diff --git a/.github/workflows/native-wheel-ci.yml b/.github/workflows/native-wheel-ci.yml
index b759194..832cb04 100644
--- a/.github/workflows/native-wheel-ci.yml
+++ b/.github/workflows/native-wheel-ci.yml
@@ -7,7 +7,7 @@ on:
       - "rust/**"
       - "scripts/build_native_hol_guard_wheel.py"
       - "ci/native_runtime/test_native_hol_guard_wheel.py"
-      - "ci/native_runtime/probe_native_default_auto.py"
+      - "ci/native_runtime/probe_native_required.py"
       - "src/codex_plugin_scanner/guard/native_runtime.py"
       - ".github/workflows/native-wheel-ci.yml"
   push:
@@ -16,7 +16,7 @@ on:
       - "rust/**"
       - "scripts/build_native_hol_guard_wheel.py"
       - "ci/native_runtime/test_native_hol_guard_wheel.py"
-      - "ci/native_runtime/probe_native_default_auto.py"
+      - "ci/native_runtime/probe_native_required.py"
       - "src/codex_plugin_scanner/guard/native_runtime.py"
       - ".github/workflows/native-wheel-ci.yml"
   workflow_dispatch:
@@ -53,7 +53,7 @@ jobs:
           rustup target add x86_64-unknown-linux-musl
           sudo apt-get update
           sudo apt-get install --yes --no-install-recommends musl-tools
-      - name: Build pure Python wheel
+      - name: Build internal base wheel for native assembly
         run: uv run --no-sync python -m build --wheel --outdir pure-dist
       - name: Build static native runtime
         env:
@@ -89,8 +89,8 @@ jobs:
             --source-sha "$SOURCE_SHA" \
             --rule-digest "$RULE_DIGEST"
           uv pip install --python .venv/bin/python --no-deps --force-reinstall native-dist/*.whl
-          unset HOL_GUARD_NATIVE HOL_GUARD_NATIVE_BINARY
-          uv run --no-sync python ci/native_runtime/probe_native_default_auto.py
+          unset HOL_GUARD_NATIVE HOL_GUARD_NATIVE_BINARY HOL_GUARD_NATIVE_DEVELOPMENT
+          uv run --no-sync python ci/native_runtime/probe_native_required.py
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: hol-guard-native-wheel-linux-x64
@@ -128,7 +128,7 @@ jobs:
         run: |
           rustup toolchain install 1.88.0 --profile minimal
           rustup default 1.88.0
-      - name: Build pure Python wheel
+      - name: Build internal base wheel for native assembly
         run: uv run --no-sync python -m build --wheel --outdir pure-dist
       - name: Build native runtime
         env:
@@ -158,8 +158,8 @@ jobs:
             --source-sha "$SOURCE_SHA" \
             --rule-digest "$RULE_DIGEST"
           uv pip install --python .venv/bin/python --no-deps --force-reinstall native-dist/*.whl
-          unset HOL_GUARD_NATIVE HOL_GUARD_NATIVE_BINARY
-          uv run --no-sync python ci/native_runtime/probe_native_default_auto.py
+          unset HOL_GUARD_NATIVE HOL_GUARD_NATIVE_BINARY HOL_GUARD_NATIVE_DEVELOPMENT
+          uv run --no-sync python ci/native_runtime/probe_native_required.py
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: hol-guard-native-wheel-${{ matrix.target }}
@@ -186,7 +186,7 @@ jobs:
         run: |
           rustup toolchain install 1.88.0 --profile minimal
           rustup default 1.88.0
-      - name: Build pure Python wheel
+      - name: Build internal base wheel for native assembly
         run: uv run --no-sync python -m build --wheel --outdir pure-dist
       - name: Build native runtime
         shell: pwsh
@@ -218,7 +218,8 @@ jobs:
           uv pip install --python .venv\Scripts\python.exe --no-deps --force-reinstall $wheel
           Remove-Item Env:HOL_GUARD_NATIVE -ErrorAction SilentlyContinue
           Remove-Item Env:HOL_GUARD_NATIVE_BINARY -ErrorAction SilentlyContinue
-          uv run --no-sync python ci/native_runtime/probe_native_default_auto.py
+          Remove-Item Env:HOL_GUARD_NATIVE_DEVELOPMENT -ErrorAction SilentlyContinue
