@ccoalm/ccl-skills 0.11.0 → 0.12.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/dual-track-review-gate.md

@@ -524,7 +524,7 @@ A **scope-cut / out-of-phase** finding (the scope-direction signal in `SKILL.md`
 
 The initial independent review plus Agent-initiated challenges share one **Agent-autonomous external-review budget of at most five rounds**. The initial review consumes round 1, so `challenge_budget` is `0..4`. Candidate edits, commits, rebases, amended plans, renamed slices, or a fresh controller invocation do not create more Agent authority. A stateless local controller cannot prove omitted history against a caller that controls its files, so the consuming workflow must preserve the complete review ledger and treat an Agent-created reset as a contract violation.
 
-Five is the generic `code-review` transport ceiling, not this extraction lane's spend. Non-wording Agent-autonomous extraction calls go through `scripts/extraction_review_gate.sh`, which fixes `challenge_budget=1` per chain: one review plus one challenge. **The lane spans at most two chains and three rounds; the third exists only because a fix batch moved the candidate.** Holding fixes keeps the challenge on the frozen round-1 candidate, so the batch that lands is unreviewed until a succeeding chain challenges it — and a fix touching a selected owner's `SKILL.md` or `references/**.md` moves that owner digest and ends the first chain anyway. The trigger is the candidate, never a disposition label the author writes: **landing hash equal to the challenged hash owes nothing; different owes one succession challenge bound to what lands.** There the autonomous lane ends. An authenticated human may request later review, but that is separately attributed human-requested evidence outside this chain/budget, never an additional Agent round. Unused generic capacity never authorizes automatic continuation. The closeout validator rejects referenced receipts whose recorded budget is not the wrapper-fixed value, rejects any post-chain round that is not a succession, and checks budget and ordering consistency within the caller-supplied set. `scripts/review_ledger_binding.py` is its merge-side half: it recomputes the candidate with the controller's own packet freeze and refuses a landing whose evidence binds a different one. Evidence lives outside the reviewed paths, so committing the ledger cannot move the hash it records. It cannot authenticate that the wrapper produced those receipts or that the caller retained every earlier chain or receipt. The wrapper does not mint or persist `review_chain_id` or `autonomous_review_index`: the caller still supplies both, and could start a fresh-looking chain after the final round. The validator detects bad order inside the referenced set but cannot detect a prior chain the caller omitted, so complete caller-owned ledger retention—and treating an Agent reset as a contract violation—remains part of the boundary rather than a property the local scripts prove.
+Five is the generic `code-review` transport ceiling, not this extraction lane's spend. Non-wording Agent-autonomous extraction calls go through `scripts/extraction_review_gate.sh`, which fixes `challenge_budget=1` per chain: one review plus one challenge. **The lane spans at most two chains and three rounds; the third exists only because a fix batch moved the candidate.** Holding fixes keeps the challenge on the frozen round-1 candidate, so the batch that lands is unreviewed until a succeeding chain challenges it — and a fix touching a selected owner's `SKILL.md` or `references/**.md` moves that owner digest and ends the first chain anyway. The trigger is the candidate, never a disposition label the author writes: **landing hash equal to the challenged hash owes nothing; different owes one succession challenge bound to what lands.** There the autonomous lane ends. An authenticated human may request later review, but that is separately attributed human-requested evidence outside this chain/budget, never an additional Agent round. Unused generic capacity never authorizes automatic continuation. The closeout validator rejects referenced receipts whose recorded budget is not the wrapper-fixed value, rejects any post-chain round that is not a succession, and checks budget and ordering consistency within the caller-supplied set. `scripts/review_ledger_binding.py` is its merge-side half: it recomputes the candidate with the controller's own packet freeze and refuses a landing whose evidence binds a different one. Evidence lives outside the reviewed paths, so committing the ledger cannot move the hash it records. A candidate larger than one packet is not split as a pull request but as a review: `--print-manifest --partition <paths> [--partition <paths> ...]` renders a landing partition manifest whose path partitions cover every changed file exactly once, each partition hashing to what `--print-candidate --paths <partition>` answers; commit the manifest with one validated closeout ledger per partition, and the gate recomputes every partition and refuses a manifest whose parts do not add up to the whole (an uncovered or overlapping file, a partition that no longer reproduces, a base other than the fork point, or an aggregate hash that does not reproduce its partitions). It cannot authenticate that the wrapper produced those receipts or that the caller retained every earlier chain or receipt. The wrapper does not mint or persist `review_chain_id` or `autonomous_review_index`: the caller still supplies both, and could start a fresh-looking chain after the final round. The validator detects bad order inside the referenced set but cannot detect a prior chain the caller omitted, so complete caller-owned ledger retention—and treating an Agent reset as a contract violation—remains part of the boundary rather than a property the local scripts prove.
 
 **Self-hosted chains break on every fix; the budget is summed across chains, never per chain.** In a skill repository the candidate edits its own owner package by construction, so the chain's stable bindings make the dead-end the norm, not an edge case: the selected-owner digest hashes each owner package's current working tree and owners derive from the candidate's own paths, so a fix that touches any selected-owner tree ends the tracked chain (`review_chain_invalid`) — in an extraction round that is nearly every fix, while a fix confined to files outside every selected owner drifts only the candidate hash and continues in-chain — and a plan edit that changes the normalized review scope (intent, acceptance, stage/depth, risk tags, budget) ends it as `review_scope_changed` — a self-review- or evidence-only plan refresh keeps the scope digest and the chain (binding mechanics are owned by the staged review contract in `code-review`). A chain restarted at index 1 after such a break spends the SAME Agent-autonomous budget. Treating each restarted chain as a procedurally required fresh review loop is the observed way the budget hollows out: two consecutive extraction rounds ran 20+ reviewer rounds and then 12 restarted chains — 21 reviewer invocations to land a three-line diff — each restart looking locally mandatory. When a round returns findings, walk this enumeration before any further external call:
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/extraction-quickstart.md

