diff --git a/packages/app/src/pages/session/v2/adversarial-ui-e2e.test.ts b/packages/app/src/pages/session/v2/adversarial-ui-e2e.test.ts
new file mode 100644
index 000000000..c13ac92ba
--- /dev/null
+++ b/packages/app/src/pages/session/v2/adversarial-ui-e2e.test.ts
@@ -0,0 +1,135 @@
+import { describe, expect, test } from "bun:test"
+import { ProvenanceMatrix } from "@opencode-ai/schema/provenance-matrix"
+import {
+  applyLedgerKeyDown,
+  buildLedgerView,
+  describeLedgerStatus,
+  LEDGER_CAPABILITY_LABELS,
+  ledgerCapabilityLabel,
+  type LedgerStatusInput,
+  type LedgerStatusKind,
+} from "./lineage-ledger-view"
+
+/**
+ * The ui harness of the adversarial full-provenance matrix (amicode#1084).
+ *
+ * This cross-harness E2E fixture RUNS the ui-owned matrix rows against the REAL
+ * unified lineage-ledger view-model (#1082) — the same pure reducer + status
+ * descriptors the Files Changed surface renders — and records each row that
+ * produced its declared observable result as green. It proves the unified surface
+ * is operable by keyboard and legible in BOTH supported themes (its distinctions
+ * are text + icon, never color), then feeds the green set to the shared gate
+ * (`ProvenanceMatrix.gate`) exactly as the engine harness does.
+ */
+
+const green = new Set<string>()
+const ui = ProvenanceMatrix.subset("ui")
+
+// ── AC7a: keyboard operation ─────────────────────────────────────────────────
+
+function keyEvent(key: string) {
+  let prevented = false
+  return { event: { key, preventDefault: () => (prevented = true) }, prevented: () => prevented }
+}
+
+function runKeyboard(): void {
+  // Enter and Space on a focused row toggle it and prevent default (no page scroll).
+  for (const key of ["Enter", " "]) {
+    const e = keyEvent(key)
+    expect(applyLedgerKeyDown(e.event, { focusKind: "row", id: "res-1", expanded: false })).toEqual({
+      type: "toggle",
+      id: "res-1",
+    })
+    expect(e.prevented()).toBe(true)
+  }
+  // Escape inside expanded content collapses and returns focus to the row.
+  expect(applyLedgerKeyDown(keyEvent("Escape").event, { focusKind: "content", id: "res-1", expanded: true })).toEqual({
+    type: "collapse",
+    id: "res-1",
+    refocus: "res-1",
+  })
+  // Escape on an expanded row collapses it.
+  expect(applyLedgerKeyDown(keyEvent("Escape").event, { focusKind: "row", id: "res-1", expanded: true })).toEqual({
+    type: "collapse",
+    id: "res-1",
+    refocus: "res-1",
+  })
+  // Unrelated keys and collapsed-row escape are no-ops — the surface never traps the keyboard.
+  expect(applyLedgerKeyDown(keyEvent("a").event, { focusKind: "row", id: "res-1", expanded: false })).toEqual({
+    type: "none",
+  })
+  expect(applyLedgerKeyDown(keyEvent("Escape").event, { focusKind: "row", id: "res-1", expanded: false })).toEqual({
+    type: "none",
+  })
+}
+
+// ── AC7b: legibility across both supported themes (text + icon, never color) ──
+
+const STATUS_CASES: Array<{ input: LedgerStatusInput; kind: LedgerStatusKind }> = [
+  { input: { netState: "added", outcome: "succeeded" }, kind: "added" },
+  { input: { netState: "modified", outcome: "succeeded" }, kind: "modified" },
+  { input: { netState: "deleted", outcome: "succeeded" }, kind: "deleted" },
+  { input: { netState: "reverted", outcome: "succeeded" }, kind: "reverted" },
+  { input: { netState: "conflicted", outcome: "succeeded" }, kind: "conflicted" },
+  { input: { netState: "unavailable", outcome: "succeeded", evidenceState: "unavailable" }, kind: "unavailable" },
+  { input: { outcome: "opaque", netState: "opaque" }, kind: "opaque" },
+  { input: { outcome: "partial", netState: "added" }, kind: "partial" },
+]
+
+function runThemes(): void {
+  const descriptors = STATUS_CASES.map((c) => describeLedgerStatus(c.input))
+  // Each named state resolves to its kind.
+  for (const [index, c] of STATUS_CASES.entries()) expect(descriptors[index].kind).toBe(c.kind)
+  // Distinctions are TEXT + ICON — unique per state — so the surface is legible without relying on color.
+  expect(new Set(descriptors.map((d) => d.label)).size).toBe(STATUS_CASES.length)
+  expect(new Set(descriptors.map((d) => d.icon)).size).toBe(STATUS_CASES.length)
+  for (const d of descriptors) {
+    expect(d.label.length).toBeGreaterThan(0)
+    expect(d.icon.length).toBeGreaterThan(0)
+    // Tone is a semantic keyword, never a raw color literal — so no theme owns the meaning.
+    expect(["success", "danger", "warning", "neutral"]).toContain(d.tone)
+    expect(d.tone).not.toMatch(/#|rgb|hsl/i)
+  }
+  // Theme-independent by construction: the descriptor carries no theme branch or inline color.
+  expect(describeLedgerStatus({ netState: "deleted", outcome: "succeeded" })).toEqual(
+    describeLedgerStatus({ netState: "deleted", outcome: "succeeded" }),
+  )
+  // Screen-reader legibility (theme-agnostic): the accessible name carries execution + assessment + evidence.
+  const accessible = describeLedgerStatus({ outcome: "succeeded", netState: "added", evidenceState: "available" }).accessibleName.toLowerCase()
+  for (const token of ["succeeded", "added", "available"]) expect(accessible).toContain(token)
+  // The capability label is fixed explanatory text selected only by capability — surfaced on the built view.
+  for (const mode of ["full", "partial", "legacy"] as const)
+    expect(ledgerCapabilityLabel(mode)).toEqual(LEDGER_CAPABILITY_LABELS[mode])
+  expect(buildLedgerView({ capability: { mode: "legacy" }, records: [] }).capability).toEqual(
+    LEDGER_CAPABILITY_LABELS.legacy,
+  )
+}
+
+// ── Register the ui per-row tests ────────────────────────────────────────────
+
+describe("adversarial matrix — ui harness (unified Files Changed surface)", () => {
+  for (const row of ui.cases) {
+    test(row.id, () => {
+      if (row.id === "a11y:keyboard") runKeyboard()
+      else if (row.id === "a11y:themes") runThemes()
+      else throw new Error(`no ui executor for row ${row.id}`)
+      green.add(row.id)
+    })
+  }
+})
+
+describe("adversarial matrix — the ui-subset release gate (AC8)", () => {
+  test("every required ui case ran green — all_required_passed, enablement STILL off", () => {
+    const result = ProvenanceMatrix.gate(ui, green)
+    expect(result.missingRequired).toEqual([])
+    expect(result.all_required_passed).toBe(true)
+    expect(result.defaultEnablement).toBe("off")
+  })
+
+  test("dropping any one required ui case blocks the gate", () => {
+    const dropped = ProvenanceMatrix.requiredCaseIDs(ui)[0]
+    const minusOne = new Set(green)
+    minusOne.delete(dropped)
+    expect(ProvenanceMatrix.gate(ui, minusOne).all_required_passed).toBe(false)
+  })
+})
diff --git a/packages/opencode/test/session/adversarial-e2e.test.ts b/packages/opencode/test/session/adversarial-e2e.test.ts
new file mode 100644
index 000000000..67be3e649
--- /dev/null
+++ b/packages/opencode/test/session/adversarial-e2e.test.ts
@@ -0,0 +1,902 @@
+import { describe, expect, test } from "bun:test"
+import fs from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { Effect, Layer } from "effect"
+import { eq } from "drizzle-orm"
+import { Database } from "@opencode-ai/core/database/database"
+import { SessionLineageTable } from "@opencode-ai/core/session/sql"
+import { AppNodeBuilder } from "@opencode-ai/core/effect/app-node-builder"
+import { LayerNode } from "@opencode-ai/core/effect/layer-node"
+import { SessionProjector } from "@opencode-ai/core/session/projector"
+import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner"
+import { ProvenanceMatrix } from "@opencode-ai/schema/provenance-matrix"
+import { SessionMutation } from "@/session/mutation"
+import { SessionReceipt } from "@/session/receipt"
+import { SessionEvidence } from "@/session/evidence"
+import { SessionReceiptPrivacy } from "@/session/receipt-privacy"
+import { SessionRollout } from "@/session/rollout"
+import { ExternalDiff } from "@/session/external-diff"
+import { Session as SessionNs } from "@/session/session"
+import { EventV2Bridge } from "@/event-v2-bridge"
+import { InstanceStore } from "@/project/instance-store"
+import { InstanceBootstrap } from "@/project/bootstrap"
+import { RuntimeFlags } from "@/effect/runtime-flags"
+import { testEffect } from "../lib/effect"
+
+/**
+ * The engine harness of the adversarial full-provenance matrix (amicode#1084).
+ *
+ * This cross-harness E2E fixture RUNS every engine-owned matrix row against the
+ * REAL merged contracts — the mutation gate + identity (#1077), lineage (#1075),
+ * receipt/evidence/budget storage (#1088/#1090/#1103/#1104), the privacy
+ * serializers (#1078), the external-diff boundary, and the rollout resolver
+ * (#1083) — and records each row that produced its declared observable result as
+ * green. The final gate assertion feeds the green set to `ProvenanceMatrix.gate`
+ * and proves `all_required_passed` is true only when every required engine case is
+ * green (product-denied outcomes are asserted expected results, not failures), and
+ * composes with the #1083 `SessionRollout.Release` readiness evaluator.
+ *
+ * Isolation: every mutated file lives in an isolated `mkdtemp` root that is removed
+ * with a containment assertion; receipt/evidence/external-diff storage and the
+ * database are sandboxed by test/preload.ts (temp XDG_DATA_HOME + in-memory SQLite).
+ * No case touches a real user directory.
+ */
+
+// Case IDs that ran green, collected across every per-row test below. The final
+// gate test consumes this set — a row whose assertions throw never lands here.
