec8559 Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 20:12:19 +0200
Subject: [PATCH 03/12] evals: route interview seat through Axe

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 bin/check-event-first.sh                      |  7 +++
 bin/check-harness-contract.sh                 | 26 ++++++++---
 bin/check-model-policy-mutations.sh           | 25 +++++++++++
 bin/check-model-policy.sh                     | 44 ++++++++++++++++++-
 bin/corpus-inventory.sh                       |  8 ++--
 bin/model-seat-inventory.sh                   | 10 ++++-
 cells/agent-new-interview/README.md           | 29 +++++++++++-
 .../agent-new-interview.kdl                   |  2 +-
 docs/vrs/spec.md                              | 14 ++++++
 9 files changed, 152 insertions(+), 13 deletions(-)

diff --git a/bin/check-event-first.sh b/bin/check-event-first.sh
index f47d96d4..d5c9702b 100755
--- a/bin/check-event-first.sh
+++ b/bin/check-event-first.sh
@@ -32,6 +32,13 @@ required=(
 while IFS=$'\t' read -r cell agent _harness _workspace _st_agent command_line; do
   kdl="cells/$cell/$cell.kdl"
   command_text="$(sed -n "${command_line}p" "$kdl")"
+  if grep -Fq 'exec axe agent launch ' <<< "$command_text"; then
+    grep -Fq -- '--mode managed-unattended' <<< "$command_text" ||
+      fail "$kdl:$command_line agent $agent Axe launch omits managed-unattended mode"
+    grep -Fq -- '--boot managed-v1' <<< "$command_text" ||
+      fail "$kdl:$command_line agent $agent Axe launch omits managed-v1 event-first boot contract"
+    continue
+  fi
   for phrase in "${required[@]}"; do
     grep -Fiq "$phrase" <<< "$command_text" ||
       fail "$kdl:$command_line agent $agent does not teach '$phrase'"
diff --git a/bin/check-harness-contract.sh b/bin/check-harness-contract.sh
index e03e1a68..41ae40a4 100755
--- a/bin/check-harness-contract.sh
+++ b/bin/check-harness-contract.sh
@@ -103,6 +103,16 @@ while IFS=$'\t' read -r cell agent harness workspace st_agent command_line; do
 
   kdl="cells/$cell/$cell.kdl"
   command_text="$(sed -n "${command_line}p" "$kdl")"
+  axe_launch=0
+  if grep -Fq 'exec axe agent launch ' <<< "$command_text"; then
+    axe_launch=1
+    grep -Fq -- '--mode managed-unattended' <<< "$command_text" ||
+      { echo "FAIL: $cell/$agent Axe launch omits managed-unattended mode" >&2; failed=1; }
+    grep -Fq -- '--boot managed-v1' <<< "$command_text" ||
+      { echo "FAIL: $cell/$agent Axe launch omits managed-v1 boot contract" >&2; failed=1; }
+    ! grep -Fq -- '--account ' <<< "$command_text" ||
+      { echo "FAIL: $cell/$agent durably pins an account instead of using Axe selection" >&2; failed=1; }
+  fi
   if [ "$harness" = "Claude" ]; then
     [ -s "$target/CLAUDE.md" ] ||
       { echo "FAIL: $cell/$agent has no non-empty CLAUDE.md" >&2; failed=1; continue; }
@@ -112,8 +122,10 @@ while IFS=$'\t' read -r cell agent harness workspace st_agent command_line; do
       { echo "FAIL: $cell/$agent has no non-empty PERSONA.md" >&2; failed=1; }
     cmp -s harness/claude-settings.local.json "$target/.claude/settings.local.json" ||
       { echo "FAIL: $cell/$agent does not materialize the canonical Claude hooks" >&2; failed=1; }
-    grep -Fq 'Read CLAUDE.md.' <<< "$command_text" ||
-      { echo "FAIL: $cell/$agent launch does not use its Claude loader" >&2; failed=1; }
+    if [ "$axe_launch" -eq 0 ]; then
+      grep -Fq 'Read CLAUDE.md.' <<< "$command_text" ||
+        { echo "FAIL: $cell/$agent launch does not use its Claude loader" >&2; failed=1; }
+    fi
     [ ! -e "$target/.codex/hooks.json" ] ||
       { echo "FAIL: $cell/$agent Claude workspace mixes in Codex hooks" >&2; failed=1; }
   else
@@ -121,10 +133,12 @@ while IFS=$'\t' read -r cell agent harness workspace st_agent command_line; do
       { echo "FAIL: $cell/$agent has no non-empty AGENTS.md" >&2; failed=1; continue; }
     cmp -s harness/codex-hooks.json "$target/.codex/hooks.json" ||
       { echo "FAIL: $cell/$agent does not materialize the canonical Codex hooks" >&2; failed=1; }
-    grep -Fq 'Read AGENTS.md.' <<< "$command_text" ||
-      { echo "FAIL: $cell/$agent launch does not use its Codex loader" >&2; failed=1; }
-    grep -Fq -- '--dangerously-bypass-hook-trust' <<< "$command_text" ||
-      { echo "FAIL: $cell/$agent launch does not trust the declared Codex hooks" >&2; failed=1; }
+    if [ "$axe_launch" -eq 0 ]; then
+      grep -Fq 'Read AGENTS.md.' <<< "$command_text" ||
+        { echo "FAIL: $cell/$agent launch does not use its Codex loader" >&2; failed=1; }
+      grep -Fq -- '--dangerously-bypass-hook-trust' <<< "$command_text" ||
+        { echo "FAIL: $cell/$agent launch does not trust the declared Codex hooks" >&2; failed=1; }
+    fi
     [ ! -e "$target/.claude/settings.local.json" ] ||
       { echo "FAIL: $cell/$agent Codex workspace mixes in Claude hooks" >&2; failed=1; }
   fi
diff --git a/bin/check-model-policy-mutations.sh b/bin/check-model-policy-mutations.sh
index 3ff9a7da..de3ace96 100755
--- a/bin/check-model-policy-mutations.sh
+++ b/bin/check-model-policy-mutations.sh
@@ -59,3 +59,28 @@ grep -Fq 'selects Opus' "$opus_output" || {
 }
 
 echo "PASS: nested provider launches are counted independently; unpinned and Opus mutations fail"
+
+mkdir -p "$scratch/axe-valid" "$scratch/axe-pinned"
+printf '%s\n' \
+  'team "x" { agent "i" { workspace "./i"; env { ST_AGENT "x.i" }; command #"exec axe agent launch --harness claude --persona generalist --model claude-sonnet-5 --effort medium --mode managed-unattended --boot managed-v1"#; ding } }' \
+  >"$scratch/axe-valid/axe.kdl"
+printf '%s\n' \
+  'team "x" { agent "i" { workspace "./i"; env { ST_AGENT "x.i" }; command #"exec axe agent launch --harness claude --persona generalist --model claude-sonnet-5 --effort medium --mode managed-unattended --boot managed-v1 --account claude/example"#; ding } }' \
+  >"$scratch/axe-pinned/axe.kdl"
+
+bash "$checker" "$scratch/axe-valid" >/dev/null || {
+  echo "FAIL: model policy rejected a fully typed, account-neutral Axe launch" >&2
+  exit 1
+}
+axe_pinned_output="$scratch/axe-pinned.out"
+if bash "$checker" "$scratch/axe-pinned" >"$axe_pinned_output" 2>&1; then
+  echo "FAIL: model policy accepted a durable Axe account pin" >&2
+  exit 1
+fi
+grep -Fq 'durably pins an account' "$axe_pinned_output" || {
+  echo "FAIL: pinned Axe account mutation lacked the expected diagnostic" >&2
+  cat "$axe_pinned_output" >&2
+  exit 1
+}
+
+echo "PASS: typed Axe launches are counted and durable account pins fail"
diff --git a/bin/check-model-policy.sh b/bin/check-model-policy.sh
index 52133e6e..150b42d7 100755
--- a/bin/check-model-policy.sh
+++ b/bin/check-model-policy.sh
@@ -31,6 +31,8 @@ while IFS=: read -r file line text; do
   fi
 
   remaining="$code"
+  remaining="${remaining//--harness claude/--harness claude_harness}"
+  remaining="${remaining//--harness codex/--harness codex_harness}"
   provider_regex='(^|[^[:alnum:]_-])(exec[[:space:]]+)?(claude|codex)[[:space:]]+-'
   while [[ "$remaining" =~ $provider_regex ]]; do
     match="${BASH_REMATCH[0]}"
@@ -65,9 +67,49 @@ while IFS=: read -r file line text; do
 
     remaining="$after"
   done
+
+  axe_remaining="$code"
+  axe_regex='(^|[^[:alnum:]_-])(exec[[:space:]]+)?axe[[:space:]]+agent[[:space:]]+launch[[:space:]]+'
+  while [[ "$axe_remaining" =~ $axe_regex ]]; do
+    axe_match="${BASH_REMATCH[0]}"
+    axe_after="${axe_remaining#*"$axe_match"}"
+    axe_invocation="$axe_match$axe_after"
+    if [[ "$axe_after" =~ $axe_regex ]]; then
+      next_axe_match="${BASH_REMATCH[0]}"
+      axe_invocation="$axe_match${axe_after%%"$next_axe_match"*}"
+    fi
+
+    ((launches += 1))
+    [[ "$axe_invocation" != *"--account "* ]] ||
+      fail "$file:$line Axe launch durably pins an account instead of selecting per run"
+    [[ "$axe_invocation" == *"--persona "* ]] ||
+      fail "$file:$line Axe launch omits --persona"
+    [[ "$axe_invocation" == *"--mode managed-unattended"* ]] ||
+      fail "$file:$line Axe launch omits --mode managed-unattended"
+    [[ "$axe_invocation" == *"--boot managed-v1"* ]] ||
+      fail "$file:$line Axe launch omits --boot managed-v1"
+
+    if [[ "$axe_invocation" == *"--harness claude"* ]]; then
+      ((claude_launches += 1))
+      [[ "$axe_invocation" == *"--model claude-sonnet-5"* ]] ||
+        fail "$file:$line launches Claude through Axe without --model claude-sonnet-5"
+      [[ "$axe_invocation" == *"--effort medium"* ]] ||
+        fail "$file:$line launches Claude through Axe without --effort medium"
+    elif [[ "$axe_invocation" == *"--harness codex"* ]]; then
+      ((codex_launches += 1))
+      [[ "$axe_invocation" == *"--model gpt-5.6-sol"* ]] ||
+        fail "$file:$line launches Codex through Axe without --model gpt-5.6-sol"
+      [[ "$axe_invocation" == *"--effort medium"* ]] ||
+        fail "$file:$line launches Codex through Axe without --effort medium"
+    else
+      fail "$file:$line Axe launch has no supported explicit --harness claude|codex"
+    fi
+
+    axe_remaining="$axe_after"
+  done
 done < <(
   rg --no-ignore -n --no-heading \
-    'exec[[:space:]]+(claude|codex)|(^|[^[:alnum:]_-])(claude|codex)[[:space:]]+-' \
+    'exec[[:space:]]+(claude|codex)|(^|[^[:alnum:]_-])(claude|codex)[[:space:]]+-|axe[[:space:]]+agent[[:space:]]+launch' \
     "$scan_root" -g '*.kdl' -g '*.sh' -g '!**/_git/**' || true
 )
 
diff --git a/bin/corpus-inventory.sh b/bin/corpus-inventory.sh
index ed35fed9..2ee412f8 100755
--- a/bin/corpus-inventory.sh
+++ b/bin/corpus-inventory.sh
@@ -57,15 +57,17 @@ for cell in "${cells[@]}"; do
       code="${code%%//*}"
     fi
     if [[ "$code" =~ exec[[:space:]]+claude([[:space:]]|$) ]] ||
-      [[ "$code" =~ (^|[^[:alnum:]_-])claude[[:space:]]+- ]]; then
+      [[ "$code" =~ (^|[^[:alnum:]_-])claude[[:space:]]+- ]] ||
+      [[ "$code" =~ exec[[:space:]]+axe[[:space:]]+agent[[:space:]]+launch[[:space:]].*--harness[[:space:]]+claude([[:space:]]|$) ]]; then
       ((claude += 1))
     elif [[ "$code" =~ exec[[:space:]]+codex([[:space:]]|$) ]] ||
-      [[ "$code" =~ (^|[^[:alnum:]_-])codex[[:space:]]+- ]]; then
+      [[ "$code" =~ (^|[^[:alnum:]_-])codex[[:space:]]+- ]] ||
+      [[ "$code" =~ exec[[:space:]]+axe[[:space:]]+agent[[:space:]]+launch[[:space:]].*--harness[[:space:]]+codex([[:space:]]|$) ]]; then
       ((codex += 1))
     fi
   done < <(
     rg -n --no-heading \
-      'exec[[:space:]]+(claude|codex)|(^|[^[:alnum:]_-])(claude|codex)[[:space:]]+-' \
+      'exec[[:space:]]+(claude|codex)|(^|[^[:alnum:]_-])(claude|codex)[[:space:]]+-|exec[[:space:]]+axe[[:space:]]+agent[[:space:]]+launch' \
       "$cell_dir" -g '*.kdl' -g '*.sh' -g '!**/_git/**' || true
   )
 
diff --git a/bin/model-seat-inventory.sh b/bin/model-seat-inventory.sh
index e429ff1d..b3ba6919 100755
--- a/bin/model-seat-inventory.sh
+++ b/bin/model-seat-inventory.sh
@@ -100,6 +100,14 @@ while IFS= read -r cell; do
         } else if ($0 ~ /exec codex[[:space:]]/) {
           harness = "Codex"
           command_line = NR
+        } else if ($0 ~ /exec axe agent launch[[:space:]]/ &&
+                   $0 ~ /--harness[[:space:]]+claude([[:space:]]|$)/) {
+          harness = "Claude"
+          command_line = NR
+        } else if ($0 ~ /exec axe agent launch[[:space:]]/ &&
+                   $0 ~ /--harness[[:space:]]+codex([[:space:]]|$)/) {
+          harness = "Codex"
+          command_line = NR
         }
       }
       if (trimmed == child_indent "ding") {
@@ -118,7 +126,7 @@ while IFS= read -r cell; do
 done < <(find cells -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | LC_ALL=C sort)
 
 launches="$(
-  rg -n --no-heading '^[[:space:]]*command[[:space:]]+.*exec (claude|codex)[[:space:]]' \
+  rg -n --no-heading '^[[:space:]]*command[[:space:]]+.*exec ((claude|codex)[[:space:]]|axe agent launch[[:space:]])' \
     cells/*/*.kdl | wc -l | tr -d ' '
 )"
 rows="$(wc -l < "$inventory" | tr -d ' ')"
diff --git a/cells/agent-new-interview/README.md b/cells/agent-new-interview/README.md
index cdabbb9d..3dea4fea 100644
--- a/cells/agent-new-interview/README.md
+++ b/cells/agent-new-interview/README.md
@@ -2,7 +2,9 @@
 
 This is the paid judgment half of the B2 `axe agent new` proposal. A
 short-lived Claude Sonnet interviewer receives exactly one sentence from the
-human. It may inspect the frozen local snapshot of the referenced issue, then
+human. It is launched through the typed `axe agent launch` boundary with no
+durable account pin, so Axe selects from the configured account pool for that
+run. It may inspect the frozen local snapshot of the referenced issue, then
 submits one typed semantic intent record.
 
 The interviewer cannot write the final Agent Spec. `submit-intent` validates a
@@ -25,3 +27,28 @@ Run it only with explicit paid-run authorization:
 ```sh
 st2 eval ./cells/agent-new-interview/
 ```
+
+## Current composition gate
+
+This proposed cell intentionally uses the production typed launch boundary.
+The current `st2 eval` team loader still boots `team { agent { command ... } }`
+seats as transient commands; it does not materialize those seats as canonical
+Agent Specs in the temporary catalog.
+
+Current Axe admission requires:
+
+1. `CATALOG`, `ST_ROOT`, and `PTY_ROOT` to agree on the st2 eval catalog; and
+2. `ST_AGENT` to resolve to exactly one canonical Agent Spec.
+
+With the eval roots supplied, admission reaches the second check and rejects
+`new.interviewer` because the temporary catalog contains zero canonical Agent
+Specs for that identity. Therefore this paid cell currently fails at boot
+before account selection or provider launch. Tokenlens can independently
+return an eligible Claude account, so lack of pool quota is not the blocker.
+
+The principled fix belongs at the st2 eval/Axe composition seam: eval team
+seats should be represented by canonical Agent Specs (or eval should directly
+execute a canonical fleet declaration) and export the catalog-derived roots.
+This cell must not work around the gap by fabricating an Agent Spec from inside
+the seat, pinning an account in KDL, or launching bare Claude with ambient
+credentials.
diff --git a/cells/agent-new-interview/agent-new-interview.kdl b/cells/agent-new-interview/agent-new-interview.kdl
index 2612f66a..e6887b25 100644
--- a/cells/agent-new-interview/agent-new-interview.kdl
+++ b/cells/agent-new-interview/agent-new-interview.kdl
@@ -5,7 +5,7 @@ team "new" {
   agent "interviewer" {
     workspace "./interviewer"
     env { ST_AGENT "new.interviewer" }
-    command #"exec claude --model claude-sonnet-5 --effort medium --permission-mode auto 'You just cold-started in a hermetic st2 eval. Read CLAUDE.md. Drain the inbox once with st2 message using $ST_ROOT and $ST_AGENT, then set status available; presence is best-effort if this flat eval seat cannot resolve. If the drain contains no work, stand by for DING. After any DING, drain the inbox once again, act on every message, archive each handled item, and report completion or blockers over the st2 bus. Pipe every message body through stdin with a quoted heredoc delimiter.'"#
+    command #"exec axe agent launch --harness claude --persona generalist --model claude-sonnet-5 --effort medium --mode managed-unattended --boot managed-v1"#
     ding
   }
 }
diff --git a/docs/vrs/spec.md b/docs/vrs/spec.md
index 34a145b4..3cbb8a52 100644
--- a/docs/vrs/spec.md
+++ b/docs/vrs/spec.md
@@ -101,6 +101,20 @@ one-sentence human request
   explicit in that intent; the deterministic boundary owns canonical KDL,
   keeps account selection out of durable state, and places the goal and
   references in an initial inbox Resource.
+- The temporary interviewer itself launches through typed
+  `axe agent launch` with explicit harness, model, effort, persona, mode, and
+  boot axes. The cell does not pin `--account`: Axe selects an eligible
+  account per run. Corpus inventory, model policy, lifecycle, and harness
+  checks recognize this typed launch as a paid model seat and reject durable
+  account pins.
+- **Current composition gate:** `st2 eval` currently boots legacy team
+  `command` seats without creating a canonical Agent Spec for the temporary
+  identity. Axe correctly rejects that seat before account selection because
+  `ST_AGENT` resolves to zero canonical specs. This is a blocked paid
+  experiment, not evidence against account selection or interviewer judgment.
+  The accepted direction is to make eval seats canonical at the runtime seam;
+  a cell-local compatibility wrapper, fabricated spec, account pin, or ambient
+  bare-provider launch is outside the contract.
 - Passing model-free evidence proves the bundle boundary and its negative
   controls only. The autonomous-selection claim remains unaccepted until the
   paid judgment cell has a structured PASS receipt.

From 901d9f2598c8a11187db94176345ad0dbdb7f1ec Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 21:43:57 +0200
Subject: [PATCH 04/12] evals: exercise canonical agent runtime

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 AGENT-SPEC.md                                 |  4 +-
 CATALOG.md                                    |  6 ++-
 README.md                                     |  2 +-
 bin/check-corpus.sh                           | 14 +++----
 bin/check-model-policy-mutations.sh           | 25 +++++++++++
 bin/check-model-policy.sh                     | 15 +++++--
 bin/corpus-inventory.sh                       | 27 ++++++++----
 cells/agent-new-interview/README.md           | 42 ++++++++-----------
 .../agent-new-interview.kdl                   | 15 +++----
 .../fixture/_templates/bus.st2.md             |  7 ++++
 .../fixture/agent.kdl.template                | 28 +++++++++++++
 .../fixture/publish-interviewer.sh            | 29 +++++++++++++
 cells/canonical-agent-runtime-smoke/README.md | 13 ++++++
 .../canonical-agent-runtime-smoke.kdl         | 21 ++++++++++
 .../fixture/agents/evalhost/probe/agent.kdl   |  9 ++++
 .../fixture/probe.sh                          | 22 ++++++++++
 cells/canonical-agent-runtime-smoke/task.md   |  1 +
 docs/vrs/spec.md                              | 26 ++++++++----
 evidence/harness-exclusions.tsv               |  1 +
 19 files changed, 240 insertions(+), 67 deletions(-)
 create mode 100644 cells/agent-new-interview/fixture/_templates/bus.st2.md
 create mode 100644 cells/agent-new-interview/fixture/agent.kdl.template
 create mode 100755 cells/agent-new-interview/fixture/publish-interviewer.sh
 create mode 100644 cells/canonical-agent-runtime-smoke/README.md
 create mode 100644 cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl
 create mode 100644 cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl
 create mode 100755 cells/canonical-agent-runtime-smoke/fixture/probe.sh
 create mode 100644 cells/canonical-agent-runtime-smoke/task.md

diff --git a/AGENT-SPEC.md b/AGENT-SPEC.md
index f1e46481..2b5bda16 100644
--- a/AGENT-SPEC.md
+++ b/AGENT-SPEC.md
@@ -1,8 +1,8 @@
 # Canonical st2 agent specification
 
 This is the sole agent-authoring specification for this repository. It is pinned to st2
-[`9887b2842222def0838c2cd82e6c24c218f7efa6`](https://github.com/compoundingtech/st2/commit/9887b2842222def0838c2cd82e6c24c218f7efa6)
-(`0.1.0`, source `9887b28`). It documents the hand-authored KDL accepted at that commit. Do not infer
+[`0ec6a22e877f9374260202c5f76dabc4579fc7e3`](https://github.com/compoundingtech/st2/commit/0ec6a22e877f9374260202c5f76dabc4579fc7e3)
+(`0.1.0`, source `0ec6a22`). It documents the hand-authored KDL accepted at that commit. Do not infer
 additional fields or commands from older corpus fixtures.
 
 st2 runs long-lived `service` agents made of interactive `pty` tasks and terminal-free `exec` tasks.
diff --git a/CATALOG.md b/CATALOG.md
index 87ca4867..8df7a740 100644
--- a/CATALOG.md
+++ b/CATALOG.md
@@ -1,7 +1,7 @@
 <!-- Generated by bin/generate-catalog.sh from cell KDL and evidence/*.tsv. Do not edit. -->
 # Current eval catalog and evidence
 
-This is the sole current corpus surface: **47 included cells** (15 model-free,
+This is the sole current corpus surface: **48 included cells** (16 model-free,
 32 model-backed) and **4 retired exclusions**. Inventory fields are derived from the active
 KDL and executable judge scripts. Latest accepted PASS evidence remains distinct from the append-only run
 history: a failed last run is visible without being advertised as accepted evidence, and cells with no
@@ -18,6 +18,7 @@ harness-native loader plus canonical hook file.
 |---|---|---|---:|---|---|---:|---|---|
 | `agent-new-bundle-contract` | model-free | — | 0 | none | `60s` | 5 | — | **NO STRUCTURED RUN** |
 | `agent-new-interview` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 4 | — | **NO STRUCTURED RUN** |
+| `canonical-agent-runtime-smoke` | model-free | — | 0 | none | `30s` | 2 | — | **NO STRUCTURED RUN** |
 | `context-resource-continuity` | model-free | — | 0 | none | `90s` | 4 | — | **NO STRUCTURED RUN** |
 | `crash-ding` | mixed | `claude-sonnet-5+gpt-5.6-sol` / medium | 4 | high | `180s` | 5 | — | **NO STRUCTURED RUN** |
 | `ding-mode` | Claude | `claude-sonnet-5` / medium | 2 | medium | `1200s` | 4 | — | **NO STRUCTURED RUN** |
@@ -84,6 +85,7 @@ while the last-run column makes a recorded failure distinct from a cell with no
 ## Harness hook exclusions
 
 - `agent-new-bundle-contract` / `cell` — deterministic semantic-intent lowering and mutation probe; no harness seat
+- `canonical-agent-runtime-smoke` / `cell` — deterministic canonical Agent Spec boot, kickoff, reply, and teardown probe; no harness seat
 - `context-resource-continuity` / `cell` — deterministic native context/resource restart probe; no harness seat
 - `docs` / `judge:cold-reader` — one-shot offline Claude print grader; no bus identity, DING, or hook surface
 - `exec-lifecycle-logging` / `cell` — deterministic native exec lifecycle probe; no harness seat
@@ -100,7 +102,7 @@ while the last-run column makes a recorded failure distinct from a cell with no
 - `targeted-reconcile-isolation` / `cell` — deterministic selected reconcile isolation probe; no bus-connected agent
 - `two-networks-coexist` / `cell` — deterministic catalog-isolation probe; no harness seat
 
-These **16** rows are generated from structured exclusions. A cell-level row is required for
+These **17** rows are generated from structured exclusions. A cell-level row is required for
 every derived model-free cell. The one-shot docs cold reader is a model-backed grader, but not a bus-connected
 agent: it has no st2 identity, DING sidecar, or lifecycle hooks.
 
diff --git a/README.md b/README.md
index 37808f25..717030d0 100644
--- a/README.md
+++ b/README.md
@@ -96,7 +96,7 @@ VERDICT: PASS
 ```
 
 Requirements are `st2 0.1.0` from source
-[`9887b28`](https://github.com/compoundingtech/st2/commit/9887b2842222def0838c2cd82e6c24c218f7efa6),
+[`0ec6a22`](https://github.com/compoundingtech/st2/commit/0ec6a22e877f9374260202c5f76dabc4579fc7e3),
 `pty`, Bash, Git, `jq`, Rust/Cargo for the pinned KDL parser gate, and Node for JavaScript fixtures. A paid cell
 also needs every harness named by its dry-run row.
 
diff --git a/bin/check-corpus.sh b/bin/check-corpus.sh
index fc85e69d..0d9684c3 100755
--- a/bin/check-corpus.sh
+++ b/bin/check-corpus.sh
@@ -5,10 +5,10 @@ set -euo pipefail
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 
-expected_source="9887b28"
-expected_source_full="9887b2842222def0838c2cd82e6c24c218f7efa6"
-expected_binary_sha256="d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d"
-expected_version_regex='^st2 0\.1\.0 — running from local source \(9887b28, .+ ago\)$'
+expected_source="0ec6a22"
+expected_source_full="0ec6a22e877f9374260202c5f76dabc4579fc7e3"
+expected_binary_sha256="df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db"
+expected_version_regex='^st2 0\.1\.0 — running from local source \(0ec6a22, .+ ago\)$'
 st2_path="$(command -v st2)"
 actual_version="$(st2 --version)"
 [[ "$actual_version" =~ $expected_version_regex ]] || {
@@ -20,11 +20,7 @@ actual_binary_sha256="$(sha256sum "$st2_path" | awk '{ print $1 }')"
   echo "FAIL: expected st2 binary sha256 $expected_binary_sha256, found $actual_binary_sha256 at $st2_path" >&2
   exit 1
 }
-LC_ALL=C grep -aFq "$expected_source_full" "$st2_path" || {
-  echo "FAIL: st2 binary at $st2_path does not embed full pinned source $expected_source_full" >&2
-  exit 1
-}
-echo "PASS: pinned runner source $expected_source ($actual_version; sha256 $actual_binary_sha256)"
+echo "PASS: pinned runner source $expected_source_full ($actual_version; sha256 $actual_binary_sha256)"
 
 mapfile -d '' shell_files < <(
   find bin cells -type f -name '*.sh' -not -path '*/_git/*' -print0 | sort -z
diff --git a/bin/check-model-policy-mutations.sh b/bin/check-model-policy-mutations.sh
index de3ace96..c97f636e 100755
--- a/bin/check-model-policy-mutations.sh
+++ b/bin/check-model-policy-mutations.sh
@@ -84,3 +84,28 @@ grep -Fq 'durably pins an account' "$axe_pinned_output" || {
 }
 
 echo "PASS: typed Axe launches are counted and durable account pins fail"
+
+mkdir -p "$scratch/canonical-valid" "$scratch/canonical-pinned"
+printf '%s\n' \
+  'agent "i" { argv "@ADAPTER@" "agent" "launch" "--harness" "claude" "--persona" "generalist" "--model" "claude-sonnet-5" "--effort" "medium" "--mode" "managed-unattended" "--boot" "managed-v1" }' \
+  >"$scratch/canonical-valid/agent.kdl.template"
+printf '%s\n' \
+  'agent "i" { argv "@ADAPTER@" "agent" "launch" "--harness" "claude" "--persona" "generalist" "--model" "claude-sonnet-5" "--effort" "medium" "--mode" "managed-unattended" "--boot" "managed-v1" "--account" "claude/example" }' \
+  >"$scratch/canonical-pinned/agent.kdl.template"
+
+bash "$checker" "$scratch/canonical-valid" >/dev/null || {
+  echo "FAIL: model policy rejected a canonical managed-launch template" >&2
+  exit 1
+}
+canonical_pinned_output="$scratch/canonical-pinned.out"
+if bash "$checker" "$scratch/canonical-pinned" >"$canonical_pinned_output" 2>&1; then
+  echo "FAIL: model policy accepted an account pin in a canonical managed-launch template" >&2
+  exit 1
+fi
+grep -Fq 'durably pins an account' "$canonical_pinned_output" || {
+  echo "FAIL: canonical template account pin lacked the expected diagnostic" >&2
+  cat "$canonical_pinned_output" >&2
+  exit 1
+}
+
+echo "PASS: canonical managed-launch templates are counted and durable account pins fail"
diff --git a/bin/check-model-policy.sh b/bin/check-model-policy.sh
index 150b42d7..f2b53ed0 100755
--- a/bin/check-model-policy.sh
+++ b/bin/check-model-policy.sh
@@ -29,6 +29,10 @@ while IFS=: read -r file line text; do
   if [[ "$file" == *.kdl ]]; then
     code="${code%%//*}"
   fi
+  if [[ "$file" == *.kdl.template && "$code" == *argv* && "$code" == *'"agent" "launch"'* ]]; then
+    code="${code//\"/}"
+    code="${code/agent launch/axe agent launch}"
+  fi
 
   remaining="$code"
   remaining="${remaining//--harness claude/--harness claude_harness}"
@@ -108,9 +112,14 @@ while IFS=: read -r file line text; do
     axe_remaining="$axe_after"
   done
 done < <(
-  rg --no-ignore -n --no-heading \
-    'exec[[:space:]]+(claude|codex)|(^|[^[:alnum:]_-])(claude|codex)[[:space:]]+-|axe[[:space:]]+agent[[:space:]]+launch' \
-    "$scan_root" -g '*.kdl' -g '*.sh' -g '!**/_git/**' || true
+  {
+    rg --no-ignore -n --no-heading \
+      'exec[[:space:]]+(claude|codex)|(^|[^[:alnum:]_-])(claude|codex)[[:space:]]+-|axe[[:space:]]+agent[[:space:]]+launch' \
+      "$scan_root" -g '*.kdl' -g '*.sh' -g '!**/_git/**' || true
+    rg --no-ignore -n --no-heading \
+      '"agent"[[:space:]]+"launch"' \
+      "$scan_root" -g '*.kdl.template' || true
+  }
 )
 
 [ "$launches" -gt 0 ] || fail "no maintained Claude or Codex launch sites were found"
diff --git a/bin/corpus-inventory.sh b/bin/corpus-inventory.sh
index 2ee412f8..e9c2d01a 100755
--- a/bin/corpus-inventory.sh
+++ b/bin/corpus-inventory.sh
@@ -56,19 +56,28 @@ for cell in "${cells[@]}"; do
     if [[ "$file" == *.kdl ]]; then
       code="${code%%//*}"
     fi
-    if [[ "$code" =~ exec[[:space:]]+claude([[:space:]]|$) ]] ||
-      [[ "$code" =~ (^|[^[:alnum:]_-])claude[[:space:]]+- ]] ||
-      [[ "$code" =~ exec[[:space:]]+axe[[:space:]]+agent[[:space:]]+launch[[:space:]].*--harness[[:space:]]+claude([[:space:]]|$) ]]; then
+    scan_code="$code"
+    if [[ "$file" == *.kdl.template ]]; then
+      scan_code="${code//\"/}"
+    fi
+    if [[ "$scan_code" =~ exec[[:space:]]+claude([[:space:]]|$) ]] ||
+      [[ "$scan_code" =~ (^|[^[:alnum:]_-])claude[[:space:]]+- ]] ||
+      [[ "$scan_code" =~ (exec[[:space:]]+axe|argv[[:space:]]+[^[:space:]]+)[[:space:]]+agent[[:space:]]+launch[[:space:]].*--harness[[:space:]]+claude([[:space:]]|$) ]]; then
       ((claude += 1))
-    elif [[ "$code" =~ exec[[:space:]]+codex([[:space:]]|$) ]] ||
-      [[ "$code" =~ (^|[^[:alnum:]_-])codex[[:space:]]+- ]] ||
-      [[ "$code" =~ exec[[:space:]]+axe[[:space:]]+agent[[:space:]]+launch[[:space:]].*--harness[[:space:]]+codex([[:space:]]|$) ]]; then
+    elif [[ "$scan_code" =~ exec[[:space:]]+codex([[:space:]]|$) ]] ||
+      [[ "$scan_code" =~ (^|[^[:alnum:]_-])codex[[:space:]]+- ]] ||
+      [[ "$scan_code" =~ (exec[[:space:]]+axe|argv[[:space:]]+[^[:space:]]+)[[:space:]]+agent[[:space:]]+launch[[:space:]].*--harness[[:space:]]+codex([[:space:]]|$) ]]; then
       ((codex += 1))
     fi
   done < <(
-    rg -n --no-heading \
-      'exec[[:space:]]+(claude|codex)|(^|[^[:alnum:]_-])(claude|codex)[[:space:]]+-|exec[[:space:]]+axe[[:space:]]+agent[[:space:]]+launch' \
-      "$cell_dir" -g '*.kdl' -g '*.sh' -g '!**/_git/**' || true
+    {
+      rg -n --no-heading \
+        'exec[[:space:]]+(claude|codex)|(^|[^[:alnum:]_-])(claude|codex)[[:space:]]+-|axe[[:space:]]+agent[[:space:]]+launch' \
+        "$cell_dir" -g '*.kdl' -g '*.sh' -g '!**/_git/**' || true
+      rg -n --no-heading \
+        '"agent"[[:space:]]+"launch"' \
+        "$cell_dir" -g '*.kdl.template' || true
+    }
   )
 
   seats=$((claude + codex))
diff --git a/cells/agent-new-interview/README.md b/cells/agent-new-interview/README.md
index 3dea4fea..b7cf84d5 100644
--- a/cells/agent-new-interview/README.md
+++ b/cells/agent-new-interview/README.md
@@ -28,27 +28,21 @@ Run it only with explicit paid-run authorization:
 st2 eval ./cells/agent-new-interview/
 ```
 
