diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json
index fec5aaa..20bb7af 100644
--- a/.ciagent/CHECKPOINT.json
+++ b/.ciagent/CHECKPOINT.json
@@ -1,24 +1,35 @@
 {
-  "phase": 2,
-  "stage": "complete",
+  "phase": 3,
+  "stage": "verify",
   "milestone": "v1.26",
   "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-08-18T00:25:00Z",
-  "project": "nova-blockchain-exchange",
+  "updated_at": "2026-08-19T00:00:00Z",
+  "project": "acdl",
   "projects": ["acdl", "nova-blockchain-exchange"],
   "active_milestone": "v1.26",
   "milestone_branch": "milestone/v1.26-pilot-activation",
-  "phase_branch": "phase/02-contract-and-deploy",
+  "phase_branch": "phase/03-pilot-metrics-and-policies",
   "tag_line": "v1.25.x",
-  "previous_phase": {"phase": 1, "tag": "v1.25.1", "status": "complete"},
-  "current_phase": {"phase": 2, "tag": "v1.25.2", "status": "complete"},
-  "requirements": ["REQ-322", "REQ-313", "REQ-314"],
+  "previous_phase": {"phase": 2, "tag": "v1.25.2", "status": "complete"},
+  "current_phase": {"phase": 3, "tag": "v1.25.3", "status": "verify"},
+  "requirements": ["REQ-315", "REQ-316", "REQ-317", "REQ-318", "REQ-319", "REQ-320"],
+  "waves": {
+    "W0": "Gitea adapter — inline checkout-then-call in consumer deploy.yml (SPEC §10 Q1 resolved, consumer repo)",
+    "W0.5": "kyverno-json substrate fix (v1.25 skip-masked bug) + P2 drift (dynamodb examples, sync_workflows, deck path)",
+    "W2": "outcome backfill (REQ-317) + escalation_reason (REQ-318)",
+    "W3": "env-JSON state_backend wiring (REQ-319) — dev bound to 581513795199",
+    "W4": "pilot-readiness (REQ-320) + settlement-finality (REQ-315) kyverno-json policies — run against real kj",
+    "W5": "CAP-025 live-pilot-apply regression check (REQ-316)",
+    "W6": "deploy.yml drift fixes — AWS_DEFAULT_REGION from secret, ref v1.25, no raw NOVA_AWS_* in shell env (SPEC §5.1/§5.2)",
+    "W7": "secret rotation scheduled workflow (SPEC §5.9) + forge-agnostic token name (REQ-230)"
+  },
   "pre_run": {
     "flaky_test_fixed": "8c68d68 test(metrics): fix attestation-event test freshness time-bomb",
     "acdl_to_nova_migration": "f844fea chore(bootstrap): migrate ACDL_* env vars to NOVA_*",
     "aws_bootstrap": "S3 nova-tfstate-581513795199-us-east-1 + DynamoDB nova-outbox created (idempotent, account 581513795199)",
-    "consumer_repo_created": "continuous-intelligence/nova-blockchain-exchange (Gitea, private, init, cloned to /root/nova-blockchain-exchange)"
+    "consumer_repo_created": "continuous-intelligence/nova-blockchain-exchange (Gitea, private, init, cloned to /root/nova-blockchain-exchange)",
+    "kj_installed": "kyverno-json v0.0.3 via go install (binary kyverno-json symlinked as kj) — policy tests run, not skipped"
   },
-  "notes": "v1.26 P2 complete. W0 DynamoDB L1 primitive (REQ-322, acdl), W1 contract.yaml + 3 env variants (REQ-313, consumer), W2 deploy.yml .github+.gitea mirror (REQ-314, consumer), W3 v1.25 floating tag → v1.25.0 (acdl). Verify PASS (structural/behavioral/security/quality). 45 platform + 40 consumer tests green. Ready for P3."
+  "notes": "v1.26 P3 verify PASS. W0 Gitea adapter (consumer deploy.yml inline — SPEC §10 Q1 resolved). W0.5 fixed v1.25 skip-masked kj substrate bug (engine + 16 policies + install script) + 7 pre-existing P2 drift failures. W2 outcome backfill + escalation_reason. W3 env-JSON state_backend (dev→581513795199). W4 pilot policies (real kj). W5 CAP-025. W6 deploy.yml drift (AWS_DEFAULT_REGION, ref v1.25). W7 rotation workflow. 844 platform + 90 consumer tests green. Ready for P3 SHIP → v1.25.3."
 }
\ No newline at end of file
diff --git a/.ciagent/REQUIREMENTS.md b/.ciagent/REQUIREMENTS.md
index c18af90..97b7ef1 100644
--- a/.ciagent/REQUIREMENTS.md
+++ b/.ciagent/REQUIREMENTS.md
@@ -289,12 +289,12 @@
 | REQ-322 | P2 | complete (v1.25.2) |
 | REQ-313 | P2 | complete (v1.25.2) |
 | REQ-314 | P2 | complete (v1.25.2) |
-| REQ-315 | P3 | pending |
-| REQ-316 | P3 + P4 | pending |
-| REQ-317 | P3 | pending |
-| REQ-318 | P3 | pending |
-| REQ-319 | P3 | pending |
-| REQ-320 | P3 | pending |
+| REQ-315 | P3 | complete (v1.25.3) |
+| REQ-316 | P3 + P4 | complete (v1.25.3 — CAP-025; P4 live-verify pending) |
+| REQ-317 | P3 | complete (v1.25.3) |
+| REQ-318 | P3 | complete (v1.25.3) |
+| REQ-319 | P3 | complete (v1.25.3) |
+| REQ-320 | P3 | complete (v1.25.3) |
 | REQ-321 | P4 | pending |
 
 Full v1.26 requirement text: