diff --git a/plugins/autonomy/.claude-plugin/plugin.json b/plugins/autonomy/.claude-plugin/plugin.json
index 5ef982bc1..e1856de5e 100644
--- a/plugins/autonomy/.claude-plugin/plugin.json
+++ b/plugins/autonomy/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "autonomy",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "Governed autonomous agent operation: role-topology, binding-seam, wiring-vs-advisor, telemetry, return-accounting, trigger-dispatch, per-work-class guardrail-matrix, standing-routine-catalog, and design-only runner-charter contracts for climbing the AI-adoption ladder, plus a guided-setup skill that discovers an adopting org's state, writes its schema-versioned binding, wires standards-pinned OTLP emission with a zero-cost file-artifact default, wires human-attested return capture at the task boundary, wires signal adapters with one governed dispatch entrypoint, binds the five-class guardrail matrix to an org's isolation substrates with an in-boundary live-validation probe before recording each fail-closed binding, and stands up standing-routine-catalog classes as scheduled temporal signal adapters behind the one governed queue with free scheduling defaults wired as reviewable changes and each routine's work-class mapping homed on the security surface.",
   "author": {
     "name": "Melodic Software",
@@ -25,7 +25,7 @@
     "lane_stop_gate_enabled": {
       "type": "boolean",
       "title": "lane-stop gate",
-      "description": "Opt an autonomous lane into the deterministic Stop-hook completion gate. Default OFF \u2014 a Stop-blocking hook must never engage for an interactive session. Honored from user or managed settings only (the gate reads those files itself); per-session lanes are armed by the claude-ops lane launcher instead. The env mirror is never authority (#1784).",
+      "description": "Opt an autonomous lane into the deterministic Stop-hook completion gate. Default OFF — a Stop-blocking hook must never engage for an interactive session. Honored from user or managed settings only (the gate reads those files itself); per-session lanes are armed by the claude-ops lane launcher instead. The env mirror is never authority (#1784).",
       "default": false
     },
     "lane_stop_gate_sentinel": {
@@ -43,7 +43,7 @@
     "lane_stop_gate_arm_id": {
       "type": "string",
       "title": "lane-stop gate arm id (launcher-managed)",
-      "description": "Written by the lane launcher at launch: names this session's arm record in the plugin's own data directory (hooks/lane-stop-gate-arm.sh). A capability pointer, never authority by itself \u2014 the gate validates it, honors only a record in its install-derived store, and binds it to the first presenting session. Not set by hand.",
+      "description": "Written by the lane launcher at launch: names this session's arm record in the plugin's own data directory (hooks/lane-stop-gate-arm.sh). A capability pointer, never authority by itself — the gate validates it, honors only a record in its install-derived store, and binds it to the first presenting session. Not set by hand.",
       "default": ""
     },
     "lane_notify_enabled": {
@@ -63,6 +63,18 @@
       "title": "lane-notify terminal channel",
       "description": "Audible bell + OSC 9 notification written to the controlling terminal for the lane-stop alert.",
       "default": true
+    },
+    "verification_lens_pool": {
+      "type": "string",
+      "title": "verification lens pool",
+      "description": "Ordered, comma-separated pool of verification lenses the model-adjudicated checker slots draw from — one distinct lens per slot, in pool order. Tokens come from the closed vocabulary in the verification-topology contract leaf; an unrecognized token is recorded as unresolved and draws no lens, and a pool shorter than a class's model-adjudicated slot count leaves the remaining slots unlensed rather than repeating a lens. The pool contributes to no count: how many checkers a class runs, how they must differ, and whether one must be cross-vendor are floors on the org's security binding, outside this setting's reach.",
+      "default": "specification,adversarial,contract,regression,evidence"
+    },
+    "visual_narration_enabled": {
+      "type": "boolean",
+      "title": "advisory visual narration lane",
+      "description": "Run the advisory visual narration lane: strictly downstream of deterministic detection, it writes a plain-language account of a difference the deterministic layer already found and attaches it to the run record for the human gate. Advisory only — it emits no verdict, fills no checker slot, is counted by no floor, and never gates a transition; no cell anywhere names it as authority. Default OFF: it is inert without an upstream deterministic comparator, and each narrated artifact is a metered vision-model call.",
+      "default": false
     }
   }
 }
diff --git a/plugins/autonomy/CHANGELOG.md b/plugins/autonomy/CHANGELOG.md
index 58d81d1b6..ba62c11d9 100644
--- a/plugins/autonomy/CHANGELOG.md
+++ b/plugins/autonomy/CHANGELOG.md
@@ -6,6 +6,47 @@ All notable changes to the `autonomy` plugin are documented here. Format follows
 Versions 0.1.0–0.7.0 predate this file (introduced with 0.7.1); their history lives in the
 merged work-package PRs (#333, #343, #356, #372, #377, #600, #676).
 
+## [0.16.0]
+
+### Changed — ACTION REQUIRED for anyone with an existing `L2`/`L3` binding, or auto-merge bound
+
+- **Every `L2`/`L3` level binding now carries `component_reachable_hosts`, and a level without it
+  is UNPROVEN.** Target selection is what makes the egress assertion mean anything: a probe that
+  samples only hosts the surface's installed components never request certifies a boundary that is
+  in fact open. Measured, not theorized — 201,961 bytes of origin data crossed a global
+  default-deny through a component-installed allow rule. The field is the human-ratified set of
+  destinations those components may request, and the probe must cover it in FULL, since each
+  destination is a separate policy decision. **The empty list is a valid and meaningful value:** it
+  is the explicit claim that the surface installs nothing carrying policy rules of its own. **To
+  restore dispatch: ratify the list (or the empty list) on the level entry and re-probe so the
+  transcript covers it.**
+- **A class bound `auto` merge with a verification layer below `blocking` is now an INVALID
+  binding.** An automatic transition requires unanimous agreement among the checkers the class
+  declares, and an advisory layer records a dissent without withholding the transition — so the
+  configuration promised a gate it could not deliver. Bindings that encoded this are rejected with
+  a finding naming the remedy. **To restore: set the layer to `blocking` (ratifying its promotion
+  cell where promotable), or bind the class to `human` merge.** Demotion now cascades from the
+  `C3` AI-review cell to `C3` auto-merge for the same reason.
+
+### Added
+
+- **Verification topology** (`reference/guardrails/verification-topology.md` + a sixth guardrail
+  matrix column): who verifies a change, how those verifiers must differ, and the per-class floor
+  for how many there are — expressed as pipeline roles, relational constraints, and predicates a
+  binding can actually evaluate, with no capability label anywhere in the contract. Floors ship as
+  `min_checkers` and `min_model_checkers` per class, both tighten-only on the agent-unwritable
+  security binding. `cross_vendor_required` is never vacuously satisfiable, and vendor disjointness
+  holds among the model-adjudicated slots rather than only against the generator.
+- **`verification_topology`** as an optional top-level security-binding key modeling all three axes.
+  Absent is not a hole — the shipped floors apply, as `escalation_severity` already does — so
+  `schema_version` stays `"1.0"` and every existing binding keeps validating.
+- **Two `userConfig` options:** `verification_lens_pool` (what angle each model-adjudicated checker
+  is asked to take) and `visual_narration_enabled` (an advisory narration lane, default off). Both
+  live on the operator surface rather than the security binding because neither counts anything —
+  the pool seats no slot and the lane has no binding cell at all, so neither can weaken a floor.
+  The lane is structurally incapable of gating: no cell exists anywhere through which authority
+  could be granted to it.
+
 ## [0.15.1]
 
 ### Changed
diff --git a/plugins/autonomy/README.md b/plugins/autonomy/README.md
index b619ab312..72a2af2b6 100644
--- a/plugins/autonomy/README.md
+++ b/plugins/autonomy/README.md
@@ -26,10 +26,11 @@ state and records that binding.
   lease) — plus the setup trigger/dispatch slice, its adapter and acknowledgment templates,
   and the signal-envelope conformance check.
 - **Guardrail matrix** (`reference/guardrails.md`): five semantic work classes (`C1`–`C5`)
-  crossed with five enforcement columns — isolation floor, verification layers, merge policy,
-  cost tier, escalation — as one progressive-disclosure hub with on-demand leaves (isolation
-  ladder, work classes, security review, admission policy), human-ratified promotion with
-  automatic fail-closed demotion, and a two-surface binding split by governance sensitivity
+  crossed with six enforcement columns — isolation floor, verification layers, verification
+  topology, merge policy, cost tier, escalation — as one progressive-disclosure hub with
+  on-demand leaves (isolation ladder, work classes, security review, verification topology,
+  admission policy), human-ratified promotion with automatic fail-closed demotion, and a
+  two-surface binding split by governance sensitivity
   (security axes on the settings-as-code home outside agent blast radius; non-security remaps
   repo-local) — plus the contract-owned security-binding schema and its semantic check, and the
   setup guardrail slice that detects substrates per surface, live-validates isolation with an
@@ -192,6 +193,8 @@ reads it from.
 | `lane_notify_enabled` | boolean | `true` | `CLAUDE_PLUGIN_OPTION_LANE_NOTIFY_ENABLED` | Master switch for the operator alert fired when a lane stops without signaling completion. |
 | `lane_notify_os_toast_enabled` | boolean | `true` | `CLAUDE_PLUGIN_OPTION_LANE_NOTIFY_OS_TOAST_ENABLED` | OS-native desktop toast (macOS/Linux) for the lane-stop alert. |
 | `lane_notify_terminal_enabled` | boolean | `true` | `CLAUDE_PLUGIN_OPTION_LANE_NOTIFY_TERMINAL_ENABLED` | Audible bell + OSC 9 notification written to the controlling terminal for the lane-stop alert. |
+| `verification_lens_pool` | string | `"specification,adversarial,contract,regression,evidence"` | `CLAUDE_PLUGIN_OPTION_VERIFICATION_LENS_POOL` | Ordered, comma-separated pool of verification lenses the model-adjudicated checker slots draw from — one distinct lens per slot, in pool order. Tokens come from the closed vocabulary in the verification-topology contract leaf; an unrecognized token is recorded as unresolved and draws no lens, and a pool shorter than a class's model-adjudicated slot count leaves the remaining slots unlensed rather than repeating a lens. The pool contributes to no count: how many checkers a class runs, how they must differ, and whether one must be cross-vendor are floors on the org's security binding, outside this setting's reach. |
+| `visual_narration_enabled` | boolean | `false` | `CLAUDE_PLUGIN_OPTION_VISUAL_NARRATION_ENABLED` | Run the advisory visual narration lane: strictly downstream of deterministic detection, it writes a plain-language account of a difference the deterministic layer already found and attaches it to the run record for the human gate. Advisory only — it emits no verdict, fills no checker slot, is counted by no floor, and never gates a transition; no cell anywhere names it as authority. Default OFF: it is inert without an upstream deterministic comparator, and each narrated artifact is a metered vision-model call. |
 
 ### How to set these
 
diff --git a/plugins/autonomy/reference/autonomous-pipeline-reminder.md b/plugins/autonomy/reference/autonomous-pipeline-reminder.md
index f28dfb867..24d0782bc 100644
--- a/plugins/autonomy/reference/autonomous-pipeline-reminder.md
+++ b/plugins/autonomy/reference/autonomous-pipeline-reminder.md
@@ -106,9 +106,9 @@ the rest — not a gate presented as if it covered all seven.
 ## Provenance
 
 The clause set is this repository's own wording of guidance published in a model vendor's prompting
-guide for its frontier model. It is authored here rather than reproduced, per this repository's rule
-against hand-copying upstream content — so it is a locally-owned artifact that cannot silently drift
-out of sync with a copy, while the guide stays the thing to read when the upstream advice changes.
+guide. It is authored here rather than reproduced, per this repository's rule against hand-copying
+upstream content — so it is a locally-owned artifact that cannot silently drift out of sync with a
+copy, while the guide stays the thing to read when the upstream advice changes.
 
 **The citation, the exact section, and the recheck trigger live in the plugin
 [`README.md`](../README.md), not here.** These `reference/` contracts are written in surface classes
diff --git a/plugins/autonomy/reference/guardrails.md b/plugins/autonomy/reference/guardrails.md
index 506658295..4fb19ce15 100644
--- a/plugins/autonomy/reference/guardrails.md
+++ b/plugins/autonomy/reference/guardrails.md
@@ -1,7 +1,7 @@
 # Guardrails
 
 Normative contract for per-work-class guardrail enforcement: five semantic risk classes
-(`C1`–`C5`) crossed with five guardrail columns, in one matrix. This document is the hub and
+(`C1`–`C5`) crossed with six guardrail columns, in one matrix. This document is the hub and
 glance layer of a progressive-disclosure contract — the matrix plus the one-line class and
 column definitions below alone answer "what governs class X"; every deeper question routes to
 a named leaf under `guardrails/`, loaded on demand. Vocabulary is contract-owned; every
@@ -16,13 +16,13 @@ guardrail axis. That sentence is the playbook's; the five-class taxonomy, the pe
 blocking knobs, and the promotion predicates that fill the cells are this contract's own
 instantiation of it — the playbook names the obligation, this contract supplies the mechanism.
 
-| Class | Min isolation (unattended) | Verification | Merge policy | Cost tier | Escalation |
-|---|---|---|---|---|---|
-| C1 | L2 (exfil surface remains) | output-shape checks | n/a; artifacts via queue audit trail | economy | low |
-| C2 | L2 | deterministic blocking | auto-merge ELIGIBLE after per-class promotion trigger; ships human-gated | economy | gate failure → human |
-| C3 | L2 | deterministic blocking + AI review (advisory, promotable per [the security-review policy](guardrails/security-review.md)) | auto-merge ELIGIBLE after per-class promotion trigger; ships human-gated | standard | divergence/failed verify → human |
-| C4 | L2 | deterministic + AI + human review mandatory | human merge always | premium | upfront plan approval |
-| C5 | L3 | full gates + zero secret exposure | human merge always | standard | always |
+| Class | Min isolation (unattended) | Verification | Verification topology | Merge policy | Cost tier | Escalation |
+|---|---|---|---|---|---|---|
+| C1 | L2 (exfil surface remains) | output-shape checks | 1 checker | n/a; artifacts via queue audit trail | economy | low |
+| C2 | L2 | deterministic blocking | 1 checker | auto-merge ELIGIBLE after per-class promotion trigger; ships human-gated | economy | gate failure → human |
+| C3 | L2 | deterministic blocking + AI review (advisory, promotable per [the security-review policy](guardrails/security-review.md)) | 2 distinct checkers, 1 a model judge | auto-merge ELIGIBLE after per-class promotion trigger; ships human-gated | standard | divergence/failed verify → human |
+| C4 | L2 | deterministic + AI + human review mandatory | 3 distinct checkers, 2 vendor-disjoint model judges | human merge always | premium | upfront plan approval |
+| C5 | L3 | full gates + zero secret exposure | 3 distinct checkers, 2 vendor-disjoint model judges | human merge always | standard | always |
 
 ### Classes
 
@@ -40,6 +40,10 @@ instantiation of it — the playbook names the obligation, this contract supplie
   for running the class unattended.
 - **Verification** — the gate layers a change must pass, with per-layer blocking knobs bound
   on the governance surface.
+- **Verification topology** — the floor for how many DISTINCT checker slots verify the class
+  and whether they must be vendor-disjoint; roles, relational constraints, and predicates are
+  contract vocabulary, instances org-bound. The leaf owns these floor values; the cells above
+  are their glance restatement.
 - **Merge policy** — who lands the change; promotion-gated where the cell says so.
 - **Cost tier** — contract vocabulary (`economy` | `standard` | `premium`); the org binds
   tiers to model instances. Policy vocabulary only — cost enforcement is out of scope.
@@ -56,6 +60,7 @@ answered from this document:
 | What each level means, which substrate classes satisfy it, what happens when none does | [isolation-ladder](guardrails/isolation-ladder.md) |
 | What exactly is in each class, and how a promotable cell promotes or demotes | [work-classes](guardrails/work-classes.md) |
 | Which verification layers exist and which block, per class | [security-review](guardrails/security-review.md) |
+| Which roles verify a class, how they must differ, and the shipped checker floors | [verification-topology](guardrails/verification-topology.md) |
 | Which signals may enter the queue autonomously, and under what caps | [admission-policy](guardrails/admission-policy.md) |
 
 ## Permission posture
@@ -65,6 +70,15 @@ per-action prompts remain the control; at `L2` and above the whole-process bound
 control, replacing per-action prompts. The [isolation-ladder](guardrails/isolation-ladder.md)
 leaf carries this note in context.
 