+const green = new Set<string>()
+
+const engine = ProvenanceMatrix.subset("engine")
+const isDBRow = (row: ProvenanceMatrix.Row) =>
+  (row.dimension === "outcome" && (row.expectedOutcome === "aborted" || row.expectedOutcome === "unavailable")) ||
+  (row.dimension === "version" && row.concern !== "mixed_binaries" && row.concern !== "rollback") ||
+  (row.dimension === "concurrency" && row.id === "concurrency:non-attribution")
+
+// ── In-memory mutation-gate helpers (pure boundaries) ────────────────────────
+
+const SESSION = "ses_1084_root"
+const ROOT = "ses_1084_root"
+const makeGate = (now = 1_000) =>
+  SessionMutation.create({
+    rootForSession: (s) => (s === SESSION ? ROOT : undefined),
+    now: () => now,
+    operations: SessionMutation.OperationStore.memory(),
+  })
+
+type Endpoint = { value: string; kind: "file" | "directory" }
+const fileEndpoint = (value: string): Endpoint => ({ value, kind: "file" })
+
+const declaredResource = (id: string, value: string): SessionMutation.DeclaredResource => ({
+  id,
+  endpoint: fileEndpoint(value),
+  operation: "write",
+  role: "target",
+})
+
+// ── Origin dimension (AC1): agent/child-agent/user/system/opaque × modes ─────
+
+const hostReceiptWithOrigin = (origin: string): SessionReceiptPrivacy.HostReceipt => ({
+  operation: { id: "op-priv", rootID: "root-priv", sessionID: "ses-priv", origin, state: "committed" },
+  receipt: { id: "r1", sequence: 1, resource: "src/a.ts", operation: "write", outcome: "applied", timeCreated: 1 },
+  assessment: {
+    id: "assess-priv",
+    receiptID: "r1",
+    confidence: "observed",
+    netState: "modified",
+    evidenceState: "available",
+    revision: 1,
+    timeCreated: 2,
+  },
+})
+
+function runOrigin(row: ProvenanceMatrix.Row): void {
+  const origin = row.origin!
+  if (origin === "opaque") {
+    const gate = makeGate()
+    const ctx = gate.issue({
+      routeID: "shell-action",
+      kind: "opaque",
+      panelID: "p",
+      sessionID: SESSION,
+      rootID: ROOT,
+      origin: "opaque",
+      operation: "shell",
+      expiresAt: 5_000,
+    })!
+    expect(ctx).toBeDefined()
+    const result = gate.executeOpaque({
+      context: ctx,
+      request: {
+        routeID: "shell-action",
+        panelID: "p",
+        sessionID: SESSION,
+        rootID: ROOT,
+        origin: "opaque",
+        operation: "shell",
+        operationID: `op-opaque-${row.requiredMode}`,
+      },
+    })
+    expect(result.kind).toBe("executed")
+    if (result.kind !== "executed") return
+    expect(result.result.outcome).toBe("unknown")
+    expect((result.result as SessionMutation.OpaqueResult).receipt.origin).toBe("opaque")
+    return
+  }
+
+  if (row.requiredMode === "legacy") {
+    const legacy = { version: 1, note: "pre-ledger" }
+    const out = SessionReceiptPrivacy.display({ legacy, receipt: hostReceiptWithOrigin(origin) }, { mode: "legacy" })
+    // Legacy mode retains the pre-ledger payload — never a full-provenance claim.
+    expect(out).toBe(legacy)
+    return
+  }
+
+  // full / partial: the capability-selected projection carries the origin, attributed to the active root.
+  const projection = SessionReceiptPrivacy.display(
+    { legacy: { version: 1 }, receipt: hostReceiptWithOrigin(origin) },
+    { mode: "full", version: 1 },
+  )
+  expect(projection).toEqual(SessionReceiptPrivacy.project(hostReceiptWithOrigin(origin), "files_changed"))
+  expect((projection as SessionReceiptPrivacy.Projection).operation?.origin).toBe(origin)
+}
+
+// ── Resource dimension (AC2): every filesystem resource class ────────────────
+
+function withTmp(fn: (dir: string) => void): void {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "amc1084-res-"))
+  try {
+    fn(dir)
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true })
+    // Containment: the isolated fixture is gone; nothing escaped it.
+    expect(fs.existsSync(dir)).toBe(false)
+  }
+}
+
+const identity = (target: string, kind: "file" | "directory") => SessionMutation.ResourceIdentity.resolve(target, kind)
+
+function runExternalDiff(sessionID: string, git: boolean): void {
+  withTmp((dir) => {
+    if (git) Bun.spawnSync(["git", "init", "-q", dir])
+    const file = path.join(dir, "external.txt")
+    fs.writeFileSync(file, "baseline\n")
+    const reservation = ExternalDiff.prepare({ sessionID, files: [file] })
+    expect(reservation).toBeDefined()
+    fs.writeFileSync(file, "changed\n")
+    expect(ExternalDiff.commit({ sessionID, reservation: reservation! })).toBe(true)
+
+    const canonical = path.resolve(file)
+    const assessment = ExternalDiff.assessed(sessionID).assessments.find((a) => a.file === canonical)
+    expect(assessment?.state).toBe("changed")
+    // The generated patch never crosses this boundary by default — host-local only.
+    expect(assessment).not.toHaveProperty("patch")
+    const detail = ExternalDiff.assessed(sessionID, { patch: true }).assessments.find((a) => a.file === canonical)
+    expect(typeof (detail as { patch?: string }).patch).toBe("string")
+    ExternalDiff.remove(sessionID)
+  })
+}
+
+function runResource(row: ProvenanceMatrix.Row): void {
+  switch (row.resourceClass) {
+    case "workspace":
+      return withTmp((dir) => {
+        const file = path.join(dir, "w.ts")
+        fs.writeFileSync(file, "x")
+        const id = identity(file, "file")
+        expect(id?.value.startsWith("local:existing:")).toBe(true)
+        expect(identity(file, "file")!.value).toBe(id!.value)
+      })
+    case "symlink":
+      return withTmp((dir) => {
+        const target = path.join(dir, "t.ts")
+        fs.writeFileSync(target, "x")
+        const link = path.join(dir, "l.ts")
+        fs.symlinkSync(target, link)
+        // A symlink binds the SAME physical identity as its target — the path is discarded.
+        expect(identity(link, "file")!.value).toBe(identity(target, "file")!.value)
+      })
+    case "alias":
+      return withTmp((dir) => {
+        const target = path.join(dir, "t.ts")
+        fs.writeFileSync(target, "x")
+        const hard = path.join(dir, "h.ts")
+        fs.linkSync(target, hard)
+        expect(identity(hard, "file")!.value).toBe(identity(target, "file")!.value)
+      })
+    case "directory":
+      return withTmp((dir) => {
+        const sub = path.join(dir, "sub")
+        fs.mkdirSync(sub)
+        expect(identity(sub, "directory")?.kind).toBe("directory")
+        expect(identity(sub, "file")).toBeUndefined()
+      })
+    case "binary":
+      return withTmp((dir) => {
+        const file = path.join(dir, "b.bin")
+        fs.writeFileSync(file, Buffer.from([0, 1, 2, 255, 254, 0, 3]))
+        // Identity is by physical inode, content-agnostic — the bytes never enter it.
+        expect(identity(file, "file")?.value.startsWith("local:existing:")).toBe(true)
+      })
+    case "trash":
+      return withTmp((dir) => {
+        const file = path.join(dir, "f.ts")
+        fs.writeFileSync(file, "x")
+        expect(identity(file, "file")!.value.startsWith("local:existing:")).toBe(true)
+        const trash = path.join(dir, "Trash")
+        fs.mkdirSync(trash)
+        fs.renameSync(file, path.join(trash, "f.ts"))
+        // The original path is now missing — the delete is captured as an identity change.
+        expect(identity(file, "file")!.value.startsWith("local:missing:")).toBe(true)
+      })
+    case "restore":
+      return withTmp((dir) => {
+        const file = path.join(dir, "f.ts")
+        expect(identity(file, "file")!.value.startsWith("local:missing:")).toBe(true)
+        fs.writeFileSync(file, "x")
+        expect(identity(file, "file")!.value.startsWith("local:existing:")).toBe(true)
+      })
+    case "internal": {
+      // An internal (out-of-scope) store is never a ledger route → no context is issued.
+      expect(SessionMutation.Registry.require("credential-store")?.kind).toBe("out_of_scope")
+      const gate = makeGate()
+      const ctx = gate.issue({
+        routeID: "credential-store",
+        kind: "local",
+        panelID: "p",
+        sessionID: SESSION,
+        rootID: ROOT,
+        origin: "system",
+        operation: "write",
+        source: fileEndpoint("local:existing:1:1"),
+        expiresAt: 5_000,
+      })
+      expect(ctx).toBeUndefined()
+      return
+    }
+    case "unsupported_provider": {
+      const gate = makeGate()
+      const source = fileEndpoint("local:existing:1:1")
+      const ctx = gate.issue({
+        routeID: "local-file-write",
+        kind: "local",
+        panelID: "p",
+        sessionID: SESSION,
+        rootID: ROOT,
+        origin: "agent",
+        operation: "write",
+        source,
+        expiresAt: 5_000,
+      })!
+      const result = gate.executeLocal({
+        context: ctx,
+        request: {
+          routeID: "local-file-write",
+          panelID: "p",
+          sessionID: SESSION,
+          rootID: ROOT,
+          origin: "agent",
+          operation: "write",
+          operationID: "op-unsafe",
+          source,
+        },
+        provider: {
+          capabilities: { safeResolve: false, noFollowWrite: false },
+          safeResolve: (e) => e,
+          noFollowWrite: () => ({ groupID: "g", outcome: "applied" }),
+        },
+      })
+      // A provider lacking the safe-resolve / no-follow-write capability is DENIED (expected product-denial).