+          uv run --no-sync python ci/native_runtime/probe_native_required.py
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: hol-guard-native-wheel-windows-x64
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8679190..28e0fa2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -363,17 +363,6 @@ jobs:
       - name: Record immutable distribution hashes
         run: |
           find dist -maxdepth 1 -type f -print0 | sort -z | xargs -0 sha256sum > distribution-sha256.txt
-      - name: Bind installed canary subject
-        if: github.event_name == 'pull_request'
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-          SOURCE_SHA: ${{ steps.version.outputs.source_sha }}
-        run: |
-          uv run --no-sync python scripts/installed_canary_proof.py write-subject \
-            --dist-dir dist \
-            --version "$VERSION" \
-            --source-sha "$SOURCE_SHA" \
-            --output installed-canary-subject.json
       - name: Upload artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
@@ -384,13 +373,6 @@ jobs:
         with:
           name: distribution-sha256
           path: distribution-sha256.txt
-      - name: Upload installed canary subject
-        if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          name: installed-canary-subject
-          path: installed-canary-subject.json
-          if-no-files-found: error
       - name: Upload release toolchain SBOM
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
@@ -552,6 +534,14 @@ jobs:
           pattern: native-guard-wheel-*
           path: dist/
           merge-multiple: true
+      - name: Remove non-publishable Guard base artifacts
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          rm -f \
+            "dist/hol_guard-${VERSION}-py3-none-any.whl" \
+            "dist/hol_guard-${VERSION}.tar.gz" \
+            "dist/hol-guard-${VERSION}.tar.gz"
       - name: Validate exact native artifact set
         env:
           SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
@@ -614,7 +604,7 @@ jobs:
       github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       contains(github.event.pull_request.labels.*.name, 'publish-testpypi-canary')
-    needs: [build, publish-testpypi]
+    needs: [build, publish-testpypi, assemble-native-guard-distributions]
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
@@ -640,10 +630,17 @@ jobs:
         with:
           name: distributions-native
           path: dist/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          name: installed-canary-subject
-          path: installed-canary/
+      - name: Bind the current platform native wheel
+        shell: bash
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+          SOURCE_SHA: ${{ needs.build.outputs.source_sha }}
+        run: |
+          uv run --no-project --with packaging==25.0 python scripts/installed_canary_proof.py write-subject \
+            --dist-dir dist \
+            --version "$VERSION" \
+            --source-sha "$SOURCE_SHA" \
+            --output installed-canary/installed-canary-subject.json
       - name: Download exact TestPyPI wheel bytes
         shell: bash
         env:
@@ -924,9 +921,18 @@ jobs:
             fi
             sleep 5
           done
-          wheel=$(jq -r '.install_paths[] | select(endswith("-py3-none-any.whl"))' <<< "$result")
+          wheel=$(jq -r '.install_paths[] | select(endswith("-py3-none-manylinux_2_17_x86_64.whl"))' <<< "$result")
           [[ -n "$wheel" ]]
           [[ "$(uv tool run --from "$wheel" hol-guard --version)" == "hol-guard $VERSION" ]]
+          rm -rf "$RUNNER_TEMP/native-published-venv"
+          uv venv --python 3.12 "$RUNNER_TEMP/native-published-venv"
+          uv pip install --python "$RUNNER_TEMP/native-published-venv/bin/python" --no-deps "$wheel"
