Date: 2026-08-28/29 UTC Scope: GPT↔Codex continuity relay / real-runtime acceptance verification only Baseline reconciled: main branch version 37 (R3-GUARD merge) Production: NO_GO

The durable CURRENT V6 correctly required one real Codex runtime execution but had no live read-only endpoint that converted the exact acceptance-lane evidence into an explicit fail-closed state machine.

R4 adds that verifier without changing the acceptance challenge, issuing an ACK, creating a message, consuming pairing, authorizing a project action or promoting production.

R3-GUARD was detected as a concurrent same-scope mutation after the earlier relay baseline was read. It was reconciled before R4 edits.

R4 preserves:

• external R2 authorizer;
• one-time-token ledger;
• exact PR/base/head/package/evidence binding;
• merge authorization disabled unless separately enabled;
• production_go=false.

GET /v1/acceptance/CODEX_REAL_RUNTIME_ACCEPTANCE_V1

Authorization: GPT or admin bearer only. Mutation behavior: none.

Fail-closed states:

• CHALLENGE_NOT_PROVEN
• AMBIGUOUS_CHALLENGE_SET
• CHALLENGE_CONTRACT_MISMATCH
• PENDING_CODEX_ACK
• PENDING_CODEX_RESPONSE
• AMBIGUOUS_MULTIPLE_CODEX_RESPONSES
• INVALID_CODEX_RESPONSE
• PENDING_CHATGPT_ACK
• PASS_RUNTIME_ROUNDTRIP

PASS requires:

1. exactly one stored GPT→Codex acceptance challenge;
2. challenge contract contains all seven declared acceptance requirements;
3. exact Codex ACK bound to challenge message id + message SHA-256;
4. exactly one Codex→GPT reverse response;
5. exact challenge nonce;
6. valid SHA-256 syntax for local plugin manifest and local runtime receipt;
7. exact final GPT ACK bound to reverse message id + message SHA-256.

PENDING_CHATGPT_ACK keeps manual semantic review explicit. PASS proves only continuity transport/runtime binding; it never grants project production authorization.

Self-test file: acceptance_selftest.ts Self-test file version: 45 Evaluation ID: 01a04b59-7aa6-74ed-a388-865ee2e1437c Result: PASS

Observed:

• implementation_revision = R4-ACCEPTANCE-GUARD
• unauthenticated acceptance request = HTTP 401
• authenticated acceptance state = PENDING_CODEX_ACK
• mechanical_checks_passed = false
• lane revision = 1
• lane checkpoint SHA-256 = d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962
• audit_chain_ok = true
• audit event count at release test = 29
• production_go = false

Exact challenge:

• message id = f7ca12d8-226a-43b9-9fc0-bd9ede8548af
• message SHA-256 = 70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979
• acked_at = null

Real pairing:

• pairing id codex-v4 rows observed = 0
• therefore production pairing is NOT_ISSUED / NOT_CONFIRMED.

• main.tsx = version 40
• README.md = version 44
• acceptance_selftest.ts = version 45
• R3_GUARD_RELEASE.md = version 37

SECOND_BRAIN_CONTINUITY_CURRENT_V6 remains semantically correct for the gate:

• actual Codex runtime requires one real execution;
• full federated runtime remains NO_GO until real Codex response and final ChatGPT ACK.

Its relay implementation label is now stale relative to the live relay because R3-GUARD and R4-ACCEPTANCE-GUARD were promoted afterward. This release evidence is an append-only live implementation delta; it does not silently rewrite the durable CURRENT pointer.

R4_IMPLEMENTATION = PASS_LIVE R4_SELFTEST = PASS AUDIT_CHAIN = PASS REAL_CODEX_PAIRING_V4 = NOT_PROVEN REAL_CODEX_ACK = NOT_PROVEN REAL_CODEX_RESPONSE = NOT_PROVEN FINAL_CHATGPT_ACK = NOT_PROVEN FULL_FEDERATED_RUNTIME = NO_GO PRODUCTION = NO_GO

The only valid next promotion event is a real user Codex/local runtime:

1. performs V4 pairing/bootstrap;
2. consumes this exact challenge;
3. ACKs this exact challenge id + SHA-256;
4. publishes one reverse response with the same nonce plus local manifest/runtime receipt SHA-256 values;
5. then ChatGPT performs semantic review and exact final ACK.

No simulation, static package, activation ZIP, self-test or prepared launcher may substitute for that receipt.