+      expect(result.kind).toBe("denied")
+      if (result.kind === "denied") expect(result.reason).toBe("unsafe_provider")
+      return
+    }
+    case "non_git_external":
+      return runExternalDiff("ext_non_git_1084", false)
+    case "external_repo":
+      return runExternalDiff("ext_repo_1084", true)
+    case "artifact":
+      return runExternalDiff("ext_artifact_1084", false)
+    default:
+      throw new Error(`unhandled resource class: ${row.resourceClass}`)
+  }
+}
+
+// ── Outcome dimension (AC3): pure gate outcomes ──────────────────────────────
+
+function runGateOutcome(outcome: ProvenanceMatrix.Outcome): void {
+  const source = fileEndpoint("local:existing:9:900")
+  const localRequest = {
+    routeID: "local-file-write" as const,
+    panelID: "p",
+    sessionID: SESSION,
+    rootID: ROOT,
+    origin: "agent",
+    operation: "write",
+  }
+  switch (outcome) {
+    case "success": {
+      const gate = makeGate()
+      const ctx = gate.issue({ ...localRequest, kind: "local", source, expiresAt: 5_000 })!
+      const result = gate.executeLocal({
+        context: ctx,
+        request: { ...localRequest, operationID: "op-ok", source },
+        provider: {
+          capabilities: { safeResolve: true, noFollowWrite: true },
+          safeResolve: (e) => e,
+          noFollowWrite: () => ({ groupID: "op-ok", outcome: "applied" }),
+        },
+      })
+      expect(result.kind).toBe("executed")
+      if (result.kind === "executed") expect(result.result.outcome).toBe("applied")
+      return
+    }
+    case "denied": {
+      const gate = makeGate()
+      const result = gate.executeLocal({
+        request: { ...localRequest, operationID: "op-denied", source },
+        provider: {
+          capabilities: { safeResolve: true, noFollowWrite: true },
+          safeResolve: (e) => e,
+          noFollowWrite: () => ({ groupID: "op-denied", outcome: "applied" }),
+        },
+      })
+      expect(result.kind).toBe("denied")
+      if (result.kind === "denied") expect(result.reason).toBe("missing_context")
+      return
+    }
+    case "expiry": {
+      const gate = makeGate(1_000)
+      const ctx = gate.issue({ ...localRequest, kind: "local", source, expiresAt: 1_000 })!
+      const result = gate.executeLocal({
+        context: ctx,
+        request: { ...localRequest, operationID: "op-exp", source },
+        provider: {
+          capabilities: { safeResolve: true, noFollowWrite: true },
+          safeResolve: (e) => e,
+          noFollowWrite: () => ({ groupID: "op-exp", outcome: "applied" }),
+        },
+      })
+      expect(result.kind).toBe("denied")
+      if (result.kind === "denied") expect(result.reason).toBe("expired_context")
+      return
+    }
+    case "conflict": {
+      const gate = makeGate()
+      const ctx = gate.issue({ ...localRequest, kind: "local", source, expiresAt: 5_000 })!
+      const result = gate.executeLocal({
+        context: ctx,
+        request: { ...localRequest, operationID: "op-conflict", source },
+        provider: {
+          capabilities: { safeResolve: true, noFollowWrite: true },
+          // The source resolved to a DIFFERENT physical identity between issue and execute — a conflict.
+          safeResolve: () => fileEndpoint("local:existing:9:999"),
+          noFollowWrite: () => ({ groupID: "op-conflict", outcome: "applied" }),
+        },
+      })
+      expect(result.kind).toBe("denied")
+      if (result.kind === "denied") expect(result.reason).toBe("identity_changed")
+      return
+    }
+    case "opaque": {
+      const gate = makeGate()
+      const ctx = gate.issue({
+        routeID: "shell-action",
+        kind: "opaque",
+        panelID: "p",
+        sessionID: SESSION,
+        rootID: ROOT,
+        origin: "agent",
+        operation: "shell",
+        expiresAt: 5_000,
+      })!
+      const result = gate.executeOpaque({
+        context: ctx,
+        request: {
+          routeID: "shell-action",
+          panelID: "p",
+          sessionID: SESSION,
+          rootID: ROOT,
+          origin: "agent",
+          operation: "shell",
+          operationID: "op-opaque-outcome",
+        },
+      })
+      expect(result.kind).toBe("executed")
+      if (result.kind === "executed") expect(result.result.outcome).toBe("unknown")
+      return
+    }
+    case "failed": {
+      const gate = makeGate()
+      const resources = [declaredResource("r1", "local:existing:1:1")]
+      const groupRequest = {
+        routeID: "tool-write" as const,
+        panelID: "p",
+        sessionID: SESSION,
+        rootID: ROOT,
+        origin: "agent",
+        operation: "write",
+        resources,
+      }
+      const ctx = gate.issueGroup({ ...groupRequest, expiresAt: 5_000 })!
+      const result = gate.executeGroup({
+        context: ctx,
+        request: { ...groupRequest, operationID: "op-failed" },
+        provider: {
+          capabilities: { safeResolve: true, noFollowWrite: true },
+          // A resource's identity no longer resolves to what was reserved → the group fails, nothing started.
+          safeResolve: (e) => ({ value: `${e.value}X`, kind: e.kind }),
+          execute: () => "applied",
+        },
+      })
+      expect(result.kind).toBe("executed")
+      if (result.kind === "executed") {
+        expect(result.result.outcome).toBe("failed")
+        expect(result.result.receipts.every((r) => r.outcome === "not_started")).toBe(true)
+      }
+      return
+    }
+    case "partial": {
+      const gate = makeGate()
+      const resources = [
+        declaredResource("r1", "local:existing:1:1"),
+        declaredResource("r2", "local:existing:1:2"),
+      ]
+      const groupRequest = {
+        routeID: "tool-write" as const,
+        panelID: "p",
+        sessionID: SESSION,
+        rootID: ROOT,
+        origin: "agent",
+        operation: "write",
+        resources,
+      }
+      const ctx = gate.issueGroup({ ...groupRequest, expiresAt: 5_000 })!
+      const result = gate.executeGroup({
+        context: ctx,
+        request: { ...groupRequest, operationID: "op-partial" },
+        provider: {
+          capabilities: { safeResolve: true, noFollowWrite: true },
+          safeResolve: (e) => e,
+          execute: (resource) => (resource.id === "r1" ? "applied" : "failed"),
+        },
+      })
+      expect(result.kind).toBe("executed")
+      if (result.kind === "executed") expect(result.result.outcome).toBe("partial")
+      return
+    }
+    case "quota": {
+      const gate = makeGate()
+      const resources = [
+        declaredResource("r1", "local:existing:1:1"),
+        declaredResource("r2", "local:existing:1:2"),
+      ]
+      const groupRequest = {
+        routeID: "tool-write" as const,
+        panelID: "p",
+        sessionID: SESSION,
+        rootID: ROOT,
+        origin: "agent",
+        operation: "write",
+        resources,
+        recursive: { maxResources: 1 },
+      }
+      const ctx = gate.issueGroup({ ...groupRequest, expiresAt: 5_000 })!
+      const result = gate.executeGroup({
+        context: ctx,
+        request: { ...groupRequest, operationID: "op-quota" },
+        provider: {
+          capabilities: { safeResolve: true, noFollowWrite: true },
+          safeResolve: (e) => e,
+          execute: () => "applied",
+        },
+      })
+      // The recursive group exceeded its resource budget → DENIED (quota).
+      expect(result.kind).toBe("denied")
+      if (result.kind === "denied") expect(result.reason).toBe("resource_budget_exceeded")
+      return
+    }
+    default:
+      throw new Error(`unhandled pure outcome: ${outcome}`)
+  }
+}
+
+// ── Privacy dimension (AC5): capability/evidence/protected metadata never egress
+
+const FIELD_SENTINEL: Partial<Record<string, string>> = {
+  "context.capability": "__CAPABILITY_1084__",
+  "evidence.content": "__EVIDENCE_BYTES_1084__",
+  "operation.id": "__OPERATION_ID_1084__",
+  "operation.rootID": "__ROOT_ID_1084__",
+  "operation.sessionID": "__SESSION_ID_1084__",
+  "assessment.id": "__ASSESSMENT_ID_1084__",
+  "context.canonicalPath": "__CANONICAL_PATH_1084__",
+  "context.rawHash": "__RAW_HASH_1084__",
+  "context.baseline": "__BASELINE_1084__",
+  "context.redactionDecision": "__REDACTION_1084__",
+}
+
+const sentinelHostReceipt = (): SessionReceiptPrivacy.HostReceipt => ({
+  operation: {
+    id: FIELD_SENTINEL["operation.id"],
+    rootID: FIELD_SENTINEL["operation.rootID"],
+    sessionID: FIELD_SENTINEL["operation.sessionID"],
+    origin: "agent",
+    state: "committed",
+  },
+  receipt: { id: "r1", sequence: 1, resource: "src/a.ts", operation: "write", outcome: "applied", timeCreated: 1 },
+  assessment: {
+    id: FIELD_SENTINEL["assessment.id"],
+    receiptID: "r1",
+    confidence: "observed",
+    netState: "modified",
+    evidenceState: "available",
+    revision: 1,
+    timeCreated: 2,
+  },
+  evidence: { receiptID: "r1", content: FIELD_SENTINEL["evidence.content"] },
+  context: {
+    capability: FIELD_SENTINEL["context.capability"],
+    canonicalPath: FIELD_SENTINEL["context.canonicalPath"],
+    rawHash: FIELD_SENTINEL["context.rawHash"],
+    baseline: FIELD_SENTINEL["context.baseline"],
+    redactionDecision: FIELD_SENTINEL["context.redactionDecision"],
+  },
+  derived: { patch: FIELD_SENTINEL["evidence.content"], additions: 1, deletions: 1 },
+})
+
+function runPrivacy(row: ProvenanceMatrix.Row): void {
+  const boundary = row.prohibitedEgress[0]!.boundary
+  const projection = SessionReceiptPrivacy.project(sentinelHostReceipt(), boundary)
+  const serialized = JSON.stringify(projection)
+  // Every field the row declares prohibited at this boundary is absent from the projection.
+  for (const prohibited of row.prohibitedEgress) {
+    const sentinel = FIELD_SENTINEL[prohibited.field]
+    if (sentinel) expect(serialized).not.toContain(sentinel)
+  }
+  // The browser boundary still surfaces the display-safe fields; other egress carries only redacted markers.
