douglasmonsky · douglasmonsky · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -47,6 +47,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           python -m pip install ".[dev]"
+          python -m venv --system-site-packages .venv
       - name: Verify kernel phase
         env:
           MATRIX_PYTHON: ${{ matrix.python-version }}

diff --git a/docs/INDEX.md b/docs/INDEX.md
@@ -212,6 +212,18 @@ runtime acceptance and
 does not authorize a command, launch, token refund, retry, restart,
 replacement, receipt, or downstream transition.
 
+The additive versioned
+[`lifecycle-terminal-failure-clean-commit-authority-v2`](decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.json)
+preserves both clean-commit v1 authority files byte-for-byte and closes the
+clean-hosted-checkout environment seam exposed by PR #448. It binds the one
+exact workflow change that creates the matrix interpreter's repository-local
+`.venv` with `python -m venv --system-site-packages .venv` after the existing
+tooling install and before verification. The v2 verifier admits only the exact
+18-path authority delta or exact 18-plus-seven clean integrated transition;
+missing, extra, partial, wrong-workflow, wrong-lineage, and wrong-candidate
+states fail closed. It adds no network install, qualification invocation,
+launch, refund, retry, receipt, runtime acceptance, or downstream authority.
+
 The V11 candidate must construct and validate the exact overlay/cohort-bound
 receipt and non-null stdout/stderr/output evidence before its first durable
 `completed` finalization. Evidence read/hash/parse/validation/finalization

