 1:  80d69b3 =  1:  0edae4c chore(sdd): ledger and briefs for regression phase 1
 2:  4b7e843 =  2:  468d555 chore(sdd): ruling on v5 after cert phase 2 landed
 3:  c6e29b9 =  3:  4370002 feat(regression): signed production failure and regression case records; EvaluationRunRecord v5
 4:  ce5637c =  4:  957f88c chore(sdd): task 1 fix round 1
 5:  bb292ed =  5:  ab22aab chore(sdd): task 1 complete; briefs 2-3
 6:  da25f99 =  6:  f0b70fa chore(sdd): tasks 2-3 dispatched
 7:  a618467 =  7:  c351ed8 feat(regression): suite digest and per-case run comparison
 8:  772bdc4 =  8:  097f9fd feat(registry): look up evaluators by failure_mode
 9:  0ea9c30 =  9:  932783a chore(sdd): tasks 2-3 report and review package
10:  de4bfb0 = 10:  f35c5ce chore(sdd): tasks 2-3 complete; brief 4
11:  ce4fbbc ! 11:  025e533 feat(regression): Postgres store, migration 0097, v5 run columns
    @@ Commit message
         Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
         Claude-Session: https://claude.ai/code/session_01EKDrzzMkwRtAJRbCkButdd
     
    - ## alembic/versions/0097_regression_suite.py (new) ##
    + ## alembic/versions/0098_regression_suite.py (new) ##
     @@
     +"""regression suite: production failures, cases, waivers, retirements
     +
    @@ alembic/versions/0097_regression_suite.py (new)
     +new table carries the terminated-tenant freeze trigger, as 0093 does for
     +behaviour_manifests.
     +
    -+Revision ID: 0097
    -+Revises: 0096
    ++Revision ID: 0098
    ++Revises: 0097
     +"""
     +
     +from __future__ import annotations
    @@ alembic/versions/0097_regression_suite.py (new)
     +
     +from alembic import op
     +
    -+revision: str = "0097"
    -+down_revision: str | None = "0096"
    ++revision: str = "0098"
    ++down_revision: str | None = "0097"
     +branch_labels: str | Sequence[str] | None = None
     +depends_on: str | Sequence[str] | None = None
     +
    @@ alembic/versions/0097_regression_suite.py (new)
     +        op.drop_table(table)
     
      ## sengol/api/app.py ##
    -@@ sengol/api/app.py: from sengol.api.postgres_controlbook_store import PostgresControlBookStore
    - from sengol.api.postgres_eval_run_store import PostgresEvaluationRunStore
    +@@ sengol/api/app.py: from sengol.api.postgres_eval_run_store import PostgresEvaluationRunStore
      from sengol.api.postgres_gold_score_store import PostgresGoldScoreStore
      from sengol.api.postgres_human_review_store import PostgresHumanReviewQueue
    + from sengol.api.postgres_raw_trace_index_store import PostgresRawTraceIndexStore
     +from sengol.api.postgres_regression_store import PostgresRegressionStore
      from sengol.api.postgres_report_store import PostgresReportStore
      from sengol.api.postgres_saturation_store import PostgresSaturationStateStore
    @@ tests/api/test_regression_store_live_postgres.py (new)
     +    [(case, got)] = await store.active_cases("acme", "loan-advisor")
     +    assert got == text and case.input_hash == sha256_text(text)
     +    assert case.verify(InMemoryKeyRing(KEY))
    -
    - ## tests/store_manifest.json ##
    -@@
    -     "tests/api/test_storage_mode_guard.py"
    -   ],
    -   "package_code_sites": [
    --    "sengol/api/app.py:617",
    --    "sengol/api/app.py:859",
    -+    "sengol/api/app.py:619",
    -+    "sengol/api/app.py:869",
    -     "sengol/api/app.py:import",
    -     "sengol/governance/audit_store.py:537",
    -     "sengol/governance/audit_store.py:548",
12:  a56ca7d = 12:  faf6a14 chore(sdd): task 4 report + package
13:  cde73a2 = 13:  8356b4a chore(sdd): task 4 complete; briefs 5-6
14:  858a333 = 14:  5681703 feat(rbac): regression:review permission for reviewer roles
15:  13c6ac2 ! 15:  b1b60f8 feat(regression): /v1/regression confirm, promote, waive, retire, suite routes
    @@ docs/reference/console.md: on demand.