@@ -119,7 +119,7 @@ For maintainers running a fresh codebase / Figma / doc extraction. Read this fir
 - File: `~/.<host>/skills/.extraction-work/<project>-completion.md`
 - Final state: which batches done, which deferred, which sources unavailable.
 - Lessons: what surprised; what would change in next extraction; what to add to skill-extraction-workflow.
-- For every non-wording review chain, build the receipt-bound closeout ledger and run `scripts/validate_extraction_review_state.py <closeout.json>` before reporting a terminal state. Ask `scripts/review_ledger_binding.py --print-candidate` what the landing candidate hashes to first: if the held fix batch moved it, the ledger owes the succession challenge bound to that hash, and the same script is the merge-side gate that refuses a landing whose evidence binds a different candidate. A clean Round 2 challenge plus its exact-candidate completion receipt may validate as `ready_for_human_decision`; Round 2 findings at the exhausted budget validate as `continuation_authorization_required`; a second ordered base drift validates as `baseline_race`. Unknown, stale, omitted, or invalid evidence remains `interim`. The strict wording-only single-review path records its independent review row and does not fabricate a multi-round ledger — but note the cost the merge-side gate imposes on it: that gate accepts only a validator-checked ledger, because it cannot authenticate a hand-writable receipt, so a wording-only change that touches the bound paths still owes the two-round chain before it can land.
+- For every non-wording review chain, build the receipt-bound closeout ledger and run `scripts/validate_extraction_review_state.py <closeout.json>` before reporting a terminal state. Ask `scripts/review_ledger_binding.py --print-candidate` what the landing candidate hashes to first: if the held fix batch moved it, the ledger owes the succession challenge bound to that hash, and the same script is the merge-side gate that refuses a landing whose evidence binds a different candidate. When the whole candidate exceeds one packet, split the review rather than the pull request: `--print-manifest --partition <paths> ...` renders a landing partition manifest, and one validated ledger per partition plus the committed manifest is what the gate binds. A clean Round 2 challenge plus its exact-candidate completion receipt may validate as `ready_for_human_decision`; Round 2 findings at the exhausted budget validate as `continuation_authorization_required`; a second ordered base drift validates as `baseline_race`. Unknown, stale, omitted, or invalid evidence remains `interim`. The strict wording-only single-review path records its independent review row and does not fabricate a multi-round ledger — but note the cost the merge-side gate imposes on it: that gate accepts only a validator-checked ledger, because it cannot authenticate a hand-writable receipt, so a wording-only change that touches the bound paths still owes the two-round chain before it can land.
 
