frankbria
diff --git a/‎codeframe/cli/pr_commands.py‎
Lines changed: 15 additions & 9 deletions b/‎codeframe/cli/pr_commands.py‎
Lines changed: 15 additions & 9 deletions
diff --git a/‎codeframe/core/proof/evidence.py‎
Lines changed: 147 additions & 5 deletions b/‎codeframe/core/proof/evidence.py‎
Lines changed: 147 additions & 5 deletions
diff --git a/‎codeframe/core/proof/ledger.py‎
Lines changed: 9 additions & 2 deletions b/‎codeframe/core/proof/ledger.py‎
Lines changed: 9 additions & 2 deletions
diff --git a/‎codeframe/core/proof/runner.py‎
Lines changed: 14 additions & 1 deletion b/‎codeframe/core/proof/runner.py‎
Lines changed: 14 additions & 1 deletion
@@ -432,8 +432,6 @@ def _check_merge_gate(
     override is pending so the caller can persist the audit record after the
     merge actually succeeds, or None when nothing was bypassed.
     """
-    from codeframe.core.proof import ledger as proof_ledger
-    from codeframe.core.proof.models import ReqStatus
     from codeframe.core.workspace import find_workspace_root, get_workspace
 
     reason = (override_reason or "").strip()
@@ -455,27 +453,35 @@ def _check_merge_gate(
         return None
 
     try:
-        open_reqs = proof_ledger.list_requirements(workspace, status=ReqStatus.OPEN)
+        # Blocking, not merely open: a requirement recorded SATISFIED whose
+        # evidence no longer verifies must stop the merge too (#952).
+        from codeframe.core.proof.evidence import list_blocking_requirements
+
+        blocking_reqs = list_blocking_requirements(workspace)
     except Exception as e:
         # Fail closed, like the API path: a broken ledger blocks the merge.
         console.print(f"[red]PROOF9 gate check failed:[/red] {e} — merge blocked")
         raise typer.Exit(1)
-    if not open_reqs:
+    if not blocking_reqs:
         return None
 
     if not override:
         console.print(
-            f"[red]PROOF9 merge gate:[/red] {len(open_reqs)} open requirement(s) block this merge:"
+            f"[red]PROOF9 merge gate:[/red] {len(blocking_reqs)} requirement(s) block this merge:"
         )
-        for r in open_reqs[:10]:
+        for r in blocking_reqs[:10]:
             console.print(f"  - {r.id}: {r.title}")
-        console.print('Satisfy or waive them, or pass --override --reason "...".')
+        console.print(
+            "Each is either unproven, or recorded satisfied with evidence that "
+            "no longer matches its checksum."
+        )
+        console.print('Satisfy, waive or re-prove them, or pass --override --reason "...".')
         raise typer.Exit(1)
 
     console.print(
-        f"[yellow]PROOF9 merge gate overridden[/yellow] ({len(open_reqs)} open requirement(s) bypassed — audited)"
+        f"[yellow]PROOF9 merge gate overridden[/yellow] ({len(blocking_reqs)} requirement(s) bypassed — audited)"
     )
-    return workspace, [{"id": r.id, "title": r.title} for r in open_reqs]
+    return workspace, [{"id": r.id, "title": r.title} for r in blocking_reqs]
 
 
 @pr_app.command("merge")
 
@@ -5,16 +5,32 @@
 """
 
 import hashlib
+import logging
 from datetime import datetime, timezone
 from pathlib import Path
 
 from codeframe.core.proof import ledger
 from codeframe.core.proof.models import Evidence, Gate, GateOutcome, Requirement
 from codeframe.core.workspace import Workspace
 
+logger = logging.getLogger(__name__)
+
+
+class EvidenceTamperError(Exception):
+    """A stored artifact no longer matches the checksum recorded with it.
+
+    A hard state, never a warning: the whole point of the ledger is that a
+    recorded pass is attributable. Raised on a mutated artifact, a missing one,
+    and on one transplanted from a different run or gate.
+    """
+
 
 def _sha256(file_path: str) -> str:
-    """Compute SHA-256 checksum of a file. Raises if file missing."""
+    """Compute SHA-256 checksum of a file's bytes. Raises if file missing.
+
+    The pre-#952 digest. Kept because evidence written before that change is
+    stored in this form — see ``verify_evidence``.
+    """
     path = Path(file_path)
     if not path.exists():
         raise FileNotFoundError(f"Artifact not found: {file_path}")
@@ -23,6 +39,70 @@ def _sha256(file_path: str) -> str:
     return h.hexdigest()
 