     
      ## pyproject.toml ##
     @@ pyproject.toml: extend-immutable-calls = [
    - "sengol.api.postgres_judge_build_run_store".msg = "ADR-0052: server-internal. Client-tier code (cli/, governance/, runtime/, dataset/, build/, evaluators/) reaches compliance data through the API tier — the Api*Sink classes or require_scope routes — never by importing server internals. #524."
      "sengol.api.postgres_mcp_pin_store".msg = "ADR-0052: server-internal. Client-tier code (cli/, governance/, runtime/, dataset/, build/, evaluators/) reaches compliance data through the API tier — the Api*Sink classes or require_scope routes — never by importing server internals. #524."
      "sengol.api.postgres_mcp_scan_log_store".msg = "ADR-0052: server-internal. Client-tier code (cli/, governance/, runtime/, dataset/, build/, evaluators/) reaches compliance data through the API tier — the Api*Sink classes or require_scope routes — never by importing server internals. #524."
    + "sengol.api.postgres_raw_trace_index_store".msg = "ADR-0052: server-internal. Client-tier code (cli/, governance/, runtime/, dataset/, build/, evaluators/) reaches compliance data through the API tier — the Api*Sink classes or require_scope routes — never by importing server internals. #524."
     +"sengol.api.postgres_regression_store".msg = "ADR-0052: server-internal. Client-tier code (cli/, governance/, runtime/, dataset/, build/, evaluators/) reaches compliance data through the API tier — the Api*Sink classes or require_scope routes — never by importing server internals. #524."
      "sengol.api.postgres_report_store".msg = "ADR-0052: server-internal. Client-tier code (cli/, governance/, runtime/, dataset/, build/, evaluators/) reaches compliance data through the API tier — the Api*Sink classes or require_scope routes — never by importing server internals. #524."
      "sengol.api.postgres_saturation_store".msg = "ADR-0052: server-internal. Client-tier code (cli/, governance/, runtime/, dataset/, build/, evaluators/) reaches compliance data through the API tier — the Api*Sink classes or require_scope routes — never by importing server internals. #524."
    @@ sengol/api/app.py: app.include_router(lifecycle_router)
      app.include_router(reports_router)
      app.include_router(console_router)
     
    - ## sengol/api/openapi.yaml ##
    -@@ sengol/api/openapi.yaml: paths:
    -           description: The credential is valid but not accepted for this operation. Under a validated token the `scope` claim
    -             does not contain `audit:write`; with no `SENGOL_JWT_SIGNING_KEY` set, the bearer does not match the server's `SENGOL_API_TOKEN`.
    -             The status does not distinguish them — the body's `detail` names which one applies.
    -+  /v1/regression/failures:
    -+    post:
    -+      tags:
    -+      - regression
    -+      summary: Confirm Failure
    -+      operationId: confirm_failure_v1_regression_failures_post
    -+      parameters:
    -+      - name: authorization
    -+        in: header
    -+        required: false
    -+        schema:
    -+          type: string
    -+          default: ''
    -+          title: Authorization
    -+      requestBody:
    -+        required: true
    -+        content:
    -+          application/json:
    -+            schema:
    -+              $ref: '#/components/schemas/ConfirmIn'
    -+      responses:
    -+        '201':
    -+          description: Successful Response
    -+          content:
    -+            application/json:
    -+              schema: {}
    -+        '422':
    -+          description: Validation Error
    -+          content:
    -+            application/json:
    -+              schema:
    -+                $ref: '#/components/schemas/HTTPValidationError'
    -+        '401':
    -+          description: 'The request carries no usable credential: no `Authorization: Bearer` header and no session cookie
    -+            the deployment accepts, or a token that fails validation. Refused before the handler runs.'
    -+        '403':
    -+          description: The credential is valid but not accepted for this operation. Under a validated token the `scope` claim
    -+            does not contain `regression:review`; with no `SENGOL_JWT_SIGNING_KEY` set, the bearer does not match the server's
    -+            `SENGOL_API_TOKEN`. The status does not distinguish them — the body's `detail` names which one applies.