+## Automatic transitions
+
+Unanimity is not a matrix column: every transition a run takes without a human — merge and
+every stage before it — requires unanimous agreement among the checkers the class declares,
+and one dissent hands the item to the human gate and raises `verification-divergence` below.
+It is a fixed invariant, not a knob, so no cell above can express it. The
+[verification-topology](guardrails/verification-topology.md) leaf carries it in context,
+including what is enforced at binding-validity time today and what is deferred.
+
 ## Escalation
 
 Six escalation event classes:
@@ -72,7 +86,7 @@ Six escalation event classes:
 | Event class | Fires when |
 |---|---|
 | `gate-failure` | a blocking verification gate fails |
-| `verification-divergence` | a verification outcome diverges from the expected or claimed result |
+| `verification-divergence` | a verification outcome diverges from the expected or claimed result, or two checkers of one class disagree |
 | `admission-rejection` | the admission seam rejects a signal as an audited rejection |
 | `demotion` | contrary evidence automatically demotes a promoted cell |
 | `structural-plan-approval` | a `C4` item requires upfront plan approval before execution |
diff --git a/plugins/autonomy/reference/guardrails/isolation-ladder.md b/plugins/autonomy/reference/guardrails/isolation-ladder.md
index c69bf642f..30cc968c3 100644
--- a/plugins/autonomy/reference/guardrails/isolation-ladder.md
+++ b/plugins/autonomy/reference/guardrails/isolation-ladder.md
@@ -13,7 +13,8 @@ document names substrate CLASSES as marked examples only, never an instance list
   tools, hooks, and protocol-connected tool surfaces still execute on the host. An attended
   ergonomics tier — NOT an autonomy tier.
 - **`L2` — whole-process OS-enforced boundary with default-deny egress, credential
-  protection, and contained workspace host-writes.** The MINIMUM for any unattended run.
+  protection, contained workspace host-writes, and policy nothing the run can install may
+  widen.** The MINIMUM for any unattended run.
   Free-path substrate classes (marked examples, not an instance list): a whole-process
   OS-sandbox wrap; a container with a default-deny egress firewall.
 
@@ -23,6 +24,16 @@ document names substrate CLASSES as marked examples only, never an instance list
   host later executes — a version-control config file is a command key ring, and one of its keys
   fires on a read-only-looking status call. Scope is deliberately WRITE containment: read
   exposure is not covered at this level, and a copy-on-read workspace leaves reads fully open.
+
+  The widening clause names a DIRECTION, because that is what generalizes. An additive policy
+  layer — one whose installed components carry rules of their own, in the sense of extension
+  permissions, admission control, or any engine that composes its rules from parts — meets `L2`
+  only where a component's rules can subtract reachability and never add it. A surface where an
+  installed component can add an allow rule the base policy denies is not `L2` however strict that
+  base policy reads, because the run manufactures its own exception at install time; the failure is
+  measured, not hypothetical — a component installed while the environment was being created
+  carried egress past a global default-deny and origin data flowed. Until governance is configured
+  so component rules can only narrow, the surface is not `L2`-capable.
 - **`L3` — kernel-separated ephemeral environment.** Substrate classes (marked examples): a
   VM or microVM; a hosted ephemeral executor surface. Required where policy demands kernel
   separation — untrusted-provenance (`C5`) work.
diff --git a/plugins/autonomy/reference/guardrails/verification-topology.md b/plugins/autonomy/reference/guardrails/verification-topology.md
new file mode 100644
index 000000000..dbba14417
--- /dev/null
+++ b/plugins/autonomy/reference/guardrails/verification-topology.md
@@ -0,0 +1,294 @@
+# Verification topology
+
+Normative leaf of the [guardrail contract](../guardrails.md): WHO verifies a change, how those
+verifiers must differ from each other, and the per-class floor for how many there are. The
+[security-review leaf](security-review.md) owns which verification LAYERS exist and which of them
+gate a merge; this leaf owns the population that runs them. Roles, constraints, and predicates are
+contract vocabulary; every concrete model instance is an org-binding outcome on the binding seam.
+
+## Roles
+
+Roles are properties of THIS pipeline, not of any vendor's roster, so a roster change never edits
+policy — only the binding that resolves a role to an instance.
+
+| Role | Adjudicates |
+|---|---|
+| `generator` | produces the artifact under verification |
+| `checker` | judges that artifact, in isolation from every other checker |
+| `cross_vendor_checker` | the role a class uses to require vendor disjointness where its own floor does not — under `cross_vendor_required`, every model-adjudicated slot already carries it |
+| `ranker` | orders candidates or findings relative to each other rather than scoring one absolutely |
+
+## Checker slots
+
+A class's topology declares a list of checker SLOTS, and a slot is filled by either a DETERMINISTIC
+layer or a MODEL-ADJUDICATED role. The distinction is load-bearing: a deterministic layer has no
+model or vendor identity, so the relational constraints and predicates below bind only
+model-adjudicated slots and are never required of a deterministic one.
+
+**Distinctness is REQUIRED on every slot and cannot be opted out of.** Two slots are distinct only
+where they cannot share a failure mode: deterministic slots are distinguished by scanner class,
+model-adjudicated slots by resolved model identity. **Two slots that resolve identically declare ONE
+checker**, and a binding whose distinct-slot count falls below its class floor is invalid.
+
+A slot NAME tells a validator nothing about what the slot resolves to, so distinctness that is only
+intended is not distinctness. **The binding establishes it explicitly**: every model-adjudicated
+checker slot declares `distinct_model_from` against the `generator` AND against every other checker
+slot in its class. A binding that leaves it undeclared has not established it and is invalid — an
+undeclared constraint is the unevaluable case, which is the same failure as declaring none.
+
+Identity equality is the FLOOR of that test, not the whole of it. Two identifiers can name one
+underlying model — an alias, a route through a reseller, adjacent versions of one family — and those
+share every failure mode while comparing unequal. **A binding declaring two slots it knows resolve
+to the same underlying model has declared one checker.** A check cannot see that, so the contract
+states the requirement and a check enforces the part it can read; the gap is recorded here rather
+than implied away.
+
+The human review the matrix makes mandatory for `C4` is NOT a checker slot. It is the merge gate.
+
+## Relational constraints
+
+A constraint binds a role by its relationship to another role, never by naming an instance.
+
+| Constraint | Resolves via | Why |
+|---|---|---|
+| `distinct_model_from: <role>` | the model identity the binding declares — static, because a check reads a binding | a model judging its own output measures its own preference, not the artifact |
+| `distinct_vendor_from: <role>` | vendor identity | disjoint model families fail independently; same-vendor checkers share failure modes, so agreement between them is weaker evidence than its count suggests. `cross_vendor_required` therefore obliges vendor disjointness AMONG the model-adjudicated slots as well as from the `generator` — a class whose checkers all share one vendor satisfies neither the constraint nor the reason for it |
+| `not_weaker_than: <role>` | an ordering source the binding declares | PRESENT BUT NOT DEFAULTED — no cross-vendor capability ordering exists to evaluate it against, so no shipped default uses it. A binding may state it only where it also declares its own ordering source |
+
+A constraint naming a role that its own class does not declare is invalid, not ignored.
+
+## Machine-checkable predicates
+
+A predicate is a requirement a binding can EVALUATE against a candidate instance. A requirement that
+cannot be evaluated is a preference, and preferences are not policy.
+
+| Predicate | Resolution source |
+|---|---|
+| `min_context_tokens: N` | the declared input limit of the bound instance |
+| `requires_modality: [...]` | the declared input/output modalities of the bound instance |
+| `requires_feature: [...]` | the bound instance's declared feature set — feature NAMES are vendor-local, so the binding declares the mapping it resolves against |
+
+## Budget
+
+`max_input_cost_per_mtok` / `max_output_cost_per_mtok` — a per-role ceiling. This REFINES the
+matrix's cost-tier column and never replaces it: the tier is the class-level cost vocabulary, the
+ceiling is a numeric bound inside it. No vendor supplies a price feed, so the ceiling resolves
+against an org-maintained table.
+
+**The ceiling is RECORDED, never enforcing.** A price that will not resolve is recorded as
+unresolved; it does not invalidate a binding and does not gate a run. The matrix states that cost
+enforcement is out of scope, and hard spend caps are gated behind their own trigger — a ceiling that
+blocked here would quietly make this leaf the one enforcing exception to both.
+
+## Pins
+
+`pinned_model_id` is the one place a concrete instance identifier is legal, and only to reproduce a
+RECORDED MEASUREMENT. Append-only: a recorded result keeps its pin forever, so pins accumulate and
+never need updating. A pin never selects a role for new work and is never a policy default.
+
+## Rejected vocabulary: capability labels
+
+Capability labels — words naming how capable a model is, rather than what it must do or how it must
+differ — are RECORDED AS REJECTED as policy vocabulary. Falsified twice over: each such word names a
+different thing at each vendor, and none survives a model release. No such label appears anywhere in
+this contract; a binding that introduces one is expressing preference where the contract requires a
+resolvable constraint. The sourced per-label evidence lives in the pull request that introduced this
+leaf and on the issue it closes, deliberately outside the contract surface.
+
+## Shipped floors
+
+| Class | `min_checkers` | `min_model_checkers` | `cross_vendor_required` |
+|---|---|---|---|
+| `C1` | 1 | 0 | no |
+| `C2` | 1 | 0 | no |
+| `C3` | 2 | 1 | no |
+| `C4` | 3 | 2 | yes |
+| `C5` | 3 | 2 | yes |
+
+`min_checkers` counts DISTINCT slots per the rule above. It is a coverage floor, never a list
+length: a class declaring its floor count of slots that resolve identically has declared one
+checker, and its binding is invalid.
+
+**`min_model_checkers` exists because a total count cannot express which KIND of coverage is
+owed.** Without it, a class meets its floor with deterministic slots alone and never faces a model
+judge — and `cross_vendor_required` then binds an empty set and is satisfied by declaring nothing.
+So it is never vacuously satisfied: **`cross_vendor_required: yes` requires at least two
+model-adjudicated slots, pairwise vendor-disjoint and disjoint from the `generator`**, and a class
+asserting it with fewer is invalid rather than trivially conforming.
+
+Each class's composition is absolute, stated against the
+[security-review layers](security-review.md) it must not contradict:
+
+- `C1` — one slot: the output-shape check.
+- `C2` — one slot: the deterministic scanner layer.
+- `C3` — two slots: one deterministic layer and one model judge.
+- `C4` and `C5` — three slots: one deterministic layer and two model judges, vendor-disjoint.
+
+Shipped values are FLOORS: a binding may tighten any cell but never weaken one below its shipped
+value. The weakening-is-invalid rule is the security-review knobs' own; this leaf adds that no
+justification field excuses a weakening either. Floors bind ONLY on the org's security governance
+surface, outside the blast radius of the agents they govern; a floor those agents can lower is no
+floor. An absent or invalid binding fail-closes to the shipped values above, which this leaf owns —
+the matrix cells are their glance restatement.
+
+## Lenses
+
+A slot fixes WHO verifies; a lens fixes what that verifier is asked to look for. Diversity of lens
+is the point — two checkers asked the identical question share the blind spot the count exists to
+cover, exactly as two slots resolving to one model do.
+
+Lenses bind MODEL-ADJUDICATED slots only. A deterministic slot is not asked a question; its coverage
+is fixed by its scanner class, and a lens on it would be decoration.
+
+The vocabulary is CLOSED — a lens the pipeline cannot resolve to a question is a preference, and
+preferences are not policy.
+
+| Lens | The question the checker is asked |
+|---|---|
+| `specification` | does the artifact do what the item asked for |
+| `adversarial` | how could it be defeated, abused, or driven to fail |
+| `contract` | does it honor the declared interfaces and invariants of everything it touches |
+| `regression` | what previously-working behavior does it disturb |
+| `evidence` | are the claims made about the artifact supported by artifacts the run actually produced |
+
+**Draw rule.** Distinct model-adjudicated slots draw distinct lenses, in pool order.
+
+**The pool contributes to NO count.** Every floor above is counted over the slots the binding
+declares, so no pool value seats a slot, unseats one, or substitutes for one. A pool shorter than a
+class's model-adjudicated slot count leaves the remaining slots UNLENSED — judging the artifact
+whole, which is what a checker did before this section existed — rather than repeating a lens. An
+unrecognized token is recorded as unresolved and draws no lens, on the same footing as the Budget
+ceiling: recorded, never enforcing. Angle is the only thing a pool can add, and the only thing it
+can fail to add.
+
+The pool therefore binds in plugin `userConfig`, not on the security binding: nothing it can be set
+to changes how many slots a class runs, how they must differ, or whether one must be cross-vendor.
+
+## Where each axis binds
+
+Two homes, and the difference is not convenience. An axis fixing HOW MUCH verification a class gets
+binds on the org's security governance surface, outside the blast radius of the agents it governs.
+An axis fixing WHAT ANGLE that verification takes binds on the operator's own plugin-option surface,
+which resolves from user-scope, invocation-scope, and managed settings only — a watched
+repository's in-tree settings are not read for plugin options, so a repo an agent can write cannot
+dial its own verification.
+
+| Axis | Home |
+|---|---|
+| `min_checkers`, `min_model_checkers`, `cross_vendor_required` | security binding |
+| slot distinctness, relational constraints, predicates | security binding, inside the class's declared slots |
+| the lens pool | plugin `userConfig` |
+| whether the advisory narration lane runs | plugin `userConfig` |
+
+**Raise, never lower.** The asymmetry is the whole reason the split exists. Tightening a binding
+cell is legal; weakening one is invalid per the floor rule above. `userConfig` reaches no floor at
+all and cannot be made to: the pool contributes to no count, and the narration lane has no cell to
+weaken. A degenerate pool costs angle, never coverage — the slots still run, still resolve
+distinctly, and still owe unanimity. The reachable outcomes are a lensed checker or an unlensed one,
+never fewer checkers than the class's floor.
+
+## The advisory narration lane
+
+An OPTIONAL lane that reads a difference a deterministic layer has ALREADY detected and writes a
+plain-language account of it into the run record. Advisory only: it emits no verdict, fills no
+checker slot, is counted by no floor, and never gates a transition. Its output reaches the human
+gate as narration attached to the deterministic finding it explains.
+
+**Its position is upstream-dependent, not configurable.** It never runs first, and never runs on an
+artifact no deterministic layer flagged. A lane with nothing upstream of it has nothing to narrate
+and produces nothing.
+
+**It carries no authority cell, by construction rather than by default.** The table above gives it
+no cell on the security binding, its schema carries none, and `userConfig` carries only whether it
+runs. Nothing an org could flip promotes it — a stronger property than a knob shipped off.
+
+**What this does NOT rule out, stated plainly.** A class may declare a model-adjudicated checker
+SLOT whose `requires_modality` names an image input, and a security-review layer may gate on that
+slot. That slot is a CHECKER: counted by the floors, held distinct, bound by every relational
+constraint, and owing unanimity. It is a different governance object from this lane, which is
+counted by nothing and owes nothing. The measurements below bear on both, and a class declaring such
+a slot should read them — but only the lane is structurally incapable of gating.
+
+**Why the lane is shaped this way — measured, not assumed.** Model judgment over rendered UI
+artifacts tops out below the precision a gate needs, and its characteristic error is declaring
+broken things fine: the wrong direction for a check whose purpose is catching breakage. Its verdict
+on identical input also varies run to run at a rate well above the level at which a suite stops
+being believed, and that variance is a property of hosted inference the operator cannot tune away —
+no temperature setting or seed removes it. Recall is where it is strong, which is precisely what
+makes narration its job rather than judgment. Every established comparison product surveyed reaches
+the same arrangement independently: detect the difference deterministically, narrate it with a
+model, route acceptance to a person. Per-request image caps and per-frame metering make a lane's
+artifact volume a cost bound the runner resolves against the bound instance's declared limits, never
+a policy axis. The sourced measurements live in the pull request that introduced this lane and on
+the issue it closes, deliberately outside the contract surface.
+
+**Not demonstrated at runtime.** With no runner built there is no runtime in which to exercise the
+ordering, so the property claimed here is structural: no cell exists through which authority could
+be granted. The runtime assertion — that a deterministic pass carrying a narration finding still
+advances — is a DEFERRED item bound to the runner's build trigger, not a claim made here.
+
+## Two fixed invariants
+
+Neither is a knob, and no binding may relax either.
+
+**Independent aggregation, never deliberation.** Checkers run isolated: no checker sees another
+checker's verdict or reasoning, and verdicts are combined mechanically. Deliberation between
+checkers is RECORDED AS REJECTED: agreement reached by discussion is correlation, not corroboration
+— the count of agreeing checkers stops measuring independent confirmation the moment they can hear
+each other, so a deliberating panel's unanimity means strictly less than an isolated panel's while
+reading as if it meant more.
+
+**Unanimous checker agreement for anything auto-proceeding.** Every transition a run takes without a
+human — not merge alone — requires every checker the class declares to agree. One dissent withholds
+the automatic transition and hands the item to the human gate; divergence routing is owned by the
+matrix's escalation contract.
+
+## How unanimity is enforced today
+
+Unanimity needs a checker POPULATION and FORCE behind its verdicts. This leaf's floors supply the
+population; the [security-review leaf](security-review.md)'s per-class blocking knob supplies the
+force. Only force is configurable into absence — floors are tighten-only, so no floor value can
+describe a topology that cannot be unanimous, while a knob left below `blocking` lets a dissent be
+recorded and the transition proceed anyway.
+
+**Binding-validity rule.** A class whose merge disposition is bound `auto` is INVALID, rejected at
+check time, when either holds:
+
+- any verification layer for that class is bound `advisory` — the checker runs, dissents, and the
+  transition proceeds regardless; or
+- the class declares a model-adjudicated checker slot while its model-adjudicated layer is bound
+  `not-required` — the layer that slot judges in never runs, so its agreement can never be obtained
+  and unanimity over it is vacuous.
+
+A class declaring no model-adjudicated slot is not caught by the second case: its floor is seated by
+a deterministic slot, whose force is its own layer. The rule is a JOIN across two axes, never a floor
+on either — each axis alone at a legal value can still combine into an automatic transition no
+checker can withhold.
+
+**Dissent routes on the existing channel.** A withheld transition files on the bound route for the
+matrix's `verification-divergence` event class, whose definition already covers checker
+disagreement. No token and no channel is added here; the one-channel invariant binds unchanged.
+
+**Consumers resolve both.** A consumer resolving a class's merge disposition must resolve its
+checker layers in the same step, against live promotion-evidence telemetry: automatic merge is
+unavailable whenever a checker layer resolves below `blocking`, including where a human-ratified
+`blocking` has been lowered by automatic demotion. Reading the bound merge disposition alone is
+non-conforming.
+
+**Why the check is merge-scoped while the obligation is not.** The obligation covers every
+transition a run takes without a human. Merge is the only such transition a binding can express:
+intermediate pipeline transitions are runner-owned, and no runner exists. Autonomous ADMISSION is
+not a second hole — admission precedes the artifact, so there is no checker verdict to be unanimous
+about at that point.
+
+**Two limits, stated rather than hidden.** Neither is verified anywhere today.
+
+- **Per-run aggregation is not asserted.** Unanimous pass, single dissent, checker timeout, and
+  duplicate checker identity at run time are verdict-aggregation obligations on the runner seam,
+  deferred to the runner's build trigger. What ships is the contract obligation and the
+  binding-validity rule above: a configuration that could auto-proceed with no force behind its
+  checkers is rejected; a RUN that does so is not yet detectable.
+- **Force is checked; RESOLVED distinctness is not.** The slot rule above is stated over the binding
+  because a binding is what a check can read. Two slots held distinct by declared constraints can
+  still resolve to one instance at run time, and no static check sees that — it is the same
+  runner-seam obligation.
diff --git a/plugins/autonomy/reference/guardrails/work-classes.md b/plugins/autonomy/reference/guardrails/work-classes.md
index e8463b338..8cc7aa0ec 100644
--- a/plugins/autonomy/reference/guardrails/work-classes.md
+++ b/plugins/autonomy/reference/guardrails/work-classes.md
@@ -60,6 +60,12 @@ per the [telemetry contract](../telemetry.md) are the evidence base.
 - **Demotion is automatic and fail-closed.** Contrary evidence lowers the cell's effective
   state immediately, without waiting for human action; the cell re-earns promotion from
   there through the same evidence predicate.
+- **Promotion never overrides unanimity.** A promoted `C2`/`C3` auto-merge cell still does not
+  auto-proceed on checker dissent: the promoted state is a ceiling, and dissent withholds the
+  automatic transition the same way contrary evidence lowers the cell — the same mechanism, not
+  a second one beside it. Requiring unanimous checker agreement is a
+  [verification-topology](verification-topology.md) invariant, never a promotable knob; that
+  leaf states what is checked at binding-validity time and what awaits the runner.
 
