test: capture held-merge and resume evidence

AGENTS.md

@@ -46,14 +46,13 @@ or makes a public SDK/provider/MCP stability promise. The real
 execution-host path is now selectable on macOS and proves an honest `weak` `process-group` posture
 at compose time; the current real GitHub Forge/GitHub Issues path includes blocked-PR surfacing,
 held-merge replay safety, landing-path redaction, and origin-bearing work-source provenance —
-the success-path real Forge `open-pr` smoke has been rerun on the current checkout, while
-held-merge and commit-status/comment block-surfacing legs remain unit-proven with real-effect
-evidence still owed.
+the success-path real Forge `open-pr`, protected-branch held merge, commit-status/comment
+block-surfacing, and resume idempotency smokes have been captured on the current checkout.
 Strong no-phone-home evidence remains future work. EVRUN-partial is recorded; P11 also records a
 blocked EVRUN-full capture attempt plus a later successful combined EVRUN-full smoke: real GitHub
 Issues, real Codex app-server, real host attestation, real GitHub Forge `open-pr`, and records
-integrity on the disposable target repo. Strong no-phone-home, held-merge/idempotency, hosted, and
-Windows evidence remain future work.
+integrity on the disposable target repo. Strong no-phone-home, hosted, and Windows evidence remain
+future work.
 
 ## Commands
 

README.md

@@ -35,16 +35,13 @@ checkout. The package split and the private Codex app-server transport are now i
 inside this private workspace; neither creates a shipped public API. The real execution-host path
 now exercises a local macOS process-group probe and reports an honest `weak` containment posture.
 
-Current evidence proves a scoped real-provider path with a scripted agent leg
-(`EVRUN-partial`). P11 also captured an EVRUN-full attempt: the narrow Codex app-server and
-real-host smokes pass outside the Codex sandbox, but the combined real GitHub path could not run
-without sandbox credentials and an integrity key. The current real GitHub Forge/GitHub Issues path
-also carries blocked-PR surfacing, held-merge replay safety, landing-path redaction, and
-per-candidate origin-bearing provenance — the success-path real Forge `open-pr` smoke has been
-rerun on the current checkout, while held-merge and commit-status/comment block-surfacing legs
-remain unit-proven with real-effect evidence still owed. `EVRUN-full`, remote execution, public
-package publication, and a full Codex-driven agent leg remain future work; strong/no-phone-home
-execution-host evidence remains in that later proof step.
+Current evidence proves scoped real-provider paths with a scripted agent leg (`EVRUN-partial` and
+P05 follow-up smokes). P11 also captured a combined EVRUN-full smoke with real GitHub Issues, real
+Codex app-server, real host attestation, real GitHub Forge `open-pr`, records integrity, and
+redaction on the disposable target repo. The current real GitHub Forge path now carries real-effect
+evidence for blocked-PR surfacing, held-merge posture, landing-path redaction, repeated-effect
+idempotency, and per-candidate origin-bearing provenance. Remote execution, public package
+publication, and strong/no-phone-home execution-host evidence remain future work.
 
 ## Quick Start
 

docs/README.md

@@ -25,9 +25,8 @@ scoped to **Jig the execution engine**.
 Current implementation truth includes a private setup command that emits validated owner
 configuration, plus a private real GitHub Forge/GitHub Issues path with blocked-PR surfacing,
 held-merge replay safety, landing-path redaction, and origin-bearing candidate provenance —
-the success-path real Forge `open-pr` smoke has been rerun on the current checkout, while
-held-merge and commit-status/comment block-surfacing legs remain unit-proven with real-effect
-evidence still owed;
+the success-path real Forge `open-pr`, protected-branch held merge, commit-status/comment
+block-surfacing, and resume idempotency smokes have been captured on the current checkout;
 phase-table PR-number status updates still live in delivery docs.
 
