Phase Track P / P-deploy — Deployment gate (Thinking freeze)

Status: Reviewed → pass (P-deploy-r3). P-deploy Thinking is spec-only and now frozen; no code, no skill file edit, and no honesty schema change land in this phase. The P-deploy Auto build ({step}b) is cleared to start mechanically against this frozen contract; it is the only phase that writes files. Do not re-derive this contract during the Auto build.

phase: TRACK-P-P-DEPLOY
outputs:
- id: track-p-p-deploy
  path: docs/archive/phases/PHASE-TRACK-P-P-DEPLOY.md
  frozen: true
frozen_inputs:
- id: p-evidence-contract
  path: docs/archive/phases/PHASE-TRACK-P-P-EVIDENCE.md
- id: honesty-ledger-impl
  path: tools/honesty/ledger.py
- id: honesty-validate
  path: tools/honesty/validate.py
- id: honesty-types
  path: tools/honesty/types.py
- id: honesty-status
  path: tools/honesty/status.py
- id: build-verification-skill
  path: cursor/skills/build-verification-review/SKILL.md
- id: layered-honesty-vision-l0
  path: docs/archive/thinking/OVERSEER-KIT-LAYERED-HONESTY-VISION.md#21-l0--governance-shipped
- id: test-tiers
  path: policy/test-tiers.yaml
- id: decision-tiers
  path: policy/tiers.yaml
- id: freeze-ceremony
  path: docs/OVERSEER-KIT-SPEC.md#6
- id: kit-boundary
  path: AGENTS.md
- id: roadmap-p-deploy-row
  path: docs/ROADMAP.md
review_stamp:
  reviewed_at: '2026-07-13T23:33:58Z'
  verdict: pass
  reviewer_mode: agent
  reviewer_model: thinking-high
  reviewer_provider: local
  kit_version: 0.1.0
  artifact_digest: sha256:a9fe1cd9c65a4e181d0b51bd186691df4a648a09a7f4f38730906effaee06b6d

Downstream edge: the P-deploy Auto build ({step}b) treats this document as ground truth without re-deriving it (SPEC §6 mandatory reviewed freeze). The deploy-verification skill and the L2 honesty Mode C check consume the frozen gate as ground truth for what a deploy/health claim must look like before a "shipped" → DONE assertion — but the operator / CI / runtime, never the kit, performs the deploy or produces the health-check bytes.

Review record (§6.2): every freeze-review finding MUST cite file+line per SPEC §6; uncited findings are invalid and are discarded. Fixes applied during the loop are Tier 1 (feature branch); merge to main is Tier 3 and is never part of this loop.

Round	Reviewer	Verdict	Resolution
P-deploy-r1	Freeze-review loop (checklist + thinking, thinking-high)	findings	CLI checklist not yet run. Semantic review raised two MAJOR completeness findings + one MINOR. No escalation categories.
P-deploy-r1 fix	Author (cited lines only)	—	R1-M1 fixed: §PD.5.0 freezes mode-resolution algorithm so shared --frozen-spec does not imply Mode B when --deploy-health is set. R1-M2 fixed: §PD.5 freezes HonestyStatusOptions.deploy_health, argparse --deploy-health, dataclass JSON field, and CLI stderr map for exit 34. R1-N1 fixed: Mode B/C optional --frozen-spec ownership stated once.
P-deploy-r2	Freeze-review loop (checklist + thinking, thinking-high)	findings	R1 items confirmed RESOLVED. New: R2-M1 §PD.4 omitted explicit HonestyConfig.require_deploy_health dataclass field (parse/HONESTY_KEYS alone leave Auto without the typed default). R2-M2 §PD.0/§PD.8 "by default" probe wording contradicted §PD.1 absolute never. R2-N1 §PD.6 rule 3 "instead of a second BV round" readable as waiving mandatory BV.
P-deploy-r2 fix	Author (cited lines only)	—	R2-M1 fixed: §PD.4 parse rule 5 requires HonestyConfig field + load wiring. R2-M2 fixed: probe language hardened to never (no "by default" escape). R2-N1 fixed: §PD.6 rule 3 states BV is never waived.
P-deploy-r3	Freeze-review loop (checklist + thinking, thinking-high)	pass	CLI checklist gate clean (0 findings, dry-run). Semantic re-read confirmed R1-M1–M2, R1-N1, R2-M1–M2, R2-N1 RESOLVED; exit 34 + missing_deploy_health non-overlapping; Mode C resolution handles shared --frozen-spec; boundary held (kit records/gates, never deploys/probes); BV never waived; seven-tier matrix complete; rejection table present; no security/irreversible/real_money/gates_tier3 escalation. Stamp written by ok review --freeze.