 ## Suggested default predicates
 
@@ -76,4 +82,6 @@ org binds (org-bindable values):
 **Demotion evidence set** (one event suffices): any post-merge gate failure, any
 human-reverted merge, any verification divergence. Demotion cascades along
 predicate dependencies: `C3` auto-merge is earned on the `C2` auto-merge track
-record, so contrary evidence against `C2` auto-merge demotes both cells.
+record, and its automatic transition is gated on the `C3` AI-review cell being
+blocking, so contrary evidence against either prerequisite demotes `C3`
+auto-merge with it.
diff --git a/plugins/autonomy/skills/setup/SKILL.md b/plugins/autonomy/skills/setup/SKILL.md
index f9cf1bab4..07578ff2d 100644
--- a/plugins/autonomy/skills/setup/SKILL.md
+++ b/plugins/autonomy/skills/setup/SKILL.md
@@ -156,7 +156,8 @@ splits policy into. This section owns resolution; the [guardrail slice below](#g
 this order resolves.
 
 **Two-surface split.** Security-sensitive guardrail axes — isolation bindings with their
-runtime markers, merge policy, verification blocking knobs, promotion state, escalation
+runtime markers, merge policy, verification blocking knobs, per-class verification
+topology, promotion state, escalation
 routes, admission rules and caps — bind ONLY in the security binding document in the
 settings-as-code home, outside the blast radius of the agents it governs. Its schema is
 contract-owned and ships at
@@ -169,6 +170,16 @@ binding. Non-security axes remap in the additive `guardrails` section of the rep
 binding: class→label strings (which local label means which work class) and
 cost-tier→model names — vocabulary remaps only, never policy content.
 
+**A third home that is not a governance surface.** Two axes of the
+[verification-topology leaf](${CLAUDE_PLUGIN_ROOT}/reference/guardrails/verification-topology.md)
+bind in this plugin's `userConfig` rather than either governance surface: the verification lens
+pool, and whether the advisory visual narration lane runs. Neither counts anything — the pool
+contributes to no floor, and the narration lane has no security-binding cell at all — so neither can
+weaken a floor, which is what lets them sit on an operator surface. Plugin options resolve from
+user, `--settings`, and managed settings only; a watched repository's own `.claude/settings.json` is
+not read for them, so a repo cannot dial its own verification. The slice proposes neither as a
+binding field.
+
 **Layered resolution order.** Org-policy-home defaults → settings-as-code per-repo
 security binding → repo-local non-security remaps. Later layers refine earlier ones for
 NON-SECURITY axes only; no repo-local (agent-writable) value ever supplies or overrides a
@@ -229,11 +240,17 @@ depends on the binding until that human-landed change exists.
    pre-existing surface is authoritative input to reconcile against, not a blank field to fill.
 3. **Live-validate BEFORE recording** — the empirical probe per substrate class (recipe in
    [`templates/isolation-probe.md`](templates/isolation-probe.md)). A candidate `L2`/`L3`
-   substrate is validated by running, INSIDE the boundary, two probes that MUST both fail:
-   - a **denied-egress smoke test** — a network fetch to a well-known external host MUST fail
-     (a boundary that lets egress through is not an `L2` boundary);
+   substrate is validated by running, INSIDE the boundary, three probes that MUST all fail:
+   - a **denied-egress smoke test** — a network fetch MUST fail against two well-known external
+     hosts under different operators AND against every destination the level binding ratifies as
+     component-reachable (a boundary that lets egress through is not an `L2` boundary, and a probe
+     that samples only what the base policy denies never looks where an installed component may
+     already have widened it);
    - a **host-credential-path read attempt** — a read of a host credential path MUST be absent or
-     denied (a boundary that leaks host secrets is not an `L2` boundary).
+     denied (a boundary that leaks host secrets is not an `L2` boundary);
+   - a **workspace host-write containment check** — randomized canaries written inside MUST all be
+     absent on the host after teardown (a boundary the host later executes writes from is not an
+     `L2` boundary).
 