-## Current composition gate
-
-This proposed cell intentionally uses the production typed launch boundary.
-The current `st2 eval` team loader still boots `team { agent { command ... } }`
-seats as transient commands; it does not materialize those seats as canonical
-Agent Specs in the temporary catalog.
-
-Current Axe admission requires:
-
-1. `CATALOG`, `ST_ROOT`, and `PTY_ROOT` to agree on the st2 eval catalog; and
-2. `ST_AGENT` to resolve to exactly one canonical Agent Spec.
-
-With the eval roots supplied, admission reaches the second check and rejects
-`new.interviewer` because the temporary catalog contains zero canonical Agent
-Specs for that identity. Therefore this paid cell currently fails at boot
-before account selection or provider launch. Tokenlens can independently
-return an eligible Claude account, so lack of pool quota is not the blocker.
-
-The principled fix belongs at the st2 eval/Axe composition seam: eval team
-seats should be represented by canonical Agent Specs (or eval should directly
-execute a canonical fleet declaration) and export the catalog-derived roots.
-This cell must not work around the gap by fabricating an Agent Spec from inside
-the seat, pinning an account in KDL, or launching bare Claude with ambient
-credentials.
+## Canonical eval seam
+
+The cell copies its fixture, deterministically publishes one canonical
+`agents/evalhost/interviewer/agent.kdl` from the active runtime profile, and
+then opts into st2's `canonical-agents` admission. The profile supplies the
+exact immutable Axe adapter, absolute runtime-profile path, and canonical
+generalist prompt. The declaration itself owns the typed launch trajectory and
+contains no account pin.
+
+This makes the paid cell environment-bound by design: the selected runtime
+profile is an explicit test prerequisite and part of the run evidence. The
+cell is not hermetic across different profile artifacts.
+
+st2 validates and materializes that declaration before launch, routes the
+kickoff through its canonical inbox, and requires a fresh interviewer reply
+before the singleton eval can complete. The paid judgment run remains held
+until the host's Claude workspace-trust projection has independent evidence;
+the model-free bundle cell does not prove provider readiness.
diff --git a/cells/agent-new-interview/agent-new-interview.kdl b/cells/agent-new-interview/agent-new-interview.kdl
index e6887b25..1f94eca1 100644
--- a/cells/agent-new-interview/agent-new-interview.kdl
+++ b/cells/agent-new-interview/agent-new-interview.kdl
@@ -1,20 +1,17 @@
 // One short human request is classified by a constrained temporary interviewer.
 // The interviewer emits semantic intent only; the fixture's deterministic submit
 // boundary validates that intent and renders the final B2 bundle.
-team "new" {
-  agent "interviewer" {
-    workspace "./interviewer"
-    env { ST_AGENT "new.interviewer" }
-    command #"exec axe agent launch --harness claude --persona generalist --model claude-sonnet-5 --effort medium --mode managed-unattended --boot managed-v1"#
-    ding
-  }
-}
+host "evalhost"
 
 eval {
   copy "./fixture"
+  run "publish-canonical-interviewer" {
+    command "bash ./publish-interviewer.sh"
+  }
+  canonical-agents
   message {
     from "requester"
-    to "new.interviewer"
+    to "evalhost.interviewer"
     content "./task.md"
   }
   max-timeout "300s"
diff --git a/cells/agent-new-interview/fixture/_templates/bus.st2.md b/cells/agent-new-interview/fixture/_templates/bus.st2.md
new file mode 100644
index 00000000..f99a4448
--- /dev/null
+++ b/cells/agent-new-interview/fixture/_templates/bus.st2.md
@@ -0,0 +1,7 @@
+# st2 message bus
+
+Use the native st2 message bus for coordination.
+
+- Read your inbox with `st2 message inbox "$ST_AGENT"`.
+- Send message bodies through stdin with a quoted heredoc delimiter.
+- Reply to the requester after the bounded task is complete.
diff --git a/cells/agent-new-interview/fixture/agent.kdl.template b/cells/agent-new-interview/fixture/agent.kdl.template
new file mode 100644
index 00000000..57274912
--- /dev/null
+++ b/cells/agent-new-interview/fixture/agent.kdl.template
@@ -0,0 +1,28 @@
+agent "interviewer" {
+  identity "interviewer"
+  host "evalhost"
+  workspace "$CATALOG/interviewer"
+
+  restart {
+    attempts 3
+    interval "60s"
+    delay "0s"
+    mode "delay"
+  }
+
+  env {
+    AGENT_LAUNCH_HOSTED "1"
+    AGENT_PERSONA "generalist"
+    AGENT_RUNTIME_PROFILE "@PROFILE@"
+    ST_AGENT "evalhost.interviewer"
+  }
+
+  argv "@ADAPTER@" "agent" "launch" "--harness" "claude" "--model" "claude-sonnet-5" "--effort" "medium" "--persona" "generalist" "--mode" "managed-unattended" "--boot" "managed-v1"
+  ding
+
+  render {
+    copy "_templates/generalist.md" ".st2/PERSONA.md"
+    copy "_templates/bus.st2.md" ".st2/bus.md"
+    git-exclude ".st2/"
+  }
+}
diff --git a/cells/agent-new-interview/fixture/publish-interviewer.sh b/cells/agent-new-interview/fixture/publish-interviewer.sh
new file mode 100755
index 00000000..a5534a8b
--- /dev/null
+++ b/cells/agent-new-interview/fixture/publish-interviewer.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+profile="${AGENT_RUNTIME_PROFILE:-$HOME/.config/coding-agents/profile.json}"
+case "$profile" in
+  /*) ;;
+  *)
+    echo "runtime profile must be absolute: $profile" >&2
+    exit 1
+    ;;
+esac
+
+adapter="$(jq -er '.agentSpec.adapterBin | select(type == "string" and startswith("/"))' "$profile")"
+persona_source="$(jq -er '.personas.prompts.generalist | select(type == "string" and startswith("/"))' "$profile")"
+for path in "$profile" "$adapter" "$persona_source"; do
+  case "$path" in
+    *[!A-Za-z0-9_./+-]*)
+      echo "runtime path cannot be represented in canonical KDL: $path" >&2
+      exit 1
+      ;;
+  esac
+done
+
+mkdir -p ./agents/evalhost/interviewer ./_templates
+cp "$persona_source" ./_templates/generalist.md
+sed \
+  -e "s|@PROFILE@|$profile|" \
+  -e "s|@ADAPTER@|$adapter|" \
+  ./agent.kdl.template >./agents/evalhost/interviewer/agent.kdl
diff --git a/cells/canonical-agent-runtime-smoke/README.md b/cells/canonical-agent-runtime-smoke/README.md
new file mode 100644
index 00000000..18ef2fd0
--- /dev/null
+++ b/cells/canonical-agent-runtime-smoke/README.md
@@ -0,0 +1,13 @@
+# canonical-agent-runtime-smoke
+
+This model-free cell exercises st2's production Agent Spec eval seam with one
+deterministic shell agent. The canonical declaration is the sole launch and
+routing authority: st2 boots it, delivers the kickoff to its native inbox,
+requires a fresh reply, grades the root and routing receipts, and tears the PTY
+down through normal eval cleanup.
+
+It uses no Axe, account, model, or provider harness.
+
+```sh
+st2 eval ./cells/canonical-agent-runtime-smoke/
+```
diff --git a/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl b/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl
new file mode 100644
index 00000000..9562a142
--- /dev/null
+++ b/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl
@@ -0,0 +1,21 @@
+host "evalhost"
+
+eval {
+  copy "./fixture"
+  canonical-agents
+  message {
+    from "requester"
+    to "evalhost.probe"
+    content "./task.md"
+  }
+  max-timeout "30s"
+
+  judges {
+    judge "CANONICAL ROOTS — the shell agent receives only the eval-owned catalog, bus, and PTY roots" {
+      exec "test -f $CATALOG/probe/roots-ok"
+    }
+    judge "CANONICAL KICKOFF — the request arrives in the admitted Agent Spec inbox before reply" {
+      exec "test -f $CATALOG/probe/kickoff-seen"
+    }
+  }
+}
diff --git a/cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl b/cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl
new file mode 100644
index 00000000..bb962859
--- /dev/null
+++ b/cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl
@@ -0,0 +1,9 @@
+agent "probe" {
+  identity "probe"
+  host "evalhost"
+  workspace "$CATALOG"
+  env {
+    ST_AGENT "evalhost.probe"
+  }
+  argv "bash" "$CATALOG/probe.sh"
+}
diff --git a/cells/canonical-agent-runtime-smoke/fixture/probe.sh b/cells/canonical-agent-runtime-smoke/fixture/probe.sh
new file mode 100755
index 00000000..6ef660a6
--- /dev/null
+++ b/cells/canonical-agent-runtime-smoke/fixture/probe.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+test "$CATALOG" = "$ST_ROOT"
+test "$PTY_ROOT" = "$CATALOG/pty"
+test "$ST_AGENT" = "evalhost.probe"
+mkdir -p "$CATALOG/probe"
+touch "$CATALOG/probe/roots-ok"
+
+for _ in $(seq 1 200); do
+  if test "$(st2 message ls "$ST_AGENT" --catalog "$CATALOG" --from requester --count)" -gt 0; then
+    touch "$CATALOG/probe/kickoff-seen"
+    st2 message send requester --catalog "$CATALOG" --as "$ST_AGENT" <<'MSG'
+Canonical kickoff received.
+MSG
+    exec sleep 60
+  fi
+  sleep 0.05
+done
+
+echo "canonical kickoff did not arrive" >&2
+exit 1
diff --git a/cells/canonical-agent-runtime-smoke/task.md b/cells/canonical-agent-runtime-smoke/task.md
new file mode 100644
index 00000000..c1084de8
--- /dev/null
+++ b/cells/canonical-agent-runtime-smoke/task.md
@@ -0,0 +1 @@
+Confirm the canonical eval runtime path.
diff --git a/docs/vrs/spec.md b/docs/vrs/spec.md
index 3cbb8a52..3e513919 100644
--- a/docs/vrs/spec.md
+++ b/docs/vrs/spec.md
@@ -107,14 +107,24 @@ one-sentence human request
   account per run. Corpus inventory, model policy, lifecycle, and harness
   checks recognize this typed launch as a paid model seat and reject durable
   account pins.
-- **Current composition gate:** `st2 eval` currently boots legacy team
-  `command` seats without creating a canonical Agent Spec for the temporary
-  identity. Axe correctly rejects that seat before account selection because
-  `ST_AGENT` resolves to zero canonical specs. This is a blocked paid
-  experiment, not evidence against account selection or interviewer judgment.
-  The accepted direction is to make eval seats canonical at the runtime seam;
-  a cell-local compatibility wrapper, fabricated spec, account pin, or ambient
-  bare-provider launch is outside the contract.
+- The paid cell uses st2's explicit `canonical-agents` seam. A deterministic
+  pre-admission run reads the active runtime profile and publishes one
+  canonical interviewer declaration with its exact immutable Axe adapter,
+  absolute profile path, and canonical persona source. st2 then carries that
+  declaration unchanged through strict validation, materialization, launch,
+  kickoff routing, singleton completion, and teardown. No compact eval seat,
+  compatibility wrapper, account pin, or ambient provider launch participates.
+- The paid cell is environment-bound to that explicit runtime-profile
+  artifact; the artifact identity belongs in run evidence and results are not
+  represented as hermetic across different profiles.
+- The canonical runtime seam removes the prior zero-Agent-Spec admission
+  blocker. The paid judgment run remains held until the host's Claude
+  workspace-trust projection is independently proven; model-free evidence
+  does not establish provider readiness.
+- The model-free `canonical-agent-runtime-smoke` cell independently proves the
+  runtime seam with one deterministic shell Agent Spec: strict admission,
+  boot, canonical kickoff, fresh reply, and normal teardown, with no Axe,
+  account, model, or provider harness.
 - Passing model-free evidence proves the bundle boundary and its negative
   controls only. The autonomous-selection claim remains unaccepted until the
   paid judgment cell has a structured PASS receipt.
diff --git a/evidence/harness-exclusions.tsv b/evidence/harness-exclusions.tsv
index 0961c818..f785a70e 100644
--- a/evidence/harness-exclusions.tsv
+++ b/evidence/harness-exclusions.tsv
@@ -1,5 +1,6 @@
 cell	surface	reason
 agent-new-bundle-contract	cell	deterministic semantic-intent lowering and mutation probe; no harness seat
+canonical-agent-runtime-smoke	cell	deterministic canonical Agent Spec boot, kickoff, reply, and teardown probe; no harness seat
 context-resource-continuity	cell	deterministic native context/resource restart probe; no harness seat
 docs	judge:cold-reader	one-shot offline Claude print grader; no bus identity, DING, or hook surface
 exec-lifecycle-logging	cell	deterministic native exec lifecycle probe; no harness seat

From 44b75cfc052d3d21530a3d5a366441162efb2feb Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 21:59:28 +0200
Subject: [PATCH 05/12] evals: harden canonical session evidence

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 AGENT-SPEC.md                                 |  8 ++--
 CATALOG.md                                    |  2 +-
 README.md                                     |  2 +
 bin/check-agent-new-renderer-security.sh      | 30 +++++++++++++
 ...check-canonical-seat-template-mutations.sh | 32 ++++++++++++++
 bin/check-canonical-seat-template.sh          | 44 +++++++++++++++++++
 bin/check-corpus.sh                           | 18 ++++----
 bin/check-event-first.sh                      | 19 +++++---
 bin/check-harness-contract.sh                 | 32 +++++++++++---
 bin/check-preflight-safety.sh                 | 10 +++++
 bin/check-st2-pin-consistency.sh              | 20 +++++++++
 bin/corpus-inventory.sh                       | 43 ++++--------------
 bin/model-seat-inventory.sh                   | 42 +++++++++++++++---
 bin/st2-pin.sh                                |  6 +++
 cells/agent-new-bundle-contract/README.md     |  5 ++-
 .../agent-new-bundle-contract.kdl             |  8 +++-
 .../fixture/inputs/workspace-injection.json   | 18 ++++++++
 .../fixture/render-intent.sh                  |  2 +-
 .../fixture/interviewer/render-intent.sh      |  2 +-
 docs/vrs/spec.md                              |  9 ++++
 20 files changed, 280 insertions(+), 72 deletions(-)
 create mode 100755 bin/check-agent-new-renderer-security.sh
 create mode 100755 bin/check-canonical-seat-template-mutations.sh
 create mode 100755 bin/check-canonical-seat-template.sh
 create mode 100755 bin/check-st2-pin-consistency.sh
 create mode 100755 bin/st2-pin.sh
 create mode 100644 cells/agent-new-bundle-contract/fixture/inputs/workspace-injection.json

diff --git a/AGENT-SPEC.md b/AGENT-SPEC.md
index 2b5bda16..1c46d640 100644
--- a/AGENT-SPEC.md
+++ b/AGENT-SPEC.md
@@ -432,8 +432,8 @@ Inspect the declaration, every referenced template, and every workspace destinat
 materialization command. Materialization is byte-idempotent and does not imply hook installation. Starting
 the network is a separate, explicitly authorized action.
 
-For source `9887b28`, the accepted Linux executable has SHA256
-`d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d`; its published archive has SHA256
-`32ee103bd17ccb3e155ac63d816a3906c2470a3c98e3cc04b56e5a67138b9927`. `bin/check-corpus.sh` verifies
-the variable-age version contract, exact installed binary, embedded full source commit, strict semantic
+For source `0ec6a22e877f9374260202c5f76dabc4579fc7e3`, the accepted local-source Linux executable has
+SHA256 `df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db`.
+`bin/check-st2-pin-consistency.sh` keeps this active spec, the README, and executable preflight aligned.
+`bin/check-corpus.sh` verifies the variable-age version contract, exact installed binary, strict semantic
 validation, fixture resets, and the rest of the model-free corpus gate before an eval may run.
diff --git a/CATALOG.md b/CATALOG.md
index 8df7a740..2bcb19c6 100644
--- a/CATALOG.md
+++ b/CATALOG.md
@@ -23,7 +23,7 @@ harness-native loader plus canonical hook file.
 | `crash-ding` | mixed | `claude-sonnet-5+gpt-5.6-sol` / medium | 4 | high | `180s` | 5 | — | **NO STRUCTURED RUN** |
 | `ding-mode` | Claude | `claude-sonnet-5` / medium | 2 | medium | `1200s` | 4 | — | **NO STRUCTURED RUN** |
 | `ding-reply` | Claude | `claude-sonnet-5` / medium | 1 | low | `420s` | 2 | — | **NO STRUCTURED RUN** |
-| `docs` | Claude | `claude-sonnet-5` / medium | 3 | high | `1200s` | 5 | — | **NO STRUCTURED RUN** |
+| `docs` | Claude | `claude-sonnet-5` / medium | 2 | medium | `1200s` | 5 | — | **NO STRUCTURED RUN** |
 | `exec-lifecycle-logging` | model-free | — | 0 | none | `90s` | 5 | — | **NO STRUCTURED RUN** |
 | `feature-fit` | Claude | `claude-sonnet-5` / medium | 2 | medium | `1200s` | 5 | — | **NO STRUCTURED RUN** |
 | `fork-in-the-road` | Claude | `claude-sonnet-5` / medium | 4 | high | `1200s` | 5 | — | **NO STRUCTURED RUN** |
diff --git a/README.md b/README.md
index 717030d0..eeaf54a3 100644
--- a/README.md
+++ b/README.md
@@ -97,6 +97,8 @@ VERDICT: PASS
 
 Requirements are `st2 0.1.0` from source
 [`0ec6a22`](https://github.com/compoundingtech/st2/commit/0ec6a22e877f9374260202c5f76dabc4579fc7e3),
+using the accepted local-source Linux binary SHA256
+`df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db`;
 `pty`, Bash, Git, `jq`, Rust/Cargo for the pinned KDL parser gate, and Node for JavaScript fixtures. A paid cell
 also needs every harness named by its dry-run row.
 
diff --git a/bin/check-agent-new-renderer-security.sh b/bin/check-agent-new-renderer-security.sh
new file mode 100755
index 00000000..718eace4
--- /dev/null
+++ b/bin/check-agent-new-renderer-security.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+input="$repo_root/cells/agent-new-bundle-contract/fixture/inputs/workspace-injection.json"
+scratch="$(mktemp -d)"
+cleanup() {
+  rm -rf -- "$scratch"
+}
+trap cleanup EXIT
+
+renderers=(
+  "$repo_root/cells/agent-new-bundle-contract/fixture/render-intent.sh"
+  "$repo_root/cells/agent-new-interview/fixture/interviewer/render-intent.sh"
+)
+
+for renderer in "${renderers[@]}"; do
+  name="$(basename "$(dirname "$renderer")")"
+  out="$scratch/$name"
+  if bash "$renderer" "$input" "$out" >/dev/null 2>&1; then
+    echo "FAIL: $renderer accepted a workspace KDL injection" >&2
+    exit 1
+  fi
+  [ ! -e "$out/agents" ] || {
+    echo "FAIL: $renderer emitted an Agent Spec after rejecting workspace KDL injection" >&2
+    exit 1
+  }
+done
+
+echo "PASS: both Agent Spec renderers reject workspace KDL injection before output"
diff --git a/bin/check-canonical-seat-template-mutations.sh b/bin/check-canonical-seat-template-mutations.sh
new file mode 100755
index 00000000..8aecf918
--- /dev/null
+++ b/bin/check-canonical-seat-template-mutations.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+checker="$repo_root/bin/check-canonical-seat-template.sh"
+source_template="$repo_root/cells/agent-new-interview/fixture/agent.kdl.template"
+source_publisher="$repo_root/cells/agent-new-interview/fixture/publish-interviewer.sh"
+scratch="$(mktemp -d)"
+cleanup() {
+  rm -rf -- "$scratch"
+}
+trap cleanup EXIT
+
+cp "$source_template" "$scratch/valid.template"
+cp "$source_publisher" "$scratch/publisher.sh"
+"$checker" "$scratch/valid.template" "$scratch/publisher.sh" >/dev/null
+
+cp "$source_template" "$scratch/missing-boot.template"
+sed -i 's/"--boot" "managed-v1"//' "$scratch/missing-boot.template"
+if "$checker" "$scratch/missing-boot.template" "$scratch/publisher.sh" >/dev/null 2>&1; then
+  echo "FAIL: canonical template without managed-v1 boot passed" >&2
+  exit 1
+fi
+
+cp "$source_template" "$scratch/missing-overlay.template"
+sed -i '/copy "_templates\/bus.st2.md" ".st2\/bus.md"/d' "$scratch/missing-overlay.template"
+if "$checker" "$scratch/missing-overlay.template" "$scratch/publisher.sh" >/dev/null 2>&1; then
+  echo "FAIL: canonical template without bus overlay passed" >&2
+  exit 1
+fi
+
+echo "PASS: removing a required launch axis or canonical overlay fails the template gate"
diff --git a/bin/check-canonical-seat-template.sh b/bin/check-canonical-seat-template.sh
new file mode 100755
index 00000000..418c7119
--- /dev/null
+++ b/bin/check-canonical-seat-template.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+template="${1:?canonical Agent Spec template required}"
+publisher="${2:?canonical Agent Spec publisher required}"
+
+require_once() {
+  local pattern="$1" description="$2"
+  if [ "$(grep -Fxc "$pattern" "$template" || true)" -ne 1 ]; then
+    echo "FAIL: $template must contain exactly one $description" >&2
+    exit 1
+  fi
+}
+
+require_once '    AGENT_LAUNCH_HOSTED "1"' "hosted launch marker"
+require_once '    AGENT_PERSONA "generalist"' "canonical persona"
+require_once '    AGENT_RUNTIME_PROFILE "@PROFILE@"' "runtime-profile projection"
+require_once '  argv "@ADAPTER@" "agent" "launch" "--harness" "claude" "--model" "claude-sonnet-5" "--effort" "medium" "--persona" "generalist" "--mode" "managed-unattended" "--boot" "managed-v1"' "typed managed-v1 launch"
+require_once '    copy "_templates/generalist.md" ".st2/PERSONA.md"' "canonical persona overlay"
+require_once '    copy "_templates/bus.st2.md" ".st2/bus.md"' "canonical bus overlay"
+require_once '    git-exclude ".st2/"' "overlay exclusion"
+require_once '  ding' "native DING declaration"
+
+if grep -Fq -- '--account' "$template"; then
+  echo "FAIL: $template durably pins an account" >&2
+  exit 1
+fi
+
+for projection in \
+  'profile="${AGENT_RUNTIME_PROFILE:-$HOME/.config/coding-agents/profile.json}"' \
+  'case "$profile" in' \
+  '/*) ;;' \
+  '.agentSpec.adapterBin' \
+  '.personas.prompts.generalist' \
+  's|@PROFILE@|$profile|' \
+  's|@ADAPTER@|$adapter|' \
+  'cp "$persona_source" ./_templates/generalist.md'; do
+  grep -Fq "$projection" "$publisher" || {
+    echo "FAIL: $publisher omits canonical projection $projection" >&2
+    exit 1
+  }
+done
+
+echo "PASS: $template is an account-neutral managed-v1 canonical template with explicit profile and overlay projection"
diff --git a/bin/check-corpus.sh b/bin/check-corpus.sh
index 0d9684c3..66572986 100755
--- a/bin/check-corpus.sh
+++ b/bin/check-corpus.sh
@@ -5,22 +5,20 @@ set -euo pipefail
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 
-expected_source="0ec6a22"
-expected_source_full="0ec6a22e877f9374260202c5f76dabc4579fc7e3"
-expected_binary_sha256="df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db"
-expected_version_regex='^st2 0\.1\.0 — running from local source \(0ec6a22, .+ ago\)$'
+source bin/st2-pin.sh
+bin/check-st2-pin-consistency.sh
 st2_path="$(command -v st2)"
 actual_version="$(st2 --version)"
-[[ "$actual_version" =~ $expected_version_regex ]] || {
-  echo "FAIL: expected st2 0.1.0 from pinned source $expected_source, found $actual_version" >&2
+[[ "$actual_version" =~ $ST2_VERSION_REGEX ]] || {
+  echo "FAIL: expected st2 0.1.0 from pinned source $ST2_SOURCE_SHORT, found $actual_version" >&2
   exit 1
 }
 actual_binary_sha256="$(sha256sum "$st2_path" | awk '{ print $1 }')"
-[ "$actual_binary_sha256" = "$expected_binary_sha256" ] || {
-  echo "FAIL: expected st2 binary sha256 $expected_binary_sha256, found $actual_binary_sha256 at $st2_path" >&2
+[ "$actual_binary_sha256" = "$ST2_BINARY_SHA256" ] || {
+  echo "FAIL: expected st2 binary sha256 $ST2_BINARY_SHA256, found $actual_binary_sha256 at $st2_path" >&2
   exit 1
 }
-echo "PASS: pinned runner source $expected_source_full ($actual_version; sha256 $actual_binary_sha256)"
+echo "PASS: pinned runner source $ST2_SOURCE_FULL ($actual_version; sha256 $actual_binary_sha256)"
 
 mapfile -d '' shell_files < <(
   find bin cells -type f -name '*.sh' -not -path '*/_git/*' -print0 | sort -z
@@ -29,8 +27,10 @@ bash -n "${shell_files[@]}"
 echo "PASS: ${#shell_files[@]} shell files parse"
 
 bin/check-preflight-safety.sh
+bin/check-agent-new-renderer-security.sh
 bin/check-model-policy.sh
 bin/check-model-policy-mutations.sh
+bin/check-canonical-seat-template-mutations.sh
 bin/check-run-history.sh
 bin/check-retired-surfaces.sh
 bin/model-seat-inventory.sh >/dev/null
diff --git a/bin/check-event-first.sh b/bin/check-event-first.sh
index d5c9702b..ef449c29 100755
--- a/bin/check-event-first.sh
+++ b/bin/check-event-first.sh
@@ -29,19 +29,26 @@ required=(
   "report completion or blockers over the st2 bus"
 )
 
-while IFS=$'\t' read -r cell agent _harness _workspace _st_agent command_line; do
-  kdl="cells/$cell/$cell.kdl"
-  command_text="$(sed -n "${command_line}p" "$kdl")"
+while IFS=$'\t' read -r cell agent _harness _workspace _st_agent source_kind source_path source_line; do
+  command_text="$(sed -n "${source_line}p" "$source_path")"
+  if [ "$source_kind" = "canonical-template" ]; then
+    grep -Fq '"--mode" "managed-unattended"' <<< "$command_text" ||
+      fail "$source_path:$source_line agent $agent canonical launch omits managed-unattended mode"
+    grep -Fq '"--boot" "managed-v1"' <<< "$command_text" ||
+      fail "$source_path:$source_line agent $agent canonical launch omits managed-v1 event-first boot contract"
+    continue
+  fi
+  kdl="$source_path"
   if grep -Fq 'exec axe agent launch ' <<< "$command_text"; then
     grep -Fq -- '--mode managed-unattended' <<< "$command_text" ||
-      fail "$kdl:$command_line agent $agent Axe launch omits managed-unattended mode"
+      fail "$kdl:$source_line agent $agent Axe launch omits managed-unattended mode"
     grep -Fq -- '--boot managed-v1' <<< "$command_text" ||
-      fail "$kdl:$command_line agent $agent Axe launch omits managed-v1 event-first boot contract"
+      fail "$kdl:$source_line agent $agent Axe launch omits managed-v1 event-first boot contract"
     continue
   fi
   for phrase in "${required[@]}"; do
     grep -Fiq "$phrase" <<< "$command_text" ||
-      fail "$kdl:$command_line agent $agent does not teach '$phrase'"
+      fail "$kdl:$source_line agent $agent does not teach '$phrase'"
   done
 done < "$inventory"
 
diff --git a/bin/check-harness-contract.sh b/bin/check-harness-contract.sh
index 41ae40a4..bf335de1 100755
--- a/bin/check-harness-contract.sh
+++ b/bin/check-harness-contract.sh
@@ -6,14 +6,19 @@ repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 
 selected="all"
+selected_cell=""
 if [ "$#" -eq 2 ] && [ "$1" = "--harness" ]; then
   selected="$2"
   case "$selected" in
     Claude|Codex) ;;
     *) echo "usage: bin/check-harness-contract.sh [--harness Claude|Codex]" >&2; exit 2 ;;
   esac
+elif [ "$#" -eq 2 ] && [ "$1" = "--cell" ]; then
+  selected_cell="$2"
+  [ -d "cells/$selected_cell" ] ||
+    { echo "FAIL: unknown cell $selected_cell" >&2; exit 2; }
 elif [ "$#" -ne 0 ]; then
-  echo "usage: bin/check-harness-contract.sh [--harness Claude|Codex]" >&2
+  echo "usage: bin/check-harness-contract.sh [--harness Claude|Codex] | [--cell CELL]" >&2
   exit 2
 fi
 
@@ -79,7 +84,10 @@ prepare_cell() {
 declare -A roots=()
 failed=0
 checked=0
-while IFS=$'\t' read -r cell agent harness workspace st_agent command_line; do
+while IFS=$'\t' read -r cell agent harness workspace st_agent source_kind source_path source_line; do
+  if [ -n "$selected_cell" ] && [ "$cell" != "$selected_cell" ]; then
+    continue
+  fi
   if [ "$selected" != "all" ] && [ "$harness" != "$selected" ]; then
     continue
   fi
@@ -92,7 +100,11 @@ while IFS=$'\t' read -r cell agent harness workspace st_agent command_line; do
     }
   fi
 
-  relative="${workspace#./}"
+  if [[ "$workspace" == "\$CATALOG/"* ]]; then
+    relative="${workspace#\$CATALOG/}"
+  else
+    relative="${workspace#./}"
+  fi
   target="${roots[$cell]}/$relative"
   [ -n "$relative" ] || target="${roots[$cell]}"
   if [ ! -d "$target" ]; then
@@ -101,10 +113,18 @@ while IFS=$'\t' read -r cell agent harness workspace st_agent command_line; do
     continue
   fi
 
-  kdl="cells/$cell/$cell.kdl"
-  command_text="$(sed -n "${command_line}p" "$kdl")"
+  command_text="$(sed -n "${source_line}p" "$source_path")"
   axe_launch=0
-  if grep -Fq 'exec axe agent launch ' <<< "$command_text"; then
+  if [ "$source_kind" = "canonical-template" ]; then
+    publisher="$(dirname "$source_path")/publish-interviewer.sh"
+    bin/check-canonical-seat-template.sh "$source_path" "$publisher" >/dev/null || {
+      failed=1
+      continue
+    }
+    [ -s "$(dirname "$source_path")/_templates/bus.st2.md" ] ||
+      { echo "FAIL: $cell/$agent canonical bus overlay source is missing" >&2; failed=1; }
+    axe_launch=1
+  elif grep -Fq 'exec axe agent launch ' <<< "$command_text"; then
     axe_launch=1
     grep -Fq -- '--mode managed-unattended' <<< "$command_text" ||
       { echo "FAIL: $cell/$agent Axe launch omits managed-unattended mode" >&2; failed=1; }
diff --git a/bin/check-preflight-safety.sh b/bin/check-preflight-safety.sh
index 4af8f41e..61745445 100755
--- a/bin/check-preflight-safety.sh
+++ b/bin/check-preflight-safety.sh
@@ -7,6 +7,9 @@ cd "$repo_root"
 
 reachable=(
   bin/check-corpus.sh
+  bin/check-agent-new-renderer-security.sh
+  bin/check-canonical-seat-template-mutations.sh
+  bin/check-canonical-seat-template.sh
   bin/check-event-first.sh
   bin/check-fixture-reset.sh
   bin/check-fixture-reset-terminal.sh
@@ -20,6 +23,7 @@ reachable=(
   bin/check-preflight-safety.sh
   bin/check-run-history.sh
   bin/check-retired-surfaces.sh
+  bin/check-st2-pin-consistency.sh
   bin/check-st2-semantic.sh
   bin/check-vrs-scope-drift.sh
   bin/check-vrs-variations.sh
@@ -27,8 +31,11 @@ reachable=(
   bin/corpus-inventory.sh
   bin/generate-catalog.sh
   bin/model-seat-inventory.sh
+  bin/st2-pin.sh
 )
 materializers=(
+  cells/agent-new-bundle-contract/fixture/render-intent.sh
+  cells/agent-new-interview/fixture/interviewer/render-intent.sh
   cells/signal-rename/fixture/materialize.sh
   cells/signal-rename-codex/fixture/materialize.sh
   cells/weird-git-setup/fixture/setup-megarepo.sh
@@ -56,6 +63,8 @@ mapfile -t direct < <(
     LC_ALL=C sort -u
 )
 expected_direct=(
+  bin/check-agent-new-renderer-security.sh
+  bin/check-canonical-seat-template-mutations.sh
   bin/check-event-first.sh
   bin/check-fixture-reset-terminal.sh
   bin/check-harness-contract.sh
@@ -68,6 +77,7 @@ expected_direct=(
   bin/check-preflight-safety.sh
   bin/check-retired-surfaces.sh
   bin/check-run-history.sh
+  bin/check-st2-pin-consistency.sh
   bin/check-st2-semantic.sh
   bin/check-vrs-scope-drift.sh
   bin/check-vrs-variations.sh
diff --git a/bin/check-st2-pin-consistency.sh b/bin/check-st2-pin-consistency.sh
new file mode 100755
index 00000000..6a276983
--- /dev/null
+++ b/bin/check-st2-pin-consistency.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+source bin/st2-pin.sh
+
+grep -Fq "$ST2_SOURCE_FULL" AGENT-SPEC.md
+grep -Fq "$ST2_SOURCE_FULL" README.md
+grep -Fq "$ST2_BINARY_SHA256" AGENT-SPEC.md
+grep -Fq "$ST2_BINARY_SHA256" README.md
+grep -Fq 'source bin/st2-pin.sh' bin/check-corpus.sh
+
+if rg -n '9887b28|d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d' \
+  AGENT-SPEC.md README.md bin/check-corpus.sh bin/st2-pin.sh; then
+  echo "FAIL: active st2 pin surfaces retain the superseded source or binary hash" >&2
+  exit 1
+fi
+
+echo "PASS: active spec, README, and executable preflight share st2 $ST2_SOURCE_FULL / $ST2_BINARY_SHA256"
diff --git a/bin/corpus-inventory.sh b/bin/corpus-inventory.sh
index e9c2d01a..7fdd67b9 100755
--- a/bin/corpus-inventory.sh
+++ b/bin/corpus-inventory.sh
@@ -13,6 +13,13 @@ elif [ "$#" -ne 0 ]; then
   exit 2
 fi
 
+seat_inventory="$(mktemp)"
+cleanup() {
+  rm -f -- "$seat_inventory"
+}
+trap cleanup EXIT
+bin/model-seat-inventory.sh --no-header > "$seat_inventory"
+
 if [ "$include_header" -eq 1 ]; then
   printf 'cell\tharness\tmodels\teffort\tmodel_seats\tcost_band\ttimeout\theld_out_judges\n'
 fi
@@ -45,40 +52,8 @@ for cell in "${cells[@]}"; do
   }
   timeout="${timeouts[0]}"
 
-  claude=0
-  codex=0
-  while IFS=: read -r file line text; do
-    trimmed="${text#"${text%%[![:space:]]*}"}"
-    if [[ "$trimmed" == \#* || "$trimmed" == //* ]]; then
-      continue
-    fi
-    code="$text"
-    if [[ "$file" == *.kdl ]]; then
-      code="${code%%//*}"
-    fi
-    scan_code="$code"
-    if [[ "$file" == *.kdl.template ]]; then
-      scan_code="${code//\"/}"
-    fi
-    if [[ "$scan_code" =~ exec[[:space:]]+claude([[:space:]]|$) ]] ||
-      [[ "$scan_code" =~ (^|[^[:alnum:]_-])claude[[:space:]]+- ]] ||
-      [[ "$scan_code" =~ (exec[[:space:]]+axe|argv[[:space:]]+[^[:space:]]+)[[:space:]]+agent[[:space:]]+launch[[:space:]].*--harness[[:space:]]+claude([[:space:]]|$) ]]; then
-      ((claude += 1))
-    elif [[ "$scan_code" =~ exec[[:space:]]+codex([[:space:]]|$) ]] ||
-      [[ "$scan_code" =~ (^|[^[:alnum:]_-])codex[[:space:]]+- ]] ||
-      [[ "$scan_code" =~ (exec[[:space:]]+axe|argv[[:space:]]+[^[:space:]]+)[[:space:]]+agent[[:space:]]+launch[[:space:]].*--harness[[:space:]]+codex([[:space:]]|$) ]]; then
-      ((codex += 1))
-    fi
-  done < <(
-    {
-      rg -n --no-heading \
-        'exec[[:space:]]+(claude|codex)|(^|[^[:alnum:]_-])(claude|codex)[[:space:]]+-|axe[[:space:]]+agent[[:space:]]+launch' \
-        "$cell_dir" -g '*.kdl' -g '*.sh' -g '!**/_git/**' || true
-      rg -n --no-heading \
-        '"agent"[[:space:]]+"launch"' \
-        "$cell_dir" -g '*.kdl.template' || true
-    }
-  )
+  claude="$(awk -F '\t' -v cell="$cell" '$1 == cell && $3 == "Claude" { count += 1 } END { print count + 0 }' "$seat_inventory")"
+  codex="$(awk -F '\t' -v cell="$cell" '$1 == cell && $3 == "Codex" { count += 1 } END { print count + 0 }' "$seat_inventory")"
 
   seats=$((claude + codex))
   if [ "$claude" -gt 0 ] && [ "$codex" -gt 0 ]; then
diff --git a/bin/model-seat-inventory.sh b/bin/model-seat-inventory.sh
index b3ba6919..bf1dc538 100755
--- a/bin/model-seat-inventory.sh
+++ b/bin/model-seat-inventory.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Emit every maintained model seat directly from the root folder-eval declarations.
+# Emit every maintained model seat from compact eval declarations and canonical templates.
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -28,7 +28,7 @@ while IFS= read -r cell; do
     continue
   }
 
-  if ! awk -v cell="$cell" '
+  if ! awk -v cell="$cell" -v source_path="$kdl" '
     function direct(line) {
       return index(line, child_indent) == 1
     }
@@ -49,7 +49,7 @@ while IFS= read -r cell; do
         bad = 1
       }
       if (workspace != "" && st_agent != "" && ding == 1) {
-        printf "%s\t%s\t%s\t%s\t%s\t%d\n", cell, agent, harness, workspace, st_agent, command_line
+        printf "%s\t%s\t%s\t%s\t%s\tcompact\t%s\t%d\n", cell, agent, harness, workspace, st_agent, source_path, command_line
       }
     }
     /^[[:space:]]*agent[[:space:]]+"/ {
@@ -125,9 +125,39 @@ while IFS= read -r cell; do
   fi
 done < <(find cells -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | LC_ALL=C sort)
 
+while IFS= read -r template; do
+  cell="${template#cells/}"
+  cell="${cell%%/*}"
+  agent="$(sed -n 's/^[[:space:]]*agent[[:space:]]*"\([^"]*\)".*/\1/p' "$template")"
+  workspace="$(sed -n 's/^[[:space:]]*workspace[[:space:]]*"\([^"]*\)".*/\1/p' "$template")"
+  st_agent="$(sed -n 's/^[[:space:]]*ST_AGENT[[:space:]]*"\([^"]*\)".*/\1/p' "$template")"
+  command_line="$(rg -n '^[[:space:]]*argv[[:space:]].*"agent"[[:space:]]+"launch"' "$template" | cut -d: -f1)"
+  command_text="$(sed -n "${command_line}p" "$template")"
+  ding_count="$(rg -c '^[[:space:]]*ding[[:space:]]*$' "$template" || true)"
+  harness=""
+  if grep -Fq '"--harness" "claude"' <<< "$command_text"; then
+    harness="Claude"
+  elif grep -Fq '"--harness" "codex"' <<< "$command_text"; then
+    harness="Codex"
+  fi
+  if [ -z "$agent" ] || [ -z "$workspace" ] || [ -z "$st_agent" ] ||
+    [ -z "$command_line" ] || [ -z "$harness" ] || [ "$ding_count" -ne 1 ]; then
+    echo "FAIL: canonical model-seat template is incomplete: $template" >&2
+    failed=1
+    continue
+  fi
+  printf '%s\t%s\t%s\t%s\t%s\tcanonical-template\t%s\t%s\n' \
+    "$cell" "$agent" "$harness" "$workspace" "$st_agent" "$template" "$command_line" \
+    >> "$inventory"
+done < <(find cells -type f -name 'agent.kdl.template' | LC_ALL=C sort)
+
 launches="$(
-  rg -n --no-heading '^[[:space:]]*command[[:space:]]+.*exec ((claude|codex)[[:space:]]|axe agent launch[[:space:]])' \
-    cells/*/*.kdl | wc -l | tr -d ' '
+  {
+    rg -n --no-heading '^[[:space:]]*command[[:space:]]+.*exec ((claude|codex)[[:space:]]|axe agent launch[[:space:]])' \
+      cells/*/*.kdl || true
+    rg -n --no-heading '^[[:space:]]*argv[[:space:]].*"agent"[[:space:]]+"launch"' \
+      cells -g 'agent.kdl.template' || true
+  } | wc -l | tr -d ' '
 )"
 rows="$(wc -l < "$inventory" | tr -d ' ')"
 if [ "$rows" -ne "$launches" ]; then
@@ -137,6 +167,6 @@ fi
 
 [ "$failed" -eq 0 ] || exit 1
 if [ "$include_header" -eq 1 ]; then
-  printf 'cell\tagent\tharness\tworkspace\tst_agent\tcommand_line\n'
+  printf 'cell\tagent\tharness\tworkspace\tst_agent\tsource_kind\tsource_path\tsource_line\n'
 fi
 cat "$inventory"
diff --git a/bin/st2-pin.sh b/bin/st2-pin.sh
new file mode 100755
index 00000000..1784a70f
--- /dev/null
+++ b/bin/st2-pin.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+ST2_SOURCE_SHORT="0ec6a22"
+ST2_SOURCE_FULL="0ec6a22e877f9374260202c5f76dabc4579fc7e3"
+ST2_BINARY_SHA256="df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db"
+ST2_VERSION_REGEX='^st2 0\.1\.0 — running from local source \(0ec6a22, .+ ago\)$'
diff --git a/cells/agent-new-bundle-contract/README.md b/cells/agent-new-bundle-contract/README.md
index bd0adaa1..f8aaa065 100644
--- a/cells/agent-new-bundle-contract/README.md
+++ b/cells/agent-new-bundle-contract/README.md
@@ -5,9 +5,10 @@ interview handoff. A small semantic `axe.agent-creation-intent.v1` record is
 the only interviewer output. The renderer owns canonical Agent Spec KDL and
 the initial inbox Resource.
 
-Two valid one-session intents exercise the same lowering path. Two invalid
+Two valid one-session intents exercise the same lowering path. Three invalid
 inputs prove the input boundary is closed: an interviewer cannot pin an
-account or introduce an unsupported trajectory value.
+account, introduce an unsupported trajectory value, or inject KDL through the
+workspace path.
 
