@ccoalm/ccl-skills 0.15.3 → 0.15.5

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_cli_review_wrappers.sh

@@ -698,18 +698,31 @@ if [ "${1:-}" = mcp ] && [ "${2:-}" = list ]; then
   fi
   python3 - "$@" <<'PY_MCP_LIST'
 import json, os, sys, tomllib
+from pathlib import Path
 
 arguments = iter(sys.argv[1:])
 servers = {}
-inherited_names = {
-    "inherited_mcp": "unrelated",
-    "inherited_mcp_dot": "unrelated.name",
-    "inherited_mcp_space": "unrelated name",
-    "inherited_mcp_quote": 'unrelated"name',
-}
-inherited_name = inherited_names.get(os.environ.get("STUB_BEHAVIOR"))
-if inherited_name is not None:
-    servers[inherited_name] = {"command": "/bin/false", "args": [], "enabled": True}
+plugin_sourced = set()
+# Inherited servers come from the home the CLI was actually handed, never from
+# the test's own environment: whether the reviewer sees a user's server is
+# exactly the question, and a stub that injects one regardless of the home
+# could not tell a private home from the user's.
+home = Path(os.environ.get("CODEX_HOME", ""))
+home_config = home / "config.toml" if os.environ.get("CODEX_HOME") else None
+if home_config is not None and home_config.exists():
+    try:
+        home_data = tomllib.loads(home_config.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, tomllib.TOMLDecodeError):
+        home_data = {}
+    for inherited_name, inherited in (home_data.get("mcp_servers") or {}).items():
+        if isinstance(inherited, dict):
+            servers[inherited_name] = dict(inherited)
+            servers[inherited_name].setdefault("enabled", True)
+# A plugin contributes its server outside `mcp_servers`, which is why an
+# override under that table cannot reach it.
+if os.environ.get("CODEX_HOME") and (home / "plugins" / "provided.json").exists():
+    servers["plugin_provided"] = {"command": "/bin/false", "args": [], "enabled": True}
+    plugin_sourced.add("plugin_provided")
 for argument in arguments:
     if argument in {"-c", "--config"}:
         # Codex splits the override path separately from its TOML value;
@@ -724,18 +737,76 @@ for argument in arguments:
         else:
             continue
         for name, settings in configured_servers.items():
+            if name in plugin_sourced:
+                # A plugin contributes its server outside `mcp_servers`, so an
+                # override under that table builds an entry with no transport
+                # and the CLI refuses to load the configuration at all.
+                sys.stderr.write(
+                    "Error: failed to load bootstrap configuration\n\n"
+                    "Caused by:\n    invalid transport\n"
+                    "    in `mcp_servers." + name + "`\n")
+                sys.exit(1)
             servers.setdefault(name, {}).update(settings)
-print(json.dumps([
+rows = [
     {"name": name, "enabled": server.get("enabled", True),
      "transport": {"type": "stdio", "command": server["command"],
                    "args": server.get("args", [])}}
     for name, server in servers.items()
-]))
+]
+if os.environ.get("STUB_MALFORMED_DISABLED_ROW"):
+    # The malformed row is disabled: a check that filters before validating
+    # would never look at it.
+    bad = {"missing": {}, "empty": {"name": ""}, "nonstring": {"name": 7}}[
+        os.environ["STUB_MALFORMED_DISABLED_ROW"]]
+    rows.append({**bad, "enabled": False,
+                 "transport": {"type": "stdio", "command": "/bin/false", "args": []}})
+if os.environ.get("STUB_DUPLICATE_PACKET_ROW") == "1":
+    # A JSON array can carry the same name twice; a dict of servers cannot.