    The checker resolves no DNS and reads no remote host, so it validates the probe's targets against
    operator-configured seams. The egress target checks against `--egress-hosts <host,...>` (a
@@ -256,13 +273,17 @@ depends on the binding until that human-landed change exists.
    lands ahead of the probe that proves its boundary.
 4. **Bind level → substrate per surface** — record each validated substrate under its surface in
    `isolation_bindings` (surface id → level token → substrate instance + the human-ratified
-   `substrate_class` + `probe_evidence` + the non-forgeable `runtime_markers` the dispatch seam
-   attests against), plus the merge policy,
-   verification-blocking knobs, escalation routes, and admission rules and caps — all on the
+   `substrate_class` and `component_reachable_hosts` + `probe_evidence` + the non-forgeable
+   `runtime_markers` the dispatch seam attests against), plus the merge policy,
+   verification-blocking knobs, each class's `verification_topology`, escalation routes, and
+   admission rules and caps — all on the
    prepared security-binding change, validated by
    [`scripts/check-security-binding.mjs`](scripts/check-security-binding.mjs) against
    [`schemas/guardrails-security-binding.schema.json`](schemas/guardrails-security-binding.schema.json)
    before it is proposed.
+   The lens pool and the advisory visual narration lane are NOT binding fields — they resolve from
+   plugin `userConfig` per the [third home above](#guardrail-binding-resolution), and proposing
+   either here is invalid.
 5. **Security-review wiring folds in here (no separate capability)** — the security-review policy
    is one part of this single guardrail slice, never a near-duplicate setup capability. Wire the
    [security-review leaf's](${CLAUDE_PLUGIN_ROOT}/reference/guardrails/security-review.md) two
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/admission-weakened-no-justification.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/admission-weakened-no-justification.json
index 24d09ba05..c0639f64c 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/admission-weakened-no-justification.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/admission-weakened-no-justification.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ambiguous-runtime-markers.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ambiguous-runtime-markers.json
index 0b3a3dcde..5d8f77b1e 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ambiguous-runtime-markers.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ambiguous-runtime-markers.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "pool": "blue",
@@ -18,6 +21,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-b-l2.json",
         "runtime_markers": {
           "pool": "blue",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/as112-v6-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/as112-v6-valid.json
index 046760ada..0b9a6c62b 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/as112-v6-valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/as112-v6-valid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-as112-v6.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/auto-merge-advisory-checkers.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/auto-merge-advisory-checkers.json
new file mode 100644
index 000000000..45596feab
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/auto-merge-advisory-checkers.json
@@ -0,0 +1,117 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "auto",
+    "C3": "auto",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "advisory",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  },
+  "promotion_state": {
+    "C2-auto-merge": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-06-30-c2-auto-merge",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-06-30T00:00:00Z"
+    },
+    "C3-auto-merge": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-07-01-c3-auto-merge",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-07-01T00:00:00Z"
+    },
+    "C3-ai-review-blocking": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-06-29-c3-ai-review-blocking",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-06-29T00:00:00Z"
+    }
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/auto-merge-blocking-checkers.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/auto-merge-blocking-checkers.json
new file mode 100644
index 000000000..34116dcb5
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/auto-merge-blocking-checkers.json
@@ -0,0 +1,117 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "auto",
+    "C3": "auto",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  },
+  "promotion_state": {
+    "C2-auto-merge": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-06-30-c2-auto-merge",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-06-30T00:00:00Z"
+    },
+    "C3-auto-merge": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-07-01-c3-auto-merge",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-07-01T00:00:00Z"
+    },
+    "C3-ai-review-blocking": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-06-29-c3-ai-review-blocking",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-06-29T00:00:00Z"
+    }
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c2-auto-unratified.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c2-auto-unratified.json
index 13f0bed8f..78dc202d1 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c2-auto-unratified.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c2-auto-unratified.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c3-auto-unratified.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c3-auto-unratified.json
index 7448441f2..fc1e96b6b 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c3-auto-unratified.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c3-auto-unratified.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c3-blocking-unratified.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c3-blocking-unratified.json
index 1400ebfcb..e0827399c 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c3-blocking-unratified.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c3-blocking-unratified.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c4-auto-merge.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c4-auto-merge.json
index 792ec263a..5b8744a17 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c4-auto-merge.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/c4-auto-merge.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/component-reach-empty-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/component-reach-empty-valid.json
new file mode 100644
index 000000000..6a53e60d6
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/component-reach-empty-valid.json
@@ -0,0 +1,95 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/equal-specificity-tie.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/equal-specificity-tie.json
index a67c3672e..8cadb9f00 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/equal-specificity-tie.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/equal-specificity-tie.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-ack-invalid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-ack-invalid.json
index beec7e83d..168b1bf96 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-ack-invalid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-ack-invalid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -61,11 +64,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-ack-loop.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-ack-loop.json
index 76a7d9e18..72440ba93 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-ack-loop.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-ack-loop.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -61,11 +64,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-push-without-channel.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-push-without-channel.json
index c19c5b547..c3e53635d 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-push-without-channel.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-push-without-channel.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -50,7 +53,9 @@
     "untrusted-provenance": "urgent"
   },
   "escalation_severity_routes": {
-    "urgent": { "push": "personal-push:oncall-primary" }
+    "urgent": {
+      "push": "personal-push:oncall-primary"
+    }
   },
   "admission": {
     "classification": {
@@ -63,11 +68,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-runner-route-missing.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-runner-route-missing.json
index aad516766..d1abafbdf 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-runner-route-missing.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-runner-route-missing.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -60,11 +63,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-bad-token.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-bad-token.json
index 514a01c64..f0e2092aa 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-bad-token.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-bad-token.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -60,11 +63,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-tracker-only-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-tracker-only-valid.json
index 6a8bc1ef4..f66de57b0 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-tracker-only-valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-tracker-only-valid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -60,11 +63,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-valid.json
index f05a19a1e..511c55000 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/escalation-severity-valid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -56,8 +59,13 @@
     "runner-cap-exceeded": "notice"
   },
   "escalation_severity_routes": {
-    "attention": { "channel": "channel:autonomy-escalations" },
-    "urgent": { "channel": "channel:autonomy-escalations", "push": "personal-push:oncall-primary" }
+    "attention": {
+      "channel": "channel:autonomy-escalations"
+    },
+    "urgent": {
+      "channel": "channel:autonomy-escalations",
+      "push": "personal-push:oncall-primary"
+    }
   },
   "escalation_ack": {
     "staleness_window": 72,
@@ -74,11 +82,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/hosted-ephemeral-l3-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/hosted-ephemeral-l3-valid.json
index 50899aa3e..c3b7792c4 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/hosted-ephemeral-l3-valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/hosted-ephemeral-l3-valid.json
@@ -7,6 +7,9 @@
       "L3": {
         "substrate": "hosted-ephemeral-pool",
         "substrate_class": "hosted-ephemeral-executor",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l3-hosted.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/l3-ratified-class-container.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/l3-ratified-class-container.json
index fb5c8b526..5f3528670 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/l3-ratified-class-container.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/l3-ratified-class-container.json
@@ -7,6 +7,9 @@
       "L3": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l3-container.json"
       }
     }
@@ -53,11 +56,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/marker-prototype-key.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/marker-prototype-key.json
index 7d609f918..2946b350f 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/marker-prototype-key.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/marker-prototype-key.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "toString": "l2"
@@ -15,6 +18,9 @@
       "L3": {
         "substrate": "microvm-pool",
         "substrate_class": "vm-microvm",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l3.json",
         "runtime_markers": {
           "tier": "metal"
@@ -64,11 +70,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/missing-probe-evidence.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/missing-probe-evidence.json
index 77ac2aee5..9a5f90cbe 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/missing-probe-evidence.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/missing-probe-evidence.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
           "region": "us-east"
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/missing-substrate-class.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/missing-substrate-class.json
index 3e22b425b..29c83dfcd 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/missing-substrate-class.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/missing-substrate-class.json
@@ -10,7 +10,10 @@
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
           "region": "us-east"
-        }
+        },
+        "component_reachable_hosts": [
+          "example.com"
+        ]
       }
     }
   },
@@ -56,11 +59,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/multi-host-egress-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/multi-host-egress-valid.json
index d99310fd5..9edbe313e 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/multi-host-egress-valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/multi-host-egress-valid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-multi-host.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-6to4-relay.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-6to4-relay.json
index 84aa0411a..75f777e2c 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-6to4-relay.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-6to4-relay.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-6to4-relay.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-6to4-v6.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-6to4-v6.json
index cd13d2e1f..c7d1575cf 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-6to4-v6.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-6to4-v6.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-6to4-v6.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-bare-metadata.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-bare-metadata.json
index aef19e9de..9503c6676 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-bare-metadata.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-bare-metadata.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-bare-metadata.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-benchmarking-v6.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-benchmarking-v6.json
index e4a69ed5f..3438d28bc 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-benchmarking-v6.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-benchmarking-v6.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-benchmarking-v6.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-bogus-metadata.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-bogus-metadata.json
index e2a5aeba0..1576dd26a 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-bogus-metadata.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-bogus-metadata.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-bogus-metadata.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-component-reach-partial.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-component-reach-partial.json
new file mode 100644
index 000000000..2c374f5f5
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-component-reach-partial.json
@@ -0,0 +1,98 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com",
+          "api.example.net"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-component-reach-uncovered.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-component-reach-uncovered.json
new file mode 100644
index 000000000..16bbdf4c9
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-component-reach-uncovered.json
@@ -0,0 +1,98 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "api.example.net",
+          "cdn.example.net"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-component-reach-unratified.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-component-reach-unratified.json
new file mode 100644
index 000000000..738190de9
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-component-reach-unratified.json
@@ -0,0 +1,94 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-cred-outer-missing.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-cred-outer-missing.json
index cce7464d8..3ddc806cc 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-cred-outer-missing.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-cred-outer-missing.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-cred-outer-missing.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-cred-outer-nonzero.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-cred-outer-nonzero.json
index 39f9ba8e6..23b89caee 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-cred-outer-nonzero.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-cred-outer-nonzero.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-cred-outer-nonzero.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credpath-code-count.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credpath-code-count.json
index e1e626f99..4fd982d18 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credpath-code-count.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credpath-code-count.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-credpath-code-count.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credpath-partial-zero.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credpath-partial-zero.json
index 3184fb7e0..ec7073d06 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credpath-partial-zero.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credpath-partial-zero.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-credpath-partial-zero.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-case-mismatch.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-case-mismatch.json
index 83fdc1f61..e83a105a1 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-case-mismatch.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-case-mismatch.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-id-rsa.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-drive-root.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-drive-root.json
index 0113ac1b6..5668c50d7 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-drive-root.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-drive-root.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-drive-root.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-relative-root.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-relative-root.json
index 74aa9be37..1b05cfe36 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-relative-root.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-relative-root.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-relative-credpath.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-root-slash.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-root-slash.json
index 83fdc1f61..e83a105a1 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-root-slash.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-root-slash.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-id-rsa.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-unconfigured.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-unconfigured.json
index 83fdc1f61..e83a105a1 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-unconfigured.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-credroots-unconfigured.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-id-rsa.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-discard-only.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-discard-only.json
index 600bf3701..9860d8012 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-discard-only.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-discard-only.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-discard-only.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-doc-3fff.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-doc-3fff.json
index 7b117bc81..a95d7ccc2 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-doc-3fff.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-doc-3fff.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-doc-3fff.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-docnet-host.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-docnet-host.json
index d3fc7513b..4d8225da6 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-docnet-host.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-docnet-host.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-docnet.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-dot-traversal.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-dot-traversal.json
index 4b3f8c025..6e319da02 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-dot-traversal.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-dot-traversal.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-dot-traversal.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-dummy-prefix.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-dummy-prefix.json
index 2471904cd..6d5034269 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-dummy-prefix.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-dummy-prefix.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-dummy-prefix.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-client-not-ready.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-client-not-ready.json
index 154c1bf9e..273651d43 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-client-not-ready.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-client-not-ready.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-egress-client-not-ready.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-duplicate-host.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-duplicate-host.json
index 81401121b..44f474057 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-duplicate-host.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-duplicate-host.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-egress-duplicate-host.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-fingerprint-on-nonpeer.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-fingerprint-on-nonpeer.json
index 9d8b4eed2..2d0b83f8a 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-fingerprint-on-nonpeer.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-fingerprint-on-nonpeer.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-egress-fingerprint-on-nonpeer.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-no-transport.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-no-transport.json
index 7dddbe306..9a366ee2b 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-no-transport.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-no-transport.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-egress-no-transport.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-peer-match.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-peer-match.json
index 8cd2a48b6..254656eba 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-peer-match.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-peer-match.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-egress-peer-match.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-single-target.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-single-target.json
index 510e41372..fe31d6aa1 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-single-target.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-single-target.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-egress-single-target.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-transport-count.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-transport-count.json
index 171d7b7ee..a9aa655e6 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-transport-count.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-transport-count.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-egress-transport-count.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-transport-token.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-transport-token.json
index 5c1545d12..4cd6b49c8 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-transport-token.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-transport-token.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-egress-transport-token.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-zero-exit-peer-substituted.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-zero-exit-peer-substituted.json
index 0a6c457f4..adac1a592 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-zero-exit-peer-substituted.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-egress-zero-exit-peer-substituted.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-egress-zero-exit-peer-substituted.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-encoded-loopback.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-encoded-loopback.json
index 117f27e74..1f8090811 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-encoded-loopback.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-encoded-loopback.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-encoded-loopback.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expanded-loopback.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expanded-loopback.json
index 7beba7d36..f40c91a0b 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expanded-loopback.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expanded-loopback.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-expanded-loopback.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expansion-ephemeral.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expansion-ephemeral.json
index c0e594a25..7dddfd2ae 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expansion-ephemeral.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expansion-ephemeral.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-expansion-ephemeral.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expansion-tail-mismatch.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expansion-tail-mismatch.json
index d8c72332e..1115c9ca6 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expansion-tail-mismatch.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-expansion-tail-mismatch.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-expansion-tail-mismatch.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-generic-env-token.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-generic-env-token.json
index 7d091c2e9..7d896121c 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-generic-env-token.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-generic-env-token.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-generic-env-token.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-host-home-mount.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-host-home-mount.json
index 60d56759c..099e7b817 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-host-home-mount.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-host-home-mount.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-host-home-mount.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-imds-http-error.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-imds-http-error.json
index 3a86bb308..401597327 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-imds-http-error.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-imds-http-error.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-imds-http-error.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invalid-tld.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invalid-tld.json
index bbdb41bf6..d90af7872 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invalid-tld.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invalid-tld.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-invalid-tld.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invented-env-token.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invented-env-token.json
index 5c85374ac..4a71aafb3 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invented-env-token.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invented-env-token.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-invented-env-token.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invented-home-user.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invented-home-user.json
index 99dde248b..343982d0f 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invented-home-user.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-invented-home-user.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-invented-home-user.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-ipv4-compat.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-ipv4-compat.json
index b90d17d32..ad66cfb74 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-ipv4-compat.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-ipv4-compat.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-ipv4-compat.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-l3-container.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-l3-container.json
index 6714196c0..ea4146608 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-l3-container.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-l3-container.json
@@ -7,6 +7,9 @@
       "L3": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l3-container.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-level-mismatch.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-level-mismatch.json
index 2273e68d5..114e399b7 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-level-mismatch.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-level-mismatch.json
@@ -7,6 +7,9 @@
       "L3": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "vm-microvm",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-local-host.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-local-host.json
index b6b858e65..12db323e6 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-local-host.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-local-host.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-localhost.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-malformed-dns.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-malformed-dns.json
index f9abba05b..768d57f10 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-malformed-dns.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-malformed-dns.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-malformed-dns.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-expansion-mismatch.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-expansion-mismatch.json
index dfc7b2c53..bb2fd0bd0 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-expansion-mismatch.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-expansion-mismatch.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-metadata-expansion-mismatch.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-port.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-port.json
index af7706faf..e84819ac1 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-port.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-port.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-metadata-port.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-route-boundary.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-route-boundary.json
index 4a16eb540..59f7ea9da 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-route-boundary.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-route-boundary.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-metadata-route-boundary.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-route.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-route.json
index 279eb5d2d..829a3d0c3 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-route.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-route.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-metadata-route.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-scheme.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-scheme.json
index 8f7a85981..e5ec53d44 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-scheme.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-metadata-scheme.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-metadata-scheme.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-host-expanded.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-host-expanded.json
index fcdb7158a..2bd11551e 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-host-expanded.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-host-expanded.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-no-host-expanded.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-outer-exit.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-outer-exit.json
index 038fa8dc3..3b88353c2 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-outer-exit.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-outer-exit.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-no-outer-exit.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-probed-at.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-probed-at.json
index ed9b219cb..0d1764b5b 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-probed-at.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-probed-at.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-no-probed-at.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-target.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-target.json
index 066dbd741..f34ad32e6 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-target.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-target.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-no-host.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-transport.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-transport.json
index edaae30e9..ece1579f4 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-transport.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-missing-transport.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-no-transport.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-multi-host-private.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-multi-host-private.json
index f571389bc..7873c13d2 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-multi-host-private.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-multi-host-private.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-multi-host-private.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-nat64-local.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-nat64-local.json
index 6e371ee9c..2c70d7e84 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-nat64-local.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-nat64-local.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-nat64-local.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-nat64-private-embed.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-nat64-private-embed.json
index cd06d8d94..17f57ed37 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-nat64-private-embed.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-nat64-private-embed.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-nat64-private-embed.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-outer-egress-failed.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-outer-egress-failed.json
index 34e64b5ac..8bc9c8899 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-outer-egress-failed.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-outer-egress-failed.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-outer-egress-failed.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-protocol-assignment.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-protocol-assignment.json
index a8697cc9e..ecb2cd356 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-protocol-assignment.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-protocol-assignment.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-protocol-assignment.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-ratified-class-mismatch.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-ratified-class-mismatch.json
index 43b3e5e94..670c48c11 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-ratified-class-mismatch.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-ratified-class-mismatch.json
@@ -7,6 +7,9 @@
       "L3": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "vm-microvm",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l3-container.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-root-escape.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-root-escape.json
index 4d6c7864b..e8a1b7148 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-root-escape.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-root-escape.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "../ci-pool-a-l2-outside-root.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-site-local-v6.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-site-local-v6.json
index 9316c4fe9..80ab080d2 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-site-local-v6.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-site-local-v6.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-site-local-v6.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-srv6-sid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-srv6-sid.json
index d5f834b76..18555b28a 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-srv6-sid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-srv6-sid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-srv6-sid.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-teredo.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-teredo.json
index 927b00eab..8b96ebf80 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-teredo.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-teredo.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-teredo.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-transport-cross-type.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-transport-cross-type.json
index 8d2bea909..7b42637c8 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-transport-cross-type.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-transport-cross-type.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-transport-cross-type.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-unc-credpath.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-unc-credpath.json
index 7015955ed..aff41c077 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-unc-credpath.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-unc-credpath.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-unc-credpath.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-uri-host.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-uri-host.json
index c1d8c7f34..fdb6ad77f 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-uri-host.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-uri-host.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-uri-host.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-count.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-count.json
index 7470124b5..299100373 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-count.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-count.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-canary-count.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-duplicate.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-duplicate.json
index 2fed013d7..0e4a6eb7f 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-duplicate.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-duplicate.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-canary-duplicate.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-shapes.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-shapes.json
index 5a44791af..a5819d582 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-shapes.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-shapes.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-canary-shapes.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-traversal.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-traversal.json
index d0fe7477e..692d05504 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-traversal.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-traversal.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-canary-traversal.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-visible.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-visible.json
index 5035c2f73..0138f8827 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-visible.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-canary-visible.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-canary-visible.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-git-digest-changed.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-git-digest-changed.json
index dc1a5f0c2..6ecce6349 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-git-digest-changed.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-git-digest-changed.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-git-digest-changed.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-inner-code-empty.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-inner-code-empty.json
index 29b5c91a3..831537a7c 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-inner-code-empty.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-inner-code-empty.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-inner-code-empty.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-missing.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-missing.json
index 1e1be27ac..4c508d6fa 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-missing.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-missing.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-missing.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-no-teardown.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-no-teardown.json
index e284f6514..ab0e13d72 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-no-teardown.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-no-teardown.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-no-teardown.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-not-applicable.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-not-applicable.json
index 25438a0ed..bde68a23d 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-not-applicable.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-workspace-not-applicable.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-workspace-not-applicable.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-zero-exit.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-zero-exit.json
index 2ad14205c..08d2ca1ab 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-zero-exit.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/probe-evidence-zero-exit.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-zero-exit.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2.json
index 13c6d69fd..dd08c6964 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2c3-late.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2c3-late.json
index b64d6cf6d..e1b422ade 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2c3-late.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2c3-late.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -33,7 +36,7 @@
     "ai-review": {
       "C1": "not-required",
       "C2": "not-required",
-      "C3": "advisory",
+      "C3": "blocking",
       "C4": "blocking",
       "C5": "blocking"
     }
@@ -103,6 +106,12 @@
       "ratified_by_change": "change/2026-07-20-c3-auto-merge",
       "evidence_window": "2026-06-01..2026-06-28",
       "ratified_at": "2026-07-20T00:00:00Z"
+    },
+    "C3-ai-review-blocking": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-06-29-c3-ai-review-blocking",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-06-29T00:00:00Z"
     }
   }
 }
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2c3.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2c3.json
index cccdc37a9..9e7557266 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2c3.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2c3.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -33,7 +36,7 @@
     "ai-review": {
       "C1": "not-required",
       "C2": "not-required",
-      "C3": "advisory",
+      "C3": "blocking",
       "C4": "blocking",
       "C5": "blocking"
     }
@@ -103,6 +106,12 @@
       "ratified_by_change": "change/2026-07-01-c3-auto-merge",
       "evidence_window": "2026-06-01..2026-06-28",
       "ratified_at": "2026-07-01T00:00:00Z"
+    },
+    "C3-ai-review-blocking": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-06-29-c3-ai-review-blocking",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-06-29T00:00:00Z"
     }
   }
 }
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2reearned-c3.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2reearned-c3.json
index 043a48e86..0a0959898 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2reearned-c3.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c2reearned-c3.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -33,7 +36,7 @@
     "ai-review": {
       "C1": "not-required",
       "C2": "not-required",
-      "C3": "advisory",
+      "C3": "blocking",
       "C4": "blocking",
       "C5": "blocking"
     }
@@ -103,6 +106,12 @@
       "ratified_by_change": "change/2026-07-01-c3-auto-merge",
       "evidence_window": "2026-06-01..2026-06-28",
       "ratified_at": "2026-07-01T00:00:00Z"
+    },
+    "C3-ai-review-blocking": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-06-29-c3-ai-review-blocking",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-06-29T00:00:00Z"
     }
   }
 }
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c3-only.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c3-only.json
index cc94390b2..29d320ab3 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c3-only.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promoted-c3-only.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -33,7 +36,7 @@
     "ai-review": {
       "C1": "not-required",
       "C2": "not-required",
-      "C3": "advisory",
+      "C3": "blocking",
       "C4": "blocking",
       "C5": "blocking"
     }
@@ -97,6 +100,12 @@
       "ratified_by_change": "change/2026-07-01-c3-auto-merge",
       "evidence_window": "2026-06-01..2026-06-28",
       "ratified_at": "2026-07-01T00:00:00Z"
+    },
+    "C3-ai-review-blocking": {
+      "state": "promoted",
+      "ratified_by_change": "change/2026-06-29-c3-ai-review-blocking",
+      "evidence_window": "2026-06-01..2026-06-28",
+      "ratified_at": "2026-06-29T00:00:00Z"
     }
   }
 }
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promotion-nonpromotable.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promotion-nonpromotable.json
index 00150f75b..d3f697262 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promotion-nonpromotable.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/promotion-nonpromotable.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-calendar-invalid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-calendar-invalid.json
index 5ffe580bc..3fd98ce12 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-calendar-invalid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-calendar-invalid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -65,11 +68,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-non-iso.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-non-iso.json
index 8d4ea9572..37bc14864 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-non-iso.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-non-iso.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-offset-invalid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-offset-invalid.json
index f924f1d1e..80c8c044d 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-offset-invalid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-offset-invalid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -65,11 +68,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-submilli.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-submilli.json
index 6e433cf43..9cc4ef098 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-submilli.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ratified-at-submilli.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -65,11 +68,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/same-surface-level-ambiguity.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/same-surface-level-ambiguity.json
index d90cb36ef..22d95da71 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/same-surface-level-ambiguity.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/same-surface-level-ambiguity.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -16,6 +19,9 @@
       "L3": {
         "substrate": "microvm-pool",
         "substrate_class": "vm-microvm",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l3.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ssh-id-rsa-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ssh-id-rsa-valid.json
index 83fdc1f61..e83a105a1 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ssh-id-rsa-valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/ssh-id-rsa-valid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2-id-rsa.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-classification-bare-string.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-classification-bare-string.json
index 1a6a9d121..51d961cfd 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-classification-bare-string.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-classification-bare-string.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -66,11 +69,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-classification-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-classification-valid.json
index 88d8ad22d..3b6053155 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-classification-valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-classification-valid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -71,11 +74,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-duplicate-producer-identity.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-duplicate-producer-identity.json
index 8b562dc57..64848080a 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-duplicate-producer-identity.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-duplicate-producer-identity.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -71,11 +74,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-empty-source-surface.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-empty-source-surface.json
index 8c71a49e3..540752b3c 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-empty-source-surface.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-empty-source-surface.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -71,11 +74,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-identity-grammar.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-identity-grammar.json
index b501259e0..d240e3d4c 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-identity-grammar.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-identity-grammar.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -71,11 +74,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-missing-producer-identity.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-missing-producer-identity.json
index e9c6e4be3..b3867ff42 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-missing-producer-identity.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-missing-producer-identity.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -70,11 +73,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-missing-run-link-prefix.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-missing-run-link-prefix.json
index 3ba58bf7e..e66a4c218 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-missing-run-link-prefix.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-missing-run-link-prefix.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -70,11 +73,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-shared-run-link-prefix-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-shared-run-link-prefix-valid.json
index 5119482ac..6654d683a 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-shared-run-link-prefix-valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-shared-run-link-prefix-valid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -71,11 +74,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-shared-source-surface.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-shared-source-surface.json
index a6265ad25..fa62316f4 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-shared-source-surface.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/temporal-shared-source-surface.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -71,11 +74,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-all-deterministic-c4.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-all-deterministic-c4.json
new file mode 100644
index 000000000..722e392ad
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-all-deterministic-c4.json
@@ -0,0 +1,125 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C4": {
+      "min_checkers": 3,
+      "min_model_checkers": 0,
+      "cross_vendor_required": true,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "secrets",
+          "role": "checker",
+          "scanner_class": "secret-detection"
+        },
+        {
+          "name": "deps",
+          "role": "checker",
+          "scanner_class": "dependency-audit"
+        },
+        {
+          "name": "sast",
+          "role": "checker",
+          "scanner_class": "static-analysis"
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-checker-count-below-min.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-checker-count-below-min.json
new file mode 100644
index 000000000..8e7eb7f42
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-checker-count-below-min.json
@@ -0,0 +1,122 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 3,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": [
+            "author",
+            "reviewer-a"
+          ]
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-decorative.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-decorative.json
new file mode 100644
index 000000000..6be6f1f60
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-decorative.json
@@ -0,0 +1,122 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": true,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": [
+            "author",
+            "reviewer-a"
+          ]
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-dropped.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-dropped.json
new file mode 100644
index 000000000..1327a98fa
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-dropped.json
@@ -0,0 +1,130 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C5": {
+      "min_checkers": 3,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": [
+            "author",
+            "reviewer-a"
+          ]
+        },
+        {
+          "name": "reviewer-c",
+          "role": "checker",
+          "distinct_model_from": [
+            "reviewer-a",
+            "reviewer-b"
+          ]
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-no-generator.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-no-generator.json
new file mode 100644
index 000000000..46923883e
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-no-generator.json
@@ -0,0 +1,115 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": true,
+      "roles": [
+        {
+          "name": "reviewer-a",
+          "role": "cross_vendor_checker",
+          "distinct_model_from": "reviewer-b"
+        },
+        {
+          "name": "reviewer-b",
+          "role": "cross_vendor_checker",
+          "distinct_model_from": "reviewer-a"
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-vacuous.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-vacuous.json
new file mode 100644
index 000000000..059c6be15
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-cross-vendor-vacuous.json
@@ -0,0 +1,121 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "min_model_checkers": 1,
+      "cross_vendor_required": true,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "scanner",
+          "role": "checker",
+          "scanner_class": "secret-detection"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "cross_vendor_checker",
+          "distinct_model_from": "author",
+          "distinct_vendor_from": "author"
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-duplicate-modality.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-duplicate-modality.json
new file mode 100644
index 000000000..683ae6c8b
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-duplicate-modality.json
@@ -0,0 +1,126 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author",
+          "requires_modality": [
+            "text",
+            "text"
+          ]
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": [
+            "author",
+            "reviewer-a"
+          ]
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-duplicate-relation-target.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-duplicate-relation-target.json
new file mode 100644
index 000000000..5878ad89e
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-duplicate-relation-target.json
@@ -0,0 +1,123 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": [
+            "author",
+            "author"
+          ],
+          "distinct_vendor_from": "reviewer-a"
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-duplicate-role-name.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-duplicate-role-name.json
new file mode 100644
index 000000000..83e92576f
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-duplicate-role-name.json
@@ -0,0 +1,119 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-min-checkers-weakened.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-min-checkers-weakened.json
new file mode 100644
index 000000000..e2b8b27a7
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-min-checkers-weakened.json
@@ -0,0 +1,120 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C4": {
+      "min_checkers": 2,
+      "cross_vendor_required": true,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-c",
+          "role": "cross_vendor_checker",
+          "distinct_vendor_from": "author",
+          "distinct_model_from": "reviewer-a"
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-non-class-key.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-non-class-key.json
new file mode 100644
index 000000000..738758a8b
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-non-class-key.json
@@ -0,0 +1,132 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": [
+            "author",
+            "reviewer-a"
+          ]
+        }
+      ]
+    },
+    "C6": {
+      "min_checkers": 1,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "reviewer-a",
+          "role": "checker"
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-self-reference.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-self-reference.json
new file mode 100644
index 000000000..ae36740b5
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-self-reference.json
@@ -0,0 +1,122 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": [
+            "reviewer-b",
+            "reviewer-a"
+          ]
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-tightened-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-tightened-valid.json
new file mode 100644
index 000000000..e78c032de
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-tightened-valid.json
@@ -0,0 +1,151 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 4,
+      "min_model_checkers": 3,
+      "cross_vendor_required": true,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "scanner",
+          "role": "checker",
+          "scanner_class": "secret-detection"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author",
+          "distinct_vendor_from": [
+            "reviewer-b",
+            "reviewer-c"
+          ],
+          "min_context_tokens": 200000
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": [
+            "author",
+            "reviewer-a"
+          ],
+          "distinct_vendor_from": [
+            "reviewer-c"
+          ],
+          "requires_modality": [
+            "text"
+          ]
+        },
+        {
+          "name": "reviewer-c",
+          "role": "cross_vendor_checker",
+          "distinct_vendor_from": "author",
+          "distinct_model_from": [
+            "reviewer-a",
+            "reviewer-b"
+          ],
+          "requires_feature": [
+            "structured-output"
+          ]
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-unconstrained-checker-pair.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-unconstrained-checker-pair.json
new file mode 100644
index 000000000..4d3512302
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-unconstrained-checker-pair.json
@@ -0,0 +1,119 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": "author"
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-undeclared-role.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-undeclared-role.json
new file mode 100644
index 000000000..1fd371668
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-undeclared-role.json
@@ -0,0 +1,120 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author"
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": "reviewer-a",
+          "distinct_vendor_from": "reviewer-x"
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-unknown-predicate.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-unknown-predicate.json
new file mode 100644
index 000000000..48c9694b4
--- /dev/null
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/topology-unknown-predicate.json
@@ -0,0 +1,123 @@
+{
+  "schema_version": "1.0",
+  "executor_class": "self-operated",
+  "dispatch_posture": "autonomous-enabled",
+  "isolation_bindings": {
+    "ci-pool-a": {
+      "L2": {
+        "substrate": "egress-denied-container-pool",
+        "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
+        "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
+        "runtime_markers": {
+          "runner-pool": "ci-pool-a",
+          "region": "us-east"
+        }
+      }
+    }
+  },
+  "merge_policy": {
+    "C1": "human",
+    "C2": "human",
+    "C3": "human",
+    "C4": "human",
+    "C5": "human"
+  },
+  "verification_blocking": {
+    "deterministic": {
+      "C1": "not-required",
+      "C2": "blocking",
+      "C3": "blocking",
+      "C4": "blocking",
+      "C5": "blocking"
+    },
+    "ai-review": {
+      "C1": "not-required",
+      "C2": "not-required",
+      "C3": "advisory",
+      "C4": "blocking",
+      "C5": "blocking"
+    }
+  },
+  "verification_topology": {
+    "C3": {
+      "min_checkers": 2,
+      "cross_vendor_required": false,
+      "roles": [
+        {
+          "name": "author",
+          "role": "generator"
+        },
+        {
+          "name": "reviewer-a",
+          "role": "checker",
+          "distinct_model_from": "author",
+          "max_latency_ms": 500
+        },
+        {
+          "name": "reviewer-b",
+          "role": "checker",
+          "distinct_model_from": [
+            "author",
+            "reviewer-a"
+          ]
+        }
+      ]
+    }
+  },
+  "escalation_routes": {
+    "gate-failure": "queue:escalations/gate-failure",
+    "verification-divergence": "queue:escalations/verification-divergence",
+    "admission-rejection": "queue:escalations/admission-rejection",
+    "demotion": "queue:escalations/demotion",
+    "structural-plan-approval": "queue:escalations/structural-plan-approval",
+    "untrusted-provenance": "queue:escalations/untrusted-provenance"
+  },
+  "admission": {
+    "classification": {
+      "tracker-vcs-event": {
+        "autonomy:audit": "C1",
+        "autonomy:mechanical": "C2",
+        "autonomy:scoped": "C3",
+        "autonomy:structural": "C4",
+        "autonomy:untrusted": "C5"
+      }
+    },
+    "rules": [
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
+    ],
+    "autonomous_concurrency": 1,
+    "items_per_run": 3
+  }
+}
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/two-level-surface-valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/two-level-surface-valid.json
index cd26ad822..e8f5ca694 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/two-level-surface-valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/two-level-surface-valid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -16,6 +19,9 @@
       "L3": {
         "substrate": "microvm-pool",
         "substrate_class": "vm-microvm",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l3.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a-metal",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/unverifiable-probe-evidence.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/unverifiable-probe-evidence.json
index 66278d5a7..c5d691222 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/unverifiable-probe-evidence.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/unverifiable-probe-evidence.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/does-not-exist.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/valid.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/valid.json
index 324b9fe4a..ee1e92521 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/valid.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/valid.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
@@ -57,11 +60,36 @@
       }
     },
     "rules": [
-      { "signal_class": "*", "provenance": "*", "work_class": "C1", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C2", "disposition": "autonomous-eligible" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C3", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C4", "disposition": "human-gated" },
-      { "signal_class": "*", "provenance": "*", "work_class": "C5", "disposition": "human-gated" }
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C1",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C2",
+        "disposition": "autonomous-eligible"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C3",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C4",
+        "disposition": "human-gated"
+      },
+      {
+        "signal_class": "*",
+        "provenance": "*",
+        "work_class": "C5",
+        "disposition": "human-gated"
+      }
     ],
     "autonomous_concurrency": 1,
     "items_per_run": 3
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/vendor-hosted-auto.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/vendor-hosted-auto.json
index 05ecdc08e..a9de8699f 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/vendor-hosted-auto.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/vendor-hosted-auto.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/verification-below-floor.json b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/verification-below-floor.json
index 6d1d1d410..d65151c50 100644
--- a/plugins/autonomy/skills/setup/evals/fixtures/security-binding/verification-below-floor.json
+++ b/plugins/autonomy/skills/setup/evals/fixtures/security-binding/verification-below-floor.json
@@ -7,6 +7,9 @@
       "L2": {
         "substrate": "egress-denied-container-pool",
         "substrate_class": "container",
+        "component_reachable_hosts": [
+          "example.com"
+        ],
         "probe_evidence": "probe-transcripts/ci-pool-a-l2.json",
         "runtime_markers": {
           "runner-pool": "ci-pool-a",
diff --git a/plugins/autonomy/skills/setup/schemas/guardrails-security-binding.schema.json b/plugins/autonomy/skills/setup/schemas/guardrails-security-binding.schema.json
index 8a1c195f0..4d1f1bf9c 100644
--- a/plugins/autonomy/skills/setup/schemas/guardrails-security-binding.schema.json
+++ b/plugins/autonomy/skills/setup/schemas/guardrails-security-binding.schema.json
@@ -53,6 +53,18 @@
         "ai-review": { "$ref": "#/$defs/PerClassVerification" }
       }
     },
+    "verification_topology": {
+      "description": "Optional per-class verification-topology binding over the verification-topology leaf's vocabulary: WHO verifies, how those verifiers must differ, and the per-class checker floor. An absent key (or an absent class) is NOT a hole: the leaf's shipped floors apply, exactly as escalation_severity falls back to contract defaults. Shipped floor values are FLOORS: tightening is legal, weakening below a shipped value makes the binding invalid — the admission-rule override_justification escape does NOT apply here, the same rule verification_blocking carries. Policy is roles + relational constraints + machine-checkable predicates; every concrete model instance is an org-binding outcome resolved on the binding seam at run time, so no entry here ever names a vendor or instance.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "C1": { "$ref": "#/$defs/ClassTopology" },
+        "C2": { "$ref": "#/$defs/ClassTopology" },
+        "C3": { "$ref": "#/$defs/ClassTopology" },
+        "C4": { "$ref": "#/$defs/ClassTopology" },
+        "C5": { "$ref": "#/$defs/ClassTopology" }
+      }
+    },
     "promotion_state": {
       "description": "Keyed by PROMOTABLE cell id only (C2-auto-merge, C3-auto-merge, C3-ai-review-blocking); an entry for a non-promotable cell (C4/C5 merge never promotes) makes the binding invalid. The bound state is a CEILING: consumers must resolve the effective state against live promotion-evidence telemetry before every autonomous dispatch/merge decision, fail-closing to unpromoted when evidence is unavailable.",
       "type": "object",
@@ -174,8 +186,13 @@
           "description": "The HUMAN-RATIFIED substrate-class assertion the eligibility decision keys off, living here on the agent-unwritable surface — never resolved from the probe transcript, whose recorded class is capture evidence the executing agent could doctor and must EQUAL this value to verify. An L3 entry ratifying a class outside the kernel-separated pair (vm-microvm, hosted-ephemeral-executor) is an invalid binding, fail-closed.",
           "enum": ["container", "os-sandbox", "vm-microvm", "hosted-ephemeral-executor"]
         },
+        "component_reachable_hosts": {
+          "description": "The HUMAN-RATIFIED set of external destinations this surface's installed components may request — an outer-world fact no capture can establish, so it lives here on the agent-unwritable surface rather than in the transcript. An L2/L3 probe transcript verifies only when its probed egress targets cover this set in FULL: each ratified destination is a separate policy decision, so covering one says nothing about the rest. The EMPTY list is the explicit claim that this surface installs nothing carrying policy rules of its own; an ABSENT field leaves the level UNPROVEN and excluded from isolation eligibility, fail-closed.",
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
         "probe_evidence": {
-          "description": "Reference to the live-validation probe transcript that proved this boundary; a binding without probe evidence is invalid. For L2/L3 the referenced transcript must VERIFY (capture shape with all three assertions — denied egress proven by peer identity, absent host credentials, contained workspace host-writes — and a networked outer context) — under autonomous-enabled an unverifiable transcript leaves the level UNPROVEN and excluded from isolation eligibility, fail-closed. A transcript captured before the workspace assertion existed does not verify: the level goes UNPROVEN and the surface re-probes.",
+          "description": "Reference to the live-validation probe transcript that proved this boundary; a binding without probe evidence is invalid. For L2/L3 the referenced transcript must VERIFY (capture shape with all three assertions — denied egress proven by peer identity, absent host credentials, contained workspace host-writes — and a networked outer context) — under autonomous-enabled an unverifiable transcript leaves the level UNPROVEN and excluded from isolation eligibility, fail-closed. A transcript captured before the workspace assertion existed does not verify: the level goes UNPROVEN and the surface re-probes. The transcript must additionally cover every ratified component_reachable_hosts destination.",
           "type": "string",
           "minLength": 1
         },
@@ -226,6 +243,76 @@
         }
       }
     },
+    "ClassTopology": {
+      "description": "One class's declared verification topology: a list of checker SLOTS plus the floors evaluated over it. All four axes are required — a count with no slot list is a length with no coverage, so a declared class always carries the list its counts are checked against. The checker enforces the floor comparisons, relational-reference resolution, the declared distinctness the leaf requires of every model-adjudicated slot, and the never-vacuous cross_vendor_required rule; this schema fixes the shape.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["min_checkers", "min_model_checkers", "cross_vendor_required", "roles"],
+      "properties": {
+        "min_checkers": {
+          "description": "Floor-bounded count of DISTINCT checker slots — a coverage floor, never a list length: deterministic slots are distinguished by scanner class, model-adjudicated slots by declared distinctness, and two slots that resolve identically declare ONE checker.",
+          "type": "integer",
+          "minimum": 1
+        },
+        "min_model_checkers": {
+          "description": "Floor-bounded count of MODEL-ADJUDICATED checker slots. Exists because a total count cannot express which KIND of coverage is owed: without it a class meets its floor with deterministic slots alone and never faces a model judge.",
+          "type": "integer",
+          "minimum": 0
+        },
+        "cross_vendor_required": {
+          "description": "Whether the model-adjudicated slots must be pairwise vendor-disjoint AND disjoint from the generator. The knob itself carries that obligation onto every model-adjudicated slot, and it is never vacuously satisfied: asserting it with fewer than two model-adjudicated slots is invalid rather than trivially conforming. Floor-bounded: false where the shipped floor is true is invalid.",
+          "type": "boolean"
+        },
+        "roles": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/TopologyRole" }
+        }
+      }
+    },
+    "TopologyRole": {
+      "description": "One declared slot in the class's verification pipeline. A slot is filled by either a DETERMINISTIC layer (role checker carrying scanner_class) or a MODEL-ADJUDICATED role; a deterministic layer has no model or vendor identity, so the relational constraints and predicates bind only model-adjudicated slots and are never accepted on a deterministic one. name is the class-local id relational constraints resolve against: a constraint naming a role its own class does not declare is invalid, not ignored — that resolution is what keeps the constraint machine-checkable rather than decorative. A slot name says nothing about what it resolves to, so every model-adjudicated checker slot DECLARES distinct_model_from against the generator and against every other model-adjudicated checker slot; undeclared distinctness is unestablished distinctness. Predicates are requirements a binding can EVALUATE against a candidate instance; a requirement that cannot be evaluated is a preference, and preferences are not policy, so an unrecognized predicate key is rejected rather than carried as decoration.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "role"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "role": { "enum": ["generator", "checker", "cross_vendor_checker", "ranker"] },
+        "scanner_class": {
+          "description": "Marks the slot as a DETERMINISTIC layer and names the scanner class that distinguishes it — two deterministic slots sharing a scanner class resolve identically and declare one checker. Legal on role checker only.",
+          "type": "string",
+          "minLength": 1
+        },
+        "distinct_model_from": { "$ref": "#/$defs/RoleReference" },
+        "distinct_vendor_from": { "$ref": "#/$defs/RoleReference" },
+        "min_context_tokens": {
+          "description": "Evaluated against the declared input limit of the bound instance.",
+          "type": "integer",
+          "minimum": 1
+        },
+        "requires_modality": { "$ref": "#/$defs/PredicateTokenList" },
+        "requires_feature": { "$ref": "#/$defs/PredicateTokenList" }
+      }
+    },
+    "RoleReference": {
+      "description": "Relational-constraint target(s): the class-local name(s) of declared roles this role must differ from. A list is several constraints of one kind; entries must be distinct, because repeating a target restates one constraint while presenting as several.",
+      "oneOf": [
+        { "type": "string", "minLength": 1 },
+        {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        }
+      ]
+    },
+    "PredicateTokenList": {
+      "description": "Non-empty, duplicate-free token list. For requires_feature the names are vendor-local, so the binding declares the mapping it resolves them against; a repeated token is one requirement presenting as several.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 }
+    },
     "Route": { "type": "string", "minLength": 1 },
     "EscalationEventClass": {
       "description": "The escalation event-class registry: the six inherited guardrail classes plus the two additive runner classes. escalation_routes keeps requiring only the six inherited classes; the two runner classes bind additively, and a runner class keyed in escalation_severity must also carry its own escalation_routes entry (the queue destination severity can never supply).",
diff --git a/plugins/autonomy/skills/setup/scripts/check-security-binding.fixtures.test.manifest.json b/plugins/autonomy/skills/setup/scripts/check-security-binding.fixtures.test.manifest.json
index 828962757..44e41bc6d 100644
--- a/plugins/autonomy/skills/setup/scripts/check-security-binding.fixtures.test.manifest.json
+++ b/plugins/autonomy/skills/setup/scripts/check-security-binding.fixtures.test.manifest.json
@@ -830,6 +830,157 @@
       "exit": 0,
       "findings_substrings": [],
       "credential_roots": "/home/runner"
+    },
+    "topology-all-deterministic-c4.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C4.min_model_checkers: 0 weakens the shipped floor 2",
+        "verification_topology.C4: cross_vendor_required true with 0 model-adjudicated checker slots"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-checker-count-below-min.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3.roles: declares 2 distinct checker roles against min_checkers 3"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-cross-vendor-decorative.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3: cross_vendor_required true but no declared checker is vendor-distinct from the generator"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-cross-vendor-dropped.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C5.cross_vendor_required: false weakens the shipped floor true — floors may be tightened, never weakened"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-cross-vendor-no-generator.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3.roles[\"reviewer-a\"]: role cross_vendor_checker with no generator declared in this class"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-cross-vendor-vacuous.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3: cross_vendor_required true with 1 model-adjudicated checker slot"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-duplicate-modality.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3.roles[1].requires_modality: [\"text\",\"text\"] repeats a token"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-duplicate-relation-target.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3.roles[2].distinct_model_from: [\"author\",\"author\"] repeats a target"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-duplicate-role-name.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3.roles: \"reviewer-a\" is declared more than once",
+        "declares 1 distinct checker role against min_checkers 2"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-min-checkers-weakened.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C4.min_checkers: 2 weakens the shipped floor 3 — floors may be tightened, never weakened"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-non-class-key.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology: unknown key \"C6\" (additionalProperties: false)"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-self-reference.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3.roles[\"reviewer-b\"].distinct_model_from: names its own role"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-tightened-valid.json": {
+      "exit": 0,
+      "findings_substrings": [],
+      "credential_roots": "/home/runner"
+    },
+    "topology-unconstrained-checker-pair.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3.roles: checker roles \"reviewer-a\" and \"reviewer-b\" carry no distinct_model_from/distinct_vendor_from relation between them"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-undeclared-role.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3.roles[\"reviewer-b\"].distinct_vendor_from: \"reviewer-x\" names a role this class does not declare"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "topology-unknown-predicate.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "verification_topology.C3.roles[1]: unknown key \"max_latency_ms\" (additionalProperties: false)"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "probe-evidence-component-reach-uncovered.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "leaving ratified component_reachable_hosts api.example.net, cdn.example.net unprobed"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "probe-evidence-component-reach-partial.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "leaving ratified component_reachable_hosts api.example.net unprobed"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "probe-evidence-component-reach-unratified.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "the level binding ratifies no component_reachable_hosts"
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "component-reach-empty-valid.json": {
+      "exit": 0,
+      "findings_substrings": [],
+      "credential_roots": "/home/runner"
+    },
+    "auto-merge-advisory-checkers.json": {
+      "exit": 1,
+      "findings_substrings": [
+        "merge_policy.C2: \"auto\" with verification_blocking.ai-review.C2 \"advisory\"",
+        "merge_policy.C3: \"auto\" with verification_blocking.ai-review.C3 \"advisory\""
+      ],
+      "credential_roots": "/home/runner"
+    },
+    "auto-merge-blocking-checkers.json": {
+      "exit": 0,
+      "findings_substrings": [],
+      "credential_roots": "/home/runner"
     }
   },
   "quarantined": {},
diff --git a/plugins/autonomy/skills/setup/scripts/check-security-binding.mjs b/plugins/autonomy/skills/setup/scripts/check-security-binding.mjs
index 9e4e96f08..8d1798961 100755
--- a/plugins/autonomy/skills/setup/scripts/check-security-binding.mjs
+++ b/plugins/autonomy/skills/setup/scripts/check-security-binding.mjs
@@ -6,7 +6,8 @@
 // mirrored here, dependency-free) plus the semantic rules the schema cannot
 // express: matrix merge caps, runtime-marker attestability and pairwise
 // joint-satisfiability, per-surface class-aware isolation verdicts, promotion
-// discipline, and admission floors/precedence.
+// discipline, per-class verification-topology floors and coverage, and
+// admission floors/precedence.
 //
 // Usage: node check-security-binding.mjs <binding.json> [--evidence <evidence.json>] [--probe-evidence-root <dir>] [--egress-hosts <host,host,...>] [--credential-roots <path,path,...>]
 // Exit 0 = valid (verdicts printed); 1 = findings; 2 = usage/environment error.
@@ -365,13 +366,45 @@ const VERIFICATION_FLOORS = {
 };
 const VERIFICATION_STRENGTH = { "not-required": 0, advisory: 1, blocking: 2 };
 