    -+    get:
    -+      tags:
    -+      - regression
    -+      summary: List Failures
    -+      operationId: list_failures_v1_regression_failures_get
    -+      parameters:
    -+      - name: agent_id
    -+        in: query
    -+        required: true
    -+        schema:
    -+          type: string
    -+          title: Agent Id
    -+      - name: state
    -+        in: query
    -+        required: false
    -+        schema:
    -+          anyOf:
    -+          - type: string
    -+          - type: 'null'
    -+          title: State
    -+      - name: authorization
    -+        in: header
    -+        required: false
    -+        schema:
    -+          type: string
    -+          default: ''
    -+          title: Authorization
    -+      responses:
    -+        '200':
    -+          description: Successful Response
    -+          content:
    -+            application/json:
    -+              schema: {}
    -+        '422':
    -+          description: Validation Error
    -+          content:
    -+            application/json:
    -+              schema:
    -+                $ref: '#/components/schemas/HTTPValidationError'
    -+        '401':
    -+          description: 'The request carries no usable credential: no `Authorization: Bearer` header and no session cookie
    -+            the deployment accepts, or a token that fails validation. Refused before the handler runs.'
    -+        '403':
    -+          description: The credential is valid but not accepted for this operation. Under a validated token the `scope` claim
    -+            does not contain `audit:read`; with no `SENGOL_JWT_SIGNING_KEY` set, the bearer does not match the server's `SENGOL_API_TOKEN`.
    -+            The status does not distinguish them — the body's `detail` names which one applies.
    -+  /v1/regression/failures/{failure_id}/promote:
    -+    post:
    -+      tags:
    -+      - regression
    -+      summary: Promote Failure
    -+      operationId: promote_failure_v1_regression_failures__failure_id__promote_post
    -+      parameters:
    -+      - name: failure_id
    -+        in: path
    -+        required: true
    -+        schema:
    -+          type: string
    -+          title: Failure Id
    -+      - name: authorization
    -+        in: header
    -+        required: false
    -+        schema:
    -+          type: string
    -+          default: ''
    -+          title: Authorization
    -+      requestBody:
    -+        required: true
    -+        content:
    -+          application/json:
    -+            schema:
    -+              $ref: '#/components/schemas/PromoteIn'
    -+      responses:
    -+        '201':
    -+          description: Successful Response
    -+          content:
    -+            application/json:
    -+              schema: {}
    -+        '422':
    -+          description: Validation Error
    -+          content:
    -+            application/json:
    -+              schema:
    -+                $ref: '#/components/schemas/HTTPValidationError'
    -+        '401':
    -+          description: 'The request carries no usable credential: no `Authorization: Bearer` header and no session cookie
    -+            the deployment accepts, or a token that fails validation. Refused before the handler runs.'
    -+        '403':
    -+          description: The credential is valid but not accepted for this operation. Under a validated token the `scope` claim
    -+            does not contain `audit:write`; with no `SENGOL_JWT_SIGNING_KEY` set, the bearer does not match the server's `SENGOL_API_TOKEN`.
    -+            The status does not distinguish them — the body's `detail` names which one applies.
    -+  /v1/regression/failures/{failure_id}/waive:
    -+    post:
    -+      tags:
    -+      - regression
    -+      summary: Waive Failure
    -+      operationId: waive_failure_v1_regression_failures__failure_id__waive_post
    -+      parameters:
    -+      - name: failure_id
    -+        in: path
    -+        required: true
    -+        schema:
    -+          type: string
    -+          title: Failure Id
    -+      - name: authorization
    -+        in: header
    -+        required: false
    -+        schema:
    -+          type: string
    -+          default: ''
    -+          title: Authorization
    -+      requestBody:
    -+        required: true
    -+        content:
    -+          application/json:
    -+            schema:
    -+              $ref: '#/components/schemas/ReasonIn'
    -+      responses:
    -+        '201':
    -+          description: Successful Response
    -+          content:
    -+            application/json:
    -+              schema: {}
    -+        '422':
    -+          description: Validation Error
    -+          content:
    -+            application/json:
    -+              schema:
    -+                $ref: '#/components/schemas/HTTPValidationError'
    -+        '401':
    -+          description: 'The request carries no usable credential: no `Authorization: Bearer` header and no session cookie
    -+            the deployment accepts, or a token that fails validation. Refused before the handler runs.'
    -+        '403':
    -+          description: The credential is valid but not accepted for this operation. Under a validated token the `scope` claim
    -+            does not contain `regression:review`; with no `SENGOL_JWT_SIGNING_KEY` set, the bearer does not match the server's
    -+            `SENGOL_API_TOKEN`. The status does not distinguish them — the body's `detail` names which one applies.
