diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b969ca2..87144dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,8 +32,12 @@ jobs:
         run: python3 scripts/check_compatibility_matrix.py --self-test
       - name: Check ORRO release state
         run: python3 scripts/check_orro_release_state.py
+      - name: Check ORRO engine dependency
+        run: python3 scripts/check_orro_engine_dependency.py
       - name: Release state self-test
         run: python3 scripts/check_orro_release_state.py --self-test
+      - name: Engine dependency self-test
+        run: python3 scripts/check_orro_engine_dependency.py --self-test
       - name: Check ORRO packaging decision
         run: python3 scripts/check_orro_packaging_decision.py
       - name: Check ORRO fallback policy
@@ -51,7 +55,7 @@ jobs:
       - name: Check ORRO wrapper distribution
         run: python3 scripts/check_orro_wrapper_distribution.py --json --allow-network
       - name: Compile scripts
-        run: python3 -m py_compile scripts/check_no_bidi_controls.py scripts/check_orro_repo_contract.py scripts/check_orro_language_boundaries.py scripts/check_orro_assurance_contract_fixtures.py scripts/check_orro_release_manifest.py scripts/check_compatibility_matrix.py scripts/check_orro_release_state.py scripts/check_orro_packaging_decision.py scripts/check_orro_fallback_policy.py scripts/check_orro_command_migration.py scripts/check_orro_removed_command_docs.py scripts/check_orro_command_migration_dry_run.py scripts/check_orro_wrapper.py scripts/check_orro_wrapper_install.py scripts/check_orro_wrapper_distribution.py scripts/orro_build_backend.py scripts/orro_e2e_smoke.py scripts/update_orro_engine_lock.py scripts/bootstrap_orro.py src/orro_wrapper/__init__.py src/orro_wrapper/__main__.py src/orro_wrapper/cli.py
+        run: python3 -m py_compile scripts/check_no_bidi_controls.py scripts/check_orro_repo_contract.py scripts/check_orro_language_boundaries.py scripts/check_orro_assurance_contract_fixtures.py scripts/check_orro_release_manifest.py scripts/check_compatibility_matrix.py scripts/check_orro_release_state.py scripts/check_orro_engine_dependency.py scripts/check_orro_packaging_decision.py scripts/check_orro_fallback_policy.py scripts/check_orro_command_migration.py scripts/check_orro_removed_command_docs.py scripts/check_orro_command_migration_dry_run.py scripts/check_orro_wrapper.py scripts/check_orro_wrapper_install.py scripts/check_orro_wrapper_distribution.py scripts/orro_build_backend.py scripts/orro_e2e_smoke.py scripts/update_orro_engine_lock.py scripts/bootstrap_orro.py src/orro_wrapper/__init__.py src/orro_wrapper/__main__.py src/orro_wrapper/cli.py
       - name: Bidi control scanner self-test
         run: python3 scripts/check_no_bidi_controls.py --self-test
       - name: Install ORRO wrapper package (editable)
diff --git a/README.md b/README.md
index 91da106..1f54e71 100644
--- a/README.md
+++ b/README.md
@@ -18,8 +18,8 @@ Today:
 - This repository keeps ORRO docs, product boundary, locks, thin wrapper package metadata, assurance contract checks, and integration-surface policy.
 - The runnable `orro` command is ORRO-owned and delegates to witnessd.
 - The ORRO product line is published on PyPI through 0.2.21, while this repository
-  packages the 0.2.22 release candidate. The post-release target state is: `orro`
-  0.2.22 is published on PyPI. It becomes true only after `v0.2.22` is tagged and
+  packages the 0.2.23 release candidate. The post-release target state is: `orro`
+  0.2.23 is published on PyPI. It becomes true only after `v0.2.23` is tagged and
   the Trusted-Publishing workflow completes. Until then, a normal
   `pip install orro` installs the latest published product-line release.
 - The local wrapper package exposes both `orro` and `orro-wrapper`.
@@ -33,7 +33,7 @@ Current focus:
 ## Can I use ORRO today?
 
 Yes. The published ORRO product line is installable from PyPI; see Current Status
-for the latest published version. Development dogfood can run the 0.2.22 source
+for the latest published version. Development dogfood can run the 0.2.23 source
 directly against pinned Depone and witnessd checkouts.
 
 Current split:
@@ -74,7 +74,7 @@ migration.
 Current command source: the `orro` command is exposed by this ORRO package and
 delegates to `python -m orro`.
 
-The 0.2.22 package metadata declares `witnessd>=2.4.0,<3.0.0` while keeping Depone and
+The 0.2.23 package metadata declares `witnessd>=2.37.0,<3.0.0` while keeping Depone and
 witnessd as separate engine repositories.
 
 ## Pinned Engine E2E
@@ -98,9 +98,9 @@ Engine-lock update discipline is documented in
 [`docs/engine-lock-update-process.md`](docs/engine-lock-update-process.md), and
 validated engine pairs are listed in
 [`docs/compatibility-matrix.md`](docs/compatibility-matrix.md). The published PyPI
-version is documented in Current Status; this repository sources 0.2.22,
+version is documented in Current Status; this repository sources 0.2.23,
 whose publication will be completed as a separate release step after the
-`v0.2.22` tag triggers the
+`v0.2.23` tag triggers the
 Trusted-Publishing workflow. Repository metadata changes do not publish or
 rewrite an artifact.
 
@@ -137,7 +137,7 @@ not assurance.
