feat(proof): fail-closed evidence battery for Codex 2x cold-resume fixture

.osc/plans/done/173-codex-token-efficiency-proof-amendment-1.md

@@ -0,0 +1,23 @@
+# Amendment 1: 173-codex-token-efficiency-proof
+
+## Parent
+
+173-codex-token-efficiency-proof
+
+## Date
+
+2026-06-18
+
+## Learning
+
+The Codex 2x cold-resume fixture is useful but too easy to over-read: it currently proves one bounded token-efficiency decision, while the next proof-battery work needs to make adjacent non-claims impossible to accidentally promote. Human-reviewer replication, controlled ablations, and cold-resume packet quality should be first-class, source-labeled fixture metadata even when their status is `not_demonstrated` or `mixed_not_proven`.
+
+## New direction
+
+Harden the checked-in proof surface by adding a fail-closed evidence-battery layer to proof manifests. The current Codex fixture may still pass only for its stated source-labeled 2x cold-resume claim, but its report must also disclose which evidence items are required for that pass and which adjacent claims are explicitly outside the pass gate: human-reviewer replication, controlled ablations, and broader fixture coverage. Add a cold-resume packet contract so the compact packet's required fields are mechanically named and source-linked instead of implied by prose.
+
+## Impact on acceptance criteria
+
+- AC1 and AC3 gain a stricter source-labeling requirement: the Codex fixture must include evidence-battery entries and a cold-resume packet contract that point only to committed, public-safe local fixture files.
+- AC4 gains explicit non-claim disclosures: human-reviewer replication and controlled ablations must be represented as `not_demonstrated` / `mixed_not_proven` evidence entries unless and until real receipts exist.
+- AC5 expands from targeted proof tests to include fail-closed evidence-battery validation, package-payload coverage for the new fixture sources, and docs that keep the Codex 2x claim bounded.

.osc/plans/active/173-codex-token-efficiency-proof.md → .osc/plans/done/173-codex-token-efficiency-proof.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-active
+done
 
 ## Context
 
@@ -40,11 +40,11 @@ and uses at least 2x fewer Codex-reported total tokens than the naked Codex lane
 
 ## Acceptance criteria
 
-- [ ] `osc prove compare examples/proof/codex-token-efficient-resume/manifest.json --format markdown` reports PASS with a token metric ratio of at least 2x.
-- [ ] If a proof manifest sets a minimum ratio that is not met, `compareProofManifest` marks the bounded proof as failed/inconclusive.
-- [ ] The new fixture's live Codex receipts are source-labeled, committed, and include enough usage data to recompute the medians.
-- [ ] Public docs say exactly what the 2x fixture proves and what it does not prove.
-- [ ] Targeted tests and the full project test suite pass.
+- [x] `osc prove compare examples/proof/codex-token-efficient-resume/manifest.json --format markdown` reports PASS with a token metric ratio of at least 2x. Evidence: `examples/proof/codex-token-efficient-resume/manifest.json`, `examples/proof/codex-token-efficient-resume/receipts/aggregate.json`, `.osc/releases/2026-06-18-173-codex-token-efficiency-proof.md`.
+- [x] If a proof manifest sets a minimum ratio that is not met, `compareProofManifest` marks the bounded proof as failed/inconclusive. Evidence: `src/compare.ts`, `tests/proof.test.ts`, `.osc/releases/2026-06-18-173-codex-token-efficiency-proof.md`.
+- [x] The new fixture's live Codex receipts are source-labeled, committed, and include enough usage data to recompute the medians. Evidence: `examples/proof/codex-token-efficient-resume/receipts/aggregate.json`, `examples/proof/codex-token-efficient-resume/receipts/control-r1.json`, `examples/proof/codex-token-efficient-resume/receipts/scaffolded-r1.json`.
+- [x] Public docs say exactly what the 2x fixture proves and what it does not prove. Evidence: `docs/PROOF_HARNESS.md`, `docs/SCHEMA_REGISTRY.md`, `examples/proof/codex-token-efficient-resume/evidence/human-reviewer-replication-boundary.md`, `examples/proof/codex-token-efficient-resume/evidence/controlled-ablations-boundary.md`.
+- [x] Targeted tests and the full project test suite pass. Evidence: `tests/proof.test.ts`, `tests/package-payload.test.ts`, `.osc/releases/2026-06-18-173-codex-token-efficiency-proof.md`.
 
