Record Stage 6 real refresh evidence

.sot/03-PROTOCOLS/CTO-CASE-STAGE6-REAL-GOVERNED-REFRESH-EVIDENCE.md

@@ -0,0 +1,89 @@
+---
+name: cto-case-stage6-real-governed-refresh-evidence
+tier: local
+status: validated
+owner: jp
+source: .sot/03-PROTOCOLS/CTO-CASE-STAGE6-REAL-GOVERNED-REFRESH-ISSUES.md
+created: 2026-06-01
+last_reviewed: 2026-06-01
+lifecycle_classification: planning
+core_promotion_status: not-promoted
+description: Child-local evidence that CTO-WORK-055 refreshed Stage 6 candidate-default readiness against the first real governed Stage 5 Case pass.
+---
+
+# CTO Case Stage 6 Real Governed Refresh Evidence
+
+Local planning SOT only. Not a Core Protocol. Not active Core authority.
+
+## Result
+
+Status: validated.
+
+Work item: `CTO-WORK-055`
+
+Hermes CTO commit:
+
+```text
+2b6e114 Add Stage 6 real governed refresh
+```
+
+Focused refresh validator:
+
+```text
+python3 harness/runner/validate-case-stage6-real-refresh.py --json
+```
+
+Focused refresh comparison artifact:
+
+```text
+/home/svrnty/.hermes/profiles/cto-planb/harness-runs/20260601T111843Z-stage6-real-governed-refresh/stage6-real-governed-refresh-comparison.json
+```
+
+Post-merge aggregate Harness command:
+
+```text
+./harness/evals/health.sh --json
+```
+
+Post-merge aggregate status:
+
+```text
+pass
+```
+
+Post-merge refresh comparison artifact:
+
+```text
+/home/svrnty/.hermes/profiles/cto-planb/harness-runs/20260601T111941Z-stage6-real-governed-refresh/stage6-real-governed-refresh-comparison.json
+```
+
+## Evidence Facts
+
+- refresh type: `stage6-real-governed-read-only`
+- first real governed Stage 5 pass report was imported
+- Stage 5 proof was imported
+- target repository read-only check passed
+- report shape passed
+- event validity passed
+- allowed-path compliance passed
+- prior Stage 6 failure closure passed
+- artifact completeness passed
+- forbidden-action closure passed
+- operator acceptance passed
+- source admission status remained current
+- fake lane was represented by prior Stage 6 comparison evidence
+- Codex lane was explicitly blocked without explicit Codex admission
+- Pi lane was explicitly blocked without explicit Pi probe/admission
+- runtime default activation: false
+- no target repository mutation attempted
+- no push, merge, deploy, close, PR open, issue close, public publication, vendor-source mutation, or unowned repository mutation was authorized
+
+## Decision
+
+`CTO-WORK-055` is validated.
+
+Case remains a gated adapter behind the CTO Harness seam.
+
+Runtime default activation remains false.
+
+This evidence does not promote CTO artifacts into Core and does not authorize broader target mutation.

WORKBOARD.yaml

@@ -273,6 +273,6 @@ items:
     owner: ""
   - id: CTO-WORK-055
     title: Stage 6 Real Governed Refresh Evidence Route
-    status: candidate
+    status: validated
     source: .sot/03-PROTOCOLS/CTO-CASE-STAGE6-REAL-GOVERNED-REFRESH-ISSUES.md
     owner: ""

tools/validate_cto_child.py

@@ -42,6 +42,7 @@ REQUIRED_FILES = [
     ".sot/03-PROTOCOLS/CTO-CASE-STAGE6-CANDIDATE-DEFAULT-ISSUES.md",
     ".sot/03-PROTOCOLS/CTO-CASE-STAGE6-REAL-GOVERNED-REFRESH-PRD.md",
     ".sot/03-PROTOCOLS/CTO-CASE-STAGE6-REAL-GOVERNED-REFRESH-ISSUES.md",
+    ".sot/03-PROTOCOLS/CTO-CASE-STAGE6-REAL-GOVERNED-REFRESH-EVIDENCE.md",
     ".sot/03-PROTOCOLS/CTO-HERMES-CONTROL-SURFACE-PRD.md",
     ".sot/03-PROTOCOLS/CTO-HERMES-CONTROL-SURFACE-ISSUES.md",
     ".sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-PRD.md",
@@ -131,6 +132,25 @@ REQUIRED_FIRST_REAL_WORKFLOW_APPROVAL_PACKET_PHRASES = [
     "Runtime default activation remains false.",
 ]
 
+REQUIRED_STAGE6_REAL_REFRESH_EVIDENCE_PHRASES = [
+    "Local planning SOT only. Not a Core Protocol. Not active Core authority.",
+    "CTO-WORK-055",
+    "2b6e114 Add Stage 6 real governed refresh",
+    "validate-case-stage6-real-refresh.py --json",
+    "stage6-real-governed-refresh-comparison.json",
+    "target repository read-only check passed",
+    "report shape passed",
+    "event validity passed",
+    "allowed-path compliance passed",
+    "prior Stage 6 failure closure passed",
+    "artifact completeness passed",
+    "forbidden-action closure passed",
+    "operator acceptance passed",
+    "runtime default activation: false",
+    "no target repository mutation attempted",
+    "Runtime default activation remains false.",
+]
+
 REQUIRED_STAGE6_REAL_REFRESH_PHRASES = [
     "Local planning SOT only. Not a Core Protocol. Not active Core authority.",
     "CTO-WORK-049",
@@ -1052,6 +1072,16 @@ def main() -> int:
             if phrase not in text:
                 errors.append(f"missing_stage6_real_refresh_issue_phrase:{phrase}")
 
+    stage6_real_refresh_evidence = ROOT / ".sot/03-PROTOCOLS/CTO-CASE-STAGE6-REAL-GOVERNED-REFRESH-EVIDENCE.md"
+    if stage6_real_refresh_evidence.is_file():
+        text = stage6_real_refresh_evidence.read_text(encoding="utf-8")
+        if "core_promotion_status: not-promoted" not in text:
+            errors.append("stage6_real_refresh_evidence_missing_not_promoted_frontmatter")
+        for phrase in REQUIRED_STAGE6_REAL_REFRESH_EVIDENCE_PHRASES:
+            checked.append(f"stage6_real_refresh_evidence_phrase:{phrase}")
+            if phrase not in text:
+                errors.append(f"missing_stage6_real_refresh_evidence_phrase:{phrase}")
+
     prd = ROOT / ".sot/03-PROTOCOLS/CTO-CASE-CANDIDATE-BACKEND-PRD.md"
     if prd.is_file():
         text = prd.read_text(encoding="utf-8")
@@ -1637,7 +1667,7 @@ def main() -> int:
             "CTO-WORK-052": "validated",
             "CTO-WORK-053": "validated",
             "CTO-WORK-054": "validated",
-            "CTO-WORK-055": "candidate",
+            "CTO-WORK-055": "validated",
         }
         for issue_id, expected in expected_statuses.items():
             checked.append(f"workboard_status:{issue_id}:{expected}")