 ### 5. Provenance migration
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md

@@ -520,3 +520,5 @@ Round 073-receipt-bundling rows (new table so the entry renders as a table row a
 | A probe that cannot tell "this checkout cannot be measured" from "the thing being measured is broken" is deleted, not patched again: the repository checker runs against synthetic fixtures inside other suites, and a smoke that reds there fails suites that have nothing to do with it | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/check-ccl-skills.sh | `updated` | Owner key `skill-extraction-workflow/SKILL.md` (entrypoint unchanged; lands in scripts/check-ccl-skills.sh). Supersedes by pointer the row above that added this smoke. Observed failure, three times in one round and each time in a suite that does not own the gate: the catalog suite, then route-drift and sync-pointers together, then the source-register lifecycle suite — every one of them runs the checker against a synthetic repository where the smoke legitimately cannot operate, and the third failure additionally exposed that its capture was not `set -e` safe, so the checker died silently mid-run before printing the verdicts those suites read. Two patches had already narrowed the predicate (skip without a controller, skip without a parent commit) and a third would have narrowed it again, which is the signal this repository already records: when the same class recurs, question whether the capability should exist. It should not. The gate's own suite owns the real-checkout path with a case that runs it against the checkout it ships in, and the CI step is the enforcement point — verified green on this candidate's own pull request. What is lost is stated rather than glossed: nothing else runs the gate during `make test-repo-gates`, so a break in it surfaces at the CI step rather than locally. RED-baseline (applied): the lifecycle suite reds against the smoke-bearing checker and is green after its removal, with the gate's own eighteen-case suite unchanged in both runs. |
 | The merge gate binds every tracked path minus exactly what this round ADDS under a round's evidence directory, and refuses a candidate tree that is not committed: a whitelist binds only the paths some round happened to review, so unreviewed executable content rode along on a valid ledger; a written-down `specs/` exclusion would additionally hide edits to the committed review history itself; and a packet frozen from a dirty working tree produces a hash no clean checkout recomputes | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh | `updated` | Owner key `skill-extraction-workflow/SKILL.md` (entrypoint unchanged; lands in scripts/review_ledger_binding.py, its suite, and .github/workflows/ci.yml). Observed failure: the succession round of the previous round's own lane raised the whitelist half and it was deferred with its reason -- every fix moves the candidate and voids the ledger, and that lane's budget was spent -- so it was recorded for the next round that touches this gate. This round's own review and challenge then each found that the first inversion traded one hole for another, and both land here rather than as further deferrals. The review found that the frozen packet includes untracked files, so a scratch file inside the widened set produces a candidate hash only that working copy can reproduce: the author records it in the ledger and the merge-side run then reports that nothing binds the landing candidate, refusing valid work. The challenge found that excluding all of `specs/` excludes the committed review history, so a pull request could delete or rewrite an earlier round's plan and receipts with no evidence required. The exclusion is therefore computed from the round's own diff rather than written down: only added paths under a round's evidence directory stay outside, because a receipt inside the bound set would move the hash it records, while every modification and deletion under `specs/` is bound like any other file. The succession round then broke that shape too -- an arbitrary added file under an evidence directory, a script included, was excluded for the same reason -- which is the third occurrence of one class: the rule kept naming a LOCATION and letting the location stand in for `this is a receipt`. Rather than narrow the path a fourth time, the predicate moved to an invariant this gate owns: a path is excluded only when its committed blob parses as a JSON object carrying a 64-hex `candidate_sha256`, so a script, a fixture, or an unbound JSON file committed there is bound like anything else. Backward compatibility was measured, not assumed: recomputed at the previous round's own fork point, the old and new path sets produce the identical candidate hash its committed ledger records. Supersedes by pointer the merge-queue half of the row above, which recorded that the CI step now also runs for `merge_group`: the workflow's `on:` never subscribed to that event, so in a merge-queue run the workflow would not start at all and the condition read as coverage while providing none. Restoring the trigger was rejected rather than done, because a merge_group HEAD combines several queued pull requests while each committed ledger binds one individual candidate, so no ledger binds the aggregate and every otherwise-valid queued request would be refused -- the trigger would make the sentence true and the system worse. The unreachable branch is removed and the real coverage boundary is stated where the step lives. RED-baseline (applied, differential, two mutants each attributed to its own cases and nothing else): restoring the whole-subtree exclusion reds exactly the three committed-history cases -- rewriting an earlier plan, rewriting an earlier receipt, deleting an earlier receipt; removing the committed-tree refusal reds exactly the three dirty-tree cases; degenerating the receipt predicate to always-true reds exactly the three smuggled-file cases; three unbound executable paths (a root Makefile, a README, a release script) each red against the original whitelist and are refused after; the added-evidence case stays green throughout, which is what proves the self-reference exclusion survived. Control is 34 passing with no case disturbed. A fourth round then broke the content predicate too -- a JSON file carrying any 64-hex `candidate_sha256` is accepted as a receipt -- and that one is NOT fixed, deliberately. Four shapes of this exclusion have now been broken in four rounds, and every one of them was a proxy for `this is a controller-generated receipt` over a file the candidate itself supplies, which is the already-recorded boundary that a gate living inside the candidate cannot authenticate what it reads. This repository's own standard is that a class recurring across rounds is a question about the design rather than a fifth patch, so the residual is recorded for a person: accept it, or replace the exclusion mechanism outright -- binding the tree as of the commit before the evidence lands would need no exclusion predicate at all. What did close is real: history can no longer be rewritten unnoticed, and a script or binary can no longer ride in under an evidence directory. |
 | A succession may not carry the chain id of the chain it succeeds, and the controller refuses it at mint rather than leaving the refusal to the closeout validator: the validator only sees a lane it reads whole, while the controller mints one receipt at a time, so a caller that never closes a ledger never reaches that check | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | `updated` | Owner key `code-review/SKILL.md` (entrypoint unchanged this round; lands in scripts/review_gate.py and its suite). Observed failure: the previous round recorded this as a non-blocking deferral with its reason -- fixing it would have moved the controller digest and forfeited that round's ability to close its own ledger with the succession round it introduced. The severity recorded then is the one that holds now, and it is narrower than it first reads: this is not an open bypass, because `validate_extraction_review_state.py` already refuses a succession whose chain id equals the wrapper chain's. What lands is the same refusal at the point the receipt is made, which is the only place it applies to a controller run that never reaches a closeout. The equality direction is not inferred: the existing validator refusal uses the same predicate and the same words, so the intended semantics is that the two ids must differ. RED-baseline (applied, differential): a succession minted with its predecessor's own chain id reds against the pre-fix controller and is refused with its own diagnostic after, with the suite moving from 261 to 262 passing and no pre-existing case disturbed. |
+| The merge gate binds a landing candidate larger than one review packet through a committed landing partition manifest: path partitions whose changed files together equal the candidate's exactly once, each recomputed with the controller's own freeze and bound by its own validated ledger, so the reviewer's byte ceiling is no longer the pull request's ceiling | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh | `updated` | Owner key `skill-extraction-workflow/SKILL.md` (entrypoint unchanged; lands in scripts/review_ledger_binding.py, its suite, references/dual-track-review-gate.md, references/extraction-quickstart.md, and a .github/workflows/ci.yml comment). Observed failure: the gate defined the landing candidate as one packet hash, and the controller caps a packet at what one reviewer can read whole, so a candidate larger than that could not be frozen and no ledger could ever bind it -- a release whose whole diff was three times the ceiling had to land as eight separate merges, each splitting the pull request where the review side already permitted splitting the packet. The two identities are different sizes: base..HEAD has no natural byte limit, a reviewer's input does. A manifest committed under a round's evidence directory names the partitions and, for each, the hash that `--print-candidate --paths` already answers; the gate refuses any manifest whose parts do not add up to the whole -- a changed file in no partition, a changed file in two, a partition whose recorded hash no longer reproduces, a base other than the fork point, an aggregate hash that does not reproduce its partitions, or a partition path shaped like a pathspec. The manifest carries a top-level 64-hex `candidate_sha256` (the aggregate identity) so it satisfies the existing receipt predicate and committing it moves no partition; the exclusion predicate is unchanged and the accepted caller-controlled-evidence residual is not widened. `--print-manifest --partition ...` renders the manifest with every hash computed by the gate, so the canonical form lives in one place. Merge-queue aggregation of several pull requests into one HEAD is a different aggregate and stays unsolved, as the workflow comment now states. RED-baseline (applied, differential): the partition cases red 18 against the pre-fix gate with the existing 35 undisturbed; five in-place mutants -- coverage equality, disjointness, aggregate recomputation, base equality, partition-hash recomputation -- each red exactly their own cases (2, 2, 1, 1, 1) and nothing else, restored and verified after each. The candidate that triggered the round, measured at 623,458 bytes, renders as six freezable partitions. |
+| The partition manifest refuses a wildcard partition path and requires the partition union to EQUAL the reviewed changed set, not merely contain it: git reads `*`, `?`, `[` and `\\` as glob syntax even in a non-magic pathspec, so a wildcard partition chooses its own coverage, and under a narrowed `--paths` scope a partition can reach changed files outside the reviewed set with no uncovered file and no overlap to refuse | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh | `updated` | Owner key `skill-extraction-workflow/SKILL.md` (entrypoint unchanged; lands in scripts/review_ledger_binding.py and its suite). Observed failure: the round's own dual-track lane found both -- the independent review reported that `validate_partition_path` rejected only leading pathspec magic while `lane-*` passed through to git as a glob, and that `partition_coverage` checked only `changed_all - owner`, so with `--paths skills/a` a partition naming `.` covered changed files outside the scope and passed; the adversarial challenge independently hit the wildcard class on the same frozen candidate. Both are the same shape: the manifest was allowed to influence what git enumerated on its behalf. Fix: refuse the metacharacters as a path (never handed to git), and refuse a union larger than the reviewed set with the surplus named. Held until the challenge ran, then applied as one batch that moved the candidate, so the lane owes and runs one succession challenge bound to what lands. RED-baseline (applied, differential): the four wildcard shapes plus the rendering case red against the pre-fix gate and are refused after; the out-of-scope case reds against the pre-fix gate with a freeze error on the oversized `.` partition and is refused before freezing after; disabling the wildcard check reds exactly the five wildcard cases and disabling the equality check reds exactly the out-of-scope case, suite otherwise at 60 passing. |

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py

@@ -44,6 +44,32 @@ commit; the alternative costs a review round nobody can reproduce. The workflow
 directory stays bound, as it was before: with only `skills/` bound, deleting the CI
 step that runs this gate would not move the candidate the evidence has to match.
 
