fix: close post-merge Codex provenance, recovery and OCI review debt

.github/workflows/online-bridge.yml

@@ -6,6 +6,12 @@ on:
       - 'tests/lichess/**'
       - 'scripts/qualify-online-bridge.py'
       - 'scripts/prepare-online3b-wheels.py'
+      - 'scripts/sanitize_qualification_evidence.py'
+      - 'scripts/http_evidence_verdict.py'
+      - 'scripts/qualify-online-recovery.py'
+      - 'scripts/verify_source_closure.py'
+      - 'qualification/http-evidence-contract-v1.json'
+      - 'qualification/online-recovery-v1.json'
       - 'qualification/online-bridge-v1.json'
       - '.github/workflows/online-bridge.yml'
       - 'Makefile'

.github/workflows/online-recovery-v2.yml

@@ -6,6 +6,23 @@ on:
       - 'tests/lichess/**'
       - 'tests/fixtures/lichess/**'
       - 'scripts/qualify-online-recovery-v2.py'
+      - 'scripts/qualify-online-recovery.py'
+      - 'scripts/http_evidence_verdict.py'
+      - 'scripts/sanitize_qualification_evidence.py'
+      - 'scripts/verify_assurance_contract.py'
+      - 'scripts/verify_source_closure.py'
+      - 'qualification/assurance-contract-v1.json'
+      - 'qualification/http-evidence-contract-v1.json'
+      - 'qualification/schemas/**'
+      - 'scripts/release-manifest.py'
+      - 'scripts/package-online.py'
+      - 'scripts/build-online-engine-opt-v2.sh'
+      - 'scripts/qualify-engine-opt-v2.py'
+      - 'scripts/prepare-online3b-wheels.py'
+      - 'scripts/ci-install-apt-deps.sh'
+      - 'Makefile'
+      - 'deploy/bin/**'
+      - 'qualification/online-recovery-v1.json'
       - 'qualification/online-recovery-v2.json'
       - '.github/workflows/online-recovery-v2.yml'
       - 'docs/ONLINE_4B_RECOVERY.md'
@@ -136,6 +153,7 @@ jobs:
 
   independent-guarded-qualification:
     needs: guarded-integration
+    if: ${{ always() }}
     runs-on: ubuntu-24.04
     timeout-minutes: 16
     steps:
@@ -147,17 +165,29 @@ jobs:
       - name: Install independent chess oracle
         run: |
           bash scripts/ci-install-apt-deps.sh python3-pip python3-venv
-          python3 -m pip install --break-system-packages 'chess==1.11.2'
+          python3 -m pip install --break-system-packages 'chess==1.11.2' 'PyYAML==6.0.3'
+      - name: Verify independent exact-source worktree before importing recovery code
+        run: |
+          set -euo pipefail
+          VERIFIED="$RUNNER_TEMP/online4b-verified-${GITHUB_RUN_ID}"
+          git worktree add --detach "$VERIFIED" "$ALLFATHER_SOURCE_SHA"
+          test "$(git -C "$VERIFIED" rev-parse HEAD)" = "$ALLFATHER_SOURCE_SHA"
+          git -C "$VERIFIED" diff --exit-code
+          python3 "$VERIFIED/scripts/verify_source_closure.py" \
+            --profile online-recovery-v2 --source-sha "$ALLFATHER_SOURCE_SHA"
+          python3 "$VERIFIED/deploy/lichess/fetch_bridge.py"
+          echo "ONLINE4B_VERIFIED_ROOT=$VERIFIED" >> "$GITHUB_ENV"
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        continue-on-error: true
         with:
           name: online4b-guarded-raw-evidence
           path: build/test-results/online-recovery-v2
       - name: Independently qualify guarded safety and restart continuation
         run: |
-          python3 scripts/qualify-online-recovery-v2.py \
-            --evidence build/test-results/online-recovery-v2 \
+          python3 "$ONLINE4B_VERIFIED_ROOT/scripts/qualify-online-recovery-v2.py" \
+            --evidence "$GITHUB_WORKSPACE/build/test-results/online-recovery-v2" \
             --source-sha "$ALLFATHER_SOURCE_SHA" \
-            --output build/test-results/online4b-verdict/report.json
+            --output "$GITHUB_WORKSPACE/build/test-results/online4b-verdict/report.json"
       - name: Summarize containment versus recovery claims
         if: always()
         run: |

.github/workflows/online-recovery.yml

@@ -6,6 +6,20 @@ on:
       - 'tests/lichess/**'
       - 'tests/fixtures/lichess/**'
       - 'scripts/qualify-online-recovery.py'
+      - 'scripts/http_evidence_verdict.py'
+      - 'scripts/sanitize_qualification_evidence.py'
+      - 'scripts/verify_assurance_contract.py'
+      - 'scripts/verify_source_closure.py'
+      - 'qualification/assurance-contract-v1.json'
+      - 'qualification/http-evidence-contract-v1.json'
+      - 'qualification/schemas/**'
+      - 'scripts/release-manifest.py'
+      - 'scripts/package-online.py'
+      - 'scripts/build-online-engine-opt-v2.sh'
+      - 'scripts/qualify-engine-opt-v2.py'
+      - 'scripts/ci-install-apt-deps.sh'
+      - 'Makefile'
+      - 'deploy/bin/**'
       - 'qualification/online-recovery-v1.json'
       - '.github/workflows/online-recovery.yml'
       - 'docs/ONLINE_4_RECOVERY.md'
@@ -133,6 +147,7 @@ jobs:
 
   independent-recovery-evidence:
     needs: offline-fault-integration
+    if: ${{ always() }}
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
@@ -146,15 +161,26 @@ jobs:
           bash scripts/ci-install-apt-deps.sh python3-pip python3-venv
           python3 -m pip install --break-system-packages 'chess==1.11.2'
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        continue-on-error: true
         with:
           name: online4a-raw-evidence
           path: build/test-results/online-recovery-v1
+      - name: Establish Git-committed independent verifier source before imports
+        run: |
+          set -euo pipefail
+          VERIFIED="$RUNNER_TEMP/online4a-verified-${GITHUB_RUN_ID}"
+          git worktree add --detach "$VERIFIED" "$ALLFATHER_SOURCE_SHA"
+          test "$(git -C "$VERIFIED" rev-parse HEAD)" = "$ALLFATHER_SOURCE_SHA"
+          git -C "$VERIFIED" diff --exit-code
+          python3 "$VERIFIED/scripts/verify_source_closure.py" \
+            --profile online-recovery-v1 --source-sha "$ALLFATHER_SOURCE_SHA"
+          echo "ONLINE4A_VERIFIED_ROOT=$VERIFIED" >> "$GITHUB_ENV"
       - name: Independently reconstruct commits and fault witnesses
         run: |
-          python3 scripts/qualify-online-recovery.py \
-            --evidence build/test-results/online-recovery-v1 \
+          python3 "$ONLINE4A_VERIFIED_ROOT/scripts/qualify-online-recovery.py" \
+            --evidence "$GITHUB_WORKSPACE/build/test-results/online-recovery-v1" \
             --source-sha "$ALLFATHER_SOURCE_SHA" \
-            --output build/test-results/online4a-verdict/report.json
+            --output "$GITHUB_WORKSPACE/build/test-results/online4a-verdict/report.json"
       - name: Publish diagnostic qualification summary
         if: always()
         run: |