 Held-out mutation checks copy valid output and independently prove that the
 bundle grader rejects:
diff --git a/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl b/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl
index 392e71e6..bd141e7f 100644
--- a/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl
+++ b/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl
@@ -18,6 +18,10 @@ eval {
     allow-nonzero
     command "bash ./render-intent.sh ./inputs/trajectory-drift.json ./out/trajectory-drift"
   }
+  run "workspace-injection" {
+    allow-nonzero
+    command "bash ./render-intent.sh ./inputs/workspace-injection.json ./out/workspace-injection"
+  }
 
   judges {
     judge "IMPLEMENTATION — typed intent lowers to the exact canonical managed trajectory" {
@@ -29,8 +33,8 @@ eval {
     judge "INITIAL CONTEXT — goal and references become an inbox Resource, not KDL fields" {
       exec "bash ./judges/grade.sh inbox"
     }
-    judge "CLOSED INPUT — account pins, unknown fields, and unstable trajectory values fail closed" {
-      exec #"test "$RUN_forbidden_account_EXIT" -ne 0 && test "$RUN_trajectory_drift_EXIT" -ne 0"#
+    judge "CLOSED INPUT — account pins, unstable trajectory values, and KDL workspace injection fail closed" {
+      exec #"test "$RUN_forbidden_account_EXIT" -ne 0 && test "$RUN_trajectory_drift_EXIT" -ne 0 && test "$RUN_workspace_injection_EXIT" -ne 0 && test ! -e "$CATALOG/out/workspace-injection/agents""#
     }
     judge "NEGATIVE CONTROLS — raw provider argv, trajectory drift, and missing context are rejected" {
       exec "bash ./judges/mutation-check.sh"
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/workspace-injection.json b/cells/agent-new-bundle-contract/fixture/inputs/workspace-injection.json
new file mode 100644
index 00000000..36a10eaa
--- /dev/null
+++ b/cells/agent-new-bundle-contract/fixture/inputs/workspace-injection.json
@@ -0,0 +1,18 @@
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "dotfiles.axe.issue-40.implementation",
+  "workspace": "/workspace/dotfiles\"\n  argv \"sh\" \"-c\" \"touch /tmp/injected\"",
+  "goal": "Implement Axe issue 40.",
+  "references": [
+    "https://github.com/compoundingtech/axe/issues/40"
+  ],
+  "trajectory": {
+    "harness": "codex",
+    "model": "gpt-5.6-sol",
+    "effort": "high",
+    "persona": "generalist",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
diff --git a/cells/agent-new-bundle-contract/fixture/render-intent.sh b/cells/agent-new-bundle-contract/fixture/render-intent.sh
index e28b2777..812df71f 100755
--- a/cells/agent-new-bundle-contract/fixture/render-intent.sh
+++ b/cells/agent-new-bundle-contract/fixture/render-intent.sh
@@ -12,7 +12,7 @@ jq -e '
   .schema == "axe.agent-creation-intent.v1" and
   .decision == "commit" and
   (.identity | test("^[a-z0-9][a-z0-9.-]*[a-z0-9]$")) and
-  (.workspace | test("^/")) and
+  (.workspace | test("^/[-A-Za-z0-9._/+:]+$")) and
   (.goal | type == "string" and length > 0 and test("[\"\\n\\r]") | not) and
   (.references | type == "array" and length > 0 and
     all(.[]; type == "string" and test("^https://github\\.com/"))) and
diff --git a/cells/agent-new-interview/fixture/interviewer/render-intent.sh b/cells/agent-new-interview/fixture/interviewer/render-intent.sh
index d84b651f..a8f1cf33 100755
--- a/cells/agent-new-interview/fixture/interviewer/render-intent.sh
+++ b/cells/agent-new-interview/fixture/interviewer/render-intent.sh
@@ -12,7 +12,7 @@ jq -e '
   .schema == "axe.agent-creation-intent.v1" and
   .decision == "commit" and
   (.identity | test("^[a-z0-9][a-z0-9.-]*[a-z0-9]$")) and
-  (.workspace | test("^/")) and
+  (.workspace | test("^/[-A-Za-z0-9._/+:]+$")) and
   (.goal | type == "string" and length > 0 and test("[\"\\n\\r]") | not) and
   (.references | type == "array" and length > 0 and
     all(.[]; type == "string" and test("^https://github\\.com/"))) and
diff --git a/docs/vrs/spec.md b/docs/vrs/spec.md
index 3e513919..c198e269 100644
--- a/docs/vrs/spec.md
+++ b/docs/vrs/spec.md
@@ -101,6 +101,10 @@ one-sentence human request
   explicit in that intent; the deterministic boundary owns canonical KDL,
   keeps account selection out of durable state, and places the goal and
   references in an initial inbox Resource.
+- The renderer accepts workspace values only from a closed absolute-path
+  alphabet and rejects invalid input before creating an Agent Spec. A
+  model-free malicious-workspace control gates both renderers against KDL
+  injection.
 - The temporary interviewer itself launches through typed
   `axe agent launch` with explicit harness, model, effort, persona, mode, and
   boot axes. The cell does not pin `--account`: Axe selects an eligible
@@ -117,6 +121,11 @@ one-sentence human request
 - The paid cell is environment-bound to that explicit runtime-profile
   artifact; the artifact identity belongs in run evidence and results are not
   represented as hermetic across different profiles.
+- One structured seat inventory is authoritative for both compact eval seats
+  and canonical paid templates. Corpus cost classification, event-first
+  policy, and harness-overlay checks consume its source-kind/path records;
+  canonical template mutations prove required launch axes and overlays are
+  non-vacuous.
 - The canonical runtime seam removes the prior zero-Agent-Spec admission
   blocker. The paid judgment run remains held until the host's Claude
   workspace-trust projection is independently proven; model-free evidence

From 024f0ad54671c378b85f47722b12299c667e9801 Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 22:14:30 +0200
Subject: [PATCH 06/12] evals: prepare canonical Git workspace

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 CATALOG.md                                    |  2 +-
 bin/check-agent-new-interview-attempts.sh     | 49 +++++++++++++++++++
 bin/check-corpus.sh                           |  1 +
 bin/check-harness-contract.sh                 | 11 ++++-
 bin/check-preflight-safety.sh                 |  4 ++
 cells/agent-new-interview/README.md           | 11 +++++
 .../agent-new-interview.kdl                   |  3 ++
 .../fixture/prepare-interviewer-worktree.sh   | 24 +++++++++
 cells/canonical-agent-runtime-smoke/README.md |  5 +-
 .../canonical-agent-runtime-smoke.kdl         |  9 ++++
 .../fixture/_templates/bus.st2.md             |  1 +
 .../fixture/_templates/generalist.md          |  1 +
 .../fixture/agents/evalhost/probe/agent.kdl   |  7 ++-
 .../fixture/prepare-interviewer-worktree.sh   | 18 +++++++
 docs/vrs/spec.md                              | 26 ++++++----
 evidence/agent-new-interview-attempts.tsv     |  2 +
 16 files changed, 161 insertions(+), 13 deletions(-)
 create mode 100755 bin/check-agent-new-interview-attempts.sh
 create mode 100755 cells/agent-new-interview/fixture/prepare-interviewer-worktree.sh
 create mode 100644 cells/canonical-agent-runtime-smoke/fixture/_templates/bus.st2.md
 create mode 100644 cells/canonical-agent-runtime-smoke/fixture/_templates/generalist.md
 create mode 100755 cells/canonical-agent-runtime-smoke/fixture/prepare-interviewer-worktree.sh
 create mode 100644 evidence/agent-new-interview-attempts.tsv

diff --git a/CATALOG.md b/CATALOG.md
index 2bcb19c6..ac7a8592 100644
--- a/CATALOG.md
+++ b/CATALOG.md
@@ -18,7 +18,7 @@ harness-native loader plus canonical hook file.
 |---|---|---|---:|---|---|---:|---|---|
 | `agent-new-bundle-contract` | model-free | — | 0 | none | `60s` | 5 | — | **NO STRUCTURED RUN** |
 | `agent-new-interview` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 4 | — | **NO STRUCTURED RUN** |
-| `canonical-agent-runtime-smoke` | model-free | — | 0 | none | `30s` | 2 | — | **NO STRUCTURED RUN** |
+| `canonical-agent-runtime-smoke` | model-free | — | 0 | none | `30s` | 4 | — | **NO STRUCTURED RUN** |
 | `context-resource-continuity` | model-free | — | 0 | none | `90s` | 4 | — | **NO STRUCTURED RUN** |
 | `crash-ding` | mixed | `claude-sonnet-5+gpt-5.6-sol` / medium | 4 | high | `180s` | 5 | — | **NO STRUCTURED RUN** |
 | `ding-mode` | Claude | `claude-sonnet-5` / medium | 2 | medium | `1200s` | 4 | — | **NO STRUCTURED RUN** |
diff --git a/bin/check-agent-new-interview-attempts.sh b/bin/check-agent-new-interview-attempts.sh
new file mode 100755
index 00000000..c970c5a4
--- /dev/null
+++ b/bin/check-agent-new-interview-attempts.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Validate append-only pre-run evidence without representing it as a judged model run.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+ledger="evidence/agent-new-interview-attempts.tsv"
+expected_header=$'recorded_at_utc\tsource_commit\tst2_commit\tst2_sha256\taxe_feature_head\tadapter\truntime_profile\tstage\tresult\tdiagnostic\tcleanup'
+
+[ -f "$ledger" ] && [ "$(head -n 1 "$ledger")" = "$expected_header" ] || {
+  echo "FAIL: $ledger is missing or has an unexpected header" >&2
+  exit 1
+}
+
+if git cat-file -e "HEAD:$ledger" 2>/dev/null; then
+  prior="$(mktemp)"
+  trap 'rm -f -- "$prior"' EXIT
+  git show "HEAD:$ledger" >"$prior"
+  prior_size="$(wc -c <"$prior")"
+  current_size="$(wc -c <"$ledger")"
+  [ "$current_size" -ge "$prior_size" ] && cmp -n "$prior_size" "$prior" "$ledger" || {
+    echo "FAIL: $ledger rewrites or removes existing evidence; only append rows" >&2
+    exit 1
+  }
+fi
+
+rows=0
+while IFS=$'\t' read -r recorded source st2_commit st2_sha axe_head adapter profile stage result diagnostic cleanup extra; do
+  [ "$recorded" != "recorded_at_utc" ] || continue
+  [ -n "$recorded" ] || continue
+  [ -z "${extra:-}" ] || { echo "FAIL: $ledger row has extra columns" >&2; exit 1; }
+  [[ "$recorded" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]] ||
+    { echo "FAIL: invalid recorded_at_utc $recorded" >&2; exit 1; }
+  [[ "$source" =~ ^[0-9a-f]{40}$ ]] && git cat-file -e "$source^{commit}" 2>/dev/null ||
+    { echo "FAIL: unavailable source commit $source" >&2; exit 1; }
+  [[ "$st2_commit" =~ ^[0-9a-f]{40}$ && "$st2_sha" =~ ^[0-9a-f]{64}$ ]] ||
+    { echo "FAIL: st2 identity is not exact" >&2; exit 1; }
+  [[ "$axe_head" =~ ^[0-9a-f]{7,40}$ && "$adapter" == /nix/store/* && "$profile" == /nix/store/* ]] ||
+    { echo "FAIL: Axe/runtime artifact identity is not exact" >&2; exit 1; }
+  [ "$stage" = "materialization" ] && [ "$result" = "PRE_AXE_FAIL" ] ||
+    { echo "FAIL: pre-run evidence claims an unsupported stage or result" >&2; exit 1; }
+  [ -n "$diagnostic" ] && [ "$cleanup" = "catalog-absent;process-absent" ] ||
+    { echo "FAIL: pre-run evidence lacks diagnostic or cleanup proof" >&2; exit 1; }
+  ((rows += 1))
+done <"$ledger"
+
+[ "$rows" -gt 0 ] || { echo "FAIL: $ledger has no evidence rows" >&2; exit 1; }
+printf 'PASS: %d append-only pre-Axe attempt row(s) validated with exact artifacts and cleanup\n' "$rows"
diff --git a/bin/check-corpus.sh b/bin/check-corpus.sh
index 66572986..ebefc6c7 100755
--- a/bin/check-corpus.sh
+++ b/bin/check-corpus.sh
@@ -32,6 +32,7 @@ bin/check-model-policy.sh
 bin/check-model-policy-mutations.sh
 bin/check-canonical-seat-template-mutations.sh
 bin/check-run-history.sh
+bin/check-agent-new-interview-attempts.sh
 bin/check-retired-surfaces.sh
 bin/model-seat-inventory.sh >/dev/null
 bin/check-event-first.sh
diff --git a/bin/check-harness-contract.sh b/bin/check-harness-contract.sh
index bf335de1..af061b96 100755
--- a/bin/check-harness-contract.sh
+++ b/bin/check-harness-contract.sh
@@ -56,6 +56,9 @@ prepare_cell() {
   }
   cp -a "$fixture"/. "$root"/
   case "$cell" in
+    agent-new-interview)
+      script="$root/prepare-interviewer-worktree.sh"
+      ;;
     signal-rename|signal-rename-codex)
       script="$root/materialize.sh"
       ;;
@@ -78,7 +81,11 @@ prepare_cell() {
     echo "FAIL: $cell materializer contains a provider/reconcile/network command" >&2
     return 1
   fi
-  CATALOG="$root" bash "$script" >/dev/null
+  if [ "$cell" = "agent-new-interview" ]; then
+    CATALOG="$root" bash "$script" "$root/interviewer" >/dev/null
+  else
+    CATALOG="$root" bash "$script" >/dev/null
+  fi
 }
 
 declare -A roots=()
@@ -123,6 +130,8 @@ while IFS=$'\t' read -r cell agent harness workspace st_agent source_kind source
     }
     [ -s "$(dirname "$source_path")/_templates/bus.st2.md" ] ||
       { echo "FAIL: $cell/$agent canonical bus overlay source is missing" >&2; failed=1; }
+    git -C "$target" rev-parse --is-inside-work-tree | grep -Fxq true ||
+      { echo "FAIL: $cell/$agent canonical workspace is not a Git worktree" >&2; failed=1; }
     axe_launch=1
   elif grep -Fq 'exec axe agent launch ' <<< "$command_text"; then
     axe_launch=1
diff --git a/bin/check-preflight-safety.sh b/bin/check-preflight-safety.sh
index 61745445..e94646f8 100755
--- a/bin/check-preflight-safety.sh
+++ b/bin/check-preflight-safety.sh
@@ -8,6 +8,7 @@ cd "$repo_root"
 reachable=(
   bin/check-corpus.sh
   bin/check-agent-new-renderer-security.sh
+  bin/check-agent-new-interview-attempts.sh
   bin/check-canonical-seat-template-mutations.sh
   bin/check-canonical-seat-template.sh
   bin/check-event-first.sh
@@ -34,8 +35,10 @@ reachable=(
   bin/st2-pin.sh
 )
 materializers=(
+  cells/agent-new-interview/fixture/prepare-interviewer-worktree.sh
   cells/agent-new-bundle-contract/fixture/render-intent.sh
   cells/agent-new-interview/fixture/interviewer/render-intent.sh
+  cells/canonical-agent-runtime-smoke/fixture/prepare-interviewer-worktree.sh
   cells/signal-rename/fixture/materialize.sh
   cells/signal-rename-codex/fixture/materialize.sh
   cells/weird-git-setup/fixture/setup-megarepo.sh
@@ -63,6 +66,7 @@ mapfile -t direct < <(
     LC_ALL=C sort -u
 )
 expected_direct=(
+  bin/check-agent-new-interview-attempts.sh
   bin/check-agent-new-renderer-security.sh
   bin/check-canonical-seat-template-mutations.sh
   bin/check-event-first.sh
diff --git a/cells/agent-new-interview/README.md b/cells/agent-new-interview/README.md
index b7cf84d5..786ba2f9 100644
--- a/cells/agent-new-interview/README.md
+++ b/cells/agent-new-interview/README.md
@@ -46,3 +46,14 @@ kickoff through its canonical inbox, and requires a fresh interviewer reply
 before the singleton eval can complete. The paid judgment run remains held
 until the host's Claude workspace-trust projection has independent evidence;
 the model-free bundle cell does not prove provider readiness.
+
+The fixture setup creates the copied interviewer directory as a deterministic,
+clean Git worktree before canonical admission. This is required because the
+canonical overlay retains `git-exclude ".st2/"`, and materialization warnings
+remain fatal.
+
+The first authorized attempt is recorded in
+[`evidence/agent-new-interview-attempts.tsv`](../../evidence/agent-new-interview-attempts.tsv).
+It stopped at materialization before Axe, account selection, provider
+readiness, or judges because the earlier fixture lacked that Git-worktree
+setup. Cleanup removed the temporary catalog and process.
diff --git a/cells/agent-new-interview/agent-new-interview.kdl b/cells/agent-new-interview/agent-new-interview.kdl
index 1f94eca1..73ef088c 100644
--- a/cells/agent-new-interview/agent-new-interview.kdl
+++ b/cells/agent-new-interview/agent-new-interview.kdl
@@ -5,6 +5,9 @@ host "evalhost"
 
 eval {
   copy "./fixture"
+  run "prepare-interviewer-worktree" {
+    command "bash ./prepare-interviewer-worktree.sh"
+  }
   run "publish-canonical-interviewer" {
     command "bash ./publish-interviewer.sh"
   }
diff --git a/cells/agent-new-interview/fixture/prepare-interviewer-worktree.sh b/cells/agent-new-interview/fixture/prepare-interviewer-worktree.sh
new file mode 100755
index 00000000..9d9abdeb
--- /dev/null
+++ b/cells/agent-new-interview/fixture/prepare-interviewer-worktree.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+workspace="${1:-./interviewer}"
+[ -d "$workspace" ] || {
+  echo "interviewer workspace does not exist: $workspace" >&2
+  exit 1
+}
+[ ! -e "$workspace/.git" ] || {
+  echo "interviewer workspace is already a Git worktree: $workspace" >&2
+  exit 1
+}
+
+git -C "$workspace" init -q --initial-branch=main
+git -C "$workspace" add -A
+GIT_AUTHOR_DATE="2000-01-01T00:00:00Z" \
+GIT_COMMITTER_DATE="2000-01-01T00:00:00Z" \
+  git -C "$workspace" \
+    -c core.hooksPath=/dev/null \
+    -c user.name=eval-fixture \
+    -c user.email=eval-fixture@local \
+    commit -q -m "fixture: canonical interviewer workspace"
+
+test -z "$(git -C "$workspace" status --porcelain=v1)"
diff --git a/cells/canonical-agent-runtime-smoke/README.md b/cells/canonical-agent-runtime-smoke/README.md
index 18ef2fd0..ee035337 100644
--- a/cells/canonical-agent-runtime-smoke/README.md
+++ b/cells/canonical-agent-runtime-smoke/README.md
@@ -6,7 +6,10 @@ routing authority: st2 boots it, delivers the kickoff to its native inbox,
 requires a fresh reply, grades the root and routing receipts, and tears the PTY
 down through normal eval cleanup.
 
-It uses no Axe, account, model, or provider harness.
+Before admission, a deterministic run creates the same disposable Git-worktree
+shape required by the paid interviewer. Strict materialization copies the
+canonical persona and bus overlays and applies `git-exclude` with zero
+warnings. It uses no Axe, account, model, or provider harness.
 
 ```sh
 st2 eval ./cells/canonical-agent-runtime-smoke/
diff --git a/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl b/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl
index 9562a142..809b7f97 100644
--- a/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl
+++ b/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl
@@ -2,6 +2,9 @@ host "evalhost"
 
 eval {
   copy "./fixture"
+  run "prepare-interviewer-worktree" {
+    command "bash ./prepare-interviewer-worktree.sh"
+  }
   canonical-agents
   message {
     from "requester"
@@ -17,5 +20,11 @@ eval {
     judge "CANONICAL KICKOFF — the request arrives in the admitted Agent Spec inbox before reply" {
       exec "test -f $CATALOG/probe/kickoff-seen"
     }
+    judge "STRICT MATERIALIZATION — canonical persona and bus overlays materialize into a clean Git worktree" {
+      exec #"test -s "$CATALOG/interviewer/.st2/PERSONA.md" && test -s "$CATALOG/interviewer/.st2/bus.md" && grep -Fxq ".st2/" "$CATALOG/interviewer/.git/info/exclude" && test -z "$(git -C "$CATALOG/interviewer" status --porcelain=v1)""#
+    }
+    judge "MODEL FREE — the admitted Agent Spec contains no provider, account, or Axe launch" {
+      exec #"! grep -Eq 'axe|claude|codex|opencode|pi|--account' "$CATALOG/agents/evalhost/probe/agent.kdl""#
+    }
   }
 }
diff --git a/cells/canonical-agent-runtime-smoke/fixture/_templates/bus.st2.md b/cells/canonical-agent-runtime-smoke/fixture/_templates/bus.st2.md
new file mode 100644
index 00000000..663bbbfd
--- /dev/null
+++ b/cells/canonical-agent-runtime-smoke/fixture/_templates/bus.st2.md
@@ -0,0 +1 @@
+Synthetic canonical st2 bus instructions for model-free materialization.
diff --git a/cells/canonical-agent-runtime-smoke/fixture/_templates/generalist.md b/cells/canonical-agent-runtime-smoke/fixture/_templates/generalist.md
new file mode 100644
index 00000000..998fa71d
--- /dev/null
+++ b/cells/canonical-agent-runtime-smoke/fixture/_templates/generalist.md
@@ -0,0 +1 @@
+Synthetic canonical generalist prompt for model-free materialization.
diff --git a/cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl b/cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl
index bb962859..426428c7 100644
--- a/cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl
+++ b/cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl
@@ -1,9 +1,14 @@
 agent "probe" {
   identity "probe"
   host "evalhost"
-  workspace "$CATALOG"
+  workspace "$CATALOG/interviewer"
   env {
     ST_AGENT "evalhost.probe"
   }
   argv "bash" "$CATALOG/probe.sh"
+  render {
+    copy "_templates/generalist.md" ".st2/PERSONA.md"
+    copy "_templates/bus.st2.md" ".st2/bus.md"
+    git-exclude ".st2/"
+  }
 }
diff --git a/cells/canonical-agent-runtime-smoke/fixture/prepare-interviewer-worktree.sh b/cells/canonical-agent-runtime-smoke/fixture/prepare-interviewer-worktree.sh
new file mode 100755
index 00000000..b4e9db80
--- /dev/null
+++ b/cells/canonical-agent-runtime-smoke/fixture/prepare-interviewer-worktree.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+workspace="./interviewer"
+mkdir -p "$workspace"
+printf '%s\n' "canonical materialization fixture" > "$workspace/README.md"
+
+git -C "$workspace" init -q --initial-branch=main
+git -C "$workspace" add README.md
+GIT_AUTHOR_DATE="2000-01-01T00:00:00Z" \
+GIT_COMMITTER_DATE="2000-01-01T00:00:00Z" \
+  git -C "$workspace" \
+    -c core.hooksPath=/dev/null \
+    -c user.name=eval-fixture \
+    -c user.email=eval-fixture@local \
+    commit -q -m "fixture: canonical materialization workspace"
+
+test -z "$(git -C "$workspace" status --porcelain=v1)"
diff --git a/docs/vrs/spec.md b/docs/vrs/spec.md
index c198e269..180d4607 100644
--- a/docs/vrs/spec.md
+++ b/docs/vrs/spec.md
@@ -112,12 +112,14 @@ one-sentence human request
   checks recognize this typed launch as a paid model seat and reject durable
   account pins.
 - The paid cell uses st2's explicit `canonical-agents` seam. A deterministic
-  pre-admission run reads the active runtime profile and publishes one
-  canonical interviewer declaration with its exact immutable Axe adapter,
-  absolute profile path, and canonical persona source. st2 then carries that
-  declaration unchanged through strict validation, materialization, launch,
-  kickoff routing, singleton completion, and teardown. No compact eval seat,
-  compatibility wrapper, account pin, or ambient provider launch participates.
+  pre-admission run first creates the copied interviewer workspace as a clean,
+  deterministic Git worktree. A second run reads the active runtime profile
+  and publishes one canonical interviewer declaration with its exact immutable
+  Axe adapter, absolute profile path, and canonical persona source. st2 then
+  carries that declaration unchanged through strict validation,
+  warning-free materialization, launch, kickoff routing, singleton completion,
+  and teardown. No compact eval seat, compatibility wrapper, account pin, or
+  ambient provider launch participates.
 - The paid cell is environment-bound to that explicit runtime-profile
   artifact; the artifact identity belongs in run evidence and results are not
   represented as hermetic across different profiles.
@@ -131,9 +133,15 @@ one-sentence human request
   workspace-trust projection is independently proven; model-free evidence
   does not establish provider readiness.
 - The model-free `canonical-agent-runtime-smoke` cell independently proves the
-  runtime seam with one deterministic shell Agent Spec: strict admission,
-  boot, canonical kickoff, fresh reply, and normal teardown, with no Axe,
-  account, model, or provider harness.
+  runtime seam with one deterministic shell Agent Spec: the same disposable
+  Git-worktree shape, strict persona/bus overlay materialization with zero
+  warnings, boot, canonical kickoff, fresh reply, and normal teardown, with no
+  Axe, account, model, or provider harness.
+- The first authorized paid attempt is evidence only for a pre-Axe fixture
+  defect: required `git-exclude` materialization failed because the copied
+  workspace was not a Git worktree. It reached no account selection, provider
+  readiness, trust behavior, judge, or verdict and left no catalog or process
+  residue. It cannot be represented as provider evidence.
 - Passing model-free evidence proves the bundle boundary and its negative
   controls only. The autonomous-selection claim remains unaccepted until the
   paid judgment cell has a structured PASS receipt.
diff --git a/evidence/agent-new-interview-attempts.tsv b/evidence/agent-new-interview-attempts.tsv
new file mode 100644
index 00000000..c7e386e1
--- /dev/null
+++ b/evidence/agent-new-interview-attempts.tsv
@@ -0,0 +1,2 @@
+recorded_at_utc	source_commit	st2_commit	st2_sha256	axe_feature_head	adapter	runtime_profile	stage	result	diagnostic	cleanup
+2026-07-30T20:06:02Z	44b75cfc052d3d21530a3d5a366441162efb2feb	0ec6a22e877f9374260202c5f76dabc4579fc7e3	df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db	c1bbce7f7	/nix/store/jyvz9050ba3wv214k862wnkvd03yxll6-axe/bin/axe	/nix/store/5lp3nnsgb591qhhk5cp44ffajmnqcihy-coding-agent-runtime-profile/share/coding-agents/profile.json	materialization	PRE_AXE_FAIL	interviewer workspace was not a Git worktree, so required git-exclude produced a fatal warning	catalog-absent;process-absent

From d72e3280d9db80720eae8aaa36b81468a60e123c Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 22:24:02 +0200
Subject: [PATCH 07/12] evals: harden pre-Axe evidence

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 ...-agent-new-interview-attempts-mutations.sh | 33 +++++++++++++++++
 bin/check-agent-new-interview-attempts.sh     | 32 +++++++++-------
 bin/check-append-only-file.sh                 | 37 +++++++++++++++++++
 bin/check-corpus.sh                           | 16 +++++++-
 bin/check-preflight-safety.sh                 |  3 ++
 cells/canonical-agent-runtime-smoke/README.md |  4 ++
 evidence/agent-new-interview-attempts.tsv     |  4 +-
 7 files changed, 112 insertions(+), 17 deletions(-)
 create mode 100755 bin/check-agent-new-interview-attempts-mutations.sh
 create mode 100755 bin/check-append-only-file.sh

diff --git a/bin/check-agent-new-interview-attempts-mutations.sh b/bin/check-agent-new-interview-attempts-mutations.sh
new file mode 100755
index 00000000..b6b577e6
--- /dev/null
+++ b/bin/check-agent-new-interview-attempts-mutations.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Prove the append-only helper accepts an append and rejects a baseline-row rewrite.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+scratch="$(mktemp -d)"
+trap 'rm -rf -- "$scratch"' EXIT
+
+git -C "$scratch" init -q --initial-branch=main
+mkdir -p "$scratch/evidence"
+printf 'header\nbaseline-row\n' >"$scratch/evidence/attempts.tsv"
+git -C "$scratch" add evidence/attempts.tsv
+GIT_AUTHOR_DATE="2000-01-01T00:00:00Z" \
+GIT_COMMITTER_DATE="2000-01-01T00:00:00Z" \
+  git -C "$scratch" \
+    -c core.hooksPath=/dev/null \
+    -c user.name=eval-fixture \
+    -c user.email=eval-fixture@local \
+    commit -q -m "fixture: append-only baseline"
+baseline="$(git -C "$scratch" rev-parse HEAD)"
+
+printf 'appended-row\n' >>"$scratch/evidence/attempts.tsv"
+"$repo_root/bin/check-append-only-file.sh" \
+  --repo-root "$scratch" --baseline "$baseline" --path evidence/attempts.tsv >/dev/null
+
+printf 'header\nrewritten-row\nappended-row\n' >"$scratch/evidence/attempts.tsv"
+if "$repo_root/bin/check-append-only-file.sh" \
+  --repo-root "$scratch" --baseline "$baseline" --path evidence/attempts.tsv >/dev/null 2>&1; then
+  echo "FAIL: append-only helper accepted a rewritten baseline row" >&2
+  exit 1
+fi
+
+echo "PASS: append-only mutation accepts appended bytes and rejects a baseline-row rewrite"
diff --git a/bin/check-agent-new-interview-attempts.sh b/bin/check-agent-new-interview-attempts.sh
index c970c5a4..04cce282 100755
--- a/bin/check-agent-new-interview-attempts.sh
+++ b/bin/check-agent-new-interview-attempts.sh
@@ -1,28 +1,28 @@
 #!/usr/bin/env bash
-# Validate append-only pre-run evidence without representing it as a judged model run.
+# Validate pre-run evidence without representing it as a judged model run.
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 
 ledger="evidence/agent-new-interview-attempts.tsv"
-expected_header=$'recorded_at_utc\tsource_commit\tst2_commit\tst2_sha256\taxe_feature_head\tadapter\truntime_profile\tstage\tresult\tdiagnostic\tcleanup'
+baseline=""
+if [ "$#" -eq 2 ] && [ "$1" = "--baseline" ]; then
+  baseline="$2"
+elif [ "$#" -ne 0 ]; then
+  echo "usage: $0 [--baseline COMMIT]" >&2
+  exit 2
+fi
+expected_header=$'recorded_at_utc\tsource_commit\tst2_commit\tst2_sha256\taxe_source_commit\tadapter\truntime_profile\tstage\tresult\tdiagnostic\tcleanup'
 
 [ -f "$ledger" ] && [ "$(head -n 1 "$ledger")" = "$expected_header" ] || {
   echo "FAIL: $ledger is missing or has an unexpected header" >&2
   exit 1
 }
 
-if git cat-file -e "HEAD:$ledger" 2>/dev/null; then
-  prior="$(mktemp)"
-  trap 'rm -f -- "$prior"' EXIT
-  git show "HEAD:$ledger" >"$prior"
-  prior_size="$(wc -c <"$prior")"
-  current_size="$(wc -c <"$ledger")"
-  [ "$current_size" -ge "$prior_size" ] && cmp -n "$prior_size" "$prior" "$ledger" || {
-    echo "FAIL: $ledger rewrites or removes existing evidence; only append rows" >&2
-    exit 1
-  }
+if [ -n "$baseline" ]; then
+  bin/check-append-only-file.sh \
+    --repo-root "$repo_root" --baseline "$baseline" --path "$ledger"
 fi
 
 rows=0
@@ -36,7 +36,7 @@ while IFS=$'\t' read -r recorded source st2_commit st2_sha axe_head adapter prof
     { echo "FAIL: unavailable source commit $source" >&2; exit 1; }
   [[ "$st2_commit" =~ ^[0-9a-f]{40}$ && "$st2_sha" =~ ^[0-9a-f]{64}$ ]] ||
     { echo "FAIL: st2 identity is not exact" >&2; exit 1; }
-  [[ "$axe_head" =~ ^[0-9a-f]{7,40}$ && "$adapter" == /nix/store/* && "$profile" == /nix/store/* ]] ||
+  [[ "$axe_head" =~ ^[0-9a-f]{40}$ && "$adapter" == /nix/store/* && "$profile" == /nix/store/* ]] ||
     { echo "FAIL: Axe/runtime artifact identity is not exact" >&2; exit 1; }
   [ "$stage" = "materialization" ] && [ "$result" = "PRE_AXE_FAIL" ] ||
     { echo "FAIL: pre-run evidence claims an unsupported stage or result" >&2; exit 1; }
@@ -46,4 +46,8 @@ while IFS=$'\t' read -r recorded source st2_commit st2_sha axe_head adapter prof
 done <"$ledger"
 
 [ "$rows" -gt 0 ] || { echo "FAIL: $ledger has no evidence rows" >&2; exit 1; }
-printf 'PASS: %d append-only pre-Axe attempt row(s) validated with exact artifacts and cleanup\n' "$rows"
+if [ -n "$baseline" ]; then
+  printf 'PASS: %d pre-Axe attempt row(s) validated with exact artifacts, cleanup, and an immutable baseline\n' "$rows"
+else
+  printf 'PASS: %d pre-Axe attempt row(s) validated with exact artifacts and cleanup; no append-only baseline supplied\n' "$rows"
+fi
diff --git a/bin/check-append-only-file.sh b/bin/check-append-only-file.sh
new file mode 100755
index 00000000..a2737391
--- /dev/null
+++ b/bin/check-append-only-file.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Prove that a working-tree file preserves an immutable baseline blob as an exact prefix.
+set -euo pipefail
+
+repo_root=""
+baseline=""
+path=""
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --repo-root) repo_root="${2:-}"; shift 2 ;;
+    --baseline) baseline="${2:-}"; shift 2 ;;
+    --path) path="${2:-}"; shift 2 ;;
+    *) echo "usage: $0 --repo-root DIR --baseline REF --path RELATIVE_PATH" >&2; exit 2 ;;
+  esac
+done
+[ -n "$repo_root" ] && [ -n "$baseline" ] && [ -n "$path" ] ||
+  { echo "usage: $0 --repo-root DIR --baseline REF --path RELATIVE_PATH" >&2; exit 2; }
+[[ "$path" != /* && "$path" != *..* ]] ||
+  { echo "FAIL: append-only path must be repository-relative" >&2; exit 1; }
+
+baseline_commit="$(git -C "$repo_root" rev-parse --verify "$baseline^{commit}")" ||
+  { echo "FAIL: append-only baseline is not an immutable commit: $baseline" >&2; exit 1; }
+git -C "$repo_root" cat-file -e "$baseline_commit:$path" 2>/dev/null ||
+  { echo "FAIL: baseline $baseline_commit has no $path to compare" >&2; exit 1; }
+[ -f "$repo_root/$path" ] || { echo "FAIL: working file is missing: $path" >&2; exit 1; }
+
+prior="$(mktemp)"
+trap 'rm -f -- "$prior"' EXIT
+git -C "$repo_root" show "$baseline_commit:$path" >"$prior"
+prior_size="$(wc -c <"$prior")"
+current_size="$(wc -c <"$repo_root/$path")"
+[ "$current_size" -ge "$prior_size" ] &&
+  cmp -n "$prior_size" "$prior" "$repo_root/$path" || {
+    echo "FAIL: $path rewrites or removes baseline $baseline_commit; only append bytes" >&2
+    exit 1
+  }
+printf 'PASS: %s preserves baseline %s as an exact prefix\n' "$path" "$baseline_commit"
diff --git a/bin/check-corpus.sh b/bin/check-corpus.sh
index ebefc6c7..5af09ab3 100755
--- a/bin/check-corpus.sh
+++ b/bin/check-corpus.sh
@@ -32,7 +32,21 @@ bin/check-model-policy.sh
 bin/check-model-policy-mutations.sh
 bin/check-canonical-seat-template-mutations.sh
 bin/check-run-history.sh
-bin/check-agent-new-interview-attempts.sh
+attempt_baseline="${EVALS_EVIDENCE_BASELINE_REF:-}"
+if [ -z "$attempt_baseline" ] && git rev-parse --verify origin/main^{commit} >/dev/null 2>&1; then
+  candidate_baseline="$(git merge-base HEAD origin/main)"
+  current_commit="$(git rev-parse HEAD)"
+  if [ "$candidate_baseline" != "$current_commit" ] &&
+    git cat-file -e "$candidate_baseline:evidence/agent-new-interview-attempts.tsv" 2>/dev/null; then
+    attempt_baseline="$candidate_baseline"
+  fi
+fi
+if [ -n "$attempt_baseline" ]; then
+  bin/check-agent-new-interview-attempts.sh --baseline "$attempt_baseline"
+else
+  bin/check-agent-new-interview-attempts.sh
+fi
+bin/check-agent-new-interview-attempts-mutations.sh
 bin/check-retired-surfaces.sh
 bin/model-seat-inventory.sh >/dev/null
 bin/check-event-first.sh
diff --git a/bin/check-preflight-safety.sh b/bin/check-preflight-safety.sh
index e94646f8..1f71275e 100755
--- a/bin/check-preflight-safety.sh
+++ b/bin/check-preflight-safety.sh
@@ -7,6 +7,8 @@ cd "$repo_root"
 
 reachable=(
   bin/check-corpus.sh
+  bin/check-append-only-file.sh
+  bin/check-agent-new-interview-attempts-mutations.sh
   bin/check-agent-new-renderer-security.sh
   bin/check-agent-new-interview-attempts.sh
   bin/check-canonical-seat-template-mutations.sh
@@ -66,6 +68,7 @@ mapfile -t direct < <(
     LC_ALL=C sort -u
 )
 expected_direct=(
+  bin/check-agent-new-interview-attempts-mutations.sh
   bin/check-agent-new-interview-attempts.sh
   bin/check-agent-new-renderer-security.sh
   bin/check-canonical-seat-template-mutations.sh
diff --git a/cells/canonical-agent-runtime-smoke/README.md b/cells/canonical-agent-runtime-smoke/README.md
index ee035337..9ba5201b 100644
--- a/cells/canonical-agent-runtime-smoke/README.md
+++ b/cells/canonical-agent-runtime-smoke/README.md
@@ -11,6 +11,10 @@ shape required by the paid interviewer. Strict materialization copies the
 canonical persona and bus overlays and applies `git-exclude` with zero
 warnings. It uses no Axe, account, model, or provider harness.
 
+Its six gating results are the successful preparation run step, canonical team
+completion, and four declared judges. The run-step result is emitted and graded
+by st2 in addition to the judges declared in KDL.
+
 ```sh
 st2 eval ./cells/canonical-agent-runtime-smoke/
 ```
diff --git a/evidence/agent-new-interview-attempts.tsv b/evidence/agent-new-interview-attempts.tsv
index c7e386e1..30351938 100644
--- a/evidence/agent-new-interview-attempts.tsv
+++ b/evidence/agent-new-interview-attempts.tsv
@@ -1,2 +1,2 @@
-recorded_at_utc	source_commit	st2_commit	st2_sha256	axe_feature_head	adapter	runtime_profile	stage	result	diagnostic	cleanup
-2026-07-30T20:06:02Z	44b75cfc052d3d21530a3d5a366441162efb2feb	0ec6a22e877f9374260202c5f76dabc4579fc7e3	df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db	c1bbce7f7	/nix/store/jyvz9050ba3wv214k862wnkvd03yxll6-axe/bin/axe	/nix/store/5lp3nnsgb591qhhk5cp44ffajmnqcihy-coding-agent-runtime-profile/share/coding-agents/profile.json	materialization	PRE_AXE_FAIL	interviewer workspace was not a Git worktree, so required git-exclude produced a fatal warning	catalog-absent;process-absent
+recorded_at_utc	source_commit	st2_commit	st2_sha256	axe_source_commit	adapter	runtime_profile	stage	result	diagnostic	cleanup
+2026-07-30T20:06:02Z	44b75cfc052d3d21530a3d5a366441162efb2feb	0ec6a22e877f9374260202c5f76dabc4579fc7e3	df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db	c1bbce7f712f823f1df4447837d46e972910d9fa	/nix/store/jyvz9050ba3wv214k862wnkvd03yxll6-axe/bin/axe	/nix/store/5lp3nnsgb591qhhk5cp44ffajmnqcihy-coding-agent-runtime-profile/share/coding-agents/profile.json	materialization	PRE_AXE_FAIL	interviewer workspace was not a Git worktree, so required git-exclude produced a fatal warning	catalog-absent;process-absent

From 0015922e8906178f02e74b71e773ec145efed665 Mon Sep 17 00:00:00 2001
From: Nathan <me@nathanherald.com>
Date: Thu, 30 Jul 2026 22:44:12 +0200
Subject: [PATCH 08/12] Adapt canonical eval smoke to merged st2

---
 AGENT-SPEC.md                                 |  8 +-
 CATALOG.md                                    |  2 +-
 README.md                                     |  4 +-
 bin/check-canonical-agent-runtime-smoke.sh    | 74 +++++++++++++++++++
 bin/check-st2-pin-consistency.sh              |  3 +-
 bin/st2-pin.sh                                |  8 +-
 cells/canonical-agent-runtime-smoke/README.md | 19 +++--
 .../canonical-agent-runtime-smoke.kdl         | 13 +++-
 .../fleet/remote/declaration/agent.kdl        |  8 ++
 .../.managed/arbitrary/declaration}/agent.kdl | 11 ++-
 .../fixture/probe.sh                          |  2 +
 11 files changed, 129 insertions(+), 23 deletions(-)
 create mode 100755 bin/check-canonical-agent-runtime-smoke.sh
 create mode 100644 cells/canonical-agent-runtime-smoke/fixture/fleet/remote/declaration/agent.kdl
 rename cells/canonical-agent-runtime-smoke/fixture/{agents/evalhost/probe => organization/.managed/arbitrary/declaration}/agent.kdl (52%)

diff --git a/AGENT-SPEC.md b/AGENT-SPEC.md
index 1c46d640..6f38b50f 100644
--- a/AGENT-SPEC.md
+++ b/AGENT-SPEC.md
@@ -1,8 +1,8 @@
 # Canonical st2 agent specification
 
 This is the sole agent-authoring specification for this repository. It is pinned to st2
-[`0ec6a22e877f9374260202c5f76dabc4579fc7e3`](https://github.com/compoundingtech/st2/commit/0ec6a22e877f9374260202c5f76dabc4579fc7e3)
-(`0.1.0`, source `0ec6a22`). It documents the hand-authored KDL accepted at that commit. Do not infer
+[`c6846f6239329f0803142afc06c15a07b93937c1`](https://github.com/compoundingtech/st2/commit/c6846f6239329f0803142afc06c15a07b93937c1)
+(`0.1.0`, source `c6846f6`). It documents the hand-authored KDL accepted at that commit. Do not infer
 additional fields or commands from older corpus fixtures.
 
 st2 runs long-lived `service` agents made of interactive `pty` tasks and terminal-free `exec` tasks.
@@ -432,8 +432,8 @@ Inspect the declaration, every referenced template, and every workspace destinat
 materialization command. Materialization is byte-idempotent and does not imply hook installation. Starting
 the network is a separate, explicitly authorized action.
 
-For source `0ec6a22e877f9374260202c5f76dabc4579fc7e3`, the accepted local-source Linux executable has
-SHA256 `df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db`.
+For source `c6846f6239329f0803142afc06c15a07b93937c1`, the accepted local-source Linux executable has
+SHA256 `2bba8d58be24250bc262f75f835ce2d780369add275774f3f2135c623d23d29c`.
 `bin/check-st2-pin-consistency.sh` keeps this active spec, the README, and executable preflight aligned.
 `bin/check-corpus.sh` verifies the variable-age version contract, exact installed binary, strict semantic
 validation, fixture resets, and the rest of the model-free corpus gate before an eval may run.
diff --git a/CATALOG.md b/CATALOG.md
index ac7a8592..916011c0 100644
--- a/CATALOG.md
+++ b/CATALOG.md
@@ -18,7 +18,7 @@ harness-native loader plus canonical hook file.
 |---|---|---|---:|---|---|---:|---|---|
 | `agent-new-bundle-contract` | model-free | — | 0 | none | `60s` | 5 | — | **NO STRUCTURED RUN** |
 | `agent-new-interview` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 4 | — | **NO STRUCTURED RUN** |
-| `canonical-agent-runtime-smoke` | model-free | — | 0 | none | `30s` | 4 | — | **NO STRUCTURED RUN** |
+| `canonical-agent-runtime-smoke` | model-free | — | 0 | none | `30s` | 7 | — | **NO STRUCTURED RUN** |
 | `context-resource-continuity` | model-free | — | 0 | none | `90s` | 4 | — | **NO STRUCTURED RUN** |
 | `crash-ding` | mixed | `claude-sonnet-5+gpt-5.6-sol` / medium | 4 | high | `180s` | 5 | — | **NO STRUCTURED RUN** |
 | `ding-mode` | Claude | `claude-sonnet-5` / medium | 2 | medium | `1200s` | 4 | — | **NO STRUCTURED RUN** |
diff --git a/README.md b/README.md
index eeaf54a3..1e84f970 100644
--- a/README.md
+++ b/README.md
@@ -96,9 +96,9 @@ VERDICT: PASS
 ```
 