+  if (boundary === "browser") {
+    expect((projection as SessionReceiptPrivacy.Projection).receipt?.resource).toBe("src/a.ts")
+    expect((projection as SessionReceiptPrivacy.Projection).operation?.origin).toBe("agent")
+  }
+}
+
+// ── Concurrency dimension (AC4): cross-root context is denied (pure) ──────────
+
+function runCrossRootDenied(): void {
+  const store = SessionMutation.OperationStore.memory()
+  // The session maps to root A at issue time, but resolves to root B at execute time.
+  let mapped = "root-A"
+  const gate = SessionMutation.create({
+    rootForSession: () => mapped,
+    now: () => 1_000,
+    operations: store,
+  })
+  const source = fileEndpoint("local:existing:2:2")
+  const base = { routeID: "local-file-write" as const, panelID: "p", sessionID: "ses-x", origin: "agent", operation: "write" }
+  const ctx = gate.issue({ ...base, rootID: "root-A", kind: "local", source, expiresAt: 5_000 })!
+  expect(ctx).toBeDefined()
+  mapped = "root-B"
+  const result = gate.executeLocal({
+    context: ctx,
+    request: { ...base, rootID: "root-A", operationID: "op-x", source },
+    provider: {
+      capabilities: { safeResolve: true, noFollowWrite: true },
+      safeResolve: (e) => e,
+      noFollowWrite: () => ({ groupID: "op-x", outcome: "applied" }),
+    },
+  })
+  // A context is bound to one root; a session that now resolves elsewhere can never use it.
+  expect(result.kind).toBe("denied")
+  if (result.kind === "denied") expect(result.reason).toBe("invalid_context")
+}
+
+// ── Version dimension (AC6): pure rollout concerns ───────────────────────────
+
+function runRolloutConcern(concern: ProvenanceMatrix.VersionConcern): void {
+  const v = SessionRollout.PROTOCOL_VERSION
+  if (concern === "mixed_binaries") {
+    const oldEngine = SessionRollout.Matrix.resolve({
+      engine: { supported: [v], requested: v + 1 },
+      client: "new",
+      root: { mode: "full" },
+    })
+    expect(oldEngine.mode).toBe("legacy")
+    const oldClient = SessionRollout.Matrix.resolve({
+      engine: { supported: [v], requested: v },
+      client: "old",
+      root: { mode: "full" },
+    })
+    // A new engine + old client keeps its pre-ledger view — a visibly-labelled non-full claim.
+    expect(oldClient.mode).toBe("legacy")
+    expect(oldClient.label).toBe("pre_ledger")
+    return
+  }
+  // rollback: full discovery is disabled BEFORE client routes are withdrawn — no uncontextualized window.
+  expect(
+    SessionRollout.Capability.discover({ supported: [v], requested: v, root: { mode: "full" }, fullDiscoveryEnabled: false }).mode,
+  ).toBe("legacy")
+  expect(SessionRollout.Rollback.unsafe({ fullDiscovery: true, clientRoutes: false })).toBe(true)
+  for (const step of SessionRollout.Rollback.plan()) expect(SessionRollout.Rollback.unsafe(step)).toBe(false)
+}
+
+// ── Register the pure per-row tests, grouped by dimension ────────────────────
+
+const enginePure = engine.cases.filter((row) => !isDBRow(row))
+
+describe("adversarial matrix — engine harness, pure boundaries", () => {
+  for (const row of enginePure) {
+    test(row.id, () => {
+      switch (row.dimension) {
+        case "origin":
+          runOrigin(row)
+          break
+        case "resource":
+          runResource(row)
+          break
+        case "outcome":
+          runGateOutcome(row.expectedOutcome!)
+          break
+        case "privacy":
+          runPrivacy(row)
+          break
+        case "concurrency":
+          runCrossRootDenied()
+          break
+        case "version":
+          runRolloutConcern(row.concern!)
+          break
+        default:
+          throw new Error(`no pure executor for dimension ${row.dimension}`)
+      }
+      green.add(row.id)
+    })
+  }
+})
+
+// ── Register the database-backed rows via the shared session harness ─────────
+
+const it = testEffect(
+  AppNodeBuilder.build(
+    LayerNode.group([
+      SessionNs.node,
+      Database.node,
+      EventV2Bridge.node,
+      SessionProjector.node,
+      CrossSpawnSpawner.node,
+      InstanceStore.node,
+    ]),
+    [
+      [RuntimeFlags.node, RuntimeFlags.layer({ experimentalWorkspaces: false })],
+      [InstanceBootstrap.node, Layer.succeed(InstanceBootstrap.Service, InstanceBootstrap.Service.of({ run: Effect.void }))],
+    ],
+  ),
+)
+
+const budget = { maxReceipts: 4, maxMetadataBytes: 100_000 }
+
+describe("adversarial matrix — engine harness, database-backed boundaries", () => {
+  it.instance("outcome:aborted", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const database = yield* Database.Service
+      const root = yield* session.create({ title: "aborted" })
+      yield* SessionReceipt.reserve(database, {
+        id: "op-abort",
+        sessionID: root.id,
+        origin: "agent",
+        receipts: [{ id: "r-abort", resource: "file:///a", operation: "write", outcome: "applied", timeCreated: 1 }],
+        budget: { maxReceipts: 1, maxMetadataBytes: 1_000 },
+      })
+      yield* SessionReceipt.abort(database, "op-abort")
+      expect(yield* SessionReceipt.committed(database, root.id)).toEqual([])
+      yield* session.remove(root.id)
+      green.add("outcome:aborted")
+    }),
+  )
+
+  it.instance("outcome:unavailable", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const database = yield* Database.Service
+      const root = yield* session.create({ title: "unavailable" })
+      yield* SessionReceipt.publish(database, {
+        id: "op-unavail",
+        sessionID: root.id,
+        origin: "agent",
+        budget: { maxReceipts: 1, maxMetadataBytes: 1_000, maxEvidenceBytes: 1_000 },
+        receipts: [{ id: "r-unavail", resource: "file:///u", operation: "write", outcome: "applied", timeCreated: 1 }],
+        evidence: [{ receiptID: "r-unavail", content: "baseline" }],
+      })
+      SessionEvidence.removeRoot(root.id)
+      yield* SessionReceipt.assessEvidence(database, { receiptID: "r-unavail", timeCreated: 2 })
+      const assessments = yield* SessionReceipt.assessments(database, "r-unavail")
+      const latest = assessments.at(-1)!
+      expect(latest.evidenceState).toBe("unavailable")
+      expect(latest).not.toHaveProperty("patch")
+      yield* session.remove(root.id)
+      green.add("outcome:unavailable")
+    }),
+  )
+
+  it.instance("concurrency:non-attribution", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const database = yield* Database.Service
+      const [a, b] = yield* Effect.all([session.create({ title: "root-a" }), session.create({ title: "root-b" })], {
+        concurrency: "unbounded",
+      })
+      yield* Effect.all(
+        [
+          SessionReceipt.publish(database, {
+            id: "op-a",
+            sessionID: a.id,
+            origin: "agent",
+            budget,
+            receipts: [{ id: "r-a", resource: "file:///a", operation: "write", outcome: "applied", timeCreated: 1 }],
+          }),
+          SessionReceipt.publish(database, {
+            id: "op-b",
+            sessionID: b.id,
+            origin: "agent",
+            budget,
+            receipts: [{ id: "r-b", resource: "file:///b", operation: "write", outcome: "applied", timeCreated: 1 }],
+          }),
+        ],
+        { concurrency: "unbounded" },
+      )
+      const aCommitted = yield* SessionReceipt.committed(database, a.id)
+      const bCommitted = yield* SessionReceipt.committed(database, b.id)
+      // The active root sees ONLY its own receipts — the unrelated concurrent writer is never attributed to it.
+      expect(aCommitted.flatMap((o) => o.receipts.map((r) => r.id))).toEqual(["r-a"])
+      expect(bCommitted.flatMap((o) => o.receipts.map((r) => r.id))).toEqual(["r-b"])
+      expect(aCommitted.some((o) => o.rootID === b.id)).toBe(false)
+      yield* session.remove(a.id)
+      yield* session.remove(b.id)
+      green.add("concurrency:non-attribution")
+    }),
+  )
+
+  it.instance("version:task_aggregation", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const parent = yield* session.create({ title: "parent" })
+      const task = yield* session.create({ parentID: parent.id, lineageEdgeKind: "task_spawn", title: "task" })
+      const lineage = yield* session.lineage(task.id)
+      expect(lineage.rootID).toBe(parent.id)
+      expect(lineage.descendants.some((d) => d.sessionID === task.id && d.edgeKind === "task_spawn")).toBe(true)
+      green.add("version:task_aggregation")
+    }),
+  )
+
+  it.instance("version:spawn_aggregation", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const parent = yield* session.create({ title: "parent" })
+      const spawn = yield* session.create({ parentID: parent.id, title: "spawn" })
+      const lineage = yield* session.lineage(spawn.id)
+      expect(lineage.rootID).toBe(parent.id)
+      expect(lineage.descendants.some((d) => d.sessionID === spawn.id && d.edgeKind === "session_spawn")).toBe(true)
+      green.add("version:spawn_aggregation")
+    }),
+  )
+
+  it.instance("version:fork_separation", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const parent = yield* session.create({ title: "source" })
+      yield* session.create({ parentID: parent.id, title: "source child" })
+      const fork = yield* session.fork({ sessionID: parent.id })
+      const lineage = yield* session.lineage(fork.id)
+      // A fork is its own root and inherits no descendants.
+      expect(lineage.rootID).toBe(fork.id)
+      expect(lineage.descendants).toEqual([])
+      green.add("version:fork_separation")
+    }),
+  )
+
+  it.instance("version:child_archival", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const root = yield* session.create({ title: "root" })
+      const child = yield* session.create({ parentID: root.id, title: "child" })
+      yield* session.setArchived({ sessionID: child.id, time: 1 })
+      expect((yield* session.lineage(root.id)).descendants).toEqual([])
+      green.add("version:child_archival")
+    }),
+  )
+
+  it.instance("version:child_deletion", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const root = yield* session.create({ title: "root" })
+      const child = yield* session.create({
+        parentID: root.id,
+        title: "child",
+        metadata: { private: "do not retain" },
+      })
+      yield* session.setArchived({ sessionID: child.id, time: 1 })
+      yield* session.remove(child.id)
+      const lineage = yield* session.lineage(root.id, { retainedOrigins: true })
+      const retained = lineage.retainedOrigins.find((o) => o.sessionID === child.id)
+      // Only the root-owned origin projection is retained — no private metadata survives.
