From c0a7462624419280b3e145a4c47c82d10022ed5f Mon Sep 17 00:00:00 2001
From: hudsonaikins-crown <hudson.aikins@blanoire.co>
Date: Sat, 12 Sep 2026 16:08:11 -0400
Subject: [PATCH 1/2] feat: rebuild provenance from pinned source snapshots

Plane-Work-Item: TAB-22
Entire-Checkpoint: 95aae876ef91
---
 README.md                       |  7 ++++-
 scripts/demo-provenance.mjs     | 46 ++++++++++++++++++++++++++++-----
 scripts/tabellio-provenance.mjs | 17 +++++++++---
 3 files changed, 60 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index ba806c1..c35b22e 100644
--- a/README.md
+++ b/README.md
@@ -61,13 +61,18 @@ isolated cluster:
 node scripts/demo-provenance.mjs --verify-storage-tests true --out /tmp/tabellio-demo.json
 ```
 
-The `tabellio-provenance` CLI supports `capture`, `import`, `import-sources`, `replay`,
+The `tabellio-provenance` CLI supports `capture`, `import`, `import-sources`, `replay`, `replay-sources`,
 `show`, `review`, and `packet`. `import-sources` normalizes a bundle of Plane,
 Entire, GitHub, and Buildkite snapshots and captures Git directly from `--repo`.
 Readers preserve healthy sources while reporting authentication, permission,
 missing-record, outage, and malformed-input failures as blocked. The demo imports
 all five sources, then verifies missing independent security evidence blocks review.
 External snapshots remain explicitly synthetic in the sample.
+`replay-sources` rebuilds from the original source bundle using `--repo`, `--input`,
+the original capture time in `--now`, and `--expected-digest` from the import receipt.
+It writes only when the rebuilt digest matches; changed or missing sources return
+blocked evidence without storing a replacement. Reordering snapshots and repeating
+the replay preserve the same record. Source snapshots are never modified.
 Database operations require an explicit local
 `--database-url`; review and packet commands also require `--repo` so readiness
 is checked against current Git state. `--now` supplies a deterministic evaluation
diff --git a/scripts/demo-provenance.mjs b/scripts/demo-provenance.mjs
index 59672ba..aa9295a 100755
--- a/scripts/demo-provenance.mjs
+++ b/scripts/demo-provenance.mjs
@@ -68,14 +68,21 @@ try {
   await writeFile(inputPath, JSON.stringify(input));
   const cli = fileURLToPath(new URL("./tabellio-provenance.mjs", import.meta.url));
   const invoke = async (...args) => JSON.parse((await run(process.execPath, [cli, ...args])).stdout);
+  const invokeBlocked = async (...args) => {
+    try {
+      await invoke(...args);
+    } catch (error) {
+      if (error.code !== 1 || !error.stdout) throw error;
+      return JSON.parse(error.stdout);
+    }
+    throw new Error("Expected blocked CLI exit.");
+  };
   const sourcePath = join(root, "sources.json");
-  await writeFile(sourcePath, JSON.stringify(await sampleSourceBundle(candidate, now)));
+  const sourceBundle = await sampleSourceBundle(candidate, now);
+  await writeFile(sourcePath, JSON.stringify(sourceBundle));
   const sourceImport = await invoke("import-sources", "--repo", repo, "--database-url", databaseUrl, "--input", sourcePath, "--now", now);
   if (sourceImport.status !== "stored" || !sourceImport.sources.every((source) => source.status === "present")) throw new Error("Source fixture import failed.");
-  const sourcePacket = await invoke("packet", "--repo", repo, "--database-url", databaseUrl, "--digest", sourceImport.lineage.digest, "--project-key", "SAMPLE", "--repository-id", "sample/repository", "--now", now).catch((error) => {
-    if (error.code !== 1 || !error.stdout) throw error;
-    return JSON.parse(error.stdout);
-  });
+  const sourcePacket = await invokeBlocked("packet", "--repo", repo, "--database-url", databaseUrl, "--digest", sourceImport.lineage.digest, "--project-key", "SAMPLE", "--repository-id", "sample/repository", "--now", now);
   if (sourcePacket.status !== "blocked" || sourcePacket.reasons.length !== 1 || sourcePacket.reasons[0].kind !== "security") throw new Error("Source fixture must block only on missing independent security review.");
   const imported = await invoke("import", "--database-url", databaseUrl, "--input", inputPath);
   const query = ["--database-url", databaseUrl, "--digest", imported.digest, "--project-key", "SAMPLE", "--repository-id", "sample/repository"];
@@ -87,6 +94,33 @@ try {
   const afterRestart = await invoke("show", ...query);
   if (afterRestart.digest !== imported.digest) throw new Error("Restart changed the lineage.");
   const store = new LocalProvenanceStore({ databaseUrl }); await store.migrate();
+  const sourceQuery = { digest: sourceImport.lineage.digest, projectKey: candidate.projectKey, repositoryId: candidate.repositoryId };
+  await store.removeLineage(sourceQuery);
+  if (await store.getLineage(sourceQuery) !== null) throw new Error("Source replay did not start from an empty derived record.");
+  sourceBundle.snapshots = Object.fromEntries(Object.entries(sourceBundle.snapshots).reverse());
+  await writeFile(sourcePath, JSON.stringify(sourceBundle));
+  const replaySourceArgs = ["replay-sources", "--repo", repo, "--database-url", databaseUrl, "--input", sourcePath, "--now", now, "--expected-digest", sourceImport.lineage.digest];
+  for (let replay = 0; replay < 2; replay += 1) {
+    const rebuilt = await invoke(...replaySourceArgs);
+    if (rebuilt.status !== "stored" || rebuilt.lineage.digest !== sourceImport.lineage.digest) throw new Error("Source replay changed the record.");
+  }
+  if (JSON.stringify(sourceBundle) !== await readFile(sourcePath, "utf8")) throw new Error("Replay modified original source snapshots.");
+  sourceBundle.snapshots.github.reviews[0].state = "changes_requested";
+  await writeFile(sourcePath, JSON.stringify(sourceBundle));
+  const changedSource = await invokeBlocked(...replaySourceArgs);
+  if (changedSource.status !== "blocked" || changedSource.lineage.digest === sourceQuery.digest) throw new Error("Changed source replay was accepted.");
+  if (await store.getLineage({ ...sourceQuery, digest: changedSource.lineage.digest }) !== null) throw new Error("Rejected replay was persisted.");
+  if ((await store.getLineage(sourceQuery))?.digest !== sourceQuery.digest) throw new Error("Rejected replay changed the original record.");
+  sourceBundle.snapshots.github.reviews[0].state = "approved";
+  await writeFile(sourcePath, JSON.stringify(sourceBundle));
+  const unavailableGitArgs = [...replaySourceArgs];
+  unavailableGitArgs[2] = join(root, "missing-repository");
+  const unavailableGit = await invokeBlocked(...unavailableGitArgs);
+  if (unavailableGit.status !== "blocked" || unavailableGit.sources.find((source) => source.source === "git")?.status !== "blocked" || !unavailableGit.sources.filter((source) => source.source !== "git").every((source) => source.status === "present")) throw new Error("Git outage discarded healthy source evidence.");
+  delete sourceBundle.snapshots.entire;
+  await writeFile(sourcePath, JSON.stringify(sourceBundle));
+  const missingSource = await invokeBlocked(...replaySourceArgs);
+  if (missingSource.status !== "blocked" || missingSource.sources.find((source) => source.source === "entire")?.status !== "blocked") throw new Error("Missing source replay was accepted.");
   await store.removeLineage({ digest: imported.digest, projectKey: "SAMPLE", repositoryId: "sample/repository" });
   const replayed = await invoke("replay", "--database-url", databaseUrl, "--input", inputPath);
   if (replayed.digest !== imported.digest) throw new Error("Replay changed the lineage.");
@@ -102,7 +136,7 @@ try {
     moved = JSON.parse(error.stdout);
     if (moved.status !== "blocked" || !moved.reasons.some((reason) => reason.state === "stale")) throw new Error("Moved base did not block readiness.");
   }
-  receipt = { status: "passed", candidate, lineageDigest: imported.digest, checks: { cliImport: "passed", sourceImport: sourceImport.status, missingSecurity: sourcePacket.status, review: initial.status, postgresServerRestart: "passed", deleteAndReplay: "passed", safePacket: packet.status, movedBase: moved.status }, sources: { git: "real temporary sample repository", plane: "synthetic fixture", entire: "synthetic fixture", github: "synthetic fixture", buildkite: "synthetic fixture", security: "synthetic fixture" }, cost: { usd: 0, modelCalls: 0, cloudCalls: 0 } };
+  receipt = { status: "passed", candidate, lineageDigest: imported.digest, checks: { cliImport: "passed", sourceImport: sourceImport.status, sourceReplay: "passed", changedSourceReplay: changedSource.status, missingSourceReplay: missingSource.status, gitOutage: unavailableGit.status, missingSecurity: sourcePacket.status, review: initial.status, postgresServerRestart: "passed", deleteAndReplay: "passed", safePacket: packet.status, movedBase: moved.status }, sources: { git: "real temporary sample repository", plane: "synthetic fixture", entire: "synthetic fixture", github: "synthetic fixture", buildkite: "synthetic fixture", security: "synthetic fixture" }, cost: { usd: 0, modelCalls: 0, cloudCalls: 0 } };
 } catch (error) {
   const postgresLog = await readFile(join(root, "postgres.log"), "utf8").catch(() => "");
   const socketPathFailure = /Unix-domain socket path.*too long/i.test(postgresLog);
diff --git a/scripts/tabellio-provenance.mjs b/scripts/tabellio-provenance.mjs
index f51d588..79a8fc7 100755
--- a/scripts/tabellio-provenance.mjs
+++ b/scripts/tabellio-provenance.mjs
@@ -22,13 +22,14 @@ async function main() {
   const options = parseCommandOptions(process.argv.slice(2), {
     capture: ["repo", "projectKey", "repositoryId", "base", "head", "out"],
     "import-sources": ["input", "repo", "databaseUrl", "now", "out"],
+    "replay-sources": ["input", "repo", "databaseUrl", "now", "expectedDigest", "out"],
     import: ["input", "databaseUrl", "out"],
     replay: ["input", "databaseUrl", "out"],
     show: [...query, "out"],
     review: [...query, "repo", "base", "head", "now", "out"],
     packet: [...query, "repo", "base", "head", "now", "out"],
   });
-  if (options.command === "import-sources") {
+  if (["import-sources", "replay-sources"].includes(options.command)) {
     await importSources(options);
     return;
   }
@@ -67,11 +68,21 @@ async function main() {
 }
 
 async function importSources(options) {
-  requireOptions(options, ["input", "repo", "databaseUrl"], "import-sources");
+  requireOptions(options, ["input", "repo", "databaseUrl"], options.command);
+  if (options.command === "replay-sources") {
+    requireOptions(options, ["now", "expectedDigest"], options.command);
+    if (!/^[a-f0-9]{64}$/.test(options.expectedDigest)) throw new Error("Expected lineage digest must be SHA-256.");
+  }
   const input = await readInput(options.input);
-  const snapshots = { ...input.snapshots, git: await captureGitSource({ repo: options.repo, candidate: input.candidate, capturedAt: options.now }) };
+  const snapshots = { ...input.snapshots };
   const readers = Object.fromEntries(Object.entries(snapshots).map(([source, snapshot]) => [source, async () => snapshot]));
+  readers.git = () => captureGitSource({ repo: options.repo, candidate: input.candidate, capturedAt: options.now });
   const result = await collectProvenanceSources({ candidate: input.candidate, selection: input.selection, readers, now: options.now });
+  if (options.expectedDigest && result.lineage.digest !== options.expectedDigest) {
+    await writeJsonOutput({ status: "blocked", reason: "Source replay differs from the original record. Reconcile changed or unavailable source evidence before accepting a new record.", expectedDigest: options.expectedDigest, ...result }, options.out);
+    process.exitCode = 1;
+    return;
+  }
   const store = new LocalProvenanceStore({ databaseUrl: options.databaseUrl });
   await store.migrate();
   await store.putLineage(result.lineage);

From 520cb3966e2fd59a9d974d905a7868016c102a10 Mon Sep 17 00:00:00 2001
From: Hudson Aikins <hudson@intelip.co>
Date: Sat, 12 Sep 2026 19:27:07 -0400
Subject: [PATCH 2/2] =?UTF-8?q?feat:=20explicit=20provenance=20verdicts=20?=
 =?UTF-8?q?and=20safe=20review=20(TAB-23=E2=80=9329)=20(#50)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: preserve safe source failure reasons in review packets

Plane-Work-Item: TAB-23
Entire-Checkpoint: 95aae876ef91

* feat: exact-candidate packets, security, and review (TAB-24–29) (#51)

* fix: enforce complete review packet bounds and candidate acceptance

Plane-Work-Item: TAB-25

Validates TAB-24 candidate movement and unrelated-history rejection.

Entire-Checkpoint: 7098fc8f9b88

* test: validate review packets with the native schema checker

Plane-Work-Item: TAB-25
Entire-Checkpoint: 7098fc8f9b88

* feat: exact security evidence, review, and recovery (TAB-26–29) (#52)

* feat: bind separate security checks to immutable review candidates

Plane-Work-Item: TAB-26
Entire-Checkpoint: 3a4c8131eec1

* ci: require pinned provenance security scanners

Plane-Work-Item: TAB-26
Entire-Checkpoint: 3a4c8131eec1

* feat: exact review results, safe publication, and recovery (TAB-27–29) (#53)

* feat: show actionable provenance review and GitHub statuses

Plane-Work-Item: TAB-27
Entire-Checkpoint: 3a4c8131eec1

* test: demonstrate failure recovery and secured review (TAB-28/TAB-29) (#54)

* test: demonstrate provenance failure and clean-store recovery (TAB-28)

Entire-Checkpoint: 3a4c8131eec1

* fix: review the secured lineage in the release demo (TAB-29) (#55)

* test: generate unsafe token fixture at runtime (TAB-29)

Entire-Checkpoint: 3a4c8131eec1

* fix: demonstrate review of the secured provenance lineage (TAB-29)

Entire-Checkpoint: 3a4c8131eec1

---------

Co-authored-by: hudsonaikins-crown <hudson.aikins@blanoire.co>

---------

Co-authored-by: hudsonaikins-crown <hudson.aikins@blanoire.co>

---------

Co-authored-by: hudsonaikins-crown <hudson.aikins@blanoire.co>

---------

Co-authored-by: hudsonaikins-crown <hudson.aikins@blanoire.co>

---------

Co-authored-by: hudsonaikins-crown <hudson.aikins@blanoire.co>

---------

Co-authored-by: hudsonaikins-crown <hudson.aikins@blanoire.co>
---
 .buildkite/scripts/fallow.sh                  |   1 +
 .buildkite/scripts/product-validation.sh      |   1 +
 .buildkite/scripts/security-tools.sh          |  47 +++++
 .buildkite/scripts/tests.sh                   |   1 +
 .github/workflows/product-validation.yml      |   2 +
 .github/workflows/quality.yml                 |   4 +
 .tabellio/validators.json                     |   4 +-
 README.md                                     |  68 ++++++-
 package.json                                  |   3 +-
 schemas/provenance-review-packet.schema.json  |  55 ++++++
 .../provenance-security-review.schema.json    | 179 ++++++++++++++++++
 scripts/check-provenance-security.mjs         |  19 ++
 scripts/demo-provenance.mjs                   | 128 ++++++++++++-
 scripts/lib/provenance-ledger.mjs             |  10 +-
 scripts/lib/provenance-review-publication.mjs |  88 +++++++++
 scripts/lib/provenance-review-result.mjs      |  87 +++++++++
 scripts/lib/provenance-security-scanners.mjs  | 139 ++++++++++++++
 scripts/lib/provenance-security.mjs           |  90 +++++++++
 scripts/lib/provenance-source-failures.mjs    |  17 ++
 scripts/lib/provenance-sources.mjs            |   7 +-
 scripts/tabellio-provenance.mjs               |  60 +++++-
 tests/analytics-core.test.mjs                 |   2 +-
 tests/provenance-ledger.test.mjs              |  71 ++++++-
 tests/provenance-review-publication.test.mjs  | 113 +++++++++++
 tests/provenance-review-result.test.mjs       |  96 ++++++++++
 tests/provenance-security-scanners.test.mjs   |  88 +++++++++
 tests/provenance-security.test.mjs            | 129 +++++++++++++
 tests/provenance-sources.test.mjs             |  31 ++-
 28 files changed, 1512 insertions(+), 28 deletions(-)
 create mode 100644 .buildkite/scripts/security-tools.sh
 create mode 100644 schemas/provenance-review-packet.schema.json
 create mode 100644 schemas/provenance-security-review.schema.json
 create mode 100644 scripts/check-provenance-security.mjs
 create mode 100644 scripts/lib/provenance-review-publication.mjs
 create mode 100644 scripts/lib/provenance-review-result.mjs
 create mode 100644 scripts/lib/provenance-security-scanners.mjs
 create mode 100644 scripts/lib/provenance-security.mjs
 create mode 100644 scripts/lib/provenance-source-failures.mjs
 create mode 100644 tests/provenance-review-publication.test.mjs
 create mode 100644 tests/provenance-review-result.test.mjs
 create mode 100644 tests/provenance-security-scanners.test.mjs
 create mode 100644 tests/provenance-security.test.mjs

diff --git a/.buildkite/scripts/fallow.sh b/.buildkite/scripts/fallow.sh
index 34ae582..eb5692f 100755
--- a/.buildkite/scripts/fallow.sh
+++ b/.buildkite/scripts/fallow.sh
@@ -11,6 +11,7 @@ fi
 
 base_branch="${BUILDKITE_PULL_REQUEST_BASE_BRANCH:-${TABELLIO_BASE_BRANCH:-main}}"
 git fetch --no-tags origin "+refs/heads/${base_branch}:refs/remotes/origin/${base_branch}"
+. .buildkite/scripts/security-tools.sh
 npm install --global fallow@2.89.0 c8@10.1.3
 bash .buildkite/scripts/provenance-coverage.sh
 
diff --git a/.buildkite/scripts/product-validation.sh b/.buildkite/scripts/product-validation.sh
index f8e4cf1..242f8a0 100755
--- a/.buildkite/scripts/product-validation.sh
+++ b/.buildkite/scripts/product-validation.sh
@@ -15,6 +15,7 @@ if [[ "$pull_request" == "false" && "$build_context" != "preflight" && "$default
 fi
 
 . .buildkite/scripts/verify-git-toolchain.sh
+. .buildkite/scripts/security-tools.sh
 
 candidate="${BUILDKITE_COMMIT:-HEAD}"
 base_branch="${BUILDKITE_PULL_REQUEST_BASE_BRANCH:-${TABELLIO_BASE_BRANCH:-main}}"
diff --git a/.buildkite/scripts/security-tools.sh b/.buildkite/scripts/security-tools.sh
new file mode 100644
index 0000000..f958a01
--- /dev/null
+++ b/.buildkite/scripts/security-tools.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Source this script to retain PATH in Buildkite. GitHub receives the same paths
+# through its runner environment files. No candidate package scripts are run.