+The candidate's Git identity and the reviewer's input are two different sizes.
+A landing candidate is base..HEAD and has no natural byte limit; a review packet
+is what one reviewer can read whole, and the controller caps it at
+`MAX_PACKET_BYTES`. Binding the landing candidate to ONE packet hash therefore
+made the reviewer's ceiling the pull request's ceiling: a candidate larger than
+one packet could not be frozen, no ledger could ever bind it, and authors split
+the pull request instead of the review -- eight merges for one release. The
+review side already allowed splitting a large candidate by path into partitions
+(the `code-review` skill's packet rule); what was missing was the merge side
+consuming them. A committed landing partition manifest closes that: it names
+path partitions whose changed files together equal the candidate's changed files
+exactly once, and each partition's `candidate_sha256`, which is what
+`--print-candidate --paths <partition>` already answers. This gate recomputes
+every partition with the same `freeze_packet`, requires a validator-accepted
+ledger per partition, and refuses any manifest whose parts do not add up to the
+whole: an uncovered file, an overlapping file, a partition that no longer
+reproduces, a base other than the fork point, or an aggregate hash that does not
+reproduce its own partitions. The manifest carries a top-level 64-hex
+`candidate_sha256` -- the aggregate identity -- so it satisfies the existing
+receipt predicate and committing it moves no partition; that is the load-bearing
+reason for the field, and the exclusion predicate itself is unchanged. What the
+manifest proves is the same narrow thing the single ledger proves, taken per
+part: every byte that lands is a byte some external round froze and inspected.
+Merge-queue aggregation of several pull requests into one HEAD is a different
+aggregate and remains unsolved here.
+
 Boundaries this gate does NOT close, stated because a gate that lives inside the
 candidate cannot authenticate itself: it cannot prove the caller retained every
 earlier chain; it runs the candidate's own validator, so a candidate that also
@@ -92,6 +118,21 @@ EVIDENCE_MEMBER = re.compile(r"^specs/[^/]+/evidence/")
 # A receipt is small; anything larger is not one, and reading it is not free.
 MAX_RECEIPT_BYTES = 4_000_000
 DEFAULT_PATHS = (".",)
+# A landing partition manifest splits one candidate by path into packets a
+# reviewer can read whole. Its shape is closed: exactly these keys, this kind,
+# and a bounded partition count, so a manifest cannot double as a ledger or
+# smuggle fields the gate does not read.
+MANIFEST_KIND = "landing_partition_manifest"
+MANIFEST_SCHEMA_VERSION = 1
+MANIFEST_KEYS = {"schema_version", "kind", "base", "partitions", "candidate_sha256"}
+PARTITION_KEYS = {"paths", "candidate_sha256"}
+MAX_PARTITIONS = 64
+HEX40 = re.compile(r"^[0-9a-f]{40}$")
+HEX64 = re.compile(r"^[0-9a-f]{64}$")
+
+
+class ManifestError(Exception):
+    """A manifest that does not describe this candidate; the message is the reason."""
 
 
 def emit(message: str) -> None:
@@ -312,6 +353,233 @@ def candidate_hash(module: types.ModuleType, repo_root: Path, base: str, paths:
     return packet_sha256
 