 ## Verification steps
 

.osc/releases/2026-06-18-173-codex-token-efficiency-proof.md

@@ -0,0 +1,40 @@
+# Release / Evidence Note: 173-codex-token-efficiency-proof
+
+## Summary
+
+Hardened the Codex 2x cold-resume proof fixture with fail-closed evidence-battery rows, explicit non-claim disclosures for human-reviewer replication and controlled ablations, and a cold-resume packet contract recorded in the aggregate receipt. The bounded Codex 2x claim remains source-labeled to committed receipts and still does not claim broad workload dominance, human replication, release, merge, publish, deployment, or compliance approval.
+
+## Traceability
+
+- Roadmap / issue / task: owner prompt to strengthen bounded proof battery; implemented through plan 173 amendment 1.
+- Plan: `.osc/plans/done/173-codex-token-efficiency-proof.md`.
+- Amendment: `.osc/plans/done/173-codex-token-efficiency-proof-amendment-1.md`.
+- Run ID / run packet: `N/A` — no runtime was spawned; this is a fixture/manifest/docs/test hardening slice over committed receipts.
+- Branch / PR: branch `proof-battery-hardening`; PR pending owner review.
+
+## Verification
+
+- `./verify.sh --quick --quiet && npm run osc -- resume --max-chars 12000` — exit 0; resumed active plan 173.
+- `node examples/proof/codex-token-efficient-resume/score-fixture.mjs --reuse-committed-receipts` — exit 0; regenerated `receipts/aggregate.json` and `manifest.json`; reported ratio `4.330033` with control tokens `137327` and scaffolded tokens `31715`.
+- `npm run osc -- prove check examples/proof/codex-token-efficient-resume/manifest.json` — PASS, `0 warning(s)`.
+- `npm run osc -- prove compare examples/proof/codex-token-efficient-resume/manifest.json --format markdown` — PASS; evidence battery pass; required rows `codex-2x-cold-resume-replicates` and `cold-resume-packet-contract` demonstrated; human-reviewer replication `not_demonstrated`; controlled ablations `mixed_not_proven`.
+- `npm test -- --run tests/proof.test.ts tests/package-payload.test.ts tests/public-positioning.test.ts tests/blueprint-mega.test.ts` — 4 files passed, 34 tests passed.
+- `npm run build` — exit 0 (`build:core` and `build:runtime-omx`).
+- `npm test` — 48 files passed, 541 tests passed.
+- `./verify.sh --strict` — 9 pass, 0 fail, 1 warn (`Plan immutability check skipped` in this git-worktree checkout).
+- `npm run osc -- doctor --check secret-scan` — PASS, no obvious token/webhook strings found.
+- `git diff --check` — exit 0.
+- Added-line public safety scan for names, private paths, Discord IDs, tokens/webhooks/secrets/API keys — no private identity/path/secret hit; benign matches were proof-token wording and fixture paths.
+
+## Outcome
+
+approval:
+  status: approved
+  rationale: Local plan closeout is approved for this branch because the source-labeled fixture hardening, docs, tests, build, proof compare/check, secret scan, and diff checks passed; this is not merge, publish, release, deployment, or compliance approval.
+
+The proof harness now renders an evidence-battery section in `osc prove compare`, validates every evidence-battery source ref with the same local/public-safe fail-closed rules as metric refs, and blocks `boundedProof` when a required item is not `demonstrated` or `reproduced`. The Codex cold-resume fixture records a packet-field contract and explicitly keeps human-reviewer replication and controlled ablation claims out of the PASS gate until real receipts exist.
+
+## Follow-up
+
+- Open PR / owner review / merge remain pending; no merge, publish, npm release, GitHub Release, deployment, or compliance approval happened.
+- Real human-reviewer replication and controlled ablation runs remain future source-labeled receipts, not current claims.

MISSION.md

@@ -53,6 +53,8 @@ One-line dated entries for every scope pivot. Format: `YYYY-MM-DD: <one-line piv
 
 <!-- append YYYY-MM-DD entries below this line -->
 - 2026-06-18: closed v1-public-positioning-polish — polished v1 public positioning and release-readiness boundaries
+- 2026-06-18: closed 173-codex-token-efficiency-proof — closed proof-battery hardening with fail-closed evidence battery and source-labeled Codex 2x fixture boundaries
+- 2026-06-18: Owner expanded proof-battery hardening: add source-labeled evidence-battery metadata for more fixtures, human-reviewer replication status, controlled ablation status, and cold-resume packet contract without broadening the Codex 2x claim. — see .osc/plans/done/173-codex-token-efficiency-proof-amendment-1.md
 - 2026-06-15: closed 172-public-readiness-package-sync — Published open-scaffold@0.32.1 to npm latest and created GitHub Release v0.32.1 as Latest.
 - 2026-06-15: closed public-readiness-hardening — hardened public readiness messaging
 - 2026-06-13: closed 171-capture-package-sync — Published open-scaffold@0.32.0 to npm latest and created GitHub Release v0.32.0 as Latest.

docs/PROOF_HARNESS.md

@@ -118,6 +118,25 @@ now target what a human reader needs from the answer: readability, comprehension
 clarity, enough decision detail, unambiguous resume routing, and explicit
 authority boundaries. It is not a blind human-reader study.
 
