diff --git a/.sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-EVIDENCE.md b/.sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-EVIDENCE.md
new file mode 100644
index 0000000..5e1ced3
--- /dev/null
+++ b/.sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-EVIDENCE.md
@@ -0,0 +1,54 @@
+---
+name: CTO Hermes WebUI Live Smoke Evidence
+status: validated
+lifecycle_classification: sot
+owner: jp
+created: 2026-06-01
+last_reviewed: 2026-06-01
+core_promotion_status: not-promoted
+---
+
+# CTO Hermes WebUI Live Smoke Evidence
+
+Local planning SOT only. Not a Core Protocol. Not active Core authority.
+
+## Scope
+
+This evidence closes `CTO-WORK-061`.
+
+The implementation extends existing plugin smoke coverage for the CTO control panel route and static assets. It does not edit upstream `hermes-webui`, upstream `hermes-agent`, Cortex Core, Case source, or any target repository.
+
+## Implementation Evidence
+
+- Hermes plugin commit: `95fb43d Add CTO WebUI smoke coverage`
+- Smoke route: `/api/cto/control-summary`
+- Smoke asset: `/plugins/svrnty/cto_control_panel.js`
+- Smoke asset: `/plugins/svrnty/cto_control_panel.css`
+- Focused test: `tests/unit/test_boot_smoke_cto.py`
+
+## Validation Evidence
+
+- Focused validation: `python3 -m pytest tests/unit/test_boot_smoke_cto.py tests/unit/test_cto_control_summary.py -q`
+- Focused result: `4 passed`
+- Aggregate validation before commit: `python3 scripts/ast-connection-map.py --check`
+- Aggregate result before commit: `CONNECTION-MAP.md is fresh`
+- Aggregate validation before commit: `python3 -m pytest tests/ -q`
+- Aggregate result before commit: `101 passed, 4 skipped`
+- Aggregate validation after merge: `python3 scripts/ast-connection-map.py --check`
+- Aggregate result after merge: `CONNECTION-MAP.md is fresh`
+- Aggregate validation after merge: `python3 -m pytest tests/ -q`
+- Aggregate result after merge: `105 passed`
+
+## Governance Evidence
+
+- Harness-backed summary data remains the source of truth.
+- Case runtime default active: false
+- target repository mutation: false
+- upstream `hermes-webui` edited: false
+- upstream `hermes-agent` edited: false
+- Hermes remains visualization/control only.
+- Cortex remains SOT authority.
+
+## Result
+
+`CTO-WORK-061` is validated because the existing Hermes WebUI smoke path now covers the CTO control panel API and static assets without expanding authority or mutating protected repositories.
diff --git a/WORKBOARD.yaml b/WORKBOARD.yaml
index 92ae712..2316322 100644
--- a/WORKBOARD.yaml
+++ b/WORKBOARD.yaml
@@ -303,6 +303,6 @@ items:
     owner: ""
   - id: CTO-WORK-061
     title: Hermes WebUI CTO Live Smoke Coverage
-    status: candidate
+    status: validated
     source: .sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-ISSUES.md
     owner: ""
diff --git a/tools/validate_cto_child.py b/tools/validate_cto_child.py
index 02afa4a..6ca938d 100644
--- a/tools/validate_cto_child.py
+++ b/tools/validate_cto_child.py
@@ -53,6 +53,7 @@ REQUIRED_FILES = [
     ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-CONTROL-PANEL-EVIDENCE.md",
     ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-PRD.md",
     ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-ISSUES.md",
+    ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-EVIDENCE.md",
     ".sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-PRD.md",
     ".sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-ISSUES.md",
     ".sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-APPROVAL-PACKET.md",
@@ -186,6 +187,24 @@ REQUIRED_HERMES_WEBUI_LIVE_SMOKE_PHRASES = [
     "Do not mutate target repositories.",
 ]
 
+REQUIRED_HERMES_WEBUI_LIVE_SMOKE_EVIDENCE_PHRASES = [
+    "Local planning SOT only. Not a Core Protocol. Not active Core authority.",
+    "CTO-WORK-061",
+    "95fb43d Add CTO WebUI smoke coverage",
+    "/api/cto/control-summary",
+    "/plugins/svrnty/cto_control_panel.js",
+    "/plugins/svrnty/cto_control_panel.css",
+    "python3 -m pytest tests/unit/test_boot_smoke_cto.py tests/unit/test_cto_control_summary.py -q",
+    "4 passed",
+    "python3 scripts/ast-connection-map.py --check",
+    "CONNECTION-MAP.md is fresh",
+    "105 passed",
+    "Case runtime default active: false",
+    "target repository mutation: false",
+    "upstream `hermes-webui` edited: false",
+    "upstream `hermes-agent` edited: false",
+]
+
 REQUIRED_HERMES_REAL_REFRESH_CONTROL_REPLAY_EVIDENCE_PHRASES = [
     "Local planning SOT only. Not a Core Protocol. Not active Core authority.",
     "CTO-WORK-057",
@@ -1229,6 +1248,16 @@ def main() -> int:
             if phrase not in text:
                 errors.append(f"missing_hermes_webui_live_smoke_issue_phrase:{phrase}")
 
+    hermes_webui_live_smoke_evidence = ROOT / ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-EVIDENCE.md"
+    if hermes_webui_live_smoke_evidence.is_file():
+        text = hermes_webui_live_smoke_evidence.read_text(encoding="utf-8")
+        if "core_promotion_status: not-promoted" not in text:
+            errors.append("hermes_webui_live_smoke_evidence_missing_not_promoted_frontmatter")
+        for phrase in REQUIRED_HERMES_WEBUI_LIVE_SMOKE_EVIDENCE_PHRASES:
+            checked.append(f"hermes_webui_live_smoke_evidence_phrase:{phrase}")
+            if phrase not in text:
+                errors.append(f"missing_hermes_webui_live_smoke_evidence_phrase:{phrase}")
+
     hermes_real_refresh_control_replay_evidence = ROOT / ".sot/03-PROTOCOLS/CTO-HERMES-REAL-REFRESH-CONTROL-REPLAY-EVIDENCE.md"
     if hermes_real_refresh_control_replay_evidence.is_file():
         text = hermes_real_refresh_control_replay_evidence.read_text(encoding="utf-8")
@@ -1840,7 +1869,7 @@ def main() -> int:
             "CTO-WORK-058": "validated",
             "CTO-WORK-059": "validated",
             "CTO-WORK-060": "validated",
-            "CTO-WORK-061": "candidate",
+            "CTO-WORK-061": "validated",
         }
         for issue_id, expected in expected_statuses.items():
             checked.append(f"workboard_status:{issue_id}:{expected}")