 
+def canonical_digest(value: object) -> str:
+    canonical = json.dumps(
+        value, sort_keys=True, separators=(",", ":"), ensure_ascii=False
+    ).encode("utf-8")
+    return hashlib.sha256(canonical).hexdigest()
+
+
+def manifest_aggregate(base: str, partitions: list[dict]) -> str:
+    """The aggregate identity a manifest carries as its own `candidate_sha256`.
+
+    Computed here and nowhere else: the renderer writes it and the gate rechecks
+    it, so two implementations of one hash cannot drift into a forged manifest.
+    """
+    return canonical_digest(
+        {
+            "schema_version": MANIFEST_SCHEMA_VERSION,
+            "kind": MANIFEST_KIND,
+            "base": base,
+            "partitions": partitions,
+        }
+    )
+
+
+def validate_partition_path(value: object) -> str:
+    """A partition path is a plain relative path, never a pathspec.
+
+    The gate appends its own exclusions; a manifest that could name `:(exclude)`
+    or a glob would choose what its partition does not cover, and a leading `-`
+    would reach git as an option. Reject the shape here rather than trust git to
+    interpret it the way the manifest author hoped.
+    """
+    if not isinstance(value, str) or not value:
+        raise ManifestError("partition path must be a non-empty string")
+    if value.startswith((":", "-", "/")) or any(ord(ch) < 32 for ch in value):
+        raise ManifestError(f"partition path is not a plain relative path: {value!r}")
+    # Git reads `*`, `?`, `[` and `\` inside a pathspec as glob/escape syntax even
+    # without magic; a wildcard partition would let the manifest choose its own
+    # coverage, so it is refused as a path rather than handed to git.
+    if any(ch in value for ch in "*?[]\\"):
+        raise ManifestError(f"partition path contains a pathspec wildcard: {value!r}")
+    if ".." in value.split("/"):
+        raise ManifestError(f"partition path escapes the repository: {value!r}")
+    return value
+
+
+def parse_manifest(payload: dict, fork: str) -> tuple[list[list[str]], list[str]]:
+    """Return (partition path lists, partition hashes) or raise ManifestError.
+
+    Order of checks is cheapest first and each failure names one reason, so an
+    author reads which part failed to add up rather than a generic refusal.
+    """
+    if set(payload) != MANIFEST_KEYS:
+        raise ManifestError("manifest does not carry exactly the manifest keys")
+    if payload["schema_version"] != MANIFEST_SCHEMA_VERSION or type(payload["schema_version"]) is not int:
+        raise ManifestError(f"manifest schema_version must be {MANIFEST_SCHEMA_VERSION}")
+    base = payload["base"]
+    if not isinstance(base, str) or not HEX40.match(base):
+        raise ManifestError("manifest base must be a 40-hex commit id")
+    if base != fork:
+        raise ManifestError(
+            f"manifest base {base[:12]} is not this candidate's fork point {fork[:12]}"
+        )
+    partitions = payload["partitions"]
+    if not isinstance(partitions, list) or not 1 <= len(partitions) <= MAX_PARTITIONS:
+        raise ManifestError(f"manifest must list between 1 and {MAX_PARTITIONS} partitions")
+    path_lists: list[list[str]] = []
+    digests: list[str] = []
+    seen: set[str] = set()
+    for index, partition in enumerate(partitions, start=1):
+        if not isinstance(partition, dict) or set(partition) != PARTITION_KEYS:
+            raise ManifestError(f"partition {index} does not carry exactly paths and candidate_sha256")
+        paths = partition["paths"]
+        if not isinstance(paths, list) or not paths:
+            raise ManifestError(f"partition {index} names no paths")
+        validated = [validate_partition_path(value) for value in paths]
+        for value in validated:
+            if value in seen:
+                raise ManifestError(f"partition path is listed twice: {value}")
+            seen.add(value)
+        digest = partition["candidate_sha256"]
+        if not isinstance(digest, str) or not HEX64.match(digest):
+            raise ManifestError(f"partition {index} candidate_sha256 must be 64-hex")
+        path_lists.append(validated)
+        digests.append(digest)
+    aggregate = payload["candidate_sha256"]
+    if aggregate != manifest_aggregate(base, partitions):
+        raise ManifestError("manifest aggregate candidate_sha256 does not reproduce its partitions")
+    return path_lists, digests
+
+
+def partition_coverage(
+    repo_root: Path,
+    base: str,
+    path_lists: list[list[str]],
+    excludes: tuple[str, ...],
+    changed_all: list[str],
+) -> list[list[str]]:
+    """Each partition's changed files; refuse unless they tile the candidate.
+
+    Name-only diffs are cheap, so every way the parts can fail to add up is found
+    before any packet is frozen: an empty partition, a changed file in no
+    partition, or a changed file in two. Overlap is refused rather than tolerated
+    because two verdicts over one file leave undefined which one covers it.
+    """
+    per_partition: list[list[str]] = []
+    owner: dict[str, int] = {}
+    overlaps: list[str] = []
+    for index, paths in enumerate(path_lists, start=1):
+        changed = changed_skill_paths(repo_root, base, tuple(paths) + excludes)
+        if not changed:
+            raise ManifestError(f"partition {index} ({' '.join(paths)}) covers no changed path")
+        for value in changed:
+            if value in owner:
+                overlaps.append(value)
+            owner[value] = index
+        per_partition.append(changed)
+    if overlaps:
+        raise ManifestError(
+            "partitions overlap on changed paths: " + ", ".join(sorted(set(overlaps))[:5])
+        )
+    uncovered = sorted(set(changed_all) - set(owner))
+    if uncovered:
+        raise ManifestError(
+            "changed paths uncovered by every partition: " + ", ".join(uncovered[:5])
+        )
+    # Equality, not containment: under a narrowed --paths scope a partition can
+    # reach changed files outside the reviewed set, and a union larger than the
+    # candidate is as wrong as one smaller than it.
+    outside = sorted(set(owner) - set(changed_all))
+    if outside:
+        raise ManifestError(
+            "partitions cover changed paths outside the reviewed scope: " + ", ".join(outside[:5])
+        )
+    return per_partition
+
+
+def render_manifest(
+    module: types.ModuleType,
+    repo_root: Path,
+    base: str,
+    path_lists: list[list[str]],
+    excludes: tuple[str, ...],
+    changed_all: list[str],
+) -> dict:
+    """Build the manifest an author commits, with every hash computed by this gate."""
+    validated = [[validate_partition_path(value) for value in paths] for paths in path_lists]
+    seen: set[str] = set()
+    for paths in validated:
+        for value in paths:
+            if value in seen:
+                raise ManifestError(f"partition path is listed twice: {value}")
+            seen.add(value)
+    partition_coverage(repo_root, base, validated, excludes, changed_all)
+    partitions = [
+        {
+            "paths": paths,
+            "candidate_sha256": candidate_hash(module, repo_root, base, tuple(paths) + excludes),
+        }
+        for paths in validated
+    ]
+    return {
+        "schema_version": MANIFEST_SCHEMA_VERSION,
+        "kind": MANIFEST_KIND,
+        "base": base,
+        "partitions": partitions,
+        "candidate_sha256": manifest_aggregate(base, partitions),
+    }
+
+
+def accepted_ledger_for(
+    evidence: list[tuple[Path, dict]],
+    repo_root: Path,
+    validator: Path,
+    digest: str,
+    rejected: list[str],
+) -> str | None:
+    """The first validator-accepted closeout ledger bound to `digest`, if any.
+
+    The same criterion the single-candidate path uses: a receipt-shaped file is
+    not evidence, only a ledger the validator accepts, because this gate cannot
+    authenticate that a controller minted what it reads.
+    """
+    for path, payload in evidence:
+        if payload.get("candidate_sha256") != digest:
+            continue
+        if "closeout_state" not in payload or "controller_receipts" not in payload:
+            continue
+        relative = str(path.relative_to(repo_root))
+        accepted, output = validator_accepts(validator, path)
+        if accepted:
+            return f"{relative} -- {output}"
+        rejected.append(f"{relative}: {output}")
+    return None
+
+
+def bind_manifest(
+    module: types.ModuleType,
+    repo_root: Path,
+    base: str,
+    payload: dict,
+    excludes: tuple[str, ...],
+    changed_all: list[str],
+    evidence: list[tuple[Path, dict]],
+    validator: Path,
+    rejected_ledgers: list[str],
+) -> list[str]:
+    """Bind the candidate through one manifest; return per-partition proof lines.
+
+    Raises ManifestError naming the first part that does not add up.
+    """
+    path_lists, digests = parse_manifest(payload, base)
+    partition_coverage(repo_root, base, path_lists, excludes, changed_all)
+    proofs: list[str] = []
+    for index, (paths, recorded) in enumerate(zip(path_lists, digests), start=1):
+        label = f"partition {index} ({' '.join(paths)})"
+        actual = candidate_hash(module, repo_root, base, tuple(paths) + excludes)
+        if actual != recorded:
+            raise ManifestError(
+                f"{label} recorded {recorded[:12]}... but does not reproduce: the candidate now hashes to {actual[:12]}..."
+            )
+        proof = accepted_ledger_for(evidence, repo_root, validator, actual, rejected_ledgers)
+        if proof is None:
+            raise ManifestError(f"no accepted ledger binds {label} {actual}")
+        proofs.append(f"  {label} {actual[:12]}... <- {proof}")
+    return proofs
+
+
 def validator_accepts(validator: Path, ledger_path: Path) -> tuple[bool, str]:
     result = subprocess.run(
         [sys.executable, str(validator), str(ledger_path)],
@@ -382,7 +650,27 @@ def main() -> int:
         action="store_true",
         help="print the candidate hash the evidence must bind, then exit",
     )
+    parser.add_argument(
+        "--print-manifest",
+        action="store_true",
+        help=(
+            "render a landing partition manifest for the --partition groups given, "
+            "with every hash computed by this gate, then exit"
+        ),
+    )
+    parser.add_argument(
+        "--partition",
+        action="append",
+        nargs="+",
+        metavar="PATH",
+        default=[],
+        help="one partition's paths; repeat per partition (only with --print-manifest)",
+    )
     args = parser.parse_args()
+    if args.print_manifest and not args.partition:
+        parser.error("--print-manifest needs at least one --partition")
+    if args.partition and not args.print_manifest:
+        parser.error("--partition is only meaningful with --print-manifest")
 
     repo_root = Path(args.repo_root).resolve()
     base = args.base or os.environ.get("CCL_SKILL_BASE_REF", "")
@@ -410,61 +698,114 @@ def main() -> int:
     # confirmed, and no test asserts a bypass this gate does not have. `literal`
     # stays because interpreting these names as patterns is a capability the gate
     # never needed, and removing it costs nothing.
-    paths = tuple(args.paths) + tuple(
+    excludes = tuple(
         f":(exclude,literal){path}" for path in added_evidence_paths(repo_root, base)
     )
+    paths = tuple(args.paths) + excludes
     require_committed_tree(repo_root, paths)
     changed = changed_skill_paths(repo_root, base, paths)
     if not changed:
         # No reviewed path moved, so there is no candidate to freeze and nothing to
         # bind. Say which it is rather than letting an empty packet surface as a
         # freeze error, which reads like a broken gate.
-        if args.print_candidate:
+        if args.print_candidate or args.print_manifest:
             emit(f"review_ledger_binding_no_change: no reviewed-path change against {base}")
         else:
             print(f"review_ledger_binding_ok: no reviewed-path change against {base}")
         return 0
 