+if [[ -n "${TABELLIO_SECURITY_TOOLS_DIR:-}" ]]; then
+  security_tools_root="$TABELLIO_SECURITY_TOOLS_DIR"
+else
+  security_tools_root="$(mktemp -d "${TMPDIR:-/tmp}/tabellio-security-tools.XXXXXX")"
+fi
+mkdir -p "$security_tools_root"
+case "$(uname -s)-$(uname -m)" in
+  Darwin-arm64)
+    security_archive_name="gitleaks_8.30.1_darwin_arm64.tar.gz"
+    security_archive_digest="b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5"
+    ;;
+  Linux-x86_64)
+    security_archive_name="gitleaks_8.30.1_linux_x64.tar.gz"
+    security_archive_digest="551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+    ;;
+  *) printf '%s\n' 'Unsupported security tool platform.' >&2; exit 1 ;;
+esac
+security_archive_path="$security_tools_root/$security_archive_name"
+if [[ ! -f "$security_archive_path" ]]; then
+  curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \
+    --connect-timeout 15 --max-time 120 \
+    "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/$security_archive_name" \
+    --output "$security_archive_path"
+fi
+node --input-type=module - "$security_archive_path" "$security_archive_digest" <<'NODE'
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+const actual = createHash('sha256').update(readFileSync(process.argv[2])).digest('hex');
+if (actual !== process.argv[3]) throw new Error('Security scanner archive integrity mismatch.');
+NODE
+tar -xzf "$security_archive_path" -C "$security_tools_root" gitleaks
+npm install --prefix "$security_tools_root" --no-save --no-package-lock --ignore-scripts \
+  --registry https://registry.npmjs.org @ast-grep/cli@0.45.1
+export PATH="$security_tools_root:$security_tools_root/node_modules/.bin:$PATH"
+export TABELLIO_GITLEAKS="$security_tools_root/gitleaks"
+export TABELLIO_REQUIRE_SECURITY_SCANNERS=1
+test "$(gitleaks version)" = "8.30.1"
+test "$(ast-grep --version)" = "ast-grep 0.45.1"
+if [[ -n "${GITHUB_PATH:-}" ]]; then
+  printf '%s\n' "$security_tools_root" "$security_tools_root/node_modules/.bin" >> "$GITHUB_PATH"
+  printf 'TABELLIO_GITLEAKS=%s\nTABELLIO_REQUIRE_SECURITY_SCANNERS=1\n' "$TABELLIO_GITLEAKS" >> "$GITHUB_ENV"
+fi
diff --git a/.buildkite/scripts/tests.sh b/.buildkite/scripts/tests.sh
index 0bddf21..990be14 100644
--- a/.buildkite/scripts/tests.sh
+++ b/.buildkite/scripts/tests.sh
@@ -2,6 +2,7 @@
 set -euo pipefail
 
 . .buildkite/scripts/verify-git-toolchain.sh
+. .buildkite/scripts/security-tools.sh
 npm run check
 node scripts/write-tabellio-evidence-envelope.mjs --out tabellio-pr-evidence.json
 node scripts/check-tabellio-evidence-envelope.mjs --evidence tabellio-pr-evidence.json
diff --git a/.github/workflows/product-validation.yml b/.github/workflows/product-validation.yml
index d7aace2..480bb6c 100644
--- a/.github/workflows/product-validation.yml
+++ b/.github/workflows/product-validation.yml
@@ -28,6 +28,8 @@ jobs:
           test -x "$postgres_bin/initdb"
           test -x "$postgres_bin/pg_ctl"
           echo "$postgres_bin" >> "$GITHUB_PATH"
+      - name: Install pinned security scanners
+        run: bash .buildkite/scripts/security-tools.sh
       - name: Resolve squash-merge checkpoint revision
         id: checkpoint
         if: github.event_name == 'push'
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index c4f672d..2963462 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -32,6 +32,8 @@ jobs:
         with:
           node-version: 20
           package-manager-cache: false
+      - name: Install pinned security scanners
+        run: bash .buildkite/scripts/security-tools.sh
       - name: Run repository checks
         run: npm run check
 
@@ -49,6 +51,8 @@ jobs:
         with:
           node-version: 20
           package-manager-cache: false
+      - name: Install pinned security scanners
+        run: bash .buildkite/scripts/security-tools.sh
       - name: Install pinned Fallow
         run: npm install --global fallow@2.89.0 c8@10.1.3
       - name: Measure provenance function and statement coverage
diff --git a/.tabellio/validators.json b/.tabellio/validators.json
index 77f1062..dca21c9 100644
--- a/.tabellio/validators.json
+++ b/.tabellio/validators.json
@@ -26,10 +26,10 @@
       "summary": "Agent run and review lifecycle examples"
     },
     "security": {
-      "commands": [["node", "scripts/check-tabellio-external-actions.mjs", "--evidence", "examples/tabellio-evidence/minimal-evidence.json"]],
+      "commands": [["node", "scripts/check-tabellio-external-actions.mjs", "--evidence", "examples/tabellio-evidence/minimal-evidence.json"], ["node", "scripts/check-provenance-security.mjs"]],
       "metrics": [{"name": "external_action_policy_pass", "unit": "boolean", "passValue": 1, "failValue": 0}],
       "cost": {"telemetry": "available", "usd": 0, "modelCalls": 0, "toolCalls": 0},
-      "summary": "External-action and side-effect policy checks"
+      "summary": "External-action policy and real candidate-bound security scanner regressions"
     },
     "analytics-static": {
       "commands": [["node", "--test", "tests/analytics-core.test.mjs"]],
diff --git a/README.md b/README.md
index c35b22e..3d47cad 100644
--- a/README.md
+++ b/README.md
@@ -54,6 +54,45 @@ Git and PostgreSQL operations are real; Plane, Entire, GitHub, Buildkite, and
 security observations in this sample are explicitly synthetic. This is not a
 live-provider or security-scanner certification.
 
+The demo receipt includes a failure matrix with expected and actual verdicts,
+safe reasons, and lineage digests where available. It exercises missing, stale,
+conflicting, tampered, secret, failed-validation, outage, and moved-base cases.
+Source replay runs twice in a newly created local database, verifies the original
+digest, and checks that source snapshots and Git refs remain unchanged. Cleanup
+and local cost/time are recorded even when the demo fails.
+
+To replace the sample security observation with real bounded checks, install
+Gitleaks 8.30.1 and ast-grep 0.45.1 on `PATH`, then run:
+
+```bash
+node scripts/demo-provenance.mjs --verify-security-scanners true
+```
+
+On Apple Silicon macOS or x86-64 Linux, `. .buildkite/scripts/security-tools.sh`
+installs the pinned tools into a temporary directory and exposes them on `PATH`.
+Set `TABELLIO_SECURITY_TOOLS_DIR` to reuse a tool directory. The installer verifies
+the Gitleaks archive checksum and does not run npm package install scripts.
+Configured CI uses this setup before checks; the required security
+validator fails when scanners are missing instead of skipping scanner fixtures.
+Run the same required check locally with `npm run tabellio:provenance:security:check`.
+
+The scanner reads immutable Git blobs without running candidate code. It uses
+Gitleaks defaults and explicit JavaScript/TypeScript rules for unverified JWT
+decoding, unsigned JWT configuration, disabled TLS verification, and dynamic
+`eval`. Candidate ignore files and suppression comments cannot grant a pass.
+Insecure HTTP dependency references fail; other declared npm dependencies remain
+blocked pending vulnerability evidence. These checks cover the listed rules;
+they do not establish the absence of all authorization or dependency defects.
+
+`tabellio-provenance security --input <lineage.json> --repo <repo> --now <time>`
+produces a separate security receipt. `import-security` accepts that receipt with
+the scoped lineage query, current repository candidate, and expected
+`--policy-digest`. It binds the receipt to the same safe packet and candidate,
+rejects modified receipts, and preserves failed or unavailable checks as blocking
+evidence. Findings contain rule IDs, severity, file locations, and content
+digests; matched secrets and source snippets are omitted. The findings contract
+is `schemas/provenance-security-review.schema.json`.
+
 For development validation, include PostgreSQL integration tests in that same
 isolated cluster:
 
@@ -61,13 +100,36 @@ isolated cluster:
 node scripts/demo-provenance.mjs --verify-storage-tests true --out /tmp/tabellio-demo.json
 ```
 
+`review` returns the full current candidate, distinct review and security verdicts,
+actions for failed or blocked evidence, and matching GitHub status payloads. Known
+Git and provider records receive source links; other records retain their exact
+source identifiers and lineage digest. Load verified security finding locations
+with `--security-input <receipt.json> --policy-digest <expected-digest>`.
+`--report-url` supplies a credential-free report link for both status contexts.
+
+`review-intent` prepares an immutable publication intent from the same scoped
+lineage query. `publish-review` accepts `--intent-input` and `--approval-input`,
+uses `GH_TOKEN`, rechecks the current candidate and GitHub origin,
+and publishes separate `Tabellio / provenance review` and
+`Tabellio / provenance security` contexts. The approval uses
+`tabellio-provenance-status-approval/v0.1` with `id`, `intentDigest`, `approved: true`,
+`approvedBy`, `approvedAt`, `expiresAt`, and `reason`; its lifetime is at most one
+hour. Publication receipts report delivery separately from review verdicts.
+Each approval is reserved in `refs/tabellio/provenance-statuses` before delivery;
+repeated requests reuse the receipt, and uncertain attempts require inspection
+before a new approval. The local demo exercises this flow through a fake GitHub
+transport and compares the delivered states with the CLI result.
+
 The `tabellio-provenance` CLI supports `capture`, `import`, `import-sources`, `replay`, `replay-sources`,
-`show`, `review`, and `packet`. `import-sources` normalizes a bundle of Plane,
+`show`, `review`, `review-intent`, `publish-review`, and `packet`. `import-sources` normalizes a bundle of Plane,
 Entire, GitHub, and Buildkite snapshots and captures Git directly from `--repo`.
 Readers preserve healthy sources while reporting authentication, permission,
 missing-record, outage, and malformed-input failures as blocked. The demo imports
 all five sources, then verifies missing independent security evidence blocks review.
 External snapshots remain explicitly synthetic in the sample.
+The packet contract is `schemas/provenance-review-packet.schema.json`. Packets
+contain only candidate-scoped facts and fixed failure explanations; their complete
+JSON envelope, including its digest, is limited to 65,536 UTF-8 bytes.
 `replay-sources` rebuilds from the original source bundle using `--repo`, `--input`,
 the original capture time in `--now`, and `--expected-digest` from the import receipt.
 It writes only when the rebuilt digest matches; changed or missing sources return
@@ -82,8 +144,8 @@ never an inherited application's `DATABASE_URL`.
 
 The capture and retention boundary lives in `tabellio.data-boundary.json`.
 Raw prompts, transcripts, provider bodies, and credentials are excluded. The
-remaining rebuild work includes independent security evidence,
-GitHub presentation, and the final release decision. No cloud provisioning,
+remaining release work includes failure/recovery acceptance and the explicit
+release decision. No cloud provisioning,
 automatic publication, deployment, or learning is introduced.
 
 The native engine runs through the installed `git` executable. It never constructs shell commands.
