Unify Oracle submission-authority classification

[1Morganmore]

Incident

A real live qualified-Pro run (20260814T122734Z-fe1e1b409f1f) exited at the ChatGPT login screen before the composer opened: no conversation URL, no output, process exited. settle-no-submission refused with NO_SUBMISSION_EVIDENCE_INCOMPLETE, so the project lock could never be released, while diagnose reported the same run as lifecycle-running-via-exact-session-ownership. Settlement, project locks and diagnosis each carried their own string rules, so they disagreed about the same evidence.

Change

• Login refusal is now an official user-confirmable pre-submit family. _chatgpt_session_absent_no_submission_evidence binds Oracle's exact paired refusal (ERROR: plus User error (browser-automation):) with the same strength as the app-route rejection: canonical artifact paths, no symlinks, strict UTF-8, no conversation URL anywhere, Session: <locator>, byte-identical source/transport mission, mission and manifest SHA-256, a proof-version runtime, a completed local exit with no armed watchdog, and no submission marker (Answer: or the prompt-timeout marker). Eligibility oracle-chatgpt-session-absent/v1 settles only through an explicit user-confirmed-no-submission, producing session_authority: pre_submit, transport_status: not_submitted_user_confirmed, task_outcome: not_executed and a released lock.
• No automatic settlement. The first attempt at this fix auto-settled the refusal; that violated the no-settlement-without-user-confirmation rule and was removed. Nothing releases a login refusal without explicit confirmation.
• One deep module. classify_submission_authority(run_dir) returns PRE_SUBMIT_PROVEN | SUBMITTED_BOUND | SUBMITTED_UNKNOWN | TERMINAL | INVALID_EVIDENCE plus owns_project, settlement_eligibility and requires_user_confirmation. unresolved_project_sessions decides ownership only from that verdict, and chatgpt_oracle_run.py, chatgpt_oracle_diagnose.py and chatgpt_oracle_incident.py all report the same classification. Every consumer gates on requires_user_confirmation, so no eligible family can be dropped by a label check.

Safety rules kept

No auto-resubmission after a real submission; a conversation URL still allows exact-slug recovery only; no lock release on unclear state; no settlement without user confirmation; no automatic login or cookie injection; no backend, ZIP or new-conversation fallback; no DevSpace-to-root-chat fallback; no model or reasoning downgrade; exact-session ownership stays monotonic. Absence of evidence never releases a lock — only a proven settlement does.

Ownership contracts preserved and hardened

• terminal_observed still owns its project until an exact harvest.
• A tampered or lost user confirmation re-locks, and now outranks the parallel-child coexistence rule so a revoked release cannot let a sibling submit.
• Legacy running records still fail closed; legacy attention-required records still do not become permanent locks.
• A bare local-ledger status: complete no longer releases ownership, matching resolve_lifecycle's refusal to treat the weakest authority as completion.
• A persisted pre_submit claim now requires an agreeing transport_status and no observed answer in the run's own logs, so a single edited field cannot release a live submitted run.
• Owner matching resolves the candidate's project root, and an unresolvable stored root keeps the row as an owner instead of hiding it.

Diagnosis and reporting

• Each eligible family gets its own signature and settlement reason, so the report, the receipt and the audit trail agree.
• safe_for_fresh_run_buckets and the per-bucket remediation are computed from the verdicts, so a bucket holding a lock-owning run is never advertised as fresh-run-safe.
• --summary-only stays the aggregate no-subcommand form; combining it with triage/watch is refused with a message that spells out the exact usage, and the skills now describe both forms without conflating them.

Verification

• Focused suites (state, run, diagnose, incident, comprehensive, multi-gpt): 477 passed, 7 skipped.
• Whole suite except the genuine-install lifecycle tests: 735 passed, 8 skipped.
• Install-lifecycle doctor subset: 13 passed.
• compileall clean; golden-path dry run all checks pass; portability and skill-metadata checks pass.
• Local full-gate and fast-gate wall clock is currently load-bound on this workstation (the same doctor subset went from 4.4s to 36s per test under load with no code change; a stashed-baseline measurement showed the pre-change suite at the same per-test rate), so this PR relies on CI for the authoritative full gate and the enforced fast-gate budget.
• Independent reviews: contract review PASS with three MEDIUM reporting defects, all fixed here; security review returned six findings, of which the two introduced by this change (bare status: complete release and the eligibility-label divergence) are fixed, three are hardened as described, and one is tracked below.

Tracked, not fixed here

• parallel_parent_id grants project-lock coexistence without proving parenthood against web_multi_child_provenance. Pre-existing, needs its own provenance-binding change.
• run_root and the Oracle state-root environment share the host trust boundary: whoever authors them can author any host state. A union scan over ambient ledgers was tried and reverted because it made one project's lock depend on unrelated host state.

[1Morganmore]

Merged and deployed verification:

• Merge commit: 37cea8c.
• PR CI: both Windows portable jobs PASS (12m7s, 14m15s) and both POSIX process gates PASS, so the authoritative full release contract and the enforced fast-gate budget both passed on clean runners.
• Installed from merged main into the active Orca CODEX_HOME: 122 files, v4 receipt codexpro-automation-20260814-215852668-d1e6e3c195e54986b211dea8ef126d33.json.
• Doctor readback against that CODEX_HOME: PASS, no issues, manifest_version 1.9.0.
• Source-versus-installed SHA-256 match confirmed for chatgpt_oracle_state.py, chatgpt_oracle_run.py, chatgpt_oracle_diagnose.py and chatgpt_oracle_incident.py.
• Incident run 20260814T122734Z-fe1e1b409f1f now classifies as PRE_SUBMIT_PROVEN with owns_project false, and the isolated project reports no unresolved owners. Its state was written by the interim automatic settlement that this PR removed, so settle-no-submission correctly refuses to re-adjudicate it (NO_SUBMISSION_AUTHORITY_INVALID: only a submitted_unknown run may be adjudicated). No state file was hand-edited.
• The retry is re-pinned: dry-run produced route oracle-pro-devspace / transport pro-devspace, and the manifest with archive never hashes to a7dac6cdcd9955961bead66efac5ee9cca22836772c502ebaf7e9ae270dda368.

Follow-up defect found while verifying the lock ledger, not fixed here: five Aug 8 runs in the DevSpace-Oracle project were legitimately settled with a user confirmation under Oracle 0.17.1, and their sidecar, mission and manifest hashes all still match, yet proven_user_confirmed_no_submission re-derives today's eligibility (which no longer includes 0.17.1 in the app-route proof version set) and therefore reports tampered-user-confirmation, keeping the project locked forever. The fix is to revalidate a recorded settlement against its own immutable hash bindings rather than against the current eligibility rules.