+    rows.append({"name": "code_review_packet", "enabled": False,
+                 "transport": {"type": "stdio", "command": "/bin/false", "args": []}})
+print(json.dumps(rows))
 PY_MCP_LIST
   exit $?
 fi
 touch "$state/codex_invoked"
 printf '%s' "$0" >"$state/codex_argv0"
+printf '%s' "${CODEX_HOME:-}" >"$state/codex_home"
+if [ "${STUB_REPLACE_AUTH_LINK:-}" = 1 ] && [ -n "${CODEX_HOME:-}" ]; then
+  rm -f "$CODEX_HOME/auth.json"
+  printf '%s\n' '{"tokens":{"access":"rotated"}}' >"$CODEX_HOME/auth.json"
+fi
+python3 - "${CODEX_HOME:-}" "$state/codex_home_shape" <<'PY_HOME_SHAPE'
+import json, os, sys, tomllib
+from pathlib import Path
+
+# The wrapper deletes its run directory on exit, so the private home can only
+# be inspected from inside the run.
+home = Path(sys.argv[1]) if sys.argv[1] else None
+shape = {"home": sys.argv[1], "config_keys": [], "has_mcp_servers": None,
+         "has_plugins": None, "auth_link": None}
+if home is not None:
+    config = home / "config.toml"
+    if config.exists():
+        try:
+            data = tomllib.loads(config.read_text(encoding="utf-8"))
+        except (OSError, UnicodeError, tomllib.TOMLDecodeError):
+            data = {"__unreadable__": True}
+        shape["config_keys"] = sorted(data)
+        shape["has_mcp_servers"] = "mcp_servers" in data
+        shape["model"] = data.get("model")
+        shape["model_reasoning_effort"] = data.get("model_reasoning_effort")
+        providers = data.get("model_providers")
+        shape["provider_keys"] = sorted(providers) if isinstance(providers, dict) else None
+    else:
+        shape["has_mcp_servers"] = False
+    shape["has_plugins"] = (home / "plugins").exists()
+    auth = home / "auth.json"
+    if auth.is_symlink():
+        shape["auth_link"] = os.readlink(auth)
+    elif auth.exists():
+        shape["auth_link"] = "__regular_file__"
+Path(sys.argv[2]).write_text(json.dumps(shape), encoding="utf-8")
+PY_HOME_SHAPE
 printf '%s' "${CMUX_CODEX_HOOKS_DISABLED:-}" >"$state/codex_cmux_hooks_disabled"
 last_message=""
 has_model=no
@@ -1802,16 +1873,29 @@ out="$(run_codex packet_tampered)"; rc=$?
 check "Codex rejects altered packet tool bytes through wrapper and parser" \
   '[ "$rc" = 2 ] && [ "$(field reason_code "$out")" = binding_mismatch ] && [ "$(field cascade_eligible "$out")" = False ]'
 
-for inherited_mcp_case in inherited_mcp inherited_mcp_dot inherited_mcp_space inherited_mcp_quote; do
-  case "$inherited_mcp_case" in
-    inherited_mcp) inherited_mcp_name=unrelated ;;
-    inherited_mcp_dot) inherited_mcp_name=unrelated.name ;;
-    inherited_mcp_space) inherited_mcp_name='unrelated name' ;;
-    inherited_mcp_quote) inherited_mcp_name='unrelated"name' ;;
-  esac
+# A user's own server, however its name is spelled, must not reach the reviewer
+# and must not be touched: the wrapper neither disables it nor names it.
+inherited_index=0
+for inherited_mcp_name in 'unrelated' 'unrelated.name' 'unrelated name' 'unrelated"name'; do
+  inherited_index=$((inherited_index + 1))
+  inherited_source="$WORK/codex-inherited-$inherited_index"
+  mkdir -p "$inherited_source"
+  python3 - "$inherited_source/config.toml" "$inherited_mcp_name" <<'PY_INHERITED_SOURCE'
+import json, sys
+from pathlib import Path
+
+Path(sys.argv[1]).write_text(
+    "[mcp_servers]\n"
+    + json.dumps(sys.argv[2])
+    + ' = { command = "/bin/false", args = [] }\n',
+    encoding="utf-8",
+)
+PY_INHERITED_SOURCE
+  printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$inherited_source/auth.json"
+  chmod 0600 "$inherited_source/auth.json"
   rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
-  out="$(run_codex "$inherited_mcp_case")"; rc=$?