+          (
+            cd "$RUNNER_TEMP"
+            env -u HOL_GUARD_NATIVE -u HOL_GUARD_NATIVE_BINARY -u HOL_GUARD_NATIVE_DEVELOPMENT \
+              "$RUNNER_TEMP/native-published-venv/bin/python" \
+              "$GITHUB_WORKSPACE/ci/native_runtime/probe_native_required.py"
+          )
           uv run --with packaging==25.0 python scripts/verify_native_runtime_release.py \
             verify-published --registry testpypi --version "$VERSION" \
             --source-sha "$SOURCE_SHA" --dist-dir dist
@@ -1049,9 +1055,18 @@ jobs:
             fi
             sleep 5
           done
-          wheel=$(jq -r '.install_paths[] | select(endswith("-py3-none-any.whl"))' <<< "$result")
+          wheel=$(jq -r '.install_paths[] | select(endswith("-py3-none-manylinux_2_17_x86_64.whl"))' <<< "$result")
           [[ -n "$wheel" ]]
           [[ "$(uv tool run --from "$wheel" hol-guard --version)" == "hol-guard $VERSION" ]]
+          rm -rf "$RUNNER_TEMP/native-published-venv"
+          uv venv --python 3.12 "$RUNNER_TEMP/native-published-venv"
+          uv pip install --python "$RUNNER_TEMP/native-published-venv/bin/python" --no-deps "$wheel"
+          (
+            cd "$RUNNER_TEMP"
+            env -u HOL_GUARD_NATIVE -u HOL_GUARD_NATIVE_BINARY -u HOL_GUARD_NATIVE_DEVELOPMENT \
+              "$RUNNER_TEMP/native-published-venv/bin/python" \
+              "$GITHUB_WORKSPACE/ci/native_runtime/probe_native_required.py"
+          )
           uv run --with packaging==25.0 python scripts/verify_native_runtime_release.py \
             verify-published --registry pypi --version "$VERSION" \
             --source-sha "$SOURCE_SHA" --dist-dir dist
diff --git a/.github/workflows/rust-command-shadow.yml b/.github/workflows/rust-command-shadow.yml
index f061e78..4e76990 100644
--- a/.github/workflows/rust-command-shadow.yml
+++ b/.github/workflows/rust-command-shadow.yml
@@ -77,7 +77,7 @@ jobs:
           rust/target/release/hol-guard-runtime self-test --json
       - name: Exercise resident command shadow bridge
         env:
-          HOL_GUARD_NATIVE: force
+          HOL_GUARD_NATIVE_DEVELOPMENT: "1"
           HOL_GUARD_NATIVE_BINARY: ${{ github.workspace }}/rust/target/release/hol-guard-runtime
         run: >-
           uv run --no-sync pytest
diff --git a/.github/workflows/rust-runtime-differential.yml b/.github/workflows/rust-runtime-differential.yml
index 7ab38f4..663383c 100644
--- a/.github/workflows/rust-runtime-differential.yml
+++ b/.github/workflows/rust-runtime-differential.yml
@@ -8,6 +8,8 @@ on:
       - "src/codex_plugin_scanner/guard/native_runtime_resident.py"
       - "src/codex_plugin_scanner/guard/runtime/hook_*.py"
       - "ci/native_runtime/test_guard_native_runtime_differential.py"
+      - "ci/native_runtime/test_guard_native_runtime_corpus.py"
+      - "tests/fixtures/hook_payloads/native-post-tool-corpus.v1.json"
       - ".github/workflows/rust-runtime-differential.yml"
   push:
     branches: [release/3.0]
@@ -17,6 +19,8 @@ on:
       - "src/codex_plugin_scanner/guard/native_runtime_resident.py"
       - "src/codex_plugin_scanner/guard/runtime/hook_*.py"
       - "ci/native_runtime/test_guard_native_runtime_differential.py"
+      - "ci/native_runtime/test_guard_native_runtime_corpus.py"
+      - "tests/fixtures/hook_payloads/native-post-tool-corpus.v1.json"
       - ".github/workflows/rust-runtime-differential.yml"
   workflow_dispatch:
 
@@ -55,8 +59,12 @@ jobs:
           export HOL_GUARD_PACKAGE_VERSION="$VERSION"
           cargo build --manifest-path rust/Cargo.toml --locked --release -p hol-guard-runtime
           rust/target/release/hol-guard-runtime self-test --json
-      - name: Compare Python and Rust decisions
+      - name: Verify resident, one-shot, and neutral-corpus Rust decisions
