fix: harden workflow authority gates

docs/CLI.md

@@ -479,7 +479,7 @@ Flags:
 Notes:
 - Prefer explicit public source-family examples such as `--sources web,community`; use `--source-selection` only to explain selector semantics.
 - Use `--browser-mode extension` when X, Threads, Facebook, Reddit, or another signed-in social provider needs an existing relay-backed browser session; use `managed` for reproducible no-auth reruns.
-- In the current contract, `auto` and `all` both stay inside the public topical families (`web`, `community`, `social`), but neither value guarantees reliability.
+- `--source-selection auto` is public-first and resolves to `web,community`. Use `--source-selection all`, `--source-selection social`, or explicit `--sources ...social...` only when social evidence is intentional.
 - Add shopping only with `--source-selection shopping` or explicit `--sources ...shopping...` when the task is deliberately commercial.
 - Successful research artifact bundles include `report.md`, `summary.md`, `records.json`, `context.json`, `meta.json`, and `bundle-manifest.json`.
 - `report.md` is the primary deterministic evidence briefing. It renders evidence gate status, final answer, claim map, theme synthesis, source agreement or disagreement, confidence by claim, limitations, recommendations, and an evidence appendix from accepted records and metadata.
@@ -515,9 +515,9 @@ Flags:
 Notes:
 - Use explicit providers plus `--browser-mode managed` for the most reproducible live reruns.
 - `deals.md` is the primary deterministic buying brief. It renders `# Shopping Buying Brief`, a Buying Readiness Gate, Recommendation, Best Candidate Offers, Market Baseline, Warnings and Constraints, Excluded or Constrained Offers, and an Evidence Appendix.
-- Buying readiness is `pass`, `partial`, or `fail`. `pass` allows bounded buying guidance, `partial` means use the output as a constrained shortlist, and `fail` means no confident purchase recommendation is allowed from the current evidence.
+- Buying readiness is `pass`, `partial`, or `fail`. `pass` allows bounded buying guidance, `partial` means use the output as a constrained shortlist, and `fail` means no confident purchase recommendation is allowed from the current evidence. Inspect `buyingReadiness.status` in JSON and completion text; command success only means the workflow completed transport and artifact work.
 - Raw audit surfaces stay separate: `offers.json` preserves structured offers, `comparison.csv` preserves the tabular comparison with appended currency and total-status audit fields, `meta.json` preserves workflow diagnostics, and `deals-context.json` preserves `query`, report-derived `highlights`, raw `offers`, and `meta` for agent handoff.
-- `compact` and `context` modes summarize the same report guidance as `deals.md`; `json` mode still returns raw offers and meta.
+- `compact` and `context` modes summarize the same report guidance as `deals.md`; `json` mode returns raw offers, `buyingReadiness`, and meta.
 - Expect warnings for stale, inferred, or missing price freshness; unknown or out-of-stock availability; weak query relevance; suspicious titles; duplicate same-title or same-product pressure; workflow alerts; and advisory region handling.
 - Treat `--region` as advisory unless `meta.selection.region_authoritative=true`. If `meta.alerts` includes `reasonCode=region_unenforced`, do not present the output as a trustworthy regional comparison. The alert is emitted only for selected provider diagnostics that did not enforce the requested region; enforced-region diagnostics do not create that warning.
 - The Market Baseline section is computed only from deterministic same-currency evidence. If sample size or currency coverage is insufficient, the report says `market baseline unavailable` instead of inventing savings.
@@ -554,7 +554,7 @@ Notes:
 - Successful product-video runs write `manifest.json`, `product.json`, `pricing.json`, `copy.md`, `features.md`, `presentation-readiness.json`, `raw/source-record.json`, and `bundle-manifest.json`.
 - `--output-dir` is a workflow root, not the final bundle directory. Omit it for routine runs and inspect the returned `artifact_path` first; when omitted, persisted artifacts land under `.opendevbrowser/product-video/<runId>`. If a wrapper must pass an explicit root, prefer `--output-dir .opendevbrowser`.
 - `presentation-readiness.json` is the audit surface for `presentationReadiness`, `productVideoReadiness`, selected and original record ids, bounded candidate summaries, promoted claims, rejected candidate summaries, evidence references, and compact counts.
-- `manifest.readiness.presentation` and `manifest.readiness.productVideo` are the manifest production gates. `product.json.presentationReadiness`, `product.json.productVideoReadiness`, returned `product.presentationReadiness`, and returned `product.productVideoReadiness` mirror the product-facing gates, while JSON workflow output exposes `meta.presentationReadiness` and `meta.productVideoReadiness`.