 
+def _bound_digest(run_id: str, gate: Gate, artifact_path: str) -> str:
+    """Checksum binding the artifact's bytes to *where it came from* (#952).
+
+    Hashing bytes alone proves only that a file is unmodified — it says nothing
+    about which run produced it, so a genuinely passing artifact could be
+    transplanted into another run's evidence and still verify. The digest
+    therefore covers a canonical header (run id, gate, resolved path) as well
+    as the content.
+
+    The header is length-prefixed so no two different tuples can produce the
+    same byte stream (``run="a|b", gate="c"`` vs ``run="a", gate="b|c"``).
+    """
+    path = Path(artifact_path)
+    if not path.exists():
+        raise FileNotFoundError(f"Artifact not found: {artifact_path}")
+    h = hashlib.sha256()
+    for part in ("codeframe-proof-evidence-v1", run_id, gate.value, str(path.resolve())):
+        raw = part.encode("utf-8")
+        h.update(len(raw).to_bytes(4, "big"))
+        h.update(raw)
+    h.update(path.read_bytes())
+    return h.hexdigest()
+
+
+def verify_evidence(evidence: Evidence) -> None:
+    """Re-derive an artifact's checksum and raise if it does not match.
+
+    Checksums were computed and stored but never checked on read, so the
+    integrity claim was unenforced (#952). This is the check.
+
+    Accepts the legacy bytes-only digest as well as the bound one, so evidence
+    recorded before #952 does not all become 'tampered' at once. Legacy rows
+    still detect modification of the artifact; they just cannot detect a
+    transplant. New evidence is always written in the bound form, so the
+    legacy path drains as runs happen.
+    """
+    try:
+        if _bound_digest(evidence.run_id, evidence.gate, evidence.artifact_path) == evidence.artifact_checksum:
+            return
+        if _sha256(evidence.artifact_path) == evidence.artifact_checksum:
+            logger.debug(
+                "Evidence for %s/%s verified via the pre-#952 bytes-only digest",
+                evidence.req_id, evidence.gate.value,
+            )
+            return
+    # OSError, not just FileNotFoundError: an artifact replaced by a directory
+    # or made unreadable still exists, so read_bytes raises IsADirectoryError /
+    # PermissionError instead. Those escaped, 500ing the evidence endpoints and
+    # taking down the merge gate before it could block the specific requirement
+    # or honor an override (codex review on #1080). An artifact we cannot read
+    # is an artifact we cannot verify, which is the tamper state.
+    except OSError as exc:
+        raise EvidenceTamperError(
+            f"Evidence artifact for {evidence.req_id}/{evidence.gate.value} "
+            f"cannot be read: {evidence.artifact_path} ({exc.__class__.__name__})"
+        ) from exc
+
+    raise EvidenceTamperError(
+        f"Evidence artifact for {evidence.req_id}/{evidence.gate.value} does not "
+        f"match its recorded checksum: {evidence.artifact_path} "
+        f"(run {evidence.run_id})"
+    )
+
+
 def attach_evidence(
     workspace: Workspace,
     req_id: str,
@@ -41,7 +121,7 @@ def attach_evidence(
         gate=gate,
         satisfied=(outcome == GateOutcome.PASSED),
         artifact_path=artifact_path,
-        artifact_checksum=_sha256(artifact_path),
+        artifact_checksum=_bound_digest(run_id, gate, artifact_path),
         timestamp=datetime.now(timezone.utc),
         run_id=run_id,
         status=outcome.value,
@@ -53,9 +133,71 @@ def attach_evidence(
 def check_obligation_satisfied(
     workspace: Workspace, req: Requirement, gate: Gate
 ) -> bool:
-    """Check if a gate obligation has passing evidence."""
+    """Check if a gate obligation has passing evidence.
+
+    Evidence whose artifact no longer matches its checksum does not count. The
+    verification has to happen here, before a gate accepts the artifact, or the
+    stored checksum buys nothing (#952). A tampered record is skipped and
+    logged rather than raised: one corrupted artifact must not take down the
+    whole proof run, and the obligation correctly reports unsatisfied.
+    """
     evidence_list = ledger.list_evidence(workspace, req.id)
     for ev in evidence_list:
-        if ev.gate == gate and ev.satisfied:
-            return True
+        if ev.gate != gate or not ev.satisfied:
+            continue
+        try:
+            verify_evidence(ev)
+        except EvidenceTamperError as exc:
+            logger.warning("Rejecting evidence for %s: %s", req.id, exc)
+            continue
+        return True
     return False
+
+
+def list_blocking_requirements(workspace: Workspace) -> list[Requirement]:
+    """Requirements that must stop a merge (#731 gate, #952 verification).
+
+    Two reasons a requirement blocks:
+
+    * It is still OPEN — never proven.
+    * It is recorded SATISFIED but its evidence no longer verifies. Checksum
+      verification is worthless if the only path that runs it is a fresh proof
+      run: a requirement marked satisfied yesterday keeps that status forever,
+      so editing its artifact afterwards left the merge gate waving the change
+      through (codex review on #952).
+
+    Only the **latest** passing evidence per gate is checked, not every row
+    ever recorded. Runs accumulate evidence, and deleting last month's
+    artifacts is routine housekeeping — blocking on any historical row would
+    make that cleanup wedge the gate permanently, which is a worse failure than
+    the hole this closes (codex review). Each gate is judged separately, so a
+    stale-but-intact UNIT artifact cannot mask a tampered SEC one.
+
+    A SATISFIED requirement with *no* evidence rows does not block. That is a
+    pre-existing state in older ledgers, not a tamper signal, and treating it
+    as one would wedge every workspace that has it. Only evidence that is
+    present and fails to verify counts.
+    """
+    from codeframe.core.proof.models import ReqStatus
+
+    blocking = list(ledger.list_requirements(workspace, status=ReqStatus.OPEN))
+
+    for req in ledger.list_requirements(workspace, status=ReqStatus.SATISFIED):
+        # list_evidence returns newest first, so the first passing row for a
+        # gate is that gate's current proof.
+        latest: dict[Gate, Evidence] = {}
+        for ev in ledger.list_evidence(workspace, req.id):
+            if ev.satisfied:
+                latest.setdefault(ev.gate, ev)
+
+        for ev in latest.values():
+            try:
+                verify_evidence(ev)
+            except EvidenceTamperError as exc:
+                logger.warning(
+                    "Requirement %s blocks the merge gate: %s", req.id, exc
+                )
+                blocking.append(req)
+                break
+
+    return blocking
@@ -703,7 +703,9 @@ def get_run_evidence(workspace: Workspace, run_id: str) -> list[Evidence]:
 def check_expired_waivers(workspace: Workspace) -> list[Requirement]:
     """Find and revert expired waivers to open status."""
     _ensure_tables(workspace)
-    today = date.today().isoformat()
+    # UTC, not the machine's local date: the ledger's timestamps are UTC, so a
+    # local date makes expiry depend on the operator's timezone (#952).
+    today = datetime.now(timezone.utc).date()
     conn = get_db_connection(workspace)
     cursor = conn.cursor()
 
