fix(evals): require native integrity for passed unchanged claims

[vriesd]

Why

Qualification rejected a completed workflow because its handoff said node scripts/verify.mjs passed unchanged. The saved native input passes when that sentence uses the grader's existing explicit script and invocation wording.

What changed

• Parse the exact passed unchanged status as a pass claim with script and invocation integrity.
• Reuse the existing source-bound validation, accepted review, canonical gate, and immutable-script checks.
• Add the saved organic handoff and regression tests for missing proof, changed scripts, conflicting statements, unknown commands, and scoped examples.

Scope

This changes the delivery evaluator and its tests. The packed 9.6.0 plugin, release policy, catalog, case instructions, models, and sampling remain identical.

Tradeoffs

The parser accepts this closed status phrase. Arbitrary suffixes remain unsupported because they can introduce conflicting claims.

Blast Radius

Maintainers can grade the observed truthful handoff without discarding its integrity claim. Product behavior and release passing requirements remain unchanged.

Verification

• RED committed before GREEN. The whole organic handoff and its semantic assertion reproduce the rejection before the repair.
• All three actual saved campaign inputs pass with the repair. Nine native proof and integrity mutations remain rejected.
• 349 focused delivery tests pass. Full push preflight passes with 2,965 passing tests, 20 existing skips, and zero failures. Independent exact-head review passes, and actual package hashes match the approved artifact.

The original stopped campaign remains failed. Offline replay provides repair evidence, not live qualification.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T09:03:57.492379Z	f7ac221	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.