---

§PD.0 — Simple summary

Build-verification stops an agent from marking an Auto build DONE when the code does not match the frozen spec. It does not stop an agent from saying "we shipped it" or "production is healthy" without a durable, content-addressed health record. P-evidence already lets a verifier record a deploy_health hash + opaque ref on the honesty ledger. What is missing is the gate: an opt-in check that refuses a "shipped" claim when no matching deploy/health evidence exists.

Track P / P-deploy freezes that live-deploy sibling of build-verification. The kit still never deploys, never opens an HTTP(S) connection to a production URL, and never embeds health payloads in the ledger. It only records and optionally gates operator-supplied deploy/health claims — reusing P-evidence's verification_evidence kind and deploy_health artifact type.

Technical summary: add honesty.require_deploy_health: off|warn|require (default off; HONESTY_KEYS membership); add honesty-status Mode C (--deploy-health PHASE_ID, mutually exclusive with Mode A and Mode B) whose match rule is Mode B plus ≥1 deploy_health artifact; add exit 34 + error token missing_deploy_health; freeze a twin skill /deploy-verification-review with checklist D1–D8; document the rejection table and seven-tier matrix. No new ledger kind. No Track O redesign. No kit-side deploy or live probe code.

---

§PD.1 — Scope

In scope (freeze only — this phase writes no code):

• The Mode C match rule that consumes existing verification_evidence entries and requires ≥1 deploy_health artifact (§PD.3).
• The optional honesty.require_deploy_health config flag + HONESTY_KEYS membership (§PD.4).
• Honesty-status Mode C flags, mutual exclusion with Modes A/B, JSON block, and error token (§PD.5).
• The normative /deploy-verification-review skill (twin paths) and its relationship to build-verification V8 (§PD.6).
• Exit code 34 and reuse of existing honesty codes (§PD.7).
• The boundary + rejection table (kit records/gates; never deploys / never probes) (§PD.8).
• The seven-tier test matrix the P-deploy Auto build must satisfy (§PD.9).

Out of scope (explicit non-goals — prevent creep):

• Any deploy, HTTP(S) health probe, DNS resolve, browser automation, or screenshot capture inside the kit. The kit never opens a network connection to a deploy target. Operator / CI / runtime produce health-record bytes; the kit only hashes and matches refs the caller supplies.
• A new ledger entry kind. P-deploy reuses verification_evidence + artifact type deploy_health frozen in P-evidence (§PE.3–§PE.4). Inventing a parallel deploy_evidence kind is rejected.
• Changing deploy_health artifact field rules (sha256 / required ref). Schema stays byte-identical to §PE.4.
• Making deploy-health mandatory for every repo or every Auto build. Default is off (inert). Most kit phases never claim a live deploy; they still use build-verification only.
• Automated freshness / TTL of health records. Entry ts remains audit metadata; the skill obliges the verifier to use a health record from the same ship session. No clock-gated Mode C reject in this slice.
• Redesigning Track O (O0–O3 ceremony, ok upgrade-regime, product contracts). Regime upgrade is not a P-deploy "shipped" claim.
• Redesigning P0 provenance, P-route, P-cost, or P-evidence Mode A/B. Mode C is additive; Mode A/B behavior stays byte-identical when Mode C flags are absent.
• Tier-3 merge, staging push, or live capability flips. This freeze never authorizes them.
• Blocking ok status --exit-code or governance-sync on missing deploy health. Exit 34 is confined to honesty-status Mode C (same posture as exit 33 for Mode B).