 
 The current command source is the ORRO-owned `orro` console script. The published
 PyPI version is documented in Current Status, and this repository prepares source
-version 0.2.22 with a `witnessd>=2.4.0,<3.0.0` dependency. The wrapper contains no
+version 0.2.23 with a `witnessd>=2.37.0,<3.0.0` dependency. The wrapper contains no
 engine code and must not
 implement proofrun, proofcheck, scheduler, observer, fan-in, team-ledger, or
 verifier logic.
diff --git a/docs/bootstrap.md b/docs/bootstrap.md
index 0a05079..a1e3618 100644
--- a/docs/bootstrap.md
+++ b/docs/bootstrap.md
@@ -94,10 +94,10 @@ that the installed metadata points to `orro_wrapper.cli:main`, `orro boundary`
 reports `contains_engine_logic: false`, `orro flowplan --help` delegates to
 witnessd, and both `orro-wrapper` and `python -m orro` remain usable.
 
-The post-release target state is: `orro` 0.2.22 is published on PyPI. It becomes
-true only after `v0.2.22` is tagged and the Trusted-Publishing workflow completes;
-until then, PyPI contains the ORRO product line through 0.2.15. This repository is
-the canonical 0.2.22 source, whose metadata declares `witnessd>=2.4.0,<3.0.0`.
+The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
+true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+until then, PyPI contains the ORRO product line through 0.2.22. This repository is
+the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`.
 
 The wrapper distribution smoke is separate from bootstrap:
 
diff --git a/docs/compatibility-matrix.md b/docs/compatibility-matrix.md
index 3dbf87d..a8eb8b7 100644
--- a/docs/compatibility-matrix.md
+++ b/docs/compatibility-matrix.md
@@ -5,10 +5,10 @@ proof, not verifier truth, not approval, and not assurance. It does not replace
 Depone or witnessd engine tests, and it does not imply that unlisted future
 commits are compatible.
 
-The post-release target state is: `orro` 0.2.22 is published on PyPI. It becomes
-true only after `v0.2.22` is tagged and the Trusted-Publishing workflow completes;
-until then, PyPI contains the ORRO product line through 0.2.15. This repository is
-the canonical 0.2.22 source.
+The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
+true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+until then, PyPI contains the ORRO product line through 0.2.22. This repository is
+the canonical 0.2.23 source.
 
 ```text
 Depone verifies; witnessd executes; ORRO exposes the workflow.
@@ -16,13 +16,13 @@ Depone verifies; witnessd executes; ORRO exposes the workflow.
 
 | Matrix entry | ORRO repo commit | witnessd commit | Depone commit | e2e status | notes |
 | --- | --- | --- | --- | --- | --- |
-| depone-n-witnessd-n | n/a | `64b154bb4f22a2811a0114c178023b75061748c7` | `b471b47ceb8cc2460e7221375526f63553c18353` | pass | Current locally validated engine pair; witnessd v2.34.0. |
+| depone-n-witnessd-n | n/a | `8ab96fc588ba6b43e90bfddc1d88f1867b4916ae` | `b471b47ceb8cc2460e7221375526f63553c18353` | pass | Current locally validated engine pair; witnessd v2.37.0. |
 | depone-n-witnessd-n-1 | n/a | `d601fa86fd8b658e8f4a2cf7fa4b35bde26c554d` | `0e86a55ad10c464d35308a7b6315860a47bcf8a5` | warn | Declared downgrade row, not a release lock. |
 | depone-n-1-witnessd-n | n/a | `90d4bc77b71cecf464f1f8a820d9fe17b308211f` | `b203130b5720c6ef6fc9b7492f085ac5ee733786` | warn | Declared downgrade row, not a release lock. |
-| orro-rc-locked-triplet | `3dbb293324fae2dbdd689ec7639e8312dc01b8a3` | `64b154bb4f22a2811a0114c178023b75061748c7` | `b471b47ceb8cc2460e7221375526f63553c18353` | pass | Matches witnessd v2.34.0, `engine-lock/orro-e2e-engine-lock.json`, `release/orro-release-manifest.v0.json`, and `release/compatibility-matrix.v0.json`. |
+| orro-rc-locked-triplet | `95ec4c3ae0eb67aaac830ddfff82353ac28d4ef0` | `8ab96fc588ba6b43e90bfddc1d88f1867b4916ae` | `b471b47ceb8cc2460e7221375526f63553c18353` | pass | Matches witnessd v2.37.0, `engine-lock/orro-e2e-engine-lock.json`, `release/orro-release-manifest.v0.json`, and `release/compatibility-matrix.v0.json`. |
 
-The locked witnessd revision is release `v2.34.0` (source version 2.34.0). It
-satisfies the ORRO 0.2.22 package requirement `witnessd>=2.4.0,<3.0.0`.
+The locked witnessd revision is release `v2.37.0` (source version 2.37.0). It
+satisfies the ORRO 0.2.23 package requirement `witnessd>=2.37.0,<3.0.0`.
 
 Related files:
 
diff --git a/docs/e2e-runner.md b/docs/e2e-runner.md
index 337ec04..bff09bb 100644
--- a/docs/e2e-runner.md
+++ b/docs/e2e-runner.md
@@ -78,4 +78,4 @@ separate pinned-engine e2e CI checks out the pinned witnessd and Depone commits
 from the e2e lock, then runs the full smoke.
 
 The ORRO product line is published on PyPI through 0.2.6. This pinned-engine
-smoke validates the 0.2.22 source package without publishing a new release.
+smoke validates the 0.2.23 source package without publishing a new release.
diff --git a/docs/install.md b/docs/install.md
index 32fa6d6..9f1e6b1 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -1,17 +1,17 @@
 # Install
 
-The ORRO product line is published on PyPI through 0.2.15, while this repository
-packages 0.2.22. The post-release target state is: `orro` 0.2.22 is published on
-PyPI. It becomes true only after `v0.2.22` is tagged and the Trusted-Publishing
-workflow completes. The 0.2.22 package metadata declares `witnessd>=2.4.0,<3.0.0`, and
+The ORRO product line is published on PyPI through 0.2.22, while this repository
+packages 0.2.23. The post-release target state is: `orro` 0.2.23 is published on
+PyPI. It becomes true only after `v0.2.23` is tagged and the Trusted-Publishing
+workflow completes. The 0.2.23 package metadata declares `witnessd>=2.37.0,<3.0.0`, and
 the package exposes `orro` plus the `orro-wrapper` compatibility alias.
