Every handoff below is a verified transaction. The agent proposes; the
verifier disposes. Tier 1 runtime monitors gate each transfer in
milliseconds (green pass / red block, with the exact violated clause). Tier 2
then re-proves it with a Z3 SMT solver — a real proof artifact on record for every transfer.