---

§PD.2 — What exists now (verified, do not redesign)

Element	Current shape	Source
Ledger kind verification_evidence	Required fields phase_id, frozen_spec, round, bv_verdict, artifacts[]; role verifier	P-evidence §PE.3; tools/honesty/
Artifact type deploy_health	sha256 (64 hex) + required opaque ref; kit never fetches	P-evidence §PE.4
Mode A	--hook + --artifact (verdict co-requirement)	K10 / tools/honesty/status.py
Mode B	--verification-evidence PHASE [+ --frozen-spec]; match = last bv_verdict=pass	P-evidence §PE.6
require_verification_evidence	off\|warn\|require (default off)	P-evidence §PE.6
Build-verification V8	Requires deploy_health in evidence only when claims mention deploy/health	twin build-verification skills
Exit 33	missing_verification_evidence (Mode B + require)	P-evidence §PE.8
Track P codes	30/31 route, 32 cost, 33 verification evidence	P-route / P-cost / P-evidence
Boundary	Kit = governance / record / gate; never runtime deploy	AGENTS.md, §PE.9

P-deploy must not change Mode A/B semantics, existing exit-code meanings, the canonical-hash algorithm, provenance rules, or the deploy_health artifact schema. It only adds one config flag, one honesty-status mode, one exit code, one error token, one skill, and the Mode C match predicate.

---

§PD.3 — Mode C match rule (frozen)

A matching deploy-health evidence entry for check inputs (phase_id, frozen_spec?) is an entry where all of:

1. kind == verification_evidence
2. actor_role == verifier
3. bv_verdict == pass
4. phase_id equals the requested phase id (exact string match)
5. If the caller supplies frozen_spec, it equals the entry's frozen_spec; if the caller omits it, any frozen_spec matches
6. artifacts contains at least one object with type == deploy_health (validated shape per §PE.4 — already enforced at append time)

Scan order: ledger file order; last matching entry wins (same newest-append-wins posture as Mode B).

Relationship to Mode B:

Check	Requires test_output?	Requires deploy_health?
Mode B (require_verification_evidence)	Skill process yes for BV pass; schema no	No
Mode C (require_deploy_health)	No (schema)	Yes (≥1)

A single ledger entry may satisfy both Mode B and Mode C if its artifacts include both test_output and deploy_health. Separate appends are also valid (last Mode C match wins independently of Mode B).

Pure helper the Auto build MUST add (frozen):

find_matching_deploy_health(entries, *, phase_id, frozen_spec) -> entry | None

Implemented beside find_matching_verification_evidence in tools/honesty/validate.py (or equivalent). Must not open network or read ref as a URL.

---

§PD.4 — Config: honesty.require_deploy_health (frozen)

Extend the existing honesty: block with one additive key (default preserves current behavior):

honesty:
  enabled: false
  # … existing keys unchanged …
  require_deploy_health: off   # off | warn | require — default off

Value	Meaning
off	(default) Mode C may still be invoked; the match is computed for JSON but never fails the exit code (0 on the match dimension even when no entry exists). Repos that never set the key stay inert.
warn	Mode C on miss: stderr warning (warning: no matching deploy_health evidence entry) + exit 0 (reminder posture — same family as require_verification_evidence: warn).
require	Mode C on miss: exit 34.

Parse rules (frozen):

1. Value MUST be one of off|warn|require (string); anything else → config exit 2.
2. Auto MUST add require_deploy_health to HONESTY_KEYS in adapters/config.py (unknown-key fail-closed). Omitting that frozenset update would reject a valid config as unknown honesty keys.
3. Default when the key is absent: off.
4. The flag is meaningless when honesty.enabled: false (module short-circuit exit 4 on ledger / honesty-status paths remains unchanged).
5. Auto MUST add require_deploy_health: str = "off" to the HonestyConfig dataclass in adapters/config.py and wire the parsed value into load_config / the returned config object (same pattern as require_verification_evidence).

