diff --git a/TODO.md b/TODO.md
index def51fa..cb25068 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,7 +22,9 @@
   gates and pinned adoption in `todo2code`; extend it with safe concurrent
   workstreams, dependency-aware intents and non-overlapping write scopes.
   Current state: `IN_PROGRESS / EDIT` for the approved AC-18..AC-25: add a
-  pinned, read-only and attested `koru / code-review` PR check plus a required ruleset.
+  pinned, read-only and attested `koru / code-review` PR check plus a required
+  ruleset. The workflow and live fail-closed semantic probe are verified;
+  ruleset `20186914` is staged for activation after the bootstrap evidence merge.
   Earlier AC-11..AC-16 pass; AC-17 and the pre-existing publication/external
   governance blockers remain recorded separately.
 
diff --git a/project/ticket-018/README.md b/project/ticket-018/README.md
index b5802ee..526a549 100644
--- a/project/ticket-018/README.md
+++ b/project/ticket-018/README.md
@@ -148,13 +148,13 @@ agent self-approved.
 - [x] AC-20: Koru 0.1.444 runs exactly one read-only Vallm 0.1.94 review round
       over changed supported source files; auto-fix, commit, push and mutable
       dependency versions are absent.
-- [ ] AC-21: Deterministic syntax/complexity/security checks and semantic
+- [x] AC-21: Deterministic syntax/complexity/security checks and semantic
       LLM-as-judge review fail closed on findings, missing credentials,
       malformed output or provider failure, with no secret value in logs.
-- [ ] AC-22: The structured report records repository, base/head SHA, selected
+- [x] AC-22: The structured report records repository, base/head SHA, selected
       files, tool/model versions and verdict, is uploaded with fixed retention,
       and receives GitHub artifact provenance attestation.
-- [ ] AC-23: The workflow uses least-privilege read permissions, never uses
+- [x] AC-23: The workflow uses least-privilege read permissions, never uses
       `pull_request_target`, and treats fork PRs without secrets as requiring a
       trusted rerun rather than exposing organization credentials.
 - [ ] AC-24: A repository ruleset requires `governance / enforce` and
@@ -224,3 +224,19 @@ remain historical evidence, not evidence for AC-11..AC-17.
   stops at `cargo fetch --locked` with exit 101 before the full tests start.
   Resolving it belongs to the `sdk`/`integration` workstream and requires its
   own approved ticket; ticket-018 does not rewrite or claim that artifact.
+- Pull request #1 ran `koru / code-review` successfully as run `30703151199`.
+  Its `t2c.koru-code-review/v1` report binds base `06a2faa`, head `4cfd2f9`,
+  the pinned tool/model versions and an empty supported-source set. The report
+  was uploaded for 14 days and has a GitHub Sigstore provenance attestation.
+- Historical dispatch `30703292661` exercised the live semantic path over
+  `src/comparison/workspace.ts` and `test/workspace.test.ts`. Koru rejected
+  both files with exit 1; the required check failed while report construction,
+  artifact upload and attestation still succeeded. The attested report digest
+  is `sha256:fa0f4d0c1f780bb8d21f56ca74d8ae901e184fb4996f9e84832a87846adfc1d8`.
+  No credential value appears in the workflow output.
+- Repository ruleset `20186914` is staged with no bypass actors and
+  `current_user_can_bypass: never`. It targets the default branch, requires a
+  pull request, dismisses stale review evidence, rejects deletion/force-push,
+  and requires strict `governance / enforce` plus `koru / code-review` checks.
+  Enforcement remains disabled only until this bootstrap evidence commit is
+  merged; AC-24 is not claimed until the rule is activated and queried back.
diff --git a/project/ticket-018/ai-codex-logs.txt b/project/ticket-018/ai-codex-logs.txt
index fa464e3..7991c18 100644
--- a/project/ticket-018/ai-codex-logs.txt
+++ b/project/ticket-018/ai-codex-logs.txt
@@ -204,3 +204,32 @@ $ make governance
 Four existing ticket-019 findings remain: GOV-CONFLICT-001,
 GOV-DEPENDENCY-002, GOV-WORKSTREAM-003 and GOV-WORKSTREAM-004.
 No new ticket-018 secret, path or scope finding was emitted.
+
+2026-08-01 KORU REMOTE VALIDATION
+$ GitHub pull request #1 / workflow run 30703151199
+koru / code-review: PASS
+verify: PASS
+Java adapter (JDK 17 required): PASS
+governance / enforce: FAIL only on the separately owned ticket-019 state
+report schema: t2c.koru-code-review/v1
+artifact retention: 14 days
+Sigstore provenance attestations for review.json: 1
+
+$ workflow_dispatch run 30703292661
+reviewed base: 38d33d222d2e550d055c02b609a036937c7db255
+reviewed head: bc93128f42060be3106776a7c9551c464bb52ffc
+selected: src/comparison/workspace.ts, test/workspace.test.ts
+semantic credential check: PASS (value was neither read nor logged)
+Koru/Vallm result: reject, exit=1, 2/2 files failed review
+required check: FAIL (expected negative path)
+report/artifact/attestation steps: PASS
+report digest: sha256:fa0f4d0c1f780bb8d21f56ca74d8ae901e184fb4996f9e84832a87846adfc1d8
+GitHub Sigstore provenance attestations for digest: 1
+
+$ stage repository ruleset 20186914
+name: main: governed Koru review
+enforcement: disabled for final bootstrap evidence merge
+bypass actors: none
+current_user_can_bypass: never
+rules: pull request, dismiss stale reviews, block deletion/force-push,
+strict required checks governance / enforce and koru / code-review
diff --git a/project/ticket-018/ai-codex.md b/project/ticket-018/ai-codex.md
index 84502e2..1cc7be3 100644
--- a/project/ticket-018/ai-codex.md
+++ b/project/ticket-018/ai-codex.md
@@ -140,6 +140,16 @@ Current verified baseline:
   bounded artifact retention and GitHub provenance attestation. The job is
   read-only with respect to repository contents and cannot approve or mutate a
   pull request.
+- Published the workflow through pull request #1 after the Koru check, Node
+  verification and Java adapter passed. The unrelated deterministic governance
+  failure remains assigned to ticket-019.
+- Exercised the real OpenRouter semantic path through historical dispatch
+  `30703292661`. Koru/Vallm rejected two TypeScript files and propagated a
+  failing required check while preserving an attested, commit-bound report.
+- Staged repository ruleset `20186914` with no bypass actors, strict governance
+  and Koru status checks, mandatory pull requests, stale-evidence dismissal and
+  force-push/deletion prevention. It remains disabled solely for the final
+  bootstrap evidence merge and will be activated afterward.
 
