Emit crash-safe v2 eval campaigns

[vriesd]

Phase 4 freezes campaign cells before launch and writes crash-safe v2 evidence as attempts complete.

• Adds immutable canonical plan, transcript, attempt, completion, and report storage.
• Uses synced temporary files and atomic no-replace cell claims.
• Supports byte-identical replay while rejecting conflicting attempts and transcripts.
• Reconciles in frozen plan order and ignores crash leftovers.
• Finalizes only reports accepted by the strict v2 parser.
• Preserves legacy reports and cassettes while printing the exact v2 report path.
• Records honest stopped causes, observed budgets, requested actors, and explicit unobserved full actual identity.

Verification

• Fault-injection, concurrent-writer, replay, transcript-binding, and truncated-ledger tests pass.
• Final paid happy-path emitted and independently parsed a complete v2 report.
• bun run check passes 468 tests, one intentional live-host skip, zero failures.
• Four-model Interrogate found no unresolved blocker.
• Contribution preflights passed; optional gitleaks scan was unavailable.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9e953a338

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate transcript artifacts before accepting a report

Before finalizing a campaign, verify that each referenced transcript exists under the report directory and that its stored bytes match attempt.transcript.sha256. Currently finalize() passes ledger values directly to parseReport(), which only validates the artifact path and digest format; as demonstrated by the existing finalization tests, a report with no transcript files at all is accepted, so deleted, tampered, or never-written evidence can silently produce a validated report.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reopen interrupted campaign directories on resume

Allow a rerun to select and reopen an existing campaign directory instead of unconditionally generating a new timestamped directory. If this paid runner is terminated after some immutable attempts have landed, its next invocation creates a different .v2 store and launches every cell again; there is no CLI or repository caller that passes the previous directory back to createReportStore, so the persisted ledger cannot actually be resumed and the completed paid attempts are duplicated.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Record only commands that were actually dispatched

Build command provenance from the steps reached by the attempt rather than every configured scenario step. For a multi-step scenario whose first command errors, or an environment failure before any command is sent, the catch path still calls persistV2Attempt() and this mapping records all later commands as delivered; the resulting immutable ledger therefore misstates the inputs that produced the failure.

Useful? React with 👍 / 👎.