 Preserve active design history in place:

docs/delivery/target-state-implementation/README.md

@@ -60,8 +60,8 @@ Verified against the repo after Phase 02 workspace split:
   includes the private production Codex app-server transport: `bootstrap.ts` composes
   `createProductionCodexAgentSession`, and driver selection supports `agent: 'codex'`. The
   remaining limitation is evidence, not absence of implementation: P11 now records the combined
-  real Codex / real GitHub `open-pr` smoke, while stronger no-phone-home and repeated-effect
-  idempotency evidence remain open. The real Execution host is now selectable on macOS and
+  real Codex / real GitHub `open-pr` smoke and a later real repeated-effect idempotency smoke,
+  while stronger no-phone-home evidence remains open. The real Execution host is now selectable on macOS and
   exercises a local `process-group` confinement probe that reports an honest proven `weak` posture
   at compose time.
 - **Conformance and controlled doubles** now live in `packages/jig-testkit`
@@ -78,9 +78,9 @@ Verified against the repo after Phase 02 workspace split:
 - **Evidence**: EVRUN-partial is committed
   ([evidence index](../../design/evidence/README.md)) — one real
   work-source → forge → records-integrity run with a **scripted** agent leg. P11 also records the
-  earlier blocked EVRUN-full attempt and the later combined real Codex / real-host / real GitHub
-  `open-pr` smoke. Strong no-phone-home, held-merge/idempotency, hosted, and Windows evidence
-  remain open.
+  earlier blocked EVRUN-full attempt, the later combined real Codex / real-host / real GitHub
+  `open-pr` smoke, and the follow-up held-merge / resume idempotency smokes. Strong
+  no-phone-home, hosted, and Windows evidence remain open.
 
 ## Desired target state
 
@@ -103,9 +103,9 @@ Verified against the repo after Phase 02 workspace split:
 - **Observability** ([guarantee 5](../../product/guarantees.md#5-full-observability)): watch,
   notices with acknowledge/snooze, ask-why, and write-once redacted export, all answered from
   the run's own records.
-- **Evidence**: EVRUN-full combined smoke committed; remaining no-phone-home/idempotency evidence
-  captured or explicitly deferred; contract-freeze readiness prepared for the contract owner's T14
-  decision.
+- **Evidence**: EVRUN-full combined smoke committed; repeated-effect idempotency captured; remaining
+  no-phone-home evidence captured or explicitly deferred; contract-freeze readiness prepared for the
+  contract owner's T14 decision.
 - **Docs**: README, AGENTS.md, and docs indexes state the shipped surface truthfully at every
   phase boundary.
 
@@ -346,16 +346,13 @@ boundary enforcement from P02 on, docs checks, and the definition of "delivered"
 Per the escalation rule (product owns what/why; design reconciles to product; delivery names
 conflicts rather than resolving them):
 
-- **`MERGE-5` is partially proven; block-surfacing real-effect evidence is still owed.** The
-  product guarantees blocked-PR surfacing. Surfacing is now reachable from normal runner wiring,
-  and the success-path real Forge `open-pr` smoke was rerun on the current checkout
-  (`docs/design/evidence/2026-07-06-p05-real-forge-smoke-rerun.md`). The commit-status/comment
-  block-surfacing leg remains unit-proven, the earlier commit-status write/read attempt failed
-  with an HTTP 403, and held-merge posture was never observed against a protected target — the
-  EVRUN-partial-style smoke records explicitly do not claim `MERGE-5` end to end. Additional
-  real-effect proof remains required before the claim is fully proven; see the review record
-  `docs/archive/reviews/2026-07-06-p04-p12-target-state-review.md` for the observed failure
-  detail.
+- **`MERGE-5` has real-effect evidence.** The product guarantees blocked-PR surfacing. Surfacing is
+  reachable from normal runner wiring, the success-path real Forge `open-pr` smoke was rerun on the
+  current checkout (`docs/design/evidence/2026-07-06-p05-real-forge-smoke-rerun.md`), and the
+  follow-up held-merge smoke observed a protected-branch `done-not-landed` outcome plus readable
+  PR/status/comment block surfacing
+  (`docs/design/evidence/2026-07-06-p05-held-merge-smoke.md`). Earlier partial records remain
+  provenance for the previous gap, not the current claim.
 - **GUARD-2 pause shape is an open design question** (distinct sub-state vs. reusing `parked`,
   raised in [`plan-intake.md`](../../design/core/plan-intake.md#open-questions);
   [`authorization.md`](../../design/core/authorization.md) explicitly declines to invent a new

docs/delivery/target-state-implementation/phases/11-evrun-full-evidence.md

@@ -12,8 +12,9 @@ Issues work source, real Codex agent over the app-server transport, real executi
 containment, real GitHub Forge landing, integrity and redaction active — plus the adversarial
 probes EVRUN-partial could not claim (no-phone-home, multi-run idempotency). P11 first landed an
 honest blocked capture attempt; a later follow-up captured the combined real GitHub / real Codex /
-real-host `open-pr` smoke. Strong no-phone-home, held-merge replay, and multi-run idempotency
-remain open. Product code changes are not this phase's purpose.
+real-host `open-pr` smoke, and this follow-up captured multi-run idempotency against a real
+`open-pr` effect. Strong no-phone-home remains open. Product code changes are not this phase's
+purpose.
 
