fix: resolve governance and benchmark audit findings

README.md

@@ -72,6 +72,11 @@ explicit promotion.
 Authority is contextual, not permanent. The Trust Engine evaluates sample size, coverage, harmful
 outcomes, regret, governance tax, recency, policy identity, and available adapter capabilities.
 
+The promotion gate assumes a non-adversarial, same-user trust domain. Receipt and ledger hashes
+detect corruption and make decisions reproducible; they do not prove authorship or stop the agent,
+a prompt-injected tool, or another same-user process from rewriting local state. Do not treat local
+Earned Enforcement as a security boundary against software running as the same OS user.
+
 ## User intent and controls
 
 Codex user prompts can express deliberate repeat intent in English or Italian, including `repeat`,

benchmark/analysis/summary.md

@@ -2,7 +2,9 @@
 
 ## Executive Summary
 
-No Codex OFF/ON trajectory was executed. The integration-only preflight passes for the
+This directory records an earlier blocked preflight; no Codex OFF/ON trajectory was executed in
+that attempt. A later exploratory smoke did run, and its complete evidence is published under
+`benchmarks/swebench_lite/evidence/smoke-2026-08-11-dbce533/`. The integration-only preflight passes for the
 frozen three-task set, Codex 0.147.0, `gpt-5.6-sol`, and `high` reasoning effort. The
 mandatory full preflight stops before inference because successful shell executions are
 not observable through the pinned hook contract and no official per-instance SWE-bench

benchmark/results/README.md

@@ -0,0 +1,6 @@
+# Benchmark results
+
+These empty files belong to the earlier blocked preflight and contain no Codex trajectories. The
+completed exploratory smoke evidence is under
+[`benchmarks/swebench_lite/evidence/smoke-2026-08-11-dbce533/`](../../benchmarks/swebench_lite/evidence/smoke-2026-08-11-dbce533/),
+including paired telemetry, verifier reports, provenance, verification, and the public report.

benchmarks/swebench_lite/PUBLIC_BENCHMARK.md

@@ -8,7 +8,7 @@ MARGINAL overhead is counted in net efficiency and net savings.
 | Resolved | 0/3 | 0/3 | +0.00 pp |
 | Agent tokens | 1,098,747 | 824,839 | 24.93% fewer |
 | Effective tokens (incl. governance) | 1,098,747 | 824,839 | 24.93% fewer |
-| Effective USD | $0.0000 | $0.0000 | 0.00% lower |
+| Effective USD | n/a | n/a | n/a |
 | Effective latency | 593,106 ms | 565,768 ms | 4.61% lower |
 | Tool calls | 33 | 32 | 3.03% fewer |
 | Repeated calls | 0 | 0 | 0.00% fewer |
@@ -17,32 +17,16 @@ MARGINAL overhead is counted in net efficiency and net savings.
 
 ## Governance tax
 
-MARGINAL overhead: **0 tokens**, **$0.000000**, **7,058 ms**.
+MARGINAL overhead: **0 tokens**, **n/a**, **7,058 ms**.
 Gross agent-token savings: **24.93%**. Net token savings after governance: **24.93%**.
 
 ## Quality and intervention decision
 
-Net token savings 95.0% bootstrap interval: **21.52% to 28.07%**.
-Quality preserved within the 1.00 pp non-inferiority margin: **True**.
+Token uncertainty: **not evaluable** without a successful task in both arms.
+Quality preserved within the 1.00 pp non-inferiority margin: **not evaluable**.
 Regressions: **0**. Recoveries: **0**.
 Reviewed deny recommendations: **0**. False stops: **0** (n/a).
 Intervention status: **pass_through**.
 No verified successful task was observed, so token efficiency per resolved task is undefined and the intervention cannot be classified as supported.
 