+- `manifest.readiness.presentation` and `manifest.readiness.productVideo` are the manifest production gates. `product.json.presentationReadiness`, `product.json.productVideoReadiness`, returned `product.presentationReadiness`, and returned `product.productVideoReadiness` mirror the product-facing gates, while JSON workflow output exposes `meta.presentationReadiness` and `meta.productVideoReadiness`. CLI completion text also includes both readiness statuses when available, so transport success is not confused with production authority.
 - Readiness status is `pass`, `partial`, or `fail`. `pass` can feed a normal production brief after human evidence review. `partial` is a constrained draft and must carry warnings plus reason codes. `fail` blocks production use.
 - Raw evidence stays preserved under `raw/source-record.json` for audit and debugging. Do not treat raw marketplace, site navigation, catalog, seller, shipping, condition, or returns text as verified copy unless it is promoted through `presentation-readiness.json.promotedClaims[]`.
 - `copy.md` and `features.md` are not automatically verified production input. They are production-safe only when readiness permits and the claims evidence map ties each claim to captured or structured evidence.
@@ -600,7 +600,7 @@ Notes:
 - Repeat `--url` for multiple inspiration sources. There is no `--urls` alias.
 - `harvest` merges explicit URLs before discovered URLs, trims and de-duplicates references, and stores rejected reference diagnostics in generated metadata.
 - Query-based Pinterest harvests become product-ready only through query-discovered canonical `/pin/{id}/` references plus manifest-backed first-party pin-media bytes. `discovery-diagnostics.json` records accepted and rejected URL counts, blocker diagnostics, and recovery actions; login/challenge and search-shell diagnostics are recovery paths, not product-ready evidence.
-- `social/pinterest` is a browser-native site recipe. For non-Google logged-in Pinterest search, prefer a dedicated managed headed profile with `--profile <name>`, `--use-cookies`, and `--cookie-policy required`; use extension `/ops` when you need live active-tab reuse. Registry-backed explicit CDP profiles are available for browser/session primitives through `cdp-profile start` plus `connect --profile`, but provider workflows do not yet expose an explicit-CDP transport selector. Compatible Pinterest URL recovery can run as `--provider social/pinterest --url <pinterest-url>` without `--query`; generic provider plus URL recovery without a query remains rejected. Use one canonical `/pin/{id}/` URL per harvest when validating design-ready pin media. The workflow must recover session evidence first when Pinterest returns login, challenge, empty-grid, or search-shell states.
+- `social/pinterest` is a browser-native site recipe. Default Pinterest harvest applies extension auth defaults only when `extensionAuthReady` is current and the caller has not set incompatible auth transport or cookie settings. Explicit `browserMode`, `profile`, `useCookies`, `cookiePolicyOverride`, or `challengeAutomationMode` values other than `browser_with_helper` opt out; explicit `challengeAutomationMode=browser_with_helper` is compatible and may merge with the implicit extension, cookies, and required cookie policy defaults. For managed recovery, use a dedicated headed profile with `--profile <name>`, `--use-cookies`, and `--cookie-policy required`. Registry-backed explicit CDP profiles are available for browser/session primitives through `cdp-profile start` plus `connect --profile`, but provider workflows do not yet expose an explicit-CDP transport selector. Compatible Pinterest URL recovery can run as `--provider social/pinterest --url <pinterest-url>` without `--query`; generic provider plus URL recovery without a query remains rejected. Use one canonical `/pin/{id}/` URL per harvest when validating design-ready pin media. The workflow must recover session evidence first when Pinterest returns login, challenge, empty-grid, or search-shell states.
 - Canonical Pinterest pin-media harvest opens the exact canonical pin in the active managed or extension workflow session before extracting persisted first-party bytes. Extension `/ops` remains the best live-tab reuse path, but it is no longer the only intended logged-in Pinterest lane.
 - Browser-native site recipes do not silently widen scope to unrelated providers. If fallback to broad web sources is desired, ask the user or rerun with an explicit `--provider web/default`.
 - `--include-prototype-guidance` appends prototype structure guidance to the generated design contract output.
@@ -619,7 +619,7 @@ Notes:
 - Workflow outputs can include typed `nextStepGuidance` with `readiness`, `reasonCode`, `primaryAction`, command examples, `paramsExamples`, `validationChecks`, `fallbackPolicy`, and `doNotProceedIf` blockers.
 - Harvest outputs separate operational completion, guidance readiness, and product readiness. `success:true` or `ok:true` means the command completed and wrote artifacts; top-level `ready` is product-ready only when `productSuccess=true`, `artifactAuthority=product_ready`, and `evidenceAuthority` is non-diagnostic. `readiness` and `guidanceReadiness` expose the next-step guidance state.
