[kikashy]

Closes #133.

What it adds

• Forged-label bypass (HIGH): TypeScript and Go store guards exempt only exact labels they emitted. Handwritten vectors and record/model-answer tests cover forged labels, patterns spanning them, and the compaction-to-checkpoint path. The new forged-label mutant and its Go twin are caught.
• Fallback settings and ledger: Replacement requests use the selected connection's model and tier mapping, including Gemini's model path and thinking budget; usage names the requested model. Tests cover every TypeScript engine and both Go adapters, including resume. The existing prompt-digest mutant is caught.
• Compaction resume bytes: Summaries are guarded before projection and hashing; refused summaries use the deterministic index. Both languages compare stored summaries, digests and resumed request bytes across redaction. The existing compaction-fallback mutant is caught.
• Refusal usage: Output refusal emits exactly one closed usage event before end, consistent with its checkpoint. Tests cover every TypeScript engine and the Go boundary, including oversized input. The new terminal-usage mutant and its Go twin are caught.
• Recorded agent replay: Recordings retain ordered agent events and tool callbacks. Real Codex and Go agent adapter record→store→replay tests complete without drift, and both readers consume the handwritten callback fixture. The existing corpus engine-bypass mutant is caught. Public surface: agent response bodies now carry ordered steps; Go exposes capture/replay helpers and serializes callback members with lower-case names. Legacy events-only bodies remain readable.

Checks

== check summary (dev.json) ==
handover: boundary 4 paths, shared 5 paths; see AGENTS.md "Before you hand over"
PASS     contract                 0s
    checked 314 JSON documents
PASS     local-paths              0s
PASS     agent-docs               0s
    sync-agent-docs: CLAUDE.md matches AGENTS.md
PASS     diff-check               0s
PASS     python-tests             344s
    Ran 54 tests in 344.682s
    OK
PASS     mutation-rows            0s
    266 rows checked, 0 problems; 1 retired
PASS     build                    2s
PASS     reference                7s
    reference: 13 pages match their sources
    # pass 4
    # fail 0
PASS     unit-tests               71s
    Test Files  69 passed (69)
    Tests  2444 passed | 27 skipped (2471)
PASS     certify-vercel           30s
    certify vercel: passed, 384 of the model engine's own checks among them
PASS     certify-codex            8s
    certify codex: passed, 119 of the agent engine's own checks among them
PASS     certify-deepagents       21s
    certify deepagents: passed, 408 of the model engine's own checks among them
PASS     go-module-path           0s
PASS     gofmt                    0s
PASS     go-vet                   0s
PASS     go-test                  20s
    13 lines matched; last: ok  	github.com/Judgment-Pack/judgment-pack-agent/go/relay	0.278s
PASS     go-race                  74s
    6 lines matched; last: ok  	github.com/Judgment-Pack/judgment-pack-agent/go/adapter/wire	7.104s
PASS     harness-check            22s
    198 legs passed, 0 failed
    90 agent checks passed, 0 failed (the package's stand-in only: no host's bridge was certified)
PASS     parity                   0s
    parity: packages/harness against the Desk at d9251ec; the table was made against d9251ec
    parity: 25 moved files identical, 46 differ for the reasons named above; 113 package files are new
    parity: every difference is named
== 19 passed, 0 failed, 0 skipped, 0 not run ==

Go generation was run from go/ with go generate ./contract; git status --short -- go/contract was empty. The sandbox-incompatible go-generate comparison is left to CI.

Handover (a), (b), (d), (e), (f), (g): admission/verdict boundary paths are unchanged; no schema members or enums were added; both new mutation rows and their Go twins are caught; malformed refusal events remain schema-valid; compaction checkpoint/resume bytes agree; the ADR wording was checked against the implementation. Shared vectors pass in both languages. The shared-path list is unchanged.

Not in this PR

The coordinator's LOW release-note corrections, version/tag changes, and release approval are not included. Adapter checks use scripted transports; no live provider bridge was certified.

Material-decision impact: security-boundary (the store-side guard's exemption); the release reviewer re-reads the head.

A Codex session wrote the change.

[github-actions]

🎉 Thank you for your contribution to Judgment Pack!

If you’d like another task, choose a path that interests you:

• Go runtime
• Judgment desk
• Gateway and provenance
• Python and evaluator experiments
• Specification and documentation
• Agent harness and adapters