diff --git a/docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.json b/docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.json
@@ -0,0 +1,143 @@
+{
+  "schema": "codex-usage-tracker.ck07r1-lifecycle-terminal-failure-clean-commit-authority.v2",
+  "version": 2,
+  "task": "CK-07R1",
+  "status": "permitted_not_accepted",
+  "authority_base_sha": "487e0b7138d638d7cfb1d91627e5a6ebda743699",
+  "authority_base_tree_sha": "2eef42c34cee001c40333e4e3d0af49e09bd7ec8",
+  "source_authority": [
+    {
+      "path": "docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v1.json",
+      "sha256": "badda5361f66944eb4972c061103435d55c6d59c2797ce7db8f34c70662d1e02"
+    },
+    {
+      "path": "docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v1.schema.json",
+      "sha256": "0819f90addbacccc2d45a467cce134a4a8112bd836cbfe2cbe9702b163ace03b"
+    }
+  ],
+  "superseded_immutable_paths": [
+    {
+      "path": ".github/workflows/ci.yml",
+      "before_sha256": "f25ea89fb207b2d7a9ff1c18953865ef91cb73cfe23796f545d304a40cc8959c",
+      "sha256": "ce1dd9c0324c32e00298aeb90100539796d583272dad4059cd81c5564b13437e"
+    },
+    {
+      "path": "scripts/ck07r1_prelaunch_recovery.py",
+      "before_sha256": "a3f6376f9f1328b5ccce3d8b16486b87cefe4d2b6c783a4e2a706e71142b1fc4",
+      "sha256": "36dbe7a7fc2aaf70a5458ebbb7c9e25a271662e3d6883631311f37ef2499a5d0"
+    },
+    {
+      "path": "scripts/ck07r1_shared_successor_overlay.py",
+      "before_sha256": "f3745ec07bf47ee15f50969132f315aec61d407c745f6c63694e9910a88c5768",
+      "sha256": "05ddf028f9cfda30b78d8756e21940c7915796357cef79c7a632da31dba60168"
+    }
+  ],
+  "implementation_transition": {
+    "pull_request": 448,
+    "source_base_sha": "652f2166b58b9ee0d719348a769901577d11e6fd",
+    "source_head_sha": "927aa06f7c4c88319cc30247343c40db8e9b817e",
+    "candidate_scope_source": "bound_v1_clean_commit_authority",
+    "representations": {
+      "dirty_prepublication": {
+        "head": "exact_v2_authority_head",
+        "worktree_delta": "exact_candidate_scope",
+        "committed_delta": "exact_v2_authority_scope"
+      },
+      "clean_integrated": {
+        "base": "exact_v2_authority_base",
+        "worktree_delta": "empty",
+        "committed_delta": "exact_v2_authority_scope_plus_candidate_scope",
+        "source_identity": "bound_v1_source_head_or_exact_tree_equivalent_squash"
+      }
+    }
+  },
+  "ci_environment_transition": {
+    "workflow_path": ".github/workflows/ci.yml",
+    "before_sha256": "f25ea89fb207b2d7a9ff1c18953865ef91cb73cfe23796f545d304a40cc8959c",
+    "sha256": "ce1dd9c0324c32e00298aeb90100539796d583272dad4059cd81c5564b13437e",
+    "matrix_python": [
+      "3.10",
+      "3.14"
+    ],
+    "install_step": "Install kernel tooling",
+    "command": [
+      "python",
+      "-m",
+      "venv",
+      "--system-site-packages",
+      ".venv"
+    ],
+    "required_before_step": "Verify kernel phase",
+    "lexical_interpreter": ".venv/bin/python",
+    "matching_sys_prefix": ".venv",
+    "network_access_added": false,
+    "qualification_command_invocations": 0
+  },
+  "decision": {
+    "root_cause": "clean_hosted_checkout_lacked_bound_repository_venv",
+    "v1_authority_bytes_preserved": true,
+    "dirty_prepublication_remains_valid": true,
+    "clean_committed_transition_permitted": true,
+    "implementation_acceptance": "not_claimed",
+    "runtime_acceptance": "not_claimed",
+    "new_command_invocations_permitted": 0,
+    "launch_authorized": false,
+    "token_consumed": true,
+    "token_refund": false,
+    "retry": "none",
+    "restart": "none",
+    "replacement": "none",
+    "receipt_fabrication": "forbidden",
+    "post_single_run": "unavailable_without_complete_planner_valid_receipt",
+    "final_accepted": "unavailable"
+  },
+  "scope": {
+    "authority_write_scope": [
+      ".github/workflows/ci.yml",
+      "docs/INDEX.md",
+      "docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.json",
+      "docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.schema.json",
+      "docs/roadmap/REMAINING_EXECUTION_PLAN.md",
+      "docs/roadmap/TASK_PACKETS.md",
+      "docs/roadmap/tasks/ck-07r1-correct-lifecycle-preparation-scale.md",
+      "scripts/check_kernel_scope.py",
+      "scripts/ck07r1_consuming_boundary.py",
+      "scripts/ck07r1_prelaunch_recovery.py",
+      "scripts/ck07r1_shared_successor_overlay.py",
+      "scripts/ck07r1_terminal_failure_correction.py",
+      "tests/kernel/test_ck07r1_consuming_boundary_authority.py",
+      "tests/kernel/test_ck07r1_prelaunch_recovery_authority.py",
+      "tests/kernel/test_ck07r1_shared_successor_overlay.py",
+      "tests/kernel/test_ck07r1_terminal_failure_correction_authority.py",
+      "tests/kernel/test_documentation_authority.py",
+      "tests/kernel/test_kernel_scope.py"
+    ],
+    "candidate_scope": [
+      "output/ck07r1/lifecycle-requalification-v1.launch-token.json",
+      "output/ck07r1/lifecycle-requalification-v2.launch-token.json",
+      "output/ck07r1/lifecycle-requalification-v2.stderr.txt",
+      "output/ck07r1/lifecycle-requalification-v2.stdout.txt",
+      "scripts/benchmark_ck07r1_lifecycle_scale.py",
+      "src/codex_usage_tracker/agent_kernel/publication/preparation.py",
+      "tests/agent_kernel/publication/test_lifecycle_scale.py"
+    ],
+    "forbidden": [
+      "mixed_partial_or_extra_candidate_delta",
+      "extra_workflow_or_authority_delta",
+      "wrong_v2_authority_base_or_tree",
+      "wrong_implementation_source_head_or_candidate_bytes",
+      "v1_authority_rewrite",
+      "terminal_evidence_mutation",
+      "qualification_command_invocation",
+      "child_or_fork",
+      "token_refund_or_new_invocation",
+      "retry_restart_or_replacement",
+      "receipt_fabrication",
+      "implementation_files_in_authority_pr",
+      "PR_394_mutation",
+      "live_or_real_data",
+      "downstream_dispatch",
+      "cleanup_or_witness_loss"
+    ]
+  }
+}
diff --git a/...isions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.schema.json b/...isions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.schema.json
@@ -0,0 +1,188 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://local.codex/schemas/ck07r1-lifecycle-terminal-failure-clean-commit-authority-v2.json",
+  "title": "CK-07R1 lifecycle terminal failure clean committed CI transition authority v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "version",
+    "task",
+    "status",
+    "authority_base_sha",
+    "authority_base_tree_sha",
+    "source_authority",
+    "superseded_immutable_paths",
+    "implementation_transition",
+    "ci_environment_transition",
+    "decision",
+    "scope"
+  ],
+  "properties": {
+    "schema": {
+      "const": "codex-usage-tracker.ck07r1-lifecycle-terminal-failure-clean-commit-authority.v2"
+    },
+    "version": {