 Requirements are `st2 0.1.0` from source
-[`0ec6a22`](https://github.com/compoundingtech/st2/commit/0ec6a22e877f9374260202c5f76dabc4579fc7e3),
+[`c6846f6`](https://github.com/compoundingtech/st2/commit/c6846f6239329f0803142afc06c15a07b93937c1),
 using the accepted local-source Linux binary SHA256
-`df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db`;
+`2bba8d58be24250bc262f75f835ce2d780369add275774f3f2135c623d23d29c`;
 `pty`, Bash, Git, `jq`, Rust/Cargo for the pinned KDL parser gate, and Node for JavaScript fixtures. A paid cell
 also needs every harness named by its dry-run row.
 
diff --git a/bin/check-canonical-agent-runtime-smoke.sh b/bin/check-canonical-agent-runtime-smoke.sh
new file mode 100755
index 00000000..af6ec31f
--- /dev/null
+++ b/bin/check-canonical-agent-runtime-smoke.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+source bin/st2-pin.sh
+
+st2_bin="$(command -v st2)"
+version="$(st2 --version)"
+sha256="$(sha256sum "$st2_bin" | awk '{ print $1 }')"
+[[ "$version" =~ $ST2_VERSION_REGEX ]] || {
+  echo "FAIL: expected st2 source $ST2_SOURCE_SHORT, found $version" >&2
+  exit 1
+}
+[ "$sha256" = "$ST2_BINARY_SHA256" ] || {
+  echo "FAIL: expected st2 binary $ST2_BINARY_SHA256, found $sha256 at $st2_bin" >&2
+  exit 1
+}
+
+bin/corpus-inventory.sh --no-header |
+  awk -F '\t' '$1 == "canonical-agent-runtime-smoke" && $2 == "model-free" && $5 == 0 { found = 1 } END { exit !found }' || {
+    echo "FAIL: canonical-agent-runtime-smoke is not classified as zero-seat model-free" >&2
+    exit 1
+  }
+
+log="$(mktemp)"
+catalog=""
+cleanup() {
+  rm -f -- "$log"
+  if [ -n "$catalog" ]; then
+    case "$catalog" in
+      /tmp/st2e-[0-9]*) rm -rf -- "$catalog" ;;
+      *) echo "REFUSE: unexpected scratch catalog path $catalog" >&2 ;;
+    esac
+  fi
+}
+trap cleanup EXIT
+
+set +e
+st2 eval ./cells/canonical-agent-runtime-smoke/ --keep >"$log" 2>&1 &
+eval_pid=$!
+catalog="/tmp/st2e-$eval_pid"
+wait "$eval_pid"
+status=$?
+set -e
+cat "$log"
+
+[ "$status" -eq 0 ] || {
+  echo "FAIL: canonical Agent Spec smoke exited $status" >&2
+  exit "$status"
+}
+grep -Fq "SCORE: 9 PASS / 0 FAIL / 9 gating judges" "$log"
+grep -Fq "VERDICT: PASS" "$log"
+
+for pid_file in "$catalog/probe/work.pid" "$catalog/probe/guard.pid"; do
+  pid="$(cat "$pid_file")"
+  [[ "$pid" =~ ^[0-9]+$ ]] || {
+    echo "FAIL: canonical runtime task receipt is not a PID: $pid_file=$pid" >&2
+    exit 1
+  }
+  if kill -0 "$pid" 2>/dev/null; then
+    echo "FAIL: canonical runtime task $pid from $pid_file survived eval teardown" >&2
+    exit 1
+  fi
+done
+
+sessions="$(st2 pty --catalog "$catalog" ls --json)"
+jq -e 'length == 0' <<<"$sessions" >/dev/null || {
+  echo "FAIL: canonical eval left PTY registry residue: $sessions" >&2
+  exit 1
+}
+test ! -e "$catalog/REMOTE-SPAWNED"
+
+echo "PASS: path-independent local PTY+exec launched, native routing completed, remote sentinel stayed inert, and teardown left zero tasks"
diff --git a/bin/check-st2-pin-consistency.sh b/bin/check-st2-pin-consistency.sh
index 6a276983..e4258acf 100755
--- a/bin/check-st2-pin-consistency.sh
+++ b/bin/check-st2-pin-consistency.sh
@@ -11,7 +11,8 @@ grep -Fq "$ST2_BINARY_SHA256" AGENT-SPEC.md
 grep -Fq "$ST2_BINARY_SHA256" README.md
 grep -Fq 'source bin/st2-pin.sh' bin/check-corpus.sh
 
-if rg -n '9887b28|d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d' \
+if rg -n \
+  '9887b28|d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d|0ec6a22|df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db' \
   AGENT-SPEC.md README.md bin/check-corpus.sh bin/st2-pin.sh; then
   echo "FAIL: active st2 pin surfaces retain the superseded source or binary hash" >&2
   exit 1
diff --git a/bin/st2-pin.sh b/bin/st2-pin.sh
index 1784a70f..f784ad21 100755
--- a/bin/st2-pin.sh
+++ b/bin/st2-pin.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-ST2_SOURCE_SHORT="0ec6a22"
-ST2_SOURCE_FULL="0ec6a22e877f9374260202c5f76dabc4579fc7e3"
-ST2_BINARY_SHA256="df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db"
-ST2_VERSION_REGEX='^st2 0\.1\.0 — running from local source \(0ec6a22, .+ ago\)$'
+ST2_SOURCE_SHORT="c6846f6"
+ST2_SOURCE_FULL="c6846f6239329f0803142afc06c15a07b93937c1"
+ST2_BINARY_SHA256="2bba8d58be24250bc262f75f835ce2d780369add275774f3f2135c623d23d29c"
+ST2_VERSION_REGEX='^st2 0\.1\.0 — running from local source \(c6846f6, .+ ago\)$'
diff --git a/cells/canonical-agent-runtime-smoke/README.md b/cells/canonical-agent-runtime-smoke/README.md
index 9ba5201b..ebad02f9 100644
--- a/cells/canonical-agent-runtime-smoke/README.md
+++ b/cells/canonical-agent-runtime-smoke/README.md
@@ -1,20 +1,23 @@
 # canonical-agent-runtime-smoke
 
 This model-free cell exercises st2's production Agent Spec eval seam with one
-deterministic shell agent. The canonical declaration is the sole launch and
-routing authority: st2 boots it, delivers the kickoff to its native inbox,
-requires a fresh reply, grades the root and routing receipts, and tears the PTY
-down through normal eval cleanup.
+deterministic local shell agent and one valid remote-host sentinel. The local
+declaration intentionally lives outside the conventional agent path and owns a
+custom-named PTY plus an exec task. Its explicit identity and host remain the
+sole launch and routing authority while the remote declaration stays inert.
+st2 boots every local task, delivers the kickoff to the declaration's native
+inbox, requires a fresh reply, captures the custom PTY log, and tears both
+tasks down through normal eval cleanup.
 
 Before admission, a deterministic run creates the same disposable Git-worktree
 shape required by the paid interviewer. Strict materialization copies the
 canonical persona and bus overlays and applies `git-exclude` with zero
 warnings. It uses no Axe, account, model, or provider harness.
 
-Its six gating results are the successful preparation run step, canonical team
-completion, and four declared judges. The run-step result is emitted and graded
-by st2 in addition to the judges declared in KDL.
+Its nine gating results are the successful preparation run step, canonical
+team completion, and seven declared judges. The run-step result is emitted and
+graded by st2 in addition to the judges declared in KDL.
 
 ```sh
-st2 eval ./cells/canonical-agent-runtime-smoke/
+bin/check-canonical-agent-runtime-smoke.sh
 ```
diff --git a/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl b/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl
index 809b7f97..acfb7ff1 100644
--- a/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl
+++ b/cells/canonical-agent-runtime-smoke/canonical-agent-runtime-smoke.kdl
@@ -23,8 +23,17 @@ eval {
     judge "STRICT MATERIALIZATION — canonical persona and bus overlays materialize into a clean Git worktree" {
       exec #"test -s "$CATALOG/interviewer/.st2/PERSONA.md" && test -s "$CATALOG/interviewer/.st2/bus.md" && grep -Fxq ".st2/" "$CATALOG/interviewer/.git/info/exclude" && test -z "$(git -C "$CATALOG/interviewer" status --porcelain=v1)""#
     }
-    judge "MODEL FREE — the admitted Agent Spec contains no provider, account, or Axe launch" {
-      exec #"! grep -Eq 'axe|claude|codex|opencode|pi|--account' "$CATALOG/agents/evalhost/probe/agent.kdl""#
+    judge "PATH-INDEPENDENT ROUTING — the explicit local identity owns its declaration-parent inbox" {
+      exec #"test -d "$CATALOG/organization/.managed/arbitrary/declaration/resources/inbox""#
+    }
+    judge "GENERIC TASK VECTOR — custom PTY and exec task IDs were both admitted and launched" {
+      exec #"test -s "$CATALOG/logs/canonical-probe-work.log" && test -s "$CATALOG/probe/guard.pid" && kill -0 "$(cat "$CATALOG/probe/guard.pid")""#
+    }
+    judge "REMOTE PROJECTION — a valid remote-host declaration remains inert" {
+      exec #"test ! -e "$CATALOG/REMOTE-SPAWNED""#
+    }
+    judge "MODEL FREE — neither admitted declaration contains a provider, account, or Axe launch" {
+      exec #"! grep -ERq '(^|[^[:alnum:]_-])(axe|claude|codex|opencode|pi)([^[:alnum:]_-]|$)|--account' "$CATALOG/organization" "$CATALOG/fleet""#
     }
   }
 }
diff --git a/cells/canonical-agent-runtime-smoke/fixture/fleet/remote/declaration/agent.kdl b/cells/canonical-agent-runtime-smoke/fixture/fleet/remote/declaration/agent.kdl
new file mode 100644
index 00000000..fae9a85a
--- /dev/null
+++ b/cells/canonical-agent-runtime-smoke/fixture/fleet/remote/declaration/agent.kdl
@@ -0,0 +1,8 @@
+agent "remote" {
+  identity "remote"
+  host "remotehost"
+  pty "work" {
+    id "canonical-remote-work"
+    command #"touch "$CATALOG/REMOTE-SPAWNED"; exec sleep 60"#
+  }
+}
diff --git a/cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl b/cells/canonical-agent-runtime-smoke/fixture/organization/.managed/arbitrary/declaration/agent.kdl
similarity index 52%
rename from cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl
rename to cells/canonical-agent-runtime-smoke/fixture/organization/.managed/arbitrary/declaration/agent.kdl
index 426428c7..a8a388c6 100644
--- a/cells/canonical-agent-runtime-smoke/fixture/agents/evalhost/probe/agent.kdl
+++ b/cells/canonical-agent-runtime-smoke/fixture/organization/.managed/arbitrary/declaration/agent.kdl
@@ -5,7 +5,16 @@ agent "probe" {
   env {
     ST_AGENT "evalhost.probe"
   }
-  argv "bash" "$CATALOG/probe.sh"
+
+  pty "work" {
+    id "canonical-probe-work"
+    argv "bash" "$CATALOG/probe.sh"
+  }
+  exec "guard" {
+    id "canonical-probe-guard"
+    command #"mkdir -p "$CATALOG/probe"; printf '%s\n' "$$$$" > "$CATALOG/probe/guard.pid"; exec sleep 60"#
+  }
+
   render {
     copy "_templates/generalist.md" ".st2/PERSONA.md"
     copy "_templates/bus.st2.md" ".st2/bus.md"
diff --git a/cells/canonical-agent-runtime-smoke/fixture/probe.sh b/cells/canonical-agent-runtime-smoke/fixture/probe.sh
index 6ef660a6..26a31ae0 100755
--- a/cells/canonical-agent-runtime-smoke/fixture/probe.sh
+++ b/cells/canonical-agent-runtime-smoke/fixture/probe.sh
@@ -5,6 +5,8 @@ test "$CATALOG" = "$ST_ROOT"
 test "$PTY_ROOT" = "$CATALOG/pty"
 test "$ST_AGENT" = "evalhost.probe"
 mkdir -p "$CATALOG/probe"
+printf '%s\n' "$$" >"$CATALOG/probe/work.pid"
+echo "canonical probe ready"
 touch "$CATALOG/probe/roots-ok"
 
 for _ in $(seq 1 200); do

From 9abb46efcb52f1c3ea05b95c2f0566fbeac6ae46 Mon Sep 17 00:00:00 2001
From: Nathan <me@nathanherald.com>
Date: Thu, 30 Jul 2026 22:56:00 +0200
Subject: [PATCH 09/12] Use agent terminology in PR56 gates

---
 AGENT-SPEC.md                                 |  2 +-
 CATALOG.md                                    | 38 +++++++++----------
 README.md                                     |  2 +-
 bin/check-canonical-agent-runtime-smoke.sh    |  2 +-
 ...eck-canonical-agent-template-mutations.sh} |  2 +-
 ...e.sh => check-canonical-agent-template.sh} |  1 +
 bin/check-corpus.sh                           |  6 +--
 bin/check-event-first.sh                      |  6 +--
 bin/check-harness-contract.sh                 |  8 ++--
 bin/check-preflight-safety.sh                 | 10 ++---
 bin/corpus-inventory.sh                       | 22 +++++------
 bin/generate-catalog.sh                       | 12 +++---
 ...-inventory.sh => model-agent-inventory.sh} |  8 ++--
 bin/overnight.sh                              | 18 ++++-----
 docs/vrs/spec.md                              | 10 ++---
 evidence/exclusions.tsv                       |  2 +-
 evidence/harness-exclusions.tsv               | 30 +++++++--------
 17 files changed, 90 insertions(+), 89 deletions(-)
 rename bin/{check-canonical-seat-template-mutations.sh => check-canonical-agent-template-mutations.sh} (95%)
 rename bin/{check-canonical-seat-template.sh => check-canonical-agent-template.sh} (95%)
 rename bin/{model-seat-inventory.sh => model-agent-inventory.sh} (93%)

diff --git a/AGENT-SPEC.md b/AGENT-SPEC.md
index 6f38b50f..803c6e97 100644
--- a/AGENT-SPEC.md
+++ b/AGENT-SPEC.md
@@ -421,7 +421,7 @@ example, create every `$CATALOG`-rooted workspace it names.
 
 ## Free authoring gate
 
-These commands parse and materialize without starting a model seat:
+These commands parse and materialize without starting a model agent:
 
 ```sh
 st2 validate --catalog "$CATALOG" --host <host> --strict
diff --git a/CATALOG.md b/CATALOG.md
index 916011c0..0bba34d3 100644
--- a/CATALOG.md
+++ b/CATALOG.md
@@ -9,12 +9,12 @@ structured run row say so explicitly.
 
 Every model launch is explicitly pinned by `bin/check-model-policy.sh`: Claude uses
 `claude-sonnet-5` at medium effort and Codex uses `gpt-5.6-sol` at medium reasoning effort.
-Every bus-connected model seat is mechanically checked for the event-first DING lifecycle and its
+Every bus-connected model agent is mechanically checked for the event-first DING lifecycle and its
 harness-native loader plus canonical hook file.
 
 ## Included overnight inventory
 
-| Cell | Harness | Model(s) / effort | Model seats | Cost | Timeout | Held-out judges | Latest accepted PASS | Last recorded run |
+| Cell | Harness | Model(s) / effort | Model agents | Cost | Timeout | Held-out judges | Latest accepted PASS | Last recorded run |
 |---|---|---|---:|---|---|---:|---|---|
 | `agent-new-bundle-contract` | model-free | — | 0 | none | `60s` | 5 | — | **NO STRUCTURED RUN** |
 | `agent-new-interview` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 4 | — | **NO STRUCTURED RUN** |
@@ -77,30 +77,30 @@ while the last-run column makes a recorded failure distinct from a cell with no
 - `clean-compose` — retired composition-overlay discriminator
 - `compose-config-load` — retired composition/config-loader discriminator
 - `compose-global-skill` — retired composition/global-skill discriminator
-- `team-standup` — retired runtime seat-generation discriminator
+- `team-standup` — retired runtime agent-generation discriminator
 
 `hook-integrity` is not excluded: it is now a model-free, current-native
 `st2 up --materialize-only` hook installation and idempotency test.
 
 ## Harness hook exclusions
 
-- `agent-new-bundle-contract` / `cell` — deterministic semantic-intent lowering and mutation probe; no harness seat
-- `canonical-agent-runtime-smoke` / `cell` — deterministic canonical Agent Spec boot, kickoff, reply, and teardown probe; no harness seat
-- `context-resource-continuity` / `cell` — deterministic native context/resource restart probe; no harness seat
+- `agent-new-bundle-contract` / `cell` — deterministic semantic-intent lowering and mutation probe; no harness agent
+- `canonical-agent-runtime-smoke` / `cell` — deterministic canonical Agent Spec boot, kickoff, reply, and teardown probe; no harness agent
+- `context-resource-continuity` / `cell` — deterministic native context/resource restart probe; no harness agent
 - `docs` / `judge:cold-reader` — one-shot offline Claude print grader; no bus identity, DING, or hook surface
-- `exec-lifecycle-logging` / `cell` — deterministic native exec lifecycle probe; no harness seat
-- `hook-integrity` / `cell` — deterministic native hook-installation probe; no live harness seat
-- `host-lock-health-negatives` / `cell` — deterministic native doctor negative probe; no harness seat
-- `pty-attach-only` / `cell` — deterministic PTY dead-attach policy probe; no harness seat
-- `pty-send-peek` / `cell` — deterministic PTY transport probe; no harness seat
-- `presence-ding-matrix` / `cell` — deterministic native presence and DING probe; no harness seat
-- `reconcile-retire-keep` / `cell` — deterministic native reconcile lifecycle probe; no harness seat
-- `render-target-safety` / `cell` — deterministic native render-policy probe; no harness seat
-- `strict-validation-json` / `cell` — deterministic native validation-diagnostics probe; no harness seat
-- `st2-doctor-structure` / `cell` — deterministic catalog-health probe; no harness seat
-- `st2-network` / `cell` — deterministic catalog/message round-trip probe; no harness seat
+- `exec-lifecycle-logging` / `cell` — deterministic native exec lifecycle probe; no harness agent
+- `hook-integrity` / `cell` — deterministic native hook-installation probe; no live harness agent
+- `host-lock-health-negatives` / `cell` — deterministic native doctor negative probe; no harness agent
+- `pty-attach-only` / `cell` — deterministic PTY dead-attach policy probe; no harness agent
+- `pty-send-peek` / `cell` — deterministic PTY transport probe; no harness agent
+- `presence-ding-matrix` / `cell` — deterministic native presence and DING probe; no harness agent
+- `reconcile-retire-keep` / `cell` — deterministic native reconcile lifecycle probe; no harness agent
+- `render-target-safety` / `cell` — deterministic native render-policy probe; no harness agent
+- `strict-validation-json` / `cell` — deterministic native validation-diagnostics probe; no harness agent
+- `st2-doctor-structure` / `cell` — deterministic catalog-health probe; no harness agent
+- `st2-network` / `cell` — deterministic catalog/message round-trip probe; no harness agent
 - `targeted-reconcile-isolation` / `cell` — deterministic selected reconcile isolation probe; no bus-connected agent
-- `two-networks-coexist` / `cell` — deterministic catalog-isolation probe; no harness seat
+- `two-networks-coexist` / `cell` — deterministic catalog-isolation probe; no harness agent
 
 These **17** rows are generated from structured exclusions. A cell-level row is required for
 every derived model-free cell. The one-shot docs cold reader is a model-backed grader, but not a bus-connected
@@ -114,7 +114,7 @@ Run the complete model-free preflight:
 bin/check-corpus.sh
 ```
 
-Preview the exact lexical run order, harness, model, effort, seat count, cost band, and timeout:
+Preview the exact lexical run order, harness, model, effort, agent count, cost band, and timeout:
 
 ```sh
 bin/overnight.sh --dry-run
diff --git a/README.md b/README.md
index 1e84f970..f8512ebf 100644
--- a/README.md
+++ b/README.md
@@ -81,7 +81,7 @@ next paid cell to start.
 ## Run one cell
 
 `st2 eval` creates a hermetic temporary catalog, copies the fixture, boots declared agents and model judges,
-delivers the kickoff, waits for completion or the cell timeout, tears seats down, and runs the held-out judges:
+delivers the kickoff, waits for completion or the cell timeout, tears agents down, and runs the held-out judges:
 
 ```sh
 st2 eval ./cells/ghost-bug/
diff --git a/bin/check-canonical-agent-runtime-smoke.sh b/bin/check-canonical-agent-runtime-smoke.sh
index af6ec31f..74725011 100755
--- a/bin/check-canonical-agent-runtime-smoke.sh
+++ b/bin/check-canonical-agent-runtime-smoke.sh
@@ -19,7 +19,7 @@ sha256="$(sha256sum "$st2_bin" | awk '{ print $1 }')"
 
 bin/corpus-inventory.sh --no-header |
   awk -F '\t' '$1 == "canonical-agent-runtime-smoke" && $2 == "model-free" && $5 == 0 { found = 1 } END { exit !found }' || {
-    echo "FAIL: canonical-agent-runtime-smoke is not classified as zero-seat model-free" >&2
+    echo "FAIL: canonical-agent-runtime-smoke is not classified as zero-model-agent model-free" >&2
     exit 1
   }
 
diff --git a/bin/check-canonical-seat-template-mutations.sh b/bin/check-canonical-agent-template-mutations.sh
similarity index 95%
rename from bin/check-canonical-seat-template-mutations.sh
rename to bin/check-canonical-agent-template-mutations.sh
index 8aecf918..438755e2 100755
--- a/bin/check-canonical-seat-template-mutations.sh
+++ b/bin/check-canonical-agent-template-mutations.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-checker="$repo_root/bin/check-canonical-seat-template.sh"
+checker="$repo_root/bin/check-canonical-agent-template.sh"
 source_template="$repo_root/cells/agent-new-interview/fixture/agent.kdl.template"
 source_publisher="$repo_root/cells/agent-new-interview/fixture/publish-interviewer.sh"
 scratch="$(mktemp -d)"
diff --git a/bin/check-canonical-seat-template.sh b/bin/check-canonical-agent-template.sh
similarity index 95%
rename from bin/check-canonical-seat-template.sh
rename to bin/check-canonical-agent-template.sh
index 418c7119..cb3d64de 100755
--- a/bin/check-canonical-seat-template.sh
+++ b/bin/check-canonical-agent-template.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Validate the canonical paid model-agent declaration template and publisher.
 set -euo pipefail
 
 template="${1:?canonical Agent Spec template required}"
diff --git a/bin/check-corpus.sh b/bin/check-corpus.sh
index 5af09ab3..7e8063be 100755
--- a/bin/check-corpus.sh
+++ b/bin/check-corpus.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Complete free preflight for the current overnight corpus. Never starts a model seat.
+# Complete free preflight for the current overnight corpus. Never starts a model agent.
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -30,7 +30,7 @@ bin/check-preflight-safety.sh
 bin/check-agent-new-renderer-security.sh
 bin/check-model-policy.sh
 bin/check-model-policy-mutations.sh
-bin/check-canonical-seat-template-mutations.sh
+bin/check-canonical-agent-template-mutations.sh
 bin/check-run-history.sh
 attempt_baseline="${EVALS_EVIDENCE_BASELINE_REF:-}"
 if [ -z "$attempt_baseline" ] && git rev-parse --verify origin/main^{commit} >/dev/null 2>&1; then
@@ -48,7 +48,7 @@ else
 fi
 bin/check-agent-new-interview-attempts-mutations.sh
 bin/check-retired-surfaces.sh
-bin/model-seat-inventory.sh >/dev/null
+bin/model-agent-inventory.sh >/dev/null
 bin/check-event-first.sh
 bin/check-kdl-parse.sh
 bin/check-st2-semantic.sh
diff --git a/bin/check-event-first.sh b/bin/check-event-first.sh
index ef449c29..cd681b78 100755
--- a/bin/check-event-first.sh
+++ b/bin/check-event-first.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Enforce one cold-start drain followed by native DING wakeups for every maintained model seat.
+# Enforce one cold-start drain followed by native DING wakeups for every maintained model agent.
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -12,7 +12,7 @@ cleanup() {
 }
 trap cleanup EXIT
 
-bin/model-seat-inventory.sh --no-header > "$inventory"
+bin/model-agent-inventory.sh --no-header > "$inventory"
 
 failed=0
 fail() {
@@ -69,7 +69,7 @@ if rg -n --pcre2 \
 fi
 
 if [ "$failed" -eq 0 ]; then
-  printf 'PASS: %s model seats use one cold-start drain and event-first native DING wakeups\n' \
+  printf 'PASS: %s model agents use one cold-start drain and event-first native DING wakeups\n' \
     "$(wc -l < "$inventory" | tr -d ' ')"
 fi
 exit "$failed"
diff --git a/bin/check-harness-contract.sh b/bin/check-harness-contract.sh
index af061b96..e46765f0 100755
--- a/bin/check-harness-contract.sh
+++ b/bin/check-harness-contract.sh
@@ -30,7 +30,7 @@ cleanup() {
 }
 trap cleanup EXIT
 
-bin/model-seat-inventory.sh --no-header > "$inventory"
+bin/model-agent-inventory.sh --no-header > "$inventory"
 
 hydrate_gitdirs() {
   local root="$1" gitdir target
@@ -124,7 +124,7 @@ while IFS=$'\t' read -r cell agent harness workspace st_agent source_kind source
   axe_launch=0
   if [ "$source_kind" = "canonical-template" ]; then
     publisher="$(dirname "$source_path")/publish-interviewer.sh"
-    bin/check-canonical-seat-template.sh "$source_path" "$publisher" >/dev/null || {
+    bin/check-canonical-agent-template.sh "$source_path" "$publisher" >/dev/null || {
       failed=1
       continue
     }
@@ -182,7 +182,7 @@ while IFS=$'\t' read -r cell agent harness workspace st_agent source_kind source
 done < "$inventory"
 
 [ "$checked" -gt 0 ] || {
-  echo "FAIL: no $selected model seats were checked" >&2
+  echo "FAIL: no $selected model agents were checked" >&2
   exit 1
 }
 
@@ -209,7 +209,7 @@ grep -Fxq $'docs\tjudge:cold-reader\tone-shot offline Claude print grader; no bu
   }
 
 if [ "$failed" -eq 0 ]; then
-  printf 'PASS: %d %s model seats materialize and use the canonical harness overlay and hooks\n' \
+  printf 'PASS: %d %s model agents materialize and use the canonical harness overlay and hooks\n' \
     "$checked" "$selected"
   printf 'PASS: %d derived model-free cells have explicit harness-hook exclusions\n' \
     "${#expected[@]}"
diff --git a/bin/check-preflight-safety.sh b/bin/check-preflight-safety.sh
index 1f71275e..bd8e21ce 100755
--- a/bin/check-preflight-safety.sh
+++ b/bin/check-preflight-safety.sh
@@ -11,8 +11,8 @@ reachable=(
   bin/check-agent-new-interview-attempts-mutations.sh
   bin/check-agent-new-renderer-security.sh
   bin/check-agent-new-interview-attempts.sh
-  bin/check-canonical-seat-template-mutations.sh
-  bin/check-canonical-seat-template.sh
+  bin/check-canonical-agent-template-mutations.sh
+  bin/check-canonical-agent-template.sh
   bin/check-event-first.sh
   bin/check-fixture-reset.sh
   bin/check-fixture-reset-terminal.sh
@@ -33,7 +33,7 @@ reachable=(
   bin/check-weird-git-setup.sh
   bin/corpus-inventory.sh
   bin/generate-catalog.sh
-  bin/model-seat-inventory.sh
+  bin/model-agent-inventory.sh
   bin/st2-pin.sh
 )
 materializers=(
@@ -71,7 +71,7 @@ expected_direct=(
   bin/check-agent-new-interview-attempts-mutations.sh
   bin/check-agent-new-interview-attempts.sh
   bin/check-agent-new-renderer-security.sh
-  bin/check-canonical-seat-template-mutations.sh
+  bin/check-canonical-agent-template-mutations.sh
   bin/check-event-first.sh
   bin/check-fixture-reset-terminal.sh
   bin/check-harness-contract.sh
@@ -90,7 +90,7 @@ expected_direct=(
   bin/check-vrs-variations.sh
   bin/check-weird-git-setup.sh
   bin/generate-catalog.sh
-  bin/model-seat-inventory.sh
+  bin/model-agent-inventory.sh
 )
 if [ "${direct[*]}" != "${expected_direct[*]}" ]; then
   fail "check-corpus.sh direct command set differs from the reviewed allowlist"
diff --git a/bin/corpus-inventory.sh b/bin/corpus-inventory.sh
index 7fdd67b9..36979f76 100755
--- a/bin/corpus-inventory.sh
+++ b/bin/corpus-inventory.sh
@@ -13,15 +13,15 @@ elif [ "$#" -ne 0 ]; then
   exit 2
 fi
 
-seat_inventory="$(mktemp)"
+agent_inventory="$(mktemp)"
 cleanup() {
-  rm -f -- "$seat_inventory"
+  rm -f -- "$agent_inventory"
 }
 trap cleanup EXIT
-bin/model-seat-inventory.sh --no-header > "$seat_inventory"
+bin/model-agent-inventory.sh --no-header > "$agent_inventory"
 
 if [ "$include_header" -eq 1 ]; then
-  printf 'cell\tharness\tmodels\teffort\tmodel_seats\tcost_band\ttimeout\theld_out_judges\n'
+  printf 'cell\tharness\tmodels\teffort\tmodel_agents\tcost_band\ttimeout\theld_out_judges\n'
 fi
 
 mapfile -t cells < <(find cells -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | LC_ALL=C sort)
@@ -52,10 +52,10 @@ for cell in "${cells[@]}"; do
   }
   timeout="${timeouts[0]}"
 
-  claude="$(awk -F '\t' -v cell="$cell" '$1 == cell && $3 == "Claude" { count += 1 } END { print count + 0 }' "$seat_inventory")"
-  codex="$(awk -F '\t' -v cell="$cell" '$1 == cell && $3 == "Codex" { count += 1 } END { print count + 0 }' "$seat_inventory")"
+  claude="$(awk -F '\t' -v cell="$cell" '$1 == cell && $3 == "Claude" { count += 1 } END { print count + 0 }' "$agent_inventory")"
+  codex="$(awk -F '\t' -v cell="$cell" '$1 == cell && $3 == "Codex" { count += 1 } END { print count + 0 }' "$agent_inventory")"
 
-  seats=$((claude + codex))
+  agents=$((claude + codex))
   if [ "$claude" -gt 0 ] && [ "$codex" -gt 0 ]; then
     harness="mixed"
     models="claude-sonnet-5+gpt-5.6-sol"
@@ -70,13 +70,13 @@ for cell in "${cells[@]}"; do
     models="-"
   fi
 
-  if [ "$seats" -eq 0 ]; then
+  if [ "$agents" -eq 0 ]; then
     effort="-"
     cost="none"
-  elif [ "$seats" -eq 1 ]; then
+  elif [ "$agents" -eq 1 ]; then
     effort="medium"
     cost="low"
-  elif [ "$seats" -eq 2 ]; then
+  elif [ "$agents" -eq 2 ]; then
     effort="medium"
     cost="medium"
   else
@@ -87,5 +87,5 @@ for cell in "${cells[@]}"; do
   judges="$(rg -c '^[[:space:]]*judge[[:space:]]+"' "$kdl" || true)"
   judges="${judges:-0}"
   printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
-    "$cell" "$harness" "$models" "$effort" "$seats" "$cost" "$timeout" "$judges"
+    "$cell" "$harness" "$models" "$effort" "$agents" "$cost" "$timeout" "$judges"
 done
diff --git a/bin/generate-catalog.sh b/bin/generate-catalog.sh
index 0a70e45e..2ba81300 100755
--- a/bin/generate-catalog.sh
+++ b/bin/generate-catalog.sh
@@ -141,7 +141,7 @@ done < evidence/harness-exclusions.tsv
 total=0
 model_free=0
 model_backed=0
-while IFS=$'\t' read -r cell harness models effort seats cost timeout judges; do
+while IFS=$'\t' read -r cell harness models effort agents cost timeout judges; do
   ((total += 1))
   if [ "$harness" = "model-free" ]; then
     ((model_free += 1))
@@ -163,16 +163,16 @@ structured run row say so explicitly.
 
 Every model launch is explicitly pinned by \`bin/check-model-policy.sh\`: Claude uses
 \`claude-sonnet-5\` at medium effort and Codex uses \`gpt-5.6-sol\` at medium reasoning effort.
-Every bus-connected model seat is mechanically checked for the event-first DING lifecycle and its
+Every bus-connected model agent is mechanically checked for the event-first DING lifecycle and its
 harness-native loader plus canonical hook file.
 
 ## Included overnight inventory
 
-| Cell | Harness | Model(s) / effort | Model seats | Cost | Timeout | Held-out judges | Latest accepted PASS | Last recorded run |
+| Cell | Harness | Model(s) / effort | Model agents | Cost | Timeout | Held-out judges | Latest accepted PASS | Last recorded run |
 |---|---|---|---:|---|---|---:|---|---|
 EOF
 
-  while IFS=$'\t' read -r cell harness models effort seats cost timeout judges; do
+  while IFS=$'\t' read -r cell harness models effort agents cost timeout judges; do
     if [ "$models" = "-" ]; then
       model_display="—"
     else
@@ -203,7 +203,7 @@ EOF
       last="**NO STRUCTURED RUN**"
     fi
     printf '| `%s` | %s | %s | %s | %s | `%s` | %s | %s | %s |\n' \
-      "$cell" "$harness" "$model_display" "$seats" "$cost" "$timeout" "$judges" "$accepted" "$last"
+      "$cell" "$harness" "$model_display" "$agents" "$cost" "$timeout" "$judges" "$accepted" "$last"
   done < "$inventory"
 
   cat <<EOF
@@ -236,7 +236,7 @@ Run the complete model-free preflight:
 bin/check-corpus.sh
 \`\`\`
 
-Preview the exact lexical run order, harness, model, effort, seat count, cost band, and timeout:
+Preview the exact lexical run order, harness, model, effort, agent count, cost band, and timeout:
 
 \`\`\`sh
 bin/overnight.sh --dry-run
diff --git a/bin/model-seat-inventory.sh b/bin/model-agent-inventory.sh
similarity index 93%
rename from bin/model-seat-inventory.sh
rename to bin/model-agent-inventory.sh
index bf1dc538..9ca1f303 100755
--- a/bin/model-seat-inventory.sh
+++ b/bin/model-agent-inventory.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Emit every maintained model seat from compact eval declarations and canonical templates.
+# Emit every maintained model agent from compact eval declarations and canonical templates.
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -9,7 +9,7 @@ include_header=1
 if [ "${1:-}" = "--no-header" ]; then
   include_header=0
 elif [ "$#" -ne 0 ]; then
-  echo "usage: bin/model-seat-inventory.sh [--no-header]" >&2
+  echo "usage: bin/model-agent-inventory.sh [--no-header]" >&2
   exit 2
 fi
 
@@ -142,7 +142,7 @@ while IFS= read -r template; do
   fi
   if [ -z "$agent" ] || [ -z "$workspace" ] || [ -z "$st_agent" ] ||
     [ -z "$command_line" ] || [ -z "$harness" ] || [ "$ding_count" -ne 1 ]; then
-    echo "FAIL: canonical model-seat template is incomplete: $template" >&2
+    echo "FAIL: canonical model-agent template is incomplete: $template" >&2
     failed=1
     continue
   fi
@@ -161,7 +161,7 @@ launches="$(
 )"
 rows="$(wc -l < "$inventory" | tr -d ' ')"
 if [ "$rows" -ne "$launches" ]; then
-  echo "FAIL: model-seat inventory found $rows structured seats but $launches root-KDL launch lines" >&2
+  echo "FAIL: model-agent inventory found $rows structured agents but $launches root-KDL launch lines" >&2
   failed=1
 fi
 
diff --git a/bin/overnight.sh b/bin/overnight.sh
index 5640810f..a68630e0 100755
--- a/bin/overnight.sh
+++ b/bin/overnight.sh
@@ -128,16 +128,16 @@ fi
 
 requires_claude=0
 requires_codex=0
-while IFS=$'\t' read -r _cell _harness models _effort _seats _cost _timeout _judges; do
+while IFS=$'\t' read -r _cell _harness models _effort _agents _cost _timeout _judges; do
   [[ "$models" != *claude-sonnet-5* ]] || requires_claude=1
   [[ "$models" != *gpt-5.6-sol* ]] || requires_codex=1
 done < "$inventory"
 
 printf '%-30s %-10s %-35s %-7s %-5s %-8s %s\n' \
-  CELL HARNESS MODEL EFFORT SEATS COST TIMEOUT
-while IFS=$'\t' read -r cell harness models effort seats cost timeout _judges; do
+  CELL HARNESS MODEL EFFORT AGENTS COST TIMEOUT
+while IFS=$'\t' read -r cell harness models effort agents cost timeout _judges; do
   printf '%-30s %-10s %-35s %-7s %-5s %-8s %s\n' \
-    "$cell" "$harness" "$models" "$effort" "$seats" "$cost" "$timeout"
+    "$cell" "$harness" "$models" "$effort" "$agents" "$cost" "$timeout"
 done < "$inventory"
 
 cells="$(wc -l < "$inventory" | tr -d ' ')"
@@ -179,7 +179,7 @@ fi
 }
 
 echo
-echo "== free preflight (no model seats) =="
+echo "== free preflight (no model agents) =="
 bin/check-corpus.sh
 
 if [ "$requires_claude" -eq 1 ]; then
@@ -281,7 +281,7 @@ cleanup_timed_out_catalog() {
   fi
 }
 