Regime: regime-agnostic git-only baseline capability. No Muse dependency. Optional provenance on evidence entries follows P0 soft/hard rules independently.

---

§PD.5 — honesty-status Mode C (frozen)

Extend Mode resolution so three mutually exclusive modes exist. Exact CLI flag names are frozen (no aliases in this slice):

Mode	Required flags	Forbidden together with
A — verdict co-requirement (existing)	--hook HOOK + --artifact PATH	--verification-evidence, --frozen-spec, --deploy-health
B — verification evidence (existing)	--verification-evidence PHASE_ID	--hook, --artifact, --producer-session, --deploy-health
C — deploy health (new)	--deploy-health PHASE_ID	--hook, --artifact, --producer-session, --verification-evidence

Shared optional flag: --frozen-spec PATH_STRING is allowed with Mode B or Mode C (not both modes in one invocation). It is an opaque string passed through to the match rule — not a filesystem must-exist check. It is forbidden with Mode A.

Auto wiring (frozen — required for Mode C to be reachable):

1. HonestyStatusOptions gains additive field deploy_health: str | None = None (alongside existing verification_evidence / frozen_spec).
2. cli/main.py registers argparse --deploy-health PHASE_ID on the honesty-status parser (metavar PHASE_ID).
3. cli/commands/honesty_status.py passes deploy_health=getattr(args, "deploy_health", None) into HonestyStatusOptions and maps exit 34 → stderr error token text missing deploy health (same family as exit 33 → missing verification evidence).
4. HonestyStatusJson gains additive optional field deploy_health: dict[str, Any] | None = None emitted only on Mode C responses (§PD.5.1).

§PD.5.0 — Mode-resolution algorithm (frozen)

Today _resolve_mode in tools/honesty/status.py treats any --frozen-spec as Mode B partial and rejects --frozen-spec without --verification-evidence. Auto must replace that logic with the following (normative). Pseudocode:

mode_a_partial = hook or artifact or producer_session
mode_a_full    = hook and artifact
mode_b_full    = verification_evidence is set
mode_c_full    = deploy_health is set
# --frozen-spec is SHARED metadata — it does NOT by itself imply Mode B or Mode C
frozen         = frozen_spec is set

if mode_b_full and mode_c_full:
    return None   # usage
if mode_a_partial and (mode_b_full or mode_c_full or frozen):
    return None   # Mode A exclusive of B/C/frozen-spec
if frozen and not mode_b_full and not mode_c_full:
    return None   # --frozen-spec alone is usage
if not mode_a_full and not mode_b_full and not mode_c_full:
    return None
if mode_c_full:
    return "mode_c"
if mode_b_full:
    return "mode_b"
return "mode_a"

Invariant: --deploy-health PHASE --frozen-spec PATH resolves to mode_c (not usage). --verification-evidence PHASE --frozen-spec PATH resolves to mode_b (unchanged). --frozen-spec PATH alone remains usage 1.

Usage exit 1 when the algorithm returns None.

When Mode C flags are absent, Mode A/B behavior is byte-identical to pre-P-deploy for every invocation that does not pass --deploy-health.

Mode C applies require_deploy_health per §PD.4 (off → always 0 for the match dimension and still emits the JSON block below; warn → stderr warning + 0 on miss; require → 34 on miss). Module disabled → existing 4 short-circuit before mode logic.

The /deploy-verification-review skill (§PD.6) is the process obligation that creates / confirms the entry; Mode C is how CI / operators confirm it later before a "shipped" → DONE claim.