+      expect(retained?.title).toBe("child")
+      expect(retained).not.toHaveProperty("metadata")
+      green.add("version:child_deletion")
+    }),
+  )
+
+  it.instance("version:legacy_session", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const database = yield* Database.Service
+      const legacy = yield* session.create({ title: "before rollout" })
+      yield* database.db.delete(SessionLineageTable).where(eq(SessionLineageTable.session_id, legacy.id)).run()
+      const lineage = yield* session.lineage(legacy.id)
+      expect(lineage.mode).toBe("legacy")
+      expect(lineage.rootID).toBeUndefined()
+      green.add("version:legacy_session")
+    }),
+  )
+
+  it.instance("version:upgrade_epoch", () =>
+    Effect.gen(function* () {
+      const session = yield* SessionNs.Service
+      const database = yield* Database.Service
+      const legacy = yield* session.create({ title: "before" })
+      yield* database.db.delete(SessionLineageTable).where(eq(SessionLineageTable.session_id, legacy.id)).run()
+      yield* session.beginPartialLineage(legacy.id, 42)
+      const after = yield* session.create({ parentID: legacy.id, title: "tracked" })
+      const lineage = yield* session.lineage(after.id)
+      // The epoch tracks spawns after the boundary as partial; pre-epoch history is never backfilled.
+      expect(lineage.mode).toBe("partial")
+      expect(lineage.rootID).toBe(legacy.id)
+      expect(lineage.descendants.some((d) => d.sessionID === after.id && d.mode === "partial")).toBe(true)
+      green.add("version:upgrade_epoch")
+    }),
+  )
+})
+
+// ── The engine-subset gate (AC8) + composition with the #1083 release evaluator
+
+describe("adversarial matrix — the release gate (AC8)", () => {
+  test("every required engine case ran green — all_required_passed, enablement STILL off", () => {
+    const result = ProvenanceMatrix.gate(engine, green)
+    expect(result.missingRequired).toEqual([])
+    expect(result.all_required_passed).toBe(true)
+    // AC8: the matrix reports readiness only — it NEVER flips default enablement (human-only).
+    expect(result.defaultEnablement).toBe("off")
+  })
+
+  test("dropping any one required engine case blocks the gate", () => {
+    const dropped = ProvenanceMatrix.requiredCaseIDs(engine)[0]
+    const minusOne = new Set(green)
+    minusOne.delete(dropped)
+    const result = ProvenanceMatrix.gate(engine, minusOne)
+    expect(result.all_required_passed).toBe(false)
+    expect(result.missingRequired).toContain(dropped)
+  })
+
+  test("the green engine matrix IDs satisfy the #1083 SessionRollout.Release evaluator (enablement off)", () => {
+    const mandatory = { rehearsalCaseIDs: ["upgrade"], matrixCaseIDs: ProvenanceMatrix.requiredCaseIDs(engine) }
+    const parsed = SessionRollout.Release.parse({
+      forkTag: "opencode-v1.18.12-amicode.3",
+      binaryChecksums: { "darwin-arm64": "sha256:aaa" },
+      lockPin: "opencode.lock:deadbeef",
+      extensionVersion: "0.0.3",
+      overlayProvenance: { verified: true },
+      rehearsalCaseIDs: ["upgrade"],
+      matrixCaseIDs: [...green],
+      completion: { forkAt: 100, binaryPinAt: 200, extensionAt: 300 },
+      gates: [{ id: "matrix", required: true, passed: true }],
+    })
+    expect(parsed.ok).toBe(true)
+    if (!parsed.ok) return
+    const readiness = SessionRollout.Release.evaluate(parsed.manifest, mandatory)
+    expect(readiness.ready).toBe(true)
+    expect(readiness.defaultEnablement).toBe("off")
+    // A missing matrix case blocks the release evaluator too.
+    const short = SessionRollout.Release.parse({ ...parsed.manifest, matrixCaseIDs: [...green].slice(1) })
+    if (short.ok) expect(SessionRollout.Release.evaluate(short.manifest, mandatory).ready).toBe(false)
+  })
+})
diff --git a/packages/schema/src/provenance-matrix.ts b/packages/schema/src/provenance-matrix.ts
new file mode 100644
index 000000000..1290fa719
--- /dev/null
+++ b/packages/schema/src/provenance-matrix.ts
@@ -0,0 +1,533 @@
+export * as ProvenanceMatrix from "./provenance-matrix"
+
+import { type Boundary, type Field } from "./session-receipt"
+
+/**
+ * The adversarial full-provenance matrix (amicode#1084) — the release GATE.
+ *
+ * This is the versioned manifest of case IDs (the deliberation resolution): each
+ * row declares its fixture, setup, trigger, expected authorization decision,
+ * expected receipts/assessments, permitted display-safe fields, prohibited egress
+ * fields, cleanup, and required mode. A case is COVERED only when its row runs and
+ * produces its declared observable result — the E2E fixtures in the opencode
+ * (engine) and app (ui) harnesses run each row against the REAL session-lineage,
+ * mutation, receipt, privacy, and view-model contracts.
+ *
+ * The gate ({@link gate}) consumes the manifest and a set of green case IDs and
+ * emits `all_required_passed` ONLY when every required case is green. Product-denied
+ * outcomes are asserted expected results (their rows carry
+ * `expectedAuthorization: "denied"`), never failed tests. The gate NEVER flips
+ * default enablement — that flip is a human-only release act, so
+ * `defaultEnablement` is always `"off"` (AC8). This module composes with the #1083
+ * `SessionRollout.Release` evaluator: {@link requiredCaseIDs} is the mandatory
+ * matrix-case set that evaluator checks.
+ *
+ * This module is pure data + logic. It lives in `@opencode-ai/schema` — the one
+ * package BOTH the opencode engine and the app frontend depend on — so a single
+ * versioned manifest is the shared source of truth across every harness.
+ */
+
+/** The matrix version. Bump on any row-schema or required-set change. */
+export const VERSION = 1
+
+// ── Enumerated dimensions (the AC coverage axes) ────────────────────────────
+
+/** Mutation origins (AC1). `opaque` = a shell / mcp / custom-tool / cli action with no ledger identity. */
+export const Origins = ["agent", "child_agent", "user", "system", "opaque"] as const
+export type Origin = (typeof Origins)[number]
+
+/** Lineage modes (AC1 / AC6). */
+export const Modes = ["full", "partial", "legacy"] as const
+export type Mode = (typeof Modes)[number]
+
+/** Filesystem resource classes (AC2). */
+export const ResourceClasses = [
+  "workspace",
+  "non_git_external",
+  "external_repo",
+  "internal",
+  "binary",
+  "artifact",
+  "directory",
+  "trash",
+  "restore",
+  "symlink",
+  "alias",
+  "unsupported_provider",
+] as const
+export type ResourceClass = (typeof ResourceClasses)[number]
+
+/** Observable mutation outcomes (AC3). */
+export const Outcomes = [
+  "success",
+  "denied",
+  "failed",
+  "aborted",
+  "partial",
+  "conflict",
+  "unavailable",
+  "opaque",
+  "quota",
+  "expiry",
+] as const
+export type Outcome = (typeof Outcomes)[number]
+
+/**
+ * The egress boundaries that must never carry capability, evidence, or protected
+ * metadata (AC5). A subset of the receipt {@link Boundary} union — `files_changed`,
+ * `session_metadata`, and the authenticated `external_detail` gate are excluded
+ * because they are not the disallowed-egress surfaces this AC guards.