+      "const": 2
+    },
+    "task": {
+      "const": "CK-07R1"
+    },
+    "status": {
+      "const": "permitted_not_accepted"
+    },
+    "authority_base_sha": {
+      "const": "487e0b7138d638d7cfb1d91627e5a6ebda743699"
+    },
+    "authority_base_tree_sha": {
+      "const": "2eef42c34cee001c40333e4e3d0af49e09bd7ec8"
+    },
+    "source_authority": {
+      "const": [
+        {
+          "path": "docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v1.json",
+          "sha256": "badda5361f66944eb4972c061103435d55c6d59c2797ce7db8f34c70662d1e02"
+        },
+        {
+          "path": "docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v1.schema.json",
+          "sha256": "0819f90addbacccc2d45a467cce134a4a8112bd836cbfe2cbe9702b163ace03b"
+        }
+      ]
+    },
+    "superseded_immutable_paths": {
+      "const": [
+        {
+          "path": ".github/workflows/ci.yml",
+          "before_sha256": "f25ea89fb207b2d7a9ff1c18953865ef91cb73cfe23796f545d304a40cc8959c",
+          "sha256": "ce1dd9c0324c32e00298aeb90100539796d583272dad4059cd81c5564b13437e"
+        },
+        {
+          "path": "scripts/ck07r1_prelaunch_recovery.py",
+          "before_sha256": "a3f6376f9f1328b5ccce3d8b16486b87cefe4d2b6c783a4e2a706e71142b1fc4",
+          "sha256": "36dbe7a7fc2aaf70a5458ebbb7c9e25a271662e3d6883631311f37ef2499a5d0"
+        },
+        {
+          "path": "scripts/ck07r1_shared_successor_overlay.py",
+          "before_sha256": "f3745ec07bf47ee15f50969132f315aec61d407c745f6c63694e9910a88c5768",
+          "sha256": "05ddf028f9cfda30b78d8756e21940c7915796357cef79c7a632da31dba60168"
+        }
+      ]
+    },
+    "implementation_transition": {
+      "const": {
+        "pull_request": 448,
+        "source_base_sha": "652f2166b58b9ee0d719348a769901577d11e6fd",
+        "source_head_sha": "927aa06f7c4c88319cc30247343c40db8e9b817e",
+        "candidate_scope_source": "bound_v1_clean_commit_authority",
+        "representations": {
+          "dirty_prepublication": {
+            "head": "exact_v2_authority_head",
+            "worktree_delta": "exact_candidate_scope",
+            "committed_delta": "exact_v2_authority_scope"
+          },
+          "clean_integrated": {
+            "base": "exact_v2_authority_base",
+            "worktree_delta": "empty",
+            "committed_delta": "exact_v2_authority_scope_plus_candidate_scope",
+            "source_identity": "bound_v1_source_head_or_exact_tree_equivalent_squash"
+          }
+        }
+      }
+    },
+    "ci_environment_transition": {
+      "const": {
+        "workflow_path": ".github/workflows/ci.yml",
+        "before_sha256": "f25ea89fb207b2d7a9ff1c18953865ef91cb73cfe23796f545d304a40cc8959c",
+        "sha256": "ce1dd9c0324c32e00298aeb90100539796d583272dad4059cd81c5564b13437e",
+        "matrix_python": [
+          "3.10",
+          "3.14"
+        ],
+        "install_step": "Install kernel tooling",
+        "command": [
+          "python",
+          "-m",
+          "venv",
+          "--system-site-packages",
+          ".venv"
+        ],
+        "required_before_step": "Verify kernel phase",
+        "lexical_interpreter": ".venv/bin/python",
+        "matching_sys_prefix": ".venv",
+        "network_access_added": false,
+        "qualification_command_invocations": 0
+      }
+    },
+    "decision": {
+      "const": {
+        "root_cause": "clean_hosted_checkout_lacked_bound_repository_venv",
+        "v1_authority_bytes_preserved": true,
+        "dirty_prepublication_remains_valid": true,
+        "clean_committed_transition_permitted": true,
+        "implementation_acceptance": "not_claimed",
+        "runtime_acceptance": "not_claimed",
+        "new_command_invocations_permitted": 0,
+        "launch_authorized": false,
+        "token_consumed": true,
+        "token_refund": false,
+        "retry": "none",
+        "restart": "none",
+        "replacement": "none",
+        "receipt_fabrication": "forbidden",
+        "post_single_run": "unavailable_without_complete_planner_valid_receipt",
+        "final_accepted": "unavailable"
+      }
+    },
+    "scope": {
+      "const": {
+        "authority_write_scope": [
+          ".github/workflows/ci.yml",
+          "docs/INDEX.md",
+          "docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.json",
+          "docs/decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.schema.json",
+          "docs/roadmap/REMAINING_EXECUTION_PLAN.md",
+            "docs/roadmap/TASK_PACKETS.md",
+            "docs/roadmap/tasks/ck-07r1-correct-lifecycle-preparation-scale.md",
+            "scripts/check_kernel_scope.py",
+            "scripts/ck07r1_consuming_boundary.py",
+            "scripts/ck07r1_prelaunch_recovery.py",
+            "scripts/ck07r1_shared_successor_overlay.py",
+            "scripts/ck07r1_terminal_failure_correction.py",
+            "tests/kernel/test_ck07r1_consuming_boundary_authority.py",
+            "tests/kernel/test_ck07r1_prelaunch_recovery_authority.py",
+            "tests/kernel/test_ck07r1_shared_successor_overlay.py",
+          "tests/kernel/test_ck07r1_terminal_failure_correction_authority.py",
+          "tests/kernel/test_documentation_authority.py",
+          "tests/kernel/test_kernel_scope.py"
+        ],
+        "candidate_scope": [
+          "output/ck07r1/lifecycle-requalification-v1.launch-token.json",
+          "output/ck07r1/lifecycle-requalification-v2.launch-token.json",
+          "output/ck07r1/lifecycle-requalification-v2.stderr.txt",
+          "output/ck07r1/lifecycle-requalification-v2.stdout.txt",
+          "scripts/benchmark_ck07r1_lifecycle_scale.py",
+          "src/codex_usage_tracker/agent_kernel/publication/preparation.py",
+          "tests/agent_kernel/publication/test_lifecycle_scale.py"
+        ],
+        "forbidden": [
+          "mixed_partial_or_extra_candidate_delta",
+          "extra_workflow_or_authority_delta",
+          "wrong_v2_authority_base_or_tree",
+          "wrong_implementation_source_head_or_candidate_bytes",
+          "v1_authority_rewrite",
+          "terminal_evidence_mutation",
+          "qualification_command_invocation",
+          "child_or_fork",
+          "token_refund_or_new_invocation",
+          "retry_restart_or_replacement",
+          "receipt_fabrication",
+          "implementation_files_in_authority_pr",
+          "PR_394_mutation",
+          "live_or_real_data",
+          "downstream_dispatch",
+          "cleanup_or_witness_loss"
+        ]
+      }
+    }
+  }
+}
diff --git a/docs/roadmap/REMAINING_EXECUTION_PLAN.md b/docs/roadmap/REMAINING_EXECUTION_PLAN.md
@@ -215,6 +215,14 @@ authority-main tree or as a clean committed PR/integrated delta with exact
 base, scope, and hashes. Neither representation reopens the consumed run or
 changes the existing blocked state.
 