+// The verification-topology leaf's vocabulary and shipped per-class floors.
+// Floors carry the same rule as VERIFICATION_FLOORS: tightening is legal,
+// weakening below a shipped value is invalid, and the admission-rule
+// override_justification escape applies to admission rules ONLY, never here.
+// An ABSENT verification_topology key (or an absent class) is not a hole:
+// the leaf's shipped floors apply, exactly as escalation_severity falls back
+// to contract defaults.
+const TOPOLOGY_ROLES = ["generator", "checker", "cross_vendor_checker", "ranker"];
+// The roles that count toward min_checkers: a cross_vendor_checker IS a
+// checker, additionally constrained to a different vendor from the generator.
+const CHECKER_TYPED_ROLES = new Set(["checker", "cross_vendor_checker"]);
+const RELATIONAL_CONSTRAINTS = ["distinct_model_from", "distinct_vendor_from"];
+// min_model_checkers exists because a total count cannot express which KIND
+// of coverage is owed: without it a class meets min_checkers with
+// deterministic slots alone, never faces a model judge, and
+// cross_vendor_required then binds an empty set of model slots and is
+// satisfied by declaring nothing.
+const TOPOLOGY_FLOORS = {
+  C1: { min_checkers: 1, min_model_checkers: 0, cross_vendor_required: false },
+  C2: { min_checkers: 1, min_model_checkers: 0, cross_vendor_required: false },
+  C3: { min_checkers: 2, min_model_checkers: 1, cross_vendor_required: false },
+  C4: { min_checkers: 3, min_model_checkers: 2, cross_vendor_required: true },
+  C5: { min_checkers: 3, min_model_checkers: 2, cross_vendor_required: true },
+};
+
 const PROMOTABLE_CELLS = new Set(["C2-auto-merge", "C3-auto-merge", "C3-ai-review-blocking"]);
 
