Status: PASS / LIVE_FAIL_CLOSED / PRODUCTION_NO_GO

Runtime: R9-ISOLATED-AUTH-PROVENANCE.

Defect found: the live relay had advanced from R8/V2 acceptance to R9/V4, but acceptance_selftest.ts and README.md still asserted the old R8 contract. The resulting ACCEPTANCE_RUNTIME_REVISION_MISMATCH was verification/documentation drift, not evidence of a runtime regression.

Reconciliation updates the test to the active V4 contract: R9 provenance capabilities, bootstrap schema v3, plugin 1.2.0, isolated CODEX_HOME, regular auth.json copy, user/project/global config isolation, approval=never, read-only codex exec, exact launcher byte/hash binding, V1/V2/V3 superseded by V4, current V4 challenge/deadline, audit chain and fail-closed final ChatGPT ACK boundary.

Evaluation 01a04c01-f25b-726b-889a-f27badcf3e2a — PASS.

Observed live state:

• launcher 5.1;
• launcher SHA-256 8ced417e29c746410ba7a12e62832c5e8a4896b3ea535ca90a67f9a8b9ea852e;
• exact downloaded-byte binding PASS;
• active lane CODEX_REAL_RUNTIME_ACCEPTANCE_V4;
• state PENDING_CODEX_ACK;
• mechanical checks false;
• lane revision 1;
• checkpoint 2e65b96eea80b8aaa4a7bbf737f02131851e8f38c87519a7ba6ec3d7fad7e03c;
• audit chain PASS;
• production_go=false.

Static reconciliation audit: PASS. No synthetic Codex ACK was created and no merge/deploy/product-production authority was changed.

A second audit found documentation/prompt drift inside the served Python launcher: the active immutable challenge is V4 but the Codex instruction string still said "REAL CODEX RUNTIME ACCEPTANCE V3 ONLY." The verifier itself was V4-bound, so this was not a false PASS, but it was an avoidable semantic contradiction.

R9.1 fixes the prompt to V4 and explicitly adds plugin name/version to the required model bindings.

Promoted launcher candidate:

• version: 5.1
• SHA-256: 8ced417e29c746410ba7a12e62832c5e8a4896b3ea535ca90a67f9a8b9ea852e
• bytes: 20536

A public Windows wrapper was also added:

• path: /v1/bootstrap/codex-device.ps1
• SHA-256: 65545541e8973b275a23068b38a033cccc58f09d0b83a895b03626626b256d92
• bytes: 3443
• embedded credentials: none
• behavior: verifies local Codex + Python, live metadata and downloaded Python hash/length, runs --preflight-only before starting device pairing.

Branch-local handler regression: PASS for health, metadata, Python endpoint, Windows endpoint, legacy supersession, active V4 PENDING_CODEX_ACK, zero live Codex ACK/response, zero active device tokens, and audit-chain PASS.

Production remains NO_GO and no synthetic V4 Codex evidence was created.

Promoted to main and revalidated on the live endpoint.

• main acceptance selftest evaluation: 01a04c4c-c875-741a-acbc-1695ab645eb5 — PASS
• Python launcher: 5.1, SHA-256 8ced417e29c746410ba7a12e62832c5e8a4896b3ea535ca90a67f9a8b9ea852e, 20536 bytes
• Windows launcher: SHA-256 65545541e8973b275a23068b38a033cccc58f09d0b83a895b03626626b256d92, 3443 bytes
• Windows endpoint exact downloaded-byte binding: PASS
• active V4 state: PENDING_CODEX_ACK
• V1/V2/V3: superseded by V4
• live Codex ACKs: 0
• live Codex responses: 0
• active device tokens: 0
• pending pairings: 0
• audit chain: PASS, 88 events, tail efe388793d70ce9d3fe81ea467603cb2207c8610d5d865a6e0c4951c6046e3c6
• continuity watcher dynamically followed the new launcher hash and remained non-urgent
• Remote Desktop devices: 0

No synthetic Codex acceptance evidence was created. production_go=false.