§PD.5.1 — Mode C JSON + error token (frozen)

Extend HonestyErrorToken (tools/honesty/types.py) with exactly one additive value:

missing_deploy_health

Used when Mode C exits 34. Do not overload missing_verification_evidence, missing_verdict, or evidence_free for this case.

HonestyStatusJson.to_dict() gains one additive key, present only on Mode C responses (Mode A/B responses omit the key entirely so existing consumers stay compatible):

{
  "ok": false,
  "exit_code": 34,
  "command": "honesty-status",
  "hook": null,
  "artifact": null,
  "artifact_sha256": null,
  "producer_session": null,
  "matched_verdict_hash": null,
  "error": "missing_deploy_health",
  "deploy_health": {
    "phase_id": "Track P / P-deploy",
    "frozen_spec": null,
    "require": "require",
    "matched_entry_hash": null
  }
}

deploy_health field	Rule
phase_id	Echo of --deploy-health
frozen_spec	Echo of --frozen-spec or null
require	Effective config value off|warn|require
matched_entry_hash	entry_hash of the last matching Mode C entry, or null

On Mode C success (0): ok: true, error: null, matched_entry_hash set when a match exists; under off with no match, ok: true, matched_entry_hash: null, error: null (check not enforced). On warn miss: ok: true, error: null, matched_entry_hash: null, plus stderr warning.

Mode B responses continue to emit verification_evidence and must not emit deploy_health. Mode C responses emit deploy_health and must not emit verification_evidence.

---

§PD.6 — Deploy-verification skill (frozen, normative)

The Auto build adds both vendored skill paths as twins (same content):

• cursor/skills/deploy-verification-review/SKILL.md
• .cursor/skills/deploy-verification-review/SKILL.md

When to run (frozen process rule): invoke /deploy-verification-review before marking a phase DONE in ROADMAP / regenerating HANDOVER when any of the following claims appear in the session's deliverable, handover text, or ROADMAP row:

• live deploy / production (or staging-as-production) rollout
• public or customer-facing URL is "up" / "healthy" / "verified"
• "shipped" meaning running outside the local repo (not merely "code merged to a feature branch")

Non-triggers (frozen): ordinary Auto builds that only claim code + tests + local CLI behavior (e.g. kit governance phases, Track O ceremony code without a live consumer probe) continue to use /build-verification-review alone. Track O ok upgrade-regime is a regime ceremony, not a P-deploy trigger.

Checklist (every item needs evidence):

#	Check	Dishonesty signal
D1	Deploy/health claim is in scope for this phase (frozen spec authorizes a ship claim)	"Shipped" for a spec that forbids live probes / deploys
D2	Operator-supplied health record exists on disk or in CI artifacts (bytes the verifier hashed)	Claim with no record file
D3	Ledger entry (when honesty.enabled) is verification_evidence with bv_verdict: pass and ≥1 deploy_health artifact	Pass claim with only test_output / screenshot
D4	deploy_health.sha256 digests the same health-record bytes the verifier inspected	Hash of unrelated file
D5	deploy_health.ref identifies the check (URL string, job id, env name) as opaque metadata — not fetched by the kit	Kit "proved" health by opening the URL itself
D6	Health record is from this ship session (verifier cites session/time; no automated TTL)	Reusing last quarter's health JSON
D7	No kit code path performs deploy or production HTTP probe as part of "verification"	Auto added urllib.request.urlopen(prod) under tools/
D8	ROADMAP/HANDOVER "shipped"/DONE wording matches Mode C (when honesty enabled + require)	DONE without matching ledger entry under require

Relationship to build-verification V8 (frozen):

1. /build-verification-review remains mandatory for every Auto build DONE (existing rule).
2. When the build session claims deploy/health, V8 already requires a deploy_health artifact in the BV evidence entry (§PE.7 rule 4) — unchanged.
3. /deploy-verification-review is the sibling gate for shipped/live claims. It runs when a ship/live-health claim is present; it does not replace or waive /build-verification-review for Auto build DONE (rule 1). If BV already passed and the only remaining claim is live health, a deploy-verification round is sufficient for that ship claim. Under honesty.enabled: true, a skill pass MUST append or confirm a Mode C–matching entry.
4. When honesty.enabled: false, ledger append is skipped; D1–D8 still require claims↔record honesty in the review text (baseline without L2).
5. Hard stops unchanged: no merge to main on findings/blocked; uncited findings invalid; no Tier-3 automation.