-while IFS=$'\t' read -r cell harness models effort seats cost declared_timeout _judges; do
+while IFS=$'\t' read -r cell harness models effort agents cost declared_timeout _judges; do
   hash="$(cell_hash "$cell")"
   receipt="$state_dir/receipts/$cell.env"
   if [ -f "$receipt" ] &&
@@ -295,8 +295,8 @@ while IFS=$'\t' read -r cell harness models effort seats cost declared_timeout _
   stamp="$(date -u +%Y%m%dT%H%M%SZ)"
   log="$state_dir/logs/$cell.$stamp.log"
   watchdog_seconds=$(($(duration_seconds "$declared_timeout") + 180))
-  printf '\n== %s: %s, %s, %s seat(s), %s cost, timeout %s (+180s watchdog) ==\n' \
-    "$cell" "$harness" "$models" "$seats" "$cost" "$declared_timeout"
+  printf '\n== %s: %s, %s, %s agent(s), %s cost, timeout %s (+180s watchdog) ==\n' \
+    "$cell" "$harness" "$models" "$agents" "$cost" "$declared_timeout"
 
   setsid stdbuf -oL -eL st2 eval "./cells/$cell/" --keep > "$log" 2>&1 &
   eval_pid=$!
@@ -404,7 +404,7 @@ while IFS=$'\t' read -r cell harness models effort seats cost declared_timeout _
     "harness=$harness" \
     "models=$models" \
     "effort=$effort" \
-    "model_seats=$seats" \
+    "model_agents=$agents" \
     "cost_band=$cost" \
     "declared_timeout=$declared_timeout" \
     "hard_usage_warning=$hard_usage_seen" \
diff --git a/docs/vrs/spec.md b/docs/vrs/spec.md
index 180d4607..488c884a 100644
--- a/docs/vrs/spec.md
+++ b/docs/vrs/spec.md
@@ -93,9 +93,9 @@ one-sentence human request
   evaluates the renderer contract across multiple intents and closed-input
   failures. Held-out mutation controls reject raw provider argv, drift between
   intent and KDL, and missing initial context.
-- **R06-R09:** The judgment cell uses one explicitly pinned Claude Sonnet seat
+- **R06-R09:** The judgment cell uses one explicitly pinned Claude Sonnet agent
   at medium effort and a five-minute cell timeout. The deterministic cell has
-  no model seat and a one-minute timeout. Normal st2 eval cleanup and receipt
+  no model agent and a one-minute timeout. Normal st2 eval cleanup and receipt
   policy applies to both.
 - The interviewer output is semantic intent, not KDL. Stable launch axes are
   explicit in that intent; the deterministic boundary owns canonical KDL,
@@ -109,7 +109,7 @@ one-sentence human request
   `axe agent launch` with explicit harness, model, effort, persona, mode, and
   boot axes. The cell does not pin `--account`: Axe selects an eligible
   account per run. Corpus inventory, model policy, lifecycle, and harness
-  checks recognize this typed launch as a paid model seat and reject durable
+  checks recognize this typed launch as a paid model agent and reject durable
   account pins.
 - The paid cell uses st2's explicit `canonical-agents` seam. A deterministic
   pre-admission run first creates the copied interviewer workspace as a clean,
@@ -118,12 +118,12 @@ one-sentence human request
   Axe adapter, absolute profile path, and canonical persona source. st2 then
   carries that declaration unchanged through strict validation,
   warning-free materialization, launch, kickoff routing, singleton completion,
-  and teardown. No compact eval seat, compatibility wrapper, account pin, or
+  and teardown. No compact eval agent, compatibility wrapper, account pin, or
   ambient provider launch participates.
 - The paid cell is environment-bound to that explicit runtime-profile
   artifact; the artifact identity belongs in run evidence and results are not
   represented as hermetic across different profiles.
-- One structured seat inventory is authoritative for both compact eval seats
+- One structured model-agent inventory is authoritative for both compact eval agents
   and canonical paid templates. Corpus cost classification, event-first
   policy, and harness-overlay checks consume its source-kind/path records;
   canonical template mutations prove required launch axes and overlays are
diff --git a/evidence/exclusions.tsv b/evidence/exclusions.tsv
index f513ae35..05614619 100644
--- a/evidence/exclusions.tsv
+++ b/evidence/exclusions.tsv
@@ -2,4 +2,4 @@ cell	reason
 clean-compose	retired composition-overlay discriminator
 compose-config-load	retired composition/config-loader discriminator
 compose-global-skill	retired composition/global-skill discriminator
-team-standup	retired runtime seat-generation discriminator
+team-standup	retired runtime agent-generation discriminator
diff --git a/evidence/harness-exclusions.tsv b/evidence/harness-exclusions.tsv
index f785a70e..acbf8d0e 100644
--- a/evidence/harness-exclusions.tsv
+++ b/evidence/harness-exclusions.tsv
@@ -1,18 +1,18 @@
 cell	surface	reason
-agent-new-bundle-contract	cell	deterministic semantic-intent lowering and mutation probe; no harness seat
-canonical-agent-runtime-smoke	cell	deterministic canonical Agent Spec boot, kickoff, reply, and teardown probe; no harness seat
-context-resource-continuity	cell	deterministic native context/resource restart probe; no harness seat
+agent-new-bundle-contract	cell	deterministic semantic-intent lowering and mutation probe; no harness agent
+canonical-agent-runtime-smoke	cell	deterministic canonical Agent Spec boot, kickoff, reply, and teardown probe; no harness agent
+context-resource-continuity	cell	deterministic native context/resource restart probe; no harness agent
 docs	judge:cold-reader	one-shot offline Claude print grader; no bus identity, DING, or hook surface
-exec-lifecycle-logging	cell	deterministic native exec lifecycle probe; no harness seat
-hook-integrity	cell	deterministic native hook-installation probe; no live harness seat
-host-lock-health-negatives	cell	deterministic native doctor negative probe; no harness seat
-pty-attach-only	cell	deterministic PTY dead-attach policy probe; no harness seat
-pty-send-peek	cell	deterministic PTY transport probe; no harness seat
-presence-ding-matrix	cell	deterministic native presence and DING probe; no harness seat
-reconcile-retire-keep	cell	deterministic native reconcile lifecycle probe; no harness seat
-render-target-safety	cell	deterministic native render-policy probe; no harness seat
-strict-validation-json	cell	deterministic native validation-diagnostics probe; no harness seat
-st2-doctor-structure	cell	deterministic catalog-health probe; no harness seat
-st2-network	cell	deterministic catalog/message round-trip probe; no harness seat
+exec-lifecycle-logging	cell	deterministic native exec lifecycle probe; no harness agent
+hook-integrity	cell	deterministic native hook-installation probe; no live harness agent
+host-lock-health-negatives	cell	deterministic native doctor negative probe; no harness agent
+pty-attach-only	cell	deterministic PTY dead-attach policy probe; no harness agent
+pty-send-peek	cell	deterministic PTY transport probe; no harness agent
+presence-ding-matrix	cell	deterministic native presence and DING probe; no harness agent
+reconcile-retire-keep	cell	deterministic native reconcile lifecycle probe; no harness agent
+render-target-safety	cell	deterministic native render-policy probe; no harness agent
+strict-validation-json	cell	deterministic native validation-diagnostics probe; no harness agent
+st2-doctor-structure	cell	deterministic catalog-health probe; no harness agent
+st2-network	cell	deterministic catalog/message round-trip probe; no harness agent
 targeted-reconcile-isolation	cell	deterministic selected reconcile isolation probe; no bus-connected agent
-two-networks-coexist	cell	deterministic catalog-isolation probe; no harness seat
+two-networks-coexist	cell	deterministic catalog-isolation probe; no harness agent

From c40cb7643688a249f615c660fb134ddf19af0962 Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:20:23 +0200
Subject: [PATCH 10/12] evals: pin canonical st2 package provenance

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 AGENT-SPEC.md                                 | 79 +++++++++++++------
 README.md                                     | 16 ++--
 bin/check-canonical-agent-runtime-smoke.sh    | 13 +--
 bin/check-corpus.sh                           | 15 +---
 bin/check-preflight-safety.sh                 |  5 +-
 bin/check-st2-package-provenance-mutations.sh | 34 ++++++++
 bin/check-st2-package-provenance.sh           | 75 ++++++++++++++++++
 bin/check-st2-pin-consistency.sh              | 14 +++-
 bin/st2-pin.sh                                | 11 ++-
 docs/vrs/spec.md                              | 11 +++
 evidence/st2-package-provenance-20260730.md   | 27 +++++++
 11 files changed, 242 insertions(+), 58 deletions(-)
 create mode 100755 bin/check-st2-package-provenance-mutations.sh
 create mode 100755 bin/check-st2-package-provenance.sh
 create mode 100644 evidence/st2-package-provenance-20260730.md

diff --git a/AGENT-SPEC.md b/AGENT-SPEC.md
index 803c6e97..de1f966e 100644
--- a/AGENT-SPEC.md
+++ b/AGENT-SPEC.md
@@ -45,6 +45,7 @@ agent "<identity>" {
   supervisor "<host>.<supervisor-identity>"
   retired #false
   keep #false
+  lifecycle "service"
 
   restart {
     attempts 3
@@ -57,7 +58,7 @@ agent "<identity>" {
     ST_AGENT "<host>.<identity>"
   }
 
-  command #"<interactive harness command>"#
+  argv "<interactive-harness>" "<argument>"
   ding
 
   render {
@@ -82,9 +83,11 @@ Supported agent children are:
 | `supervisor "…"` | Optional bare identity or full bus id for crash-loop routing. |
 | `retired #true` | Decommission the declaration on the next reconciliation. Edit this flag; do not delete a live declaration to retire it. |
 | `keep #true` | Freeze dead evidence and suppress collection/restart for every task; retirement still stops live tasks. |
+| `lifecycle "service"|"adopt-only"` | Reconciliation policy for the compact task. Explicit tasks declare their own policy. |
 | `restart { … }` | Optional service restart policy. |
 | `env { KEY "value" }` | Environment inherited by the compact agent task and sidecars. |
-| `command "…"` | Compact interactive task named `agent`. |
+| `argv "program" "arg"…` | Preferred compact interactive task named `agent`; direct program invocation with preserved argument boundaries. |
+| `command "…"` | Compact interactive shell task named `agent`; use only when shell syntax is intentional. |
 | `ding` | Compact native DING sidecar named `ding`. |
 | `pty "name" { … }` | Explicit interactive task. |
 | `exec "name" { … }` | Explicit non-interactive task. |
@@ -102,20 +105,22 @@ rely on that permissiveness.
 
 ## Compact and explicit tasks
 
-The canonical compact pair:
+The canonical compact pair uses direct argv:
 
 ```kdl
-command #"<harness command>"#
+argv "<harness>" "<argument>"
 ding
 ```
 
 lowers to an interactive `pty "agent"` and a non-interactive `exec "ding"` sidecar. Do not declare
-both `command` and `pty "agent"`, or both `ding` and `exec "ding"`.
+both compact `argv` and compact `command`; do not combine either compact launch with `pty "agent"`;
+and do not declare both `ding` and `exec "ding"`.
 
 The compact task has id equal to the agent bus id, tag `role=agent`, and inherited agent environment. The
 derived DING task has id `<bus-id>.ding` and inherited environment. A service is runnable only when at least
-one authored task has a command; the derived sidecar alone is insufficient, including on a retired
-declaration. Task names are sorted lexically after lowering.
+one authored task has exactly one `argv` or `command`; `argv` must have a non-empty program element. The
+derived sidecar alone is insufficient, including on a retired declaration. Task names are sorted lexically
+after lowering.
 
 Use explicit tasks only when the agent needs an additional managed process or task-specific
 configuration:
@@ -123,9 +128,10 @@ configuration:
 ```kdl
 pty "agent" {
   id "<host>.<identity>"
-  command #"<interactive harness command>"#
+  argv "<interactive-harness>" "<argument>"
   cwd "/absolute/workspace/or/$CATALOG/path"
   keep #false
+  lifecycle "service"
   tags role="agent" purpose="subject"
   env {
     ST_AGENT "<host>.<identity>"
@@ -137,6 +143,7 @@ exec "helper" {
   command #"exec ./long-running-helper"#
   cwd "/absolute/workspace/or/$CATALOG/path"
   keep #false
+  lifecycle "adopt-only"
   tags purpose="fixture"
   env {
     EXAMPLE "value"
@@ -144,11 +151,17 @@ exec "helper" {
 }
 ```
 
-Each explicit task supports only `id`, `command`, `cwd`, `keep`, `tags`, and `env`. A nameless task is a
-validation error. Agent-level environment is parsed before tasks and inherited independent of declaration
-order; task-level values override it. A missing `cwd` falls back to agent workspace, then the spec directory.
-Commands run through `sh -c`. Interactive harnesses belong in `pty`; terminal-free daemons and helpers belong
-in `exec`.
+Each explicit task supports only `id`, `argv`, `command`, `cwd`, `keep`, `lifecycle`, `tags`, and `env`.
+A nameless task, empty `argv`, or task carrying both `argv` and `command` is a validation error. Agent-level
+environment is parsed before tasks and inherited independent of declaration order; task-level values override
+it. A missing `cwd` falls back to agent workspace, then the spec directory.
+
+`argv` resolves a bare element zero through the task environment's `PATH`, expands st2 environment references
+in each element, preserves argument boundaries, and launches the program directly without a shell. `command`
+is opaque shell source run verbatim under `sh -c`; use it only for intentional shell behavior such as pipes,
+redirections, compound commands, or shell expansion. Writing `exec` inside `command` can remove the inner
+shell after it interprets that source, but it does not turn the declaration into direct argv. Interactive
+harnesses belong in `pty`; terminal-free daemons and helpers belong in `exec`.
 
 Interactive tasks run detached through the PTY runtime with stable lifecycle ids. Exec tasks allocate no
 terminal, run in their own detached process group, append diagnostics below `<catalog>/logs/`, and retain one
@@ -159,7 +172,8 @@ what stops them.
 ## Environment and expansion
 
 Expansion recognizes `$VAR`, `${VAR}`, and `$$` for a literal dollar. Unset variables remain literal. Task
-environment values, tags, and cwd expand before spawn; the command remains opaque for its `sh -c`.
+environment values, tags, cwd, and each direct argv element expand before spawn; command remains opaque for
+its `sh -c`.
 
 st2 defaults `CATALOG` and `ST_ROOT` to the catalog. Effective `PTY_ROOT` is a non-empty ambient value or
 `<catalog>/pty`; authored task environment cannot override it. st2 supplies `ST_HOOKS` only when an installed
@@ -225,13 +239,21 @@ misclassified as an empty registry.
 Reconciliation is per task:
 
 - active and alive: adopt;
-- missing: launch only that task;
-- dead non-keep: preserve bounded diagnostics, collect, and restart according to policy;
+- missing service task: launch only that task;
+- dead non-keep service task: preserve bounded diagnostics, collect, and restart according to policy;
 - dead keep: freeze evidence without collection or restart;
+- missing or dead `adopt-only` task: report `held` without collection, replacement, or launch;
 - retired and live: stop even when keep is set;
 - retired and dead non-keep: final collection;
 - unrendered or unrunnable: do not launch.
 
+`lifecycle "adopt-only"` is a migration fence, not a restart policy. st2 may adopt an already-live generation
+but may not create a missing generation or reap and replace a dead one. Declare it at agent level for the
+compact task or inside each applicable explicit task. Explicit tasks that omit it independently default to
+`service`; they do not inherit the compact-task policy. Deliberately restore `service` (or remove the field)
+to authorize normal launch/replacement. `retired #true` is the separate teardown authority and takes
+precedence.
+
 `role` has no branch in lifecycle behavior. `supervisor` is used for `ST_SUPERVISOR` and best-effort crash-loop
 routing. New exact Codex launches require verified installed hooks and workspace pretrust; already live/adopted
 Codex tasks are not stopped by that launch gate.
@@ -267,7 +289,7 @@ agent "<identity>" {
     ST_AGENT "<host>.<identity>"
   }
 
-  command #"exec claude --model claude-sonnet-5 --effort medium --permission-mode bypassPermissions '<boot prompt>'"#
+  argv "claude" "--model" "claude-sonnet-5" "--effort" "medium" "--permission-mode" "bypassPermissions" "<boot prompt>"
   ding
 
   render {
@@ -334,7 +356,7 @@ agent "<identity>" {
     ST_AGENT "<host>.<identity>"
   }
 
-  command #"exec codex --model gpt-5.6-sol -c 'model_reasoning_effort="medium"' --dangerously-bypass-approvals-and-sandbox --dangerously-bypass-hook-trust '<boot prompt>'"#
+  argv "codex" "--model" "gpt-5.6-sol" "-c" "model_reasoning_effort=\"medium\"" "--dangerously-bypass-approvals-and-sandbox" "--dangerously-bypass-hook-trust" "<boot prompt>"
   ding
 
   render {
@@ -409,7 +431,7 @@ native DING wakeups. Structured exceptions are in `evidence/harness-exclusions.t
 At `agents/example/worker/agent.kdl`, path-derived identity and host make this the smallest valid service:
 
 ```kdl
-agent { command "true" }
+agent { argv "true" }
 ```
 
 At the pinned source it validates as one agent with zero errors and warnings. Production declarations should
@@ -432,8 +454,17 @@ Inspect the declaration, every referenced template, and every workspace destinat
 materialization command. Materialization is byte-idempotent and does not imply hook installation. Starting
 the network is a separate, explicitly authorized action.
 