 // C3 auto-merge's evidence predicate builds on the C2 auto-merge track record
 // (>= 20 autonomous C2 merges with 0 demotion events), so contrary evidence
 // against the prerequisite cell invalidates the dependent cell too — a failed
 // trust signal never leaves a promotion that was earned on it standing.
-const PROMOTION_DEPENDENCIES = { "C3-auto-merge": ["C2-auto-merge"] };
+// APPEND, never prepend: `failed` is built in dependency-array order and a
+// fixture pins the C2 cell as the named prerequisite, so reordering breaks that
+// pin the moment both fail. C3 auto-merge's automatic transition is gated on the
+// C3 AI-review cell being blocking — an advisory review layer gives a dissenting
+// checker no force — so a demotion of that cell must lower auto-merge with it.
+// Reached dynamically otherwise: the review cell resolves back to its advisory
+// floor on contrary evidence while auto-merge stays effective-promoted.
+const PROMOTION_DEPENDENCIES = { "C3-auto-merge": ["C2-auto-merge", "C3-ai-review-blocking"] };
 
 // Admission shipped defaults per work class (the admission-policy leaf), and
 // the leaf's permissiveness order: autonomous-eligible > human-gated >
@@ -469,6 +502,7 @@ function validateStructure(binding) {
       "isolation_bindings",
       "merge_policy",
       "verification_blocking",
+      "verification_topology",
       "promotion_state",
       "escalation_routes",
       "escalation_severity",
@@ -519,7 +553,14 @@ function validateStructure(binding) {
             findings.push(`${where}: must be an object`);
             continue;
           }
-          checkAllowedKeys(entry, ["substrate", "substrate_class", "probe_evidence", "runtime_markers"], where);
+          checkAllowedKeys(entry, ["substrate", "substrate_class", "component_reachable_hosts", "probe_evidence", "runtime_markers"], where);
+          if (
+            Object.hasOwn(entry, "component_reachable_hosts") &&
+            (!Array.isArray(entry.component_reachable_hosts) ||
+              entry.component_reachable_hosts.some((host) => !isNonEmptyString(host)))
+          ) {
+            findings.push(`${where}.component_reachable_hosts: must be an array of non-empty host strings — the empty array is the explicit claim that this surface installs nothing carrying policy rules of its own`);
+          }
           if (!isNonEmptyString(entry.substrate)) {
             findings.push(`${where}.substrate: missing or empty — the bound substrate instance id is required`);
           }
@@ -605,6 +646,20 @@ function validateStructure(binding) {
     }
   }
 