    -+  /v1/regression/cases/{case_id}/retire:
    -+    post:
    -+      tags:
    -+      - regression
    -+      summary: Retire Case
    -+      operationId: retire_case_v1_regression_cases__case_id__retire_post
    -+      parameters:
    -+      - name: case_id
    -+        in: path
    -+        required: true
    -+        schema:
    -+          type: string
    -+          title: Case Id
    -+      - name: authorization
    -+        in: header
    -+        required: false
    -+        schema:
    -+          type: string
    -+          default: ''
    -+          title: Authorization
    -+      requestBody:
    -+        required: true
    -+        content:
    -+          application/json:
    -+            schema:
    -+              $ref: '#/components/schemas/ReasonIn'
    -+      responses:
    -+        '201':
    -+          description: Successful Response
    -+          content:
    -+            application/json:
    -+              schema: {}
    -+        '422':
    -+          description: Validation Error
    -+          content:
    -+            application/json:
    -+              schema:
    -+                $ref: '#/components/schemas/HTTPValidationError'
    -+        '401':
    -+          description: 'The request carries no usable credential: no `Authorization: Bearer` header and no session cookie
    -+            the deployment accepts, or a token that fails validation. Refused before the handler runs.'
    -+        '403':
    -+          description: The credential is valid but not accepted for this operation. Under a validated token the `scope` claim
    -+            does not contain `regression:review`; with no `SENGOL_JWT_SIGNING_KEY` set, the bearer does not match the server's
    -+            `SENGOL_API_TOKEN`. The status does not distinguish them — the body's `detail` names which one applies.
    -+  /v1/regression/suite:
    -+    get:
    -+      tags:
    -+      - regression
    -+      summary: Get Suite
    -+      operationId: get_suite_v1_regression_suite_get
    -+      parameters:
    -+      - name: agent_id
    -+        in: query
    -+        required: true
    -+        schema:
    -+          type: string
    -+          title: Agent Id
    -+      - name: authorization
    -+        in: header
    -+        required: false
    -+        schema:
    -+          type: string
    -+          default: ''
    -+          title: Authorization
    -+      responses:
    -+        '200':
    -+          description: Successful Response
    -+          content:
    -+            application/json:
    -+              schema: {}
    -+        '422':
    -+          description: Validation Error
    -+          content:
    -+            application/json:
    -+              schema:
    -+                $ref: '#/components/schemas/HTTPValidationError'
    -+        '401':
    -+          description: 'The request carries no usable credential: no `Authorization: Bearer` header and no session cookie
    -+            the deployment accepts, or a token that fails validation. Refused before the handler runs.'
    -+        '403':
    -+          description: The credential is valid but not accepted for this operation. Under a validated token the `scope` claim
    -+            does not contain `audit:read`; with no `SENGOL_JWT_SIGNING_KEY` set, the bearer does not match the server's `SENGOL_API_TOKEN`.
    -+            The status does not distinguish them — the body's `detail` names which one applies.
    -+  /v1/regression/runs/latest:
    -+    get:
    -+      tags:
    -+      - regression
    -+      summary: Latest Run
    -+      operationId: latest_run_v1_regression_runs_latest_get
    -+      parameters:
    -+      - name: agent_id
    -+        in: query
    -+        required: true
    -+        schema:
    -+          type: string
    -+          title: Agent Id
    -+      - name: authorization
    -+        in: header
    -+        required: false
    -+        schema:
    -+          type: string
    -+          default: ''
    -+          title: Authorization
    -+      responses:
    -+        '200':
    -+          description: Successful Response
    -+          content:
    -+            application/json:
    -+              schema: {}
    -+        '422':
    -+          description: Validation Error
    -+          content:
    -+            application/json:
    -+              schema:
    -+                $ref: '#/components/schemas/HTTPValidationError'
    -+        '401':
    -+          description: 'The request carries no usable credential: no `Authorization: Bearer` header and no session cookie
    -+            the deployment accepts, or a token that fails validation. Refused before the handler runs.'
    -+        '403':
    -+          description: The credential is valid but not accepted for this operation. Under a validated token the `scope` claim
    -+            does not contain `audit:read`; with no `SENGOL_JWT_SIGNING_KEY` set, the bearer does not match the server's `SENGOL_API_TOKEN`.
    -+            The status does not distinguish them — the body's `detail` names which one applies.