diff --git a/package.json b/package.json
index 75b6b43..c3a778d 100644
--- a/package.json
+++ b/package.json
@@ -109,7 +109,8 @@
     "check": "npm test && npm run tabellio:platform:check && npm run tabellio:run:example:check && npm run tabellio:stack:example:check && npm run tabellio:stack:operation:example:check && npm run tabellio:review:example:check && npm run tabellio:validate:example:check && npm run tabellio:design-memory:example:check && npm run tabellio:ledger:example:check && npm run tabellio:release:example:check && npm run tabellio:context:example:check && npm run tabellio:analytics:product:check && npm run tabellio:evidence:example:check && npm run tabellio:deployment:check && node scripts/check-tabellio-external-actions.mjs --evidence examples/tabellio-evidence/minimal-evidence.json",
     "tabellio:local-store": "node scripts/tabellio-local-store.mjs",
     "tabellio:provenance": "node scripts/tabellio-provenance.mjs",
-    "tabellio:provenance:demo": "node scripts/demo-provenance.mjs"
+    "tabellio:provenance:demo": "node scripts/demo-provenance.mjs",
+    "tabellio:provenance:security:check": "node scripts/check-provenance-security.mjs"
   },
   "engines": {
     "node": ">=20"
diff --git a/schemas/provenance-review-packet.schema.json b/schemas/provenance-review-packet.schema.json
new file mode 100644
index 0000000..ec124ae
--- /dev/null
+++ b/schemas/provenance-review-packet.schema.json
@@ -0,0 +1,55 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:tabellio:schema:provenance-review-packet:v0.1",
+  "title": "Tabellio Provenance Review Packet",
+  "$comment": "Non-authoritative derived context. The producer enforces a 65536-byte UTF-8 limit including the digest, exact-candidate binding, credential screening, and source-authority rules.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "authoritative", "candidate", "lineageDigest", "status", "reasons", "facts", "redactions", "digest"],
+  "properties": {
+    "schemaVersion": { "const": "tabellio-review-packet/v0.1" },
+    "authoritative": { "const": false },
+    "candidate": { "$ref": "#/$defs/candidate" },
+    "lineageDigest": { "$ref": "#/$defs/digest" },
+    "digest": { "$ref": "#/$defs/digest" },
+    "status": { "enum": ["passed", "failed", "blocked"] },
+    "reasons": { "type": "array", "items": { "$ref": "#/$defs/reason" } },
+    "facts": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/fact" } },
+    "redactions": { "type": "array", "minItems": 1, "maxItems": 1, "items": { "const": "Source payloads, raw content, and private checkpoint metadata are omitted." } }
+  },
+  "$defs": {
+    "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "oid": { "type": "string", "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$" },
+    "text": { "type": "string", "minLength": 1, "maxLength": 512, "pattern": "\\S" },
+    "candidate": {
+      "type": "object", "additionalProperties": false,
+      "required": ["projectKey", "repositoryId", "baseCommit", "headCommit", "mergeBase", "id"],
+      "properties": {
+        "projectKey": { "$ref": "#/$defs/text" }, "repositoryId": { "$ref": "#/$defs/text" },
+        "baseCommit": { "$ref": "#/$defs/oid" }, "headCommit": { "$ref": "#/$defs/oid" },
+        "mergeBase": { "$ref": "#/$defs/oid" }, "id": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "fact": {
+      "type": "object", "additionalProperties": false,
+      "required": ["id", "source", "sourceId", "observedAt", "kind", "status", "candidateId"],
+      "properties": {
+        "id": { "$ref": "#/$defs/digest" }, "candidateId": { "$ref": "#/$defs/digest" },
+        "source": { "enum": ["plane", "git", "entire", "github", "buildkite", "tabellio"] },
+        "sourceId": { "$ref": "#/$defs/text" }, "observedAt": { "type": "string", "format": "date-time" },
+        "kind": { "enum": ["task", "run", "commit", "checkpoint", "pull_request", "validation", "review", "security"] },
+        "status": { "enum": ["present", "passed", "failed", "missing", "stale", "conflicting", "inferred", "blocked"] }
+      }
+    },
+    "reason": {
+      "type": "object", "additionalProperties": false,
+      "required": ["state", "kind", "message", "evidenceId"],
+      "properties": {
+        "state": { "enum": ["failed", "missing", "stale", "conflicting", "inferred", "blocked"] },
+        "kind": { "enum": ["candidate", "task", "run", "commit", "checkpoint", "pull_request", "validation", "review", "security"] },
+        "message": { "$ref": "#/$defs/text" },
+        "evidenceId": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] }
+      }
+    }
+  }
+}
diff --git a/schemas/provenance-security-review.schema.json b/schemas/provenance-security-review.schema.json
new file mode 100644
index 0000000..edd10be
--- /dev/null
+++ b/schemas/provenance-security-review.schema.json
@@ -0,0 +1,179 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tabellio.dev/schemas/provenance-security-review.schema.json",
+  "title": "Candidate-bound security check evidence",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "candidate",
+    "packetDigest",
+    "policyDigest",
+    "observedAt",
+    "status",
+    "checks",
+    "digest"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "tabellio-security-review/v0.1"
+    },
+    "candidate": {
+      "$ref": "#/$defs/candidate"
+    },
+    "packetDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "policyDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "observedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "status": {
+      "enum": [
+        "passed",
+        "failed",
+        "blocked"
+      ]
+    },
+    "checks": {
+      "type": "array",
+      "minItems": 4,
+      "maxItems": 4,
+      "items": {
+        "$ref": "#/$defs/check"
+      }
+    },
+    "digest": {
+      "$ref": "#/$defs/digest"
+    }
+  },
+  "$defs": {
+    "candidate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "projectKey",
+        "repositoryId",
+        "baseCommit",
+        "headCommit",
+        "mergeBase",
+        "id"
+      ],
+      "properties": {
+        "projectKey": {
+          "$ref": "#/$defs/text"
+        },
+        "repositoryId": {
+          "$ref": "#/$defs/text"
+        },
+        "baseCommit": {
+          "$ref": "#/$defs/oid"
+        },
+        "headCommit": {
+          "$ref": "#/$defs/oid"
+        },
+        "mergeBase": {
+          "$ref": "#/$defs/oid"
+        },
+        "id": {
+          "$ref": "#/$defs/digest"
+        }
+      }
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "oid": {
+      "type": "string",
+      "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$"
+    },
+    "text": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "pattern": "\\S"
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "category",
+        "ruleId",
+        "severity",
+        "path",
+        "line",
+        "evidenceDigest"
+      ],
+      "properties": {
+        "category": {
+          "enum": [
+            "secrets",
+            "authorization",
+            "trust",
+            "dependencies"
+          ]
+        },
+        "ruleId": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9-]{0,79}$"
+        },
+        "severity": {
+          "enum": [
+            "low",
+            "medium",
+            "high",
+            "critical"
+          ]
+        },
+        "path": {
+          "$ref": "#/$defs/text"
+        },
+        "line": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 2147483647
+        },
+        "evidenceDigest": {
+          "$ref": "#/$defs/digest"
+        }
+      }
+    },
+    "check": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "category",
+        "status",
+        "findings"
+      ],
+      "properties": {
+        "category": {
+          "enum": [
+            "secrets",
+            "authorization",
+            "trust",
+            "dependencies"
+          ]
+        },
+        "status": {
+          "enum": [
+            "passed",
+            "failed",
+            "blocked"
+          ]
+        },
+        "findings": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/finding"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/scripts/check-provenance-security.mjs b/scripts/check-provenance-security.mjs
new file mode 100644
index 0000000..94d937d
--- /dev/null
+++ b/scripts/check-provenance-security.mjs
@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execute = promisify(execFile);
+try {
+  await execute(process.execPath, ["--test", "tests/provenance-security.test.mjs", "tests/provenance-security-scanners.test.mjs"], {
+    env: { ...process.env, TABELLIO_GITLEAKS: "gitleaks", TABELLIO_REQUIRE_SECURITY_SCANNERS: "1" },
+    timeout: 120000, maxBuffer: 2 * 1024 * 1024,
+  });
+  await execute(process.execPath, ["scripts/demo-provenance.mjs", "--verify-security-scanners", "true", "--gitleaks", "gitleaks"], {
+    timeout: 120000, maxBuffer: 2 * 1024 * 1024,
+  });
+  process.stdout.write("Security scanner fixtures and exact-candidate CLI/storage integration passed.\n");
+} catch {
+  // Child diagnostics may contain scanner matches. Keep them outside evidence.
+  process.stderr.write("Security checks blocked or failed. Check pinned scanner and PostgreSQL availability, then run the security tests locally.\n");
+  process.exitCode = 1;
+}
diff --git a/scripts/demo-provenance.mjs b/scripts/demo-provenance.mjs
index aa9295a..44a364c 100755
--- a/scripts/demo-provenance.mjs
+++ b/scripts/demo-provenance.mjs
@@ -9,12 +9,17 @@ import { LocalProvenanceStore } from "./lib/local-provenance-store.mjs";
 import { captureCandidate } from "./lib/provenance-ledger.mjs";
 import { sampleObservations } from "../examples/provenance/sample.mjs";
 import { sampleSourceBundle } from "../examples/provenance/sources.mjs";
+import { runSecurityReview, SECURITY_CHECKS } from "./lib/provenance-security.mjs";
+import { SECURITY_POLICY_DIGEST } from "./lib/provenance-security-scanners.mjs";
+import { publishProvenanceStatuses } from "./lib/provenance-review-publication.mjs";
+import { GitHubStatusPublisher } from "./providers/github-status-publisher.mjs";
 import { parseOptionPairs, writeJsonOutput } from "./lib/cli-options.mjs";
 
 const execute = promisify(execFile);
 const options = parseOptionPairs(process.argv.slice(2));
-if (Object.keys(options).some((key) => !["out", "verifyStorageTests"].includes(key))) throw new Error("Unsupported demo option.");
+if (Object.keys(options).some((key) => !["out", "verifyStorageTests", "verifySecurityScanners", "gitleaks"].includes(key))) throw new Error("Unsupported demo option.");
 if (options.verifyStorageTests !== undefined && options.verifyStorageTests !== "true") throw new Error("--verify-storage-tests accepts true.");
+if (options.verifySecurityScanners !== undefined && options.verifySecurityScanners !== "true") throw new Error("--verify-security-scanners accepts true.");
 const startedAt = Date.now();
 const root = await mkdtemp(join(tmpdir(), "tbl-"));
 // Unix socket names have a small OS limit; validation TMPDIR can be much longer.
@@ -24,6 +29,7 @@ const repo = join(root, "repo");
 let running = false;
 let initialized = false;
 let receipt;
+const failureMatrix = [];
 const env = { ...process.env, LC_ALL: "C", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_AUTHOR_NAME: "Sample", GIT_AUTHOR_EMAIL: "sample@example.invalid", GIT_COMMITTER_NAME: "Sample", GIT_COMMITTER_EMAIL: "sample@example.invalid" };
 for (const key of Object.keys(env)) if (key.startsWith("PG")) delete env[key];
 const run = (command, args, cwd = root) => execute(command, args, { cwd, env, timeout: 60000, maxBuffer: 2 * 1024 * 1024 });
@@ -44,8 +50,12 @@ try {
   if (options.verifyStorageTests === "true") {
     const testFile = fileURLToPath(new URL("../tests/local-provenance-store.test.mjs", import.meta.url));
     const lineageTests = fileURLToPath(new URL("../tests/provenance-ledger.test.mjs", import.meta.url));
-    const sourceTests = fileURLToPath(new URL("../tests/provenance-sources.test.mjs", import.meta.url));
-    await execute(process.execPath, ["--test", testFile, lineageTests, sourceTests], {
+  const sourceTests = fileURLToPath(new URL("../tests/provenance-sources.test.mjs", import.meta.url));
+  const securityTests = fileURLToPath(new URL("../tests/provenance-security.test.mjs", import.meta.url));
+  const scannerTests = fileURLToPath(new URL("../tests/provenance-security-scanners.test.mjs", import.meta.url));
+  const resultTests = fileURLToPath(new URL("../tests/provenance-review-result.test.mjs", import.meta.url));
+  const publicationTests = fileURLToPath(new URL("../tests/provenance-review-publication.test.mjs", import.meta.url));
+  await execute(process.execPath, ["--test", testFile, lineageTests, sourceTests, securityTests, scannerTests, resultTests, publicationTests], {
       cwd: root, env: { ...env, TABELLIO_REQUIRE_POSTGRES: "1", TABELLIO_TEST_PG_SOCKET: socketRoot, TABELLIO_TEST_PG_USER: "tabellio" },
       timeout: 60000, maxBuffer: 2 * 1024 * 1024,
     });
@@ -54,6 +64,7 @@ try {
   await mkdir(repo);
   const git = (...args) => run("git", ["-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", ...args], repo);
   await git("init", "-b", "main");
+  await git("remote", "add", "origin", "https://github.com/sample/repository.git");
   await writeFile(join(repo, "app.mjs"), "export const greeting = 'Hello';\n");
   await git("add", "app.mjs");
   await git("commit", "-m", "Create sample application");
@@ -84,33 +95,65 @@ try {
   if (sourceImport.status !== "stored" || !sourceImport.sources.every((source) => source.status === "present")) throw new Error("Source fixture import failed.");
   const sourcePacket = await invokeBlocked("packet", "--repo", repo, "--database-url", databaseUrl, "--digest", sourceImport.lineage.digest, "--project-key", "SAMPLE", "--repository-id", "sample/repository", "--now", now);
   if (sourcePacket.status !== "blocked" || sourcePacket.reasons.length !== 1 || sourcePacket.reasons[0].kind !== "security") throw new Error("Source fixture must block only on missing independent security review.");
+  // Synthetic readers exercise the real CLI/storage boundary, not scanner effectiveness.
+  const policyDigest = options.verifySecurityScanners ? SECURITY_POLICY_DIGEST : "f".repeat(64);
+  const securityChecks = Object.fromEntries(SECURITY_CHECKS.map((category) => [category, async ({ candidateId, packetDigest, policyDigest }) => ({ candidateId, packetDigest, policyDigest, status: "passed", findings: [] })]));
+  const lineagePath = join(root, "source-lineage.json");
+  await writeFile(lineagePath, JSON.stringify(sourceImport.lineage));
+  const securityReview = options.verifySecurityScanners
+    ? await invoke("security", "--repo", repo, "--input", lineagePath, "--now", now, "--gitleaks", options.gitleaks ?? "gitleaks")
+    : await runSecurityReview({ lineage: sourceImport.lineage, now, policyDigest, checks: securityChecks });
+  const securityPath = join(root, "security.json");
+  await writeFile(securityPath, JSON.stringify(securityReview));
+  const securityArgs = ["import-security", "--repo", repo, "--database-url", databaseUrl, "--digest", sourceImport.lineage.digest, "--project-key", "SAMPLE", "--repository-id", "sample/repository", "--now", now, "--policy-digest", policyDigest, "--input", securityPath];
+  const securityImport = await invoke(...securityArgs);
+  const securedPacket = await invoke("packet", "--repo", repo, "--database-url", databaseUrl, "--digest", securityImport.digest, "--project-key", "SAMPLE", "--repository-id", "sample/repository", "--now", now);
+  if (securityImport.status !== "passed" || securedPacket.status !== "passed") throw new Error("Synthetic security receipt import failed.");
+  const unavailableSecurity = await runSecurityReview({ lineage: sourceImport.lineage, now, policyDigest, checks: {} });
+  await writeFile(securityPath, JSON.stringify(unavailableSecurity));
+  const blockedSecurityImport = await invokeBlocked(...securityArgs);
+  if (blockedSecurityImport.status !== "blocked") throw new Error("Missing security readers must block.");
   const imported = await invoke("import", "--database-url", databaseUrl, "--input", inputPath);
   const query = ["--database-url", databaseUrl, "--digest", imported.digest, "--project-key", "SAMPLE", "--repository-id", "sample/repository"];
   const reviewArgs = [...query, "--repo", repo, "--now", now];
   const initial = await invoke("review", ...reviewArgs);
   if (initial.status !== "passed") throw new Error("Sample review did not pass.");
+  await exerciseFailureMatrix({ input, inputPath, databaseUrl, query, reviewArgs, invoke, invokeBlocked, failureMatrix });
   await stop();
   await start();
   const afterRestart = await invoke("show", ...query);
   if (afterRestart.digest !== imported.digest) throw new Error("Restart changed the lineage.");
+  const publicationQuery = [...query];
+  publicationQuery[publicationQuery.indexOf("--digest") + 1] = securityImport.digest;
+  const publicationArgs = [...publicationQuery, "--repo", repo, "--now", now];
+  const publicationLineage = await invoke("show", ...publicationQuery);
+  const publicationReview = await invoke("review", ...publicationArgs);
+  if (publicationReview.status !== "passed") throw new Error("Secured lineage review did not pass.");
+  const statusIntent = await invoke("review-intent", ...publicationArgs);
+  const statusPublication = await publishSampleStatuses({ repo, lineage: publicationLineage, intent: statusIntent, cli: publicationReview, now });
   const store = new LocalProvenanceStore({ databaseUrl }); await store.migrate();