+  if (Object.hasOwn(binding, "verification_topology")) {
+    if (!isPlainObject(binding.verification_topology)) {
+      findings.push("verification_topology: must be an object keyed by work class");
+    } else {
+      checkAllowedKeys(binding.verification_topology, WORK_CLASSES, "verification_topology");
+      for (const workClass of WORK_CLASSES) {
+        // An absent class is not a hole: the verification-topology leaf's
+        // shipped floors apply to it, so only declared classes validate.
+        if (!Object.hasOwn(binding.verification_topology, workClass)) continue;
+        validateClassTopologyStructure(binding.verification_topology[workClass], `verification_topology.${workClass}`);
+      }
+    }
+  }
+
   if (Object.hasOwn(binding, "promotion_state")) {
     if (!isPlainObject(binding.promotion_state)) {
       findings.push("promotion_state: must be an object keyed by promotable cell id");
@@ -901,6 +956,90 @@ function validateTemporalClassificationHome(ruleHome, where) {
   }
 }
 
+// One class's declared verification topology (mirrors $defs/ClassTopology).
+// All three axes are required on a declared class: a count with no role list
+// is a length with no coverage, so the roles the count is evaluated against
+// always travel with it. Predicate keys are a CLOSED set — a predicate is a
+// requirement a binding can EVALUATE against a candidate instance, and an
+// unrecognized token cannot be evaluated, so it is rejected rather than
+// carried as decoration.
+function validateClassTopologyStructure(topology, where) {
+  if (!isPlainObject(topology)) {
+    findings.push(`${where}: must be an object binding the class's declared topology ({min_checkers, min_model_checkers, cross_vendor_required, roles})`);
+    return;
+  }
+  const topologyKeys = ["min_checkers", "min_model_checkers", "cross_vendor_required", "roles"];
+  checkAllowedKeys(topology, topologyKeys, where);
+  for (const key of topologyKeys) {
+    if (!Object.hasOwn(topology, key)) {
+      findings.push(`${where}.${key}: required key missing — a declared class topology carries all four axes, because a count without its role list (or a role list without its count) cannot be evaluated`);
+    }
+  }
+  if (Object.hasOwn(topology, "min_checkers") && (!Number.isInteger(topology.min_checkers) || topology.min_checkers < 1)) {
+    findings.push(`${where}.min_checkers: must be an integer >= 1`);
+  }
+  if (Object.hasOwn(topology, "min_model_checkers") && (!Number.isInteger(topology.min_model_checkers) || topology.min_model_checkers < 0)) {
+    findings.push(`${where}.min_model_checkers: must be an integer >= 0`);
+  }
+  if (Object.hasOwn(topology, "cross_vendor_required") && typeof topology.cross_vendor_required !== "boolean") {
+    findings.push(`${where}.cross_vendor_required: must be a boolean`);
+  }
+  if (!Object.hasOwn(topology, "roles")) return;
+  if (!Array.isArray(topology.roles) || topology.roles.length === 0) {
+    findings.push(`${where}.roles: must be a non-empty array of declared role entries`);
+    return;
+  }
+  topology.roles.forEach((entry, index) => {
+    const entryWhere = `${where}.roles[${index}]`;
+    if (!isPlainObject(entry)) {
+      findings.push(`${entryWhere}: must be an object`);
+      return;
+    }
+    checkAllowedKeys(
+      entry,
+      ["name", "role", "scanner_class", "distinct_model_from", "distinct_vendor_from", "min_context_tokens", "requires_modality", "requires_feature"],
+      entryWhere,
+    );
+    if (Object.hasOwn(entry, "scanner_class") && !isNonEmptyString(entry.scanner_class)) {
+      findings.push(`${entryWhere}.scanner_class: must be a non-empty string naming the scanner class that distinguishes this deterministic slot`);
+    }
+    if (!isNonEmptyString(entry.name)) {
+      findings.push(`${entryWhere}.name: missing or empty — the class-local id relational constraints resolve against`);
+    }
+    checkEnum(entry.role, TOPOLOGY_ROLES, `${entryWhere}.role`);
+    for (const constraint of RELATIONAL_CONSTRAINTS) {
+      if (!Object.hasOwn(entry, constraint)) continue;
+      const value = entry[constraint];
+      const targets = typeof value === "string" ? [value] : Array.isArray(value) ? value : null;
+      if (targets === null || targets.length === 0 || targets.some((target) => !isNonEmptyString(target))) {
+        findings.push(`${entryWhere}.${constraint}: must be a non-empty role name or a non-empty array of role names`);
+        continue;
+      }
+      if (new Set(targets).size !== targets.length) {
+        findings.push(
+          `${entryWhere}.${constraint}: ${JSON.stringify(value)} repeats a target — listing one role twice restates a single constraint while presenting as several`,
+        );
+      }
+    }
+    if (Object.hasOwn(entry, "min_context_tokens") && (!Number.isInteger(entry.min_context_tokens) || entry.min_context_tokens < 1)) {
+      findings.push(`${entryWhere}.min_context_tokens: must be an integer >= 1 — the predicate evaluates against the declared input limit of the bound instance`);
+    }
+    for (const predicate of ["requires_modality", "requires_feature"]) {
+      if (!Object.hasOwn(entry, predicate)) continue;
+      const value = entry[predicate];
+      if (!Array.isArray(value) || value.length === 0 || value.some((token) => !isNonEmptyString(token))) {
+        findings.push(`${entryWhere}.${predicate}: must be a non-empty array of non-empty string tokens`);
+        continue;
+      }
+      if (new Set(value).size !== value.length) {
+        findings.push(
+          `${entryWhere}.${predicate}: ${JSON.stringify(value)} repeats a token — a repeated requirement is one requirement presenting as several`,
+        );
+      }
+    }
+  });
+}
+
 // --- Semantic rules the schema cannot express ---
 
 function levelNumber(token) {
@@ -1116,7 +1255,7 @@ function isNonExternalEgressHost(host) {
 // surface, level, substrate, or substrate class proves a DIFFERENT boundary,
 // not this one. Returns null when verified, else the reason the entry is
 // unproven.
-function verifyProbeTranscript(ref, probeRoot, surfaceId, level, substrate, substrateClass, egressAllowList, credentialRoots) {
+function verifyProbeTranscript(ref, probeRoot, surfaceId, level, substrate, substrateClass, egressAllowList, credentialRoots, componentReachableHosts) {
   // Evidence verifies ONLY against the configured protected root: without
   // --probe-evidence-root a ref resolves as written — including to an
   // agent-writable file swapped after the human ratified the binding — so no
@@ -1412,7 +1551,7 @@ function verifyProbeTranscript(ref, probeRoot, surfaceId, level, substrate, subs
     return `transcript ${path} records assertions.egress_denied.client_ready ${JSON.stringify(egress.client_ready)} — the probe client must first be shown to RUN inside the boundary (exit "0" against an in-boundary endpoint): an absent or broken client would otherwise satisfy every egress assertion trivially`;
   }
   // One denied destination is fully consistent with a policy that allows
-  // others — including one a kit installed on top of a global deny-all.
+  // others — including one a component installed on top of a global deny-all.
   if (egressHosts.length < 2) {
     return `transcript ${path} records ${egressHosts.length} probed egress target — a single probed target cannot establish default-deny egress, since a policy may allow other destinations while denying this one; probe at least two distinct external targets under different operators`;
   }
@@ -1468,6 +1607,32 @@ function verifyProbeTranscript(ref, probeRoot, surfaceId, level, substrate, subs
   }
   const workspaceProblem = verifyWorkspaceContainment(transcript, path);
   if (workspaceProblem !== null) return workspaceProblem;
+  // Target selection is load-bearing, and this leg is LAST for the reason the
+  // whole hardened block is: the function returns the FIRST problem, and every
+  // pre-existing fixture pins the reason its own transcript is rejected for.
+  //
+  // The distinct-targets leg above samples only what the BASE policy denies. A
+  // surface whose additive policy layer lets an installed component carry rules
+  // of its own is widened at exactly the destinations those components request,
+  // so a probe drawn from anywhere else certifies a boundary open at the one
+  // place it never looked. Which destinations those are is an outer-world fact
+  // no capture can establish, so the set rides the HUMAN-RATIFIED level entry on
+  // the agent-unwritable surface — the trust boundary substrate_class sits on —
+  // and the transcript's job is to show the probe covered it.
+  if (!Array.isArray(componentReachableHosts)) {
+    return `the level binding ratifies no component_reachable_hosts — the destinations this surface's installed components may request are an outer-world fact no capture can establish, so they are ratified on the binding entry and the probe must cover them; ratify the list (or the empty list, where this surface installs nothing carrying policy rules of its own) on the agent-unwritable binding surface`;
+  }
+  if (componentReachableHosts.some((host) => !isNonEmptyString(host))) {
+    return `the level binding ratifies a component_reachable_hosts entry that is not a non-empty host string — every ratified destination must name a host the probe can be checked against`;
+  }
+  // Coverage, never a count: each ratified destination is a separate policy
+  // decision, so probing one says nothing about the rest.
+  const uncoveredRatified = componentReachableHosts
+    .map((host) => host.trim().toLowerCase().replace(/\.$/, ""))
+    .filter((host) => !distinctEgressHosts.has(host));
+  if (uncoveredRatified.length > 0) {
+    return `transcript ${path} probes ${[...distinctEgressHosts].join(", ")}, leaving ratified component_reachable_hosts ${uncoveredRatified.join(", ")} unprobed — each ratified destination is a separate policy decision, so covering one says nothing about the rest; probe every ratified component-reachable destination in the configuration the run will actually use`;
+  }
   return null;
 }
 
@@ -1662,7 +1827,7 @@ function checkSemantics(binding, probeRoot, egressAllowList, credentialRoots) {
         continue;
       }
       const reason = isNonEmptyString(entry.probe_evidence)
-        ? verifyProbeTranscript(entry.probe_evidence, probeRoot, surfaceId, level, entry.substrate, entry.substrate_class, egressAllowList, credentialRoots)
+        ? verifyProbeTranscript(entry.probe_evidence, probeRoot, surfaceId, level, entry.substrate, entry.substrate_class, egressAllowList, credentialRoots, entry.component_reachable_hosts)
         : "probe_evidence missing";
       if (reason === null) {
         provenMax = Math.max(provenMax, levelNo);
@@ -1775,6 +1940,74 @@ function checkSemantics(binding, probeRoot, egressAllowList, credentialRoots) {
     }
   }
 
+  // Unanimity join. A class bound auto-merge takes its transition without a
+  // human, and the topology leaf's unanimity invariant requires every checker
+  // the class declares to agree first. The topology floor supplies the checker
+  // POPULATION; the security-review knob supplies its FORCE — unanimity needs
+  // both, and only force is configurable into absence, because floors are
+  // tighten-only. Two ways a binding removes it: an advisory layer, where the
+  // checker dissents and the transition proceeds anyway; and a not-required
+  // layer with model-adjudicated checkers DECLARED for the class, where the
+  // layer they judge in never runs, so their agreement can never be obtained.
+  // A class declaring no model-adjudicated checker is exempt from the second:
+  // its floor is seated by a deterministic slot, whose force is its own layer.
+  // Vendor-hosted is exempt entirely — the cap above already rejects every auto
+  // cell there, the same carve-out the promotion-ratification checks make. A
+  // missing or malformed knob already produced its structural finding;
+  // re-reporting it here would double-name one root cause.
+  if (
+    isPlainObject(binding.merge_policy) &&
+    isPlainObject(binding.verification_blocking) &&
+    binding.executor_class !== "vendor-hosted"
+  ) {
+    for (const workClass of WORK_CLASSES) {
+      if (binding.merge_policy[workClass] !== "auto") continue;
+      for (const layer of LAYERS) {
+        const perClass = binding.verification_blocking[layer];
+        if (!isPlainObject(perClass) || perClass[workClass] !== "advisory") continue;
+        findings.push(
+          `merge_policy.${workClass}: "auto" with verification_blocking.${layer}.${workClass} "advisory" — an automatic transition requires unanimous agreement among every checker the class declares, and an advisory layer records a checker's dissent without withholding the transition; set verification_blocking.${layer}.${workClass} to "blocking" (ratifying its promotion_state cell where the cell is promotable) or bind merge_policy.${workClass} to "human"`,
+        );
+      }
+      const aiReview = binding.verification_blocking["ai-review"];
+      if (!isPlainObject(aiReview) || aiReview[workClass] !== "not-required") continue;
+      const topology = isPlainObject(binding.verification_topology)
+        ? binding.verification_topology[workClass]
+        : null;
+      if (!isPlainObject(topology) || !Array.isArray(topology.roles)) continue;
+      const declaredModelCheckers = topology.roles
+        .filter(
+          (role) =>
+            isPlainObject(role) &&
+            CHECKER_TYPED_ROLES.has(role.role) &&
+            isNonEmptyString(role.name) &&
+            !isNonEmptyString(role.scanner_class),
+        )
+        .map((role) => JSON.stringify(role.name));
+      if (declaredModelCheckers.length === 0) continue;
+      findings.push(
+        `verification_topology.${workClass}.roles: model-adjudicated checkers [${declaredModelCheckers.join(", ")}] declared while merge_policy.${workClass} is "auto" and verification_blocking.ai-review.${workClass} is "not-required" — the layer those checkers judge in never runs, so their agreement can never be obtained and unanimity over them is vacuous while the merge proceeds automatically; set verification_blocking.ai-review.${workClass} to "blocking", drop the model-adjudicated roles and let the class's deterministic slot seat its floor, or bind merge_policy.${workClass} to "human"`,
+      );
+    }
+  }
+
+  // Verification-topology floors and coverage per declared class. An absent
+  // verification_topology (or an absent class within it) is NOT a hole: the
+  // verification-topology leaf's shipped floors apply, exactly as
+  // escalation_severity falls back to contract defaults — so only declared
+  // classes are checked, and each on all three axes: the floors
+  // (tighten-only, no override escape — the same rule verification_blocking
+  // carries), the reference resolution that keeps relational constraints
+  // machine-checkable, and the distinctness coverage that keeps min_checkers
+  // a count of distinct checkers rather than a length.
+  if (isPlainObject(binding.verification_topology)) {
+    for (const workClass of WORK_CLASSES) {
+      const topology = binding.verification_topology[workClass];
+      if (!isPlainObject(topology)) continue;
+      checkTopologySemantics(topology, workClass);
+    }
+  }
+
   // No notification-routability rule exists for escalation_severity on
   // purpose: severity selects only the NOTIFICATION fan-out layered on the
   // filed item — it never redirects the item, whose queue destination stays
@@ -1845,6 +2078,226 @@ function checkAdmissionSemantics(rules) {
   }
 }
 