 ## Background
 
@@ -55,8 +56,9 @@ gated on this evidence path. This phase is the proof step: it converts "implemen
 - A successful capture would prove `SEC-2` (no-phone-home proven, not asserted), `RESUME-3` (no
   double effect against real systems), and `MERGE-2`/`FENCE-3` observations on a real path.
 - The later combined smoke removes the original "real Codex plus real GitHub path unproven"
-  blocker. P13/P14 status claims still need either stronger no-phone-home/idempotency evidence or
-  an explicit owner decision to defer those gates.
+  blocker, and the RESUME-3 smoke removes the repeated real-effect idempotency blocker. P13/P14
+  status claims still need either stronger no-phone-home evidence or an explicit owner decision to
+  defer that gate.
 
 ## Technical Requirements
 
@@ -87,8 +89,8 @@ gated on this evidence path. This phase is the proof step: it converts "implemen
 - **Requires:** P03 and P04 (hard).
 - **Benefits from:** P05 (block-surfacing and held-merge paths worth capturing in the same
   sweep).
-- **Would unlock:** P13 (hard) and P14 status claims only after the remaining no-phone-home /
-  idempotency evidence is captured or explicitly deferred by the owner.
+- **Would unlock:** P13 (hard) and P14 status claims only after the remaining no-phone-home
+  evidence is captured or explicitly deferred by the owner.
 - **Parallel:** P07–P10, P12 may proceed concurrently.
 
 ## Acceptance Criteria
@@ -110,8 +112,8 @@ do not lower the bar for the stronger probes.
    **Current disposition: partially met.** The combined smoke demonstrates real Codex editing
    through the owned app-server transport, real macOS execution-host attestation with honest
    `weak` strength, real GitHub Issues / Forge effects, records integrity, and redaction. The
-   adversarial no-phone-home observation remains `ambiguous`, and multi-run idempotency against a
-   repeated real landed effect remains unproven.
+   RESUME-3 smoke demonstrates multi-run idempotency against a repeated real `open-pr` effect. The
+   adversarial no-phone-home observation remains `ambiguous`.
 3. Hosted/remote operation and Windows behavior are explicitly restated as out of scope in the
    Limitations section.
 4. README/AGENTS/product status lines about EVRUN reflect the new boundary — no claim exceeds