     module = load_controller(repo_root)
+
+    if args.print_manifest:
+        try:
+            manifest = render_manifest(module, repo_root, base, args.partition, excludes, changed)
+        except ManifestError as exc:
+            emit(f"review_ledger_binding_error: cannot render a landing partition manifest: {exc}")
+            return 1
+        except Exception as exc:  # noqa: BLE001 - surface the controller's own message
+            emit(f"review_ledger_binding_error: cannot freeze a partition packet: {exc}")
+            return 1
+        print(json.dumps(manifest, indent=2, ensure_ascii=False))
+        return 0
+
+    # The whole candidate may be larger than one packet. That is no longer a
+    # terminal error: record why the single freeze failed and let a committed
+    # partition manifest bind the candidate part by part.
+    expected: str | None = None
+    whole_error: str | None = None
     try:
         expected = candidate_hash(module, repo_root, base, paths)
     except Exception as exc:  # noqa: BLE001 - surface the controller's own message
-        emit(f"review_ledger_binding_error: cannot freeze the candidate packet: {exc}")
-        return 1
+        whole_error = str(exc)
 
     if args.print_candidate:
+        if expected is None:
+            emit(f"review_ledger_binding_error: cannot freeze the candidate packet: {whole_error}")
+            return 1
         print(expected)
         return 0
 
     validator = repo_root / "skills" / "skill-extraction-workflow" / "scripts" / VALIDATOR
+    evidence = scan(repo_root, args.evidence_root)
     ledgers: list[str] = []
-    for path, payload in scan(repo_root, args.evidence_root):
-        if payload.get("candidate_sha256") != expected:
-            continue
-        relative = str(path.relative_to(repo_root))
+    if expected is not None:
         # Only a validator-accepted ledger counts. A receipt-shaped file proves
         # nothing on its own: this gate cannot authenticate that a controller
         # minted it, so any branch keyed on a self-declared field is a bypass a
         # contributor can hand-write.
-        if "closeout_state" in payload and "controller_receipts" in payload:
-            accepted, output = validator_accepts(validator, path)
-            if accepted:
-                print(
-                    f"review_ledger_binding_ok: {relative} binds the landing candidate "
-                    f"({expected[:12]}...) -- {output}"
-                )
-                return 0
-            ledgers.append(f"{relative}: {output}")
-
-    emit(
-        "review_ledger_binding_failed: no accepted review evidence binds the landing "
-        f"candidate {expected}"
-    )
+        proof = accepted_ledger_for(evidence, repo_root, validator, expected, ledgers)
+        if proof is not None:
+            print(
+                f"review_ledger_binding_ok: {proof.split(' -- ', 1)[0]} binds the landing "
+                f"candidate ({expected[:12]}...) -- {proof.split(' -- ', 1)[1]}"
+            )
+            return 0
+
+    manifests: list[str] = []
+    for path, payload in evidence:
+        if payload.get("kind") != MANIFEST_KIND:
+            continue
+        relative = str(path.relative_to(repo_root))
+        try:
+            proofs = bind_manifest(
+                module, repo_root, base, payload, excludes, changed, evidence, validator, ledgers
+            )
+        except ManifestError as exc:
+            manifests.append(f"{relative}: {exc}")
+            continue
+        except Exception as exc:  # noqa: BLE001 - surface the controller's own message
+            manifests.append(f"{relative}: cannot freeze a partition packet: {exc}")
+            continue
+        print(
+            f"review_ledger_binding_ok: {relative} binds the landing candidate as "
+            f"{len(proofs)} partitions (aggregate {payload['candidate_sha256'][:12]}...)"
+        )
+        for line in proofs:
+            print(line)
+        return 0
+
+    if expected is None:
+        emit(
+            "review_ledger_binding_failed: the whole candidate cannot be frozen as one "
+            f"packet ({whole_error}) and no committed landing partition manifest binds it"
+        )
+        emit(
+            "  split the candidate by path: --print-manifest --partition <paths> "
+            "[--partition <paths> ...] renders the manifest; commit it with one "
+            "validated ledger per partition"
+        )
+    else:
+        emit(
+            "review_ledger_binding_failed: no accepted review evidence binds the landing "
+            f"candidate {expected}"
+        )
     emit(f"  reviewed paths: {' '.join(paths)} against {base}")
     emit(f"  changed files: {len(changed)}")
     for row in ledgers:
         emit(f"  rejected ledger -> {row}")
-    if not ledgers:
+    for row in manifests:
+        emit(f"  rejected manifest -> {row}")
+    if not ledgers and not manifests:
         emit(
             "  no committed ledger records this candidate; run the extraction review "
             "lane against the final, committed tree"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh

@@ -307,6 +307,191 @@ out="$(run_scope --base "$SCOPE_BASE" --print-candidate)"; rc=$?
 check "the same clean checkout still reaches its normal verdict" \
   '[ "$rc" = 0 ] && case "$out" in *"no reviewed-path change"*) true;; *) false;; esac'
 