+The fixture now carries a fail-closed evidence battery in `manifest.json`:
+
+| Evidence item | Status | Required for PASS | Boundary |
+|---|---|---:|---|
+| `codex-2x-cold-resume-replicates` | `demonstrated` | yes | three read-only Codex replicates per arm for one paused-work decision |
+| `cold-resume-packet-contract` | `demonstrated` | yes | packet-field contract for this fixture only, not a universal resume schema |
+| `human-reviewer-replication` | `not_demonstrated` | no | no blind human-reader replication is claimed for this fixture |
+| `controlled-ablations` | `mixed_not_proven` | no | no minimal-checklist, packet-only, or alternate-packet ablation is claimed here |
+
+`osc prove compare` blocks the bounded PASS if any required evidence-battery item
+is not `demonstrated` or `reproduced`. Disclosure-only rows keep adjacent claims
+visible but cannot support the pass gate. A manifest with no `evidence_battery`
+rows reports `evidenceBatteryStatus: not_evaluated` (and `evidenceBatteryPass:
+null`) rather than `pass`, so the report never claims "passes required
+evidence-battery items" for a fixture that supplied no battery; it still does
+not block `boundedProof` on its own. The human-reviewer and ablation rows point at committed boundary files under
+`examples/proof/codex-token-efficient-resume/evidence/`; they are not substitutes
+for real receipts.
+
 ## Legacy evolution-controller fixture
 