 
 ```bash
 python3 -m pip install orro
 ```
 
-Until the `v0.2.22` workflow completes, that command installs `orro` 0.2.15.
-Development dogfood may instead use the 0.2.22 source checkout and pinned engine
+Until the `v0.2.23` workflow completes, that command installs `orro` 0.2.22.
+Development dogfood may instead use the 0.2.23 source checkout and pinned engine
 repositories directly.
 
 For the shared pinned-engine development layout, run bootstrap with the shared
@@ -92,7 +92,7 @@ The smoke runner is an orchestration harness only. It calls the current engine
 commands and does not implement proofrun, proofcheck, or runtime logic.
 
 The source package provides one user-facing ORRO install and declares
-`witnessd>=2.4.0,<3.0.0`; pinned-engine e2e metadata continues to govern repository
+`witnessd>=2.37.0,<3.0.0`; pinned-engine e2e metadata continues to govern repository
 compatibility validation.
 
 ## Packaging Decision
@@ -102,7 +102,7 @@ The v0 packaging decision is documented in `docs/packaging-decision.md` and
 verifier truth, and not package publish.
 
 Current installs use the ORRO-owned thin `orro` command. The ORRO product line is
-published on PyPI through 0.2.15, this repository prepares source 0.2.22 for the
+published on PyPI through 0.2.22, this repository prepares source 0.2.23 for the
 tag-triggered workflow, and the wrapper continues to contain no engine code.
 
 ## Wrapper Distribution Smoke
diff --git a/docs/packaging-decision.md b/docs/packaging-decision.md
index 55c280c..e478b30 100644
--- a/docs/packaging-decision.md
+++ b/docs/packaging-decision.md
@@ -12,15 +12,15 @@ ORRO will remain product/distribution/wrapper only while Depone and witnessd
 stay separate engine repositories.
 
 Current command source is the ORRO-owned `orro` console script, which delegates
-to witnessd. The post-release target state is: `orro` 0.2.22 is published on PyPI.
-It becomes true only after `v0.2.22` is tagged and the Trusted-Publishing workflow
-completes; until then, PyPI contains the ORRO product line through 0.2.15. This
-repository is the canonical 0.2.22 source, whose metadata declares
-`witnessd>=2.4.0,<3.0.0`.
+to witnessd. The post-release target state is: `orro` 0.2.23 is published on PyPI.
+It becomes true only after `v0.2.23` is tagged and the Trusted-Publishing workflow
+completes; until then, PyPI contains the ORRO product line through 0.2.22. This
+repository is the canonical 0.2.23 source, whose metadata declares
+`witnessd>=2.37.0,<3.0.0`.
 
 `published_package: true` means the ORRO product line has published PyPI
 releases; `published_package_scope: product-line` makes that scope explicit. It
-does not assert that the 0.2.22 source candidate is already published.
+does not assert that the 0.2.23 source candidate is already published.
 
 The package remains a thin wrapper that delegates to the existing engine
 command surface. It must contain no engine code.
@@ -58,7 +58,7 @@ The ORRO repository must not contain:
    `orro` and `orro-wrapper`, and contains no engine packages or engine
    implementation files.
 3. Published package: current phase. The ORRO product line is published through
-   0.2.1, and source 0.2.22 is prepared for the tag-triggered Trusted-Publishing
+  0.2.1, and source 0.2.23 is prepared for the tag-triggered Trusted-Publishing
    workflow. Any new release still requires pinned-engine e2e, boundary checks,
    bootstrap checks, and release metadata to remain green.
 
diff --git a/docs/pinned-engine-fallback.md b/docs/pinned-engine-fallback.md
index 2146e61..38520fa 100644
--- a/docs/pinned-engine-fallback.md
+++ b/docs/pinned-engine-fallback.md
@@ -67,8 +67,8 @@ mismatched engines and point to bootstrap/setup commands, but it must not
 auto-select different engine commits or rewrite the engine lock outside an
 intentional update PR.
 
-The post-release target state is: `orro` 0.2.22 is published on PyPI. It becomes
-true only after `v0.2.22` is tagged and the Trusted-Publishing workflow completes;
-until then, PyPI contains the ORRO product line through 0.2.15. This repository is
-the canonical 0.2.22 source, whose metadata declares `witnessd>=2.4.0,<3.0.0`. The current
-engine lock pins witnessd 2.34.0 at tag `v2.34.0`, satisfying that dependency.
+The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
+true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+until then, PyPI contains the ORRO product line through 0.2.22. This repository is
+the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`. The current
+engine lock pins witnessd 2.37.0 at tag `v2.37.0`, satisfying that dependency.
diff --git a/docs/release-notes/0.2.23.md b/docs/release-notes/0.2.23.md
new file mode 100644
index 0000000..0f87ccf
--- /dev/null
+++ b/docs/release-notes/0.2.23.md
@@ -0,0 +1,10 @@
+# ORRO 0.2.23
+
+ORRO 0.2.23 advances the pinned engine pair used by the package and the
+pinned-engine E2E metadata:
+
+- witnessd `2.37.0` at commit `8ab96fc588ba6b43e90bfddc1d88f1867b4916ae` (`v2.37.0`)
+- Depone `0.2.11` at commit `b471b47ceb8cc2460e7221375526f63553c18353` (`v0.2.11`)
+
+The package now requires `witnessd>=2.37.0,<3.0.0`, ensuring the documented
+witnessd-delivered session surface is available.
diff --git a/docs/repository-strategy.md b/docs/repository-strategy.md
index cb9793a..418fb5d 100644
--- a/docs/repository-strategy.md
+++ b/docs/repository-strategy.md
@@ -32,14 +32,14 @@ The release manifest and compatibility matrix are product/distribution
 metadata. They record which pinned engine pair has passed ORRO e2e CI, but they
 are not proof, not verifier truth, not approval, and not assurance. Engine-lock
 update process is intentional and PR-reviewed. The post-release target state is:
-`orro` 0.2.22 is published on PyPI. It becomes true only after `v0.2.22` is tagged
+`orro` 0.2.23 is published on PyPI. It becomes true only after `v0.2.23` is tagged
 and the Trusted-Publishing workflow completes; until then, PyPI contains the ORRO
-product line through 0.2.15. This repository is the canonical 0.2.22 source.