+  await run("createdb", ["--host", socketRoot, "--username", "tabellio", "--no-password", "tabellio_replay"]);
+  const replayDatabaseUrl = databaseUrl.replace("/tabellio?", "/tabellio_replay?");
+  const replayStore = new LocalProvenanceStore({ databaseUrl: replayDatabaseUrl }); await replayStore.migrate();
   const sourceQuery = { digest: sourceImport.lineage.digest, projectKey: candidate.projectKey, repositoryId: candidate.repositoryId };
-  await store.removeLineage(sourceQuery);
-  if (await store.getLineage(sourceQuery) !== null) throw new Error("Source replay did not start from an empty derived record.");
+  const refsBeforeReplay = (await git("show-ref")).stdout;
+  if (await replayStore.getLineage(sourceQuery) !== null) throw new Error("Source replay did not start from an empty derived record.");
   sourceBundle.snapshots = Object.fromEntries(Object.entries(sourceBundle.snapshots).reverse());
   await writeFile(sourcePath, JSON.stringify(sourceBundle));
-  const replaySourceArgs = ["replay-sources", "--repo", repo, "--database-url", databaseUrl, "--input", sourcePath, "--now", now, "--expected-digest", sourceImport.lineage.digest];
+  const replaySourceArgs = ["replay-sources", "--repo", repo, "--database-url", replayDatabaseUrl, "--input", sourcePath, "--now", now, "--expected-digest", sourceImport.lineage.digest];
   for (let replay = 0; replay < 2; replay += 1) {
     const rebuilt = await invoke(...replaySourceArgs);
     if (rebuilt.status !== "stored" || rebuilt.lineage.digest !== sourceImport.lineage.digest) throw new Error("Source replay changed the record.");
   }
   if (JSON.stringify(sourceBundle) !== await readFile(sourcePath, "utf8")) throw new Error("Replay modified original source snapshots.");
+  if ((await git("show-ref")).stdout !== refsBeforeReplay) throw new Error("Replay modified Git source refs.");
+  failureMatrix.push({ case: "clean-store-replay", expected: "passed", actual: "passed", lineageDigest: sourceQuery.digest, sourceSnapshotsUnchanged: true, gitRefsUnchanged: true });
   sourceBundle.snapshots.github.reviews[0].state = "changes_requested";
   await writeFile(sourcePath, JSON.stringify(sourceBundle));
   const changedSource = await invokeBlocked(...replaySourceArgs);
   if (changedSource.status !== "blocked" || changedSource.lineage.digest === sourceQuery.digest) throw new Error("Changed source replay was accepted.");
-  if (await store.getLineage({ ...sourceQuery, digest: changedSource.lineage.digest }) !== null) throw new Error("Rejected replay was persisted.");
-  if ((await store.getLineage(sourceQuery))?.digest !== sourceQuery.digest) throw new Error("Rejected replay changed the original record.");
+  if (await replayStore.getLineage({ ...sourceQuery, digest: changedSource.lineage.digest }) !== null) throw new Error("Rejected replay was persisted.");
+  if ((await replayStore.getLineage(sourceQuery))?.digest !== sourceQuery.digest) throw new Error("Rejected replay changed the original record.");
   sourceBundle.snapshots.github.reviews[0].state = "approved";
   await writeFile(sourcePath, JSON.stringify(sourceBundle));
   const unavailableGitArgs = [...replaySourceArgs];
@@ -136,7 +179,15 @@ try {
     moved = JSON.parse(error.stdout);
     if (moved.status !== "blocked" || !moved.reasons.some((reason) => reason.state === "stale")) throw new Error("Moved base did not block readiness.");
   }
-  receipt = { status: "passed", candidate, lineageDigest: imported.digest, checks: { cliImport: "passed", sourceImport: sourceImport.status, sourceReplay: "passed", changedSourceReplay: changedSource.status, missingSourceReplay: missingSource.status, gitOutage: unavailableGit.status, missingSecurity: sourcePacket.status, review: initial.status, postgresServerRestart: "passed", deleteAndReplay: "passed", safePacket: packet.status, movedBase: moved.status }, sources: { git: "real temporary sample repository", plane: "synthetic fixture", entire: "synthetic fixture", github: "synthetic fixture", buildkite: "synthetic fixture", security: "synthetic fixture" }, cost: { usd: 0, modelCalls: 0, cloudCalls: 0 } };
+  receipt = { status: "passed", candidate, lineageDigest: imported.digest, checks: { cliImport: "passed", sourceImport: sourceImport.status, sourceReplay: "passed", changedSourceReplay: changedSource.status, missingSourceReplay: missingSource.status, gitOutage: unavailableGit.status, missingSecurity: sourcePacket.status, securityImport: securityImport.status, unavailableSecurityImport: blockedSecurityImport.status, review: initial.status, githubRepresentation: statusPublication.status, postgresServerRestart: "passed", deleteAndReplay: "passed", safePacket: packet.status, movedBase: moved.status }, sources: { git: "real temporary sample repository", plane: "synthetic fixture", entire: "synthetic fixture", github: "synthetic records and local fake status transport", buildkite: "synthetic fixture", security: options.verifySecurityScanners ? "real bounded scanners over immutable Git content" : "synthetic fixture" }, cost: { usd: 0, modelCalls: 0, cloudCalls: 0 } };
+  receipt.reviewedLineageDigest = publicationLineage.digest;
+  receipt.securityReviewDigest = securityReview.digest;
+  failureMatrix.push(
+    { case: "changed-source-replay", expected: "blocked", actual: changedSource.status, acceptedLineageUnchanged: true, rejectedLineageNotStored: true },
+    { case: "git-outage", expected: "blocked", actual: unavailableGit.status, healthySourcesPreserved: true },
+    { case: "missing-source", expected: "blocked", actual: missingSource.status },
+    { case: "moved-base", expected: "blocked", actual: moved.status, reasons: moved.reasons },
+  );
 } catch (error) {
   const postgresLog = await readFile(join(root, "postgres.log"), "utf8").catch(() => "");
   const socketPathFailure = /Unix-domain socket path.*too long/i.test(postgresLog);
@@ -164,5 +215,64 @@ try {
     process.exitCode = 1;
   }
   receipt.durationMs = Date.now() - startedAt;
+  receipt.failureMatrix = failureMatrix;
   await writeJsonOutput(receipt, options.out);
 }
+
+async function exerciseFailureMatrix({ input, inputPath, databaseUrl, query, reviewArgs, invoke, invokeBlocked, failureMatrix }) {
+  const cases = [
+    ["missing", (value) => value.observations.splice(0, 1), "blocked"],
+    ["stale", (value) => { value.observations[0].observedAt = "2000-01-01T00:00:00Z"; }, "blocked"],
+    ["conflicting", (value) => { value.observations[2].candidate = { ...value.candidate, headCommit: "c".repeat(40) }; }, "blocked"],
+    ["failed-validation", (value) => { value.observations[5].status = "failed"; }, "failed"],
+  ];
+  for (const [name, mutate, expected] of cases) {
+    const value = structuredClone(input);
+    mutate(value);
+    await writeFile(inputPath, JSON.stringify(value));
+    const imported = await invoke("import", "--database-url", databaseUrl, "--input", inputPath);
+    const args = [...reviewArgs];
+    args[args.indexOf("--digest") + 1] = imported.digest;
+    const result = await invokeBlocked("review", ...args);
+    failureMatrix.push({ case: name, expected, actual: result.status, lineageDigest: imported.digest, reasons: result.reasons });
+    if (result.status !== expected || !result.reasons.length) throw new Error("Failure matrix verdict mismatch.");
+  }
+  await writeFile(inputPath, JSON.stringify(input));
+  const original = await invoke("show", ...query);
+  const tampered = structuredClone(original);
+  tampered.observations[0].status = "failed";
+  const secret = structuredClone(input);
+  const privateMarker = "password=" + "sample-private-value";
+  secret.observations[0].sourceId = privateMarker;
+  for (const [name, value] of [["tampered", tampered], ["secret", secret]]) {
+    await writeFile(inputPath, JSON.stringify(value));
+    let result;
+    try {
+      await invoke("import", "--database-url", databaseUrl, "--input", inputPath);
+      throw new Error("Unsafe input accepted.");
+    } catch (error) {
+      if (error.code !== 1 || error.stdout || !error.stderr || error.stderr.includes(privateMarker)) throw new Error("Unsafe input was not rejected with safe diagnostics.");
+      result = JSON.parse(error.stderr);
+    }
+    failureMatrix.push({ case: name, expected: "blocked", actual: result.status, reason: result.reason });
+    if (result.status !== "blocked") throw new Error("Unsafe input did not block.");
+  }
+  await writeFile(inputPath, JSON.stringify(input));
+}
+
+async function publishSampleStatuses({ repo, lineage, intent, cli, now }) {
+  const requests = [];
+  const publisher = new GitHubStatusPublisher({ token: "synthetic-local-demo", fetchImpl: async (url, options) => {
+    const body = JSON.parse(options.body);
+    requests.push({ url: String(url), body });
+    return new Response(JSON.stringify({ ...body, id: requests.length, created_at: now }), { status: 201 });
+  } });
+  const approval = { schemaVersion: "tabellio-provenance-status-approval/v0.1", id: "sample-review-status", intentDigest: intent.integrity.digest, approved: true, approvedBy: "Synthetic demo", approvedAt: now, expiresAt: new Date(Date.parse(now) + 60000).toISOString(), reason: "Local fake GitHub transport only." };
+  const publication = await publishProvenanceStatuses({ repo, lineage, intent, approval, publisher, now });
+  if (publication.status !== "published" || requests.length !== 2) throw new Error("Sample status publication failed.");
+  for (const [index, request] of requests.entries()) {
+    const expected = cli.github[index];
+    if (!request.url.endsWith(`/statuses/${expected.commit}`) || request.body.state !== expected.state || request.body.context !== expected.context || request.body.description !== expected.description || (request.body.target_url ?? null) !== expected.targetUrl) throw new Error("CLI and GitHub status differ.");
+  }
+  return publication;
+}
diff --git a/scripts/lib/provenance-ledger.mjs b/scripts/lib/provenance-ledger.mjs
index 82efa6c..955b025 100644
--- a/scripts/lib/provenance-ledger.mjs
+++ b/scripts/lib/provenance-ledger.mjs
@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { runGit } from "./git-process.mjs";
 import { normalizeRecord } from "./provenance-record.mjs";
+import { SOURCE_FAILURES } from "./provenance-source-failures.mjs";
 
 const CANDIDATE_FIELDS = ["projectKey", "repositoryId", "baseCommit", "headCommit", "mergeBase"];
 const SOURCES = new Set(["plane", "git", "entire", "github", "buildkite", "tabellio"]);
@@ -126,7 +127,8 @@ function checkObservation(item, context) {
   if (item.candidate.id !== candidateId) add("conflicting", item.kind, "Evidence refers to another exact candidate.", item.id);
   const age = evaluatedAt - Date.parse(item.observedAt);
   if (age < 0 || age > maxAgeMs) add("stale", item.kind, "Refresh observation from its original source.", item.id);
-  if (!["present", "passed"].includes(item.status)) add(item.status, item.kind, "Resolve source evidence before review readiness.", item.id);
+  const failure = Object.hasOwn(SOURCE_FAILURES, item.metadata.reason) ? SOURCE_FAILURES[item.metadata.reason] : null;
+  if (!["present", "passed"].includes(item.status)) add(item.status, item.kind, failure?.message ?? "Resolve source evidence before review readiness.", item.id);
   if (["validation", "review", "security"].includes(item.kind) && item.status === "present") add("blocked", item.kind, "An observation is not a passed result.", item.id);
   if (PREDECESSOR[item.kind] && !hasPredecessor(item, identities)) add("missing", item.kind, `Link this fact to its ${PREDECESSOR[item.kind]} source record.`, item.id);
   checkLinks(item, identities, add);
@@ -160,6 +162,8 @@ export function buildReviewPacket(lineage, options) {
     reasons: result.reasons, facts,
     redactions: ["Source payloads, raw content, and private checkpoint metadata are omitted."],
   };
-  if (Buffer.byteLength(JSON.stringify(packet)) > 65536) throw new Error("Review packet exceeds 65536 bytes; narrow the evidence set.");
-  return { ...packet, digest: digest(packet) };
+  const envelope = { ...packet, digest: digest(packet) };
+  // Include the CLI's two-space formatting and final newline in the wire limit.
+  if (Buffer.byteLength(`${JSON.stringify(envelope, null, 2)}\n`) > 65536) throw new Error("Review packet exceeds 65536 bytes; narrow the evidence set.");
+  return envelope;
 }
diff --git a/scripts/lib/provenance-review-publication.mjs b/scripts/lib/provenance-review-publication.mjs
new file mode 100644
index 0000000..c2bf485
--- /dev/null
+++ b/scripts/lib/provenance-review-publication.mjs
@@ -0,0 +1,88 @@
+import { contract } from "./contract-checks.mjs";
+import { digestObject } from "./stack-operation.mjs";
+import { validateOperationApproval } from "./approval-validation.mjs";
+import { captureCandidate, candidateIdentity } from "./provenance-ledger.mjs";
+import { buildProvenanceReviewResult } from "./provenance-review-result.mjs";
+import { GitJsonLedger } from "./git-json-ledger.mjs";
+import { effectiveGitHubRepository } from "./github-repository.mjs";
+import { NativeGitStore } from "../providers/native-git-store.mjs";
+
+const INTENT = "tabellio-provenance-status-intent/v0.1";
+const APPROVAL = "tabellio-provenance-status-approval/v0.1";
+
+export function createProvenanceStatusIntent(lineage, options) {
+  const result = buildProvenanceReviewResult(lineage, options);
+  if (result.github.length !== 2) throw new Error("A GitHub repository identity is required.");
+  const unsigned = { schemaVersion: INTENT, createdAt: result.evaluatedAt, candidate: result.currentCandidate, lineageDigest: lineage.digest, reportUrl: options.reportUrl ?? null, statuses: result.github };
+  return { ...unsigned, integrity: { algorithm: "sha256", digest: digestObject(unsigned) } };
+}
+
+function validateIntent(value) {
+  contract.object(value, "intent");
+  contract.exactKeys(value, ["schemaVersion", "createdAt", "candidate", "lineageDigest", "reportUrl", "statuses", "integrity"], "intent");
+  contract.equals(value.schemaVersion, INTENT, "intent.schemaVersion");
+  contract.date(value.createdAt, "intent.createdAt");
+  contract.sha256(value.lineageDigest, "intent.lineageDigest");
+  contract.equals(digestObject(value.candidate), digestObject(candidateIdentity(value.candidate)), "intent.candidate");
+  contract.object(value.integrity, "intent.integrity");
+  contract.exactKeys(value.integrity, ["algorithm", "digest"], "intent.integrity");
+  contract.equals(value.integrity.algorithm, "sha256", "intent.integrity.algorithm");
+  const { integrity, ...unsigned } = value;
+  contract.equals(integrity.digest, digestObject(unsigned), "intent.integrity.digest");
+  return value;
+}
+
+async function assertCurrent(repo, intent, base, head) {
+  const actual = await captureCandidate({ repo, projectKey: intent.candidate.projectKey, repositoryId: intent.candidate.repositoryId, base, head });
+  contract.equals(actual.id, intent.candidate.id, "current candidate");
+  return actual;
+}
+
+function checkedResponse(response, expected) {
+  for (const key of ["commit", "state", "context", "description", "targetUrl"]) contract.equals(response[key], expected[key], `published.${key}`);
+  if (!/^[0-9]{1,20}$/.test(String(response.id))) throw new Error("Invalid published status ID.");
+  return { id: String(response.id), commit: response.commit, state: response.state, context: response.context };
+}
+
+async function sendStatuses({ repo, intent, base, head, publisher }) {
+  const published = [];
+  try {
+    for (const expected of intent.statuses) {
+      await assertCurrent(repo, intent, base, head);
+      published.push(checkedResponse(await publisher.publish(expected), expected));
+    }
+    await assertCurrent(repo, intent, base, head);
+    return { status: "published", published };
+  } catch {
+    return { status: "blocked", published, reason: "Publication failed or became uncertain. Inspect GitHub statuses and the stored receipt before authorizing another attempt." };
+  }
+}
+
+export async function publishProvenanceStatuses({ repo, lineage, intent, approval, publisher, now, base = "main", head = "HEAD" }) {
+  contract.date(now, "publication time");
+  validateOperationApproval(approval, intent, { schemaVersion: APPROVAL, validateIntent, now: new Date(now) });
+  if (Date.parse(approval.expiresAt) - Date.parse(approval.approvedAt) > 3600000) throw new Error("Status approval must expire within one hour.");
+  const candidate = await assertCurrent(repo, intent, base, head);
+  contract.equals(lineage.digest, intent.lineageDigest, "lineage digest");
+  const result = buildProvenanceReviewResult(lineage, { candidate, now, reportUrl: intent.reportUrl });
+  contract.equals(digestObject(result.github), digestObject(intent.statuses), "current status representation");
+  const store = await NativeGitStore.open(repo);
+  const remote = await effectiveGitHubRepository(store, "origin");
+  const target = `${intent.statuses[0].owner}/${intent.statuses[0].repo}`.toLowerCase();
+  contract.equals(remote.key, target, "GitHub origin identity");
+  const ledger = await GitJsonLedger.open({ repoPath: repo, ref: "refs/tabellio/provenance-statuses" });
+  const path = `approvals/${approval.id}.json`;
+  const prior = await ledger.read(path);
+  if (prior.value !== null) {
+    contract.equals(prior.value.intentDigest, intent.integrity.digest, "used approval intent");
+    if (prior.value.status !== "pending") return prior.value;
+    return { ...prior.value, status: "blocked", reason: "An earlier attempt is unresolved. Inspect GitHub before authorizing another attempt." };
+  }
+  // Reserve the approval before any network mutation. CAS prevents concurrent
+  // consumers and preserves an uncertain attempt if the process stops midway.
