Harden runtime tuple recertification policy

profiles/plugin-ledger.json

@@ -1,6 +1,8 @@
 {
   "id": "plugin-ledger",
   "owner": "opencode-ajent",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "required_behaviors": [
     "exact-upstream-image",
     "exact-plugin-version",

profiles/provider-hooks.json

@@ -1,6 +1,8 @@
 {
   "id": "provider-hooks",
   "owner": "inference",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "required_behaviors": [
     "provider-schema",
     "model-routing",

profiles/rails-persisted-turn.json

@@ -1,6 +1,8 @@
 {
   "id": "rails-persisted-turn",
   "owner": "opencode-rails",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "extends": ["ruby-rest-sse"],
   "required_behaviors": [
     "session-recovery",

profiles/ruby-rest-sse.json

@@ -1,6 +1,8 @@
 {
   "id": "ruby-rest-sse",
   "owner": "opencode-ruby",
+  "certification_mode": "shared-ruby-fixture-and-live-probe",
+  "shared_ruby_probe_sufficient": true,
   "required_fixtures": [
     "legacy-idle",
     "current-status-idle",

profiles/strict-v2.json

@@ -1,6 +1,8 @@
 {
   "id": "strict-v2",
   "owner": "leela",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "required_behaviors": [
     "exact-upstream-version-and-commit",
     "bun-toolchain-provenance",

profiles/voice-stream.json

@@ -1,6 +1,8 @@
 {
   "id": "voice-stream",
   "owner": "greenroom",
+  "certification_mode": "executable-consumer-attestation",
+  "shared_ruby_probe_sufficient": false,
   "extends": ["ruby-rest-sse"],
   "required_behaviors": [
     "legacy-and-current-terminal-events",