diff --git a/.ciagent/VERIFY.md b/.ciagent/VERIFY.md
new file mode 100644
index 0000000..e3b24f5
--- /dev/null
+++ b/.ciagent/VERIFY.md
@@ -0,0 +1,286 @@
+# Praxis — Phase 1 Verification Report (VERIFY stage)
+
+> **Phase:** 1 — Minimal Viable Voice Loop
+> **Milestone:** v0.1
+> **Branch:** `phase/01-minimal-voice-loop`
+> **Reviewer:** CIAgent (mechanical, autonomy `full`, single-project mode)
+> **Date:** 2026-08-01
+> **Codebase state at review:** 22 commits since `milestone/v0.1-praxis`, working tree clean before VERIFY fixes
+> **Inputs:** PLAN.md (5 slices, 26 tasks, 10 exit criteria, 15 P1 REQs), REQUIREMENTS.md, ARCHITECTURE.md, GRILL.md (G-001..G-008)
+
+---
+
+## Overall Verdict
+
+| | |
+|---|---|
+| **Verdict** | **PASSED (with documented gaps)** |
+| **Confidence** | 0.82 |
+| **REQ coverage** | 15 / 15 P1 REQ-IDs covered by code |
+| **Exit criteria** | 8 / 10 fully verified; 2 pending live API keys (documented gap, not a failure) |
+| **Tests** | 73 passed, 9 skipped (pending-keys), 0 failed |
+| **P0 fixes applied** | 2 (cosmetic-typo + dead-code cleanup; no logic/behavior change) |
+| **P1+ flagged** | 6 (post-hoc review) |
+| **Escalations** | 0 |
+
+**One-line summary:** Phase 1 is structurally complete, behaviorally verified (all offline-testable paths green), and secure for a single-learner tech-validation harness. The two unverifiable exit criteria (live audio session + live latency measurement) are blocked on voice-service key provisioning, not on code defects — auto-generated tests in `tests/test_pending_keys.py` will exercise them when keys are present. Two risk-free cosmetic P0 fixes were applied (a misspelled constant `_DEBRIFF_` → `_DEBRIEF_` and a dead-code line in `debrief.py`); neither changed runtime behavior (verified by re-running the full suite).
+
+---
+
+## Layer 1 — Structural ✅ PASS
+
+### 1.1 Files referenced in PLAN.md exist on disk
+
+All 26 task deliverables verified present:
+
+| Slice | Expected artifact | Present? |
+|---|---|---|
+| SLICE-01 | `scripts/probe_deepgram.py`, `probe_cartesia.py`, `probe_ollama.py`, `probe_e2e.py`, `docs/latency-report.md` | ✅ all 5 |
+| SLICE-02 | `server/services/{base,registry,__init__}.py`, `server/tts/{cartesia_tts,piper_tts}.py`, `server/llm/ollama_cloud.py`, `server/pipeline.py`, `server/__main__.py`, `server/latency.py`, `server/guardrails/noop.py`, `client/src/{App.tsx,useVoiceSession.ts,main.tsx}` | ✅ all |
+| SLICE-03 | `server/scenarios/{schema,loader,runtime,classifier}.py`, `server/guardrails/customer_service.py`, `server/interruptibility.py`, `scenarios/customer_service_refund_ca_v01.yaml` | ✅ all |
+| SLICE-04 | `db/{schema.sql,store.py,migrate.py}`, `db/migrations/0001_init.sql`, `server/cost.py`, `server/session_recorder.py`, `scenarios/cost_rates.yaml` | ✅ all |
+| SLICE-05 | `server/debrief.py`, `db/migrations/0002_debrief.sql`, `docs/debrief/default.yaml`, `scripts/e2e_smoke.py`, `tests/test_e2e.py` | ✅ all |
+
+No referenced file is missing. `server/asr/__init__.py` exists but is empty (an organizational placeholder — ASR uses Pipecat's Deepgram service directly in `pipeline.py`; no adapter needed for v0.1 since Deepgram is the only ASR). Acceptable.
+
+### 1.2 Imports resolve (no dangling references)
+
+Ran `python3 -c "import ..."` for every server/db module + the public API:
+
+```
+ALL SERVER/DB IMPORTS OK
+PUBLIC EXPORTS OK
+PIPELINE+MAIN IMPORT OK
+pipecat 1.6.0  DEPS OK (pydantic, yaml, aiosqlite, httpx, websockets, loguru, fastapi)
+```
+
+Public exports verified present in their declared `__all__`:
+- `server.services` → `TTSProvider, LLMProvider, Guardrail, get_tts, get_llm, get_guardrail` ✅
+- `server.scenarios` → `Scenario, load, load_all, ...` ✅
+- `db` → `PraxisStore, apply_migrations, HARDCODED_LEARNER_ID, ...` ✅
+
+### 1.3 No stub implementations or TODO placeholders left behind
+
+Grep for `TODO|FIXME|XXX|HACK|NotImplemented|NotImplementedError` → **0 matches** in `.py` files (no `NotImplementedError` stubs; no TODO/FIXME markers).
+
+`pass` statements found: 9 — all legitimate (bare `except: pass` / `except ImportError: pass` in probe graceful-degradation paths and one no-op branch in `session_recorder.py:70` which is an intentional placeholder for future real audio-minute metering, documented in a comment). No empty-function-body stubs.
+
+### 1.4 Declared exports exist
+
+Verified each `__all__` entry resolves to a real symbol in its module. No dangling exports.