+product line through 0.2.22. This repository is the canonical 0.2.23 source.
 
 The packaging decision in `docs/packaging-decision.md` and
 `packaging/wrapper-package-plan.v0.json` is also product metadata, not package
 publish. It keeps the current command source ORRO-owned and subprocess-delegated
-to witnessd, declares `witnessd>=2.4.0,<3.0.0`, and requires the wrapper to contain no
+to witnessd, declares `witnessd>=2.37.0,<3.0.0`, and requires the wrapper to contain no
 engine code.
 
 The wrapper distribution smoke builds and installs a local wheel to verify
diff --git a/docs/thin-wrapper-plan.md b/docs/thin-wrapper-plan.md
index c1b6633..b91b314 100644
--- a/docs/thin-wrapper-plan.md
+++ b/docs/thin-wrapper-plan.md
@@ -1,9 +1,9 @@
 # Thin Wrapper Plan
 
-The post-release target state is: `orro` 0.2.22 is published on PyPI. It becomes
-true only after `v0.2.22` is tagged and the Trusted-Publishing workflow completes;
-until then, PyPI contains the ORRO product line through 0.2.15. The ORRO repository
-is the canonical 0.2.22 source, whose metadata declares `witnessd>=2.4.0,<3.0.0`.
+The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
+true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+until then, PyPI contains the ORRO product line through 0.2.22. The ORRO repository
+is the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`.
 
 ## Current State
 
@@ -57,7 +57,7 @@ Depone verifies; witnessd executes; ORRO exposes the workflow.
 The packaging decision is recorded in `docs/packaging-decision.md` and
 `packaging/wrapper-package-plan.v0.json`. It is product metadata, not package
 publish. It records the published package reality, the ORRO-owned command, the
-`witnessd>=2.4.0,<3.0.0` dependency, and the requirement that the package contain no
+`witnessd>=2.37.0,<3.0.0` dependency, and the requirement that the package contain no
 engine code.
 
 The pinned-engine fallback is recorded in `docs/pinned-engine-fallback.md` and
diff --git a/docs/thin-wrapper.md b/docs/thin-wrapper.md
index f051090..19a5f20 100644
--- a/docs/thin-wrapper.md
+++ b/docs/thin-wrapper.md
@@ -46,10 +46,10 @@ the engine command the operator explicitly invoked. The wrapper only delegates.
 
 ## Relationship To Packaging
 
-The post-release target state is: `orro` 0.2.22 is published on PyPI. It becomes
-true only after `v0.2.22` is tagged and the Trusted-Publishing workflow completes;
-until then, PyPI contains the ORRO product line through 0.2.15. This repository is
-the canonical 0.2.22 source, whose metadata declares `witnessd>=2.4.0,<3.0.0`.
+The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
+true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+until then, PyPI contains the ORRO product line through 0.2.22. This repository is
+the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`.
 
 Package work must keep:
 
diff --git a/docs/wrapper-distribution.md b/docs/wrapper-distribution.md
index ee89d0b..c7c46be 100644
--- a/docs/wrapper-distribution.md
+++ b/docs/wrapper-distribution.md
@@ -57,7 +57,7 @@ This is local distribution smoke only. It builds and installs a local wheel, but
 it does not publish a package, upload artifacts, create a marketplace release,
 or claim verifier truth.
 
-The post-release target state is: `orro` 0.2.22 is published on PyPI. It becomes
-true only after `v0.2.22` is tagged and the Trusted-Publishing workflow completes;
-until then, PyPI contains the ORRO product line through 0.2.15. This repository is
-the canonical 0.2.22 source, whose metadata declares `witnessd>=2.4.0,<3.0.0`.
+The post-release target state is: `orro` 0.2.23 is published on PyPI. It becomes
+true only after `v0.2.23` is tagged and the Trusted-Publishing workflow completes;
+until then, PyPI contains the ORRO product line through 0.2.22. This repository is
+the canonical 0.2.23 source, whose metadata declares `witnessd>=2.37.0,<3.0.0`.