 `pass_through` is a valid result: it means MARGINAL did not demonstrate enough net value to justify intervention under the preregistered threshold.
-
-## Scope and interpretation
-
-This is an **exploratory 3-task smoke with one paired run per task**, not a population estimate or headline performance claim. Codex CLI 0.147.0 and GPT-5.6-sol ran under identical prompts, limits, task order, official task images and base commits. MARGINAL added 7,058 ms of measured local governance latency, zero external governance tokens and zero governance USD.
-
-The token interval above is only a bootstrap over three task pairs; it cannot estimate run-to-run model variance because there was one repetition. All three observed ON trajectories had zero applied denies. The token difference therefore cannot be attributed to a stop decision, and neither lane's 0/3 resolve rate permits an efficiency-per-success claim.
-
-## Verification chain
-
-- Authoritative correctness: SWE-bench 4.1.0 Docker harness, x86_64, official pinned task images; 3/3 completed and 0 infrastructure errors in each lane.
-- Cloud audit: [GitHub Actions + Modal run 31474500980](https://github.com/SignalLayerLabs/Marginal/actions/runs/31474500980); 2/3 completed and the same Modal image-build error occurred for `pylint-dev__astroid-1978` in both lanes. The cloud error is retained but excluded from scoring.
-- Evidence: [`evidence/smoke-2026-08-11-dbce533/`](evidence/smoke-2026-08-11-dbce533/) contains predictions, telemetry, verifier reports, merged rows, provenance and raw public-evaluator output.
-- Frozen task-set SHA-256: `1c8c06935484fd57f4c27c363418884542bcfb06c69d02f480b61fe7687b58eb`.
-- MARGINAL source commit used by the runtime overlays: `dbce533e5c8e8def62b0543853d07cfab2bc79c1`.
-
-The next promotion gate is a preregistered repeated canary with verified successes and enough repetitions to measure trajectory variance. Until then, `pass_through` is the evidence-backed product decision.

benchmarks/swebench_lite/evidence/smoke-2026-08-11-dbce533/PUBLIC_BENCHMARK.md

@@ -8,7 +8,7 @@ MARGINAL overhead is counted in net efficiency and net savings.
 | Resolved | 0/3 | 0/3 | +0.00 pp |
 | Agent tokens | 1,098,747 | 824,839 | 24.93% fewer |
 | Effective tokens (incl. governance) | 1,098,747 | 824,839 | 24.93% fewer |
-| Effective USD | $0.0000 | $0.0000 | 0.00% lower |
+| Effective USD | n/a | n/a | n/a |
 | Effective latency | 593,106 ms | 565,768 ms | 4.61% lower |
 | Tool calls | 33 | 32 | 3.03% fewer |
 | Repeated calls | 0 | 0 | 0.00% fewer |
@@ -17,13 +17,13 @@ MARGINAL overhead is counted in net efficiency and net savings.
 
 ## Governance tax
 
-MARGINAL overhead: **0 tokens**, **$0.000000**, **7,058 ms**.
+MARGINAL overhead: **0 tokens**, **n/a**, **7,058 ms**.
 Gross agent-token savings: **24.93%**. Net token savings after governance: **24.93%**.
 
 ## Quality and intervention decision
 
-Net token savings 95.0% bootstrap interval: **21.52% to 28.07%**.
-Quality preserved within the 1.00 pp non-inferiority margin: **True**.
+Token uncertainty: **not evaluable** without a successful task in both arms.
+Quality preserved within the 1.00 pp non-inferiority margin: **not evaluable**.
 Regressions: **0**. Recoveries: **0**.
 Reviewed deny recommendations: **0**. False stops: **0** (n/a).
 Intervention status: **pass_through**.

benchmarks/swebench_lite/evidence/smoke-2026-08-11-dbce533/baseline_metrics.ndjson

@@ -1,3 +1,3 @@
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1072","latency_ms":177424,"repeated_calls":0,"reviewed_stops":0,"tokens":370497,"tool_calls":11,"usd":0.0}
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1707","latency_ms":268283,"repeated_calls":0,"reviewed_stops":0,"tokens":383851,"tool_calls":12,"usd":0.0}
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pylint-dev__astroid-1978","latency_ms":147399,"repeated_calls":0,"reviewed_stops":0,"tokens":344399,"tool_calls":10,"usd":0.0}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1072","latency_ms":177424,"repeated_calls":0,"reviewed_stops":0,"tokens":370497,"tool_calls":11,"usd":0.0,"usd_measured":false}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1707","latency_ms":268283,"repeated_calls":0,"reviewed_stops":0,"tokens":383851,"tool_calls":12,"usd":0.0,"usd_measured":false}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pylint-dev__astroid-1978","latency_ms":147399,"repeated_calls":0,"reviewed_stops":0,"tokens":344399,"tool_calls":10,"usd":0.0,"usd_measured":false}

benchmarks/swebench_lite/evidence/smoke-2026-08-11-dbce533/baseline_verified.ndjson