+  const receipt = { schemaVersion: "tabellio-provenance-status-receipt/v0.1", approvalId: approval.id, intentDigest: intent.integrity.digest, candidateId: candidate.id, attemptedAt: now, status: "pending", published: [] };
+  const attempt = await ledger.write(path, receipt, { expectedVersion: prior.version });
+  const completed = { ...receipt, ...await sendStatuses({ repo, intent, base, head, publisher }) };
+  await ledger.write(path, completed, { expectedVersion: attempt.version });
+  return completed;
+}
diff --git a/scripts/lib/provenance-review-result.mjs b/scripts/lib/provenance-review-result.mjs
new file mode 100644
index 0000000..f88afba
--- /dev/null
+++ b/scripts/lib/provenance-review-result.mjs
@@ -0,0 +1,87 @@
+import { assembleLineage, evaluateLineage } from "./provenance-ledger.mjs";
+import { attachSecurityReview } from "./provenance-security.mjs";
+import { parseGitHubRepositoryRemote } from "./github-repository.mjs";
+import { normalizeRecord } from "./provenance-record.mjs";
+
+const STATES = { passed: "success", failed: "failure", blocked: "error" };
+const ACTIONS = {
+  security: "Inspect the security receipt, resolve its findings, and rerun security checks for this candidate.",
+  review: "Address the review findings and obtain a review of this exact candidate.",
+  validation: "Inspect failed CI evidence, fix the failing checks, and rerun validation for this candidate.",
+};
+
+function repository(candidate) {
+  const id = candidate.repositoryId.replace(/^github\.com\//, "");
+  return parseGitHubRepositoryRemote(`https://github.com/${id}`);
+}
+
+function sourceUrl(observation, repo) {
+  if (observation.source === "buildkite") {
+    const match = /^([a-z0-9][a-z0-9_-]*)\/([a-z0-9][a-z0-9_-]*)\/([1-9][0-9]*)$/i.exec(observation.sourceId);
+    return match ? `https://buildkite.com/${match[1]}/${match[2]}/builds/${match[3]}` : null;
+  }
+  if (!repo) return null;
+  if (observation.source === "git" && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(observation.sourceId)) return `https://github.com/${repo.fullName}/commit/${observation.sourceId}`;
+  if (observation.kind === "pull_request") {
+    const prefix = `${observation.candidate.repositoryId}#`;
+    const number = observation.sourceId.startsWith(prefix) ? observation.sourceId.slice(prefix.length) : "";
+    if (/^[1-9][0-9]*$/.test(number)) return `https://github.com/${repo.fullName}/pull/${number}`;
+  }
+  return null;
+}
+
+function reportLink(value) {
+  if (value === null) return null;
+  normalizeRecord({ entityType: "reference", entityKey: value, source: "tabellio", sourceId: "review-report", observedAt: "2026-01-01T00:00:00Z", sensitivity: "private" });
+  const url = new URL(value);
+  const local = ["localhost", "127.0.0.1"].includes(url.hostname);
+  if ((url.protocol !== "https:" && !(local && url.protocol === "http:")) || url.username || url.password || url.search || url.hash) throw new Error("Report URL must be credential-free HTTPS or local HTTP without query parameters or fragments.");
+  return url.toString();
+}
+
+function section(kind, reasons, evidence) {
+  const status = reasons.some((item) => item.state === "failed") ? "failed" : reasons.length ? "blocked" : "passed";
+  const actions = reasons.map((reason) => ({
+    state: reason.state, kind: reason.kind,
+    nextAction: reason.message === "Resolve source evidence before review readiness." ? ACTIONS[reason.kind] ?? reason.message : reason.message,
+    evidence: evidence.find((item) => item.id === reason.evidenceId) ?? null,
+  }));
+  const nextAction = actions[0]?.nextAction ?? (kind === "security" ? "Security evidence passed for this candidate." : "Continue through the repository merge workflow for this candidate.");
+  return { status, nextAction, actions };
+}
+
+function securityDetails(lineage, receipt, policyDigest, now, repo) {
+  if (receipt === null) return { detailsState: "not_loaded", findings: [], checks: [] };
+  const original = assembleLineage({ candidate: lineage.candidate, observations: lineage.observations.filter((item) => !(item.kind === "security" && item.sourceId === receipt.digest)) });
+  const verified = attachSecurityReview({ lineage: original, review: receipt, policyDigest, now });
+  if (verified.digest !== lineage.digest) throw new Error("Security receipt does not match this lineage.");
+  const findings = receipt.checks.flatMap((check) => check.findings.map((item) => ({
+    ...item,
+    url: repo ? `https://github.com/${repo.fullName}/blob/${lineage.candidate.headCommit}/${item.path.split("/").map(encodeURIComponent).join("/")}#L${item.line}` : null,
+  })));
+  return { detailsState: "loaded", findings, checks: receipt.checks.map(({ category, status }) => ({ category, status })) };
+}
+
+export function buildProvenanceReviewResult(lineage, { candidate = lineage.candidate, now, reportUrl = null, securityReceipt = null, policyDigest } = {}) {
+  const result = evaluateLineage(lineage, { candidate, now });
+  const repo = repository(result.currentCandidate);
+  const targetUrl = reportLink(reportUrl);
+  const evidence = lineage.observations.filter((item) => item.candidate.id === result.currentCandidate.id).map((item) => ({
+    id: item.id, kind: item.kind, source: item.source, sourceId: item.sourceId,
+    lineageDigest: lineage.digest, url: sourceUrl(item, repo),
+  }));
+  const review = section("review", result.reasons.filter((item) => item.kind !== "security"), evidence);
+  const security = section("security", result.reasons.filter((item) => ["security", "candidate"].includes(item.kind)), evidence);
+  const details = result.currentCandidate.id === lineage.candidate.id
+    ? securityDetails(lineage, securityReceipt, policyDigest, now, repo)
+    : { detailsState: "stale", findings: [], checks: [] };
+  // Each GitHub context uses the same verdict and full immutable candidate ID as
+  // its CLI section. Presentation never turns missing evidence into a pass.
+  const github = repo ? Object.entries({ review, security }).map(([kind, value]) => ({
+    owner: repo.owner, repo: repo.name, commit: result.currentCandidate.headCommit,
+    state: STATES[value.status], context: `Tabellio / provenance ${kind}`,
+    description: `${value.status} ${result.currentCandidate.id}: ${value.nextAction}`.slice(0, 140),
+    targetUrl: targetUrl ?? value.actions.find((item) => item.evidence?.url)?.evidence.url ?? null,
+  })) : [];
+  return { ...result, schemaVersion: "tabellio-review-result/v0.1", review, security: { ...security, ...details }, evidence, github };
+}
diff --git a/scripts/lib/provenance-security-scanners.mjs b/scripts/lib/provenance-security-scanners.mjs
new file mode 100644
index 0000000..07db441
--- /dev/null
+++ b/scripts/lib/provenance-security-scanners.mjs
@@ -0,0 +1,139 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, relative, resolve } from "node:path";
+import { captureCandidate } from "./provenance-ledger.mjs";
+import { runSecurityReview } from "./provenance-security.mjs";
+
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const RULES = [
+  { id: "authorization-jwt-decode", pattern: "jwt.decode($TOKEN)" },
+  { id: "authorization-jwt-decode-options", pattern: "jwt.decode($TOKEN, $$$REST)" },
+  { id: "authorization-unsigned-jwt", pattern: { context: "({algorithms: ['none']})", selector: "pair" } },
+  { id: "trust-disabled-tls", pattern: { context: "({rejectUnauthorized: false})", selector: "pair" } },
+  { id: "trust-dynamic-eval", pattern: "eval($EXPRESSION)" },
+];
+const POLICY = {
+  schemaVersion: "tabellio-security-policy/v0.1",
+  gitleaksVersion: "8.30.1",
+  astGrepVersion: "0.45.1",
+  rules: RULES,
+  dependencyPolicy: "Reject insecure HTTP dependencies. Other declared dependencies need separate vulnerability evidence and remain blocked.",
+  scope: "Tracked regular files; Gitleaks default rules; listed JavaScript and TypeScript syntax rules. This is bounded deterministic analysis, not proof that all security defects are absent.",
+};
+export const SECURITY_POLICY_DIGEST = hash(JSON.stringify(POLICY));
+
+function execute(command, args, { cwd, signal, binary = false } = {}) {
+  return new Promise((resolvePromise, reject) => {
+    execFile(command, args, {
+      cwd, signal, encoding: binary ? "buffer" : "utf8", timeout: 240000, maxBuffer: 4 * 1024 * 1024,
+      env: { PATH: process.env.PATH, LC_ALL: "C", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0" },
+    }, (error, stdout) => {
+      if (error && error.code !== 1) return reject(new Error("Security tool unavailable or incomplete."));
+      resolvePromise({ exitCode: error ? 1 : 0, stdout });
+    });
+  });
+}
+
+async function snapshot(repo, candidate, directory) {
+  const result = await execute("git", ["ls-tree", "-r", "-z", candidate.headCommit], { cwd: repo });
+  if (result.exitCode !== 0) throw new Error("Candidate tree unavailable.");
+  const files = new Map();
+  let totalBytes = 0;
+  for (const row of result.stdout.split("\0").filter(Boolean)) {
+    const match = /^(100644|100755) blob ([a-f0-9]{40,64})\t(.+)$/s.exec(row);
+    if (!match) throw new Error("Unsupported candidate file mode.");
+    const path = match[3];
+    if (path.startsWith("/") || path.includes("\\") || path.split("/").some((part) => !part || part === "." || part === "..")) throw new Error("Unsafe candidate path.");
+    const blob = await execute("git", ["cat-file", "blob", match[2]], { cwd: repo, binary: true });
+    if (blob.exitCode !== 0) throw new Error("Candidate blob unavailable.");
+    totalBytes += blob.stdout.length;
+    if (files.size >= 4096 || totalBytes > 32 * 1024 * 1024) throw new Error("Candidate exceeds security scan bounds.");
+    const target = join(directory, path);
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(target, blob.stdout, { mode: 0o600 });
+    files.set(path, { digest: hash(blob.stdout), bytes: blob.stdout });
+  }
+  return files;
+}
+
+function locatedFinding(files, directory, path, line, ruleId, severity) {
+  const scoped = relative(directory, resolve(directory, path));
+  const file = files.get(scoped);
+  if (!file) throw new Error("Finding is outside the immutable candidate.");
+  return { ruleId, severity, path: scoped, line, evidenceDigest: file.digest };
+}
+
+async function scanSecrets(context, input) {
+  const { directory, root, files, gitleaks } = context;
+  const version = await execute(gitleaks, ["version"], { signal: input.signal, cwd: root });
+  if (version.exitCode !== 0 || version.stdout.trim() !== POLICY.gitleaksVersion) throw new Error("Unexpected secret scanner version.");
+  const config = join(root, "gitleaks.toml");
+  const ignore = join(root, "gitleaks.ignore");
+  const report = join(root, "secrets.json");
+  await writeFile(config, "[extend]\nuseDefault = true\n", { mode: 0o600 });
+  await writeFile(ignore, "", { mode: 0o600 });
+  const result = await execute(gitleaks, ["dir", directory, "--config", config, "--gitleaks-ignore-path", ignore, "--report-format", "json", "--report-path", report, "--redact=100", "--ignore-gitleaks-allow", "--no-banner"], { signal: input.signal, cwd: root });
+  const findings = JSON.parse(await readFile(report, "utf8"));
+  if (!Array.isArray(findings) || (result.exitCode === 1 && findings.length === 0)) throw new Error("Incomplete secret scan.");
+  return { ...input, status: findings.length ? "failed" : "passed", findings: findings.map((item) => locatedFinding(files, directory, item.File, item.StartLine, item.RuleID, "critical")) };
+}
+
+async function scanSyntax(context, input, category) {
+  // Candidate comments cannot turn required checks off.
+  for (const file of context.files.values()) {
+    if (/^\s*(?:\/\/|\/\*|\*)\s*ast-grep-ignore\b/m.test(file.bytes.toString("utf8"))) return { ...input, status: "blocked", findings: [] };
+  }
+  const version = await execute(context.astGrep, ["--version"], { signal: input.signal, cwd: context.root });
+  if (version.exitCode !== 0 || version.stdout.trim() !== `ast-grep ${POLICY.astGrepVersion}`) throw new Error("Unexpected syntax scanner version.");
+  const rules = RULES.filter((rule) => rule.id.startsWith(category)).flatMap((rule) => ["JavaScript", "TypeScript", "Tsx"].map((language) => ({ id: `${rule.id}-${language.toLowerCase()}`, language, severity: "error", message: rule.id, rule: { pattern: rule.pattern } })));
+  const args = ["scan", "--inline-rules", rules.map((rule) => JSON.stringify(rule)).join("\n---\n"), "--json=compact"];
+  for (const kind of ["hidden", "dot", "exclude", "global", "parent", "vcs"]) args.push("--no-ignore", kind);
+  args.push(context.directory);
+  const result = await execute(context.astGrep, args, { signal: input.signal, cwd: context.root });
+  const findings = JSON.parse(result.stdout);
+  if (!Array.isArray(findings) || (result.exitCode === 1 && findings.length === 0)) throw new Error("Incomplete syntax scan.");
+  return { ...input, status: findings.length ? "failed" : "passed", findings: findings.map((item) => locatedFinding(context.files, context.directory, item.file, item.range.start.line + 1, item.ruleId, "high")) };
+}
+
+function dependencyVersions(bytes) {
+  const manifest = JSON.parse(bytes.toString("utf8"));
+  return ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"].flatMap((key) => dependencyGroup(manifest, key));
+}
+
+function dependencyGroup(manifest, key) {
+  const dependencies = manifest[key] ?? {};
+  if (typeof dependencies !== "object" || Array.isArray(dependencies)) throw new Error("Malformed dependencies.");
+  const versions = Object.values(dependencies);
+  if (versions.some((version) => typeof version !== "string")) throw new Error("Malformed dependency version.");
+  return versions;
+}
+
+function scanDependencies(context, input) {
+  const declarations = [...context.files].filter(([path]) => path === "package.json" || path.endsWith("/package.json"))
+    .flatMap(([path, file]) => dependencyVersions(file.bytes).map((version) => ({ path, file, version })));
+  const findings = declarations.filter(({ version }) => /^(?:git\+)?http:\/\//i.test(version))
+    .map(({ path, file }) => ({ ruleId: "dependencies-insecure-http", severity: "high", path, line: 1, evidenceDigest: file.digest }));
+  return { ...input, status: findings.length ? "failed" : declarations.length ? "blocked" : "passed", findings };
+}
+
+export async function scanCandidateSecurity({ repo, lineage, now, base = "main", head = "HEAD", gitleaks = "gitleaks", astGrep = "ast-grep" }) {
+  const candidate = await captureCandidate({ repo, projectKey: lineage.candidate.projectKey, repositoryId: lineage.candidate.repositoryId, base, head });
+  if (candidate.id !== lineage.candidate.id) throw new Error("Security candidate changed.");
+  const root = await mkdtemp(join(tmpdir(), "tabellio-security-"));
+  try {
+    const directory = join(root, "candidate");
+    await mkdir(directory);
+    const files = await snapshot(repo, candidate, directory);
+    const context = { root, directory, files, gitleaks, astGrep };
+    return await runSecurityReview({ lineage, now, policyDigest: SECURITY_POLICY_DIGEST, checks: {
+      secrets: (input) => scanSecrets(context, input),
+      authorization: (input) => scanSyntax(context, input, "authorization"),
+      trust: (input) => scanSyntax(context, input, "trust"),
+      dependencies: (input) => scanDependencies(context, input),
+    } });
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}
diff --git a/scripts/lib/provenance-security.mjs b/scripts/lib/provenance-security.mjs
new file mode 100644
index 0000000..8fd5436
--- /dev/null
+++ b/scripts/lib/provenance-security.mjs
@@ -0,0 +1,90 @@
+import { createHash } from "node:crypto";
+import { assembleLineage, buildReviewPacket, candidateIdentity, verifyLineage } from "./provenance-ledger.mjs";
+import { normalizeRecord } from "./provenance-record.mjs";
+
+export const SECURITY_CHECKS = Object.freeze(["secrets", "authorization", "trust", "dependencies"]);
+const HEX = /^[a-f0-9]{64}$/;
+const STATES = new Set(["passed", "failed", "blocked"]);
+const SEVERITIES = new Set(["low", "medium", "high", "critical"]);
+const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+function requireFact(value) { if (!value) throw new Error("Invalid security evidence."); }
+
+function safeText(value) {
+  normalizeRecord({ entityType: "reference", entityKey: value, source: "tabellio", sourceId: "security", observedAt: "2026-01-01T00:00:00Z", sensitivity: "private" });
+  return value;
+}
+
+function finding(input, category) {
+  requireFact(input && SEVERITIES.has(input.severity) && HEX.test(input.evidenceDigest));
+  requireFact(typeof input.ruleId === "string" && /^[a-z][a-z0-9-]{0,79}$/.test(input.ruleId));
+  requireFact(typeof input.path === "string" && !input.path.startsWith("/") && !input.path.includes("\\") && !input.path.split("/").some((part) => !part || part === "." || part === ".."));
+  requireFact(Number.isSafeInteger(input.line) && input.line > 0 && input.line <= 2147483647);
+  // Never copy messages, snippets, matched secrets, or raw scanner output.
+  return { category, ruleId: safeText(input.ruleId), severity: input.severity, path: safeText(input.path), line: input.line, evidenceDigest: input.evidenceDigest };
+}
+
+function checkResult(input, category, binding) {
+  requireFact(input && input.candidateId === binding.candidateId && input.packetDigest === binding.packetDigest && input.policyDigest === binding.policyDigest);
+  requireFact(STATES.has(input.status) && Array.isArray(input.findings) && input.findings.length <= 64);
+  const findings = input.findings.map((item) => finding(item, category)).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+  // A scanner cannot override its own reported findings with a green label.