 ## Blockers
 
@@ -151,10 +161,6 @@ Current verified baseline:
   not retroactively claimed here.
 - Central `new-project` 0.7.0 is uncommitted/unpublished, so no honest immutable
   reusable-workflow SHA exists yet.
-- GitHub Ruleset and CODEOWNERS need a trusted human/team identity and external
-  repository configuration.
-- AC-18 requires explicit approval of the new Koru design after this plan is
-  visible. Until then, CI and external repository rules remain unchanged.
 - AC-17: concurrent commit `9928699` bumped the Rust SDK manifest to 0.5.1, but
   the ignored local Cargo lock still identifies the root package as 0.5.0.
   Official full Docker E2E fails closed at `cargo fetch --locked` (exit 101).
diff --git a/project/ticket-018/changelog.md b/project/ticket-018/changelog.md
index e7635fc..cf4007f 100644
--- a/project/ticket-018/changelog.md
+++ b/project/ticket-018/changelog.md
@@ -23,6 +23,13 @@
 - Added the pinned `koru / code-review` workflow with exact diff selection,
   one bounded semantic/security review round, structured evidence, artifact
   upload and GitHub provenance attestation.
+- Merged the workflow through pull request #1 after its attested Koru check and
+  existing application checks passed.
+- Proved live semantic fail-closed behavior with dispatch `30703292661`: two
+  source files were rejected, the job failed, and its report was still uploaded
+  and attested.
+- Staged ruleset `20186914` without bypass actors for final activation after the
+  bootstrap evidence merge.
 
 ## [0.1.0] - 2026-08-01