Optional Cursor rule (Auto may add, default inert): a non-alwaysApply rule or a short pointer in build-verification-required.mdc noting the sibling skill for shipped claims. Do not make deploy-verification always-on for every phase (would false-close kit-only Auto builds).

---

§PD.7 — Exit codes (frozen)

Additive code; non-overlapping with existing 1,2,4,5,7,8,10–11,20–26,30–33:

Code	Meaning	Where
34	Deploy health required but missing (no matching Mode C entry under §PD.3)	honesty-status Mode C when require_deploy_health: require; JSON error = missing_deploy_health (§PD.5.1)

Reused (no renumbering):

Code	Reuse for this gate
1	Usage — Mode A/B/C underspecified or combined (§PD.5)
2	Malformed schema on append (existing PE rules); bad config value for require_deploy_health
4	Honesty module disabled / config refuse (existing short-circuit)
23	Role violation on append (actor_role ≠ verifier)
24	Evidence-free append (artifacts empty)
25/26	Provenance (P0; unchanged)
33	Mode B missing verification evidence (unchanged; not used for Mode C)

34 is confined to honesty-status Mode C. It does not change status --exit-code precedence and does not block governance-sync by itself.

---

§PD.8 — Boundary, capability, and rejection table (frozen)

Single most important frozen rule: the kit records and optionally gates deploy/health claims; it never performs the deploy and never HTTP-probes production.

Boundary table

Concern	Overseer Kit (gate / recorder)	Operator / CI / runtime
Append verification_evidence with deploy_health	Yes (existing PE surface)	Supplies health-record bytes + ref
Mode C match / require_deploy_health	Yes	Decides when to enable
Hash file bytes path-confined	Yes (read-only helper)	Produces the files
Deploy to a host / public URL	Never	Yes (outside kit)
HTTP(S) health probe of production	Never	Yes; then supply record bytes + ref
Embed health body bytes in ledger	Never	Store blobs elsewhere
Tier-3 merge authorization	Never	Operator
Track O regime upgrade	Untouched	ok upgrade-regime (separate track)

Capability tiers

Capability	git-only (baseline)	muse+git-mirror / muse-only
Record deploy_health on file ledger	Full (via PE)	Full (identical)
Mode C gate	Full	Full
Optional signed provenance	Soft (unsigned OK)	Hard when require_agent_signature: true (P0)
Perform deploy / live health check	Not in the kit	Not in the kit

Rejection table (frozen — Auto must fail closed if asked to ship these)

Rejected ask	Why
Add tools/*/deploy.py that SSHes / kubectl-applies / uploads artifacts	Kit is not a CD system (AGENTS.md)
Add default HTTP client that GETs ref URLs to "verify" health	Violates §PD.1 / §PE.9; ref is opaque
New ledger kind deploy_evidence	Parallel store; PE already froze deploy_health
Require Mode C on every Auto DONE	False-closes non-ship phases; default off
Soften Mode C to accept screenshot alone as ship proof	Screenshot ≠ deploy/health record
Wire exit 34 into status --exit-code precedence	Out of scope; reminder/CI invoke Mode C explicitly
Redesign Track O Stage 3 / upgrade-regime as a deploy gate	Separate custody ceremony; hard stop
Auto-merge to main after Mode C pass	Tier 3 always human

---

§PD.9 — Seven-tier test matrix (P-deploy Auto build must satisfy)

The P-deploy Auto build ships all seven tiers green locally before DONE (policy/test-tiers.yaml).