+  const status = findings.length ? "failed" : input.status;
+  return { category, status, findings };
+}
+
+export async function runSecurityReview({ lineage, candidate = lineage.candidate, now, policyDigest, checks, timeoutMs = 300000 }) {
+  requireFact(typeof policyDigest === "string" && HEX.test(policyDigest));
+  requireFact(Number.isSafeInteger(timeoutMs) && timeoutMs > 0 && timeoutMs <= 900000);
+  const packet = buildReviewPacket(lineage, { candidate, now });
+  const binding = { candidateId: packet.candidate.id, packetDigest: packet.digest, policyDigest };
+  const results = await Promise.all(SECURITY_CHECKS.map(async (category) => {
+    const controller = new AbortController();
+    let timer;
+    try {
+      requireFact(typeof checks?.[category] === "function");
+      // Each check gets an isolated safe packet; one check cannot mutate another's input.
+      const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => { controller.abort(); reject(new Error("Security check timed out.")); }, timeoutMs);
+      });
+      const input = await Promise.race([Promise.resolve().then(() => checks[category]({ packet: structuredClone(packet), ...binding, signal: controller.signal })), deadline]);
+      return checkResult(input, category, binding);
+    } catch {
+      return { category, status: "blocked", findings: [] };
+    } finally {
+      clearTimeout(timer);
+    }
+  }));
+  const status = results.some((item) => item.status === "failed") ? "failed" : results.every((item) => item.status === "passed") ? "passed" : "blocked";
+  const result = { schemaVersion: "tabellio-security-review/v0.1", candidate: packet.candidate, packetDigest: packet.digest, policyDigest, observedAt: now, status, checks: results };
+  // Reuse timestamp validation and ensure the review remains bounded.
+  normalizeRecord({ entityType: "security", entityKey: packet.digest, source: "tabellio", sourceId: packet.digest, observedAt: now, sensitivity: "private" });
+  requireFact(Buffer.byteLength(JSON.stringify(result)) <= 65536);
+  return { ...result, digest: hash(result) };
+}
+
+export function attachSecurityReview({ lineage, review, policyDigest, now }) {
+  verifyLineage(lineage);
+  requireFact(review?.schemaVersion === "tabellio-security-review/v0.1" && HEX.test(policyDigest) && review.policyDigest === policyDigest);
+  requireFact(candidateIdentity(review.candidate).id === lineage.candidate.id);
+  const packet = buildReviewPacket(lineage, { now: review.observedAt });
+  requireFact(review.packetDigest === packet.digest);
+  requireFact(Array.isArray(review.checks) && review.checks.length === SECURITY_CHECKS.length);
+  const binding = { candidateId: lineage.candidate.id, packetDigest: packet.digest, policyDigest };
+  const checks = SECURITY_CHECKS.map((category, index) => {
+    const input = review.checks[index];
+    requireFact(input?.category === category);
+    return checkResult({ ...input, ...binding }, category, binding);
+  });
+  const status = checks.some((item) => item.status === "failed") ? "failed" : checks.every((item) => item.status === "passed") ? "passed" : "blocked";
+  const expected = { schemaVersion: review.schemaVersion, candidate: lineage.candidate, packetDigest: packet.digest, policyDigest, observedAt: review.observedAt, status, checks };
+  requireFact(review.digest === hash(expected) && JSON.stringify(review) === JSON.stringify({ ...expected, digest: review.digest }));
+  requireFact(Number.isFinite(Date.parse(now)) && Date.parse(review.observedAt) <= Date.parse(now));
+  const validation = lineage.observations.filter((item) => item.kind === "validation" && item.candidate.id === lineage.candidate.id);
+  requireFact(validation.length === 1);
+  return assembleLineage({ candidate: lineage.candidate, observations: [...lineage.observations, {
+    source: "tabellio", sourceId: review.digest, kind: "security", candidate: lineage.candidate,
+    status, observedAt: review.observedAt,
+    links: [{ relation: "validates", source: validation[0].source, sourceId: validation[0].sourceId, basis: "explicit" }],
+    metadata: { refs: [{ kind: "security_digest", value: review.digest }, { kind: "packet_digest", value: packet.digest }, { kind: "policy_digest", value: policyDigest }] },
+  }] });
+}
diff --git a/scripts/lib/provenance-source-failures.mjs b/scripts/lib/provenance-source-failures.mjs
new file mode 100644
index 0000000..bd9bacf
--- /dev/null
+++ b/scripts/lib/provenance-source-failures.mjs
@@ -0,0 +1,17 @@
+// Only these fixed messages may cross from source metadata into review packets.
+export const SOURCE_FAILURES = Object.freeze({
+  authentication: { state: "blocked", message: "Authenticate the source reader, then collect fresh evidence." },
+  permission: { state: "blocked", message: "Restore read permission for the selected source record, then collect it again." },
+  record_missing: { state: "missing", message: "Locate the selected record in its original source; do not infer a replacement." },
+  source_unavailable: { state: "blocked", message: "Restore source availability, then collect fresh evidence." },
+  reader_missing: { state: "missing", message: "Supply the required read-only source reader or original snapshot." },
+  source_missing: { state: "missing", message: "Supply the original source snapshot." },
+  selection_missing: { state: "missing", message: "Select explicit source identifiers for this candidate." },
+  candidate_mismatch: { state: "conflicting", message: "Source evidence names another code candidate; reconcile base, head, and merge base." },
+  scope_mismatch: { state: "conflicting", message: "Source evidence belongs to another project or repository; select matching evidence." },
+  association_missing: { state: "missing", message: "Supply an explicit source association; titles and timestamps cannot establish the link." },
+  malformed_response: { state: "blocked", message: "Collect a valid source snapshot; malformed evidence cannot establish readiness." },
+  review_not_ready: { state: "blocked", message: "Use an open pull request that is ready for review." },
+  review_binding_missing: { state: "missing", message: "Bind the review explicitly to this exact candidate before using it." },
+  manifest_mismatch: { state: "conflicting", message: "Run validation with the selected manifest; the supplied receipt names another manifest." },
+});
diff --git a/scripts/lib/provenance-sources.mjs b/scripts/lib/provenance-sources.mjs
index cde70fd..3eab470 100644
--- a/scripts/lib/provenance-sources.mjs
+++ b/scripts/lib/provenance-sources.mjs
@@ -4,6 +4,7 @@ import { validatePlaneWorkItemSnapshot } from "./plane-work-item-collector.mjs";
 import { validateLedgerSnapshot } from "./ledger-provider.mjs";
 import { validateBuildkiteBuildSnapshot } from "./buildkite-build-collector.mjs";
 import { validateValidationResult } from "./validation-runner.mjs";
+import { SOURCE_FAILURES } from "./provenance-source-failures.mjs";
 
 const SOURCES = ["plane", "git", "entire", "github", "buildkite"];
 const PRIMARY_KIND = { plane: "task", git: "commit", entire: "checkpoint", github: "pull_request", buildkite: "validation" };
@@ -51,7 +52,7 @@ function importProvenanceSources({ candidate: input, selection, snapshots, now }
       sources.push({ source, status: "present", observationIds: checked.observations.map((item) => item.id) });
     } catch (error) {
       const reason = safeFailure(error);
-      observations.push(observe(context, source, `${source}:unavailable`, PRIMARY_KIND[source], "blocked", [], now, { reason }));
+      observations.push(observe(context, source, `${source}:unavailable`, PRIMARY_KIND[source], SOURCE_FAILURES[reason].state, [], now, { reason }));
       sources.push({ source, status: "blocked", reason });
     }
   }
@@ -144,11 +145,11 @@ function pullRequestId({ candidate, selection }) { return `${candidate.repositor
 function buildId({ selection }) { return `${selection.organization}/${selection.pipeline}/${selection.buildNumber}`; }
 function requireFact(condition, reason) { if (!condition) throw Object.assign(new Error("Source evidence is blocked."), { sourceFailure: reason }); }
 function transportFailure(error) {
+  if (error?.sourceFailure === "reader_missing") return "reader_missing";
   const status = error?.status ?? error?.statusCode;
   if (status === 401) return "authentication";
   if (status === 403) return "permission";
   if (status === 404) return "record_missing";
   return "source_unavailable";
 }
-const FAILURES = new Set(["authentication", "permission", "record_missing", "source_unavailable", "reader_missing", "source_missing", "selection_missing", "candidate_mismatch", "scope_mismatch", "association_missing", "malformed_response", "review_not_ready", "review_binding_missing", "manifest_mismatch"]);
-function safeFailure(error) { return FAILURES.has(error?.sourceFailure) ? error.sourceFailure : "malformed_response"; }
+function safeFailure(error) { return Object.hasOwn(SOURCE_FAILURES, error?.sourceFailure) ? error.sourceFailure : "malformed_response"; }
diff --git a/scripts/tabellio-provenance.mjs b/scripts/tabellio-provenance.mjs
index 79a8fc7..e36b68a 100755
--- a/scripts/tabellio-provenance.mjs
+++ b/scripts/tabellio-provenance.mjs
@@ -2,8 +2,13 @@
 import { readFile } from "node:fs/promises";
 import { parseCommandOptions, requireOptions, writeJsonOutput } from "./lib/cli-options.mjs";
 import { LocalProvenanceStore } from "./lib/local-provenance-store.mjs";
-import { assembleLineage, buildReviewPacket, captureCandidate, evaluateLineage, verifyLineage } from "./lib/provenance-ledger.mjs";
+import { assembleLineage, buildReviewPacket, captureCandidate, verifyLineage } from "./lib/provenance-ledger.mjs";
 import { captureGitSource, collectProvenanceSources } from "./lib/provenance-sources.mjs";
+import { attachSecurityReview } from "./lib/provenance-security.mjs";
+import { scanCandidateSecurity } from "./lib/provenance-security-scanners.mjs";
+import { buildProvenanceReviewResult } from "./lib/provenance-review-result.mjs";
+import { createProvenanceStatusIntent, publishProvenanceStatuses } from "./lib/provenance-review-publication.mjs";
+import { GitHubStatusPublisher } from "./providers/github-status-publisher.mjs";
 
 main().catch(() => {
   // Provider content and database errors must not escape through CLI diagnostics.
@@ -26,8 +31,12 @@ async function main() {
     import: ["input", "databaseUrl", "out"],
     replay: ["input", "databaseUrl", "out"],
     show: [...query, "out"],
-    review: [...query, "repo", "base", "head", "now", "out"],
+    review: [...query, "repo", "base", "head", "now", "reportUrl", "securityInput", "policyDigest", "out"],
+    "review-intent": [...query, "repo", "base", "head", "now", "reportUrl", "out"],
+    "publish-review": [...query, "repo", "base", "head", "intentInput", "approvalInput", "out"],
     packet: [...query, "repo", "base", "head", "now", "out"],
+    "import-security": [...query, "input", "policyDigest", "repo", "base", "head", "now", "out"],
+    security: ["input", "repo", "base", "head", "now", "gitleaks", "astGrep", "out"],
   });
   if (["import-sources", "replay-sources"].includes(options.command)) {
     await importSources(options);
@@ -38,6 +47,9 @@ async function main() {
     await writeJsonOutput(await captureCandidate(options), options.out);
     return;
   }
+  if (options.command === "security") {
+    return runSecurityCommand(options);
+  }
   if (["import", "replay"].includes(options.command)) {
     requireOptions(options, ["input", "databaseUrl"], options.command);
     const input = await readInput(options.input);
@@ -62,11 +74,53 @@ async function main() {
   requireOptions(options, ["repo"], options.command);
   const candidate = await captureCandidate(options);
   const evaluation = { candidate, now: options.now ?? new Date().toISOString() };
-  const result = options.command === "packet" ? buildReviewPacket(lineage, evaluation) : evaluateLineage(lineage, evaluation);
+  if (options.command === "review-intent") {
+    await writeJsonOutput(createProvenanceStatusIntent(lineage, { ...evaluation, reportUrl: options.reportUrl ?? null }), options.out);
+    return;
+  }
+  if (options.command === "publish-review") return publishReviewCommand(options, lineage);
+  if (options.command === "import-security") {
+    return importSecurityCommand(options, { store, lineage, ...evaluation });
+  }
+  const result = options.command === "packet" ? buildReviewPacket(lineage, evaluation) : await reviewResult(options, lineage, evaluation);
+  await writeJsonOutput(result, options.out);
+  if (result.status !== "passed") process.exitCode = 1;
+}
+
+async function runSecurityCommand(options) {
+  requireOptions(options, ["input", "repo"], options.command);
+  const lineage = verifyLineage(await readInput(options.input));
+  const result = await scanCandidateSecurity({ ...options, lineage, now: options.now ?? new Date().toISOString() });
   await writeJsonOutput(result, options.out);
   if (result.status !== "passed") process.exitCode = 1;
 }
 
+async function reviewResult(options, lineage, evaluation) {
+  const securityReceipt = options.securityInput ? await readInput(options.securityInput) : null;
+  if (securityReceipt) requireOptions(options, ["policyDigest"], options.command);
+  return buildProvenanceReviewResult(lineage, { ...evaluation, reportUrl: options.reportUrl ?? null, securityReceipt, policyDigest: options.policyDigest });
+}
+
+async function publishReviewCommand(options, lineage) {
+  requireOptions(options, ["intentInput", "approvalInput"], options.command);
+  const intent = await readInput(options.intentInput);
+  const approval = await readInput(options.approvalInput);
+  const publisher = new GitHubStatusPublisher({ token: process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN });
+  const result = await publishProvenanceStatuses({ ...options, lineage, intent, approval, publisher, now: new Date().toISOString() });
+  await writeJsonOutput(result, options.out);
+  if (result.status !== "published") process.exitCode = 1;
+}
+
+async function importSecurityCommand(options, { store, lineage, candidate, now }) {
+  requireOptions(options, ["input", "policyDigest"], options.command);
+  if (candidate.id !== lineage.candidate.id) throw new Error("Security candidate changed.");
+  const review = await readInput(options.input);
+  const secured = attachSecurityReview({ lineage, review, policyDigest: options.policyDigest, now });
+  const digest = await store.putLineage(secured);
+  await writeJsonOutput({ status: review.status, candidate, digest, securityDigest: review.digest }, options.out);
+  if (review.status !== "passed") process.exitCode = 1;
+}
+
 async function importSources(options) {
   requireOptions(options, ["input", "repo", "databaseUrl"], options.command);
   if (options.command === "replay-sources") {
diff --git a/tests/analytics-core.test.mjs b/tests/analytics-core.test.mjs
index a5a9a82..1c8dadb 100644
--- a/tests/analytics-core.test.mjs
+++ b/tests/analytics-core.test.mjs
@@ -90,7 +90,7 @@ test("analytics core rejects stale, unsafe, and contradictory imported evidence"
       dataset.repositories[0].sources.find((source) => source.system === "git").sourceVersion = "b".repeat(40);
     }, /does not match headCommit/],
     ["unsafe source reason", (dataset) => {
-      blockPlaneSource(dataset, "token=gho_0123456789abcdef");
+      blockPlaneSource(dataset, `token=ghp_${"x".repeat(16)}`);
     }, /safe reason/],
     ["future provider version", (dataset) => {
       dataset.repositories[0].sources.find((source) => source.system === "github").sourceVersion =
diff --git a/tests/provenance-ledger.test.mjs b/tests/provenance-ledger.test.mjs
index 13498dc..17d93bd 100644
--- a/tests/provenance-ledger.test.mjs
+++ b/tests/provenance-ledger.test.mjs
@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
@@ -8,12 +8,47 @@ import test from "node:test";
 import { assembleLineage, buildReviewPacket, candidateIdentity, captureCandidate, evaluateLineage, verifyLineage } from "../scripts/lib/provenance-ledger.mjs";
 import { sampleObservations } from "../examples/provenance/sample.mjs";
 import { captureGitSource } from "../scripts/lib/provenance-sources.mjs";
+import { validateJsonSchema } from "../scripts/lib/json-schema-validator.mjs";
 
 const execute = promisify(execFile);
 const candidate = candidateIdentity({ projectKey: "SAMPLE", repositoryId: "sample/repository", baseCommit: "a".repeat(40), headCommit: "b".repeat(40), mergeBase: "a".repeat(40) });
 const now = "2026-09-12T12:00:01Z";
 const input = () => ({ candidate, observations: sampleObservations(candidate) });
 
+test("review packet schema accepts generated packets and rejects unsafe envelopes", async () => {
+  const schema = JSON.parse(await readFile(new URL("../schemas/provenance-review-packet.schema.json", import.meta.url), "utf8"));