diff --git a/engine-lock/orro-e2e-engine-lock.json b/engine-lock/orro-e2e-engine-lock.json
index 1a8cd48..87dd206 100644
--- a/engine-lock/orro-e2e-engine-lock.json
+++ b/engine-lock/orro-e2e-engine-lock.json
@@ -3,9 +3,9 @@
   "schema_version": "1.0",
   "witnessd": {
     "repository": "Moonweave-Systems/witnessd",
-    "commit": "64b154bb4f22a2811a0114c178023b75061748c7",
-    "version": "2.34.0",
-    "ref_name": "v2.34.0"
+    "commit": "8ab96fc588ba6b43e90bfddc1d88f1867b4916ae",
+    "version": "2.37.0",
+    "ref_name": "v2.37.0"
   },
   "depone": {
     "repository": "Moonweave-Systems/Depone",
diff --git a/packaging/plugin-manifest.draft.json b/packaging/plugin-manifest.draft.json
index 436276d..8ea84f2 100644
--- a/packaging/plugin-manifest.draft.json
+++ b/packaging/plugin-manifest.draft.json
@@ -7,12 +7,12 @@
   "entrypoint_plan": {
     "current": "ORRO-owned orro console script delegating to witnessd",
     "compatibility_alias": "orro-wrapper",
-    "distribution": "orro 0.2.22 source package"
+    "distribution": "orro 0.2.23 source package"
   },
   "engine_dependencies": {
     "witnessd": {
       "repository": "Moonweave-Systems/witnessd",
-      "package_requirement": "witnessd>=2.4.0,<3.0.0"
+      "package_requirement": "witnessd>=2.37.0,<3.0.0"
     },
     "depone": "Moonweave-Systems/Depone"
   },
diff --git a/packaging/wrapper-package-plan.v0.json b/packaging/wrapper-package-plan.v0.json
index 47255bc..d79ea64 100644
--- a/packaging/wrapper-package-plan.v0.json
+++ b/packaging/wrapper-package-plan.v0.json
@@ -4,7 +4,7 @@
   "status": "release-candidate",
   "package_goal": "single user-facing ORRO install that prepares and invokes pinned Depone and witnessd engines",
   "distribution_name": "orro",
-  "source_version": "0.2.22",
+  "source_version": "0.2.23",
   "published_pypi_versions": [
     "0.0.1",
     "0.0.2",
@@ -32,7 +32,8 @@
     "0.2.18",
     "0.2.19",
     "0.2.20",
-    "0.2.21"
+    "0.2.21",
+    "0.2.22"
   ],
   "current_command_source": "ORRO-owned orro console script",
   "published_package": true,
@@ -59,7 +60,7 @@
     {
       "phase": "published-package",
       "status": "current",
-      "description": "Track the published ORRO product line through 0.2.21 and prepare source 0.2.22 for the tag-triggered Trusted-Publishing workflow.",
+      "description": "Track the published ORRO product line through 0.2.22 and prepare source 0.2.23 for the tag-triggered Trusted-Publishing workflow.",
       "contains_engine_logic": false
     }
   ],
@@ -67,7 +68,7 @@
     "witnessd": {
       "repository": "Moonweave-Systems/witnessd",
       "role": "execution engine",
-      "package_requirement": "witnessd>=2.4.0,<3.0.0"
+      "package_requirement": "witnessd>=2.37.0,<3.0.0"
     },
     "depone": {
       "repository": "Moonweave-Systems/Depone",
diff --git a/pyproject.toml b/pyproject.toml
index 4a6e1a7..58936d0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,11 +4,11 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "orro"
-version = "0.2.22"
+version = "0.2.23"
 description = "Published ORRO product/distribution wrapper for pinned Depone and witnessd engines."
 readme = "README.md"
 requires-python = ">=3.10"
-dependencies = ["witnessd>=2.4.0,<3.0.0"]
+dependencies = ["witnessd>=2.37.0,<3.0.0"]
 
 [project.scripts]
 orro = "orro_wrapper.cli:main"
diff --git a/release/compatibility-matrix.v0.json b/release/compatibility-matrix.v0.json
index 6ae2193..9a93d7d 100644
--- a/release/compatibility-matrix.v0.json
+++ b/release/compatibility-matrix.v0.json
@@ -10,10 +10,10 @@
       "id": "depone-n-witnessd-n",
       "type": "engine-pair",
       "depone_commit": "b471b47ceb8cc2460e7221375526f63553c18353",
-      "witnessd_commit": "64b154bb4f22a2811a0114c178023b75061748c7",
+      "witnessd_commit": "8ab96fc588ba6b43e90bfddc1d88f1867b4916ae",
       "status": "pass",
       "notes": "Current locally validated engine pair; witnessd commit is published on the configured remote.",
-      "witnessd_version": "2.34.0"
+      "witnessd_version": "2.37.0"
     },
     {
       "id": "depone-n-witnessd-n-1",
@@ -34,14 +34,14 @@
     {
       "id": "orro-rc-locked-triplet",
       "type": "product-triplet",
-      "orro_commit": "3dbb293324fae2dbdd689ec7639e8312dc01b8a3",
+      "orro_commit": "95ec4c3ae0eb67aaac830ddfff82353ac28d4ef0",
       "depone_commit": "b471b47ceb8cc2460e7221375526f63553c18353",
-      "witnessd_commit": "64b154bb4f22a2811a0114c178023b75061748c7",
+      "witnessd_commit": "8ab96fc588ba6b43e90bfddc1d88f1867b4916ae",
       "status": "pass",
       "engine_lock": "engine-lock/orro-e2e-engine-lock.json",
       "release_manifest": "release/orro-release-manifest.v0.json",
       "notes": "ORRO release-candidate base with the updated immutable engine triplet.",
-      "witnessd_version": "2.34.0"
+      "witnessd_version": "2.37.0"
     }
   ],
   "boundary": {
diff --git a/release/orro-release-manifest.v0.json b/release/orro-release-manifest.v0.json
index 89df9bf..6ac3d7f 100644
--- a/release/orro-release-manifest.v0.json
+++ b/release/orro-release-manifest.v0.json
@@ -5,13 +5,13 @@
     "name": "ORRO",
     "full_name": "Observed Run & Review Orchestrator",
     "repository": "Moonweave-Systems/ORRO",