+ */
+export const EgressBoundaries = ["browser", "transcript", "share", "export", "telemetry", "log", "error"] as const
+export type EgressBoundary = (typeof EgressBoundaries)[number] & Boundary
+
+/** Aggregation / version concerns (AC6). */
+export const VersionConcerns = [
+  "task_aggregation",
+  "spawn_aggregation",
+  "fork_separation",
+  "child_archival",
+  "child_deletion",
+  "legacy_session",
+  "upgrade_epoch",
+  "mixed_binaries",
+  "rollback",
+] as const
+export type VersionConcern = (typeof VersionConcerns)[number]
+
+/** The AC group a row belongs to. */
+export const Dimensions = [
+  "origin",
+  "resource",
+  "outcome",
+  "concurrency",
+  "privacy",
+  "version",
+  "accessibility",
+] as const
+export type Dimension = (typeof Dimensions)[number]
+
+/** Which harness process runs the row. `engine` = opencode session contracts; `ui` = the app view model. */
+export type Harness = "engine" | "ui"
+
+/** The expected authorization decision a row declares. `denied` is an expected result, not a failure. */
+export type Authorization = "authorized" | "denied" | "not_applicable"
+
+/** One prohibited egress: a receipt field that must NOT cross a boundary (AC5). */
+export type ProhibitedEgress = { field: Field; boundary: EgressBoundary }
+
+/** One matrix row — the full case declaration (deliberation resolution). */
+export type Row = {
+  /** Stable case ID (the manifest is a manifest of these). */
+  id: string
+  /** Which AC group. */
+  dimension: Dimension
+  /** Which harness runs the row. */
+  harness: Harness
+  /** Required for release readiness. A required case must be green for `all_required_passed`. */
+  required: boolean
+  /** The lineage mode the case runs in (AC1 / AC6). */
+  requiredMode: Mode
+  /** The mutation origin exercised (origin rows). */
+  origin?: Origin
+  /** The filesystem resource class exercised (resource rows). */
+  resourceClass?: ResourceClass
+  /** The declared observable outcome (outcome rows). */
+  expectedOutcome?: Outcome
+  /** The aggregation / version concern (version rows). */
+  concern?: VersionConcern
+  /** The expected authorization decision. */
+  expectedAuthorization: Authorization
+  /** The isolated fixture — a temp root, sandboxed dir, contained symlink, disposable trash, or in-memory projection. Never a real user directory. */
+  fixture: string
+  /** Setup steps performed before the trigger. */
+  setup: string
+  /** The trigger that produces the observable result. */
+  trigger: string
+  /** The declared observable result — the receipts and assessments the case must produce. */
+  expectation: string
+  /** Fields the case may surface on the display-safe (Files Changed / browser) projection. */
+  permittedDisplaySafeFields: readonly Field[]
+  /** Fields that must NOT cross the named egress boundary (AC5). */
+  prohibitedEgress: readonly ProhibitedEgress[]
+  /** Cleanup + post-run containment assertion. */
+  cleanup: string
+}
+
+export type Manifest = { version: number; cases: readonly Row[] }
+
+// ── Field groupings used by the display/egress declarations ─────────────────
+
+/** The full display-safe set the Files Changed / browser projection may surface. */
+const DISPLAY_SAFE_FIELDS: readonly Field[] = [
+  "operation.origin",
+  "operation.state",
+  "receipt.id",
+  "receipt.sequence",
+  "receipt.resource",
+  "receipt.operation",
+  "receipt.outcome",
+  "receipt.timeCreated",
+  "assessment.receiptID",
+  "assessment.confidence",
+  "assessment.netState",
+  "assessment.evidenceState",
+  "assessment.revision",
+  "assessment.expiresAt",
+  "assessment.timeCreated",
+  "evidence.receiptID",
+  "derived.additions",
+  "derived.deletions",
+]
+
+/** Capability + evidence + protected metadata — must never cross an egress boundary (AC5). */
+const PROTECTED_FIELDS: readonly Field[] = [
+  "context.capability", // capability
+  "evidence.content", // evidence bytes
+  "operation.id", // protected metadata
+  "operation.rootID",
+  "operation.sessionID",
+  "assessment.id",
+  "context.canonicalPath",
+  "context.rawHash",
+  "context.baseline",
+  "context.redactionDecision",
+]
+
+// ── The manifest rows, by dimension ─────────────────────────────────────────
+
+const originRows: Row[] = Origins.flatMap((origin) =>
+  Modes.map((mode): Row => {
+    const opaque = origin === "opaque"
+    return {
+      id: `origin:${origin}:${mode}`,
+      dimension: "origin",
+      harness: "engine",
+      required: true,
+      requiredMode: mode,
+      origin,
+      // An opaque origin never authorizes a ledger route; a legacy-mode display shows the pre-ledger view.
+      expectedAuthorization: opaque ? "not_applicable" : "authorized",
+      fixture: `In-memory mutation context + host receipt for a ${origin} origin in ${mode} mode (isolated, no filesystem).`,
+      setup: `Issue a mutation context for origin=${origin} against a ${mode}-mode root; build the host receipt with that origin.`,
+      trigger:
+        opaque
+          ? `Execute the opaque route for the ${origin} origin.`
+          : `Execute the ledger route and project the receipt at the capability-selected ${mode} view.`,
+      expectation:
+        mode === "legacy"
+          ? `The ${origin} origin resolves to the pre-ledger (legacy) projection — no full-provenance claim.`
+          : opaque
+            ? `The ${origin} action yields an unknown-mutation receipt (no fabricated resource), attributed to origin=${origin}.`
+            : `A ledger receipt carries origin=${origin} on the display-safe projection and is attributed to the active root.`,
+      permittedDisplaySafeFields: mode === "legacy" ? [] : DISPLAY_SAFE_FIELDS,
+      prohibitedEgress: [],
+      cleanup: "Contexts and receipts are in-memory; the operation store is discarded with the test scope.",
+    }
+  }),
+)
+
+const RESOURCE_META: Record<ResourceClass, { authorization: Authorization; outcome: Outcome; expectation: string }> = {
+  workspace: { authorization: "authorized", outcome: "success", expectation: "A workspace file resolves to a stable physical identity and records a ledger receipt." },
+  non_git_external: { authorization: "authorized", outcome: "success", expectation: "A sandboxed non-Git external file is assessed via host-local external-diff; the patch never crosses." },
+  external_repo: { authorization: "authorized", outcome: "success", expectation: "A file in a separate sandboxed Git repo resolves to its own identity and is assessed independently." },
+  internal: { authorization: "not_applicable", outcome: "success", expectation: "An internal (out-of-scope) store is never a ledger route — no session receipt is produced." },
+  binary: { authorization: "authorized", outcome: "success", expectation: "A binary file records a metadata-only receipt; its bytes stay host-local and never reach display." },
+  artifact: { authorization: "authorized", outcome: "success", expectation: "A generated artifact records a ledger receipt; the artifact bytes are host-local evidence only." },
+  directory: { authorization: "authorized", outcome: "success", expectation: "A directory endpoint resolves with kind=directory and records an implicit-parent receipt." },
+  trash: { authorization: "authorized", outcome: "success", expectation: "A move-to-trash records a delete receipt; the disposable trash fixture holds the removed file." },
+  restore: { authorization: "authorized", outcome: "success", expectation: "A restore-from-trash records a revert/restore receipt as the file reappears at its identity." },
+  symlink: { authorization: "authorized", outcome: "success", expectation: "A symlink binds the SAME physical identity as its target — the path is discarded before the context." },
+  alias: { authorization: "authorized", outcome: "success", expectation: "A hardlink alias binds the SAME identity as its target — aliases and symlinks resolve to one resource." },
+  unsupported_provider: { authorization: "denied", outcome: "denied", expectation: "A provider lacking safe-resolve / no-follow-write is DENIED (unsafe_provider) — an expected product-denied result." },
+}
+
+const resourceRows: Row[] = ResourceClasses.map((cls): Row => {
+  const meta = RESOURCE_META[cls]
+  return {
+    id: `resource:${cls}`,
+    dimension: "resource",
+    harness: "engine",
+    required: true,
+    requiredMode: "full",
+    resourceClass: cls,
+    expectedOutcome: meta.outcome,
+    expectedAuthorization: meta.authorization,
+    fixture: `Isolated temp root / sandboxed external dir for a ${cls} resource (contained symlink/alias, disposable trash — never a real user directory).`,
+    setup: `Create the ${cls} fixture under an isolated temporary root and register its baseline.`,
+    trigger: `Resolve/assess the ${cls} resource through the mutation-identity and external-diff contracts.`,
+    expectation: meta.expectation,
+    permittedDisplaySafeFields: cls === "internal" ? [] : ["receipt.resource", "receipt.operation", "receipt.outcome"],
+    prohibitedEgress: [],
+    cleanup: "Remove the temp root; assert containment (every touched path stayed under the isolated fixture).",
+  }
+})
+
+const OUTCOME_META: Record<Outcome, { authorization: Authorization; expectation: string }> = {
+  success: { authorization: "authorized", expectation: "The mutation applies and records an applied receipt." },
+  denied: { authorization: "denied", expectation: "A missing/invalid context is DENIED — an expected product-denied result, not a failure." },
+  failed: { authorization: "authorized", expectation: "An identity mismatch during a group execute yields a failed group with not-started receipts." },
+  aborted: { authorization: "not_applicable", expectation: "An aborted reservation releases root capacity and commits no receipt." },
+  partial: { authorization: "authorized", expectation: "A group whose first resource applies and second fails yields a partial group." },
+  conflict: { authorization: "denied", expectation: "A source identity that changed between issue and execute is DENIED (identity_changed) — a conflict." },
+  unavailable: { authorization: "authorized", expectation: "A missing evidence sidecar reassesses the receipt as evidence unavailable, without a patch payload." },
+  opaque: { authorization: "not_applicable", expectation: "An opaque action with no resources yields an unknown-mutation receipt." },
+  quota: { authorization: "denied", expectation: "A recursive group over its resource budget is DENIED (resource_budget_exceeded) — a quota result." },
+  expiry: { authorization: "denied", expectation: "An expired context is DENIED (expired_context) — an expiry result." },
+}
+
+const outcomeRows: Row[] = Outcomes.map((outcome): Row => {
+  const meta = OUTCOME_META[outcome]
+  return {
+    id: `outcome:${outcome}`,
+    dimension: "outcome",
+    harness: "engine",
+    required: true,
+    requiredMode: "full",
+    expectedOutcome: outcome,
+    expectedAuthorization: meta.authorization,
+    fixture: "In-memory mutation gate + isolated temp/database fixture; product-denied outcomes are expected results.",
+    setup: `Drive the mutation/receipt contract into the ${outcome} condition.`,
+    trigger: `Execute the operation that produces the ${outcome} outcome.`,
+    expectation: meta.expectation,
+    permittedDisplaySafeFields: ["receipt.outcome", "assessment.netState", "assessment.evidenceState"],
+    prohibitedEgress: [],
+    cleanup: "In-memory contexts discarded; database fixture torn down with the test scope.",
+  }
+})
+
+const concurrencyRows: Row[] = [
+  {
+    id: "concurrency:non-attribution",
+    dimension: "concurrency",
+    harness: "engine",
+    required: true,
+    requiredMode: "full",
+    expectedAuthorization: "authorized",
+    fixture: "Two isolated lineage roots writing concurrently in an isolated database fixture.",
+    setup: "Create two independent roots; publish receipts to each concurrently.",
+    trigger: "Query the active root's committed receipts while an unrelated root is also writing.",
+    expectation: "The active root's committed receipts contain ONLY its own operations — an unrelated writer is never attributed to it.",