+
+### 1.5 Client typecheck + build
+
+```
+npm run typecheck  →  tsc -b --noEmit  →  clean (exit 0, no output)
+npm run build      →  vite build       →  ✓ built in 636ms (152 modules, dist/ produced)
+```
+
+**PASS.** (One vite chunk-size warning >500kB — a cosmetic bundling advisory, not an error; acceptable for a v0.1 single-page client.)
+
+### 1.6 Python syntax check
+
+`python3 -m py_compile` on all 20 key server/db/script modules → **PY_COMPILE OK** (no syntax errors).
+
+> **Note on Pipecat LSP static-type noise:** `pipeline.py` / `__main__.py` / `e2e_smoke.py` show Pyright/LSP errors (dataclass-settings API: `No parameter named "api_key"`/`"allow_interruptions"`; `LLMContextAggregator` "abstract"; `_FakeLLM` not assignable to `LLMProvider`). These are **static-type-only** — they stem from Pipecat's dataclass-`Settings` pattern (fields valid at runtime, not visible to the static analyzer) and test fakes that structurally satisfy the ABC but aren't registered as subclasses. **Runtime imports, the e2e smoke test, and all 73 tests pass despite the static warnings.** This matches the documented EXECUTE state. Flagged as P2 (maintainability) — see Quality findings.
+
+**Layer 1 verdict: PASS.**
+
+---
+
+## Layer 2 — Behavioral ✅ PASS (with 2 documented key-pending gaps)
+
+### 2.1 Test suite
+
+```
+python3 -m pytest  →  73 passed, 9 skipped (pending-keys), 0 failed, 1 warning in 9.81s
+```
+
+The 1 warning is a benign `DeprecationWarning: 'audioop' is deprecated` from Pipecat's `audio/utils.py` (third-party, Python 3.13 advisory — not actionable in v0.1).
+
+Test file inventory (12 files, 73 offline tests + 9 pending-key tests):
+
+| File | Tests | Covers |
+|---|---|---|
+| `test_scenario_schema.py` | 5 | TASK-03-01/02 — Pydantic schema + YAML loader |
+| `test_scenario_runtime.py` | 7 | TASK-03-03/07 — runtime, flows spec, branch set |
+| `test_classifier.py` | 11 | TASK-03-05/06 — interruptibility + branch classifier (heuristic + LLM + parser) |
+| `test_guardrail.py` | 9 | TASK-03-04 — Customer Service ruleset + debrief filter + NoOp swap |
+| `test_llm_adapter.py` | 6 | TASK-02-03 — Ollama adapter (models, missing-key, mocked stream, chat_full) |
+| `test_tts_adapters.py` | 7 | TASK-02-02 — Cartesia/Piper (env selection, missing-key, synthesize_all, ABC) |
+| `test_store.py` | 6 | TASK-04-01/02 — migrations, hardcoded learner, CRUD, progress |
+| `test_cost_and_recorder.py` | 7 | TASK-04-03/04 — cost derivation + SessionRecorder lifecycle |
+| `test_debrief.py` | 5 | TASK-05-01/02/03 — debrief gen, no-think, guardrail filter, TTS voice |
+| `test_debrief_persistence.py` | 2 | TASK-05-05 — migration 0002 + debrief_text persisted |
+| `test_latency_observer.py` | 5 | TASK-02-06 — LatencyRecord math + observer state |
+| `test_e2e.py` | 3 | TASK-05-06 — full-loop smoke (DB assertions) |
+| `test_pending_keys.py` (NEW) | 9 (skipped) | Exit criteria #1/#2 — live-key verifications |
+
+### 2.2 E2E smoke test
+
+```
+python3 scripts/e2e_smoke.py
+→ E2E SMOKE TEST — PASSED
+  session_id: sess-..., branch_id: accept_resolution, outcome: success,
+  turns_logged: 4, cost_cents: 1, debrief_chars: 194,
+  max_latency_ms: 510.0, within_budget: True, budget_ms: 600.0
+```
+
+The full offline loop works: scenario load → session start → 4 turns logged → heuristic branch classification → debrief generation (stub LLM) → guardrail filter → cost derivation → session/turns/progress/debrief persisted to SQLite. **PASS.**
+
+### 2.3 Phase 1 Exit Criteria (10 items — PLAN.md §4)
+
+| # | Criterion | Status | Evidence |
+|---|---|---|---|
+| 1 | Full session end-to-end (client → disclaimer → speak → AI responds → branch → debrief → SQLite) | **GAP (pending keys)** | Code-complete: `__main__.py` accepts WebRTC, loads scenario, logs disclaimer; `pipeline.py` wires VAD→STT→LLM→TTS; `debrief.py` + `session_recorder.py` close the loop. Cannot exercise live without DEEPGRAM/CARTESIA/OLLAMA keys. Auto-test: `tests/test_pending_keys.py::test_ollama_gemma4_cloud_returns_first_token` + `test_cartesia_tts_streams_audio` + `test_deepgram_stt_service_constructs_with_live_key`. |
+| 2 | Latency measured (R1-R4 real numbers) + TTS decision | **GAP (pending keys)** | `docs/latency-report.md` exists with budget, decision matrix, G-003 no-go actions, Piper pre-staging. Probes built and degrade gracefully (`KEY_MISSING` → exit 0). Live numbers pending keys. Auto-tests: `test_r1_deepgram_first_partial_latency`, `test_r2_...`, `test_r3_...`, `test_r4_...`, `test_live_latency_report_has_real_numbers`. |
+| 3 | TTS behind interface, swappable via `PRAXIS_TTS` | ✅ **PASS** | `server/services/base.py:TTSProvider` (ABC); `cartesia_tts.py` + `piper_tts.py` adapters; `registry.get_tts()` selects via env. Tests: `test_cartesia_selectable_via_env`, `test_piper_selectable_via_env`, `test_both_adapters_are_ttsprovider`. |