-    "commit": "3dbb293324fae2dbdd689ec7639e8312dc01b8a3"
+    "commit": "95ec4c3ae0eb67aaac830ddfff82353ac28d4ef0"
   },
   "engines": {
     "witnessd": {
       "repository": "Moonweave-Systems/witnessd",
-      "commit": "64b154bb4f22a2811a0114c178023b75061748c7",
-      "version": "2.34.0",
+      "commit": "8ab96fc588ba6b43e90bfddc1d88f1867b4916ae",
+      "version": "2.37.0",
       "role": "execution engine"
     },
     "depone": {
diff --git a/scripts/check_orro_engine_dependency.py b/scripts/check_orro_engine_dependency.py
new file mode 100644
index 0000000..bf21a61
--- /dev/null
+++ b/scripts/check_orro_engine_dependency.py
@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""Check that the package dependency floor tracks the pinned witnessd engine."""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+
+ROOT = Path(__file__).resolve().parents[1]
+PYPROJECT_PATH = ROOT / "pyproject.toml"
+ENGINE_LOCK_PATH = ROOT / "engine-lock" / "orro-e2e-engine-lock.json"
+REQUIREMENT_RE = re.compile(r"^witnessd>=(\d+\.\d+\.\d+),<(\d+\.\d+\.\d+)$")
+VERSION_RE = re.compile(r"^\d+\.\d+\.\d+$")
+
+
+class DependencyError(RuntimeError):
+    pass
+
+
+def version_tuple(label: str, value: Any) -> tuple[int, int, int]:
+    if not isinstance(value, str) or VERSION_RE.fullmatch(value) is None:
+        raise DependencyError(f"{label} must be an X.Y.Z version")
+    return tuple(int(part) for part in value.split("."))  # type: ignore[return-value]
+
+
+def parse_requirement(text: str) -> tuple[str, str]:
+    match = re.search(r"^dependencies\s*=\s*(\[[\s\S]*?\])", text, flags=re.MULTILINE)
+    if match is None:
+        raise DependencyError("pyproject.toml project dependencies are missing")
+    try:
+        dependencies = ast.literal_eval(match.group(1))
+    except (SyntaxError, ValueError) as exc:
+        raise DependencyError(f"could not parse pyproject.toml dependencies: {exc}") from exc
+    if not isinstance(dependencies, list):
+        raise DependencyError("pyproject.toml dependencies must be a list")
+    witnessd = [item for item in dependencies if isinstance(item, str) and item.startswith("witnessd")]
+    if len(witnessd) != 1:
+        raise DependencyError("pyproject.toml must declare exactly one witnessd dependency")
+    match = REQUIREMENT_RE.fullmatch(witnessd[0])
+    if match is None:
+        raise DependencyError("witnessd dependency must be witnessd>=X.Y.Z,<A.B.C")
+    return match.group(1), match.group(2)
+
+
+def validate(requirement_text: str, lock: dict[str, Any]) -> None:
+    minimum_text, upper_text = parse_requirement(requirement_text)
+    minimum = version_tuple("declared witnessd floor", minimum_text)
+    upper = version_tuple("declared witnessd upper bound", upper_text)
+    if upper <= minimum:
+        raise DependencyError("declared witnessd upper bound must exceed its floor")
+    witnessd = lock.get("witnessd")
+    if not isinstance(witnessd, dict):
+        raise DependencyError("engine lock witnessd entry must be an object")
+    locked = version_tuple("locked witnessd version", witnessd.get("version"))
+    if not minimum <= locked < upper:
+        raise DependencyError("locked witnessd version must satisfy the declared dependency range")
+    if minimum < locked:
+        raise DependencyError("declared witnessd floor must be greater than or equal to the locked version")
+
+
+def check_repository() -> None:
+    try:
+        requirement_text = PYPROJECT_PATH.read_text(encoding="utf-8")
+        lock = json.loads(ENGINE_LOCK_PATH.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        raise DependencyError(f"could not read dependency metadata: {exc}") from exc
+    if not isinstance(lock, dict):
+        raise DependencyError("engine lock must contain an object")
+    validate(requirement_text, lock)
+
+
+def self_test() -> int:
+    requirement = '[project]\ndependencies = ["witnessd>=2.36.0,<3.0.0"]\n'
+    lock = {"witnessd": {"version": "2.36.0"}}
+    validate(requirement, lock)
+    for label, forged_requirement, forged_lock in (
+        ("lower floor", 'witnessd>=2.35.0,<3.0.0', lock),
+        ("lock above upper bound", requirement, {"witnessd": {"version": "3.0.0"}}),
+    ):
+        try:
+            validate(f'[project]\ndependencies = ["{forged_requirement}"]\n', forged_lock)
+        except DependencyError:
+            continue
+        raise DependencyError(f"self-test accepted {label}")
+    print("ORRO engine dependency self-test: pass")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--self-test", action="store_true")
+    args = parser.parse_args(sys.argv[1:] if argv is None else argv)
+    try:
+        if args.self_test:
+            return self_test()
+        check_repository()
+    except DependencyError as exc:
+        print(f"ORRO engine dependency violation: {exc}", file=sys.stderr)
+        return 1
+    print("ORRO engine dependency: pass")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/check_orro_fallback_policy.py b/scripts/check_orro_fallback_policy.py
index cff8438..280e58f 100644
--- a/scripts/check_orro_fallback_policy.py
+++ b/scripts/check_orro_fallback_policy.py
@@ -100,7 +100,7 @@ def check_docs() -> None:
     require_contains("fallback docs", text, "intentional engine-lock update PR")
