feat(sor): confirmatory data-collection executor (anti-fabrication)

Measures RQ1 bridge-correlation AUC + RQ2 Shannon entropy from REAL
per-hop pcaps of live isolated-docker circuits. run_battery(live=False)
hard-raises and the executor refuses (ExecutorError) any DV it did not
measure — the executor-side twin of the launcher's "never fabricate
cells" guard. Wired into confirmatory_run's triple-locked tokened GO
(executor.run_battery(live=True) behind operator token + verified frozen
prereg SHA + engine!=local + green preflight + full grid).

Containment intact: self-fixture bytes only, isolated engine only, no
external target. Frozen prereg untouched (SHA f22331a72e…).

Verify: test_sor_executor.py 7 + confirmatory_run + full SOR suite = 163
passed; preflight green (grid 3/3, READY); no confirmatory data collected.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmd_chat/sor/confirmatory_run.py

@@ -16,13 +16,15 @@ bridge-on / on+padding arms actually insert a bridge hop + PADDING stream; RQ2
 bridge-/directory-federated topologies genuinely span >= 2 houses). The preflight
 proves this on FIXTURES (``battery.assembler_dry_check`` — plans only, no traffic).
 
-The **immutable confirmatory data run on the real grid is still the human gate**
+The **immutable confirmatory data run on the real grid is the human gate**
 (CLAUDE.md §Stop, GOAL envelope (b)). ``--operator-go`` is triple-locked — it
 requires the ``SOR_CONFIRMATORY_GO=1`` operator token, a verified frozen-prereg
-SHA-256, and an isolated engine — and even with all three plus a green preflight it
-**HOLDS on grid completion**: the confirmatory battery does not launch until the
-full physical grid is up (the operator is bringing the 3rd phone online). This
-launcher surfaces that hold; it never fabricates a confirmatory cell.
+SHA-256, and an isolated engine — plus a green preflight and a full grid. When all
+of those hold, this IS the operator's explicit GO and the wired data-collection
+executor (``sor.executor``) collects the battery for real: it stands up each cell's
+assembled circuit on the isolated engine, moves only self-generated fixture bytes,
+and **measures the DVs from the real pcaps** (``executor.run_battery(live=True)``).
+The executor refuses to emit any DV it did not measure — it never fabricates.
 
 Containment is load-bearing: nothing here forwards real/third-party traffic,
 touches an external target, or runs a forwarder on the host.
@@ -131,6 +133,12 @@ def main(argv=None) -> int:
     ap.add_argument("--engine", default="docker", help="isolated engine (default docker)")
     ap.add_argument("--operator-go", action="store_true",
                     help="attempt the human-gated confirmatory data run (triple-locked)")
+    ap.add_argument("--r-runs", type=int, default=battery.R_RUNS,
+                    help=f"runs per cell (frozen §4 default R={battery.R_RUNS})")
+    ap.add_argument("--c-circuits", type=int, default=battery.C_CIRCUITS,
+                    help=f"circuits per run (frozen §4 default C={battery.C_CIRCUITS})")
+    ap.add_argument("--hops", type=int, default=3, help="hops per circuit (default 3)")
+    ap.add_argument("--bins", type=int, default=32, help="pcap time-bins for the correlator")
     args = ap.parse_args(argv)
 
     out_dir = Path(args.out)
@@ -170,14 +178,32 @@ def main(argv=None) -> int:
             "3rd phone online. Re-run --operator-go once the grid is complete."
         )
 
-    # Full grid + all three locks + green preflight: the immutable confirmatory
-    # data run is still the human's to launch. This launcher surfaces readiness;
-    # the physical data collection is initiated by the operator, not fabricated.
-    return _refuse_go(
-        "human gate: grid complete and preflight green — the immutable confirmatory "
-        "data run is the operator's to initiate on the live grid. This launcher "
-        "does not fabricate confirmatory cells."
-    )
+    # Full grid + all three locks + green preflight + the operator token: this IS
+    # the operator's explicit GO. Collect the confirmatory battery for real — the
+    # executor stands up each cell's assembled circuit on the isolated engine, moves
+    # only self-generated fixture bytes, and measures the DVs from the real pcaps.
+    # It refuses to emit any DV it did not measure (never fabricates).
+    from cmd_chat.sor import executor
+
+    data_dir = out_dir / "confirmatory-data"
+    print(f"\n[GO] all locks armed + grid full — collecting confirmatory battery "
+          f"(R={args.r_runs} C={args.c_circuits} hops={args.hops}) into {data_dir}")
+    try:
+        doc = executor.run_battery(
+            data_dir, engine=args.engine, order_seed=args.order_seed,
+            r_runs=args.r_runs, c_circuits=args.c_circuits, hops=args.hops,
+            bins=args.bins, live=True,
+        )
+    except executor.ExecutorError as exc:
+        return _refuse_go(f"executor refused (no fabricated DV): {exc}")
+    except Exception as exc:  # noqa: BLE001
+        return _refuse_go(f"executor error during live collection: {exc}")
+
+    print(f"[GO] confirmatory battery collected: {doc['n_runs']} runs "
+          f"(measured_from={doc['measured_from']}) -> {doc['_results_path']}")
+    print("[GO] next: analysis/confirm.py CI-gate + Holm (family_size=7, report 4) "
+          "over the reported RQ1/RQ2 DVs.")
+    return 0
 
 
 if __name__ == "__main__":  # pragma: no cover