+# Partition: the candidate's Git identity is base..HEAD, but the packet a reviewer
+# can read is capped at the controller's byte ceiling. A landing candidate larger
+# than one packet used to be unlandable as one pull request -- the whole-candidate
+# freeze failed and no ledger could ever bind it -- so authors split the pull
+# request instead of the review. A committed landing partition manifest names
+# path partitions that together cover every changed file exactly once, each bound
+# by its own validated ledger; the gate recomputes every partition and refuses any
+# manifest whose parts do not add up to the whole.
+PART="$WORK/partition-repo"
+mkdir -p "$PART/skills/code-review/scripts" "$PART/skills/skill-extraction-workflow/scripts" "$PART/specs/round/evidence" "$PART/lane-a" "$PART/lane-b"
+cp "$CONTROLLER" "$PART/skills/code-review/scripts/review_gate.py"
+cat >"$PART/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py" <<'PY'
+import sys
+print("extraction_review_state_ok: stub accepted")
+sys.exit(0)
+PY
+git -C "$PART" init -q .
+git -C "$PART" config user.email t@example.invalid
+git -C "$PART" config user.name tester
+printf 'baseline\n' >"$PART/skills/skill-extraction-workflow/SKILL.md"
+printf 'baseline\n' >"$PART/lane-a/big.txt"
+printf 'baseline\n' >"$PART/lane-b/big.txt"
+git -C "$PART" add -A && git -C "$PART" commit -qm baseline
+PART_BASE="$(git -C "$PART" rev-parse HEAD)"
+
+run_part() { python3 "$GATE" --repo-root "$PART" "$@" 2>&1; }
+
+# The manifest oracle mirrors the documented canonical form (sorted keys, compact
+# separators, UTF-8) independently of the gate, so a drift in either side reds.
+cat >"$WORK/write-manifest.py" <<'PY'
+import hashlib, json, sys
+out, base, aggregate = sys.argv[1], sys.argv[2], sys.argv[3]
+partitions = []
+for spec in sys.argv[4:]:
+    paths, digest = spec.rsplit("=", 1)
+    partitions.append({"paths": paths.split(), "candidate_sha256": digest})
+body = {"schema_version": 1, "kind": "landing_partition_manifest", "base": base, "partitions": partitions}
+if aggregate == "AUTO":
+    canonical = json.dumps(body, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+    aggregate = hashlib.sha256(canonical).hexdigest()
+body["candidate_sha256"] = aggregate
+with open(out, "w", encoding="utf-8") as handle:
+    json.dump(body, handle, indent=2)
+    handle.write("\n")
+PY
+write_closeout() { python3 - "$1" "$2" <<'PY'
+import json, sys
+from pathlib import Path
+Path(sys.argv[1]).write_text(json.dumps({"schema_version": 3, "closeout_state": "ready_for_human_decision", "controller_receipts": [], "candidate_sha256": sys.argv[2]}))
+PY
+}
+
+# Two lanes each change ~130 KB: either fits one packet, the pair does not.
+python3 - "$PART" <<'PY'
+import sys
+from pathlib import Path
+root = Path(sys.argv[1])
+for lane in ("lane-a", "lane-b"):
+    lines = [f"{lane} line {index:06d} " + "x" * 40 for index in range(2200)]
+    (root / lane / "big.txt").write_text("\n".join(lines) + "\n")
+PY
+git -C "$PART" add -A && git -C "$PART" commit -qm "oversized landing"
+
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a candidate too large for one packet is refused with the partition recipe, not a bare freeze error" \
+  '[ "$rc" = 1 ] && case "$out" in *"exceeds 200000 bytes"*"landing partition manifest"*) true;; *) false;; esac'
+
+MANIFEST_JSON="$(run_part --base "$PART_BASE" --print-manifest --partition lane-a --partition lane-b)"; rc=$?
+check "the gate renders a manifest for a partition that covers the whole candidate" \
+  '[ "$rc" = 0 ] && python3 -c "import json,sys; m=json.loads(sys.argv[1]); assert m[\"kind\"]==\"landing_partition_manifest\" and len(m[\"partitions\"])==2 and m[\"base\"]==sys.argv[2]" "$MANIFEST_JSON" "$PART_BASE"'
+
+out="$(run_part --base "$PART_BASE" --print-manifest --partition lane-a)"; rc=$?
+check "rendering refuses a partition that leaves a changed path uncovered" \
+  '[ "$rc" != 0 ] && case "$out" in *"uncovered"*"lane-b/big.txt"*) true;; *) false;; esac'
+
+out="$(run_part --base "$PART_BASE" --print-manifest --partition lane-a --partition lane-a/big.txt lane-b)"; rc=$?
+check "rendering refuses partitions that overlap on a changed path" \
+  '[ "$rc" != 0 ] && case "$out" in *"overlap"*"lane-a/big.txt"*) true;; *) false;; esac'
+
+out="$(run_part --base "$PART_BASE" --print-manifest --partition lane-a --partition lane-a lane-b)"; rc=$?
+check "rendering refuses the same path listed in two partitions before touching git" \
+  '[ "$rc" != 0 ] && case "$out" in *"listed twice"*"lane-a"*) true;; *) false;; esac'
+
+HASH_A="$(run_part --base "$PART_BASE" --print-candidate --paths lane-a)"
+HASH_B="$(run_part --base "$PART_BASE" --print-candidate --paths lane-b)"
+check "a partition's hash is exactly what --print-candidate --paths already answers" \
+  '[ ${#HASH_A} = 64 ] && python3 -c "import json,sys; m=json.loads(sys.argv[1]); assert [p[\"candidate_sha256\"] for p in m[\"partitions\"]]==[sys.argv[2], sys.argv[3]]" "$MANIFEST_JSON" "$HASH_A" "$HASH_B"'
+
+printf '%s\n' "$MANIFEST_JSON" >"$PART/specs/round/evidence/landing-partitions.json"
+git -C "$PART" add -A && git -C "$PART" commit -qm "partition manifest"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest whose partitions carry no validated ledger is refused, naming the partition" \
+  '[ "$rc" = 1 ] && case "$out" in *"no accepted ledger"*"lane-a"*) true;; *) false;; esac'
+HASH_A_AFTER="$(run_part --base "$PART_BASE" --print-candidate --paths lane-a)"
+check "committing the manifest does not move the partition it describes" \
+  '[ "$HASH_A_AFTER" = "$HASH_A" ]'
+
+write_closeout "$PART/specs/round/evidence/closeout-a.json" "$HASH_A"
+write_closeout "$PART/specs/round/evidence/closeout-b.json" "$HASH_B"
+git -C "$PART" add -A && git -C "$PART" commit -qm "partition ledgers"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a complete manifest with a validated ledger per partition binds a candidate no single packet could" \
+  '[ "$rc" = 0 ] && case "$out" in *"binds the landing candidate"*"2 partitions"*) true;; *) false;; esac'
+PART_GOOD="$(git -C "$PART" rev-parse HEAD)"
+
+# Every way the parts can fail to add up to the whole is refused for its own
+# reason. Each probe branches from the passing state so the cases stay independent.
+MANIFEST="$PART/specs/round/evidence/landing-partitions.json"
+probe_part() {
+  git -C "$PART" checkout -q -B "probe" "$PART_GOOD"
+}
+
+probe_part
+python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" AUTO "lane-a=$HASH_A"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest drops a lane"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest that leaves a changed path in no partition is refused" \
+  '[ "$rc" = 1 ] && case "$out" in *"uncovered"*"lane-b/big.txt"*) true;; *) false;; esac'
+
+probe_part
+python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" AUTO "lane-a=$HASH_A" "lane-a/big.txt lane-b=$HASH_B"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest overlaps"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest whose partitions overlap is refused before any packet is frozen" \
+  '[ "$rc" = 1 ] && case "$out" in *"overlap"*"lane-a/big.txt"*) true;; *) false;; esac'
+
+probe_part
+printf 'moved after the manifest was written\n' >>"$PART/lane-a/big.txt"
+git -C "$PART" add -A && git -C "$PART" commit -qm "candidate moves after manifest"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a partition whose recorded hash no longer reproduces is refused" \
+  '[ "$rc" = 1 ] && case "$out" in *"lane-a"*"does not reproduce"*) true;; *) false;; esac'
+
+probe_part
+python3 "$WORK/write-manifest.py" "$MANIFEST" "0000000000000000000000000000000000000000" AUTO "lane-a=$HASH_A" "lane-b=$HASH_B"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest names another base"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest written against another base is refused" \
+  '[ "$rc" = 1 ] && case "$out" in *"base"*"fork point"*) true;; *) false;; esac'
+
+probe_part
+python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" "$(printf 'f%.0s' $(seq 64))" "lane-a=$HASH_A" "lane-b=$HASH_B"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest aggregate forged"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest whose aggregate hash does not reproduce its partitions is refused" \
+  '[ "$rc" = 1 ] && case "$out" in *"aggregate"*) true;; *) false;; esac'
+
+for bad_path in ":(exclude)lane-b" "-lane-b" "../lane-b" "/lane-b" "lane-*" "lane-?" "lane-[ab]" "lane-\\b"; do
+  probe_part
+  python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" AUTO "lane-a=$HASH_A" "$bad_path=$HASH_B"
+  git -C "$PART" add -A && git -C "$PART" commit -qm "manifest smuggles a pathspec"
+  out="$(run_part --base "$PART_BASE")"; rc=$?
+  check "a manifest partition path shaped like $bad_path is refused as a path, not handed to git" \
+    '[ "$rc" = 1 ] && case "$out" in *"partition path"*) true;; *) false;; esac'
+done
+
+out="$(run_part --base "$PART_BASE" --print-manifest --partition 'lane-*')"; rc=$?
+check "rendering refuses a wildcard partition instead of letting git expand it" \
+  '[ "$rc" != 0 ] && case "$out" in *"partition path"*"wildcard"*) true;; *) false;; esac'
+
+# Under a narrowed --paths scope the partition union must equal the reviewed
+# changed set, not merely contain it: a partition naming `.` reaches lane-b even
+# though only lane-a is under review, and that surplus is refused before any
+# packet is frozen. The ledgers are removed so the single-ledger path cannot
+# satisfy the narrowed scope first.
+probe_part
+git -C "$PART" rm -q "$PART/specs/round/evidence/closeout-a.json" "$PART/specs/round/evidence/closeout-b.json"
+python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" AUTO ".=$(printf '0%.0s' $(seq 64))"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest reaches outside the reviewed scope"
+out="$(run_part --base "$PART_BASE" --paths lane-a)"; rc=$?
+check "a partition reaching changed paths outside a narrowed --paths scope is refused, not accepted as covering" \
+  '[ "$rc" = 1 ] && case "$out" in *"outside the reviewed scope"*"lane-b/big.txt"*) true;; *) false;; esac'
+
+probe_part
+git -C "$PART" rm -q "$PART/specs/round/evidence/closeout-b.json"
+git -C "$PART" commit -qm "one ledger missing"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest with one partition unbound is refused, naming that partition" \
+  '[ "$rc" = 1 ] && case "$out" in *"no accepted ledger"*"lane-b"*) true;; *) false;; esac'
+
+git -C "$PART" checkout -q -B "landing" "$PART_GOOD"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "the passing partition state still passes after the probes" \
+  '[ "$rc" = 0 ]'
+
 # The suite above exercises a synthetic repository. The gate must also run against
 # the real checkout it ships in, or a break in that path passes every test here.
 REAL_ROOT="$(cd "$DIR/../../.." && pwd -P)"