     require_contains("fallback docs", text, "proofrun")
     require_contains("fallback docs", text, "proofcheck")
-    require_contains("fallback docs", text, "`orro` 0.2.22 is published on PyPI")
+    require_contains("fallback docs", text, "`orro` 0.2.23 is published on PyPI")
 
 
 def main() -> int:
diff --git a/scripts/check_orro_packaging_decision.py b/scripts/check_orro_packaging_decision.py
index 9e92dd2..ea78989 100644
--- a/scripts/check_orro_packaging_decision.py
+++ b/scripts/check_orro_packaging_decision.py
@@ -17,7 +17,7 @@
 PLAN_PATH = ROOT / "packaging/wrapper-package-plan.v0.json"
 DOC_PATH = ROOT / "docs/packaging-decision.md"
 INVARIANT = "Depone verifies; witnessd executes; ORRO exposes the workflow"
-WITNESSD_REQUIREMENT = "witnessd>=2.4.0,<3.0.0"
+WITNESSD_REQUIREMENT = "witnessd>=2.37.0,<3.0.0"
 
 
 def fail(message: str) -> None:
@@ -67,8 +67,8 @@ def check_plan() -> None:
         fail("wrapper package plan status must be release-candidate")
     if plan.get("distribution_name") != "orro":
         fail("wrapper package plan distribution_name must be orro")
-    if plan.get("source_version") != "0.2.22":
-        fail("wrapper package plan source_version must be 0.2.22")
+    if plan.get("source_version") != "0.2.23":
+        fail("wrapper package plan source_version must be 0.2.23")
     if plan.get("current_command_source") != "ORRO-owned orro console script":
         fail("current command source must be ORRO-owned")
 
@@ -123,7 +123,7 @@ def check_docs() -> None:
     require_contains("packaging decision doc", text, "not package publish")
     require_contains("packaging decision doc", text, "witnessd-hosted")
     require_contains("packaging decision doc", text, "no engine code")
-    require_contains("packaging decision doc", text, "`orro` 0.2.22 is published on PyPI")
+    require_contains("packaging decision doc", text, "`orro` 0.2.23 is published on PyPI")
     require_contains("packaging decision doc", text, WITNESSD_REQUIREMENT)
     require_contains("packaging decision doc", text, "proofrun")
     require_contains("packaging decision doc", text, "proofcheck")
diff --git a/scripts/check_orro_release_state.py b/scripts/check_orro_release_state.py
index 9366d1c..ca63e5e 100644
--- a/scripts/check_orro_release_state.py
+++ b/scripts/check_orro_release_state.py
@@ -96,7 +96,7 @@
     "Publishing 0.2.13 is a separate",
     "installs 0.2.11",
 )
-PUBLISHED_PYPI_VERSIONS = ("0.0.1", "0.0.2", "0.0.3", "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.19", "0.2.20", "0.2.21")
+PUBLISHED_PYPI_VERSIONS = ("0.0.1", "0.0.2", "0.0.3", "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.19", "0.2.20", "0.2.21", "0.2.22")
 
 
 class ReleaseStateError(RuntimeError):
@@ -334,30 +334,30 @@ def validate_release_state(state: dict[str, Any]) -> None:
 
 def self_test() -> int:
     parsed_version, parsed_requirement = parse_pyproject(
-        '[project]\nversion = "0.1.0"\ndependencies = [\n  "example>=1",\n  "witnessd>=2.4.0,<3.0.0",\n]\n'
+        '[project]\nversion = "0.1.0"\ndependencies = [\n  "example>=1",\n  "witnessd>=2.37.0,<3.0.0",\n]\n'
     )
     assert parsed_version == "0.1.0"
-    assert parsed_requirement == "witnessd>=2.4.0,<3.0.0"
+    assert parsed_requirement == "witnessd>=2.37.0,<3.0.0"
     base: dict[str, Any] = {
-        "pyproject_version": "0.2.22",
-        "setup_cfg_version": "0.2.22",
-        "pyproject_requirement": "witnessd>=2.4.0,<3.0.0",
-        "setup_cfg_requirement": "witnessd>=2.4.0,<3.0.0",
-        "package_plan_requirement": "witnessd>=2.4.0,<3.0.0",
-        "plugin_manifest_requirement": "witnessd>=2.4.0,<3.0.0",
+        "pyproject_version": "0.2.23",
+        "setup_cfg_version": "0.2.23",
+        "pyproject_requirement": "witnessd>=2.37.0,<3.0.0",
+        "setup_cfg_requirement": "witnessd>=2.37.0,<3.0.0",
+        "package_plan_requirement": "witnessd>=2.37.0,<3.0.0",
+        "plugin_manifest_requirement": "witnessd>=2.37.0,<3.0.0",
         "published_package": True,
         "published_package_scope": "product-line",
-        "engine_lock_witnessd_version": "2.34.0",
-        "engine_lock_witnessd_ref": "v2.34.0",
-        "manifest_witnessd_version": "2.34.0",
-        "package_plan_version": "0.2.22",
+        "engine_lock_witnessd_version": "2.37.0",
+        "engine_lock_witnessd_ref": "v2.37.0",
+        "manifest_witnessd_version": "2.37.0",
+        "package_plan_version": "0.2.23",
         "package_plan_status": "release-candidate",
-        "package_plan_published_versions": ["0.0.1", "0.0.2", "0.0.3", "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.19", "0.2.20", "0.2.21"],
+        "package_plan_published_versions": ["0.0.1", "0.0.2", "0.0.3", "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.19", "0.2.20", "0.2.21", "0.2.22"],
         "package_plan_published_package": True,
         "package_plan_published_package_scope": "product-line",
         "docs": {
             "README.md": (
-                "The post-release target state is: `orro` 0.2.22 is published on PyPI. "
+                "The post-release target state is: `orro` 0.2.23 is published on PyPI. "
                 "It becomes true only after Trusted Publishing completes."