-For source `c6846f6239329f0803142afc06c15a07b93937c1`, the accepted local-source Linux executable has
-SHA256 `2bba8d58be24250bc262f75f835ce2d780369add275774f3f2135c623d23d29c`.
-`bin/check-st2-pin-consistency.sh` keeps this active spec, the README, and executable preflight aligned.
-`bin/check-corpus.sh` verifies the variable-age version contract, exact installed binary, strict semantic
-validation, fixture resets, and the rest of the model-free corpus gate before an eval may run.
+For source `c6846f6239329f0803142afc06c15a07b93937c1`, the accepted artifact is the immutable Nix package:
+
+- source `flake.lock` byte SHA256
+  `aa547f85b21a8a8787adaa9f2a3ad37d55246d355248388e2ec38bd85a830141`;
+- derivation `/nix/store/nrhfzsarya6ny7wdmy64i9vwgax965a8-st2-0.1.0.drv`;
+- output `/nix/store/z4wj1y20wq00n02gpknnz45fdi2kyc7h-st2-0.1.0`, NAR
+  `sha256-w3OSHKt96U0aWMzW2FHom6Ii1NvikdXqmJ6wJ1xGJNA=` (5,147,208 bytes);
+- version prefix `st2 0.1.0+c6846f6` and packaged executable SHA256
+  `25276f30a9cfb287e1a9f72318fada2936402343e958160d46a0a7270ab2db2b`.
+
+`bin/check-st2-package-provenance.sh` verifies the whole chain and selects that exact binary rather than an
+ambient `st2`. Its mutation gate rejects a same-version substitute. `bin/check-st2-pin-consistency.sh` keeps
+this active spec, the README, and executable preflight aligned. `bin/check-corpus.sh` runs semantic validation
+and every model-free gate with the pinned package before an eval may run.
diff --git a/README.md b/README.md
index f8512ebf..2d6fe53b 100644
--- a/README.md
+++ b/README.md
@@ -95,12 +95,16 @@ SCORE: N PASS / 0 FAIL / K gating judges
 VERDICT: PASS
 ```
 
-Requirements are `st2 0.1.0` from source
-[`c6846f6`](https://github.com/compoundingtech/st2/commit/c6846f6239329f0803142afc06c15a07b93937c1),
-using the accepted local-source Linux binary SHA256
-`2bba8d58be24250bc262f75f835ce2d780369add275774f3f2135c623d23d29c`;
-`pty`, Bash, Git, `jq`, Rust/Cargo for the pinned KDL parser gate, and Node for JavaScript fixtures. A paid cell
-also needs every harness named by its dry-run row.
+Requirements are the immutable `st2 0.1.0+c6846f6` Nix package for source
+[`c6846f6239329f0803142afc06c15a07b93937c1`](https://github.com/compoundingtech/st2/commit/c6846f6239329f0803142afc06c15a07b93937c1):
+source `flake.lock` byte SHA256
+`aa547f85b21a8a8787adaa9f2a3ad37d55246d355248388e2ec38bd85a830141`, output
+`/nix/store/z4wj1y20wq00n02gpknnz45fdi2kyc7h-st2-0.1.0`, NAR
+`sha256-w3OSHKt96U0aWMzW2FHom6Ii1NvikdXqmJ6wJ1xGJNA=`, and executable SHA256
+`25276f30a9cfb287e1a9f72318fada2936402343e958160d46a0a7270ab2db2b`.
+The preflight ignores ambient `st2` selection and verifies this full provenance chain before using the
+packaged binary. It also requires Nix, `pty`, Bash, Git, `jq`, Rust/Cargo for the pinned KDL parser gate, and
+Node for JavaScript fixtures. A paid cell also needs every harness named by its dry-run row.
 
 ## Cell layout
 
diff --git a/bin/check-canonical-agent-runtime-smoke.sh b/bin/check-canonical-agent-runtime-smoke.sh
index 74725011..2807fbc9 100755
--- a/bin/check-canonical-agent-runtime-smoke.sh
+++ b/bin/check-canonical-agent-runtime-smoke.sh
@@ -5,17 +5,8 @@ repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 source bin/st2-pin.sh
 
-st2_bin="$(command -v st2)"
-version="$(st2 --version)"
-sha256="$(sha256sum "$st2_bin" | awk '{ print $1 }')"
-[[ "$version" =~ $ST2_VERSION_REGEX ]] || {
-  echo "FAIL: expected st2 source $ST2_SOURCE_SHORT, found $version" >&2
-  exit 1
-}
-[ "$sha256" = "$ST2_BINARY_SHA256" ] || {
-  echo "FAIL: expected st2 binary $ST2_BINARY_SHA256, found $sha256 at $st2_bin" >&2
-  exit 1
-}
+bin/check-st2-package-provenance.sh
+export PATH="$ST2_OUTPUT_PATH/bin:$PATH"
 
 bin/corpus-inventory.sh --no-header |
   awk -F '\t' '$1 == "canonical-agent-runtime-smoke" && $2 == "model-free" && $5 == 0 { found = 1 } END { exit !found }' || {
diff --git a/bin/check-corpus.sh b/bin/check-corpus.sh
index 7e8063be..fdb15f64 100755
--- a/bin/check-corpus.sh
+++ b/bin/check-corpus.sh
@@ -7,18 +7,9 @@ cd "$repo_root"
 
 source bin/st2-pin.sh
 bin/check-st2-pin-consistency.sh
-st2_path="$(command -v st2)"
-actual_version="$(st2 --version)"
-[[ "$actual_version" =~ $ST2_VERSION_REGEX ]] || {
-  echo "FAIL: expected st2 0.1.0 from pinned source $ST2_SOURCE_SHORT, found $actual_version" >&2
-  exit 1
-}
-actual_binary_sha256="$(sha256sum "$st2_path" | awk '{ print $1 }')"
-[ "$actual_binary_sha256" = "$ST2_BINARY_SHA256" ] || {
-  echo "FAIL: expected st2 binary sha256 $ST2_BINARY_SHA256, found $actual_binary_sha256 at $st2_path" >&2
-  exit 1
-}
-echo "PASS: pinned runner source $ST2_SOURCE_FULL ($actual_version; sha256 $actual_binary_sha256)"
+bin/check-st2-package-provenance.sh
+bin/check-st2-package-provenance-mutations.sh
+export PATH="$ST2_OUTPUT_PATH/bin:$PATH"
 
 mapfile -d '' shell_files < <(
   find bin cells -type f -name '*.sh' -not -path '*/_git/*' -print0 | sort -z
diff --git a/bin/check-preflight-safety.sh b/bin/check-preflight-safety.sh
index bd8e21ce..fe90cced 100755
--- a/bin/check-preflight-safety.sh
+++ b/bin/check-preflight-safety.sh
@@ -26,6 +26,8 @@ reachable=(
   bin/check-preflight-safety.sh
   bin/check-run-history.sh
   bin/check-retired-surfaces.sh
+  bin/check-st2-package-provenance-mutations.sh
+  bin/check-st2-package-provenance.sh
   bin/check-st2-pin-consistency.sh
   bin/check-st2-semantic.sh
   bin/check-vrs-scope-drift.sh
@@ -84,6 +86,8 @@ expected_direct=(
   bin/check-preflight-safety.sh
   bin/check-retired-surfaces.sh
   bin/check-run-history.sh
+  bin/check-st2-package-provenance-mutations.sh
+  bin/check-st2-package-provenance.sh
   bin/check-st2-pin-consistency.sh
   bin/check-st2-semantic.sh
   bin/check-vrs-scope-drift.sh
@@ -102,7 +106,6 @@ for file in "${reachable[@]}"; do
   while IFS= read -r hit; do
     line="${hit#*:}"
     case "$line" in
-      *'st2 --version'*) ;;
       *'st2 ls '*) ;;
       *'st2 validate '*) ;;
       *'st2 up '*'--materialize-only'*) ;;
diff --git a/bin/check-st2-package-provenance-mutations.sh b/bin/check-st2-package-provenance-mutations.sh
new file mode 100755
index 00000000..0c53549f
--- /dev/null
+++ b/bin/check-st2-package-provenance-mutations.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+source bin/st2-pin.sh
+
+scratch="$(mktemp -d)"
+cleanup() {
+  rm -rf -- "$scratch"
+}
+trap cleanup EXIT
+
+bin/check-st2-package-provenance.sh >/dev/null
+
+mkdir -p "$scratch/other-st2-checkout/bin"
+substitute="$scratch/other-st2-checkout/bin/st2"
+cat >"$substitute" <<SCRIPT
+#!/usr/bin/env bash
+printf '%s\\n' '$ST2_VERSION_PREFIX — committed 1 hour ago'
+SCRIPT
+chmod +x "$substitute"
+
+if bin/check-st2-package-provenance.sh --binary "$substitute" >"$scratch/substitute.log" 2>&1; then
+  echo "FAIL: a same-version binary from another st2 checkout satisfied packaged provenance" >&2
+  exit 1
+fi
+grep -Fq "candidate st2 is not the pinned packaged binary" "$scratch/substitute.log" || {
+  cat "$scratch/substitute.log" >&2
+  echo "FAIL: same-version st2 substitution failed for an unrelated reason" >&2
+  exit 1
+}
+
+echo "PASS: exact packaged st2 is accepted and a same-version other-checkout binary is rejected"
diff --git a/bin/check-st2-package-provenance.sh b/bin/check-st2-package-provenance.sh
new file mode 100755
index 00000000..b4e1bb6a
--- /dev/null
+++ b/bin/check-st2-package-provenance.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+source bin/st2-pin.sh
+
+candidate="$ST2_BINARY_PATH"
+if [ "${1:-}" = "--binary" ] && [ "$#" -eq 2 ]; then
+  candidate="$2"
+elif [ "$#" -ne 0 ]; then
+  echo "usage: bin/check-st2-package-provenance.sh [--binary PATH]" >&2
+  exit 2
+fi
+
+fail() {
+  printf 'FAIL: %s\n' "$*" >&2
+  exit 1
+}
+
+[[ "$ST2_SOURCE_FULL" =~ ^[0-9a-f]{40}$ ]] ||
+  fail "st2 source identity is not a full Git object id: $ST2_SOURCE_FULL"
+[[ "$ST2_SOURCE_SHORT" = "${ST2_SOURCE_FULL:0:${#ST2_SOURCE_SHORT}}" ]] ||
+  fail "st2 short source identity is not a prefix of the full object id"
+
+[ -f "$ST2_SOURCE_PATH/flake.lock" ] ||
+  fail "pinned st2 source flake.lock is absent: $ST2_SOURCE_PATH/flake.lock"
+actual_lock_sha256="$(sha256sum "$ST2_SOURCE_PATH/flake.lock" | awk '{ print $1 }')"
+[ "$actual_lock_sha256" = "$ST2_FLAKE_LOCK_SHA256" ] ||
+  fail "st2 flake.lock sha256 is $actual_lock_sha256, expected $ST2_FLAKE_LOCK_SHA256"
+
+[ -e "$ST2_DERIVATION" ] || fail "pinned st2 derivation is absent: $ST2_DERIVATION"
+[ -x "$ST2_BINARY_PATH" ] || fail "pinned packaged st2 binary is absent: $ST2_BINARY_PATH"
+
+derivation_json="$(nix derivation show "$ST2_DERIVATION")"
+jq -e \
+  --arg drv "$(basename "$ST2_DERIVATION")" \
+  --arg src "$ST2_SOURCE_PATH" \
+  --arg out "$ST2_OUTPUT_PATH" \
+  --arg rev "$ST2_SOURCE_SHORT" \
+  '
+    .derivations[$drv].env as $env |
+    $env.src == $src and
+    $env.out == $out and
+    ($env.CLI_BUILD_STAMP | fromjson |
+      .version == "0.1.0" and .type == "nix" and .dirty == false and .rev == $rev)
+  ' <<<"$derivation_json" >/dev/null ||
+  fail "pinned derivation does not bind the exact source, output, and clean build stamp"
+
+path_info="$(nix path-info --json --json-format 1 "$ST2_OUTPUT_PATH")"
+jq -e \
+  --arg out "$ST2_OUTPUT_PATH" \
+  --arg drv "$ST2_DERIVATION" \
+  --arg nar "$ST2_OUTPUT_NAR_HASH" \
+  --argjson size "$ST2_OUTPUT_NAR_SIZE" \
+  '.[$out].deriver == $drv and .[$out].narHash == $nar and .[$out].narSize == $size' \
+  <<<"$path_info" >/dev/null ||
+  fail "pinned output does not have the exact derivation, NAR hash, and NAR size"
+
+candidate_real="$(readlink -f "$candidate" 2>/dev/null || true)"
+[ "$candidate_real" = "$ST2_BINARY_PATH" ] ||
+  fail "candidate st2 is not the pinned packaged binary: ${candidate_real:-$candidate}"
+
+actual_version="$("$candidate_real" --version)"
+case "$actual_version" in
+  "$ST2_VERSION_PREFIX"*) ;;
+  *) fail "packaged st2 version is '$actual_version', expected prefix '$ST2_VERSION_PREFIX'" ;;
+esac
+
+actual_binary_sha256="$(sha256sum "$candidate_real" | awk '{ print $1 }')"
+[ "$actual_binary_sha256" = "$ST2_BINARY_SHA256" ] ||
+  fail "packaged st2 binary sha256 is $actual_binary_sha256, expected $ST2_BINARY_SHA256"
+
+printf 'PASS: packaged st2 provenance %s -> %s (%s; %s)\n' \
+  "$ST2_SOURCE_FULL" "$ST2_OUTPUT_PATH" "$ST2_OUTPUT_NAR_HASH" "$actual_binary_sha256"
diff --git a/bin/check-st2-pin-consistency.sh b/bin/check-st2-pin-consistency.sh
index e4258acf..7d8f1db7 100755
--- a/bin/check-st2-pin-consistency.sh
+++ b/bin/check-st2-pin-consistency.sh
@@ -7,15 +7,25 @@ source bin/st2-pin.sh
 
 grep -Fq "$ST2_SOURCE_FULL" AGENT-SPEC.md
 grep -Fq "$ST2_SOURCE_FULL" README.md
+grep -Fq "$ST2_FLAKE_LOCK_SHA256" AGENT-SPEC.md
+grep -Fq "$ST2_DERIVATION" AGENT-SPEC.md
+grep -Fq "$ST2_OUTPUT_PATH" AGENT-SPEC.md
+grep -Fq "$ST2_OUTPUT_NAR_HASH" AGENT-SPEC.md
+grep -Fq "$ST2_VERSION_PREFIX" AGENT-SPEC.md
 grep -Fq "$ST2_BINARY_SHA256" AGENT-SPEC.md
+grep -Fq "$ST2_FLAKE_LOCK_SHA256" README.md
+grep -Fq "$ST2_OUTPUT_PATH" README.md
+grep -Fq "$ST2_OUTPUT_NAR_HASH" README.md
 grep -Fq "$ST2_BINARY_SHA256" README.md
 grep -Fq 'source bin/st2-pin.sh' bin/check-corpus.sh
+grep -Fq 'bin/check-st2-package-provenance.sh' bin/check-corpus.sh
+grep -Fq 'bin/check-st2-package-provenance-mutations.sh' bin/check-corpus.sh
 
 if rg -n \
-  '9887b28|d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d|0ec6a22|df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db' \
+  '9887b28|d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d|0ec6a22|df0783843e5bb5b2bfd58323467b5ae0d89aebec4e12e5666139915e235ad2db|2bba8d58be24250bc262f75f835ce2d780369add275774f3f2135c623d23d29c' \
   AGENT-SPEC.md README.md bin/check-corpus.sh bin/st2-pin.sh; then
   echo "FAIL: active st2 pin surfaces retain the superseded source or binary hash" >&2
   exit 1
 fi
 
-echo "PASS: active spec, README, and executable preflight share st2 $ST2_SOURCE_FULL / $ST2_BINARY_SHA256"
+echo "PASS: active spec, README, and executable preflight share exact packaged st2 $ST2_SOURCE_FULL / $ST2_OUTPUT_NAR_HASH"
diff --git a/bin/st2-pin.sh b/bin/st2-pin.sh
index f784ad21..86f06567 100755
--- a/bin/st2-pin.sh
+++ b/bin/st2-pin.sh
@@ -2,5 +2,12 @@
 
 ST2_SOURCE_SHORT="c6846f6"
 ST2_SOURCE_FULL="c6846f6239329f0803142afc06c15a07b93937c1"
-ST2_BINARY_SHA256="2bba8d58be24250bc262f75f835ce2d780369add275774f3f2135c623d23d29c"
-ST2_VERSION_REGEX='^st2 0\.1\.0 — running from local source \(c6846f6, .+ ago\)$'
+ST2_SOURCE_PATH="/nix/store/darhbxcfbawbpazd24bc2x1hhlg13g42-source"
+ST2_FLAKE_LOCK_SHA256="aa547f85b21a8a8787adaa9f2a3ad37d55246d355248388e2ec38bd85a830141"
+ST2_DERIVATION="/nix/store/nrhfzsarya6ny7wdmy64i9vwgax965a8-st2-0.1.0.drv"
+ST2_OUTPUT_PATH="/nix/store/z4wj1y20wq00n02gpknnz45fdi2kyc7h-st2-0.1.0"
+ST2_OUTPUT_NAR_HASH="sha256-w3OSHKt96U0aWMzW2FHom6Ii1NvikdXqmJ6wJ1xGJNA="
+ST2_OUTPUT_NAR_SIZE="5147208"
+ST2_BINARY_PATH="$ST2_OUTPUT_PATH/bin/st2"
+ST2_BINARY_SHA256="25276f30a9cfb287e1a9f72318fada2936402343e958160d46a0a7270ab2db2b"
+ST2_VERSION_PREFIX="st2 0.1.0+c6846f6"
diff --git a/docs/vrs/spec.md b/docs/vrs/spec.md
index 488c884a..1168e83c 100644
--- a/docs/vrs/spec.md
+++ b/docs/vrs/spec.md
@@ -145,6 +145,17 @@ one-sentence human request
 - Passing model-free evidence proves the bundle boundary and its negative
   controls only. The autonomous-selection claim remains unaccepted until the
   paid judgment cell has a structured PASS receipt.
+- **Future R04 lifecycle cell:** the eventual model-free recovery discriminator
+  must operate on a real canonical temporary interviewer declaration and its
+  durable transaction records. Its crash mutation removes only the temporary
+  agent's main PTY generation. The DING sidecar may be live, stale, or already
+  absent at that observation boundary, so its state is explicitly
+  indeterminate and cannot be a gating proxy for interviewer liveness. The
+  durable retired tombstone remains the authority that prevents resurrection;
+  recovery must adopt or complete the exact transaction without a second final
+  agent or inbox publication. This cell is deferred to a pinned st2 successor
+  that exposes the required lifecycle boundary. A fake shell stand-in would
+  not prove the contract and is not part of this PR.
 
 The owner updates this spec with the corpus. Changing
 [vision.md](./vision.md) or [requirements.md](./requirements.md) requires
diff --git a/evidence/st2-package-provenance-20260730.md b/evidence/st2-package-provenance-20260730.md
new file mode 100644
index 00000000..a6e52a09
--- /dev/null
+++ b/evidence/st2-package-provenance-20260730.md
@@ -0,0 +1,27 @@
+# st2 package-provenance observation — 2026-07-30
+
+The corpus pins source commit
+`c6846f6239329f0803142afc06c15a07b93937c1`, but a source commit and reported
+version do not identify a debug executable. Two clean debug builds from two
+different st2 checkouts at that commit reported the same
+`st2 0.1.0 — running from local source (c6846f6, ...)` version and produced
+different bytes:
+
+| Checkout binary | SHA256 |
+|---|---|
+| `/tmp/st2-pr56-pin-c6846f6/target/debug/st2` | `43eedd7aba6fa886163dac0ff2130f901b940507aa9c787b913300aadebdee56` |
+| `/tmp/st2-pr56-pin-c6846f6-second/target/debug/st2` | `dc9661839d0f6e168c95fb92ac50832d4c9a0745cbd979b7ba0d72993fce9a59` |
+
+Each executable contained its distinct checkout path in its string table. These
+temporary paths and hashes are empirical evidence only, not corpus inputs.
+They demonstrate why a checkout-built executable hash is not a portable runner
+identity.
+
+The accepted runner is instead the immutable Nix output
+`/nix/store/z4wj1y20wq00n02gpknnz45fdi2kyc7h-st2-0.1.0`, tied to the exact
+source-store `flake.lock`, derivation, NAR hash and size, packaged version
+prefix, and executable hash recorded in `bin/st2-pin.sh`.
+`bin/check-st2-package-provenance-mutations.sh` keeps the distinction
+non-vacuous without rebuilding either debug checkout: the exact packaged
+binary passes, while a different executable reporting the same packaged
+version is rejected.

From bb9b0ce30a027ce31e66fd623bd004e24638cfad Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Fri, 31 Jul 2026 00:53:41 +0200
Subject: [PATCH 11/12] evals: gate zero-flag agent creation

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 CATALOG.md                                    | 17 ++--
 bin/check-agent-new-behavior-cases.sh         | 54 ++++++++++++
 bin/check-agent-new-renderer-security.sh      | 10 ++-
 bin/check-canonical-agent-template.sh         | 10 +--
 bin/check-corpus.sh                           |  1 +
 bin/check-fixture-reset-terminal.sh           | 20 ++++-
 bin/check-harness-contract.sh                 |  9 +-
 bin/check-no-pii-history.sh                   |  3 +
 bin/check-preflight-safety.sh                 |  2 +
 bin/check-vrs-scope-drift.sh                  |  3 +
 bin/check-vrs-variations.sh                   |  3 +
 bin/check-weird-git-setup.sh                  |  3 +
 bin/model-agent-inventory.sh                  | 17 ++++
 cells/agent-new-bundle-contract/README.md     | 10 ++-
 .../agent-new-bundle-contract.kdl             | 21 +++--
 .../fixture/inputs/constraint-mismatch.json   | 18 ++++
 .../fixture/inputs/forbidden-account.json     |  4 +-
 .../inputs/implementation-constraints.json    |  7 ++
 .../fixture/inputs/implementation.json        |  4 +-
 .../fixture/inputs/invalid-supervisor.json    | 16 ++++
 .../fixture/inputs/review.json                |  5 +-
 .../fixture/inputs/trajectory-drift.json      |  4 +-
 .../fixture/inputs/workspace-injection.json   |  3 +-
 .../fixture/render-intent.sh                  | 41 +++++++--
 .../agent-new-bundle-contract/judges/grade.sh |  7 ++
 .../agent-new-confirmation-contract/README.md | 10 +++
 .../agent-new-confirmation-contract.kdl       | 36 ++++++++
 .../fixture/apply-confirmation.sh             | 61 +++++++++++++
 .../fixture/intent.json                       | 18 ++++
 .../judges/grade.sh                           | 41 +++++++++
 .../judges/mutation-check.sh                  | 35 ++++++++
 cells/agent-new-creation-lifecycle/README.md  | 20 +++++
 .../agent-new-creation-lifecycle.kdl          | 45 ++++++++++
 .../fixture/inspect-case.sh                   | 38 ++++++++
 .../fixture/run-case.sh                       | 27 ++++++
 .../judges/grade.sh                           | 31 +++++++
 .../judges/mutation-check.sh                  | 38 ++++++++
 .../README.md                                 |  5 ++
 .../agent-new-interview-hard-constraint.kdl   | 31 +++++++
 .../README.md                                 |  4 +
 .../agent-new-interview-investigation.kdl     | 31 +++++++
 cells/agent-new-interview-small-fix/README.md |  4 +
 .../agent-new-interview-small-fix.kdl         | 31 +++++++
 cells/agent-new-interview/README.md           | 27 +++---
 .../agent-new-interview.kdl                   | 19 ++--
 .../fixture/agent.kdl.template                | 12 +--
 .../cases/hard-constraint/expected.json       | 14 +++
 .../hard-constraint/hard-constraints.json     |  7 ++
 .../fixture/cases/hard-constraint/task.md     |  1 +
 .../cases/implementation/expected.json        | 13 +++
 .../implementation/hard-constraints.json      |  1 +
 .../fixture/cases/implementation/task.md      |  1 +
 .../fixture/cases/investigation/expected.json | 13 +++
 .../cases/investigation/hard-constraints.json |  1 +
 .../fixture/cases/investigation/task.md       |  1 +
 .../fixture/cases/small-fix/expected.json     | 13 +++
 .../cases/small-fix/hard-constraints.json     |  1 +
 .../fixture/cases/small-fix/task.md           |  1 +
 .../fixture/interviewer/CLAUDE.md             |  1 +
 .../fixture/interviewer/PERSONA.md            | 49 +----------
 .../fixture/interviewer/PROTOCOL.md           | 32 +++++++
 .../interviewer/references/issue-106.md       |  6 ++
 .../fixture/interviewer/references/pr-1520.md |  5 ++
 .../fixture/interviewer/render-intent.sh      | 63 ++++++++++---
 .../fixture/interviewer/submit-intent         |  2 +-
 .../fixture/prepare-interviewer-worktree.sh   |  5 ++
 .../fixture/publish-interviewer.sh            | 14 ++-
 .../agent-new-interview/judges/grade-case.sh  | 83 +++++++++++++++++
 cells/agent-new-interview/judges/grade.sh     | 45 +---------
 cells/agent-new-interview/task.md             |  1 -
 .../fixture/materialize.sh                    |  4 +
 cells/signal-rename/fixture/materialize.sh    |  4 +
 .../weird-git-setup/fixture/setup-megarepo.sh |  4 +
 docs/vrs/spec.md                              | 88 +++++++++++--------
 evidence/harness-exclusions.tsv               |  2 +
 75 files changed, 1116 insertions(+), 215 deletions(-)
 create mode 100755 bin/check-agent-new-behavior-cases.sh
 create mode 100644 cells/agent-new-bundle-contract/fixture/inputs/constraint-mismatch.json
 create mode 100644 cells/agent-new-bundle-contract/fixture/inputs/implementation-constraints.json
 create mode 100644 cells/agent-new-bundle-contract/fixture/inputs/invalid-supervisor.json
 create mode 100644 cells/agent-new-confirmation-contract/README.md
 create mode 100644 cells/agent-new-confirmation-contract/agent-new-confirmation-contract.kdl
 create mode 100755 cells/agent-new-confirmation-contract/fixture/apply-confirmation.sh
 create mode 100644 cells/agent-new-confirmation-contract/fixture/intent.json
 create mode 100755 cells/agent-new-confirmation-contract/judges/grade.sh
 create mode 100755 cells/agent-new-confirmation-contract/judges/mutation-check.sh
 create mode 100644 cells/agent-new-creation-lifecycle/README.md
 create mode 100644 cells/agent-new-creation-lifecycle/agent-new-creation-lifecycle.kdl
 create mode 100755 cells/agent-new-creation-lifecycle/fixture/inspect-case.sh
 create mode 100755 cells/agent-new-creation-lifecycle/fixture/run-case.sh
 create mode 100755 cells/agent-new-creation-lifecycle/judges/grade.sh
 create mode 100755 cells/agent-new-creation-lifecycle/judges/mutation-check.sh
 create mode 100644 cells/agent-new-interview-hard-constraint/README.md
 create mode 100644 cells/agent-new-interview-hard-constraint/agent-new-interview-hard-constraint.kdl
 create mode 100644 cells/agent-new-interview-investigation/README.md
 create mode 100644 cells/agent-new-interview-investigation/agent-new-interview-investigation.kdl
 create mode 100644 cells/agent-new-interview-small-fix/README.md
 create mode 100644 cells/agent-new-interview-small-fix/agent-new-interview-small-fix.kdl
 create mode 100644 cells/agent-new-interview/fixture/cases/hard-constraint/expected.json
 create mode 100644 cells/agent-new-interview/fixture/cases/hard-constraint/hard-constraints.json
 create mode 100644 cells/agent-new-interview/fixture/cases/hard-constraint/task.md
 create mode 100644 cells/agent-new-interview/fixture/cases/implementation/expected.json
 create mode 100644 cells/agent-new-interview/fixture/cases/implementation/hard-constraints.json
 create mode 100644 cells/agent-new-interview/fixture/cases/implementation/task.md
 create mode 100644 cells/agent-new-interview/fixture/cases/investigation/expected.json
 create mode 100644 cells/agent-new-interview/fixture/cases/investigation/hard-constraints.json
 create mode 100644 cells/agent-new-interview/fixture/cases/investigation/task.md
 create mode 100644 cells/agent-new-interview/fixture/cases/small-fix/expected.json
 create mode 100644 cells/agent-new-interview/fixture/cases/small-fix/hard-constraints.json
 create mode 100644 cells/agent-new-interview/fixture/cases/small-fix/task.md
 create mode 100644 cells/agent-new-interview/fixture/interviewer/PROTOCOL.md
 create mode 100644 cells/agent-new-interview/fixture/interviewer/references/issue-106.md
 create mode 100644 cells/agent-new-interview/fixture/interviewer/references/pr-1520.md
 create mode 100755 cells/agent-new-interview/judges/grade-case.sh
 delete mode 100644 cells/agent-new-interview/task.md

diff --git a/CATALOG.md b/CATALOG.md
index 0bba34d3..916c74c3 100644
--- a/CATALOG.md
+++ b/CATALOG.md
@@ -1,8 +1,8 @@
 <!-- Generated by bin/generate-catalog.sh from cell KDL and evidence/*.tsv. Do not edit. -->
 # Current eval catalog and evidence
 
-This is the sole current corpus surface: **48 included cells** (16 model-free,
-32 model-backed) and **4 retired exclusions**. Inventory fields are derived from the active
+This is the sole current corpus surface: **53 included cells** (18 model-free,
+35 model-backed) and **4 retired exclusions**. Inventory fields are derived from the active
 KDL and executable judge scripts. Latest accepted PASS evidence remains distinct from the append-only run
 history: a failed last run is visible without being advertised as accepted evidence, and cells with no
 structured run row say so explicitly.
@@ -16,8 +16,13 @@ harness-native loader plus canonical hook file.
 
 | Cell | Harness | Model(s) / effort | Model agents | Cost | Timeout | Held-out judges | Latest accepted PASS | Last recorded run |
 |---|---|---|---:|---|---|---:|---|---|
-| `agent-new-bundle-contract` | model-free | — | 0 | none | `60s` | 5 | — | **NO STRUCTURED RUN** |
-| `agent-new-interview` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 4 | — | **NO STRUCTURED RUN** |
+| `agent-new-bundle-contract` | model-free | — | 0 | none | `60s` | 6 | — | **NO STRUCTURED RUN** |
+| `agent-new-confirmation-contract` | model-free | — | 0 | none | `30s` | 4 | — | **NO STRUCTURED RUN** |
+| `agent-new-creation-lifecycle` | model-free | — | 0 | none | `180s` | 5 | — | **NO STRUCTURED RUN** |
+| `agent-new-interview` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 5 | — | **NO STRUCTURED RUN** |
+| `agent-new-interview-hard-constraint` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 4 | — | **NO STRUCTURED RUN** |
+| `agent-new-interview-investigation` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 4 | — | **NO STRUCTURED RUN** |
+| `agent-new-interview-small-fix` | Claude | `claude-sonnet-5` / medium | 1 | low | `300s` | 4 | — | **NO STRUCTURED RUN** |
 | `canonical-agent-runtime-smoke` | model-free | — | 0 | none | `30s` | 7 | — | **NO STRUCTURED RUN** |
 | `context-resource-continuity` | model-free | — | 0 | none | `90s` | 4 | — | **NO STRUCTURED RUN** |
 | `crash-ding` | mixed | `claude-sonnet-5+gpt-5.6-sol` / medium | 4 | high | `180s` | 5 | — | **NO STRUCTURED RUN** |
@@ -85,6 +90,8 @@ while the last-run column makes a recorded failure distinct from a cell with no
 ## Harness hook exclusions
 
 - `agent-new-bundle-contract` / `cell` — deterministic semantic-intent lowering and mutation probe; no harness agent
+- `agent-new-confirmation-contract` / `cell` — deterministic pre-threshold human-confirmation boundary; no harness agent
+- `agent-new-creation-lifecycle` / `cell` — successor-gated real Axe lifecycle matrix with no provider model
 - `canonical-agent-runtime-smoke` / `cell` — deterministic canonical Agent Spec boot, kickoff, reply, and teardown probe; no harness agent
 - `context-resource-continuity` / `cell` — deterministic native context/resource restart probe; no harness agent
 - `docs` / `judge:cold-reader` — one-shot offline Claude print grader; no bus identity, DING, or hook surface
@@ -102,7 +109,7 @@ while the last-run column makes a recorded failure distinct from a cell with no
 - `targeted-reconcile-isolation` / `cell` — deterministic selected reconcile isolation probe; no bus-connected agent
 - `two-networks-coexist` / `cell` — deterministic catalog-isolation probe; no harness agent
 
-These **17** rows are generated from structured exclusions. A cell-level row is required for
+These **19** rows are generated from structured exclusions. A cell-level row is required for
 every derived model-free cell. The one-shot docs cold reader is a model-backed grader, but not a bus-connected
 agent: it has no st2 identity, DING sidecar, or lifecycle hooks.
 
diff --git a/bin/check-agent-new-behavior-cases.sh b/bin/check-agent-new-behavior-cases.sh
new file mode 100755
index 00000000..54a7f356
--- /dev/null
+++ b/bin/check-agent-new-behavior-cases.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+cases_root="cells/agent-new-interview/fixture/cases"
+cases=(hard-constraint implementation investigation small-fix)
+model_context=(
+  cells/agent-new-interview/fixture/interviewer/CLAUDE.md
+  cells/agent-new-interview/fixture/interviewer/PERSONA.md
+  cells/agent-new-interview/fixture/interviewer/PROTOCOL.md
+)
+
+for case_name in "${cases[@]}"; do
+  case_root="$cases_root/$case_name"
+  task="$case_root/task.md"
+  constraints="$case_root/hard-constraints.json"
+  expected="$case_root/expected.json"
+  test -f "$task" && test -f "$constraints" && test -f "$expected"
+  test "$(awk 'NF { rows += 1 } END { print rows + 0 }' "$task")" -eq 1
+  jq -e '
+    type == "object" and
+    (.identity | test("^[a-z0-9-]+\\.[a-z0-9-]+\\.[a-z0-9-]+\\.[a-z0-9-]+$")) and
+    (.goalTerms | type == "array" and length > 0) and
+    (.references | type == "array") and
+    (.trajectory | keys | sort) == ([
+      "boot", "effort", "harness", "mode", "model", "persona"
+    ] | sort)
+  ' "$expected" >/dev/null
+  jq -e '
+    type == "object" and
+    (keys | all(. == "harness" or . == "model" or . == "effort" or
+      . == "persona" or . == "supervisor"))
+  ' "$constraints" >/dev/null
+  identity="$(jq -r .identity "$expected")"
+  if rg -Fq "$identity" "${model_context[@]}"; then
+    echo "FAIL: held-out identity for $case_name leaked into model-facing context" >&2
+    exit 1
+  fi
+done
+
+test "$(jq '.references | length' "$cases_root/small-fix/expected.json")" -eq 0
+test "$(jq 'length' "$cases_root/hard-constraint/hard-constraints.json")" -ge 5
+
+for cell in \
+  agent-new-interview \
+  agent-new-interview-hard-constraint \
+  agent-new-interview-investigation \
+  agent-new-interview-small-fix; do
+  test -f "cells/$cell/$cell.kdl"
+done
+
+echo "PASS: four one-sentence paid cases keep expected decisions held out and hard constraints explicit"
diff --git a/bin/check-agent-new-renderer-security.sh b/bin/check-agent-new-renderer-security.sh
index 718eace4..c689fa88 100755
--- a/bin/check-agent-new-renderer-security.sh
+++ b/bin/check-agent-new-renderer-security.sh
@@ -10,14 +10,16 @@ cleanup() {
 trap cleanup EXIT
 
 renderers=(
-  "$repo_root/cells/agent-new-bundle-contract/fixture/render-intent.sh"
-  "$repo_root/cells/agent-new-interview/fixture/interviewer/render-intent.sh"
+  "$repo_root/cells/agent-new-bundle-contract/fixture/render-intent.sh|$repo_root/cells/agent-new-bundle-contract/fixture/inputs/implementation-constraints.json"
+  "$repo_root/cells/agent-new-interview/fixture/interviewer/render-intent.sh|$repo_root/cells/agent-new-interview/fixture/cases/implementation/hard-constraints.json"
 )
 
-for renderer in "${renderers[@]}"; do
+for entry in "${renderers[@]}"; do
+  renderer="${entry%%|*}"
+  constraints="${entry#*|}"
   name="$(basename "$(dirname "$renderer")")"
   out="$scratch/$name"
-  if bash "$renderer" "$input" "$out" >/dev/null 2>&1; then
+  if bash "$renderer" "$input" "$out" /workspace/dotfiles "$constraints" >/dev/null 2>&1; then
     echo "FAIL: $renderer accepted a workspace KDL injection" >&2
     exit 1
   fi
diff --git a/bin/check-canonical-agent-template.sh b/bin/check-canonical-agent-template.sh
index cb3d64de..53a14f2a 100755
--- a/bin/check-canonical-agent-template.sh
+++ b/bin/check-canonical-agent-template.sh
@@ -14,10 +14,10 @@ require_once() {
 }
 
 require_once '    AGENT_LAUNCH_HOSTED "1"' "hosted launch marker"
-require_once '    AGENT_PERSONA "generalist"' "canonical persona"
+require_once '    AGENT_PERSONA "session-creator"' "canonical persona"
 require_once '    AGENT_RUNTIME_PROFILE "@PROFILE@"' "runtime-profile projection"
-require_once '  argv "@ADAPTER@" "agent" "launch" "--harness" "claude" "--model" "claude-sonnet-5" "--effort" "medium" "--persona" "generalist" "--mode" "managed-unattended" "--boot" "managed-v1"' "typed managed-v1 launch"
-require_once '    copy "_templates/generalist.md" ".st2/PERSONA.md"' "canonical persona overlay"
+require_once '  argv "@ADAPTER@" "agent" "launch" "--harness" "claude" "--model" "claude-sonnet-5" "--effort" "medium" "--persona" "session-creator" "--mode" "managed-unattended" "--boot" "managed-v1"' "typed managed-v1 launch"
+require_once '    copy "_templates/session-creator.md" ".st2/PERSONA.md"' "canonical persona overlay"
 require_once '    copy "_templates/bus.st2.md" ".st2/bus.md"' "canonical bus overlay"
 require_once '    git-exclude ".st2/"' "overlay exclusion"
 require_once '  ding' "native DING declaration"
@@ -32,10 +32,10 @@ for projection in \
   'case "$profile" in' \
   '/*) ;;' \
   '.agentSpec.adapterBin' \
-  '.personas.prompts.generalist' \
+  '.personas.prompts["session-creator"]' \
   's|@PROFILE@|$profile|' \
   's|@ADAPTER@|$adapter|' \
-  'cp "$persona_source" ./_templates/generalist.md'; do
+  'cp "$persona_source" ./_templates/session-creator.md'; do
   grep -Fq "$projection" "$publisher" || {
     echo "FAIL: $publisher omits canonical projection $projection" >&2
     exit 1
diff --git a/bin/check-corpus.sh b/bin/check-corpus.sh
index fdb15f64..24054b52 100755
--- a/bin/check-corpus.sh
+++ b/bin/check-corpus.sh
@@ -18,6 +18,7 @@ bash -n "${shell_files[@]}"
 echo "PASS: ${#shell_files[@]} shell files parse"
 
 bin/check-preflight-safety.sh
+bin/check-agent-new-behavior-cases.sh
 bin/check-agent-new-renderer-security.sh
 bin/check-model-policy.sh
 bin/check-model-policy-mutations.sh
diff --git a/bin/check-fixture-reset-terminal.sh b/bin/check-fixture-reset-terminal.sh
index 61bbba9e..272ff2e3 100755
--- a/bin/check-fixture-reset-terminal.sh
+++ b/bin/check-fixture-reset-terminal.sh
@@ -18,17 +18,35 @@ trap cleanup EXIT
 
 plain="$scratch/plain.out"
 terminal="$scratch/terminal.out"
+hostile="$scratch/hostile.out"
+hostile_hooks="$scratch/hostile-hooks"
+hostile_config="$scratch/hostile.gitconfig"
 
 bin/check-fixture-reset.sh >"$plain"
 CHECK_FIXTURE_RESET="$repo_root/bin/check-fixture-reset.sh" \
   script -qefc 'exec "$CHECK_FIXTURE_RESET"' /dev/null </dev/null |
   tr -d '\r' >"$terminal"
 
+mkdir -p "$hostile_hooks"
+printf '%s\n' '#!/bin/sh' 'echo ambient-hook-ran >&2' 'exit 97' \
+  >"$hostile_hooks/commit-msg"
+chmod +x "$hostile_hooks/commit-msg"
+git config -f "$hostile_config" core.hooksPath "$hostile_hooks"
+git config -f "$hostile_config" user.name ambient-user
+git config -f "$hostile_config" user.email ambient@example.invalid
+GIT_CONFIG_GLOBAL="$hostile_config" GIT_CONFIG_NOSYSTEM=0 \
+  bin/check-fixture-reset.sh >"$hostile"
+
 if ! cmp -s "$plain" "$terminal"; then
   diff -u "$plain" "$terminal" >&2 || true
   echo "FAIL: fixture-reset gate differs with a terminal attached" >&2
   exit 1
 fi
+if ! cmp -s "$plain" "$hostile"; then
+  diff -u "$plain" "$hostile" >&2 || true
+  echo "FAIL: fixture reset depends on ambient Git config or hooks" >&2
+  exit 1
+fi
 
 sed -n '1,240p' "$plain"
-echo "PASS: fixture-reset gate and owned-mktemp cleanup are terminal-independent"
+echo "PASS: fixture-reset gate is terminal-independent and ignores hostile ambient Git config/hooks"
diff --git a/bin/check-harness-contract.sh b/bin/check-harness-contract.sh
index e46765f0..284e2ad2 100755
--- a/bin/check-harness-contract.sh
+++ b/bin/check-harness-contract.sh
@@ -50,13 +50,18 @@ hydrate_gitdirs() {
 
 prepare_cell() {
   local cell="$1" root="$2" fixture="cells/$cell/fixture" script
+  case "$cell" in
+    agent-new-interview-hard-constraint|agent-new-interview-investigation|agent-new-interview-small-fix)
+      fixture="cells/agent-new-interview/fixture"
+      ;;
+  esac
   [ -d "$fixture" ] || {
     echo "FAIL: model-backed cell $cell has no fixture" >&2
     return 1
   }
   cp -a "$fixture"/. "$root"/
   case "$cell" in
-    agent-new-interview)
+    agent-new-interview|agent-new-interview-hard-constraint|agent-new-interview-investigation|agent-new-interview-small-fix)
       script="$root/prepare-interviewer-worktree.sh"
       ;;
     signal-rename|signal-rename-codex)
@@ -81,7 +86,7 @@ prepare_cell() {
     echo "FAIL: $cell materializer contains a provider/reconcile/network command" >&2
     return 1
   fi
-  if [ "$cell" = "agent-new-interview" ]; then
+  if [[ "$cell" == agent-new-interview* ]]; then
     CATALOG="$root" bash "$script" "$root/interviewer" >/dev/null
   else
     CATALOG="$root" bash "$script" >/dev/null
diff --git a/bin/check-no-pii-history.sh b/bin/check-no-pii-history.sh
index ea165a90..75a9c051 100755
--- a/bin/check-no-pii-history.sh
+++ b/bin/check-no-pii-history.sh
@@ -2,6 +2,9 @@
 # Mutation-check check-no-pii.sh against a path committed and then deleted from a published _git fixture.
 set -euo pipefail
 
+export GIT_CONFIG_GLOBAL=/dev/null
+export GIT_CONFIG_NOSYSTEM=1
+
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 checker="${1:-$repo_root/bin/check-no-pii.sh}"
 scratch="$(mktemp -d)"
diff --git a/bin/check-preflight-safety.sh b/bin/check-preflight-safety.sh
index fe90cced..a2770e80 100755
--- a/bin/check-preflight-safety.sh
+++ b/bin/check-preflight-safety.sh
@@ -8,6 +8,7 @@ cd "$repo_root"
 reachable=(
   bin/check-corpus.sh
   bin/check-append-only-file.sh
+  bin/check-agent-new-behavior-cases.sh
   bin/check-agent-new-interview-attempts-mutations.sh
   bin/check-agent-new-renderer-security.sh
   bin/check-agent-new-interview-attempts.sh
@@ -70,6 +71,7 @@ mapfile -t direct < <(
     LC_ALL=C sort -u
 )
 expected_direct=(
+  bin/check-agent-new-behavior-cases.sh
   bin/check-agent-new-interview-attempts-mutations.sh
   bin/check-agent-new-interview-attempts.sh
   bin/check-agent-new-renderer-security.sh
diff --git a/bin/check-vrs-scope-drift.sh b/bin/check-vrs-scope-drift.sh
index 6ee28137..da846287 100755
--- a/bin/check-vrs-scope-drift.sh
+++ b/bin/check-vrs-scope-drift.sh
@@ -2,6 +2,9 @@
 # Model-free matched-condition and mutation-validity gate for the VRS scope-drift pair.
 set -euo pipefail
 
+export GIT_CONFIG_GLOBAL=/dev/null
+export GIT_CONFIG_NOSYSTEM=1
+
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 
diff --git a/bin/check-vrs-variations.sh b/bin/check-vrs-variations.sh
index 57c293c5..3fc72fd5 100755
--- a/bin/check-vrs-variations.sh
+++ b/bin/check-vrs-variations.sh
@@ -2,6 +2,9 @@
 # Model-free matching, treatment-isolation, and mutation-validity gate for three VRS A/B variations.
 set -euo pipefail
 
+export GIT_CONFIG_GLOBAL=/dev/null
+export GIT_CONFIG_NOSYSTEM=1
+
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 
diff --git a/bin/check-weird-git-setup.sh b/bin/check-weird-git-setup.sh
index 2a3f2969..a440c5c2 100755
--- a/bin/check-weird-git-setup.sh
+++ b/bin/check-weird-git-setup.sh
@@ -2,6 +2,9 @@
 # Mutation-check the corrected Weird-Git contract without launching a model.
 set -euo pipefail
 
+export GIT_CONFIG_GLOBAL=/dev/null
+export GIT_CONFIG_NOSYSTEM=1
+
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 scratch="$(mktemp -d)"
diff --git a/bin/model-agent-inventory.sh b/bin/model-agent-inventory.sh
index 9ca1f303..184123f3 100755
--- a/bin/model-agent-inventory.sh
+++ b/bin/model-agent-inventory.sh
@@ -151,6 +151,22 @@ while IFS= read -r template; do
     >> "$inventory"
 done < <(find cells -type f -name 'agent.kdl.template' | LC_ALL=C sort)
 
+shared_interview_template="cells/agent-new-interview/fixture/agent.kdl.template"
+for cell in \
+  agent-new-interview-hard-constraint \
+  agent-new-interview-investigation \
+  agent-new-interview-small-fix; do
+  printf '%s\t%s\t%s\t%s\t%s\tcanonical-template\t%s\t%s\n' \
+    "$cell" \
+    "global.coding-agents.session-creation.interview-eval" \
+    "Claude" \
+    '$CATALOG/interviewer' \
+    "evalhost.global.coding-agents.session-creation.interview-eval" \
+    "$shared_interview_template" \
+    "$(rg -n '^[[:space:]]*argv[[:space:]].*"agent"[[:space:]]+"launch"' "$shared_interview_template" | cut -d: -f1)" \
+    >> "$inventory"
+done
+
 launches="$(
   {
     rg -n --no-heading '^[[:space:]]*command[[:space:]]+.*exec ((claude|codex)[[:space:]]|axe agent launch[[:space:]])' \
@@ -159,6 +175,7 @@ launches="$(
       cells -g 'agent.kdl.template' || true
   } | wc -l | tr -d ' '
 )"
+launches=$((launches + 3))
 rows="$(wc -l < "$inventory" | tr -d ' ')"
 if [ "$rows" -ne "$launches" ]; then
   echo "FAIL: model-agent inventory found $rows structured agents but $launches root-KDL launch lines" >&2
diff --git a/cells/agent-new-bundle-contract/README.md b/cells/agent-new-bundle-contract/README.md
index f8aaa065..a88dfb4b 100644
--- a/cells/agent-new-bundle-contract/README.md
+++ b/cells/agent-new-bundle-contract/README.md
@@ -5,10 +5,12 @@ interview handoff. A small semantic `axe.agent-creation-intent.v1` record is
 the only interviewer output. The renderer owns canonical Agent Spec KDL and
 the initial inbox Resource.
 
-Two valid one-session intents exercise the same lowering path. Three invalid
-inputs prove the input boundary is closed: an interviewer cannot pin an
-account, introduce an unsupported trajectory value, or inject KDL through the
-workspace path.
+Two valid one-session intents exercise the same lowering path, including an
+empty-reference root session and a supervised session. Workspace is supplied by
+the creation transaction, never by model output. Invalid inputs prove the
+closed boundary rejects account pins, model-owned workspace, malformed
+supervisors, unsupported trajectory values, and any attempt to override an
+explicit human trajectory constraint.
 
 Held-out mutation checks copy valid output and independently prove that the
 bundle grader rejects:
diff --git a/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl b/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl
index bd141e7f..f15178e0 100644
--- a/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl
+++ b/cells/agent-new-bundle-contract/agent-new-bundle-contract.kdl
@@ -5,10 +5,10 @@ eval {
   max-timeout "60s"
 
   run "implementation" {
-    command "bash ./render-intent.sh ./inputs/implementation.json ./out/implementation"
+    command "bash ./render-intent.sh ./inputs/implementation.json ./out/implementation /workspace/dotfiles ./inputs/implementation-constraints.json"
   }
   run "review" {
-    command "bash ./render-intent.sh ./inputs/review.json ./out/review"
+    command "bash ./render-intent.sh ./inputs/review.json ./out/review /workspace/livestore"
   }
   run "forbidden-account" {
     allow-nonzero
@@ -20,7 +20,15 @@ eval {
   }
   run "workspace-injection" {
     allow-nonzero
-    command "bash ./render-intent.sh ./inputs/workspace-injection.json ./out/workspace-injection"
+    command "bash ./render-intent.sh ./inputs/workspace-injection.json ./out/workspace-injection /workspace/dotfiles"
+  }
+  run "invalid-supervisor" {
+    allow-nonzero
+    command "bash ./render-intent.sh ./inputs/invalid-supervisor.json ./out/invalid-supervisor /workspace/dotfiles"
+  }
+  run "constraint-mismatch" {
+    allow-nonzero
+    command "bash ./render-intent.sh ./inputs/constraint-mismatch.json ./out/constraint-mismatch /workspace/dotfiles ./inputs/implementation-constraints.json"
   }
 
   judges {
@@ -33,8 +41,11 @@ eval {
     judge "INITIAL CONTEXT — goal and references become an inbox Resource, not KDL fields" {
       exec "bash ./judges/grade.sh inbox"
     }
-    judge "CLOSED INPUT — account pins, unstable trajectory values, and KDL workspace injection fail closed" {
-      exec #"test "$RUN_forbidden_account_EXIT" -ne 0 && test "$RUN_trajectory_drift_EXIT" -ne 0 && test "$RUN_workspace_injection_EXIT" -ne 0 && test ! -e "$CATALOG/out/workspace-injection/agents""#
+    judge "CLOSED INPUT — account pins, model-owned workspace, invalid supervisors, and unsupported trajectory values fail closed" {
+      exec #"test "$RUN_forbidden_account_EXIT" -ne 0 && test "$RUN_trajectory_drift_EXIT" -ne 0 && test "$RUN_workspace_injection_EXIT" -ne 0 && test "$RUN_invalid_supervisor_EXIT" -ne 0 && test ! -e "$CATALOG/out/workspace-injection/agents""#
+    }
+    judge "HARD CONSTRAINTS — an accepted intent cannot override explicit human trajectory constraints" {
+      exec #"test "$RUN_constraint_mismatch_EXIT" -ne 0 && test ! -e "$CATALOG/out/constraint-mismatch/agents""#
     }
     judge "NEGATIVE CONTROLS — raw provider argv, trajectory drift, and missing context are rejected" {
       exec "bash ./judges/mutation-check.sh"
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/constraint-mismatch.json b/cells/agent-new-bundle-contract/fixture/inputs/constraint-mismatch.json
new file mode 100644
index 00000000..2a1b1df8
--- /dev/null
+++ b/cells/agent-new-bundle-contract/fixture/inputs/constraint-mismatch.json
@@ -0,0 +1,18 @@
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "dotfiles.axe.issue-40.implementation",
+  "goal": "Implement Axe issue 40.",
+  "references": [
+    "https://github.com/compoundingtech/axe/issues/40"
+  ],
+  "trajectory": {
+    "harness": "claude",
+    "model": "claude-sonnet-5",
+    "effort": "medium",
+    "persona": "generalist",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  },
+  "supervisor": "evalhost.root"
+}
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/forbidden-account.json b/cells/agent-new-bundle-contract/fixture/inputs/forbidden-account.json
index fb0f6fde..3a65843b 100644
--- a/cells/agent-new-bundle-contract/fixture/inputs/forbidden-account.json
+++ b/cells/agent-new-bundle-contract/fixture/inputs/forbidden-account.json
@@ -2,7 +2,6 @@
   "schema": "axe.agent-creation-intent.v1",
   "decision": "commit",
   "identity": "dotfiles.axe.issue-40.implementation",
-  "workspace": "/workspace/dotfiles",
   "goal": "Implement Axe issue 40.",
   "references": [
     "https://github.com/compoundingtech/axe/issues/40"
@@ -15,5 +14,6 @@
     "persona": "generalist",
     "mode": "managed-unattended",
     "boot": "managed-v1"
-  }
+  },
+  "supervisor": "evalhost.root"
 }
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/implementation-constraints.json b/cells/agent-new-bundle-contract/fixture/inputs/implementation-constraints.json
new file mode 100644
index 00000000..fa33e48d
--- /dev/null
+++ b/cells/agent-new-bundle-contract/fixture/inputs/implementation-constraints.json
@@ -0,0 +1,7 @@
+{
+  "harness": "codex",
+  "model": "gpt-5.6-sol",
+  "effort": "high",
+  "persona": "generalist",
+  "supervisor": "evalhost.root"
+}
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/implementation.json b/cells/agent-new-bundle-contract/fixture/inputs/implementation.json
index 58b9f8e1..9780fa3e 100644
--- a/cells/agent-new-bundle-contract/fixture/inputs/implementation.json
+++ b/cells/agent-new-bundle-contract/fixture/inputs/implementation.json
@@ -2,7 +2,6 @@
   "schema": "axe.agent-creation-intent.v1",
   "decision": "commit",
   "identity": "dotfiles.axe.issue-40.implementation",
-  "workspace": "/workspace/dotfiles",
   "goal": "Implement Axe issue 40 end to end, including tests and live verification.",
   "references": [
     "https://github.com/compoundingtech/axe/issues/40"
@@ -14,5 +13,6 @@
     "persona": "generalist",
     "mode": "managed-unattended",
     "boot": "managed-v1"
-  }
+  },
+  "supervisor": "evalhost.root"
 }
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/invalid-supervisor.json b/cells/agent-new-bundle-contract/fixture/inputs/invalid-supervisor.json
new file mode 100644
index 00000000..2a192d50
--- /dev/null
+++ b/cells/agent-new-bundle-contract/fixture/inputs/invalid-supervisor.json
@@ -0,0 +1,16 @@
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "dotfiles.axe.issue-40.implementation",
+  "goal": "Implement Axe issue 40.",
+  "references": [],
+  "trajectory": {
+    "harness": "codex",
+    "model": "gpt-5.6-sol",
+    "effort": "high",
+    "persona": "generalist",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  },
+  "supervisor": "../escape"
+}
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/review.json b/cells/agent-new-bundle-contract/fixture/inputs/review.json
index 59165d11..14ac95ac 100644
--- a/cells/agent-new-bundle-contract/fixture/inputs/review.json
+++ b/cells/agent-new-bundle-contract/fixture/inputs/review.json
@@ -2,11 +2,8 @@
   "schema": "axe.agent-creation-intent.v1",
   "decision": "commit",
   "identity": "livestore.pr-1520.review",
-  "workspace": "/workspace/livestore",
   "goal": "Review LiveStore pull request 1520 and report only evidence-backed blockers.",
-  "references": [
-    "https://github.com/livestorejs/livestore/pull/1520"
-  ],
+  "references": [],
   "trajectory": {
     "harness": "claude",
     "model": "claude-sonnet-5",
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/trajectory-drift.json b/cells/agent-new-bundle-contract/fixture/inputs/trajectory-drift.json
index cedfd847..027a8c0e 100644
--- a/cells/agent-new-bundle-contract/fixture/inputs/trajectory-drift.json
+++ b/cells/agent-new-bundle-contract/fixture/inputs/trajectory-drift.json
@@ -2,7 +2,6 @@
   "schema": "axe.agent-creation-intent.v1",
   "decision": "commit",
   "identity": "dotfiles.axe.issue-40.implementation",
-  "workspace": "/workspace/dotfiles",
   "goal": "Implement Axe issue 40.",
   "references": [
     "https://github.com/compoundingtech/axe/issues/40"
@@ -14,5 +13,6 @@
     "persona": "generalist",
     "mode": "managed-unattended",
     "boot": "managed-v1"
-  }
+  },
+  "supervisor": "evalhost.root"
 }
diff --git a/cells/agent-new-bundle-contract/fixture/inputs/workspace-injection.json b/cells/agent-new-bundle-contract/fixture/inputs/workspace-injection.json
index 36a10eaa..2547edfd 100644
--- a/cells/agent-new-bundle-contract/fixture/inputs/workspace-injection.json
+++ b/cells/agent-new-bundle-contract/fixture/inputs/workspace-injection.json
@@ -14,5 +14,6 @@
     "persona": "generalist",
     "mode": "managed-unattended",
     "boot": "managed-v1"
-  }
+  },
+  "supervisor": "evalhost.root"
 }
diff --git a/cells/agent-new-bundle-contract/fixture/render-intent.sh b/cells/agent-new-bundle-contract/fixture/render-intent.sh
index 812df71f..9ff487c7 100755
--- a/cells/agent-new-bundle-contract/fixture/render-intent.sh
+++ b/cells/agent-new-bundle-contract/fixture/render-intent.sh
@@ -3,19 +3,33 @@ set -euo pipefail
 
 input="${1:?intent path required}"
 out="${2:?output root required}"
+workspace="${3:?transaction-owned workspace required}"
+constraints="${4:-}"
+
+case "$workspace" in
+  /*) ;;
+  *) echo "workspace must be an absolute transaction input" >&2; exit 1 ;;
+esac
+if [[ "$workspace" == *$'\n'* || "$workspace" == *'"'* ]]; then
+  echo "workspace cannot be represented in canonical KDL" >&2
+  exit 1
+fi
 
 jq -e '
   type == "object" and
-  (keys | sort) == ([
-    "decision", "goal", "identity", "references", "schema", "trajectory", "workspace"
-  ] | sort) and
+  ((keys | sort) == ([
+    "decision", "goal", "identity", "references", "schema", "trajectory"
+  ] | sort) or (keys | sort) == ([
+    "decision", "goal", "identity", "references", "schema", "supervisor", "trajectory"
+  ] | sort)) and
   .schema == "axe.agent-creation-intent.v1" and
   .decision == "commit" and
   (.identity | test("^[a-z0-9][a-z0-9.-]*[a-z0-9]$")) and
-  (.workspace | test("^/[-A-Za-z0-9._/+:]+$")) and
   (.goal | type == "string" and length > 0 and test("[\"\\n\\r]") | not) and
-  (.references | type == "array" and length > 0 and
+  (.references | type == "array" and
     all(.[]; type == "string" and test("^https://github\\.com/"))) and
+  ((has("supervisor") | not) or
+    (.supervisor | type == "string" and test("^[a-z0-9][a-z0-9.-]*[a-z0-9]$"))) and
   (.trajectory | type == "object") and
   (.trajectory | keys | sort) == ([
     "boot", "effort", "harness", "mode", "model", "persona"
@@ -34,7 +48,6 @@ jq -e '
 ' "$input" >/dev/null
 
 identity="$(jq -r .identity "$input")"
-workspace="$(jq -r .workspace "$input")"
 harness="$(jq -r .trajectory.harness "$input")"
 model="$(jq -r .trajectory.model "$input")"
 effort="$(jq -r .trajectory.effort "$input")"
@@ -42,8 +55,21 @@ persona="$(jq -r .trajectory.persona "$input")"
 mode="$(jq -r .trajectory.mode "$input")"
 boot="$(jq -r .trajectory.boot "$input")"
 goal="$(jq -r .goal "$input")"
+supervisor="$(jq -r '.supervisor // empty' "$input")"
 target="$out/agents/evalhost/$identity"
 
+if [ -n "$constraints" ]; then
+  jq -e --slurpfile intent "$input" '
+    type == "object" and
+    (keys - ["supervisor"] | sort) == (["effort", "harness", "model", "persona"] | sort) and
+    .harness == $intent[0].trajectory.harness and
+    .model == $intent[0].trajectory.model and
+    .effort == $intent[0].trajectory.effort and
+    .persona == $intent[0].trajectory.persona and
+    ((has("supervisor") | not) or .supervisor == $intent[0].supervisor)
+  ' "$constraints" >/dev/null
+fi
+
 mkdir -p "$target/resources/inbox"
 cp "$input" "$out/intent.json"
 
@@ -52,6 +78,9 @@ cp "$input" "$out/intent.json"
   printf '  identity "%s"\n' "$identity"
   printf '  host "evalhost"\n'
   printf '  workspace "%s"\n\n' "$workspace"
+  if [ -n "$supervisor" ]; then
+    printf '  supervisor "%s"\n\n' "$supervisor"
+  fi
   printf '  restart {\n'
   printf '    attempts 3\n'
   printf '    interval "60s"\n'
diff --git a/cells/agent-new-bundle-contract/judges/grade.sh b/cells/agent-new-bundle-contract/judges/grade.sh
index d0ad9e3a..3cf206d4 100755
--- a/cells/agent-new-bundle-contract/judges/grade.sh
+++ b/cells/agent-new-bundle-contract/judges/grade.sh
@@ -16,6 +16,13 @@ grade_bundle() {
     "$intent" >/dev/null
   grep -Fqx "  identity \"$expected_identity\"" "$kdl"
   grep -Fqx '  host "evalhost"' "$kdl"
+  if [ "$name" = implementation ]; then
+    grep -Fqx '  workspace "/workspace/dotfiles"' "$kdl"
+    grep -Fqx '  supervisor "evalhost.root"' "$kdl"
+  else
+    grep -Fqx '  workspace "/workspace/livestore"' "$kdl"
+    ! grep -Eq '^[[:space:]]*supervisor ' "$kdl"
+  fi
   grep -Fqx '    AGENT_LAUNCH_HOSTED "1"' "$kdl"
   grep -Fqx "    AGENT_PERSONA \"$expected_persona\"" "$kdl"
   grep -Fqx "    ST_AGENT \"evalhost.$expected_identity\"" "$kdl"
diff --git a/cells/agent-new-confirmation-contract/README.md b/cells/agent-new-confirmation-contract/README.md
new file mode 100644
index 00000000..2a6c8bdc
--- /dev/null
+++ b/cells/agent-new-confirmation-contract/README.md
@@ -0,0 +1,10 @@
+# agent-new-confirmation-contract
+
+This model-free cell freezes the safe DQ1 fallback while autonomous interview
+commit is not admitted. A valid semantic intent is rendered and summarized, but
+the final bundle cannot be published until the human explicitly confirms that
+summary. Rejection, EOF, or Ctrl-C retires the temporary declaration, retains
+its tombstone, and publishes no final declaration. Merely having a valid intent
+is not commit authority.
+
+This cell does not claim that autonomous no-confirmation behavior is accepted.
diff --git a/cells/agent-new-confirmation-contract/agent-new-confirmation-contract.kdl b/cells/agent-new-confirmation-contract/agent-new-confirmation-contract.kdl
new file mode 100644
index 00000000..1b520f21
--- /dev/null
+++ b/cells/agent-new-confirmation-contract/agent-new-confirmation-contract.kdl
@@ -0,0 +1,36 @@
+// Safe pre-threshold DQ1 fallback: explicit human confirmation is commit authority.
+eval {
+  copy "./fixture"
+  max-timeout "30s"
+
+  run "confirmed" {
+    command "bash ./apply-confirmation.sh confirm ./out/confirmed"
+  }
+  run "pending" {
+    command "bash ./apply-confirmation.sh pending ./out/pending"
+  }
+  run "rejected" {
+    command "bash ./apply-confirmation.sh reject ./out/rejected"
+  }
+  run "eof" {
+    command "bash ./apply-confirmation.sh eof ./out/eof"
+  }
+  run "sigint" {
+    command "bash ./apply-confirmation.sh sigint ./out/sigint"
+  }
+
+  judges {
+    judge "CONFIRM — only explicit confirmation publishes the exact staged final bundle" {
+      exec "bash ./judges/grade.sh confirmed"
+    }
+    judge "PENDING — a valid intent and rendered summary alone publish nothing" {
+      exec "bash ./judges/grade.sh pending"
+    }
+    judge "CANCEL — reject, EOF, and Ctrl-C retain retired tombstones and publish no final bundle" {
+      exec "bash ./judges/grade.sh cancelled"
+    }
+    judge "NEGATIVE CONTROLS — missing confirmation, missing tombstone, and false cancellation fail" {
+      exec "bash ./judges/mutation-check.sh"
+    }
+  }
+}
diff --git a/cells/agent-new-confirmation-contract/fixture/apply-confirmation.sh b/cells/agent-new-confirmation-contract/fixture/apply-confirmation.sh
new file mode 100755
index 00000000..27b085e5
--- /dev/null
+++ b/cells/agent-new-confirmation-contract/fixture/apply-confirmation.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+response="${1:?confirm|pending|reject|eof|sigint required}"
+out="${2:?output root required}"
+temporary="$out/agents/dev3/global.coding-agents.session-creation.interview-eval"
+final="$out/agents/dev3/dotfiles.cos-misc.axe-40.implementation"
+
+mkdir -p "$temporary/resources/axe-agent-new"
+cp ./intent.json "$temporary/resources/axe-agent-new/intent"
+printf '%s\n' \
+  'Identity: dotfiles.cos-misc.axe-40.implementation' \
+  'Goal: Implement Axe issue 40 end to end with tests and live verification.' \
+  'Trajectory: codex / gpt-5.6-sol / high / generalist' \
+  >"$temporary/resources/axe-agent-new/confirmation-summary"
+
+write_temporary() {
+  local retired="$1"
+  {
+    printf '%s\n' 'agent "global.coding-agents.session-creation.interview-eval" {'
+    printf '%s\n' '  identity "global.coding-agents.session-creation.interview-eval"'
+    printf '%s\n' '  host "dev3"'
+    printf '%s\n' '  workspace "/workspace/dotfiles"'
+    printf '  retired %s\n' "$retired"
+    printf '%s\n' '}'
+  } >"$temporary/agent.kdl"
+}
+
+write_temporary '#false'
+case "$response" in
+  confirm)
+    write_temporary '#true'
+    mkdir -p "$final/resources/inbox"
+    printf '%s\n' \
+      'agent "dotfiles.cos-misc.axe-40.implementation" {' \
+      '  identity "dotfiles.cos-misc.axe-40.implementation"' \
+      '  host "dev3"' \
+      '  workspace "/workspace/dotfiles"' \
+      '  supervisor "dev3.root"' \
+      '  argv "/nix/store/axe/bin/axe" "agent" "launch" "--harness" "codex" "--model" "gpt-5.6-sol" "--effort" "high" "--persona" "generalist" "--mode" "managed-unattended" "--boot" "managed-v1"' \
+      '}' >"$final/agent.kdl"
+    printf '%s\n' \
+      'Goal: Implement Axe issue 40 end to end with tests and live verification.' \
+      '' \
+      'References:' \
+      '- https://github.com/compoundingtech/axe/issues/40' \
+      >"$final/resources/inbox/0001-session-goal.md"
+    printf '%s\n' committed >"$out/outcome"
+    ;;
+  pending)
+    printf '%s\n' awaiting-confirmation >"$out/outcome"
+    ;;
+  reject|eof|sigint)
+    write_temporary '#true'
+    printf '%s\n' cancelled >"$out/outcome"
+    ;;
+  *)
+    echo "unsupported confirmation response: $response" >&2
+    exit 2
+    ;;
+esac
diff --git a/cells/agent-new-confirmation-contract/fixture/intent.json b/cells/agent-new-confirmation-contract/fixture/intent.json
new file mode 100644
index 00000000..a65bc8c7
--- /dev/null
+++ b/cells/agent-new-confirmation-contract/fixture/intent.json
@@ -0,0 +1,18 @@
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "dotfiles.cos-misc.axe-40.implementation",
+  "goal": "Implement Axe issue 40 end to end with tests and live verification.",
+  "references": [
+    "https://github.com/compoundingtech/axe/issues/40"
+  ],
+  "trajectory": {
+    "harness": "codex",
+    "model": "gpt-5.6-sol",
+    "effort": "high",
+    "persona": "generalist",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  },
+  "supervisor": "dev3.root"
+}
diff --git a/cells/agent-new-confirmation-contract/judges/grade.sh b/cells/agent-new-confirmation-contract/judges/grade.sh
new file mode 100755
index 00000000..d4269a41
--- /dev/null
+++ b/cells/agent-new-confirmation-contract/judges/grade.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode="${1:?grade mode required}"
+root="${CATALOG:?CATALOG required}/out"
+temp_rel="agents/dev3/global.coding-agents.session-creation.interview-eval"
+final_rel="agents/dev3/dotfiles.cos-misc.axe-40.implementation"
+
+retired() {
+  grep -Fqx '  retired #true' "$1/$temp_rel/agent.kdl"
+  test -s "$1/$temp_rel/resources/axe-agent-new/intent"
+  test -s "$1/$temp_rel/resources/axe-agent-new/confirmation-summary"
+}
+
+case "$mode" in
+  confirmed)
+    out="$root/confirmed"
+    retired "$out"
+    grep -Fqx committed "$out/outcome"
+    test -s "$out/$final_rel/agent.kdl"
+    test -s "$out/$final_rel/resources/inbox/0001-session-goal.md"
+    ;;
+  pending)
+    out="$root/pending"
+    grep -Fqx '  retired #false' "$out/$temp_rel/agent.kdl"
+    grep -Fqx awaiting-confirmation "$out/outcome"
+    test ! -e "$out/$final_rel"
+    ;;
+  cancelled)
+    for name in rejected eof sigint; do
+      out="$root/$name"
+      retired "$out"
+      grep -Fqx cancelled "$out/outcome"
+      test ! -e "$out/$final_rel"
+    done
+    ;;
+  *)
+    echo "unknown grade mode: $mode" >&2
+    exit 2
+    ;;
+esac
diff --git a/cells/agent-new-confirmation-contract/judges/mutation-check.sh b/cells/agent-new-confirmation-contract/judges/mutation-check.sh
new file mode 100755
index 00000000..6bab66f2
--- /dev/null
+++ b/cells/agent-new-confirmation-contract/judges/mutation-check.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="${CATALOG:?CATALOG required}"
+scratch="$(mktemp -d)"
+trap 'rm -rf -- "$scratch"' EXIT
+
+expect_rejected() {
+  local name="$1" mode="$2"
+  if CATALOG="$scratch/$name" bash ./judges/grade.sh "$mode" >/dev/null 2>&1; then
+    echo "FAIL: planted $name mutation passed confirmation grader" >&2
+    exit 1
+  fi
+}
+
+mkdir -p "$scratch/no-confirm/out"
+cp -a "$root/out/pending" "$scratch/no-confirm/out/confirmed"
+expect_rejected no-confirm confirmed
+
+mkdir -p "$scratch/no-tombstone/out"
+cp -a "$root/out/confirmed" "$scratch/no-tombstone/out/confirmed"
+sed -i 's/retired #true/retired #false/' \
+  "$scratch/no-tombstone/out/confirmed/agents/dev3/global.coding-agents.session-creation.interview-eval/agent.kdl"
+expect_rejected no-tombstone confirmed
+
+mkdir -p "$scratch/cancel-published/out"
+for name in rejected eof sigint; do
+  cp -a "$root/out/$name" "$scratch/cancel-published/out/$name"
+done
+cp -a \
+  "$root/out/confirmed/agents/dev3/dotfiles.cos-misc.axe-40.implementation" \
+  "$scratch/cancel-published/out/rejected/agents/dev3/"
+expect_rejected cancel-published cancelled
+
+echo "PASS: confirmation mutations fail held-out graders"
diff --git a/cells/agent-new-creation-lifecycle/README.md b/cells/agent-new-creation-lifecycle/README.md
new file mode 100644
index 00000000..6f7eeacf
--- /dev/null
+++ b/cells/agent-new-creation-lifecycle/README.md
@@ -0,0 +1,20 @@
+# agent-new-creation-lifecycle
+
+This is the model-free lifecycle admission cell for the real zero-flag
+`axe agent new` transaction. It is intentionally unrun and non-accepting until
+the successor Axe artifact and its model-free driver are pinned. The driver
+must invoke that exact Axe binary against a real canonical temporary Agent Spec
+and st2 catalog; a shell stand-in is not admissible.
+
+Required run inputs:
+
+- `AXE_AGENT_NEW_SUCCESSOR`: exact immutable Axe executable;
+- `AXE_AGENT_NEW_SUCCESSOR_COMMIT`: its 40-hex source commit;
+- `AXE_AGENT_NEW_LIFECYCLE_DRIVER`: immutable model-free driver which invokes
+  that executable and writes the documented case state.
+
+The cell covers success, three crash boundaries, cancellation versus process
+failure, single-flight recovery, retained tombstones, main-PTY gating with Ding
+state explicitly indeterminate, exactly-once final publication, and attachment
+to the exact final PTY. Until an exact successor supplies those inputs,
+`st2 eval` must fail before claiming a result.
diff --git a/cells/agent-new-creation-lifecycle/agent-new-creation-lifecycle.kdl b/cells/agent-new-creation-lifecycle/agent-new-creation-lifecycle.kdl
new file mode 100644
index 00000000..87dc2a9c
--- /dev/null
+++ b/cells/agent-new-creation-lifecycle/agent-new-creation-lifecycle.kdl
@@ -0,0 +1,45 @@
+// Successor-gated real Axe lifecycle matrix. No provider model is launched.
+eval {
+  copy "./fixture"
+  max-timeout "180s"
+
+  run "success" {
+    command "bash ./run-case.sh success ./out/success"
+  }
+  run "crash-pre-retire" {
+    command "bash ./run-case.sh crash-pre-retire ./out/crash-pre-retire"
+  }
+  run "crash-post-retire" {
+    command "bash ./run-case.sh crash-post-retire ./out/crash-post-retire"
+  }
+  run "crash-post-publish" {
+    command "bash ./run-case.sh crash-post-publish ./out/crash-post-publish"
+  }
+  run "cancel" {
+    command "bash ./run-case.sh cancel ./out/cancel"
+  }
+  run "process-crash-before-intent" {
+    command "bash ./run-case.sh process-crash-before-intent ./out/process-crash-before-intent"
+  }
+  run "concurrent-resume" {
+    command "bash ./run-case.sh concurrent-resume ./out/concurrent-resume"
+  }
+
+  judges {
+    judge "SUCCESS — retirement precedes one final publication and exact final attachment" {
+      exec "bash ./judges/grade.sh success"
+    }
+    judge "RECOVERY — every crash boundary resumes without duplicate final context" {
+      exec "bash ./judges/grade.sh recovery"
+    }
+    judge "CANCEL VS CRASH — human cancellation retires; process failure remains active and recoverable" {
+      exec "bash ./judges/grade.sh cancel-crash"
+    }
+    judge "SINGLE FLIGHT — concurrent resumer is busy and takeover resumes after owner death" {
+      exec "bash ./judges/grade.sh concurrency"
+    }
+    judge "NEGATIVE CONTROLS — missing tombstone, Ding proxy, duplicate publication, and wrong attach fail" {
+      exec "bash ./judges/mutation-check.sh"
+    }
+  }
+}
diff --git a/cells/agent-new-creation-lifecycle/fixture/inspect-case.sh b/cells/agent-new-creation-lifecycle/fixture/inspect-case.sh
new file mode 100755
index 00000000..b315b63d
--- /dev/null
+++ b/cells/agent-new-creation-lifecycle/fixture/inspect-case.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+scenario="${1:?scenario required}"
+out="${2:?output root required}"
+temp="$out/catalog/agents/dev3/global.coding-agents.session-creation.interview-eval/agent.kdl"
+final_root="$out/catalog/agents/dev3/dotfiles.cos-misc.axe-40.implementation"
+trace="$out/trace.tsv"
+
+test -f "$temp"
+test -f "$trace"
+test "$(find "$final_root" -type f -name agent.kdl 2>/dev/null | wc -l)" -le 1
+test "$(find "$final_root/resources/inbox" -type f 2>/dev/null | wc -l)" -le 1
+
+case "$scenario" in
+  cancel)
+    grep -Fqx '  retired #true' "$temp"
+    test ! -e "$final_root"
+    ;;
+  process-crash-before-intent)
+    grep -Fqx '  retired #false' "$temp"
+    test ! -e "$final_root"
+    ;;
+  *)
+    grep -Fqx '  retired #true' "$temp"
+    test -s "$final_root/agent.kdl"
+    test "$(find "$final_root/resources/inbox" -type f | wc -l)" -eq 1
+    grep -Fqx $'main-pty-absent\ttrue' "$trace"
+    grep -Fqx $'ding-state\tindeterminate' "$trace"
+    grep -Fqx $'attached\tdev3.dotfiles.cos-misc.axe-40.implementation' "$trace"
+    ;;
+esac
+
+if [ "$scenario" = concurrent-resume ]; then
+  grep -Fqx $'second-invocation\tbusy-no-write-no-attach' "$trace"
+  grep -Fqx $'owner-death\treleased' "$trace"
+  grep -Fqx $'later-retry\tresumed' "$trace"
+fi
diff --git a/cells/agent-new-creation-lifecycle/fixture/run-case.sh b/cells/agent-new-creation-lifecycle/fixture/run-case.sh
new file mode 100755
index 00000000..9f45d355
--- /dev/null
+++ b/cells/agent-new-creation-lifecycle/fixture/run-case.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+scenario="${1:?scenario required}"
+out="${2:?output root required}"
+axe="${AXE_AGENT_NEW_SUCCESSOR:?pin AXE_AGENT_NEW_SUCCESSOR to the successor Axe executable}"
+commit="${AXE_AGENT_NEW_SUCCESSOR_COMMIT:?pin AXE_AGENT_NEW_SUCCESSOR_COMMIT}"
+driver="${AXE_AGENT_NEW_LIFECYCLE_DRIVER:?pin AXE_AGENT_NEW_LIFECYCLE_DRIVER}"
+
+case "$axe:$driver" in
+  /*:/*) ;;
+  *) echo "successor Axe and lifecycle driver must be absolute paths" >&2; exit 1 ;;
+esac
+[[ "$commit" =~ ^[0-9a-f]{40}$ ]] || {
+  echo "successor commit must be exact 40-hex" >&2
+  exit 1
+}
+test -x "$axe"
+test -x "$driver"
+
+mkdir -p "$out"
+"$driver" \
+  --axe "$axe" \
+  --axe-source-commit "$commit" \
+  --scenario "$scenario" \
+  --output "$out"
+bash ./inspect-case.sh "$scenario" "$out"
diff --git a/cells/agent-new-creation-lifecycle/judges/grade.sh b/cells/agent-new-creation-lifecycle/judges/grade.sh
new file mode 100755
index 00000000..4efc0aa6
--- /dev/null
+++ b/cells/agent-new-creation-lifecycle/judges/grade.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode="${1:?grade mode required}"
+root="${CATALOG:?CATALOG required}/out"
+
+grade_case() {
+  bash ./inspect-case.sh "$1" "$root/$1"
+}
+
+case "$mode" in
+  success)
+    grade_case success
+    ;;
+  recovery)
+    grade_case crash-pre-retire
+    grade_case crash-post-retire
+    grade_case crash-post-publish
+    ;;
+  cancel-crash)
+    grade_case cancel
+    grade_case process-crash-before-intent
+    ;;
+  concurrency)
+    grade_case concurrent-resume
+    ;;
+  *)
+    echo "unknown grade mode: $mode" >&2
+    exit 2
+    ;;
+esac
diff --git a/cells/agent-new-creation-lifecycle/judges/mutation-check.sh b/cells/agent-new-creation-lifecycle/judges/mutation-check.sh
new file mode 100755
index 00000000..76e9d1ca
--- /dev/null
+++ b/cells/agent-new-creation-lifecycle/judges/mutation-check.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="${CATALOG:?CATALOG required}"
+scratch="$(mktemp -d)"
+trap 'rm -rf -- "$scratch"' EXIT
+temp_rel="catalog/agents/dev3/global.coding-agents.session-creation.interview-eval/agent.kdl"
+final_rel="catalog/agents/dev3/dotfiles.cos-misc.axe-40.implementation"
+
+expect_rejected() {
+  local name="$1" scenario="$2"
+  if bash ./inspect-case.sh "$scenario" "$scratch/$name" >/dev/null 2>&1; then
+    echo "FAIL: planted $name lifecycle mutation passed" >&2
+    exit 1
+  fi
+}
+
+cp -a "$root/out/success" "$scratch/no-tombstone"
+sed -i 's/retired #true/retired #false/' "$scratch/no-tombstone/$temp_rel"
+expect_rejected no-tombstone success
+
+cp -a "$root/out/success" "$scratch/ding-proxy"
+sed -i '/main-pty-absent/d; s/ding-state\tindeterminate/ding-state\tabsent/' \
+  "$scratch/ding-proxy/trace.tsv"
+expect_rejected ding-proxy success
+
+cp -a "$root/out/success" "$scratch/duplicate-final"
+mkdir -p "$scratch/duplicate-final/$final_rel/duplicate"
+cp "$scratch/duplicate-final/$final_rel/agent.kdl" \
+  "$scratch/duplicate-final/$final_rel/duplicate/agent.kdl"
+expect_rejected duplicate-final success
+
+cp -a "$root/out/success" "$scratch/wrong-attach"
+sed -i 's/attached\tdev3\\.dotfiles\\.cos-misc\\.axe-40\\.implementation/attached\tdev3.wrong/' \
+  "$scratch/wrong-attach/trace.tsv"
+expect_rejected wrong-attach success
+
+echo "PASS: lifecycle mutations fail held-out inspectors"
diff --git a/cells/agent-new-interview-hard-constraint/README.md b/cells/agent-new-interview-hard-constraint/README.md
new file mode 100644
index 00000000..6aa2af16
--- /dev/null
+++ b/cells/agent-new-interview-hard-constraint/README.md
@@ -0,0 +1,5 @@
+# agent-new-interview-hard-constraint
+
+Paid, unrun held-out behavior case: explicit human trajectory and supervisor
+constraints must survive exactly. Any override is a hard failure regardless of
+semantic quality.
diff --git a/cells/agent-new-interview-hard-constraint/agent-new-interview-hard-constraint.kdl b/cells/agent-new-interview-hard-constraint/agent-new-interview-hard-constraint.kdl
new file mode 100644
index 00000000..728e0ade
--- /dev/null
+++ b/cells/agent-new-interview-hard-constraint/agent-new-interview-hard-constraint.kdl
@@ -0,0 +1,31 @@
+eval {
+  copy "../agent-new-interview/fixture"
+  run "prepare-interviewer-worktree" {
+    command "bash ./prepare-interviewer-worktree.sh"
+  }
+  run "publish-canonical-interviewer" {
+    command "bash ./publish-interviewer.sh hard-constraint"
+  }
+  canonical-agents
+  message {
+    from "requester"
+    to "evalhost.global.coding-agents.session-creation.interview-eval"
+    content "./cases/hard-constraint/task.md"
+  }
+  max-timeout "300s"
+
+  judges {
+    judge "STRUCTURE — every explicit trajectory and supervisor constraint is exact" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh hard-constraint structural"
+    }
+    judge "SEMANTICS — review scope, hierarchy, and reference match held-out expectations" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh hard-constraint semantic"
+    }
+    judge "BUNDLE — deterministic lowering preserves the constrained trajectory" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh hard-constraint bundle && bash ../agent-new-interview/judges/grade-case.sh hard-constraint inbox"
+    }
+    judge "BOUNDARY — no model-authored KDL, provider argv, or account pin escapes" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh hard-constraint boundary"
+    }
+  }
+}
diff --git a/cells/agent-new-interview-investigation/README.md b/cells/agent-new-interview-investigation/README.md
new file mode 100644
index 00000000..914ccb36
--- /dev/null
+++ b/cells/agent-new-interview-investigation/README.md
@@ -0,0 +1,4 @@
+# agent-new-interview-investigation
+
+Paid, unrun held-out behavior case: a one-sentence read-only investigation with
+a GitHub reference. Expectations exist only in the judge fixture.
diff --git a/cells/agent-new-interview-investigation/agent-new-interview-investigation.kdl b/cells/agent-new-interview-investigation/agent-new-interview-investigation.kdl
new file mode 100644
index 00000000..c7dd1933
--- /dev/null
+++ b/cells/agent-new-interview-investigation/agent-new-interview-investigation.kdl
@@ -0,0 +1,31 @@
+eval {
+  copy "../agent-new-interview/fixture"
+  run "prepare-interviewer-worktree" {
+    command "bash ./prepare-interviewer-worktree.sh"
+  }
+  run "publish-canonical-interviewer" {
+    command "bash ./publish-interviewer.sh investigation"
+  }
+  canonical-agents
+  message {
+    from "requester"
+    to "evalhost.global.coding-agents.session-creation.interview-eval"
+    content "./cases/investigation/task.md"
+  }
+  max-timeout "300s"
+
+  judges {
+    judge "STRUCTURE — output is closed, account-neutral, and preserves every hard constraint" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh investigation structural"
+    }
+    judge "SEMANTICS — read-only investigation scope and reference survive selection" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh investigation semantic"
+    }
+    judge "BUNDLE — deterministic lowering owns canonical KDL and initial context" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh investigation bundle && bash ../agent-new-interview/judges/grade-case.sh investigation inbox"
+    }
+    judge "BOUNDARY — no model-authored KDL, provider argv, or account pin escapes" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh investigation boundary"
+    }
+  }
+}
diff --git a/cells/agent-new-interview-small-fix/README.md b/cells/agent-new-interview-small-fix/README.md
new file mode 100644
index 00000000..f84d939a
--- /dev/null
+++ b/cells/agent-new-interview-small-fix/README.md
@@ -0,0 +1,4 @@
+# agent-new-interview-small-fix
+
+Paid, unrun held-out behavior case: a one-sentence small fix with no external
+reference. Expectations exist only in the judge fixture.
diff --git a/cells/agent-new-interview-small-fix/agent-new-interview-small-fix.kdl b/cells/agent-new-interview-small-fix/agent-new-interview-small-fix.kdl
new file mode 100644
index 00000000..4d789539
--- /dev/null
+++ b/cells/agent-new-interview-small-fix/agent-new-interview-small-fix.kdl
@@ -0,0 +1,31 @@
+eval {
+  copy "../agent-new-interview/fixture"
+  run "prepare-interviewer-worktree" {
+    command "bash ./prepare-interviewer-worktree.sh"
+  }
+  run "publish-canonical-interviewer" {
+    command "bash ./publish-interviewer.sh small-fix"
+  }
+  canonical-agents
+  message {
+    from "requester"
+    to "evalhost.global.coding-agents.session-creation.interview-eval"
+    content "./cases/small-fix/task.md"
+  }
+  max-timeout "300s"
+
+  judges {
+    judge "STRUCTURE — output is closed, account-neutral, and preserves every hard constraint" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh small-fix structural"
+    }
+    judge "SEMANTICS — the small fix receives the held-out identity, goal, and trajectory" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh small-fix semantic"
+    }
+    judge "BUNDLE — deterministic lowering owns canonical KDL and initial context" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh small-fix bundle && bash ../agent-new-interview/judges/grade-case.sh small-fix inbox"
+    }
+    judge "BOUNDARY — no model-authored KDL, provider argv, or account pin escapes" {
+      exec "bash ../agent-new-interview/judges/grade-case.sh small-fix boundary"
+    }
+  }
+}
diff --git a/cells/agent-new-interview/README.md b/cells/agent-new-interview/README.md
index 786ba2f9..bad9ad50 100644
--- a/cells/agent-new-interview/README.md
+++ b/cells/agent-new-interview/README.md
@@ -1,11 +1,12 @@
 # agent-new-interview
 
-This is the paid judgment half of the B2 `axe agent new` proposal. A
-short-lived Claude Sonnet interviewer receives exactly one sentence from the
-human. It is launched through the typed `axe agent launch` boundary with no
-durable account pin, so Axe selects from the configured account pool for that
-run. It may inspect the frozen local snapshot of the referenced issue, then
-submits one typed semantic intent record.
+This is one of four paid, unrun judgment cases for `axe agent new`. A
+short-lived Claude Sonnet session creator receives exactly one sentence from
+the human. It uses the exact runtime-profile `session-creator` prompt and is
+launched through typed `axe agent launch` with no durable account pin. It may
+inspect a frozen local reference snapshot, then submits one typed semantic
+intent record. Expected answers live only in held-out judges, never in the
+model prompt.
 
 The interviewer cannot write the final Agent Spec. `submit-intent` validates a
 closed input schema and deterministically renders:
@@ -17,10 +18,11 @@ semantic intent
   `-- agents/evalhost/<identity>/resources/inbox/0001-session-goal.md
 ```
 