+| 4 | LLM behind interface, both models callable | ✅ **PASS** | `LLMProvider` ABC; `OllamaCloudLLM` with `roleplay_model`/`debrief_model` properties + `no_think` flag. Tests: `test_ollama_models_from_env_defaults`, `test_ollama_is_llmprovider`. Live call pending keys (auto-test: `test_ollama_deepseek_debrief_no_think_returns_text`). |
+| 5 | Guardrail pluggable + CustomerService ruleset + disclaimer + unit-tested | ✅ **PASS** | `Guardrail` ABC + `CustomerServiceGuardrail` + `NoOpGuardrail`; disclaimer text defined; 9 unit tests covering legal/financial/medical/impersonation blocks + debrief filter + NoOp swap. |
+| 6 | Scenario YAML → Pydantic → Flows, `failure_mode` present | ✅ **PASS** | `schema.py` (Pydantic) + `loader.py` (`yaml.safe_load`) + `runtime.py` (`as_flow_spec`); `customer_service_refund_ca_v01.yaml` has `failure_mode: escalates_unresolved`. Tests: 5 schema tests + 7 runtime tests. |
+| 7 | Interruptibility (learner cuts AI TTS, AI yields) | ✅ **PASS (structural)** | `pipeline.py` sets `allow_interruptions=True` (D-008); `interruptibility.py::pipeline_allows_interruptions` verified by 3 tests. Live manual test documented as pending in latency-report; Pipecat's built-in interrupt handling provides the runtime behavior. |
+| 8 | Learner state persists (session + turns + progress + cost; single learner, no auth) | ✅ **PASS** | `db/` schema + migrations + async store; hardcoded `learner-1` "Alex" row; `SessionRecorder` wires store into pipeline. Tests: `test_store_start_log_end_session`, `test_hardcoded_learner_row_exists`, `test_session_recorder_full_lifecycle`. |
+| 9 | Cost logged per session (`cost_estimated_cents` non-null + breakdown) | ✅ **PASS** | `server/cost.py::derive_cost` + `cost_rates.yaml`; `sessions.cost_estimated_cents` + `cost_breakdown_json` populated. Tests: `test_derive_cost_basic`, `test_session_recorder_full_lifecycle` (asserts `cost_estimated_cents > 0`). |
+| 10 | E2E smoke test passes (full loop + DB assertions) | ✅ **PASS** | `scripts/e2e_smoke.py` + `tests/test_e2e.py` (3 tests) — passes; asserts session/turns/cost/debrief/branch persisted. |
+
+**Exit criteria: 8/10 PASS, 2/10 GAP (pending keys, not code defects).**
+
+### 2.4 REQ Coverage Traceability (15 P1 REQ-IDs)
+
+| REQ-ID | Covered? | Files (trace) | Test status |
+|---|---|---|---|
+| REQ-VOICE-01 | ✅ | `server/pipeline.py:_build_stt` (Deepgram Nova-3) | structural test + pending live test |
+| REQ-VOICE-02 | ✅ | `server/services/base.py:TTSProvider`, `server/tts/cartesia_tts.py`, `server/tts/piper_tts.py` | 7 tests + pending live test |
+| REQ-VOICE-03 | ✅ | `server/latency.py`, `docs/latency-report.md` | 5 tests; live number pending keys |
+| REQ-VOICE-04 | ✅ | `server/pipeline.py` (`allow_interruptions=True`), `server/interruptibility.py` | 3 tests |
+| REQ-SCEN-01 | ✅ | `scenarios/customer_service_refund_ca_v01.yaml`, `server/scenarios/runtime.py` | 7 runtime + 5 schema tests |
+| REQ-STATE-01 | ✅ | `db/schema.sql`, `db/store.py`, `db/migrations/0001_init.sql`, `server/session_recorder.py` | 6 store + 7 recorder tests |
+| REQ-LLM-01 | ✅ | `server/llm/ollama_cloud.py` (gemma4:cloud) | 6 tests + pending live test |
+| REQ-LLM-02 | ✅ | `server/llm/ollama_cloud.py` (`no_think`), `server/debrief.py`, `server/scenarios/classifier.py` | 5 debrief tests + pending live test |
+| REQ-DEBRIEF-01 | ✅ | `server/debrief.py`, `docs/debrief/default.yaml`, `server/session_recorder.py` | 5 debrief + 2 persistence tests |
+| REQ-ORCH-01 | ✅ | `server/pipeline.py` (Pipecat + Silero VAD + interrupt) | imports + e2e smoke |
+| REQ-ORCH-02 | ✅ | `server/services/base.py:Guardrail`, `server/guardrails/customer_service.py`, `server/services/registry.py` | 9 guardrail tests |
+| REQ-SCEN-FMT-01 | ✅ | `server/scenarios/schema.py`, `server/scenarios/loader.py`, `server/scenarios/runtime.py` | 5 schema + 7 runtime tests |
+| REQ-NFR-LAT-01 | ✅ | `server/latency.py`, `docs/latency-report.md`, `scripts/probe_*.py` | 5 tests; live measurement pending keys |
+| REQ-NFR-SAFE-01 | ✅ | `server/guardrails/customer_service.py` (disclaimer + 4 block categories + debrief filter) | 9 guardrail tests |
+| REQ-NFR-COST-01 | ✅ | `server/cost.py`, `scenarios/cost_rates.yaml`, `server/session_recorder.py` | 7 cost/recorder tests |
+
+**Coverage: 15/15 P1 REQ-IDs covered by code.** All have at least one offline test except where the requirement is inherently live-key-dependent (REQ-VOICE-03 live number, REQ-LLM-01/02 live call) — those are covered by auto-generated pending-key tests that activate when keys are provisioned.