+    permittedDisplaySafeFields: ["operation.origin", "receipt.resource"],
+    prohibitedEgress: [],
+    cleanup: "Remove both roots; assert each root's receipt set is disjoint.",
+  },
+  {
+    id: "concurrency:cross-root-context-denied",
+    dimension: "concurrency",
+    harness: "engine",
+    required: true,
+    requiredMode: "full",
+    expectedAuthorization: "denied",
+    fixture: "In-memory mutation gate with a root-scoped operation store.",
+    setup: "Issue a context for root A; attempt to execute it while the session maps to root B.",
+    trigger: "Execute a mutation whose session no longer resolves to the context's root.",
+    expectation: "The cross-root execution is DENIED (invalid_context) — a context is bound to one root and never leaks across.",
+    permittedDisplaySafeFields: [],
+    prohibitedEgress: [],
+    cleanup: "In-memory contexts discarded with the test scope.",
+  },
+]
+
+const privacyRows: Row[] = EgressBoundaries.map((boundary): Row => ({
+  id: `privacy:${boundary}`,
+  dimension: "privacy",
+  harness: "engine",
+  required: true,
+  requiredMode: "full",
+  expectedAuthorization: "not_applicable",
+  fixture: "In-memory host receipt carrying capability, evidence bytes, and protected metadata sentinels.",
+  setup: "Build a host receipt with capability/evidence/protected-metadata sentinels, then project it at the boundary.",
+  trigger: `Serialize the receipt at the ${boundary} egress boundary via the privacy projector.`,
+  expectation: `The ${boundary} projection contains NO capability, evidence, or protected-metadata field — only display-safe / redacted values.`,
+  permittedDisplaySafeFields: boundary === "browser" ? DISPLAY_SAFE_FIELDS : [],
+  prohibitedEgress: PROTECTED_FIELDS.map((field) => ({ field, boundary })),
+  cleanup: "In-memory receipt discarded; assert the serialized output contains none of the protected sentinels.",
+}))
+
+const VERSION_META: Record<VersionConcern, { mode: Mode; expectation: string }> = {
+  task_aggregation: { mode: "full", expectation: "A task_spawn child aggregates under the parent root with a typed task_spawn edge." },
+  spawn_aggregation: { mode: "full", expectation: "A session_spawn child aggregates under the parent root with a typed session_spawn edge." },
+  fork_separation: { mode: "full", expectation: "A fork gets an independent root and inherits no lineage descendants." },
+  child_archival: { mode: "full", expectation: "An archived child is hidden from the root's active descendants." },
+  child_deletion: { mode: "full", expectation: "A deleted child retains only its root-owned origin projection — no private metadata is retained." },
+  legacy_session: { mode: "legacy", expectation: "A session with no lineage row resolves to legacy mode with no descendants." },
+  upgrade_epoch: { mode: "partial", expectation: "An explicit partial epoch tracks spawns after the boundary; pre-epoch history is never backfilled." },
+  mixed_binaries: { mode: "legacy", expectation: "old-engine/new-client and new-engine/old-client both resolve to a visibly-labelled non-full view (never a false full claim)." },
+  rollback: { mode: "full", expectation: "Rollback disables full discovery before withdrawing client routes — no uncontextualized full mutation window." },
+}
+
+const versionRows: Row[] = VersionConcerns.map((concern): Row => {
+  const meta = VERSION_META[concern]
+  return {
+    id: `version:${concern}`,
+    dimension: "version",
+    harness: "engine",
+    required: true,
+    requiredMode: meta.mode,
+    concern,
+    expectedAuthorization: "not_applicable",
+    fixture: "Isolated lineage database fixture + the deterministic rollout resolver (no release act performed).",
+    setup: `Arrange the ${concern} lineage/version condition in an isolated fixture.`,
+    trigger: `Resolve lineage / rollout for the ${concern} concern.`,
+    expectation: meta.expectation,
+    permittedDisplaySafeFields: [],
+    prohibitedEgress: [],
+    cleanup: "Remove the lineage roots; the rollout resolver is pure and mutates nothing.",
+  }
+})
+
+const accessibilityRows: Row[] = [
+  {
+    id: "a11y:keyboard",
+    dimension: "accessibility",
+    harness: "ui",
+    required: true,
+    requiredMode: "full",
+    expectedAuthorization: "not_applicable",
+    fixture: "The pure lineage-ledger view-model reducer (no DOM, no theme dependency).",
+    setup: "Focus a resource row / expanded content in the unified Files Changed surface.",
+    trigger: "Keyboard operation: Enter/Space toggles a row; Escape collapses expanded content and refocuses the row.",
+    expectation: "Every row is operable by keyboard — Enter/Space toggle, Escape collapses; unrelated keys are no-ops.",
+    permittedDisplaySafeFields: [],
+    prohibitedEgress: [],
+    cleanup: "Pure reducer; nothing to clean up.",
+  },
+  {
+    id: "a11y:themes",
+    dimension: "accessibility",
+    harness: "ui",
+    required: true,
+    requiredMode: "full",
+    expectedAuthorization: "not_applicable",
+    fixture: "The pure status descriptor + capability labels of the unified view-model (theme-independent by construction).",
+    setup: "Build the status descriptor for every named state and the full/partial/legacy capability labels.",
+    trigger: "Render legibility check across both supported themes.",
+    expectation: "Each state is distinguishable by text + icon (never color alone) and the tone is a semantic keyword — legible in BOTH themes.",
+    permittedDisplaySafeFields: [],
+    prohibitedEgress: [],
+    cleanup: "Pure descriptors; nothing to clean up.",
+  },
+]
+
+/** The versioned adversarial full-provenance matrix. */
+export const MANIFEST: Manifest = {
+  version: VERSION,
+  cases: [
+    ...originRows,
+    ...resourceRows,
+    ...outcomeRows,
+    ...concurrencyRows,
+    ...privacyRows,
+    ...versionRows,
+    ...accessibilityRows,
+  ],
+}
+
+// ── Selectors ────────────────────────────────────────────────────────────────
+
+/** The required case IDs — the mandatory matrix-case set the #1083 release evaluator checks. */
+export function requiredCaseIDs(manifest: Manifest = MANIFEST): string[] {
+  return manifest.cases.filter((row) => row.required).map((row) => row.id)
+}
+
+/** Every case ID in the manifest. */
+export function caseIDs(manifest: Manifest = MANIFEST): string[] {
+  return manifest.cases.map((row) => row.id)
+}
+
+/** The sub-manifest a harness owns — used to run and gate one harness's boundary. */
+export function subset(harness: Harness, manifest: Manifest = MANIFEST): Manifest {
+  return { version: manifest.version, cases: manifest.cases.filter((row) => row.harness === harness) }
+}
+
+// ── The gate ─────────────────────────────────────────────────────────────────
+
+export type GateResult = {
+  /** True iff every required case in the manifest is in the green set. */
+  all_required_passed: boolean
+  /** Always `"off"` — the matrix reports readiness; flipping enablement is a human-only release act (AC8). */
+  defaultEnablement: "off"
+  /** Required case IDs that are not green (empty when `all_required_passed`). */
+  missingRequired: string[]
+  /** Totals for reporting. */
+  total: number
+  requiredTotal: number
+  greenTotal: number
+}
+
+/**
+ * Consume the manifest + the set of case IDs that RAN GREEN, and emit
+ * `all_required_passed` only when every required case is green. Default enablement
+ * always stays `off`. A product-denied case is green when it produced its declared
+ * denial (its row is `expectedAuthorization: "denied"`), so its ID belongs in
+ * `green` — the gate treats it exactly like any other required green result.
+ */
+export function gate(manifest: Manifest, green: ReadonlySet<string>): GateResult {
+  const required = manifest.cases.filter((row) => row.required)
+  const missingRequired = required.filter((row) => !green.has(row.id)).map((row) => row.id)
+  return {
+    all_required_passed: missingRequired.length === 0,
+    defaultEnablement: "off",
+    missingRequired,
+    total: manifest.cases.length,
+    requiredTotal: required.length,
+    greenTotal: [...green].length,
+  }
+}
+
+// ── Fail-closed coverage assertion ──────────────────────────────────────────
+
+/**
+ * Fails closed when the manifest does not COVER every required dimension
+ * (AC1–AC7). Called at module load so a matrix that silently dropped a dimension
+ * can never ship. Mirrors `SessionReceipt.assertExposureCoverage`.
+ */
+export function assertCoverage(manifest: Manifest): void {
+  if (manifest.version <= 0) throw new Error("provenance matrix must be versioned (version > 0)")
+
+  const ids = manifest.cases.map((row) => row.id)
+  if (ids.some((id) => id.length === 0)) throw new Error("provenance matrix has an empty case id")
+  if (new Set(ids).size !== ids.length) throw new Error("provenance matrix has duplicate case ids")
+
+  const origins = manifest.cases.filter((row) => row.dimension === "origin")
+  for (const origin of Origins)
+    for (const mode of Modes)
+      if (!origins.some((row) => row.origin === origin && row.requiredMode === mode))
+        throw new Error(`provenance matrix missing origin coverage: ${origin} × ${mode}`)
+
+  const resources = manifest.cases.filter((row) => row.dimension === "resource")
+  for (const cls of ResourceClasses)
+    if (!resources.some((row) => row.resourceClass === cls))
+      throw new Error(`provenance matrix missing resource coverage: ${cls}`)
+
+  const outcomes = manifest.cases.filter((row) => row.dimension === "outcome")
+  for (const outcome of Outcomes)
+    if (!outcomes.some((row) => row.expectedOutcome === outcome))
+      throw new Error(`provenance matrix missing outcome coverage: ${outcome}`)
+
+  if (!manifest.cases.some((row) => row.dimension === "concurrency"))
+    throw new Error("provenance matrix missing concurrency coverage")
+
+  const privacy = manifest.cases.filter((row) => row.dimension === "privacy")
+  for (const boundary of EgressBoundaries) {
+    const prohibited = privacy.flatMap((row) => row.prohibitedEgress.filter((p) => p.boundary === boundary).map((p) => p.field))
+    if (!prohibited.includes("context.capability"))
+      throw new Error(`provenance matrix missing capability egress guard at ${boundary}`)
+    if (!prohibited.includes("evidence.content"))
+      throw new Error(`provenance matrix missing evidence egress guard at ${boundary}`)
+    if (!prohibited.some((field) => field.startsWith("operation.") || field.startsWith("context.") || field === "assessment.id"))
+      throw new Error(`provenance matrix missing protected-metadata egress guard at ${boundary}`)
+  }
+
+  const versions = manifest.cases.filter((row) => row.dimension === "version")
+  for (const concern of VersionConcerns)
+    if (!versions.some((row) => row.concern === concern))
+      throw new Error(`provenance matrix missing version coverage: ${concern}`)
+
+  const accessibility = manifest.cases.filter((row) => row.dimension === "accessibility")
+  if (accessibility.length < 2 || !accessibility.every((row) => row.harness === "ui"))
+    throw new Error("provenance matrix missing keyboard + both-theme accessibility coverage on the ui harness")
+}
+
+assertCoverage(MANIFEST)
diff --git a/packages/schema/test/provenance-matrix.test.ts b/packages/schema/test/provenance-matrix.test.ts
new file mode 100644
index 000000000..4b4bee7a4
--- /dev/null
+++ b/packages/schema/test/provenance-matrix.test.ts
@@ -0,0 +1,171 @@
+import { describe, expect, test } from "bun:test"
+import { ProvenanceMatrix } from "../src/provenance-matrix"
+
+/**
+ * The adversarial full-provenance matrix (amicode#1084) is a VERSIONED manifest
+ * of case IDs, and the release gate that consumes it. These tests prove the
+ * shared source of truth: the manifest COVERS every required dimension (AC1–AC7),
+ * is versioned, and the gate emits `all_required_passed` only when every required
+ * case is green while default enablement stays OFF (AC8). The E2E fixtures in the
+ * opencode + app harnesses prove each row RUNS and produces its declared result.