-The scenario is intentionally answerable without a clarification round. It
-tests whether the interviewer derives a useful hierarchical identity, the
-implementation trajectory, an externalized goal, and the reference from a
-normal terse request.
+The four isolated cells cover a large implementation with a GitHub reference,
+a small fix with empty references, a read-only investigation, and an explicit
+human trajectory/supervisor constraint. They are intentionally answerable
+without a clarification round. No paid result or autonomy acceptance is
+claimed until all are run with durable receipts and DQ1 accepts a threshold.
 
 Run it only with explicit paid-run authorization:
 
@@ -31,10 +33,11 @@ st2 eval ./cells/agent-new-interview/
 ## Canonical eval seam
 
 The cell copies its fixture, deterministically publishes one canonical
-`agents/evalhost/interviewer/agent.kdl` from the active runtime profile, and
+`agents/evalhost/global.coding-agents.session-creation.interview-eval/agent.kdl`
+from the active runtime profile, and
 then opts into st2's `canonical-agents` admission. The profile supplies the
 exact immutable Axe adapter, absolute runtime-profile path, and canonical
-generalist prompt. The declaration itself owns the typed launch trajectory and
+session-creator prompt. The declaration itself owns the typed launch trajectory and
 contains no account pin.
 
 This makes the paid cell environment-bound by design: the selected runtime
diff --git a/cells/agent-new-interview/agent-new-interview.kdl b/cells/agent-new-interview/agent-new-interview.kdl
index 73ef088c..13eae1c3 100644
--- a/cells/agent-new-interview/agent-new-interview.kdl
+++ b/cells/agent-new-interview/agent-new-interview.kdl
@@ -1,5 +1,5 @@
-// One short human request is classified by a constrained temporary interviewer.
-// The interviewer emits semantic intent only; the fixture's deterministic submit
+// One short human request is classified by a constrained temporary session creator.
+// The session creator emits semantic intent only; the fixture's deterministic submit
 // boundary validates that intent and renders the final B2 bundle.
 host "evalhost"
 
@@ -9,19 +9,22 @@ eval {
     command "bash ./prepare-interviewer-worktree.sh"
   }
   run "publish-canonical-interviewer" {
-    command "bash ./publish-interviewer.sh"
+    command "bash ./publish-interviewer.sh implementation"
   }
   canonical-agents
   message {
     from "requester"
-    to "evalhost.interviewer"
-    content "./task.md"
+    to "evalhost.global.coding-agents.session-creation.interview-eval"
+    content "./cases/implementation/task.md"
   }
   max-timeout "300s"
 
   judges {
-    judge "SEMANTIC INTENT — the one-sentence request becomes the expected typed decision" {
-      exec "bash ./judges/grade.sh intent"
+    judge "STRUCTURE — output is closed, account-neutral, and preserves every hard constraint" {
+      exec "bash ./judges/grade-case.sh implementation structural"
+    }
+    judge "SEMANTICS — the one-sentence request becomes the held-out typed decision" {
+      exec "bash ./judges/grade-case.sh implementation semantic"
     }
     judge "CANONICAL BUNDLE — deterministic lowering owns every stable launch axis" {
       exec "bash ./judges/grade.sh bundle"
@@ -29,7 +32,7 @@ eval {
     judge "INITIAL CONTEXT — goal and GitHub reference are preserved in the inbox Resource" {
       exec "bash ./judges/grade.sh inbox"
     }
-    judge "BOUNDARY — the interviewer neither authors KDL nor selects an account" {
+    judge "BOUNDARY — the session creator neither authors KDL nor selects an account" {
       exec "bash ./judges/grade.sh boundary"
     }
   }
diff --git a/cells/agent-new-interview/fixture/agent.kdl.template b/cells/agent-new-interview/fixture/agent.kdl.template
index 57274912..397d49b2 100644
--- a/cells/agent-new-interview/fixture/agent.kdl.template
+++ b/cells/agent-new-interview/fixture/agent.kdl.template
@@ -1,5 +1,5 @@
-agent "interviewer" {
-  identity "interviewer"
+agent "global.coding-agents.session-creation.interview-eval" {
+  identity "global.coding-agents.session-creation.interview-eval"
   host "evalhost"
   workspace "$CATALOG/interviewer"
 
@@ -12,16 +12,16 @@ agent "interviewer" {
 
   env {
     AGENT_LAUNCH_HOSTED "1"
-    AGENT_PERSONA "generalist"
+    AGENT_PERSONA "session-creator"
     AGENT_RUNTIME_PROFILE "@PROFILE@"
-    ST_AGENT "evalhost.interviewer"
+    ST_AGENT "evalhost.global.coding-agents.session-creation.interview-eval"
   }
 
-  argv "@ADAPTER@" "agent" "launch" "--harness" "claude" "--model" "claude-sonnet-5" "--effort" "medium" "--persona" "generalist" "--mode" "managed-unattended" "--boot" "managed-v1"
+  argv "@ADAPTER@" "agent" "launch" "--harness" "claude" "--model" "claude-sonnet-5" "--effort" "medium" "--persona" "session-creator" "--mode" "managed-unattended" "--boot" "managed-v1"
   ding
 
   render {
-    copy "_templates/generalist.md" ".st2/PERSONA.md"
+    copy "_templates/session-creator.md" ".st2/PERSONA.md"
     copy "_templates/bus.st2.md" ".st2/bus.md"
     git-exclude ".st2/"
   }
diff --git a/cells/agent-new-interview/fixture/cases/hard-constraint/expected.json b/cells/agent-new-interview/fixture/cases/hard-constraint/expected.json
new file mode 100644
index 00000000..a3cebdbc
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/hard-constraint/expected.json
@@ -0,0 +1,14 @@
+{
+  "identity": "livestore.main.pr-1520.review",
+  "goalTerms": ["review", "evidence", "blocker"],
+  "references": ["https://github.com/livestorejs/livestore/pull/1520"],
+  "supervisor": "evalhost.root",
+  "trajectory": {
+    "harness": "claude",
+    "model": "claude-sonnet-5",
+    "effort": "medium",
+    "persona": "pr-reviewer",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
diff --git a/cells/agent-new-interview/fixture/cases/hard-constraint/hard-constraints.json b/cells/agent-new-interview/fixture/cases/hard-constraint/hard-constraints.json
new file mode 100644
index 00000000..867857ed
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/hard-constraint/hard-constraints.json
@@ -0,0 +1,7 @@
+{
+  "harness": "claude",
+  "model": "claude-sonnet-5",
+  "effort": "medium",
+  "persona": "pr-reviewer",
+  "supervisor": "evalhost.root"
+}
diff --git a/cells/agent-new-interview/fixture/cases/hard-constraint/task.md b/cells/agent-new-interview/fixture/cases/hard-constraint/task.md
new file mode 100644
index 00000000..5633176e
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/hard-constraint/task.md
@@ -0,0 +1 @@
+Review https://github.com/livestorejs/livestore/pull/1520 and report only evidence-backed blockers.
diff --git a/cells/agent-new-interview/fixture/cases/implementation/expected.json b/cells/agent-new-interview/fixture/cases/implementation/expected.json
new file mode 100644
index 00000000..d6c6cb22
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/implementation/expected.json
@@ -0,0 +1,13 @@
+{
+  "identity": "dotfiles.cos-misc.axe-40.implementation",
+  "goalTerms": ["implement", "test", "live"],
+  "references": ["https://github.com/compoundingtech/axe/issues/40"],
+  "trajectory": {
+    "harness": "codex",
+    "model": "gpt-5.6-sol",
+    "effort": "high",
+    "persona": "generalist",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
diff --git a/cells/agent-new-interview/fixture/cases/implementation/hard-constraints.json b/cells/agent-new-interview/fixture/cases/implementation/hard-constraints.json
new file mode 100644
index 00000000..0967ef42
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/implementation/hard-constraints.json
@@ -0,0 +1 @@
+{}
diff --git a/cells/agent-new-interview/fixture/cases/implementation/task.md b/cells/agent-new-interview/fixture/cases/implementation/task.md
new file mode 100644
index 00000000..bc29100b
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/implementation/task.md
@@ -0,0 +1 @@
+Implement https://github.com/compoundingtech/axe/issues/40 end to end in the dotfiles repo, including tests and live verification.
diff --git a/cells/agent-new-interview/fixture/cases/investigation/expected.json b/cells/agent-new-interview/fixture/cases/investigation/expected.json
new file mode 100644
index 00000000..5d61fdf0
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/investigation/expected.json
@@ -0,0 +1,13 @@
+{
+  "identity": "st2.main.issue-106.investigation",
+  "goalTerms": ["investigate", "evidence", "read-only"],
+  "references": ["https://github.com/compoundingtech/st2/issues/106"],
+  "trajectory": {
+    "harness": "claude",
+    "model": "claude-sonnet-5",
+    "effort": "medium",
+    "persona": "explorer",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
diff --git a/cells/agent-new-interview/fixture/cases/investigation/hard-constraints.json b/cells/agent-new-interview/fixture/cases/investigation/hard-constraints.json
new file mode 100644
index 00000000..0967ef42
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/investigation/hard-constraints.json
@@ -0,0 +1 @@
+{}
diff --git a/cells/agent-new-interview/fixture/cases/investigation/task.md b/cells/agent-new-interview/fixture/cases/investigation/task.md
new file mode 100644
index 00000000..fe918ff0
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/investigation/task.md
@@ -0,0 +1 @@
+Investigate https://github.com/compoundingtech/st2/issues/106 read-only and report the evidence, tradeoffs, and a recommended next step without changing code.
diff --git a/cells/agent-new-interview/fixture/cases/small-fix/expected.json b/cells/agent-new-interview/fixture/cases/small-fix/expected.json
new file mode 100644
index 00000000..942ef9a9
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/small-fix/expected.json
@@ -0,0 +1,13 @@
+{
+  "identity": "dotfiles.cos-misc.readme-typo.fix",
+  "goalTerms": ["typo", "readme", "test"],
+  "references": [],
+  "trajectory": {
+    "harness": "codex",
+    "model": "gpt-5.6-sol",
+    "effort": "medium",
+    "persona": "generalist",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  }
+}
diff --git a/cells/agent-new-interview/fixture/cases/small-fix/hard-constraints.json b/cells/agent-new-interview/fixture/cases/small-fix/hard-constraints.json
new file mode 100644
index 00000000..0967ef42
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/small-fix/hard-constraints.json
@@ -0,0 +1 @@
+{}
diff --git a/cells/agent-new-interview/fixture/cases/small-fix/task.md b/cells/agent-new-interview/fixture/cases/small-fix/task.md
new file mode 100644
index 00000000..c61df2c0
--- /dev/null
+++ b/cells/agent-new-interview/fixture/cases/small-fix/task.md
@@ -0,0 +1 @@
+Fix the typo in the dotfiles README heading and add the smallest regression check; there are no external references.
diff --git a/cells/agent-new-interview/fixture/interviewer/CLAUDE.md b/cells/agent-new-interview/fixture/interviewer/CLAUDE.md
index d3a79ea4..5dde2047 100644
--- a/cells/agent-new-interview/fixture/interviewer/CLAUDE.md
+++ b/cells/agent-new-interview/fixture/interviewer/CLAUDE.md
@@ -1 +1,2 @@
 @PERSONA.md
+@PROTOCOL.md
diff --git a/cells/agent-new-interview/fixture/interviewer/PERSONA.md b/cells/agent-new-interview/fixture/interviewer/PERSONA.md
index 88a6d70b..51a950e8 100644
--- a/cells/agent-new-interview/fixture/interviewer/PERSONA.md
+++ b/cells/agent-new-interview/fixture/interviewer/PERSONA.md
@@ -1,48 +1 @@
-# Session-creation interviewer
-
-You are the short-lived, no-edit interviewer behind `axe agent new`. Your only
-job is to turn the request in your st2 inbox into one typed semantic creation
-intent. You never author KDL, launch another provider, select an account, or
-edit the referenced repository.
-
-Keep the interview minimal. If the request already determines a useful goal,
-workspace, and trajectory, do not ask a redundant question. Inspect
-`references/issue-40.md` for the hermetic snapshot behind the GitHub reference.
-
-For this scenario, derive:
-
-- identity `dotfiles.axe.issue-40.implementation`;
-- workspace `/workspace/dotfiles`;
-- a concise goal preserving end-to-end implementation, tests, and live
-  verification;
-- the GitHub issue URL as the reference;
-- `codex`, `gpt-5.6-sol`, `high`, and `generalist` for implementation work;
-- fixed `managed-unattended` mode and `managed-v1` boot contract.
-
-Submit semantic intent through the deterministic boundary exactly once:
-
-```sh
-./submit-intent <<'JSON'
-{
-  "schema": "axe.agent-creation-intent.v1",
-  "decision": "commit",
-  "identity": "...",
-  "workspace": "...",
-  "goal": "...",
-  "references": ["..."],
-  "trajectory": {
-    "harness": "...",
-    "model": "...",
-    "effort": "...",
-    "persona": "...",
-    "mode": "managed-unattended",
-    "boot": "managed-v1"
-  }
-}
-JSON
-```
-
-If validation rejects the intent, correct the semantic record and resubmit.
-After a successful submission, reply once to the requester over st2 and cite
-the committed identity and trajectory. Pipe the reply body through stdin using
-a quoted heredoc delimiter; never place message text inline in a shell command.
+@.st2/PERSONA.md
diff --git a/cells/agent-new-interview/fixture/interviewer/PROTOCOL.md b/cells/agent-new-interview/fixture/interviewer/PROTOCOL.md
new file mode 100644
index 00000000..7221058d
--- /dev/null
+++ b/cells/agent-new-interview/fixture/interviewer/PROTOCOL.md
@@ -0,0 +1,32 @@
+# Eval transaction protocol
+
+This fixture supplies the deterministic submission seam of the enclosing
+creation transaction. Read `hard-constraints.json`; every present value is a
+human constraint and must be preserved exactly. The transaction already owns
+the current workspace, so workspace is not model output.
+
+Submit exactly one closed payload with `./submit-intent` on stdin:
+
+```json
+{
+  "schema": "axe.agent-creation-intent.v1",
+  "decision": "commit",
+  "identity": "<four-segment-purpose-identity>",
+  "goal": "<non-empty-goal>",
+  "references": [],
+  "trajectory": {
+    "harness": "claude|codex",
+    "model": "<profile model>",
+    "effort": "medium|high",
+    "persona": "<profile persona>",
+    "mode": "managed-unattended",
+    "boot": "managed-v1"
+  },
+  "supervisor": "<optional policy-valid identity>"
+}
+```
+
+`supervisor` is optional. Unknown fields, account pins, provider argv, KDL,
+catalog paths, and lifecycle fields are forbidden. Do not wait for a second
+request when the one-sentence input and references already determine a useful
+intent.
diff --git a/cells/agent-new-interview/fixture/interviewer/references/issue-106.md b/cells/agent-new-interview/fixture/interviewer/references/issue-106.md
new file mode 100644
index 00000000..01b241b3
--- /dev/null
+++ b/cells/agent-new-interview/fixture/interviewer/references/issue-106.md
@@ -0,0 +1,6 @@
+# Frozen issue snapshot
+
+URL: https://github.com/compoundingtech/st2/issues/106
+
+Question: prove the safest lifecycle and publication boundary for zero-flag
+managed session creation without changing code during the investigation.
diff --git a/cells/agent-new-interview/fixture/interviewer/references/pr-1520.md b/cells/agent-new-interview/fixture/interviewer/references/pr-1520.md
new file mode 100644
index 00000000..d3b4c1dd
--- /dev/null
+++ b/cells/agent-new-interview/fixture/interviewer/references/pr-1520.md
@@ -0,0 +1,5 @@
+# Frozen pull request snapshot
+
+URL: https://github.com/livestorejs/livestore/pull/1520
+
+Scope: review the proposed change and report only evidence-backed blockers.
diff --git a/cells/agent-new-interview/fixture/interviewer/render-intent.sh b/cells/agent-new-interview/fixture/interviewer/render-intent.sh
index a8f1cf33..5fef7be0 100755
--- a/cells/agent-new-interview/fixture/interviewer/render-intent.sh
+++ b/cells/agent-new-interview/fixture/interviewer/render-intent.sh
@@ -3,36 +3,67 @@ set -euo pipefail
 
 input="${1:?intent path required}"
 out="${2:?output root required}"
+workspace="${3:?transaction-owned workspace required}"
+constraints="${4:?hard constraints required}"
+
+case "$workspace" in
+  /*) ;;
+  *) echo "workspace must be an absolute transaction input" >&2; exit 1 ;;
+esac
+if [[ "$workspace" == *$'\n'* || "$workspace" == *'"'* ]]; then
+  echo "workspace cannot be represented in canonical KDL" >&2
+  exit 1
+fi
 
 jq -e '
   type == "object" and
-  (keys | sort) == ([
-    "decision", "goal", "identity", "references", "schema", "trajectory", "workspace"
-  ] | sort) and
+  ((keys | sort) == ([
+    "decision", "goal", "identity", "references", "schema", "trajectory"
+  ] | sort) or (keys | sort) == ([
+    "decision", "goal", "identity", "references", "schema", "supervisor", "trajectory"
+  ] | sort)) and
   .schema == "axe.agent-creation-intent.v1" and
   .decision == "commit" and
-  (.identity | test("^[a-z0-9][a-z0-9.-]*[a-z0-9]$")) and
-  (.workspace | test("^/[-A-Za-z0-9._/+:]+$")) and
+  (.identity | test("^[a-z0-9-]+\\.[a-z0-9-]+\\.[a-z0-9-]+\\.[a-z0-9-]+$")) and
   (.goal | type == "string" and length > 0 and test("[\"\\n\\r]") | not) and
-  (.references | type == "array" and length > 0 and
+  (.references | type == "array" and
     all(.[]; type == "string" and test("^https://github\\.com/"))) and
+  ((has("supervisor") | not) or
+    (.supervisor | type == "string" and test("^[a-z0-9][a-z0-9.-]*[a-z0-9]$"))) and
   (.trajectory | type == "object") and
   (.trajectory | keys | sort) == ([
     "boot", "effort", "harness", "mode", "model", "persona"
   ] | sort) and
   .trajectory.mode == "managed-unattended" and
   .trajectory.boot == "managed-v1" and
-  .trajectory.persona == "generalist" and
-  .trajectory.harness == "codex" and
-  .trajectory.model == "gpt-5.6-sol" and
-  .trajectory.effort == "high"
+  (.trajectory.persona | type == "string" and length > 0) and
+  (
+    (.trajectory.harness == "codex" and .trajectory.model == "gpt-5.6-sol") or
+    (.trajectory.harness == "claude" and .trajectory.model == "claude-sonnet-5")
+  ) and
+  (.trajectory.effort == "medium" or .trajectory.effort == "high")
 ' "$input" >/dev/null
 
 identity="$(jq -r .identity "$input")"
-workspace="$(jq -r .workspace "$input")"
+harness="$(jq -r .trajectory.harness "$input")"
+model="$(jq -r .trajectory.model "$input")"
+effort="$(jq -r .trajectory.effort "$input")"
+persona="$(jq -r .trajectory.persona "$input")"
 goal="$(jq -r .goal "$input")"
+supervisor="$(jq -r '.supervisor // empty' "$input")"
 target="$out/agents/evalhost/$identity"
 
+jq -e --slurpfile intent "$input" '
+  type == "object" and
+  (keys | all(. == "harness" or . == "model" or . == "effort" or
+    . == "persona" or . == "supervisor")) and
+  ((has("harness") | not) or .harness == $intent[0].trajectory.harness) and
+  ((has("model") | not) or .model == $intent[0].trajectory.model) and
+  ((has("effort") | not) or .effort == $intent[0].trajectory.effort) and
+  ((has("persona") | not) or .persona == $intent[0].trajectory.persona) and
+  ((has("supervisor") | not) or .supervisor == $intent[0].supervisor)
+' "$constraints" >/dev/null
+
 mkdir -p "$target/resources/inbox"
 cp "$input" "$out/intent.json"
 