+
+### 2.5 Auto-generated tests for unverifiable items
+
+`tests/test_pending_keys.py` (NEW — 9 tests, all skip cleanly without keys):
+
+| Test | Verifies | Activates when |
+|---|---|---|
+| `test_r1_deepgram_first_partial_latency` | R1 probe runs live | DEEPGRAM_API_KEY |
+| `test_r2_cartesia_first_audio_latency` | R2 probe runs live | CARTESIA_API_KEY |
+| `test_r3_ollama_ttft_both_models` | R3 probe (R6 resolution) | OLLAMA_API_KEY |
+| `test_r4_integrated_e2e_latency_within_or_documented` | R4 integrated e2e | OLLAMA + CARTESIA |
+| `test_ollama_gemma4_cloud_returns_first_token` | REQ-LLM-01 live | OLLAMA_API_KEY |
+| `test_ollama_deepseek_debrief_no_think_returns_text` | REQ-LLM-02 live no-think | OLLAMA_API_KEY |
+| `test_cartesia_tts_streams_audio` | REQ-VOICE-02 live | CARTESIA_API_KEY |
+| `test_deepgram_stt_service_constructs_with_live_key` | REQ-VOICE-01 live | DEEPGRAM_API_KEY |
+| `test_live_latency_report_has_real_numbers` | Exit criterion #2 | OLLAMA + CARTESIA |
+
+All 9 skip with a clear reason when keys are absent; the default fast suite stays green (73 passed, 9 skipped).
+
+**Layer 2 verdict: PASS (8/10 exit criteria verified; 2/10 documented key-pending gaps with auto-tests ready).**
+
+---
+
+## Layer 3 — Security (STRIDE) ✅ ACCEPT (all dispositions low/medium for v0.1 pilot)
+
+Threat model context: v0.1 is a **single-learner tech-validation harness** (G-008), local SQLite, no auth (D-007), no PII beyond a hardcoded display name, no network exposure beyond the pilot host. STRIDE findings are dispositioned per the auto-policy (low=accept, medium=mitigate, high=escalate).
+
+| Category | Finding | Severity | Disposition | Evidence |
+|---|---|---|---|---|
+| **Spoofing** | No auth in v0.1 (D-007 — single hardcoded learner "Alex"). Anyone who can reach the Pipecat server's `/pipecat/webrtc` endpoint could start a session. | Low (pilot) | **Accept** | D-007 explicitly defers auth. Single-learner harness; the server binds `0.0.0.0:8789` but is intended for a single pilot host. CORS is `allow_origins=["*"]` (dev) — acceptable for v0.1, **flag for tightening before any multi-learner milestone** (P1). |
+| **Tampering** | SQLite local file (`praxis.db`) — no integrity protection. A local user can `sqlite3 praxis.db` and edit session/outcome/cost rows. | Low (pilot) | **Accept** | D-007: local pilot, single-learner. Trust model assumes the pilot host is trusted. No tamper-evidence needed for tech-validation. Documented in `db/schema.sql` header. |
+| **Repudiation** | Sessions are logged with auto-generated ids (`sess-<uuid>`) and timestamps; no signed audit trail. A learner could dispute "I never did that session." | N/A (pilot) | **Accept** | Single hardcoded learner, no auth → no multi-party repudiation surface. Sessions are for learner self-review, not compliance. |
+| **Info Disclosure** | (a) `.ciagent/.env.secrets` is `0600` perms + gitignored — ✅ verified. (b) `.env`, `.env.secrets`, `.env.*` all in `.gitignore` — ✅ verified. (c) `git ls-files` confirms **no secret/key/db files tracked**. (d) Grep for hardcoded API keys (`sk-...`, `*_API_KEY="..."` assignments) → **0 matches** in non-example files. (e) `db/*.db` gitignored — no learner data leaked. | Low | **Accept** | Secrets handling is correct. The local `.ciagent/.env.secrets` contains a `DEEPGRAM_API_KEY` value (40 chars) but it is **not committed** (gitignored, 0600) — this is the intended dev-secret pattern. No info-disclosure vulnerability found. |
+| **Denial of Service** | No rate limiting on the FastAPI/Pipecat server; no connection cap; a client can open many WebRTC sessions. `asyncio.create_task(runner.run(task))` fires-and-forgets per request. | Low-Medium (pilot) | **Accept (v0.1) / Flag (P1)** | D-007/D-012: single-learner pilot, no adversarial threat model. Acceptable for v0.1. **Flag for P1 post-hoc review**: before any multi-learner exposure, add connection limits + task lifecycle management (the current `create_task` without tracking could leak tasks on disconnect). |
+| **Elevation of Privilege** | No auth → no privilege ladder → no escalation surface. | N/A | **Accept** | N/A for v0.1. |
+
+### Injection-vector review (security persona)
+
+| Vector | Status | Evidence |
+|---|---|---|
+| **YAML scenario loading** | ✅ Safe | `server/scenarios/loader.py` uses `yaml.safe_load` (not `yaml.load`) — no arbitrary Python object construction. Scenario files are repo-authored (D-007: no user-uploaded scenarios in v0.1). |
+| **LLM prompt construction** | ✅ Contained | `classifier.py::_build_user_prompt` and `debrief.py::_render` interpolate learner text into the prompt via string replacement. A malicious learner ASR transcript could inject prompt text, but: (a) the LLM is role-playing a customer (no tool calls / no DB writes from LLM output), (b) the guardrail output filter runs on the response, (c) the branch classifier output is JSON-parsed leniently with fallback. Prompt injection impact is bounded to a misclassified branch or a weird debrief — not a security boundary for v0.1. **Accept.** |
+| **SQL injection** | ✅ Safe | `db/store.py` uses parameterized queries exclusively (`?` placeholders) — no string-interpolated SQL. |
+| **Path traversal (scenario id)** | Low | `loader.load(scenario_id)` builds `base / f"{scenario_id}.yaml"` — a `scenario_id` containing `../` could escape `scenarios/`. In v0.1 the id comes from the env var `PRAXIS_SCENARIO` (operator-controlled), not user input. **Accept for v0.1; flag for P1** if scenario ids ever become user-selectable. |
+
+**Layer 3 verdict: ACCEPT.** No high-severity STRIDE findings. 3 P1 flags for future hardening (CORS tightening, DoS/connection limits, path-traversal guard) — all appropriate for a post-pilot milestone, not v0.1 blockers.
