Protect Case model admission evidence

tools/validate_cto_child.py

@@ -403,6 +403,28 @@ REQUIRED_MODEL_PROVIDER_ADMISSION_ISSUE_IDS = [
     "CTO-WORK-020",
 ]
 
+REQUIRED_MODEL_PROVIDER_ADMISSION_ISSUE_PHRASES = [
+    "f39d8ab Require admitted Case model pair",
+    "`f39d8ab` proves admission gating implementation only; it is not a real Case Stage 2 pass.",
+    "CTO_HARNESS_CASE_MODEL_ADMISSION_FILE",
+    "admission JSON is the authority",
+    "Missing admission blocks before `case_process_started`.",
+    "Mismatched admission blocks before `case_process_started`.",
+    "case_model_provider",
+    "case_model",
+    "case_model_admission_status",
+    "admitted",
+    "missing_admission",
+    "mismatch",
+    "invalid_admission",
+    "not_admitted",
+    "report.md",
+    "Case stdout/stderr",
+    "20260531T235421Z-r1-string-slugify-1875638",
+    "20260531T235448Z-r1-string-slugify-1876884",
+    "`CTO-WORK-020` remains blocked until a provider/model is explicitly approved and real Case Stage 2 produces a pass report.",
+]
+
 
 def workboard_status(text: str, issue_id: str) -> str | None:
     pattern = rf"- id: {re.escape(issue_id)}\n(?:    .+\n)*?    status: ([^\n]+)"
@@ -615,6 +637,10 @@ def main() -> int:
             checked.append(f"model_provider_admission_issue_id:{issue_id}")
             if issue_id not in text:
                 errors.append(f"missing_model_provider_admission_issue_id:{issue_id}")
+        for phrase in REQUIRED_MODEL_PROVIDER_ADMISSION_ISSUE_PHRASES:
+            checked.append(f"model_provider_admission_issue_phrase:{phrase}")
+            if phrase not in text:
+                errors.append(f"missing_model_provider_admission_issue_phrase:{phrase}")
 
     board = ROOT / "WORKBOARD.yaml"
     if board.is_file():