+The additive [clean-committed CI authority v2](../decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.json)
+preserves the v1 bridge bytes and binds the clean hosted matrix's
+repository-local `.venv` creation before verification. It recognizes only the
+exact 18-path follow-up authority delta and exact 18-plus-seven integrated
+PR #448 state. This deterministic environment correction does not authorize a
+qualification command, another child, token action, retry, receipt,
+implementation acceptance, or downstream readiness.
+
 The exact V11 launcher contract constructs and validates the fully
 overlay/cohort-bound receipt and non-null stdout/stderr/output evidence before
 any first durable `completed` finalization. Evidence

diff --git a/docs/roadmap/TASK_PACKETS.md b/docs/roadmap/TASK_PACKETS.md
@@ -124,6 +124,13 @@ locks are unchanged.
 - [ ] **CK-16-03 — Build once and qualify release candidate** · Blocked on docs/selected optional work · [packet](tasks/ck-16-03-build-once-qualify-release-candidate.md)
 - [ ] **CK-16-04 — Publish and verify public artifacts** · Blocked on CK-16-03 and approval · [packet](tasks/ck-16-04-publish-verify-public-artifacts.md)
 
+### CK-07R1 hosted CI authority supplement
+
+The [clean-committed CI authority v2](../decisions/evidence/ck07r1a0/lifecycle-terminal-failure-clean-commit-authority-v2.json)
+binds the exact repository-local hosted `.venv` seam for PR #448 without
+reopening the consumed run, authorizing a retry, or changing receipt-based
+acceptance and downstream holds.
+
 ## Critical path
 
 `CK-00 → CK-01 → CK-02 → CK-03 → CK-04 → CK-05 → CK-06 → CK-07 → CK-07B