+ */
+
+const requiredIDs = () => ProvenanceMatrix.requiredCaseIDs()
+
+describe("ProvenanceMatrix.MANIFEST — a versioned manifest of case IDs (deliberation)", () => {
+  test("is versioned", () => {
+    expect(ProvenanceMatrix.VERSION).toBeGreaterThan(0)
+    expect(ProvenanceMatrix.MANIFEST.version).toBe(ProvenanceMatrix.VERSION)
+  })
+
+  test("every case id is unique and non-empty", () => {
+    const ids = ProvenanceMatrix.MANIFEST.cases.map((row) => row.id)
+    expect(ids.every((id) => id.length > 0)).toBe(true)
+    expect(new Set(ids).size).toBe(ids.length)
+  })
+
+  test("every row declares the full case schema (fixture/setup/trigger/expectation/cleanup/mode/authorization)", () => {
+    for (const row of ProvenanceMatrix.MANIFEST.cases) {
+      expect(row.fixture.length).toBeGreaterThan(0)
+      expect(row.setup.length).toBeGreaterThan(0)
+      expect(row.trigger.length).toBeGreaterThan(0)
+      expect(row.expectation.length).toBeGreaterThan(0)
+      expect(row.cleanup.length).toBeGreaterThan(0)
+      expect(ProvenanceMatrix.Modes).toContain(row.requiredMode)
+      expect(["authorized", "denied", "not_applicable"]).toContain(row.expectedAuthorization)
+    }
+  })
+
+  test("no fixture is a real user directory — every resource row is an isolated/sandboxed fixture", () => {
+    for (const row of ProvenanceMatrix.MANIFEST.cases) {
+      // The constraint: the matrix cannot mutate a real external user directory.
+      expect(row.fixture.toLowerCase()).toMatch(/isolated|sandbox|temp|contained|disposable|in-memory|projected|synthetic|pure/)
+    }
+  })
+})
+
+describe("ProvenanceMatrix coverage — the matrix COVERS every required dimension (AC1–AC7)", () => {
+  const rowsByDimension = (dimension: ProvenanceMatrix.Dimension) =>
+    ProvenanceMatrix.MANIFEST.cases.filter((row) => row.dimension === dimension)
+
+  test("AC1: agent, child-agent, user, system, opaque origins across full, partial, legacy modes", () => {
+    const origins = rowsByDimension("origin")
+    for (const origin of ProvenanceMatrix.Origins)
+      expect(origins.some((row) => row.origin === origin)).toBe(true)
+    // Every (origin, mode) pair is present — the full cross product.
+    for (const origin of ProvenanceMatrix.Origins)
+      for (const mode of ProvenanceMatrix.Modes)
+        expect(origins.some((row) => row.origin === origin && row.requiredMode === mode)).toBe(true)
+  })
+
+  test("AC2: every filesystem resource class is covered", () => {
+    const resources = rowsByDimension("resource")
+    for (const cls of ProvenanceMatrix.ResourceClasses)
+      expect(resources.some((row) => row.resourceClass === cls)).toBe(true)
+  })
+
+  test("AC3: every outcome is covered", () => {
+    const outcomes = rowsByDimension("outcome")
+    for (const outcome of ProvenanceMatrix.Outcomes)
+      expect(outcomes.some((row) => row.expectedOutcome === outcome)).toBe(true)
+  })
+
+  test("AC4: unrelated concurrent writes are covered", () => {
+    expect(rowsByDimension("concurrency").length).toBeGreaterThanOrEqual(1)
+  })
+
+  test("AC5: capability, evidence, and protected metadata are prohibited at every egress boundary", () => {
+    const privacy = rowsByDimension("privacy")
+    for (const boundary of ProvenanceMatrix.EgressBoundaries)
+      expect(privacy.some((row) => row.prohibitedEgress.some((p) => p.boundary === boundary))).toBe(true)
+    // Every egress boundary must prohibit a capability field, an evidence field, and a protected-metadata field.
+    for (const boundary of ProvenanceMatrix.EgressBoundaries) {
+      const prohibited = privacy.flatMap((row) => row.prohibitedEgress.filter((p) => p.boundary === boundary).map((p) => p.field))
+      expect(prohibited).toContain("context.capability")
+      expect(prohibited).toContain("evidence.content")
+      expect(prohibited.some((field) => field.startsWith("operation.") || field.startsWith("context.") || field === "assessment.id")).toBe(true)
+    }
+  })
+
+  test("AC6: every task/spawn/fork/archival/deletion/legacy/epoch/mixed-binary/rollback concern is covered", () => {
+    const versions = rowsByDimension("version")
+    for (const concern of ProvenanceMatrix.VersionConcerns)
+      expect(versions.some((row) => row.concern === concern)).toBe(true)
+  })
+
+  test("AC7: keyboard operation and both-theme legibility are covered on the ui harness", () => {
+    const accessibility = rowsByDimension("accessibility")
+    expect(accessibility.length).toBeGreaterThanOrEqual(2)
+    expect(accessibility.every((row) => row.harness === "ui")).toBe(true)
+    expect(accessibility.some((row) => /keyboard/i.test(row.trigger + row.expectation))).toBe(true)
+    expect(accessibility.some((row) => /theme/i.test(row.trigger + row.expectation))).toBe(true)
+  })
+
+  test("assertCoverage fails closed on an incomplete manifest", () => {
+    const incomplete: ProvenanceMatrix.Manifest = {
+      version: ProvenanceMatrix.VERSION,
+      cases: ProvenanceMatrix.MANIFEST.cases.filter((row) => row.origin !== "system"),
+    }
+    expect(() => ProvenanceMatrix.assertCoverage(incomplete)).toThrow(/system/i)
+  })
+})
+
+describe("ProvenanceMatrix.gate — all_required_passed only when every required case is green (AC8)", () => {
+  test("a fully-green required set passes, and default enablement is STILL off", () => {
+    const green = new Set(requiredIDs())
+    const result = ProvenanceMatrix.gate(ProvenanceMatrix.MANIFEST, green)
+    expect(result.all_required_passed).toBe(true)
+    expect(result.missingRequired).toEqual([])
+    // AC8: the matrix reports readiness — it never flips enablement on (human-only).
+    expect(result.defaultEnablement).toBe("off")
+  })
+
+  test("a single missing required case blocks the gate and names it", () => {
+    const all = requiredIDs()
+    const dropped = all[0]
+    const green = new Set(all.slice(1))
+    const result = ProvenanceMatrix.gate(ProvenanceMatrix.MANIFEST, green)
+    expect(result.all_required_passed).toBe(false)
+    expect(result.missingRequired).toContain(dropped)
+    expect(result.defaultEnablement).toBe("off")
+  })
+
+  test("an empty green set blocks the gate (a passing happy path cannot substitute for coverage)", () => {
+    const result = ProvenanceMatrix.gate(ProvenanceMatrix.MANIFEST, new Set())
+    expect(result.all_required_passed).toBe(false)
+    expect(result.defaultEnablement).toBe("off")
+  })
+
+  test("a product-denied case that ran green still counts toward all_required_passed (denied is an expected result)", () => {
+    // Denied-authorization rows are asserted expected results, not failed tests: their ids are in the required set.
+    const deniedRows = ProvenanceMatrix.MANIFEST.cases.filter((row) => row.expectedAuthorization === "denied" && row.required)
+    expect(deniedRows.length).toBeGreaterThan(0)
+    const green = new Set(requiredIDs())
+    expect(ProvenanceMatrix.gate(ProvenanceMatrix.MANIFEST, green).all_required_passed).toBe(true)
+    // Dropping a denied case (as if it had "failed") blocks the gate — the denial itself is the required green result.
+    green.delete(deniedRows[0].id)
+    expect(ProvenanceMatrix.gate(ProvenanceMatrix.MANIFEST, green).all_required_passed).toBe(false)
+  })
+
+  test("the gate never reports enablement on for any green set", () => {
+    for (const green of [new Set<string>(), new Set(requiredIDs()), new Set(requiredIDs().slice(2))])
+      expect(ProvenanceMatrix.gate(ProvenanceMatrix.MANIFEST, green).defaultEnablement).toBe("off")
+  })
+})
+
+describe("ProvenanceMatrix per-harness selectors — each harness owns a boundary subset", () => {
+  test("engine and ui subsets partition the manifest", () => {
+    const engine = ProvenanceMatrix.subset("engine").cases.map((row) => row.id)
+    const ui = ProvenanceMatrix.subset("ui").cases.map((row) => row.id)
+    expect(new Set([...engine, ...ui]).size).toBe(ProvenanceMatrix.MANIFEST.cases.length)
+    expect(engine.some((id) => ui.includes(id))).toBe(false)
+    expect(engine.length).toBeGreaterThan(0)
+    expect(ui.length).toBeGreaterThan(0)
+  })
+
+  test("the required matrix case IDs are the mandatory set for the #1083 release evaluator", () => {
+    // Every required matrix id feeds SessionRollout.Release.evaluate as a mandatory matrix case.
+    expect(requiredIDs().length).toBe(ProvenanceMatrix.MANIFEST.cases.filter((row) => row.required).length)
+    expect(requiredIDs().length).toBeGreaterThan(0)
+  })
+})