-  inherited_mcp_disabled="$(python3 - "$inherited_mcp_name" "$WORK/state/codex_configs" <<'PY_MCP_DISABLED'
+  out="$(run_codex pass claude "$inherited_source")"; rc=$?
+  inherited_mcp_untouched="$(python3 - "$inherited_mcp_name" "$WORK/state/codex_configs" <<'PY_MCP_UNTOUCHED'
 import sys, tomllib
 from pathlib import Path
 
@@ -1821,15 +1905,140 @@ for override in path.read_text().splitlines() if path.exists() else []:
     key, value = override.split("=", 1)
     if key.strip() == "mcp_servers":
         tables.append(tomllib.loads("servers=" + value)["servers"])
+    elif key.strip().startswith("mcp_servers."):
+        tables.append({key.strip().split(".")[1]: {}})
 print(len(tables) == 1
-      and tables[0].get(sys.argv[1], {}).get("enabled") is False
-      and "code_review_packet" in tables[0])
-PY_MCP_DISABLED
+      and sys.argv[1] not in tables[0]
+      and list(tables[0]) == ["code_review_packet"])
+PY_MCP_UNTOUCHED
+)"
+  check "Codex never reaches or names the user's own MCP server ($inherited_mcp_name)" \
+    '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ] && [ "$inherited_mcp_untouched" = True ]'
+done
+
+# The shape that used to dead-end the preflight: a server contributed outside
+# `mcp_servers`, which no override under that table can reach.
+plugin_source="$WORK/codex-plugin-source"
+mkdir -p "$plugin_source/plugins"
+printf '%s\n' '{"server":"plugin_provided"}' >"$plugin_source/plugins/provided.json"
+printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$plugin_source/auth.json"
+chmod 0600 "$plugin_source/auth.json"
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
+out="$(run_codex pass claude "$plugin_source")"; rc=$?
+check "Codex reviews on a host whose plugin contributes an MCP server" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ]'
+
+# A canned verdict cannot prove the repair: a CLI that accepts the configuration
+# and still refuses read_packet would pass every assertion above. This one
+# replays the real packet server's bytes through the parser on that same host.
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_packet_call"
+out="$(run_codex packet_read claude "$plugin_source")"; rc=$?
+check "Codex completes a real frozen packet read on a plugin-contributing host" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$(cat "$WORK/state/codex_packet_call")" = read_packet ]'
+
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_home"
+mkdir -p "$WORK/codex-foreign-source"
+printf '%s\n' 'profile = "review"' '' '[profiles.review]' 'model = "seeded-model"' 'model_reasoning_effort = "xhigh"' \
+  '' '[model_providers."proxy.v1"]' 'name = "line one\\nline two"' '' '[mcp_servers.foreign]' 'command = "/bin/false"' 'args = []' \
+  >"$WORK/codex-foreign-source/config.toml"
+printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$WORK/codex-foreign-source/auth.json"
+chmod 0600 "$WORK/codex-foreign-source/auth.json"
+out="$(run_codex pass claude "$WORK/codex-foreign-source")"; rc=$?
+private_home_shape="$(python3 - "$WORK/state/codex_home_shape" "$WORK/codex-foreign-source" <<'PY_PRIVATE_HOME'
+import json, os, sys
+from pathlib import Path
+
+
+def normalized(value):
+    # TMPDIR here can carry a trailing separator, so the recorded and expected
+    # paths differ as strings while naming the same file.