package/dist/assets/release.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "npmPackage": "@ccoalm/ccl-skills",
-  "version": "0.11.0",
-  "sourceCommit": "3269aa4739c5336f005292e70cb82cdd4ffb76c7",
+  "version": "0.12.0",
+  "sourceCommit": "b874e09297205e68e3c5f01b112051655d48f2d7",
   "sourceState": "clean",
   "files": [
     {
@@ -2017,7 +2017,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/dual-track-review-gate.md",
-      "sha256": "b567749aee88e60a46a1ba7dfb687fe7e22e0898b2fae69f4638d2c07e2a6cca",
+      "sha256": "50f907bd644401adbcdf55f259430eb62c39e656e27c14c1f367654c3da1b630",
       "mode": 420
     },
     {
@@ -2047,7 +2047,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/extraction-quickstart.md",
-      "sha256": "63d62923d961f34765c1ebb832c73764ebd979f981a0f2c086a6f815a6c2b6b8",
+      "sha256": "68b6327538ad1bb99fe9c0dd337bd961f029ddf9929c1ecd7c60c616f59d84de",
       "mode": 420
     },
     {
@@ -2122,7 +2122,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md",
-      "sha256": "244e155d641b0495a254f765dc8d9d548e0f0bf2f1f3e60916fcbebea2b44ece",
+      "sha256": "5d4cede717c6a88c94b4154b5b2e077c5e610fb450b2d5eaaa4490b1cf826d44",
       "mode": 420
     },
     {
@@ -2252,7 +2252,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py",
-      "sha256": "20068bbd9b54f32460d14963391e11d8e9ecf08997bf8ece3c758effeb950f40",
+      "sha256": "a44a65d80dbcb366f667742e160949256c7b191175ab6fb711c38e35c74f11c7",
       "mode": 493
     },
     {
@@ -2482,7 +2482,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh",
-      "sha256": "ce08eca4a5ecd1c578216eaed67cf9af0d02629e2c9cfea54c2a27bfaf8809ae",
+      "sha256": "471362ad4524c7c13367e4cc296d48beff3127bd50974fdc5d4e8d038396855e",
       "mode": 493
     },
     {
@@ -3378,5 +3378,5 @@
       "mode": 420
     }
   ],
-  "snapshotHash": "4797cf3d30cf1336e439094f37df74198438083e314e2fb1db66dbfbd3eac0fc"
+  "snapshotHash": "09ad2ee15e60bc0b231e22c816aab9207dc5af912957bfd86d97998eb732d1ea"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccoalm/ccl-skills",
-	"version": "0.11.0",
+	"version": "0.12.0",
   "description": "Reusable workflows that help coding agents plan, build, test, review, and release software — for Claude Code, Codex, and OpenCode",
 	"keywords": ["skills", "agent-skills", "claude", "claude-code", "codex", "opencode", "agent", "ai", "ai-agents", "cli", "anthropic", "developer-tools"],
   "type": "module",