+
+---
+
+## Layer 4 — Quality (multi-persona review)
+
+### P0 fixes applied (2)
+
+Both are risk-free cosmetic cleanups with no logic/behavior change. Verified by re-running the full suite (73 passed, 9 skipped, 0 failed) + e2e smoke after each fix.
+
+| # | File:line | Issue | Fix | Verification |
+|---|---|---|---|---|
+| P0-1 | `server/guardrails/customer_service.py:119,123` | Misspelled constant `_DEBRIFF_LEGAL_REDIRECT` (two F's; should be `_DEBRIEF_`). Worked at runtime only because the method references the constant by the same misspelled name and Python resolves globals at call time — but the typo is a latent trap: any future refactor that renames one occurrence would silently break the debrief filter, causing legal-action recommendations to pass unfiltered (a safety regression). | Renamed both occurrences to `_DEBRIEF_LEGAL_REDIRECT`. | `test_debrief_guardrail_blocks_legal_action` passes; manual end-to-end check confirms legal-action text still replaced by the redirect. |
+| P0-2 | `server/debrief.py:31` | Dead code: `rel = template_id.replace("/", ".") ...` computed but never used (the actual path resolution uses `template_id.split('/')[-1]`). Confusing for maintainers and flagged by linters. | Removed the dead line. | `test_debrief_*` (5 tests) pass; template loading verified. |
+
+### P1+ findings flagged for post-hoc review (6)
+
+| # | Severity | Persona | File:line | Finding | Recommendation |
+|---|---|---|---|---|---|
+| Q-1 | P1 | Maintainability | `server/pipeline.py`, `server/__main__.py`, `scripts/e2e_smoke.py` | Pipecat LSP static-type noise (~12 Pyright errors: dataclass-`Settings` fields, `LLMContextAggregator` abstractness, `_FakeLLM` not subclassing `LLMProvider`). Runtime is fine; static analysis is noisy. | Add `# type: ignore[...]` annotations with reasons, or wrap Pipecat service construction in typed helper functions. Register test fakes via `LLMProvider.register` or duck-type with `Protocol`. Non-blocking. |
+| Q-2 | P1 | Correctness | `server/latency.py:106-112` | `TextFrame` is treated as an LLM-first-token proxy, but `TextFrame` is generic — it can carry non-LLM text (e.g. the opening-line TTS input), which could misattribute the first-token timestamp. The `LLMFullResponseEndFrame` branch (L99) is a better proxy but also imperfect. | For v0.1 accept (latency is logged, not enforced); for Phase 2 use Pipecat's `LLMTokenUsageFrame` / metrics service for accurate TTFT. |
+| Q-3 | P1 | Adversarial/Security | `server/scenarios/loader.py:34` | `load(scenario_id)` builds `base / f"{scenario_id}.yaml"` without sanitizing `../` — path traversal possible if `scenario_id` is ever user-controlled. Currently env-var-controlled (operator), so low risk. | Add a guard: reject `scenario_id` containing path separators or `..`, or resolve + verify the result stays within `base`. |
+| Q-4 | P1 | Security/DoS | `server/__main__.py:96-98` | `asyncio.create_task(runner.run(task))` is fire-and-forget — no tracking of running tasks, no cap on concurrent sessions, no cancellation on client disconnect. Acceptable for single-learner pilot but would leak resources at scale. | Track tasks in a set; cancel on disconnect; cap concurrency. Defer to multi-learner milestone. |
+| Q-5 | P1 | Security | `server/__main__.py:55` | CORS `allow_origins=["*"]` — dev setting. Acceptable for v0.1 single-origin pilot but must be tightened before any non-local exposure. | Make CORS origin env-configurable (`PRAXIS_CORS_ORIGINS`); default to the client dev origin. |
+| Q-6 | P2 | Testing | `tests/test_e2e.py:16-37` | The 3 e2e test functions each call `asyncio.run(run_e2e(...))` independently — the full loop runs 3× per test session (wasteful, ~3× the DB writes). Also `test_e2e_debrief_non_empty` re-runs the whole loop just to assert `debrief_chars > 50`. | Refactor to a session-scoped fixture that runs `run_e2e` once and shares the result dict across the 3 assertions. Non-blocking. |
+
+### Per-persona summary
+
+**Correctness:** Logic is sound across the hot path. `classify_branch_sync_heuristic` correctly scores branches by signal-keyword overlap and tie-breaks to the first branch (deterministic). `derive_cost` arithmetic verified (`test_derive_cost_piper_zero_tts` confirms Piper $0 path). `LatencyRecord.e2e_asr_to_tts_ms` math correct (550ms in test). Branch classifier parser is lenient (handles code fences, malformed JSON, empty input) with safe fallbacks. **No correctness P0s.**
+
+**Testing:** 73 tests are meaningful — they cover schema validation, adapter graceful degradation, guardrail block categories, cost math, store CRUD, recorder lifecycle, debrief generation/filter, latency math, and the full e2e loop with DB assertions. Coverage is broad; gaps are the live-key paths (now covered by `test_pending_keys.py` skips) and client-side (no React component tests — v0.1 relies on e2e smoke per `package.json` "test" script). The `_FakeLLM`/`_StubDebriefLLM` fakes structurally satisfy the `LLMProvider` contract. **No testing P0s.** One P2 (test redundancy, Q-6).