Tier	Proves
unit	require_deploy_health parse (off\|warn\|require, default off, unknown → config 2); key accepted in HONESTY_KEYS; HonestyErrorToken includes missing_deploy_health; find_matching_deploy_health returns last pass entry with ≥1 deploy_health; rejects (returns None) for pass-without-deploy_health, findings verdict, wrong phase, wrong frozen_spec, non-verifier; Mode resolution per §PD.5.0: --deploy-health+--frozen-spec → mode_c; Mode C + Mode B flags → usage invalid; --frozen-spec alone → invalid; Mode A + --deploy-health → invalid.
integration	Mode C honesty-status --deploy-health PHASE with require and no match → 34 + JSON error token; with matching entry (deploy_health present) → 0 + matched_entry_hash; entry with only test_output does not satisfy Mode C; warn missing → 0 + stderr warning; off → check not enforced; combining Mode A/B/C flags → 1; Mode A and Mode B without Mode C flags remain byte-identical; honesty.enabled: false → existing 4 short-circuit unchanged.
e2e	Fixture repo: append genesis + verification_evidence with test_output only → Mode B may match, Mode C misses; append second entry adding deploy_health → Mode C last-wins match; skill-normative fixture asserts a deploy-verification pass body includes deploy_health. Identical unsigned behavior under git-only and a Muse regime.
stress	Many evidence entries (bounded, e.g. ≥ 100) with sparse deploy_health matches; match scan remains last-wins and completes within a documented bound; no unbounded filesystem walk of ref strings.
data-integrity	Mode C match depends on artifact type string equality (deploy_health); tampering a stored artifact type or sha256 breaks chain verify (22) or fails match; append still embeds hashes/refs only (no health body bytes); path helper (if present) is path-confined; no partial ledger write on validation failure.
performance	Mode C match over a realistic ledger completes within a bounded time; linear in ledger length; no network.
security	ref values that look like URLs or shell metacharacters remain opaque — never fetched, never executed; no network on Mode C / append / verify paths (asserted); no secrets required in deploy_health fields; producer role cannot append evidence (23); exit 34 cannot be waived by omitting the check flag when CI invokes Mode C under require; Auto build must not introduce kit-side production probes (grep/tests assert absence of deploy/HTTP probe helpers in honesty / new skill surfaces).

---

§PD.10 — Shared-contract note (informative)

• Build-verification agents keep using /build-verification-review for every Auto DONE; they already require deploy_health in the evidence entry when claims mention deploy (V8 / §PE.7).
• Deploy-verification agents use /deploy-verification-review when the DONE claim is shipped/live health; Mode C is the mechanical CI gate under require_deploy_health: require.
• P-evidence remains the schema owner for artifact objects; this phase only consumes them.
• Consumer CD systems (GitHub Actions deploy jobs, Scooling runtimes, etc.) produce health records and call ok honesty-status --deploy-health … — they do not move into the kit.

---

§PD.11 — Definition of Done (Thinking freeze)

• [x] This document reviewed → pass via /freeze-review-loop + ok review --freeze
• [x] Review-record table stamped; review_stamp filled
• [x] docs/ROADMAP.md P-deploy Thinking → DONE; Auto build row present / queued
• [x] docs/OVERSEER-HANDOVER.md NEXT regenerated for P-deploy Auto build (SD-17)
• [x] No code / skill / config landed in the Thinking phase itself
• [x] No Tier-3 merge performed
• [x] No Track O files redesigned

§PD.12 — Definition of Done (Auto build — for the next session)

• [x] Mechanical implementation matches §§PD.3–PD.7
• [x] Twin deploy-verification skill paths added per §PD.6
• [x] Seven-tier matrix §PD.9 green
• [x] /build-verification-review → pass before ROADMAP Auto row → DONE
• [x] Governance sync (ROADMAP + HANDOVER) in the closing commit
• [x] Feature-branch push / PR only; merge remains Tier 3
• [x] No deploy/HTTP probe code introduced in the kit