 - Treat product readiness as the gate between artifact completion and design readiness. Continue to Canvas only when top-level `ready=true`, `productSuccess=true`, `artifactAuthority=product_ready`, ranked references are non-empty, manifest-backed authority evidence exists, and no `doNotProceedIf` condition applies. For canonical Pinterest pin-media harvests, Canvas continuation requires `evidenceAuthority=pin_media_ready` and manifest-backed `pin-media-index.json`; `snapshot_ready` and `motion_ready` are not substitutes for pin-media readiness.
-- Pinterest product readiness is pin-media-first: canonical pin URLs become product-ready only when their first-party pin-media artifact is captured, persisted, present in its manifest-backed index, and free of blocking warnings. Screenshot and screencast artifacts can inform diagnostics or motion design, but they do not satisfy required Pinterest pin-media readiness. The exact `login_or_challenge_state` and strict byte-backed `interface_chrome_shell` diagnostics are non-blocking only for trusted first-party manifest-backed pin-media bytes; broader login, challenge, captcha, search-shell, promoted, ad, blank, tiny, or chrome-only blockers still demote readiness unless query-discovered canonical pins also produce complete pin-media authority. When pin-media authority is complete, unavailable supplemental viewport screenshot evidence is recorded as skipped and satisfied by pin media, not as product-readiness failure. `pin-media-index.json` remains Pinterest authority, `media-analysis.json` remains advisory, and `motion-evidence.json` remains browser replay authority. Multimodal agents reason over those artifacts directly.
+- Pinterest product readiness is pin-media-first: canonical pin URLs become product-ready only when their first-party pin-media artifact is captured, persisted, present in its manifest-backed index, and free of blocking warnings. Screenshot and screencast artifacts can inform diagnostics or motion design, but they do not satisfy required Pinterest pin-media readiness. `login_or_challenge_state`, broader login, challenge, captcha, search-shell, promoted, ad, blank, tiny, or chrome-only blockers demote readiness; strict byte-backed `interface_chrome_shell` diagnostics remain non-blocking only for trusted first-party manifest-backed pin-media bytes. When pin-media authority is complete, unavailable supplemental viewport screenshot evidence is recorded as skipped and satisfied by pin media, not as product-readiness failure. `pin-media-index.json` remains Pinterest authority, `media-analysis.json` remains advisory, and `motion-evidence.json` remains browser replay authority. Multimodal agents reason over those artifacts directly.
 - CLI completion text includes `guidanceReadiness=<value> productSuccess=false artifactAuthority=<value> evidenceAuthority=<value>` when guidance readiness exists but product readiness is false. Product-ready runs can still emit `readiness=<value>`.
 - For `needs_recovery`, `blocked`, or `diagnostic_only`, follow the primary recovery action first. Common blockers are zero references, empty ranked references, failed required screenshot, screencast, or pin-media evidence, provider unavailability, login or challenge screens, and diagnostic-only captures.
 - The ready follow-through path is explicit: read `advanced-brief.md`, `meta-prompt.md`, `evidence.json`, `ranked-references.json`, `bundle-manifest.json`, `media-analysis.json` when present, and screenshot, screencast, or pin-media evidence first; load `opendevbrowser_skill_load opendevbrowser-best-practices "quick start"`, `opendevbrowser_skill_load opendevbrowser-design-agent "canvas-contract"`, and `opendevbrowser_skill_load opendevbrowser-motion-design "quick start"`; continue only if `canvas-plan.request.json` exists; open a Canvas session; fill the session ids in `canvas-plan.request.json`; run `opendevbrowser canvas --command canvas.plan.set --params-file ./canvas-plan.request.json`; confirm `planStatus=accepted`; then patch only the governance blocks called out by `design-agent-handoff.json`.
@@ -921,6 +921,7 @@ Notes:
 - `--timeout-ms` sets client-side daemon transport timeout for slow `--execute` runs.
 - `--browser-mode` is accepted for `--execute` runs and maps provider recovery to the same `auto|extension|managed` modes as workflow commands.
 - `--challenge-automation-mode` is accepted for `--execute` runs and maps to `challengeAutomationMode` with the same `run > session > config` precedence as workflow commands.
+- Inspect `execution.meta.ok`, `execution.meta.partial`, and `execution.failures` before treating an executed macro as complete. `success:true` can mean transport success while provider execution remains unblocked but incomplete.
 - `opendevbrowser --help` includes this timeout flag in the global flag inventory.
 
 ### Blocker contract (v2)