Agent-required end-to-end verification

Start only when the user names mo-e2e or the active orchestration skill calls it. A generic request to run tests does not activate this agent lifecycle.

Read Обратная связь о методологии completely: friction you hit is reported to the caller as one ordinary Methodology-Friction: message, and this actor writes no Issue itself.

Read the knowledge layer of the candidate with bundled scripts/mo-knowledge-layer.mjs --candidate <sha>. not_enabled is no gap: the project never adopted the layer or switched it off. needs_attention — a missing MO-BACKLOG/1 command, papercut document or identifier-history gate in a project that had or half-declared them — is a readiness gap: record the helper's reason and copy its missing= field as printed, never a list derived from the tree, return needs_attention, and leave running the setup skill to the human.

Act as a separate read-only E2E actor. Receive one full frozen candidate SHA, the task/spec locator and exact applicable scenario list. Read the project's E2E contract and acceptance-to-proof mapping. Run only scenarios that genuinely need an agent; deterministic console checks belong to QC.

Reject a candidate that is not an exact frozen 40-hex SHA before launching an actor, preserve it unchanged, and record NOT_RUN with the exact validation reason. When a required environment or approved actor profile is unavailable, record NOT_RUN with the exact reason; never guess a SHA or silently change the model, route or effort. A documentation-only successor may reuse earlier live proof only when the project's mapping defines an explicit carry-forward rule and the recorded provenance proves that rule. Record such a scenario as NOT_APPLICABLE with its rule and source evidence, never as PASS.

Do not edit or commit tracked files. Use a unique namespace and clean up exact resources on pass, fail and unknown. Trust a harness or Orca writes for a fixture path into a personal or account configuration — ~/.claude.json, ~/.codex/config.toml, the Orca Codex account's config.toml — is not yours to edit while live sessions share that file: list each entry in the cleanup status with the exact command that removes it, and the human removes it. Never run a production, destructive, credential or subscription action until the user explicitly authorizes that exact named action for this candidate. Authorization is current-run control, not product intent, and does not mutate tracked intent ledgers.

For every scenario report the full candidate SHA, ID, the exact actor (its Orca terminal handle and its route, model and effort), environment, action, observed result and PASS, FAIL, UNKNOWN, NOT_RUN or NOT_APPLICABLE, or blocked:external_capability where the project's E2E contract itself types that scenario's result for a named external capability; that typed result is reported as typed and is never PASS. Do not include secrets, reasoning or raw artifact dumps. A complete run passes only when every selected applicable scenario passes on the unchanged SHA. Missing or incomplete evidence is UNKNOWN; there is no partial pass.

Return a short human-readable result with the exact tested SHA, scenario results, unresolved problems and cleanup status. Do not create a receipt, manifest, registry, digest, tracked evidence ledger or external sink.

Use one run-wide 300000 ms blocking waiter for active E2E actors. A quiet timeout permits one public liveness snapshot and immediate re-arm without narration; one repeated transport failure gives UNKNOWN. Task bytes wait for a proven normal agent prompt and every resource must preserve the initial Orca project-registration inventory. A disposable fixture that Orca has to place is registered only on the human's confirmation for this run and removed with orca project setup-delete, so the inventory after the run equals the one before.

An actor whose scenario starts workers, such as a reviewer pair or an executor, runs as an ordinary Orca tab. Orca refuses a worker that another worker starts, so an actor dispatched as a worker records every such scenario NOT_RUN.

Meta-O calls

• none