@@ -1,3 +1,3 @@
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1072","latency_ms":177424,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":370497,"tool_calls":11,"usd":0.0}
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1707","latency_ms":268283,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":383851,"tool_calls":12,"usd":0.0}
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pylint-dev__astroid-1978","latency_ms":147399,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":344399,"tool_calls":10,"usd":0.0}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1072","latency_ms":177424,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":370497,"tool_calls":11,"usd":0.0,"usd_measured":false}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1707","latency_ms":268283,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":383851,"tool_calls":12,"usd":0.0,"usd_measured":false}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":0,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pylint-dev__astroid-1978","latency_ms":147399,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":344399,"tool_calls":10,"usd":0.0,"usd_measured":false}

benchmarks/swebench_lite/evidence/smoke-2026-08-11-dbce533/marginal_metrics.ndjson

@@ -1,3 +1,3 @@
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":1823,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1072","latency_ms":178765,"repeated_calls":0,"reviewed_stops":0,"tokens":275858,"tool_calls":11,"usd":0.0}
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":2224,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1707","latency_ms":236330,"repeated_calls":0,"reviewed_stops":0,"tokens":301257,"tool_calls":13,"usd":0.0}
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":3011,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pylint-dev__astroid-1978","latency_ms":143615,"repeated_calls":0,"reviewed_stops":0,"tokens":247724,"tool_calls":8,"usd":0.0}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":1823,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1072","latency_ms":178765,"repeated_calls":0,"reviewed_stops":0,"tokens":275858,"tool_calls":11,"usd":0.0,"usd_measured":false}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":2224,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1707","latency_ms":236330,"repeated_calls":0,"reviewed_stops":0,"tokens":301257,"tool_calls":13,"usd":0.0,"usd_measured":false}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":3011,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pylint-dev__astroid-1978","latency_ms":143615,"repeated_calls":0,"reviewed_stops":0,"tokens":247724,"tool_calls":8,"usd":0.0,"usd_measured":false}

benchmarks/swebench_lite/evidence/smoke-2026-08-11-dbce533/marginal_verified.ndjson

@@ -1,3 +1,3 @@
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":1823,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1072","latency_ms":178765,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":275858,"tool_calls":11,"usd":0.0}
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":2224,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1707","latency_ms":236330,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":301257,"tool_calls":13,"usd":0.0}
-{"applied_denies":0,"false_stops":0,"governance_latency_ms":3011,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pylint-dev__astroid-1978","latency_ms":143615,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":247724,"tool_calls":8,"usd":0.0}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":1823,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1072","latency_ms":178765,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":275858,"tool_calls":11,"usd":0.0,"usd_measured":false}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":2224,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pvlib__pvlib-python-1707","latency_ms":236330,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":301257,"tool_calls":13,"usd":0.0,"usd_measured":false}
+{"applied_denies":0,"false_stops":0,"governance_latency_ms":3011,"governance_tokens":0,"governance_usd":0.0,"instance_id":"pylint-dev__astroid-1978","latency_ms":143615,"repeated_calls":0,"resolved":false,"reviewed_stops":0,"tokens":247724,"tool_calls":8,"usd":0.0,"usd_measured":false}