@@ -41,6 +72,9 @@ cp "$input" "$out/intent.json"
   printf '  identity "%s"\n' "$identity"
   printf '  host "evalhost"\n'
   printf '  workspace "%s"\n\n' "$workspace"
+  if [ -n "$supervisor" ]; then
+    printf '  supervisor "%s"\n\n' "$supervisor"
+  fi
   printf '  restart {\n'
   printf '    attempts 3\n'
   printf '    interval "60s"\n'
@@ -49,14 +83,15 @@ cp "$input" "$out/intent.json"
   printf '  }\n\n'
   printf '  env {\n'
   printf '    AGENT_LAUNCH_HOSTED "1"\n'
-  printf '    AGENT_PERSONA "generalist"\n'
+  printf '    AGENT_PERSONA "%s"\n' "$persona"
   printf '    AGENT_RUNTIME_PROFILE "/etc/coding-agents/profile.json"\n'
   printf '    ST_AGENT "evalhost.%s"\n' "$identity"
   printf '  }\n\n'
-  printf '  argv "/nix/store/axe/bin/axe" "agent" "launch" "--harness" "codex" "--model" "gpt-5.6-sol" "--effort" "high" "--persona" "generalist" "--mode" "managed-unattended" "--boot" "managed-v1"\n'
+  printf '  argv "/nix/store/axe/bin/axe" "agent" "launch" "--harness" "%s" "--model" "%s" "--effort" "%s" "--persona" "%s" "--mode" "managed-unattended" "--boot" "managed-v1"\n' \
+    "$harness" "$model" "$effort" "$persona"
   printf '  ding\n\n'
   printf '  render {\n'
-  printf '    copy "_templates/generalist.md" ".st2/PERSONA.md"\n'
+  printf '    copy "_templates/%s.md" ".st2/PERSONA.md"\n' "$persona"
   printf '    copy "_templates/bus.st2.md" ".st2/bus.md"\n'
   printf '    git-exclude ".st2/"\n'
   printf '  }\n'
diff --git a/cells/agent-new-interview/fixture/interviewer/submit-intent b/cells/agent-new-interview/fixture/interviewer/submit-intent
index ff7b6bc6..c147d20a 100755
--- a/cells/agent-new-interview/fixture/interviewer/submit-intent
+++ b/cells/agent-new-interview/fixture/interviewer/submit-intent
@@ -4,5 +4,5 @@ set -euo pipefail
 tmp="$(mktemp)"
 trap 'rm -f -- "$tmp"' EXIT
 cat >"$tmp"
-bash ./render-intent.sh "$tmp" ./result
+bash ./render-intent.sh "$tmp" ./result "$PWD" ./hard-constraints.json
 printf 'committed %s\n' "$(jq -r .identity ./result/intent.json)"
diff --git a/cells/agent-new-interview/fixture/prepare-interviewer-worktree.sh b/cells/agent-new-interview/fixture/prepare-interviewer-worktree.sh
index 9d9abdeb..a523d97a 100755
--- a/cells/agent-new-interview/fixture/prepare-interviewer-worktree.sh
+++ b/cells/agent-new-interview/fixture/prepare-interviewer-worktree.sh
@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Eval fixtures are hermetic data. Ambient user/system Git policy, identities,
+# hooks, and aliases must not participate in their synthetic commits.
+export GIT_CONFIG_GLOBAL=/dev/null
+export GIT_CONFIG_NOSYSTEM=1
+
 workspace="${1:-./interviewer}"
 [ -d "$workspace" ] || {
   echo "interviewer workspace does not exist: $workspace" >&2
diff --git a/cells/agent-new-interview/fixture/publish-interviewer.sh b/cells/agent-new-interview/fixture/publish-interviewer.sh
index a5534a8b..94c1ffba 100755
--- a/cells/agent-new-interview/fixture/publish-interviewer.sh
+++ b/cells/agent-new-interview/fixture/publish-interviewer.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+case_name="${1:-implementation}"
 profile="${AGENT_RUNTIME_PROFILE:-$HOME/.config/coding-agents/profile.json}"
 case "$profile" in
   /*) ;;
@@ -11,7 +12,7 @@ case "$profile" in
 esac
 
 adapter="$(jq -er '.agentSpec.adapterBin | select(type == "string" and startswith("/"))' "$profile")"
-persona_source="$(jq -er '.personas.prompts.generalist | select(type == "string" and startswith("/"))' "$profile")"
+persona_source="$(jq -er '.personas.prompts["session-creator"] | select(type == "string" and startswith("/"))' "$profile")"
 for path in "$profile" "$adapter" "$persona_source"; do
   case "$path" in
     *[!A-Za-z0-9_./+-]*)
@@ -21,9 +22,14 @@ for path in "$profile" "$adapter" "$persona_source"; do
   esac
 done
 
-mkdir -p ./agents/evalhost/interviewer ./_templates
-cp "$persona_source" ./_templates/generalist.md
+case "$case_name" in
+  implementation|small-fix|investigation|hard-constraint) ;;
+  *) echo "unknown paid interview case: $case_name" >&2; exit 2 ;;
+esac
+mkdir -p ./agents/evalhost/global.coding-agents.session-creation.interview-eval ./_templates
+cp "$persona_source" ./_templates/session-creator.md
+cp "./cases/$case_name/hard-constraints.json" ./interviewer/hard-constraints.json
 sed \
   -e "s|@PROFILE@|$profile|" \
   -e "s|@ADAPTER@|$adapter|" \
-  ./agent.kdl.template >./agents/evalhost/interviewer/agent.kdl
+  ./agent.kdl.template >./agents/evalhost/global.coding-agents.session-creation.interview-eval/agent.kdl
diff --git a/cells/agent-new-interview/judges/grade-case.sh b/cells/agent-new-interview/judges/grade-case.sh
new file mode 100755
index 00000000..b411f856
--- /dev/null
+++ b/cells/agent-new-interview/judges/grade-case.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+case_name="${1:?case name required}"
+mode="${2:?grade mode required}"
+root="${CATALOG:?CATALOG required}"
+result="$root/interviewer/result"
+intent="$result/intent.json"
+expected="$root/cases/$case_name/expected.json"
+constraints="$root/interviewer/hard-constraints.json"
+
+identity="$(jq -er .identity "$expected")"
+target="$result/agents/evalhost/$identity"
+kdl="$target/agent.kdl"
+inbox="$target/resources/inbox/0001-session-goal.md"
+
+case "$mode" in
+  structural)
+    jq -e '
+      type == "object" and
+      ((keys | sort) == ([
+        "decision", "goal", "identity", "references", "schema", "trajectory"
+      ] | sort) or (keys | sort) == ([
+        "decision", "goal", "identity", "references", "schema", "supervisor", "trajectory"
+      ] | sort)) and
+      .schema == "axe.agent-creation-intent.v1" and
+      .decision == "commit" and
+      (.identity | test("^[a-z0-9-]+\\.[a-z0-9-]+\\.[a-z0-9-]+\\.[a-z0-9-]+$")) and
+      (.references | type == "array") and
+      (.trajectory | keys | sort) == ([
+        "boot", "effort", "harness", "mode", "model", "persona"
+      ] | sort) and
+      .trajectory.mode == "managed-unattended" and
+      .trajectory.boot == "managed-v1" and
+      ((has("account") or has("provider_argv") or has("workspace") or has("kdl")) | not)
+    ' "$intent" >/dev/null
+    jq -e --slurpfile intent "$intent" '
+      ((has("harness") | not) or .harness == $intent[0].trajectory.harness) and
+      ((has("model") | not) or .model == $intent[0].trajectory.model) and
+      ((has("effort") | not) or .effort == $intent[0].trajectory.effort) and
+      ((has("persona") | not) or .persona == $intent[0].trajectory.persona) and
+      ((has("supervisor") | not) or .supervisor == $intent[0].supervisor)
+    ' "$constraints" >/dev/null
+    ;;
+  semantic)
+    jq -e --slurpfile expected "$expected" --argjson intent "$(cat "$intent")" '
+      .identity == $expected[0].identity and
+      .references == $expected[0].references and
+      .trajectory == $expected[0].trajectory and
+      ((($expected[0] | has("supervisor")) | not) or
+        .supervisor == $expected[0].supervisor) and
+      all($expected[0].goalTerms[]; . as $term |
+        ($intent.goal | ascii_downcase | contains($term)))
+    ' "$intent" >/dev/null
+    ;;
+  bundle)
+    test -s "$kdl"
+    grep -Fqx "  identity \"$identity\"" "$kdl"
+    grep -Fqx '  host "evalhost"' "$kdl"
+    grep -Fqx "  workspace \"$root/interviewer\"" "$kdl"
+    harness="$(jq -r .trajectory.harness "$expected")"
+    model="$(jq -r .trajectory.model "$expected")"
+    effort="$(jq -r .trajectory.effort "$expected")"
+    persona="$(jq -r .trajectory.persona "$expected")"
+    grep -Fqx "  argv \"/nix/store/axe/bin/axe\" \"agent\" \"launch\" \"--harness\" \"$harness\" \"--model\" \"$model\" \"--effort\" \"$effort\" \"--persona\" \"$persona\" \"--mode\" \"managed-unattended\" \"--boot\" \"managed-v1\"" "$kdl"
+    ;;
+  inbox)
+    test -s "$inbox"
+    goal="$(jq -r .goal "$intent")"
+    grep -Fqx "Goal: $goal" "$inbox"
+    while IFS= read -r reference; do
+      grep -Fqx -- "- $reference" "$inbox"
+    done < <(jq -r '.references[]' "$intent")
+    ;;
+  boundary)
+    test "$(find "$root/interviewer" -type f -name '*.kdl' | wc -l)" -eq 1
+    ! grep -Eq 'argv "(claude|codex|opencode|pi)"|--account|goal|references|github\.com' "$kdl"
+    ;;
+  *)
+    echo "unknown grade mode: $mode" >&2
+    exit 2
+    ;;
+esac
diff --git a/cells/agent-new-interview/judges/grade.sh b/cells/agent-new-interview/judges/grade.sh
index 8ad3279d..eb4f9c2c 100755
--- a/cells/agent-new-interview/judges/grade.sh
+++ b/cells/agent-new-interview/judges/grade.sh
@@ -2,50 +2,13 @@
 set -euo pipefail
 
 mode="${1:?grade mode required}"
-root="${CATALOG:?CATALOG required}"
-result="$root/interviewer/result"
-intent="$result/intent.json"
-identity="dotfiles.axe.issue-40.implementation"
-target="$result/agents/evalhost/$identity"
-kdl="$target/agent.kdl"
-inbox="$target/resources/inbox/0001-session-goal.md"
-
 case "$mode" in
   intent)
-    jq -e '
-      .schema == "axe.agent-creation-intent.v1" and
-      .decision == "commit" and
-      .identity == "dotfiles.axe.issue-40.implementation" and
-      .workspace == "/workspace/dotfiles" and
-      (.goal | test("implement"; "i") and test("test"; "i") and test("live"; "i")) and
-      .references == ["https://github.com/compoundingtech/axe/issues/40"] and
-      .trajectory == {
-        "harness": "codex",
-        "model": "gpt-5.6-sol",
-        "effort": "high",
-        "persona": "generalist",
-        "mode": "managed-unattended",
-        "boot": "managed-v1"
-      }
-    ' "$intent" >/dev/null
-    ;;
-  bundle)
-    grep -Fqx "  identity \"$identity\"" "$kdl"
-    grep -Fqx '  host "evalhost"' "$kdl"
-    grep -Fqx '  workspace "/workspace/dotfiles"' "$kdl"
-    grep -Fqx '    AGENT_LAUNCH_HOSTED "1"' "$kdl"
-    grep -Fqx "    ST_AGENT \"evalhost.$identity\"" "$kdl"
-    grep -Fqx '  argv "/nix/store/axe/bin/axe" "agent" "launch" "--harness" "codex" "--model" "gpt-5.6-sol" "--effort" "high" "--persona" "generalist" "--mode" "managed-unattended" "--boot" "managed-v1"' "$kdl"
-    grep -Fqx '    copy "_templates/generalist.md" ".st2/PERSONA.md"' "$kdl"
-    ;;
-  inbox)
-    grep -Eiq '^Goal: .*implement.*test.*live' "$inbox"
-    grep -Fqx -- '- https://github.com/compoundingtech/axe/issues/40' "$inbox"
+    bash ./judges/grade-case.sh implementation structural
+    bash ./judges/grade-case.sh implementation semantic
     ;;
-  boundary)
-    test "$(find "$root/interviewer" -type f -name '*.kdl' | wc -l)" -eq 1
-    ! jq -e 'has("account") or has("provider_argv")' "$intent" >/dev/null
-    ! grep -Eq 'argv "(claude|codex|opencode|pi)"|--account|goal|references|github\.com' "$kdl"
+  bundle|inbox|boundary)
+    bash ./judges/grade-case.sh implementation "$mode"
     ;;
   *)
     echo "unknown grade mode: $mode" >&2
diff --git a/cells/agent-new-interview/task.md b/cells/agent-new-interview/task.md
deleted file mode 100644
index 7a4c74e3..00000000
--- a/cells/agent-new-interview/task.md
+++ /dev/null
@@ -1 +0,0 @@
-Please create a managed coding-agent session to implement https://github.com/compoundingtech/axe/issues/40 end to end in the dotfiles repo, including tests and live verification.
diff --git a/cells/signal-rename-codex/fixture/materialize.sh b/cells/signal-rename-codex/fixture/materialize.sh
index 9c738e23..bee15fcf 100755
--- a/cells/signal-rename-codex/fixture/materialize.sh
+++ b/cells/signal-rename-codex/fixture/materialize.sh
@@ -7,6 +7,10 @@
 # integration resolve with ZERO node_modules) but commits only its lane. Clones carry absolute origin URLs, so
 # this must run at eval time (a static fixture can't).
 set -euo pipefail
+# Keep synthetic fixture Git operations independent of the invoking agent's
+# identity, hooks, and system/user configuration.
+export GIT_CONFIG_GLOBAL=/dev/null
+export GIT_CONFIG_NOSYSTEM=1
 SB="${CATALOG:?CATALOG must be set — st2 eval provides it to run steps}"
 cd "$SB"
 GRAPH="$SB/seed-graph"           # copied in from the fixture
diff --git a/cells/signal-rename/fixture/materialize.sh b/cells/signal-rename/fixture/materialize.sh
index 7002c283..292ac58f 100755
--- a/cells/signal-rename/fixture/materialize.sh
+++ b/cells/signal-rename/fixture/materialize.sh
@@ -6,6 +6,10 @@
 # FULL workspace (so the relative _signal.js shims + the integration resolve with ZERO node_modules) but commits
 # only its lane. Clones carry absolute origin URLs, so this must run at eval time (a static fixture can't).
 set -euo pipefail
+# Keep synthetic fixture Git operations independent of the invoking agent's
+# identity, hooks, and system/user configuration.
+export GIT_CONFIG_GLOBAL=/dev/null
+export GIT_CONFIG_NOSYSTEM=1
 SB="${CATALOG:?CATALOG must be set — st2 eval provides it to run steps}"
 cd "$SB"
 GRAPH="$SB/seed-graph"           # copied in from the fixture
diff --git a/cells/weird-git-setup/fixture/setup-megarepo.sh b/cells/weird-git-setup/fixture/setup-megarepo.sh
index f2e83309..bc851784 100755
--- a/cells/weird-git-setup/fixture/setup-megarepo.sh
+++ b/cells/weird-git-setup/fixture/setup-megarepo.sh
@@ -5,6 +5,10 @@
 # they must be built IN PLACE at run time; a static `copy "./fixture"` (with _git→.git) cannot preserve the
 # bare↔worktree linkage. Deterministic, offline, public-safe (no real repo/operator tokens).
 set -euo pipefail
+# Keep synthetic fixture Git operations independent of the invoking agent's
+# identity, hooks, and system/user configuration.
+export GIT_CONFIG_GLOBAL=/dev/null
+export GIT_CONFIG_NOSYSTEM=1
 SB="${CATALOG:?CATALOG must be set — st2 eval provides it to run steps}"
 cd "$SB"
 SEED="$SB/.seed"
diff --git a/docs/vrs/spec.md b/docs/vrs/spec.md
index 1168e83c..ad85402a 100644
--- a/docs/vrs/spec.md
+++ b/docs/vrs/spec.md
@@ -78,49 +78,57 @@ and continues or stops.
 
 ## Human session-creation handoff
 
-The `agent-new-interview` and `agent-new-bundle-contract` cells split the
-human-facing creation workflow at one typed seam:
+The four `agent-new-interview*` cells, `agent-new-bundle-contract`,
+`agent-new-confirmation-contract`, and `agent-new-creation-lifecycle` split the
+human-facing creation workflow at typed judgment, projection, confirmation, and
+lifecycle seams:
 
 ```text
 one-sentence human request
   -> short-lived interviewer
   -> axe.agent-creation-intent.v1
+  -> deterministic summary + explicit human confirmation (pre-DQ1 fallback)
   -> deterministic Agent Spec + initial inbox Resource
+  -> staged retirement, publication, and exact final attachment
 ```
 
-- **R01-R05:** The paid cell evaluates interviewer judgment from a frozen
-  one-sentence request and local GitHub-reference snapshot. The model-free cell
-  evaluates the renderer contract across multiple intents and closed-input
-  failures. Held-out mutation controls reject raw provider argv, drift between
-  intent and KDL, and missing initial context.
-- **R06-R09:** The judgment cell uses one explicitly pinned Claude Sonnet agent
-  at medium effort and a five-minute cell timeout. The deterministic cell has
-  no model agent and a one-minute timeout. Normal st2 eval cleanup and receipt
-  policy applies to both.
-- The interviewer output is semantic intent, not KDL. Stable launch axes are
-  explicit in that intent; the deterministic boundary owns canonical KDL,
-  keeps account selection out of durable state, and places the goal and
-  references in an initial inbox Resource.
-- The renderer accepts workspace values only from a closed absolute-path
-  alphabet and rejects invalid input before creating an Agent Spec. A
-  model-free malicious-workspace control gates both renderers against KDL
-  injection.
-- The temporary interviewer itself launches through typed
+- **R01-R05:** Four isolated, paid, presently unrun cells evaluate the exact
+  runtime-profile `session-creator` prompt against one-sentence large
+  implementation, small-fix, read-only investigation, and explicit
+  hard-constraint inputs. Expected outputs live only in held-out judges. The
+  model-free bundle cell evaluates the renderer across multiple intents and
+  closed-input failures. Held-out controls reject raw provider argv, drift
+  between intent and KDL, missing initial context, model-owned workspace,
+  invalid supervisors, and hard-constraint override.
+- **R06-R09:** Each judgment cell uses one explicitly pinned Claude Sonnet
+  agent at medium effort and a five-minute timeout. They must run sequentially
+  under the normal paid-run authorization and receipt policy. The deterministic
+  cells have no model agent.
+- The interviewer output is semantic intent, not KDL. Axe, not model judgment,
+  owns the transaction workspace. Stable launch axes and an optional supervisor
+  are explicit in the intent; references may be empty. The deterministic
+  boundary owns canonical KDL, keeps account selection out of durable state,
+  and places the goal and references in an initial inbox Resource.
+- The renderer accepts workspace only as a transaction-owned absolute-path
+  argument and rejects a model payload containing `workspace` before creating
+  an Agent Spec. A model-free malicious-workspace control gates both renderers
+  against KDL injection.
+- The temporary session creator itself launches through typed
   `axe agent launch` with explicit harness, model, effort, persona, mode, and
   boot axes. The cell does not pin `--account`: Axe selects an eligible
   account per run. Corpus inventory, model policy, lifecycle, and harness
   checks recognize this typed launch as a paid model agent and reject durable
   account pins.
-- The paid cell uses st2's explicit `canonical-agents` seam. A deterministic
+- Each paid cell uses st2's explicit `canonical-agents` seam. A deterministic
   pre-admission run first creates the copied interviewer workspace as a clean,
   deterministic Git worktree. A second run reads the active runtime profile
-  and publishes one canonical interviewer declaration with its exact immutable
+  and publishes one canonical session-creator declaration with its exact immutable
   Axe adapter, absolute profile path, and canonical persona source. st2 then
   carries that declaration unchanged through strict validation,
   warning-free materialization, launch, kickoff routing, singleton completion,
   and teardown. No compact eval agent, compatibility wrapper, account pin, or
   ambient provider launch participates.
-- The paid cell is environment-bound to that explicit runtime-profile
+- Each paid cell is environment-bound to that explicit runtime-profile
   artifact; the artifact identity belongs in run evidence and results are not
   represented as hermetic across different profiles.
 - One structured model-agent inventory is authoritative for both compact eval agents
@@ -142,20 +150,26 @@ one-sentence human request
   workspace was not a Git worktree. It reached no account selection, provider
   readiness, trust behavior, judge, or verdict and left no catalog or process
   residue. It cannot be represented as provider evidence.
-- Passing model-free evidence proves the bundle boundary and its negative
-  controls only. The autonomous-selection claim remains unaccepted until the
-  paid judgment cell has a structured PASS receipt.
-- **Future R04 lifecycle cell:** the eventual model-free recovery discriminator
-  must operate on a real canonical temporary interviewer declaration and its
-  durable transaction records. Its crash mutation removes only the temporary
-  agent's main PTY generation. The DING sidecar may be live, stale, or already
-  absent at that observation boundary, so its state is explicitly
-  indeterminate and cannot be a gating proxy for interviewer liveness. The
-  durable retired tombstone remains the authority that prevents resurrection;
-  recovery must adopt or complete the exact transaction without a second final
-  agent or inbox publication. This cell is deferred to a pinned st2 successor
-  that exposes the required lifecycle boundary. A fake shell stand-in would
-  not prove the contract and is not part of this PR.
+- The model-free confirmation cell freezes the safe pre-threshold fallback:
+  a valid intent and rendered summary are insufficient; explicit human
+  confirmation alone authorizes final publication. Reject, EOF, or Ctrl-C
+  retires the temporary declaration, retains its tombstone, and publishes no
+  final declaration.
+- Passing model-free evidence proves only its named structural boundary. The
+  autonomous-selection claim remains unaccepted until DQ1 selects a measured
+  threshold and every required paid and model-free cell has a structured
+  accepted receipt.
+- The successor-gated lifecycle cell is present but intentionally unrun. It
+  requires exact immutable Axe and model-free-driver inputs and must operate on
+  a real canonical temporary declaration and durable transaction records. Its
+  cases cover success, crash before retirement, crash after retirement, crash
+  after final publication, cancellation versus process failure, single-flight
+  recovery, exact final attachment, and exactly-once final context. Main-PTY
+  absence is the publication gate; Ding state remains explicitly indeterminate.
+  Held-out mutations reject tombstone loss, a Ding proxy, duplicate final
+  publication, and attachment to the wrong identity. A shell stand-in is not
+  admissible, so the cell must fail before claiming a result until the successor
+  artifact and driver are pinned.
 
 The owner updates this spec with the corpus. Changing
 [vision.md](./vision.md) or [requirements.md](./requirements.md) requires
diff --git a/evidence/harness-exclusions.tsv b/evidence/harness-exclusions.tsv
index acbf8d0e..21f6f67b 100644
--- a/evidence/harness-exclusions.tsv
+++ b/evidence/harness-exclusions.tsv
@@ -1,5 +1,7 @@
 cell	surface	reason
 agent-new-bundle-contract	cell	deterministic semantic-intent lowering and mutation probe; no harness agent
+agent-new-confirmation-contract	cell	deterministic pre-threshold human-confirmation boundary; no harness agent
+agent-new-creation-lifecycle	cell	successor-gated real Axe lifecycle matrix with no provider model
 canonical-agent-runtime-smoke	cell	deterministic canonical Agent Spec boot, kickoff, reply, and teardown probe; no harness agent
 context-resource-continuity	cell	deterministic native context/resource restart probe; no harness agent
 docs	judge:cold-reader	one-shot offline Claude print grader; no bus identity, DING, or hook surface

From 8b683077440da9d50ebdab87904747adf8c3001e Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Fri, 31 Jul 2026 02:01:26 +0200
Subject: [PATCH 12/12] evals: distinguish PTY detach from Ctrl-C

agent-session-id: dev3.dotfiles-cos-misc-agent-runtime-simplification
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.config/coding-agents/profile.json
agent-skills-manifest: /nix/store/nk9iml2841l1yjjg0f6f0d3y60zkg1nn-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@4a0515f
---
 cells/agent-new-confirmation-contract/README.md  |  9 ++++++---
 .../agent-new-confirmation-contract.kdl          | 14 ++++++++++----
 .../fixture/apply-confirmation.sh                | 15 +++++++++++++--
 .../judges/grade.sh                              | 14 +++++++++++++-
 .../judges/mutation-check.sh                     | 10 +++++++++-
 cells/agent-new-creation-lifecycle/README.md     |  5 ++++-
 .../agent-new-creation-lifecycle.kdl             | 16 +++++++++++-----
 .../fixture/inspect-case.sh                      | 16 +++++++++++++++-
 .../agent-new-creation-lifecycle/judges/grade.sh |  6 ++++--
 .../judges/mutation-check.sh                     |  5 +++++
 docs/vrs/spec.md                                 | 13 ++++++++-----
 11 files changed, 98 insertions(+), 25 deletions(-)

diff --git a/cells/agent-new-confirmation-contract/README.md b/cells/agent-new-confirmation-contract/README.md
index 2a6c8bdc..df271dd3 100644
--- a/cells/agent-new-confirmation-contract/README.md
+++ b/cells/agent-new-confirmation-contract/README.md
@@ -3,8 +3,11 @@
 This model-free cell freezes the safe DQ1 fallback while autonomous interview
 commit is not admitted. A valid semantic intent is rendered and summarized, but
 the final bundle cannot be published until the human explicitly confirms that
-summary. Rejection, EOF, or Ctrl-C retires the temporary declaration, retains
-its tombstone, and publishes no final declaration. Merely having a valid intent
-is not commit authority.
+summary. Rejection, EOF, a clean `pty attach` detach (Ctrl+\), or an externally
+delivered SIGINT/exit 130 retires the temporary declaration, retains its
+tombstone, and publishes no final declaration. Because attach runs the terminal
+in raw mode, a terminal Ctrl-C byte (`0x03`) is forwarded to the managed session
+and is not local cancellation. Merely having a valid intent is not commit
+authority.
 
 This cell does not claim that autonomous no-confirmation behavior is accepted.
diff --git a/cells/agent-new-confirmation-contract/agent-new-confirmation-contract.kdl b/cells/agent-new-confirmation-contract/agent-new-confirmation-contract.kdl
index 1b520f21..8f7ec82b 100644
--- a/cells/agent-new-confirmation-contract/agent-new-confirmation-contract.kdl
+++ b/cells/agent-new-confirmation-contract/agent-new-confirmation-contract.kdl
@@ -15,8 +15,14 @@ eval {
   run "eof" {
     command "bash ./apply-confirmation.sh eof ./out/eof"
   }
-  run "sigint" {
-    command "bash ./apply-confirmation.sh sigint ./out/sigint"
+  run "clean-detach" {
+    command "bash ./apply-confirmation.sh clean-detach ./out/clean-detach"
+  }
+  run "external-sigint" {
+    command "bash ./apply-confirmation.sh external-sigint ./out/external-sigint"
+  }
+  run "terminal-ctrl-c" {
+    command "bash ./apply-confirmation.sh terminal-ctrl-c ./out/terminal-ctrl-c"
   }
 
   judges {
@@ -26,10 +32,10 @@ eval {
     judge "PENDING — a valid intent and rendered summary alone publish nothing" {
       exec "bash ./judges/grade.sh pending"
     }
-    judge "CANCEL — reject, EOF, and Ctrl-C retain retired tombstones and publish no final bundle" {
+    judge "CANCEL — reject, EOF, clean detach, and external SIGINT retire without publication" {
       exec "bash ./judges/grade.sh cancelled"
     }
-    judge "NEGATIVE CONTROLS — missing confirmation, missing tombstone, and false cancellation fail" {
+    judge "NEGATIVE CONTROLS — terminal Ctrl-C stays forwarded; missing confirmation, tombstone, and false cancellation fail" {
       exec "bash ./judges/mutation-check.sh"
     }
   }
diff --git a/cells/agent-new-confirmation-contract/fixture/apply-confirmation.sh b/cells/agent-new-confirmation-contract/fixture/apply-confirmation.sh
index 27b085e5..5f20d533 100755
--- a/cells/agent-new-confirmation-contract/fixture/apply-confirmation.sh
+++ b/cells/agent-new-confirmation-contract/fixture/apply-confirmation.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-response="${1:?confirm|pending|reject|eof|sigint required}"
+response="${1:?confirm|pending|reject|eof|clean-detach|external-sigint|terminal-ctrl-c required}"
 out="${2:?output root required}"
 temporary="$out/agents/dev3/global.coding-agents.session-creation.interview-eval"
 final="$out/agents/dev3/dotfiles.cos-misc.axe-40.implementation"
@@ -50,10 +50,21 @@ case "$response" in
   pending)
     printf '%s\n' awaiting-confirmation >"$out/outcome"
     ;;
-  reject|eof|sigint)
+  reject|eof)
     write_temporary '#true'
     printf '%s\n' cancelled >"$out/outcome"
     ;;
+  clean-detach)
+    write_temporary '#true'
+    printf '%s\n' cancelled-clean-detach >"$out/outcome"
+    ;;
+  external-sigint)
+    write_temporary '#true'
+    printf '%s\n' cancelled-external-sigint-exit-130 >"$out/outcome"
+    ;;
+  terminal-ctrl-c)
+    printf '%s\n' terminal-input-0x03-forwarded >"$out/outcome"
+    ;;
   *)
     echo "unsupported confirmation response: $response" >&2
     exit 2
diff --git a/cells/agent-new-confirmation-contract/judges/grade.sh b/cells/agent-new-confirmation-contract/judges/grade.sh
index d4269a41..2c625a51 100755
--- a/cells/agent-new-confirmation-contract/judges/grade.sh
+++ b/cells/agent-new-confirmation-contract/judges/grade.sh
@@ -27,12 +27,24 @@ case "$mode" in
     test ! -e "$out/$final_rel"
     ;;
   cancelled)
-    for name in rejected eof sigint; do
+    for name in rejected eof; do
       out="$root/$name"
       retired "$out"
       grep -Fqx cancelled "$out/outcome"
       test ! -e "$out/$final_rel"
     done
+    out="$root/clean-detach"
+    retired "$out"
+    grep -Fqx cancelled-clean-detach "$out/outcome"
+    test ! -e "$out/$final_rel"
+    out="$root/external-sigint"
+    retired "$out"
+    grep -Fqx cancelled-external-sigint-exit-130 "$out/outcome"
+    test ! -e "$out/$final_rel"
+    out="$root/terminal-ctrl-c"
+    grep -Fqx '  retired #false' "$out/$temp_rel/agent.kdl"
+    grep -Fqx terminal-input-0x03-forwarded "$out/outcome"
+    test ! -e "$out/$final_rel"
     ;;
   *)
     echo "unknown grade mode: $mode" >&2
diff --git a/cells/agent-new-confirmation-contract/judges/mutation-check.sh b/cells/agent-new-confirmation-contract/judges/mutation-check.sh
index 6bab66f2..292b17d3 100755
--- a/cells/agent-new-confirmation-contract/judges/mutation-check.sh
+++ b/cells/agent-new-confirmation-contract/judges/mutation-check.sh
@@ -24,7 +24,7 @@ sed -i 's/retired #true/retired #false/' \
 expect_rejected no-tombstone confirmed
 
 mkdir -p "$scratch/cancel-published/out"
-for name in rejected eof sigint; do
+for name in rejected eof clean-detach external-sigint terminal-ctrl-c; do
   cp -a "$root/out/$name" "$scratch/cancel-published/out/$name"
 done
 cp -a \
@@ -32,4 +32,12 @@ cp -a \
   "$scratch/cancel-published/out/rejected/agents/dev3/"
 expect_rejected cancel-published cancelled
 
+mkdir -p "$scratch/ctrl-c-retired/out"
+for name in rejected eof clean-detach external-sigint terminal-ctrl-c; do
+  cp -a "$root/out/$name" "$scratch/ctrl-c-retired/out/$name"
+done
+sed -i 's/retired #false/retired #true/' \
+  "$scratch/ctrl-c-retired/out/terminal-ctrl-c/agents/dev3/global.coding-agents.session-creation.interview-eval/agent.kdl"
+expect_rejected ctrl-c-retired cancelled
+
 echo "PASS: confirmation mutations fail held-out graders"
diff --git a/cells/agent-new-creation-lifecycle/README.md b/cells/agent-new-creation-lifecycle/README.md
index 6f7eeacf..1c5c328a 100644
--- a/cells/agent-new-creation-lifecycle/README.md
+++ b/cells/agent-new-creation-lifecycle/README.md
@@ -16,5 +16,8 @@ Required run inputs:
 The cell covers success, three crash boundaries, cancellation versus process
 failure, single-flight recovery, retained tombstones, main-PTY gating with Ding
 state explicitly indeterminate, exactly-once final publication, and attachment
-to the exact final PTY. Until an exact successor supplies those inputs,
+to the exact final PTY. It distinguishes raw terminal Ctrl-C (`0x03`), which is
+forwarded and does not cancel, from the primary human cancellation path: a
+clean `pty attach` detach via Ctrl+\. External SIGINT/exit 130 is a separate
+secondary cancellation path. Until an exact successor supplies those inputs,
 `st2 eval` must fail before claiming a result.
diff --git a/cells/agent-new-creation-lifecycle/agent-new-creation-lifecycle.kdl b/cells/agent-new-creation-lifecycle/agent-new-creation-lifecycle.kdl
index 87dc2a9c..9e6eeee1 100644
--- a/cells/agent-new-creation-lifecycle/agent-new-creation-lifecycle.kdl
+++ b/cells/agent-new-creation-lifecycle/agent-new-creation-lifecycle.kdl
@@ -15,8 +15,14 @@ eval {
   run "crash-post-publish" {
     command "bash ./run-case.sh crash-post-publish ./out/crash-post-publish"
   }
-  run "cancel" {
-    command "bash ./run-case.sh cancel ./out/cancel"
+  run "clean-detach" {
+    command "bash ./run-case.sh clean-detach ./out/clean-detach"
+  }
+  run "external-sigint" {
+    command "bash ./run-case.sh external-sigint ./out/external-sigint"
+  }
+  run "terminal-ctrl-c" {
+    command "bash ./run-case.sh terminal-ctrl-c ./out/terminal-ctrl-c"
   }
   run "process-crash-before-intent" {
     command "bash ./run-case.sh process-crash-before-intent ./out/process-crash-before-intent"
@@ -32,13 +38,13 @@ eval {
     judge "RECOVERY — every crash boundary resumes without duplicate final context" {
       exec "bash ./judges/grade.sh recovery"
     }
-    judge "CANCEL VS CRASH — human cancellation retires; process failure remains active and recoverable" {
-      exec "bash ./judges/grade.sh cancel-crash"
+    judge "CANCEL VS INPUT VS CRASH — detach and external SIGINT retire; Ctrl-C is forwarded; process failure recovers" {
+      exec "bash ./judges/grade.sh cancellation-input-crash"
     }
     judge "SINGLE FLIGHT — concurrent resumer is busy and takeover resumes after owner death" {
       exec "bash ./judges/grade.sh concurrency"
     }
-    judge "NEGATIVE CONTROLS — missing tombstone, Ding proxy, duplicate publication, and wrong attach fail" {
+    judge "NEGATIVE CONTROLS — Ctrl-C cancellation, missing tombstone, Ding proxy, duplicate publication, and wrong attach fail" {
       exec "bash ./judges/mutation-check.sh"
     }
   }
diff --git a/cells/agent-new-creation-lifecycle/fixture/inspect-case.sh b/cells/agent-new-creation-lifecycle/fixture/inspect-case.sh
index b315b63d..9f7f7075 100755
--- a/cells/agent-new-creation-lifecycle/fixture/inspect-case.sh
+++ b/cells/agent-new-creation-lifecycle/fixture/inspect-case.sh
@@ -13,9 +13,23 @@ test "$(find "$final_root" -type f -name agent.kdl 2>/dev/null | wc -l)" -le 1
 test "$(find "$final_root/resources/inbox" -type f 2>/dev/null | wc -l)" -le 1
 
 case "$scenario" in
-  cancel)
+  clean-detach)
     grep -Fqx '  retired #true' "$temp"
     test ! -e "$final_root"
+    grep -Fqx $'termination\tclean-detach' "$trace"
+    grep -Fqx $'attach-exit\t0' "$trace"
+    ;;
+  external-sigint)
+    grep -Fqx '  retired #true' "$temp"
+    test ! -e "$final_root"
+    grep -Fqx $'termination\texternal-sigint' "$trace"
+    grep -Fqx $'attach-exit\t130' "$trace"
+    ;;
+  terminal-ctrl-c)
+    grep -Fqx '  retired #false' "$temp"
+    test ! -e "$final_root"
+    grep -Fqx $'terminal-input\t0x03-forwarded' "$trace"
+    grep -Fqx $'attach-state\tattached' "$trace"
     ;;
   process-crash-before-intent)
     grep -Fqx '  retired #false' "$temp"
diff --git a/cells/agent-new-creation-lifecycle/judges/grade.sh b/cells/agent-new-creation-lifecycle/judges/grade.sh
index 4efc0aa6..5964f28d 100755
--- a/cells/agent-new-creation-lifecycle/judges/grade.sh
+++ b/cells/agent-new-creation-lifecycle/judges/grade.sh
@@ -17,8 +17,10 @@ case "$mode" in
     grade_case crash-post-retire
     grade_case crash-post-publish
     ;;
-  cancel-crash)
-    grade_case cancel
+  cancellation-input-crash)
+    grade_case clean-detach
+    grade_case external-sigint
+    grade_case terminal-ctrl-c
     grade_case process-crash-before-intent
     ;;
   concurrency)
diff --git a/cells/agent-new-creation-lifecycle/judges/mutation-check.sh b/cells/agent-new-creation-lifecycle/judges/mutation-check.sh
index 76e9d1ca..1ac84af6 100755
--- a/cells/agent-new-creation-lifecycle/judges/mutation-check.sh
+++ b/cells/agent-new-creation-lifecycle/judges/mutation-check.sh
@@ -35,4 +35,9 @@ sed -i 's/attached\tdev3\\.dotfiles\\.cos-misc\\.axe-40\\.implementation/attache
   "$scratch/wrong-attach/trace.tsv"
 expect_rejected wrong-attach success
 
+cp -a "$root/out/terminal-ctrl-c" "$scratch/ctrl-c-cancellation"
+sed -i 's/retired #false/retired #true/' \
+  "$scratch/ctrl-c-cancellation/$temp_rel"
+expect_rejected ctrl-c-cancellation terminal-ctrl-c
+
 echo "PASS: lifecycle mutations fail held-out inspectors"
diff --git a/docs/vrs/spec.md b/docs/vrs/spec.md
index ad85402a..5466e83a 100644
--- a/docs/vrs/spec.md
+++ b/docs/vrs/spec.md
@@ -152,9 +152,11 @@ one-sentence human request
   residue. It cannot be represented as provider evidence.
 - The model-free confirmation cell freezes the safe pre-threshold fallback:
   a valid intent and rendered summary are insufficient; explicit human
-  confirmation alone authorizes final publication. Reject, EOF, or Ctrl-C
+  confirmation alone authorizes final publication. Reject, EOF, a clean
+  `pty attach` detach via Ctrl+\, or externally delivered SIGINT/exit 130
   retires the temporary declaration, retains its tombstone, and publishes no
-  final declaration.
+  final declaration. Attach uses raw terminal mode, so terminal Ctrl-C byte
+  `0x03` is forwarded to the managed session and is not local cancellation.
 - Passing model-free evidence proves only its named structural boundary. The
   autonomous-selection claim remains unaccepted until DQ1 selects a measured
   threshold and every required paid and model-free cell has a structured
@@ -163,9 +165,10 @@ one-sentence human request
   requires exact immutable Axe and model-free-driver inputs and must operate on
   a real canonical temporary declaration and durable transaction records. Its
   cases cover success, crash before retirement, crash after retirement, crash
-  after final publication, cancellation versus process failure, single-flight
-  recovery, exact final attachment, and exactly-once final context. Main-PTY
-  absence is the publication gate; Ding state remains explicitly indeterminate.
+  after final publication, clean detach and external-SIGINT cancellation versus
+  forwarded terminal Ctrl-C and process failure, single-flight recovery, exact
+  final attachment, and exactly-once final context. Main-PTY absence is the
+  publication gate; Ding state remains explicitly indeterminate.
   Held-out mutations reject tombstone loss, a Ding proxy, duplicate final
   publication, and attachment to the wrong identity. A shell stand-in is not
   admissible, so the cell must fail before claiming a result until the successor