docs/design/evidence/2026-07-06-p05-held-merge-smoke.md

@@ -0,0 +1,117 @@
+---
+title: "2026-07-06 - P05 held-merge and block-surfacing smoke"
+status: applied - coordinator privileged run 2026-07-06
+date: 2026-07-06
+---
+
+# 2026-07-06 - P05 Held-Merge and Block-Surfacing Smoke
+
+## Probe
+
+This record captures a real GitHub Forge held-merge and blocked-story surfacing run against the
+disposable sandbox repository `agentic-workflow-kit/jig-smoke-target`. The sandbox `main` branch
+was made public and protected before the run: one approving review is required, admins are
+enforced, and no required status checks are configured. That posture is intentionally left in
+place as the future fixture state.
+
+The smoke used the opt-in scenario in
+`packages/jig-sdk/tests/smoke/evrun-held-merge-resume.smoke.test.ts`. It first opened a sandbox PR
+for a temporary branch, then attempted a real `merge` landing. GitHub refused the squash merge
+because branch protection required review, and Jig recorded the landing as `done-not-landed` with
+`mergeability: held-by-review`. The same run then exercised the real block-surfacing path and
+verified that the PR, failed commit status, and PR comment were readable through GitHub.
+
+## Tool Version Pins
+
+| Tool              | Version                                    |
+| ----------------- | ------------------------------------------ |
+| Node.js           | `v26.4.0`                                  |
+| pnpm              | `11.9.0`                                   |
+| GitHub CLI (`gh`) | `2.87.2 (2026-02-20)`                      |
+| Git               | `2.53.0`                                   |
+| Host              | `Darwin 25.5.0 RELEASE_ARM64_T6000 arm64`  |
+| Jig base checkout | `38c08da22563db6b06eb17315b9a46d81554f147` |
+| Git transport     | HTTPS with token-backed environment config |
+
+## Invocation
+
+The operator supplied GitHub credentials and the records-integrity key via environment variables.
+Secret values were not printed.
+
+```bash
+GITHUB_TOKEN="$(gh auth token)" \
+EVRUN_HELD_MERGE_SMOKE=1 \
+EVRUN_REAL_EFFECT_KEEP_ARTIFACTS=1 \
+JIG_GITHUB_ISSUES_REPOSITORY=agentic-workflow-kit/jig-smoke-target \
+JIG_GITHUB_ISSUES_LABEL=jig-candidate \
+JIG_RECORDS_INTEGRITY_KEY="<operator-provided one-off key>" \
+JIG_RECORDS_INTEGRITY_KEY_ID="held-merge-smoke" \
+EVRUN_HELD_MERGE_EVIDENCE_OUT=/private/tmp/jig-held-merge-smoke-evidence.json \
+corepack pnpm exec vitest run packages/jig-sdk/tests/smoke/evrun-held-merge-resume.smoke.test.ts
+```
+
+Result:
+
+```text
+Test Files  1 passed (1)
+Tests       1 passed | 1 skipped (2)
+Duration    10.59s
+```
+
+## Result Summary
+
+| Field                     | Value                                                                                  |
+| ------------------------- | -------------------------------------------------------------------------------------- |
+| Run ID                    | `run-p05-held-merge-smoke-1783358861177-61e9c545-37c3-4751-b058-bd58f594f7de`          |
+| Run status                | `failure` (expected blocked-story tail after held merge)                               |
+| Sandbox PR                | `https://github.com/agentic-workflow-kit/jig-smoke-target/pull/20`                     |
+| Held story                | `HELD-MERGE`                                                                           |
+| Held outcome              | `done-not-landed`                                                                      |
+| Mergeability              | `held-by-review`                                                                       |
+| Branch protection         | `enforceAdmins: true`, `requiredApprovingReviewCount: 1`, `requiredStatusChecks: null` |
+| Block-surfacing story     | `BLOCK-SURFACE`                                                                        |
+| Commit status observed    | `jig/block` / `failure`                                                                |
+| PR block comment observed | `true`                                                                                 |
+| Integrity status          | `verified`                                                                             |
+| `run.json` hash           | `1b37e102440f23f4bd63a0bd9eae2fcaa3d64ce603adc8cc61e056aa7463b0b8`                     |
+| `integrity` hash          | `b56ef34a5b309363324d5dbcef0a06ad969b085c8d7e5baa0d65a4f7b3e043c0`                     |
+
+## Observed Live Classifier Fix
+
+The first live attempts exposed two GitHub refusal strings that were not classified correctly by
+the previous adapter:
+
+- `the base branch policy prohibits the merge`
+- `At least 1 approving review is required by reviewers with write access`
+
+This PR pins both messages in `packages/jig-sdk/tests/providers.real-forge.p7.unit.test.ts` and
+classifies them as `held-by-review`.
+
+## Cleanup
+
+The successful smoke-created sandbox pull request was closed after capture and its branch was
+deleted: `https://github.com/agentic-workflow-kit/jig-smoke-target/pull/20`. Diagnostic sandbox
+PRs from failed capture attempts were also closed and their branches deleted. Branch protection on
+`main` was intentionally left in place.
+
+## Redaction
+
+No tokens or credentials appear in this record. The sandbox repository name and PR URL are
+intentionally cited. The smoke asserts serialized run artifacts and emitted evidence facts do not
+include GitHub tokens, `GH_TOKEN`, `GITHUB_TOKEN`, token-backed Git config values, credential
+URLs, or the records-integrity key.
+
+## Supported IDs
+
+- Supports `MERGE-5` for real blocked-PR surfacing: the run observed the PR, commit-status, and
+  comment legs against the disposable sandbox.
+- Supports `MERGE-4` held-merge posture against a real protected branch: the run observed
+  `done-not-landed` and `held-by-review` without forcing a merge.
+- Supports the front-door claim that held-merge and block-surfacing are real-effect proven, not
+  only unit-proven.
+
+## Limitations
+
+This is a scripted-agent smoke, not a real Codex app-server run. It does not prove SEC-2
+no-phone-home behavior, hosted/remote execution, Windows behavior, or package-publication posture.
+It uses a disposable sandbox repository only; no production repository was touched.