benchmarks/swebench_lite/evidence/smoke-2026-08-11-dbce533/public-benchmark.json

@@ -1 +1 @@
-{"agent_only_efficiency": {"baseline": {"tokens_per_resolved": null, "usd_per_resolved": null}, "marginal": {"tokens_per_resolved": null, "usd_per_resolved": null}}, "baseline": {"effective_latency_ms": 593106, "effective_tokens": 1098747, "effective_usd": 0.0, "false_stop_rate": null, "false_stops": 0, "governance_latency_ms": 0, "governance_tokens": 0, "governance_usd": 0.0, "latency_ms": 593106, "repeated_calls": 0, "resolve_rate": 0.0, "resolved": 0, "reviewed_stops": 0, "tasks": 3, "tokens": 1098747, "tool_calls": 33, "usd": 0.0}, "benchmark": "public-agent-benchmark-comparison-v3", "efficiency": {"baseline": {"tokens_per_resolved": null, "usd_per_resolved": null}, "marginal": {"tokens_per_resolved": null, "usd_per_resolved": null}}, "governance": {"latency_ms": 7058, "tokens": 0, "usd": 0.0}, "gross_savings": {"confidence_level": 0.95, "latency_percent": 5.8, "repeated_calls_percent": 0.0, "tokens_confidence_interval": [21.52, 28.07], "tokens_percent": 24.93, "tool_calls_percent": 3.03, "usd_percent": 0.0}, "intervention": {"eligible_for_support": false, "graceful_irrelevance": true, "minimum_net_token_savings_percent": 0.0, "net_positive": true, "status": "pass_through"}, "marginal": {"effective_latency_ms": 565768, "effective_tokens": 824839, "effective_usd": 0.0, "false_stop_rate": null, "false_stops": 0, "governance_latency_ms": 7058, "governance_tokens": 0, "governance_usd": 0.0, "latency_ms": 558710, "repeated_calls": 0, "resolve_rate": 0.0, "resolved": 0, "reviewed_stops": 0, "tasks": 3, "tokens": 824839, "tool_calls": 32, "usd": 0.0}, "net_savings": {"confidence_level": 0.95, "latency_percent": 4.61, "repeated_calls_percent": 0.0, "tokens_95pct_ci": [21.52, 28.07], "tokens_confidence_interval": [21.52, 28.07], "tokens_percent": 24.93, "tool_calls_percent": 3.03, "usd_percent": 0.0}, "quality": {"false_stop_rate": null, "false_stops": 0, "false_stops_acceptable": true, "has_verified_success": false, "max_false_stop_rate": 0.0, "non_inferiority_margin_pp": 1.0, "preserved_within_margin": true, "preserved_within_one_pp": true, "recoveries": 0, "regressions": 0, "resolved_delta_pp": 0.0, "reviewed_stops": 0}, "savings": {"confidence_level": 0.95, "latency_percent": 4.61, "repeated_calls_percent": 0.0, "tokens_95pct_ci": [21.52, 28.07], "tokens_confidence_interval": [21.52, 28.07], "tokens_percent": 24.93, "tool_calls_percent": 3.03, "usd_percent": 0.0}, "tasks": 3}
+{"agent_only_efficiency": {"baseline": {"tokens_per_resolved": null, "usd_per_resolved": null}, "marginal": {"tokens_per_resolved": null, "usd_per_resolved": null}}, "baseline": {"effective_latency_ms": 593106, "effective_tokens": 1098747, "effective_usd": null, "false_stop_rate": null, "false_stops": 0, "governance_latency_ms": 0, "governance_tokens": 0, "governance_usd": null, "latency_ms": 593106, "repeated_calls": 0, "resolve_rate": 0.0, "resolved": 0, "reviewed_stops": 0, "tasks": 3, "tokens": 1098747, "tool_calls": 33, "usd": null}, "benchmark": "public-agent-benchmark-comparison-v3", "efficiency": {"baseline": {"tokens_per_resolved": null, "usd_per_resolved": null}, "marginal": {"tokens_per_resolved": null, "usd_per_resolved": null}}, "governance": {"latency_ms": 7058, "tokens": 0, "usd": null}, "gross_savings": {"confidence_level": 0.95, "latency_percent": 5.8, "repeated_calls_percent": 0.0, "tokens_confidence_interval": null, "tokens_percent": 24.93, "tool_calls_percent": 3.03, "usd_percent": null}, "intervention": {"eligible_for_support": false, "graceful_irrelevance": true, "minimum_net_token_savings_percent": 0.0, "net_positive": true, "status": "pass_through"}, "marginal": {"effective_latency_ms": 565768, "effective_tokens": 824839, "effective_usd": null, "false_stop_rate": null, "false_stops": 0, "governance_latency_ms": 7058, "governance_tokens": 0, "governance_usd": null, "latency_ms": 558710, "repeated_calls": 0, "resolve_rate": 0.0, "resolved": 0, "reviewed_stops": 0, "tasks": 3, "tokens": 824839, "tool_calls": 32, "usd": null}, "net_savings": {"confidence_level": 0.95, "latency_percent": 4.61, "repeated_calls_percent": 0.0, "tokens_95pct_ci": null, "tokens_confidence_interval": null, "tokens_percent": 24.93, "tool_calls_percent": 3.03, "usd_percent": null}, "quality": {"evaluable": false, "false_stop_rate": null, "false_stops": 0, "false_stops_acceptable": true, "has_verified_success": false, "max_false_stop_rate": 0.0, "non_inferiority_margin_pp": 1.0, "preserved_within_margin": null, "preserved_within_one_pp": null, "recoveries": 0, "regressions": 0, "resolved_delta_pp": 0.0, "reviewed_stops": 0}, "savings": {"confidence_level": 0.95, "latency_percent": 4.61, "repeated_calls_percent": 0.0, "tokens_95pct_ci": null, "tokens_confidence_interval": null, "tokens_percent": 24.93, "tool_calls_percent": 3.03, "usd_percent": null}, "tasks": 3}