             )
         },
@@ -369,7 +369,7 @@ def self_test() -> int:
         ("ambiguous wrapper publication scope", "published_package_scope", "source-version"),
         ("unsatisfied witnessd lock", "engine_lock_witnessd_version", "2.3.3"),
         ("witnessd lock at upper bound", "engine_lock_witnessd_version", "3.0.0"),
-        ("unbounded witnessd requirement", "pyproject_requirement", "witnessd>=2.4.0"),
+        ("unbounded witnessd requirement", "pyproject_requirement", "witnessd>=2.37.0"),
         (
             "mismatched package-plan witnessd requirement",
             "package_plan_requirement",
@@ -378,7 +378,7 @@ def self_test() -> int:
         (
             "mismatched plugin-manifest witnessd requirement",
             "plugin_manifest_requirement",
-            "witnessd>=2.4.0,<4.0.0",
+            "witnessd>=2.37.0,<4.0.0",
         ),
         ("mutable witnessd ref", "engine_lock_witnessd_ref", "main"),
         ("manifest version mismatch", "manifest_witnessd_version", "2.3.2"),
@@ -397,7 +397,7 @@ def self_test() -> int:
         (
             "unreleased source listed as published",
             "package_plan_published_versions",
-            ["0.0.1", "0.0.2", "0.0.3", "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.19", "0.2.20", "0.2.21", "0.2.22"],
+            ["0.0.1", "0.0.2", "0.0.3", "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.19", "0.2.20", "0.2.21", "0.2.22", "0.2.23"],
         ),
         (
             "ambiguous package-plan publication scope",
@@ -413,7 +413,7 @@ def self_test() -> int:
             continue
         fail(f"self-test accepted forgery: {label}")
     forged_docs = copy.deepcopy(base)
-    forged_docs["docs"]["README.md"] = "`orro` 0.2.22 is published on PyPI."
+    forged_docs["docs"]["README.md"] = "`orro` 0.2.23 is published on PyPI."
     try:
         validate_release_state(forged_docs)
     except ReleaseStateError:
diff --git a/scripts/check_orro_repo_contract.py b/scripts/check_orro_repo_contract.py
index 8ba7d23..74a9241 100644
--- a/scripts/check_orro_repo_contract.py
+++ b/scripts/check_orro_repo_contract.py
@@ -568,7 +568,7 @@ def check_release_discipline() -> None:
     require_contains("release docs", lower_text, "engine-lock update")
     require_contains("release docs", text, "not proof")
     require_contains("release docs", text, "not verifier truth")
-    require_contains("release docs", lower_text, "`orro` 0.2.22 is published on pypi")
+    require_contains("release docs", lower_text, "`orro` 0.2.23 is published on pypi")
 
 
 def check_os_support_matrix() -> None:
@@ -643,8 +643,8 @@ def check_packaging_decision() -> None:
     )
     require_contains("packaging decision docs", text, "packaging decision")
     require_contains("packaging decision docs", text, "not package publish")
-    require_contains("packaging decision docs", text, "`orro` 0.2.22 is published on PyPI")
-    require_contains("packaging decision docs", text, "witnessd>=2.4.0,<3.0.0")
+    require_contains("packaging decision docs", text, "`orro` 0.2.23 is published on PyPI")
+    require_contains("packaging decision docs", text, "witnessd>=2.37.0,<3.0.0")
     require_contains("packaging decision docs", text, "no engine code")
     require_contains("packaging decision docs", text, "witnessd-hosted")
     require_contains("packaging decision docs", text, INVARIANT)
@@ -840,6 +840,7 @@ def check_no_engine_code() -> None:
             "check_orro_repo_contract.py",
             "check_orro_release_manifest.py",
             "check_orro_release_state.py",
+            "check_orro_engine_dependency.py",
             "check_compatibility_matrix.py",
             "check_orro_version_coherence.py",
             "check_orro_wrapper.py",
diff --git a/scripts/check_orro_wrapper.py b/scripts/check_orro_wrapper.py
index 1c42677..cf81f8d 100644
--- a/scripts/check_orro_wrapper.py
+++ b/scripts/check_orro_wrapper.py
@@ -16,7 +16,7 @@
 PACKAGE_DIR = ROOT / "src/orro_wrapper"
 DOC_PATH = ROOT / "docs/thin-wrapper.md"
 INVARIANT = "Depone verifies; witnessd executes; ORRO exposes the workflow"
-WITNESSD_REQUIREMENT = "witnessd>=2.4.0,<3.0.0"
+WITNESSD_REQUIREMENT = "witnessd>=2.37.0,<3.0.0"
 
 
 def fail(message: str) -> None:
@@ -32,7 +32,7 @@ def require_contains(label: str, haystack: str, needle: str) -> None:
 def check_pyproject() -> None:
     text = PYPROJECT.read_text(encoding="utf-8")
     require_contains("pyproject.toml", text, 'name = "orro"')
-    require_contains("pyproject.toml", text, 'version = "0.2.22"')
+    require_contains("pyproject.toml", text, 'version = "0.2.23"')
     require_contains(
         "pyproject.toml", text, f'dependencies = ["{WITNESSD_REQUIREMENT}"]'
     )
@@ -43,7 +43,7 @@ def check_pyproject() -> None:
 def check_setup_cfg() -> None:
     text = SETUP_CFG.read_text(encoding="utf-8")
     require_contains("setup.cfg", text, "name = orro")
-    require_contains("setup.cfg", text, "version = 0.2.22")
+    require_contains("setup.cfg", text, "version = 0.2.23")
     require_contains("setup.cfg", text, WITNESSD_REQUIREMENT)
     require_contains("setup.cfg", text, "orro = orro_wrapper.cli:main")
     require_contains("setup.cfg", text, "orro-wrapper = orro_wrapper.cli:main")
diff --git a/setup.cfg b/setup.cfg
index f0cc0be..eb61b0e 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,6 +1,6 @@
 [metadata]
 name = orro
-version = 0.2.22
+version = 0.2.23
 description = Published ORRO product/distribution wrapper for pinned Depone and witnessd engines.
 long_description = file: README.md
 long_description_content_type = text/markdown
@@ -11,7 +11,7 @@ package_dir =
 packages = find:
 python_requires = >=3.10
 install_requires =
-    witnessd>=2.4.0,<3.0.0
+    witnessd>=2.37.0,<3.0.0
 
 [options.packages.find]
 where = src