@@ -720,7 +722,12 @@ def check_expired_waivers(workspace: Workspace) -> list[Requirement]:
 
     for row in rows:
         req = _row_to_requirement(row)
-        if req.waiver and req.waiver.expires and req.waiver.expires.isoformat() <= today:
+        # `<` not `<=`: the expiry date is the waiver's LAST VALID day, so a
+        # waiver expiring today must survive today. `<=` expired it a day early
+        # and spuriously blocked the #731 merge gate (#952). Compared as dates,
+        # not isoformat strings, so the comparison cannot silently go
+        # lexicographic on a malformed value.
+        if req.waiver and req.waiver.expires and req.waiver.expires < today:
             cursor.execute(
                 "UPDATE proof_requirements SET status = 'open', waiver = NULL WHERE id = ?",
                 (req.id,),
 
@@ -27,6 +27,19 @@
 logger = logging.getLogger(__name__)
 
 
+def _new_run_id() -> str:
+    """A fresh proof-run identifier.
+
+    A full UUID, never a truncated one. ``str(uuid4())[:8]`` gives 32 bits, so
+    two runs in a workspace collide around 600 runs by the birthday bound — and
+    a collision merges evidence across runs, letting a passing run absorb a
+    failing run's artifacts (#952). Callers that need the id before the run
+    starts (the v2 router, so its response matches the evidence rows) use this
+    too, so there is one definition.
+    """
+    return str(uuid.uuid4())
+
+
 def _load_proof_config(workspace: Workspace) -> tuple[Optional[set[Gate]], str]:
     """Load (enabled_gates, strictness) from .codeframe/proof_config.json.
 
@@ -270,7 +283,7 @@ def run_proof(
         Dict mapping req_id → list of (Gate, GateOutcome) tuples
     """
     if not run_id:
-        run_id = str(uuid.uuid4())[:8]
+        run_id = _new_run_id()
 
     started_at = datetime.now(timezone.utc)