 Before the Codex 2x cold-resume fixture, the first checked-in `osc prove`
@@ -191,7 +210,34 @@ A manifest declares the two arms and a set of metrics:
 }
 ```
 
-Required metric categories are `quality`, `tokens`, `speed`, and `evolution`. `osc prove check` fails when a category is missing or a source ref is missing/private.
+Required metric categories are `quality`, `tokens`, `speed`, and `evolution`. `osc prove check` fails when a category is missing or a source ref is missing/private. Optional `evidence_battery` rows make fixture/replication/ablation claims explicit:
+
+```json
+{
+  "evidence_battery": [
+    {
+      "id": "human-reviewer-replication",
+      "kind": "human_reviewer_replication",
+      "status": "not_demonstrated",
+      "required_for_pass": false,
+      "claim": "No blind human-reader replication is claimed for this fixture.",
+      "boundary": "Deterministic reader-usability scoring only until real human receipts exist.",
+      "source_refs": ["evidence/human-reviewer-replication-boundary.md"]
+    }
+  ]
+}
+```
+
+Evidence-battery `source_refs` follow the same fail-closed rules as metric sources: committed fixture-local files only, no URLs, no absolute paths, no parent escapes, and no private/runtime directories.
+
+A manifest-level `required_evidence` array (of evidence-battery IDs) protects against accidental omission: every listed ID must be *present* in `evidence_battery` and `demonstrated`/`reproduced`, or the gate blocks. This composes with per-row `required_for_pass` (which catches a present row being downgraded to `not_demonstrated`) so deletion and status-downgrade are both fail-closed.
+
+```json
+{
+  "required_evidence": ["codex-2x-cold-resume-replicates", "cold-resume-packet-contract"],
+  "evidence_battery": [ "..." ]
+}
+```
 
 ## Boundary
 
@@ -228,6 +274,9 @@ Core bench suites write `.osc/bench/<suite-id>/aggregate.json` and `.osc/bench/<
 | Claim | Status | Notes |
 |---|---|---|
 | Codex cold-resume 2x token-efficiency fixture passes `osc prove compare` | demonstrated | `examples/proof/codex-token-efficient-resume/`; median reported total tokens 137,327 vs 31,715, ratio 4.330033x, quality tied 6/6 on a deterministic human-facing reader-usability rubric |
+| Codex cold-resume evidence-battery required rows | demonstrated | required rows are `codex-2x-cold-resume-replicates` and `cold-resume-packet-contract`; either missing/not-demonstrated row makes `boundedProof=false` |
+| Codex fixture human-reviewer replication | not_demonstrated | explicitly disclosure-only; see `examples/proof/codex-token-efficient-resume/evidence/human-reviewer-replication-boundary.md` |
+| Codex fixture controlled ablations | mixed_not_proven | explicitly disclosure-only; no minimal-checklist/packet-only/alternate-packet ablation is claimed by the current fixture |
 | Legacy evolution-controller fixture passes `osc prove check` | demonstrated | `examples/proof/scaffold-vs-naked-codex/`; retained as a legacy example fixture, not the current headline result |
 | Legacy decision quality preserved (5/5 both arms) | demonstrated | committed receipts for `examples/proof/scaffold-vs-naked-codex/` |
 | Legacy prompt payload reduction (~11.6×) | demonstrated | committed receipts for `examples/proof/scaffold-vs-naked-codex/` |

docs/SCHEMA_REGISTRY.md

@@ -28,6 +28,8 @@ Use `osc schemas list --json` for the machine-readable list. Representative sche
 - `open-scaffold.audit-envelope.v1` — digest-only audit envelope for curated local artifacts.
 - `open-scaffold.evaluation.v1` — acceptance-criteria evaluation envelope scaffold / external scorer reference.
 - `open-scaffold.evolution-judgment-checkpoint.v1` — retry authorization gate built from evolution analysis plus optional independent judge input.
+- `open-scaffold.proof-comparison.v1` / `open-scaffold.proof-comparison-result.v1` — source-labeled proof manifests and computed comparison verdicts, including evidence-battery rows for fixture/replication/ablation status.
+- `open-scaffold.proof-aggregate.v1` — per-arm proof medians, derived deltas, quality-rubric metadata, and optional cold-resume packet contract.
 - `osc.ambient-work-record.v1` — post-hoc work record extracted from observed run facts so workers do not hand-write bookkeeping in-loop.
 - `osc.feedback.v1` and `osc.feedback-analysis.v1` — feedback records and repair hypotheses.
 - `osc.accepted-improvement.v1` — accepted lesson files for relevant future-run inheritance.

examples/proof/codex-token-efficient-resume/evidence/controlled-ablations-boundary.md

@@ -0,0 +1,22 @@
+# Controlled ablation boundary
+
+Status: `mixed_not_proven` / disclosure-only for this checked-in Codex 2x cold-resume fixture.
+
+What is demonstrated here: raw paused-session artifacts versus one Open Scaffold compact resume capsule for one paused-work decision, with three Codex replicates per arm and source-labeled receipts.
+
+What is not demonstrated here:
+
+- a minimal-checklist control;
+- a packet-only ablation that removes Open Scaffold framing while keeping the same compact facts;
+- alternate packet shapes or budgets;
+- a broad causal claim that Open Scaffold, rather than compact source facts for this task, caused all token savings.
+
+Minimum ablation packet before any ablation claim may pass:
+
+1. preregistered ablation arms and kill rules;
+2. equal model/runtime settings across arms;
+3. per-run usage receipts from trusted adapter metadata, not model text;
+4. answer artifacts and a scoring protocol that preserves quality ties as ties;
+5. aggregate report with exact reproduction enum: `reproduced`, `partially_reproduced`, or `not_reproduced`.
+
+Until those files exist for this fixture, ablation evidence cannot support the bounded PASS and must remain disclosure-only.

examples/proof/codex-token-efficient-resume/evidence/human-reviewer-replication-boundary.md

@@ -0,0 +1,17 @@
+# Human-reviewer replication boundary
+
+Status: `not_demonstrated` for this checked-in Codex 2x cold-resume fixture.
+
+What is demonstrated here: committed Codex receipts plus deterministic, human-facing reader-usability scoring over the answers in `../answers/`, summarized in `../receipts/aggregate.json`.
+
+What is not demonstrated here: blind human reviewers independently reconstructing the paused-work decision from with-record and without-record packets.
+
+Minimum source-labeled replication packet before this status may change:
+
+1. preregistered human-review protocol and answer key committed before review;
+2. blinded packet pair(s), reviewer instructions, and reviewer identity anonymization policy;
+3. raw reviewer responses or sanitized per-question receipts;
+4. grading script/output and aggregate accuracy/confabulation/cost or time summary;
+5. explicit boundary saying the result is human-reviewer replication for the named fixture only, not universal proof.
+
+Until those files exist, any human-reviewer claim must remain fail-closed as `not_demonstrated`.