+
+**Security:** See Layer 3. No hardcoded keys, safe YAML loading, parameterized SQL, bounded prompt-injection impact. 3 future-hardening P1s (Q-3/4/5). **No security P0s.**
+
+**Performance:** No O(n²) in the voice-loop hot path. `LatencyObserver.process_frame` is O(1) per frame (passes through + records a timestamp). `lru_cache` on registry getters avoids repeated adapter construction. `SessionRecorder.log_turn` is O(1) per turn. The classifier runs once at session end (D-P1-05 — offline from the latency path). **No performance P0s.** One observation: `LLMContextAggregator` + Pipecat's context object grow with conversation length (unbounded turn history) — acceptable for v0.1 short sessions; flag for Phase 2 if sessions exceed ~50 turns.
+
+**Maintainability:** Interfaces (`TTSProvider`/`LLMProvider`/`Guardrail`) are clean ABCs with typed dataclasses (`TTSResult`, `LLMStreamChunk`, `GuardrailVerdict`, `GuardrailContext`). The registry centralizes env-based selection. Adapters are thin and consistently degrade gracefully on missing keys/models. Naming is clear. The one maintainability defect was the `_DEBRIFF` typo (fixed as P0-1). Pipecat static-type noise (Q-1) is the remaining friction. **No maintainability P0s after fixes.**
+
+**Adversarial:** What if the LLM returns malicious content? → Guardrail output filter (`_DEBRIEF_LEGAL_ACTION_RE` + 4 category regexes) blocks legal/financial/medical/impersonation; the debrief path replaces blocked content with a coaching redirect. What if the YAML scenario is malformed? → Pydantic `ValidationError` raised at load (typed, tested). What if the classifier returns garbage? → `_parse_branch` falls back to scanning for a known branch id, then to the first branch — never crashes. What if a probe key is missing? → `KEY_MISSING` banner, exit 0. **No adversarial P0s.** The guardrail regexes are heuristic (not LLM-based) and could be evaded by paraphrase — acceptable for v0.1 Customer Service (low-risk domain per D-019); the pluggable interface allows a stronger ruleset for high-risk domains later.
+
+**Layer 4 verdict: PASS.** 2 P0 fixes applied (cosmetic, verified). 6 P1+ flags for post-hoc review (none blocking).
+
+---
+
+## GRILL binding decisions — status check
+
+| ID | Decision | Honored? | Evidence |
+|---|---|---|---|
+| G-001 | v0.1 = tech-validation, not thesis validation | ✅ | `README.md` L3: "tech-validation harness (per G-008)"; `docs/latency-report.md` frames numbers as pilot-config. |
+| G-002 | Branch is post-hoc classification, not runtime fork | ✅ | `server/scenarios/runtime.py:as_flow_spec` → `transitions: []` with comment "v0.1: no in-flight transitions (G-002)"; classifier runs at session end. |
+| G-003 | Go/no-go gate has explicit no-go actions | ✅ | `docs/latency-report.md` §"SLICE-01 go/no-go gate" lists actions (a)/(b)/(c). |
+| G-004 | Per-slice estimates at EXECUTE | ⚠️ Partial | Commit messages carry slice/task ids; no explicit effort estimates in PLAN.md, but the wave structure + 26 tasks provide sizing. Acceptable for autonomous project. |
+| G-005 | v0.1 logged costs not representative of at-scale | ✅ | `server/cost.py` header + `scenarios/cost_rates.yaml` header both cite G-005. |
+| G-006 | No real-learner recruitment; tech harness | ✅ | Hardcoded `learner-1` "Alex"; no recruitment code/artifacts. |
+| G-007 | Stop-trigger defined (ties to G-003) | ✅ | latency-report §go/no-go gate documents the stop trigger. |
+| G-008 | "Pilot" = tech pilot, not learner pilot | ✅ | README + docs consistent. |
+
+---
+
+## Summary
+
+| Layer | Verdict | Detail |
+|---|---|---|
+| 1 — Structural | ✅ PASS | All files present; imports resolve; no stubs/TODOs; exports valid; client typecheck+build clean; py_compile clean. |
+| 2 — Behavioral | ✅ PASS (2 documented gaps) | 73 tests pass; e2e smoke passes; 8/10 exit criteria verified; 15/15 REQs covered; 9 auto-tests ready for pending keys. |
+| 3 — Security (STRIDE) | ✅ ACCEPT | No high-severity findings; secrets handled correctly (0600 + gitignored, no hardcoded keys, safe YAML, parameterized SQL); 3 P1 future-hardening flags. |
+| 4 — Quality | ✅ PASS | 2 P0 cosmetic fixes applied + verified; 6 P1+ flagged; no logic/security/performance P0s. |
+
+**Overall: PASSED (with documented gaps).** The two key-pending exit criteria are environment gaps (no voice-service keys provisioned), not code defects — `tests/test_pending_keys.py` will verify them automatically when keys are present. The codebase is ready for SHIP subject to the orchestrator's decision on the key-pending items.