+// A relational constraint's target list, tolerant of structurally invalid
+// values (those already produced their structural finding): a string is one
+// target, an array is several.
+function topologyConstraintTargets(entry, constraint) {
+  const value = entry[constraint];
+  if (typeof value === "string") return isNonEmptyString(value) ? [value] : [];
+  if (Array.isArray(value)) return value.filter(isNonEmptyString);
+  return [];
+}
+
+function checkTopologySemantics(topology, workClass) {
+  const where = `verification_topology.${workClass}`;
+  const floor = TOPOLOGY_FLOORS[workClass];
+  if (Number.isInteger(topology.min_checkers) && topology.min_checkers < floor.min_checkers) {
+    findings.push(
+      `${where}.min_checkers: ${topology.min_checkers} weakens the shipped floor ${floor.min_checkers} — floors may be tightened, never weakened (override_justification applies to admission rules only)`,
+    );
+  }
+  if (
+    Number.isInteger(topology.min_model_checkers) &&
+    topology.min_model_checkers < floor.min_model_checkers
+  ) {
+    findings.push(
+      `${where}.min_model_checkers: ${topology.min_model_checkers} weakens the shipped floor ${floor.min_model_checkers} — floors may be tightened, never weakened (override_justification applies to admission rules only)`,
+    );
+  }
+  if (topology.cross_vendor_required === false && floor.cross_vendor_required) {
+    findings.push(
+      `${where}.cross_vendor_required: false weakens the shipped floor true — floors may be tightened, never weakened (override_justification applies to admission rules only)`,
+    );
+  }
+  if (!Array.isArray(topology.roles)) return;
+  const entries = topology.roles.filter((entry) => isPlainObject(entry) && isNonEmptyString(entry.name));
+  // Distinct names, not entry count: two entries sharing one name declare ONE
+  // role while presenting as two, so the duplicate is rejected and only the
+  // first declaration seats the name.
+  const declared = new Map();
+  for (const entry of entries) {
+    if (declared.has(entry.name)) {
+      findings.push(
+        `${where}.roles: ${JSON.stringify(entry.name)} is declared more than once — role names are the class-local identity relational constraints resolve against, so a repeated name declares one role while presenting as several`,
+      );
+    } else {
+      declared.set(entry.name, entry);
+    }
+  }
+  // Reference resolution: a relational constraint naming a role its own class
+  // does not declare is INVALID, not ignored — this resolution is what makes
+  // the constraint machine-checkable rather than decorative. A self-reference
+  // is equally unevaluable: a role cannot be distinct from itself.
+  for (const entry of entries) {
+    for (const constraint of RELATIONAL_CONSTRAINTS) {
+      if (!Object.hasOwn(entry, constraint)) continue;
+      for (const target of topologyConstraintTargets(entry, constraint)) {
+        if (target === entry.name) {
+          findings.push(
+            `${where}.roles[${JSON.stringify(entry.name)}].${constraint}: names its own role — a role cannot be distinct from itself, so a self-reference can never be evaluated`,
+          );
+        } else if (!declared.has(target)) {
+          findings.push(
+            `${where}.roles[${JSON.stringify(entry.name)}].${constraint}: ${JSON.stringify(target)} names a role this class does not declare — a relational constraint resolves against its own class's role list, so an undeclared reference can never be evaluated; invalid, not ignored`,
+          );
+        }
+      }
+    }
+  }
+  // A cross_vendor_checker's DEFINING constraint references the generator —
+  // "a checker additionally constrained to a different vendor from the
+  // generator" — so declaring one in a class with no declared generator role
+  // leaves that constraint without a referent: unevaluable, under the same
+  // invalid-not-ignored rule as any other unresolvable reference.
+  const generatorNames = new Set(
+    [...declared.values()].filter((entry) => entry.role === "generator").map((entry) => entry.name),
+  );
+  if (generatorNames.size === 0) {
+    for (const entry of declared.values()) {
+      if (entry.role !== "cross_vendor_checker") continue;
+      findings.push(
+        `${where}.roles[${JSON.stringify(entry.name)}]: role cross_vendor_checker with no generator declared in this class — the role is a checker constrained to a different vendor from the GENERATOR, so without a declared generator its defining constraint has no referent and can never be evaluated; declare the generator role, or use role checker`,
+      );
+    }
+  }
+  const checkers = [...declared.values()].filter((entry) => CHECKER_TYPED_ROLES.has(entry.role));
+  // A slot is filled by either a DETERMINISTIC layer or a MODEL-ADJUDICATED
+  // role. A deterministic layer has no model or vendor identity, so the
+  // relational constraints and predicates cannot be evaluated against one and
+  // are rejected on it rather than silently ignored.
+  const deterministic = checkers.filter((entry) => isNonEmptyString(entry.scanner_class));
+  const modelCheckers = checkers.filter((entry) => !isNonEmptyString(entry.scanner_class));
+  for (const entry of deterministic) {
+    if (entry.role !== "checker") {
+      findings.push(
+        `${where}.roles[${JSON.stringify(entry.name)}]: scanner_class on role ${entry.role} — scanner_class marks a DETERMINISTIC slot, which has no vendor identity, so it is legal on role checker only`,
+      );
+    }
+    for (const key of [...RELATIONAL_CONSTRAINTS, "min_context_tokens", "requires_modality", "requires_feature"]) {
+      if (!Object.hasOwn(entry, key)) continue;
+      findings.push(
+        `${where}.roles[${JSON.stringify(entry.name)}].${key}: declared on a deterministic slot — a deterministic layer has no model or vendor identity, so this constraint can never be evaluated against it; drop it, or drop scanner_class to declare a model-adjudicated slot`,
+      );
+    }
+  }
+  // Deterministic slots are distinguished by SCANNER CLASS: two sharing one
+  // scanner class resolve identically and declare one checker.
+  const scannerClasses = new Map();
+  for (const entry of deterministic) {
+    const seen = scannerClasses.get(entry.scanner_class);
+    if (seen !== undefined) {
+      findings.push(
+        `${where}.roles: deterministic slots ${JSON.stringify(seen)} and ${JSON.stringify(entry.name)} share scanner_class ${JSON.stringify(entry.scanner_class)} — two slots that resolve identically declare ONE checker, so the pair counts once toward min_checkers`,
+      );
+    } else {
+      scannerClasses.set(entry.scanner_class, entry.name);
+    }
+  }
+  // A slot NAME says nothing about what it resolves to, so distinctness that
+  // is only intended is not distinctness: every model-adjudicated checker
+  // DECLARES distinct_model_from against the generator. Undeclared is the
+  // unevaluable case, which is the same failure as declaring none.
+  for (const entry of modelCheckers) {
+    if (generatorNames.size === 0) continue;
+    const targets = RELATIONAL_CONSTRAINTS.flatMap((constraint) => topologyConstraintTargets(entry, constraint));
+    if (targets.some((target) => generatorNames.has(target))) continue;
+    findings.push(
+      `${where}.roles[${JSON.stringify(entry.name)}]: model-adjudicated checker with no distinctness relation to the generator — a model judging its own output measures its own preference rather than the artifact, and an undeclared constraint is unestablished, not generous; declare distinct_model_from against the generator role`,
+    );
+  }
+  const minModelCheckers = Number.isInteger(topology.min_model_checkers)
+    ? topology.min_model_checkers
+    : floor.min_model_checkers;
+  if (modelCheckers.length < minModelCheckers) {
+    findings.push(
+      `${where}.roles: declares ${modelCheckers.length} model-adjudicated checker slot${modelCheckers.length === 1 ? "" : "s"} against min_model_checkers ${minModelCheckers} — a total count cannot express which KIND of coverage is owed, so a class meeting min_checkers with deterministic slots alone never faces the model judge its verification cell requires`,
+    );
+  }
+  // Coverage, not length: min_checkers is evaluated over the DISTINCT
+  // checker-typed roles the class declares — a list that cannot seat the
+  // count makes the declared topology unsatisfiable.
+  const minCheckers = Number.isInteger(topology.min_checkers) ? topology.min_checkers : floor.min_checkers;
+  if (checkers.length < minCheckers) {
+    findings.push(
+      `${where}.roles: declares ${checkers.length} distinct checker role${checkers.length === 1 ? "" : "s"} against min_checkers ${minCheckers} — min_checkers counts DISTINCT checker roles drawn from the declared role list, so a list that cannot seat the count makes the topology unsatisfiable`,
+    );
+  }
+  // Count is not coverage: two declared checker roles with no distinctness
+  // relation between them can both resolve to ONE instance at run time, and
+  // N runs of a single instance count as one checker — they share the
+  // failure the count exists to catch. Every pair of counted checkers must
+  // be held distinct by a relational constraint in at least one direction
+  // (distinct_vendor_from implies distinct model: disjoint vendors never
+  // share an instance).
+  const holdsDistinct = (a, b) =>
+    RELATIONAL_CONSTRAINTS.some(
+      (constraint) =>
+        topologyConstraintTargets(a, constraint).includes(b.name) ||
+        topologyConstraintTargets(b, constraint).includes(a.name),
+    );
+  // Scoped to the MODEL-adjudicated slots. A deterministic slot cannot carry a
+  // relational constraint at all — it has no model or vendor identity — and it
+  // can never resolve to the same thing as a model judge, so a cross-kind pair
+  // is distinct by construction. Deterministic slots are held apart from each
+  // other by scanner class above.
+  for (let i = 0; i < modelCheckers.length; i += 1) {
+    for (let j = i + 1; j < modelCheckers.length; j += 1) {
+      if (!holdsDistinct(modelCheckers[i], modelCheckers[j])) {
+        findings.push(
+          `${where}.roles: checker roles ${JSON.stringify(modelCheckers[i].name)} and ${JSON.stringify(modelCheckers[j].name)} carry no distinct_model_from/distinct_vendor_from relation between them — nothing keeps both from resolving to one instance, and N runs of a single instance count as ONE checker toward min_checkers; constrain the pair distinct in at least one direction`,
+        );
+      }
+    }
+  }
+  // cross_vendor_required is enforceable only where the role list can seat
+  // it: a cross_vendor_checker is definitionally vendor-distinct from the
+  // generator, and a plain checker qualifies when constrained
+  // distinct_vendor_from a declared generator role. A true knob with neither
+  // is a requirement the declared topology can never evaluate — decorative,
+  // not policy.
+  if (topology.cross_vendor_required === true) {
+    // Never vacuously satisfied. The knob's whole reason is that same-vendor
+    // checkers share failure modes, so agreement between them is weaker
+    // evidence than its count suggests — a class asserting it over fewer than
+    // two model-adjudicated slots satisfies neither the constraint nor the
+    // reason for it, and one asserting it over ZERO binds the empty set and is
+    // satisfied by declaring nothing.
+    if (modelCheckers.length < 2) {
+      findings.push(
+        `${where}: cross_vendor_required true with ${modelCheckers.length} model-adjudicated checker slot${modelCheckers.length === 1 ? "" : "s"} — the requirement is vendor disjointness AMONG the model slots, so fewer than two makes it vacuous rather than trivially conforming; declare at least two model-adjudicated checkers or bind cross_vendor_required false where the floor allows`,
+      );
+    }
+    const seated = checkers.some(
+      (entry) =>
+        entry.role === "cross_vendor_checker" ||
+        topologyConstraintTargets(entry, "distinct_vendor_from").some((target) => generatorNames.has(target)),
+    );
+    if (!seated) {
+      findings.push(
+        `${where}: cross_vendor_required true but no declared checker is vendor-distinct from the generator — declare a cross_vendor_checker role, or constrain a checker distinct_vendor_from a declared generator role; a requirement the role list cannot seat is decorative, not policy`,
+      );
+    }
+    // Disjointness among the model slots, not merely against the generator:
+    // {V2, V2, V2} against a V1 generator satisfies a generator-only reading
+    // while every checker shares a vendor with every other — precisely the
+    // shared-failure-mode case the knob exists to break up.
+    for (let i = 0; i < modelCheckers.length; i += 1) {
+      for (let j = i + 1; j < modelCheckers.length; j += 1) {
+        const a = modelCheckers[i];
+        const b = modelCheckers[j];
+        const disjoint =
+          topologyConstraintTargets(a, "distinct_vendor_from").includes(b.name) ||
+          topologyConstraintTargets(b, "distinct_vendor_from").includes(a.name);
+        if (!disjoint) {
+          findings.push(
+            `${where}.roles: model-adjudicated checkers ${JSON.stringify(a.name)} and ${JSON.stringify(b.name)} carry no distinct_vendor_from relation between them while cross_vendor_required is true — vendor disjointness is required AMONG the model slots, not only against the generator, because same-vendor checkers share failure modes and their agreement is weaker evidence than its count suggests`,
+          );
+        }
+      }
+    }
+  }
+}
+
 // --- Evaluation mode: effective promotion state from an evidence source ---
 
 function resolveEffectivePromotion(binding, evidencePath) {
diff --git a/plugins/autonomy/skills/setup/templates/isolation-probe.md b/plugins/autonomy/skills/setup/templates/isolation-probe.md
index 1d8f129a4..c1fd849f7 100644
--- a/plugins/autonomy/skills/setup/templates/isolation-probe.md
+++ b/plugins/autonomy/skills/setup/templates/isolation-probe.md
@@ -15,7 +15,7 @@ Three checks, run inside the boundary, all expected to FAIL:
 
 | Assertion | Runs | Expected result |
 |---|---|---|
-| Denied egress | a TLS fetch of two `<well-known-external-host>` targets under different operators | no origin peer answered — NON-zero exit, and no in-boundary peer identity matching the outer context's |
+| Denied egress | a TLS fetch of two `<well-known-external-host>` targets under different operators, plus every destination the level binding ratifies as component-reachable | no origin peer answered — NON-zero exit, and no in-boundary peer identity matching the outer context's |
 | Absent host credentials | a read of `<host-credential-path>` | file absent, or read denied — NON-zero exit |
 | Contained workspace host-writes | randomized canary writes into the workspace mount, re-checked on the host after teardown | every canary still absent on the host, and the VCS control-plane digest unchanged |
 
@@ -51,7 +51,7 @@ trusted-root values bind per the deployment's secret-binding classification.
 
 ## Egress-denial probe shape
 
-Three properties have to hold together, because each one alone is satisfiable by a boundary that is
+Four properties have to hold together, because each one alone is satisfiable by a boundary that is
 not `L2`.
 
 **The client must be shown to run.** A boundary with no working fetch tool denies nothing, yet a
@@ -59,13 +59,37 @@ missing tool is indistinguishable from a sealed network by exit code alone — s
 boundary would otherwise score best. Prove the client runs before believing anything it reports.
 
 **At least two targets, under different operators.** One denied destination is fully consistent with
-a policy that allows others; a kit installed on top of a global deny-all can add its own allow rule.
+a policy that allows others; a component installed on top of a global deny-all can add its own allow
+rule.
 
 **Each target must be reachable from the OUTER context first.** A target that fails everywhere — an
 unregistered name, a dead host — "fails" inside too and proves nothing. This is why the targets are
 well-known hosts rather than unguessable ones: unguessability and outer-reachability cannot both hold
 over DNS, and outer-reachability is what makes the inner failure mean something.
 
+**Every destination the level binding ratifies as component-reachable must be among the targets.**
+Two targets under different operators sample only what the BASE policy denies. Where the surface
+carries an additive policy layer, the destinations its installed components request are the exact
+places the boundary may already have been widened, so a probe drawn from anywhere else certifies a
+boundary open at the one place it never looked. Which destinations those are is an outer-world fact
+no capture can establish, so the set is HUMAN-RATIFIED on the level binding's
+`component_reachable_hosts` — the agent-unwritable surface `substrate_class` already sits on — and
+the probe covers it in FULL, since covering one ratified destination says nothing about the rest.
+An empty ratified list is the explicit claim that this surface installs nothing carrying policy
+rules of its own; an ABSENT one leaves the level unproven, fail-closed. Ratify only destinations
+the outer context can itself reach: a component-reachable destination on a private or internal
+network fails the outer-reachability property above and is outside what this probe settles. Probe
+in the configuration the run will ACTUALLY use, those components installed.
+
+What this settles and what it does not. A transcript can prove that the probe covered every
+destination the human ratified, and the egress assertion then proves each one was denied. It cannot
+prove the ratified set is COMPLETE — a component requesting a destination nobody ratified is
+invisible to every capture — and it cannot prove the probe ran with those components installed at
+all. The first is where the human takes responsibility by ratifying on the agent-unwritable surface;
+nothing takes responsibility for the second, and a component-reachable destination on a private or
+internal network is outside the probe's reach entirely, since a non-external target cannot evidence
+external egress denial. These are RECORDED, not implied.
+
 ```sh
 # readiness (inside the boundary): the client itself must work — record as client_ready
 <fetch-command> <in-boundary-endpoint> ; test $? -eq 0 || fail "the probe client does not run inside the boundary — an absent client would satisfy every egress assertion trivially"