+  const complete = buildReviewPacket(assembleLineage(input()), { now });
+  const missing = buildReviewPacket(assembleLineage({ candidate, observations: [] }), { now });
+  for (const packet of [complete, missing]) assert.deepEqual(validateJsonSchema(packet, schema), []);
+  assert.ok(missing.reasons.length > 0);
+  for (const evidenceId of [null, "a".repeat(64)]) {
+    const packet = structuredClone(missing);
+    packet.reasons[0].evidenceId = evidenceId;
+    assert.deepEqual(validateJsonSchema(packet, schema), []);
+  }
+  const mutations = [
+    (packet) => { packet.authoritative = true; },
+    (packet) => { packet.privatePayload = "private"; },
+    (packet) => { delete packet.digest; },
+    (packet) => { packet.candidate.headCommit = "main"; },
+    (packet) => { packet.candidate.id = "invalid"; },
+    (packet) => { packet.status = "approved"; },
+    (packet) => { packet.reasons[0].evidenceId = "invalid"; },
+    (packet) => { packet.reasons[0].evidenceId = 7; },
+    (packet) => { packet.reasons[0].privatePayload = "private"; },
+    (packet) => { packet.redactions = []; },
+  ];
+  for (const mutate of mutations) {
+    const packet = structuredClone(missing);
+    mutate(packet);
+    assert.notDeepEqual(validateJsonSchema(packet, schema), []);
+  }
+  const invalidDate = structuredClone(complete);
+  assert.ok(invalidDate.facts.length > 0);
+  invalidDate.facts[0].observedAt = "2026-02-30T12:00:00Z";
+  assert.notDeepEqual(validateJsonSchema(invalidDate, schema), []);
+});
+
 test("complete lineage is deterministic under reordered and duplicate input", () => {
   const a = assembleLineage(input());
   const b = input();
@@ -81,7 +116,7 @@ test("review packet excludes payloads and foreign candidate facts; credentials a
   assert.throws(() => assembleLineage(data), /forbidden/);
 });
 
-test("sample Git repository binds real base/head/merge-base and rejects moved base", async (t) => {
+test("sample Git repository binds real candidates and rejects moved refs and unrelated histories", async (t) => {
   const repo = await mkdtemp(join(tmpdir(), "tabellio-provenance-sample-"));
   t.after(() => rm(repo, { recursive: true, force: true }));
   const git = (...args) => execute("git", ["-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", ...args], { cwd: repo, env: { ...process.env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_AUTHOR_NAME: "Sample", GIT_AUTHOR_EMAIL: "sample@example.invalid", GIT_COMMITTER_NAME: "Sample", GIT_COMMITTER_EMAIL: "sample@example.invalid" } });
@@ -106,4 +141,36 @@ test("sample Git repository binds real base/head/merge-base and rejects moved ba
   await git("branch", "-f", "main", first.headCommit);
   const moved = await captureCandidate({ repo, projectKey: "SAMPLE", repositoryId: "sample/repository" });
   assert.equal(evaluateLineage(lineage, { candidate: moved, now }).status, "blocked");
+  await git("commit", "--allow-empty", "-m", "Move candidate head");
+  const changedHead = await captureCandidate({ repo, projectKey: "SAMPLE", repositoryId: "sample/repository" });
+  assert.notEqual(changedHead.headCommit, first.headCommit);
+  assert.equal(evaluateLineage(lineage, { candidate: changedHead, now }).status, "blocked");
+  assert.equal(buildReviewPacket(lineage, { candidate: changedHead, now }).facts.length, 0);
+  await git("checkout", "--orphan", "unrelated-history");
+  await git("commit", "-m", "Create unrelated root");
+  await assert.rejects(captureCandidate({ repo, projectKey: "SAMPLE", repositoryId: "sample/repository" }));
+  await assert.rejects(captureCandidate({ repo, projectKey: "SAMPLE", repositoryId: "sample/repository", head: "missing-ref" }));
+  await git("branch", "-f", "sample-change", first.baseCommit);
+  const rewrittenRef = await captureCandidate({ repo, projectKey: "SAMPLE", repositoryId: "sample/repository", head: "sample-change" });
+  assert.notEqual(rewrittenRef.id, first.id);
+  assert.equal(evaluateLineage(lineage, { candidate: rewrittenRef, now }).status, "blocked");
+});
+test("packet byte limit includes integrity digest and rejects one byte beyond the boundary", () => {
+  const data = input();
+  const extras = Array.from({ length: 100 }, (_, index) => ({ ...data.observations[0], sourceId: `extra-${index}`, metadata: {} }));
+  data.observations.push(...extras);
+  const packet = () => buildReviewPacket(assembleLineage(data), { now });
+  let remaining = 65536 - Buffer.byteLength(`${JSON.stringify(packet(), null, 2)}\n`);
+  for (const item of extras) {
+    const added = Math.min(512 - item.sourceId.length, remaining);
+    item.sourceId += "x".repeat(added);
+    remaining -= added;
+  }
+  assert.equal(remaining, 0);
+  assert.equal(Buffer.byteLength(`${JSON.stringify(packet(), null, 2)}\n`), 65536);
+  extras.find((item) => item.sourceId.length < 512).sourceId += "x";
+  assert.throws(packet, /exceeds 65536 bytes/);
+  const unicode = input();
+  unicode.observations.push(...Array.from({ length: 60 }, (_, index) => ({ ...unicode.observations[0], sourceId: `${index}-${"é".repeat(500)}`, metadata: {} })));
+  assert.throws(() => buildReviewPacket(assembleLineage(unicode), { now }), /exceeds 65536 bytes/);
 });
diff --git a/tests/provenance-review-publication.test.mjs b/tests/provenance-review-publication.test.mjs
new file mode 100644
index 0000000..11b78d1
--- /dev/null
+++ b/tests/provenance-review-publication.test.mjs
@@ -0,0 +1,113 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createFeatureFixture } from "./helpers/git-fixture.mjs";
+import { runGit } from "../scripts/lib/git-process.mjs";
+import { assembleLineage, captureCandidate } from "../scripts/lib/provenance-ledger.mjs";
+import { createProvenanceStatusIntent, publishProvenanceStatuses } from "../scripts/lib/provenance-review-publication.mjs";
+import { sampleObservations } from "../examples/provenance/sample.mjs";
+import { digestObject } from "../scripts/lib/stack-operation.mjs";
+
+const now = "2026-09-12T12:00:02Z";
+function approval(intent, id = "test-status") {
+  return { schemaVersion: "tabellio-provenance-status-approval/v0.1", id, intentDigest: intent.integrity.digest, approved: true, approvedBy: "Synthetic test", approvedAt: now, expiresAt: "2026-09-12T12:01:02Z", reason: "Synthetic publisher only." };
+}
+async function setup(t, change = () => {}) {
+  const fixture = await createFeatureFixture(t);
+  const repo = fixture.seed;
+  await runGit({ cwd: repo, args: ["remote", "set-url", "origin", "https://github.com/example/tabellio.git"] });
+  const candidate = await captureCandidate({ repo, projectKey: "SAMPLE", repositoryId: "github.com/example/tabellio" });
+  const observations = sampleObservations(candidate);
+  change(observations);
+  const lineage = assembleLineage({ candidate, observations });
+  const intent = createProvenanceStatusIntent(lineage, { now });
+  const calls = [];
+  const publisher = { publish: async (request) => { calls.push(request); return { ...request, id: calls.length }; } };
+  return { repo, lineage, intent, now, publisher, calls, approval: approval(intent) };
+}
+
+test("published GitHub statuses match the CLI intent and approval replay sends nothing", async (t) => {
+  const input = await setup(t);
+  const first = await publishProvenanceStatuses(input);
+  assert.equal(first.status, "published");
+  assert.deepEqual(input.calls, input.intent.statuses);
+  assert.deepEqual(await publishProvenanceStatuses(input), first);
+  assert.equal(input.calls.length, 2);
+});
+
+test("failed review and blocked security publish distinct non-green states", async (t) => {
+  const input = await setup(t, (items) => {
+    items.find((item) => item.kind === "review").status = "failed";
+    items.find((item) => item.kind === "security").status = "blocked";
+  });
+  const receipt = await publishProvenanceStatuses(input);
+  assert.equal(receipt.status, "published");
+  assert.deepEqual(input.calls.map((item) => item.state), ["failure", "error"]);
+});
+
+test("expired approval, forged green state, and wrong origin are rejected before publication", async (t) => {
+  const input = await setup(t, (items) => { items.find((item) => item.kind === "review").status = "failed"; });
+  await assert.rejects(publishProvenanceStatuses({ ...input, now: "2026-09-12T12:02:00Z" }));
+  const forged = structuredClone(input.intent);
+  forged.statuses[0].state = "success";
+  const { integrity: _integrity, ...unsigned } = forged;
+  forged.integrity.digest = digestObject(unsigned);
+  await assert.rejects(publishProvenanceStatuses({ ...input, intent: forged, approval: approval(forged) }));
+  await runGit({ cwd: input.repo, args: ["remote", "set-url", "origin", "https://github.com/example/other.git"] });
+  await assert.rejects(publishProvenanceStatuses(input));
+  assert.equal(input.calls.length, 0);
+});
+
+test("changed head and stale evidence cannot publish an earlier green result", async (t) => {
+  const input = await setup(t);
+  const later = "2026-09-13T12:00:03Z";
+  const active = { ...input.approval, approvedAt: later, expiresAt: "2026-09-13T12:01:03Z" };
+  await assert.rejects(publishProvenanceStatuses({ ...input, approval: active, now: later }));
+  await runGit({ cwd: input.repo, args: ["switch", "main"] });
+  await assert.rejects(publishProvenanceStatuses(input));
+  assert.equal(input.calls.length, 0);
+});
+
+test("partial provider failure stays blocked and consumed approval never retries", async (t) => {
+  const input = await setup(t);
+  let count = 0;
+  input.publisher = { publish: async (request) => {
+    count += 1;
+    if (count === 2) throw new Error("private provider response");
+    return { ...request, id: count };
+  } };
+  const receipt = await publishProvenanceStatuses(input);
+  assert.equal(receipt.status, "blocked");
+  assert.equal(receipt.published.length, 1);
+  assert.ok(!JSON.stringify(receipt).includes("private provider response"));
+  assert.deepEqual(await publishProvenanceStatuses(input), receipt);
+  assert.equal(count, 2);
+});
+
+test("mismatched provider response cannot upgrade blocked evidence", async (t) => {
+  const input = await setup(t, (items) => { items.find((item) => item.kind === "validation").status = "blocked"; });
+  input.publisher = { publish: async (request) => ({ ...request, id: 1, state: "success" }) };
+  const receipt = await publishProvenanceStatuses(input);
+  assert.equal(receipt.status, "blocked");
+  assert.deepEqual(receipt.published, []);
+});
+
+test("candidate movement between statuses stops the second publication", async (t) => {
+  const input = await setup(t);
+  let count = 0;
+  input.publisher = { publish: async (request) => {
+    count += 1;
+    await runGit({ cwd: input.repo, args: ["switch", "main"] });
+    return { ...request, id: count };
+  } };
+  const receipt = await publishProvenanceStatuses(input);
+  assert.equal(receipt.status, "blocked");
+  assert.equal(count, 1);
+  assert.equal(receipt.published.length, 1);
+});
+
+test("concurrent consumers cannot publish twice under one approval", async (t) => {
+  const input = await setup(t);
+  const results = await Promise.allSettled([publishProvenanceStatuses(input), publishProvenanceStatuses(input)]);
+  assert.ok(results.some((item) => item.status === "fulfilled" && item.value.status === "published"));
+  assert.equal(input.calls.length, 2);
+});
diff --git a/tests/provenance-review-result.test.mjs b/tests/provenance-review-result.test.mjs
new file mode 100644
index 0000000..ecbb38a
--- /dev/null
+++ b/tests/provenance-review-result.test.mjs
@@ -0,0 +1,96 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { assembleLineage, candidateIdentity, evaluateLineage } from "../scripts/lib/provenance-ledger.mjs";
+import { buildProvenanceReviewResult } from "../scripts/lib/provenance-review-result.mjs";
+import { attachSecurityReview, runSecurityReview, SECURITY_CHECKS } from "../scripts/lib/provenance-security.mjs";
+import { sampleObservations } from "../examples/provenance/sample.mjs";
+
+const now = "2026-09-12T12:00:02Z";
+const candidate = candidateIdentity({ projectKey: "SAMPLE", repositoryId: "github.com/example/tabellio", baseCommit: "a".repeat(40), headCommit: "b".repeat(40), mergeBase: "a".repeat(40) });
+function observations() {
+  const replacements = { "pr-1": `${candidate.repositoryId}#9`, "build-1": "example/tabellio/12" };
+  return sampleObservations(candidate).map((item) => ({ ...item, sourceId: replacements[item.sourceId] ?? item.sourceId, links: item.links.map((link) => ({ ...link, sourceId: replacements[link.sourceId] ?? link.sourceId })) }));
+}
+const lineage = (items = observations()) => assembleLineage({ candidate, observations: items });
+const result = (input = lineage(), options = {}) => buildProvenanceReviewResult(input, { now, ...options });
+
+test("CLI and GitHub preserve separate review/security verdicts and exact candidate", () => {
+  const value = result();
+  assert.equal(value.status, "passed");
+  assert.equal(value.currentCandidate.id, candidate.id);
+  assert.equal(value.security.detailsState, "not_loaded");
+  assert.deepEqual(value.github.map((item) => item.state), ["success", "success"]);
+  for (const item of value.github) {
+    assert.equal(item.commit, candidate.headCommit);
+    assert.ok(item.description.includes(candidate.id));
+    assert.ok(item.description.length <= 140);
+  }
+  const failed = observations();
+  failed.find((item) => item.kind === "review").status = "failed";
+  const rejected = result(lineage(failed));
+  assert.equal(rejected.status, "failed");
+  assert.deepEqual(rejected.github.map((item) => item.state), ["failure", "success"]);
+  assert.match(rejected.review.nextAction, /review findings/);
+});
+
+test("missing security never upgrades to a passed overall result", () => {
+  const value = result(lineage(observations().filter((item) => item.kind !== "security")));
+  assert.equal(value.status, "blocked");
+  assert.equal(value.review.status, "passed");
+  assert.equal(value.security.status, "blocked");
+  assert.deepEqual(value.github.map((item) => item.state), ["success", "error"]);
+  assert.match(value.security.nextAction, /security/);
+});
+
+test("stale head blocks both contexts and hides facts belonging to the old candidate", () => {
+  const current = candidateIdentity({ ...candidate, headCommit: "c".repeat(40) });
+  const value = result(lineage(), { candidate: current });
+  assert.equal(value.status, "blocked");
+  assert.deepEqual(value.evidence, []);
+  assert.deepEqual(value.github.map((item) => item.state), ["error", "error"]);
+  assert.ok(value.github.every((item) => item.commit === current.headCommit && item.description.includes(current.id)));
+  assert.match(value.review.nextAction, /capture fresh evidence/);
+  assert.equal(value.security.detailsState, "stale");
+});
+
+test("conflict and provider outage keep actionable source evidence visible", () => {
+  const conflict = observations();
+  conflict.push({ ...conflict[0], observedAt: "2026-09-12T12:00:01Z" });
+  assert.equal(result(lineage(conflict)).status, "blocked");
+  assert.match(result(lineage(conflict)).review.nextAction, /reconcile/);
+  const outage = observations();
+  Object.assign(outage.find((item) => item.kind === "validation"), { status: "blocked", metadata: { reason: "source_unavailable", summary: "private provider detail" } });
+  const value = result(lineage(outage));
+  assert.equal(value.status, "blocked");
+  assert.equal(value.github[0].state, "error");
+  assert.equal(value.github[0].targetUrl, "https://buildkite.com/example/tabellio/builds/12");
+  assert.match(value.review.nextAction, /Restore source availability/);
+  assert.ok(!JSON.stringify(value).includes("private provider detail"));
+});
+
+test("source links point to known records and report URLs reject credentials", () => {
+  const value = result();
+  assert.equal(value.evidence.find((item) => item.kind === "commit").url, `https://github.com/example/tabellio/commit/${candidate.headCommit}`);
+  assert.equal(value.evidence.find((item) => item.kind === "pull_request").url, "https://github.com/example/tabellio/pull/9");
+  assert.equal(value.evidence.find((item) => item.source === "plane").url, null);
+  for (const reportUrl of ["javascript:alert(1)", "https://user:password@example.test/report", "https://example.test/report?token=private", "https://example.test/report#token%3Dprivate", "http://example.test/report"]) assert.throws(() => result(lineage(), { reportUrl }));
+  const reportUrl = "https://example.test/reports/candidate";
+  assert.ok(result(lineage(), { reportUrl }).github.every((item) => item.targetUrl === reportUrl));
+});
+
+test("verified security findings link to the reviewed file without source excerpts", async () => {
+  const original = lineage(observations().filter((item) => item.kind !== "security"));
+  const policyDigest = "d".repeat(64);