+
+---
+
+*End of Phase 1 verification report. VERIFY only — SHIP is the orchestrator's next step.*
\ No newline at end of file
diff --git a/server/debrief.py b/server/debrief.py
index 46545d4..c6446e8 100644
--- a/server/debrief.py
+++ b/server/debrief.py
@@ -28,7 +28,6 @@ _DEFAULT_TEMPLATE_DIR = Path(__file__).resolve().parent.parent / "docs" / "debri
 def _load_template(template_id: str) -> dict[str, str]:
     """Load a debrief prompt template by id (e.g. 'debrief/default')."""
     # template_id is 'debrief/default' → docs/debrief/default.yaml
-    rel = template_id.replace("/", ".") if "/" in template_id else template_id
     path = _DEFAULT_TEMPLATE_DIR / f"{template_id.split('/')[-1]}.yaml"
     if not path.exists():
         # Fallback to the default template.
diff --git a/server/guardrails/customer_service.py b/server/guardrails/customer_service.py
index 7abd914..9f145ef 100644
--- a/server/guardrails/customer_service.py
+++ b/server/guardrails/customer_service.py
@@ -116,11 +116,11 @@ class CustomerServiceGuardrail(Guardrail):
     @staticmethod
     def _filter_legal(text: str) -> str:
         """Replace legal-action recommendations with a coaching redirect."""
-        return _DEBRIFF_LEGAL_REDIRECT if _DEBRIFF_LEGAL_REDIRECT else text
+        return _DEBRIEF_LEGAL_REDIRECT if _DEBRIEF_LEGAL_REDIRECT else text
 
 
 # Coaching redirect used when a debrief recommends legal action (D-019).
-_DEBRIFF_LEGAL_REDIRECT = (
+_DEBRIEF_LEGAL_REDIRECT = (
     "Focus your coaching on the learner's communication performance, "
     "not on advising the customer to take legal action."
 )
diff --git a/tests/test_pending_keys.py b/tests/test_pending_keys.py
new file mode 100644
index 0000000..baafa0b
--- /dev/null
+++ b/tests/test_pending_keys.py
@@ -0,0 +1,213 @@
+"""Auto-generated tests for Phase 1 exit criteria that require live API keys.
+
+Per the VERIFY stage directive ("For unverifiable items: auto-generate test
+scripts that WOULD verify them when keys are present"), these tests exercise the
+two Phase 1 exit criteria that are pending voice-service key provisioning:
+
+  - Exit criterion #1 (live audio session): a real WebRTC voice turn completes.
+  - Exit criterion #2 (live latency measurement): R1-R4 probes produce real
+    numbers and the TTS decision is finalized.
+
+At v0.1 VERIFY time, only GITEA_TOKEN (operational) is guaranteed; the three
+voice-service keys (DEEPGRAM_API_KEY, CARTESIA_API_KEY, OLLAMA_API_KEY) are NOT
+provisioned in this environment. These tests are therefore SKIPPED when the keys
+are absent, and will run automatically once the keys are provided via `.env` /
+`.ciagent/.env.secrets` / the environment.
+
+Run:
+    pytest tests/test_pending_keys.py -rs          # shows skip reasons
+    DEEPGRAM_API_KEY=... pytest tests/test_pending_keys.py   # runs the live tests
+
+These tests are intentionally network-bound and are NOT part of the default
+fast suite. They are gated behind the key presence checks so CI without keys
+stays green.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+import socket
+import time
+
+import pytest
+
+# Keys that must be present for the live verifications.
+REQUIRED_KEYS = ("DEEPGRAM_API_KEY", "CARTESIA_API_KEY", "OLLAMA_API_KEY")
+
+
+def _have_live_keys() -> bool:
+    """True iff all three voice-service keys are non-empty in the environment."""
+    return all(os.environ.get(k, "").strip() for k in REQUIRED_KEYS)
+
+
+pytestmark = pytest.mark.skipif(
+    not _have_live_keys(),
+    reason=(
+        "Live voice-service keys (DEEPGRAM_API_KEY, CARTESIA_API_KEY, "
+        "OLLAMA_API_KEY) are not provisioned in this environment. "
+        "Set them in .env / .ciagent/.env.secrets and re-run to exercise "
+        "Phase 1 exit criteria #1 (live audio session) and #2 (live latency)."
+    ),
+)
+
+
+# ─── Exit criterion #2: live latency measurement (R1-R4) ────────────────────
+
+
+def test_r1_deepgram_first_partial_latency():
+    """R1: Deepgram Nova-3 first-partial-transcript latency is measured (not
+    vendor-claimed) and recorded. Runs scripts/probe_deepgram.py end-to-end."""
+    import subprocess
+    import sys
+
+    proc = subprocess.run(
+        [sys.executable, "scripts/probe_deepgram.py", "--iterations", "5"],
+        capture_output=True, text=True, timeout=120,
+    )
+    assert proc.returncode == 0, f"probe failed: {proc.stderr[:500]}"
+    assert "KEY_MISSING" not in proc.stdout, "probe did not detect a key (unexpected)"
+
+
+def test_r2_cartesia_first_audio_latency():
+    """R2: Cartesia Sonic first-audio-byte latency is measured and recorded."""