    -   /v1/drift/pending-approvals/{review_id}:
    -     put:
    -       tags:
    -@@ sengol/api/openapi.yaml: components:
    -       - updated_by
    -       - updated_at
    -       title: AuthorizationPolicyResponse
    -+    BindingIn:
    -+      properties:
    -+        evaluator:
    -+          type: string
    -+          title: Evaluator
    -+        config:
    -+          additionalProperties: true
    -+          type: object
    -+          title: Config
    -+        reference:
    -+          anyOf:
    -+          - type: string
    -+          - type: 'null'
    -+          title: Reference
    -+      type: object
    -+      required:
    -+      - evaluator
    -+      title: BindingIn
    -     BreakGlassArmResponse:
    -       properties:
    -         secret:
    -@@ sengol/api/openapi.yaml: components:
    -       required:
    -       - armed
    -       title: BreakGlassStatus
    -+    CaseResult:
    -+      properties:
    -+        case_id:
    -+          type: string
    -+          title: Case Id
    -+        passed:
    -+          type: boolean
    -+          title: Passed
    -+        failure_mode:
    -+          anyOf:
    -+          - type: string
    -+          - type: 'null'
    -+          title: Failure Mode
    -+      type: object
    -+      required:
    -+      - case_id
    -+      - passed
    -+      title: CaseResult
    -+      description: Binary outcome of one regression case inside a v5 run.
    -     CertificationHistoryResponse:
    -       properties:
    -         agent_id:
    -@@ sengol/api/openapi.yaml: components:
    -       - version
    -       - compiled_at
    -       title: CompiledRegulation
    -+    ConfirmIn:
    -+      properties:
    -+        agent_id:
    -+          type: string
    -+          title: Agent Id
    -+        audit_record_id:
    -+          type: string
    -+          title: Audit Record Id
    -+        trace_id:
    -+          type: string
    -+          title: Trace Id
    -+        failure_mode:
    -+          type: string
    -+          minLength: 1
    -+          title: Failure Mode
    -+        note:
    -+          type: string
    -+          minLength: 1
    -+          title: Note
    -+        first_failure_span_id:
    -+          anyOf:
    -+          - type: string
    -+          - type: 'null'
    -+          title: First Failure Span Id
    -+      type: object
    -+      required:
    -+      - agent_id
    -+      - audit_record_id
    -+      - trace_id
    -+      - failure_mode
    -+      - note
    -+      title: ConfirmIn
    -     ConsoleKeyStatus:
    -       properties:
    -         key_id:
    -@@ sengol/api/openapi.yaml: components:
    -           - type: boolean
    -           - type: 'null'
    -           title: Mounts Complete
    -+        regression_suite_digest:
    -+          anyOf:
    -+          - type: string
    -+          - type: 'null'
    -+          title: Regression Suite Digest
    -+        case_results:
    -+          anyOf:
    -+          - items:
    -+              $ref: '#/components/schemas/CaseResult'
    -+            type: array
    -+          - type: 'null'
    -+          title: Case Results
    -         key_id:
    -           type: string
    -           title: Key Id
    -@@ sengol/api/openapi.yaml: components:
    -       - policy_id
    -       - display_name
    -       title: PolicyRef
    -+    PromoteIn:
    -+      properties:
    -+        bindings:
    -+          items:
    -+            $ref: '#/components/schemas/BindingIn'
    -+          type: array
    -+          title: Bindings
    -+      type: object
    -+      title: PromoteIn
    -     PutPendingApprovalRequest:
    -       properties:
    -         agent_id:
    -@@ sengol/api/openapi.yaml: components:
    -       - quarter
    -       - score
    -       title: QuarterPoint
    -+    ReasonIn:
    -+      properties:
    -+        reason:
    -+          type: string
    -+          minLength: 1
    -+          title: Reason
    -+      type: object
    -+      required:
    -+      - reason
    -+      title: ReasonIn
    -     RecertCompleteRequest:
    -       properties:
    -         event_record_id:
    -
      ## sengol/api/v1/regression.py (new) ##
     @@
     +"""Production failure -> regression suite routes.
16:  7010351 = 16:  28dfeed chore(sdd): tasks 5-6 report + package
17:  f3a21bc = 17:  98223b0 chore(sdd): tasks 5-6 complete
18:  0031093 = 18:  8306a23 chore(sdd): rebase conflict ruling
 -:  ------- > 19:  05cd4f9 chore: regenerate store manifest after rebase
 -:  ------- > 20:  5e0f5a0 chore: regenerate openapi.yaml after rebase