+  const checks = Object.fromEntries(SECURITY_CHECKS.map((category) => [category, async (input) => ({ ...input, status: "passed", findings: category === "trust" ? [{ ruleId: "trust-disabled-tls", severity: "high", path: "src/app.mjs", line: 4, evidenceDigest: "e".repeat(64), snippet: "private source" }] : [] })]));
+  const receipt = await runSecurityReview({ lineage: original, now, policyDigest, checks });
+  const secured = attachSecurityReview({ lineage: original, review: receipt, policyDigest, now });
+  const value = result(secured, { securityReceipt: receipt, policyDigest });
+  assert.equal(value.status, evaluateLineage(secured, { now }).status);
+  assert.equal(value.review.status, "passed");
+  assert.equal(value.security.status, "failed");
+  assert.equal(value.security.detailsState, "loaded");
+  assert.equal(value.security.findings[0].url, `https://github.com/example/tabellio/blob/${candidate.headCommit}/src/app.mjs#L4`);
+  assert.ok(!JSON.stringify(value).includes("private source"));
+  assert.throws(() => result(secured, { securityReceipt: receipt, policyDigest: "f".repeat(64) }));
+  assert.throws(() => result(secured, { securityReceipt: { ...receipt, status: "passed" }, policyDigest }));
+});
diff --git a/tests/provenance-security-scanners.test.mjs b/tests/provenance-security-scanners.test.mjs
new file mode 100644
index 0000000..8c45000
--- /dev/null
+++ b/tests/provenance-security-scanners.test.mjs
@@ -0,0 +1,88 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import test from "node:test";
+import { assembleLineage, captureCandidate } from "../scripts/lib/provenance-ledger.mjs";
+import { scanCandidateSecurity } from "../scripts/lib/provenance-security-scanners.mjs";
+
+const execute = promisify(execFile);
+const now = "2026-09-12T12:00:01Z";
+const gitleaks = process.env.TABELLIO_GITLEAKS;
+const required = process.env.TABELLIO_REQUIRE_SECURITY_SCANNERS === "1";
+test("required security scanner configuration is present", () => {
+  if (required) assert.ok(gitleaks, "TABELLIO_GITLEAKS must name the pinned scanner.");
+});
+
+async function withCandidate(files, work) {
+  const repo = await mkdtemp(join(tmpdir(), "tabellio-security-test-"));
+  const git = (...args) => execute("git", ["-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", "-c", "user.name=Sample", "-c", "user.email=sample@example.invalid", ...args], { cwd: repo });
+  try {
+    await git("init", "-b", "main");
+    await writeFile(join(repo, "base.mjs"), "export const base = true;\n");
+    await git("add", ".");
+    await git("commit", "-m", "Base");
+    await git("checkout", "-b", "sample");
+    for (const [path, content] of Object.entries(files)) await writeFile(join(repo, path), content);
+    await git("add", ".");
+    await git("commit", "-m", "Candidate");
+    const candidate = await captureCandidate({ repo, projectKey: "SAMPLE", repositoryId: "sample/repository" });
+    const lineage = assembleLineage({ candidate, observations: [] });
+    await work({ repo, lineage, now, gitleaks });
+  } finally { await rm(repo, { recursive: true, force: true }); }
+}
+
+const syntheticToken = "ghp_" + createHash("sha256").update("tabellio synthetic noncredential fixture").digest("hex").slice(0, 36);
+for (const [name, files, category] of [
+  ["clean", { "app.mjs": "export const answer = 42;\n" }, null],
+  ["secret", { "app.mjs": `export const key = '${syntheticToken}'; // gitleaks:allow\n` }, "secrets"],
+  ["broken authorization", { "app.mjs": "export const claims = jwt.decode(token);\n", ".ignore": "app.mjs\n" }, "authorization"],
+  ["unsafe trust boundary", { "app.mjs": "export const agent = new https.Agent({rejectUnauthorized: false});\n" }, "trust"],
+  ["insecure dependency", { "package.json": JSON.stringify({ dependencies: { example: "http://example.invalid/pkg.tgz" } }) }, "dependencies"],
+]) {
+  test(`real immutable candidate scanners identify ${name}`, { skip: !gitleaks && !required }, async () => {
+    await withCandidate(files, async (input) => {
+      const result = await scanCandidateSecurity(input);
+      assert.equal(result.status, category ? "failed" : "passed", JSON.stringify(result.checks.map(({ category, status }) => ({ category, status }))));
+      if (category) assert.equal(result.checks.find((item) => item.category === category).status, "failed");
+      assert.ok(!JSON.stringify(result).includes(syntheticToken));
+      assert.equal(result.candidate.id, input.lineage.candidate.id);
+    });
+  });
+}
+
+test("unavailable tools and unaudited dependencies remain blocked", async () => {
+  await withCandidate({ "package.json": JSON.stringify({ dependencies: { example: "1.0.0" } }) }, async (input) => {
+    const result = await scanCandidateSecurity({ ...input, gitleaks: join(input.repo, "missing-gitleaks"), astGrep: join(input.repo, "missing-ast-grep") });
+    assert.equal(result.status, "blocked");
+    assert.ok(result.checks.every((item) => item.status === "blocked"));
+  });
+});
+
+test("scanner uses immutable blobs and rejects a changed candidate", { skip: !gitleaks && !required }, async () => {
+  await withCandidate({ "app.mjs": "export const answer = 42;\n" }, async (input) => {
+    await writeFile(join(input.repo, "app.mjs"), "eval(untrusted);\n");
+    assert.equal((await scanCandidateSecurity(input)).status, "passed");
+    await assert.rejects(scanCandidateSecurity({ ...input, head: "main" }));
+  });
+});
+
+test("candidate syntax suppressions cannot produce a security pass", { skip: !gitleaks && !required }, async () => {
+  await withCandidate({ "app.mjs": "// ast-grep-ignore\neval(untrusted);\n" }, async (input) => {
+    const result = await scanCandidateSecurity(input);
+    assert.equal(result.status, "blocked");
+    assert.equal(result.checks.find((item) => item.category === "trust").status, "blocked");
+  });
+});
+
+test("malformed dependency manifests cannot produce a dependency pass", async () => {
+  for (const manifest of ["not JSON", JSON.stringify({ dependencies: [] }), JSON.stringify({ dependencies: "example" }), JSON.stringify({ dependencies: { example: 1 } })]) {
+    await withCandidate({ "package.json": manifest }, async (input) => {
+      const result = await scanCandidateSecurity({ ...input, gitleaks: join(input.repo, "missing-gitleaks"), astGrep: join(input.repo, "missing-ast-grep") });
+      assert.equal(result.checks.find((item) => item.category === "dependencies").status, "blocked");
+    });
+  }
+});
diff --git a/tests/provenance-security.test.mjs b/tests/provenance-security.test.mjs
new file mode 100644
index 0000000..f47eb13
--- /dev/null
+++ b/tests/provenance-security.test.mjs
@@ -0,0 +1,129 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFile } from "node:fs/promises";
+import { validateJsonSchema } from "../scripts/lib/json-schema-validator.mjs";
+import { assembleLineage, candidateIdentity, evaluateLineage } from "../scripts/lib/provenance-ledger.mjs";
+import { attachSecurityReview, runSecurityReview, SECURITY_CHECKS } from "../scripts/lib/provenance-security.mjs";
+import { sampleObservations } from "../examples/provenance/sample.mjs";
+
+const now = "2026-09-12T12:00:01Z";
+const policyDigest = "c".repeat(64);
+const candidate = candidateIdentity({ projectKey: "SAMPLE", repositoryId: "sample/repository", baseCommit: "a".repeat(40), headCommit: "b".repeat(40), mergeBase: "a".repeat(40) });
+const lineage = assembleLineage({ candidate, observations: sampleObservations(candidate).filter((item) => item.kind !== "security") });
+// Reader fixtures test the evidence boundary, not scanner effectiveness.
+const readers = () => Object.fromEntries(SECURITY_CHECKS.map((category) => [category, async ({ candidateId, packetDigest, policyDigest }) => ({ candidateId, packetDigest, policyDigest, status: "passed", findings: [] })]));
+const run = (checks = readers(), overrides = {}) => runSecurityReview({ lineage, now, policyDigest, checks, ...overrides });
+const attach = (review, overrides = {}) => attachSecurityReview({ lineage, review, policyDigest, now, ...overrides });
+const evidence = () => ({ ruleId: "fixture-rule", severity: "high", path: "src/example.mjs", line: 3, evidenceDigest: "d".repeat(64) });
+
+test("security requires four separate checks on the same safe candidate packet", async () => {
+  assert.equal(evaluateLineage(lineage, { now }).status, "blocked");
+  const calls = [];
+  const checks = Object.fromEntries(SECURITY_CHECKS.map((category) => [category, async (input) => {
+    calls.push(category);
+    assert.equal(input.packet.candidate.id, candidate.id);
+    assert.equal(input.packet.digest, input.packetDigest);
+    assert.equal(input.packet.authoritative, false);
+    assert.equal(input.packet.facts.some((item) => Object.hasOwn(item, "metadata")), false);
+    return readers()[category](input);
+  }]));
+  const result = await run(checks);
+  assert.deepEqual(calls, SECURITY_CHECKS);
+  assert.equal(result.status, "passed");
+  assert.equal(evaluateLineage(attach(result), { now }).status, "passed");
+  assert.equal(lineage.observations.some((item) => item.kind === "security"), false);
+});
+
+test("missing, unavailable, malformed, and wrongly bound checks block security", async () => {
+  for (const category of SECURITY_CHECKS) {
+    for (const replacement of [undefined, async () => { throw new Error("private scanner failure"); }, async () => ({}), async (input) => ({ ...input, candidateId: "a".repeat(64), status: "passed", findings: [] })]) {
+      const result = await run({ ...readers(), [category]: replacement });
+      assert.equal(result.status, "blocked");
+      assert.equal(evaluateLineage(attach(result), { now }).status, "blocked");
+      assert.ok(!JSON.stringify(result).includes("private scanner failure"));
+    }
+  }
+});
+
+test("findings override a green scanner label and never export matched content", async () => {
+  for (const category of SECURITY_CHECKS) {
+    const result = await run({ ...readers(), [category]: async (input) => ({ ...input, status: "passed", findings: [{ ...evidence(), secret: "private-match", snippet: "private source", message: "private explanation" }] }) });
+    assert.equal(result.status, "failed");
+    assert.equal(evaluateLineage(attach(result), { now }).status, "failed");
+    assert.ok(!JSON.stringify(result).includes("private"));
+    assert.equal(result.checks.find((item) => item.category === category).findings[0].evidenceDigest, "d".repeat(64));
+  }
+});
+
+test("unsafe findings are blocked without exporting their content", async () => {
+  for (const update of [{ path: "../private" }, { path: "/private" }, { path: "password=private" }, { line: 0 }, { evidenceDigest: "bad" }, { severity: "unknown" }, { ruleId: "private text" }]) {
+    const result = await run({ ...readers(), secrets: async (input) => ({ ...input, status: "failed", findings: [{ ...evidence(), ...update }] }) });
+    assert.equal(result.status, "blocked");
+    assert.ok(!JSON.stringify(result).includes("private"));
+  }
+});
+
+test("security receipts reject tampering, changed policy, candidate, and packet", async () => {
+  const result = await run();
+  for (const mutate of [
+    (value) => { value.status = "failed"; },
+    (value) => { value.checks.pop(); },
+    (value) => { value.checks.reverse(); },
+    (value) => { value.checks[0].findings.push(evidence()); },
+    (value) => { value.packetDigest = "d".repeat(64); },
+    (value) => { value.candidate.headCommit = "e".repeat(40); },
+    (value) => { value.private = "extra"; },
+  ]) {
+    const changed = structuredClone(result);
+    mutate(changed);
+    assert.throws(() => attach(changed));
+  }
+  assert.throws(() => attach(result, { policyDigest: "f".repeat(64) }));
+  assert.throws(() => attach(result, { now: "2026-09-11T12:00:00Z" }));
+  const changed = assembleLineage({ candidate, observations: lineage.observations.slice(1) });
+  assert.throws(() => attach(result, { lineage: changed }));
+});
+
+test("checks cannot alter the packet another check receives", async () => {
+  const result = await run({ ...readers(), secrets: async (input) => {
+    input.packet.candidate.headCommit = "e".repeat(40);
+    return readers().secrets(input);
+  }, authorization: async (input) => {
+    assert.equal(input.packet.candidate.headCommit, candidate.headCommit);
+    return readers().authorization(input);
+  } });
+  assert.equal(result.status, "passed");
+});
+
+test("timed out checks abort and block without retrying or losing healthy checks", async () => {
+  let calls = 0;
+  let signal;
+  const result = await run({ ...readers(), secrets: async (input) => {
+    calls += 1;
+    signal = input.signal;
+    return new Promise(() => {});
+  } }, { timeoutMs: 5 });
+  assert.equal(calls, 1);
+  assert.equal(signal.aborted, true);
+  assert.equal(result.status, "blocked");
+  assert.equal(result.checks.filter((item) => item.status === "passed").length, 3);
+  await assert.rejects(run(readers(), { timeoutMs: 0 }));
+});
+
+test("security findings schema accepts producer results and rejects private or incomplete evidence", async () => {
+  const schema = JSON.parse(await readFile(new URL("../schemas/provenance-security-review.schema.json", import.meta.url), "utf8"));
+  const failed = await run({ ...readers(), secrets: async (input) => ({ ...input, status: "failed", findings: [evidence()] }) });
+  for (const value of [await run(), await run({}), failed]) assert.deepEqual(validateJsonSchema(value, schema), []);
+  for (const mutate of [
+    (value) => { value.checks.pop(); },
+    (value) => { value.checks[0].findings[0].snippet = "private source"; },
+    (value) => { value.checks[0].findings[0].severity = "unknown"; },
+    (value) => { value.checks[0].findings[0].line = 0; },
+    (value) => { value.observedAt = "2026-02-30T00:00:00Z"; },
+    (value) => { value.candidate.headCommit = "main"; },
+  ]) {
+    const value = structuredClone(failed);
+    mutate(value);
+    assert.notDeepEqual(validateJsonSchema(value, schema), []);
+  }
+});
diff --git a/tests/provenance-sources.test.mjs b/tests/provenance-sources.test.mjs
index 6ce3343..c8433ac 100644
--- a/tests/provenance-sources.test.mjs
+++ b/tests/provenance-sources.test.mjs
@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { candidateIdentity, evaluateLineage } from "../scripts/lib/provenance-ledger.mjs";
+import { assembleLineage, buildReviewPacket, candidateIdentity, evaluateLineage } from "../scripts/lib/provenance-ledger.mjs";
 import { collectProvenanceSources } from "../scripts/lib/provenance-sources.mjs";
 import { sampleSourceBundle } from "../examples/provenance/sources.mjs";
 
@@ -80,3 +80,32 @@ test("missing, malformed, mismatched, and unbound evidence fails closed", async
     assert.equal(evaluateLineage(result.lineage, { now }).status, "blocked");
   }
 });
+test("review packets distinguish missing, conflicting, stale, and access-blocked source evidence", async () => {
+  const cases = [
+    ["missing", "checkpoint", (snapshots) => { delete snapshots.entire; }, /source reader/],
+    ["conflicting", "commit", (snapshots) => { snapshots.git.candidate = { ...candidate, headCommit: "d".repeat(40) }; }, /another code candidate/],
+    ["stale", "commit", (snapshots) => { snapshots.git.capturedAt = "2026-07-01T12:00:00.000Z"; }, /Refresh observation/],
+    ["blocked", "task", (snapshots) => { snapshots.plane = { failure: "permission" }; }, /read permission/],
+  ];
+  for (const [state, kind, mutate, message] of cases) {
+    const snapshots = await fixture();
+    mutate(snapshots);
+    const { lineage } = await collect(snapshots);
+    const packet = buildReviewPacket(lineage, { now });
+    assert.equal(packet.status, "blocked");
+    assert.ok(packet.reasons.some((reason) => reason.state === state && reason.kind === kind && message.test(reason.message)), `${state}: ${JSON.stringify(packet.reasons)}`);
+  }
+});
+test("review packets expose only fixed source failure explanations", async () => {
+  const result = await collect(await fixture(), { plane: async () => { throw Object.assign(new Error("private provider body"), { status: 401 }); } });
+  const packet = buildReviewPacket(result.lineage, { now });
+  assert.ok(packet.reasons.some((reason) => /Authenticate the source reader/.test(reason.message)));
+  assert.ok(!JSON.stringify(packet).includes("private provider body"));
+  for (const untrustedReason of ["private narrative", "constructor", "__proto__"]) {
+    const altered = structuredClone(result.lineage);
+    altered.observations.find((item) => item.source === "plane").metadata.reason = untrustedReason;
+    const safe = buildReviewPacket(assembleLineage(altered), { now });
+    assert.ok(safe.reasons.some((reason) => reason.message === "Resolve source evidence before review readiness."));
+    assert.ok(!JSON.stringify(safe).includes(untrustedReason));
+  }
+});