+    import subprocess
+    import sys
+
+    proc = subprocess.run(
+        [sys.executable, "scripts/probe_cartesia.py", "--iterations", "5"],
+        capture_output=True, text=True, timeout=120,
+    )
+    assert proc.returncode == 0, f"probe failed: {proc.stderr[:500]}"
+    assert "KEY_MISSING" not in proc.stdout
+
+
+def test_r3_ollama_ttft_both_models():
+    """R3: Ollama Cloud TTFT for gemma4:cloud + deepseek-v4-flash:cloud no-think
+    is measured. Also confirms R6 (Pipecat Ollama direct-API integration)."""
+    import subprocess
+    import sys
+
+    proc = subprocess.run(
+        [sys.executable, "scripts/probe_ollama.py", "--iterations", "5"],
+        capture_output=True, text=True, timeout=120,
+    )
+    assert proc.returncode == 0, f"probe failed: {proc.stderr[:500]}"
+    assert "KEY_MISSING" not in proc.stdout
+
+
+def test_r4_integrated_e2e_latency_within_or_documented():
+    """R4: the integrated three-hop e2e (transcript → Ollama → Cartesia) is
+    measured against the 600ms budget. Per G-003, if OVER budget with Cartesia,
+    the Piper leg must be measured and the TTS decision finalized. This test
+    asserts the probe runs and produces a median; it does NOT hard-assert
+    <600ms (the G-003 no-go actions handle an over-budget result)."""
+    import subprocess
+    import sys
+
+    proc = subprocess.run(
+        [sys.executable, "scripts/probe_e2e.py", "--iterations", "5"],
+        capture_output=True, text=True, timeout=180,
+    )
+    assert proc.returncode == 0, f"probe failed: {proc.stderr[:500]}"
+    assert "KEY_MISSING" not in proc.stdout
+    # The probe prints a median line when it collects samples.
+    assert "median" in proc.stdout.lower(), "no median reported (probe did not collect samples)"
+
+
+# ─── Exit criterion #1: live audio session (R6 + full loop) ─────────────────
+
+
+def test_ollama_gemma4_cloud_returns_first_token():
+    """R6 / REQ-LLM-01: a real call to gemma4:cloud via Ollama Cloud direct API
+    returns at least one token. Confirms the LLM adapter + bearer auth work
+    against the live endpoint."""
+    from server.llm.ollama_cloud import OllamaCloudLLM
+
+    llm = OllamaCloudLLM()
+
+    async def _run():
+        out = []
+        async for chunk in llm.chat(
+            [
+                {"role": "system", "content": "You are Jordan, a frustrated customer."},
+                {"role": "user", "content": "Hi, I want a refund."},
+            ],
+            stream=True,
+        ):
+            out.append(chunk.content)
+            if len(out) >= 1:
+                break
+        return out
+
+    chunks = asyncio.run(_run())
+    assert len(chunks) > 0, "gemma4:cloud returned no tokens (auth or endpoint issue)"
+
+
+def test_ollama_deepseek_debrief_no_think_returns_text():
+    """REQ-LLM-02: deepseek-v4-flash:cloud in no-think mode returns a debrief-
+    style response. Confirms the debrief model + no-think flag work live."""
+    from server.llm.ollama_cloud import OllamaCloudLLM
+
+    llm = OllamaCloudLLM()
+
+    async def _run():
+        text, _usage = await llm.chat_full(
+            [
+                {"role": "system", "content": "Reply with one word."},
+                {"role": "user", "content": "Say hello."},
+            ],
+            model=llm.debrief_model,
+            no_think=True,
+        )
+        return text
+
+    text = asyncio.run(_run())
+    assert len(text.strip()) > 0, "deepseek-v4-flash:cloud no_think returned empty"
+
+
+def test_cartesia_tts_streams_audio():
+    """REQ-VOICE-02: Cartesia Sonic TTS streams real PCM audio for a sample
+    line. Confirms the TTS adapter + WebSocket auth work live."""
+    from server.tts.cartesia_tts import CartesiaTTS
+
+    tts = CartesiaTTS()
+
+    async def _run():
+        chunks = [c async for c in tts.synthesize("Hi, I want my money back.")]
+        return chunks
+
+    chunks = asyncio.run(_run())
+    assert len(chunks) > 0, "Cartesia returned no audio (auth or endpoint issue)"
+    assert sum(len(c) for c in chunks) > 0
+
+
+def test_deepgram_stt_service_constructs_with_live_key():
+    """REQ-VOICE-01 / REQ-ORCH-01: the Deepgram Nova-3 STT service constructs
+    with a live key (the pipeline wiring is verified separately; this confirms
+    the key is accepted by the Deepgram client)."""
+    from server.pipeline import _build_stt
+
+    stt = _build_stt()
+    assert stt is not None
+
+
+def test_live_latency_report_has_real_numbers(tmp_path):
+    """Exit criterion #2: after running the probes, docs/latency-report.md (or a
+    generated report) contains real measured numbers, not vendor claims. This
+    test re-runs the e2e probe and checks the structured output has a non-zero
+    median."""
+    import json
+    import subprocess
+    import sys
+
+    out = tmp_path / "r4.json"
+    proc = subprocess.run(
+        [sys.executable, "scripts/probe_e2e.py", "--iterations", "3", "--out", str(out)],
+        capture_output=True, text=True, timeout=180,
+    )
+    assert proc.returncode == 0, f"probe failed: {proc.stderr[:500]}"
+    data = json.loads(out.read_text())
+    e2e = data.get("e2e_cartesia", {})
+    assert e2e.get("n", 0) > 0, "no e2e samples collected"
+    assert e2e.get("median_ms", 0) > 0, "median latency is not a real positive number"
\ No newline at end of file