+    return Path(os.path.normpath(str(value))) if value else None
+
+
+path = Path(sys.argv[1])
+if not path.exists():
+    print("no-run-observed"); raise SystemExit
+shape = json.loads(path.read_text(encoding="utf-8"))
+source = normalized(sys.argv[2])
+home = normalized(shape.get("home"))
+if home is None or home == source or source in home.parents:
+    print("shares-user-home"); raise SystemExit
+if shape.get("has_mcp_servers") is not False or shape.get("has_plugins") is not False:
+    print("inherited-servers-present"); raise SystemExit
+if shape.get("model") != "seeded-model" or shape.get("model_reasoning_effort") != "xhigh":
+    print("model-preference-lost"); raise SystemExit
+if shape.get("provider_keys") != ["proxy.v1"]:
+    print("provider-key-mangled"); raise SystemExit
+if normalized(shape.get("auth_link")) != source / "auth.json":
+    print("credential-not-linked"); raise SystemExit
+print("private")
+PY_PRIVATE_HOME
 )"
-  check "Codex encodes and disables the inherited MCP key ($inherited_mcp_case)" \
-    '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ] && [ "$inherited_mcp_disabled" = True ]'
+check "Codex reviews from a private home that never carried the user's MCP servers" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$private_home_shape" = private ]'
+
+# The link back to the user's credential is what keeps a rotated token in the
+# user's own file; a CLI that replaced it with a regular file would leave the
+# credential inside this run directory instead. Prove the post-run check fires.
+rm -f "$WORK/state/codex_invoked"
+# A host that names a profile it does not define must not quietly review on a
+# different model; the wrapper refuses instead of falling through.
+mkdir -p "$WORK/codex-broken-profile"
+printf '%s\n' 'profile = "missing"' 'model = "top-level-model"' >"$WORK/codex-broken-profile/config.toml"
+printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$WORK/codex-broken-profile/auth.json"
+chmod 0600 "$WORK/codex-broken-profile/auth.json"
+rm -f "$WORK/state/codex_invoked"
+out="$(run_codex pass claude "$WORK/codex-broken-profile")"; rc=$?
+check "Codex refuses a selected profile it cannot resolve instead of substituting a model" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_home_preferences_unreadable ] && [ ! -e "$WORK/state/codex_invoked" ]'
+
+# A malformed row that happens to be disabled must still fail the preflight;
+# filtering before validating would step over it.
+for malformed in missing empty nonstring; do
+  export STUB_MALFORMED_DISABLED_ROW="$malformed"
+  rm -f "$WORK/state/codex_invoked"
+  out="$(run_codex pass)"; rc=$?
+  unset STUB_MALFORMED_DISABLED_ROW
+  check "Codex refuses a malformed disabled MCP row ($malformed name)" \
+    '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_packet_tools_unavailable ] && [ ! -e "$WORK/state/codex_invoked" ]'
 done
 
+# The enabled-set check alone would accept one correctly bound row beside a
+# disabled duplicate of the same name, so the uniqueness claim needs its own case.
+export STUB_DUPLICATE_PACKET_ROW=1
+rm -f "$WORK/state/codex_invoked"
+out="$(run_codex pass)"; rc=$?
+unset STUB_DUPLICATE_PACKET_ROW
+check "Codex refuses a duplicated packet-server row even when the duplicate is disabled" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_packet_tools_unavailable ] && [ ! -e "$WORK/state/codex_invoked" ]'
+
+export STUB_REPLACE_AUTH_LINK=1
+out="$(run_codex pass claude "$WORK/codex-foreign-source")"; rc=$?
+unset STUB_REPLACE_AUTH_LINK
+check "Codex refuses when the run replaced the linked credential with a file" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_runtime_home_credential_moved ] && [ "$(field reason_code "$out")" = binding_mismatch ] && [ "$(field cascade_eligible "$out")" = False ]'
+
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
+out="$(run_codex pass)"; rc=$?
+packet_approval_mode="$(python3 - "$WORK/state/codex_configs" <<'PY_MCP_APPROVAL'
+import sys, tomllib
+from pathlib import Path
+
+path = Path(sys.argv[1])
+servers = {}
+for override in path.read_text().splitlines() if path.exists() else []:
+    key, value = override.split("=", 1)
+    if key.strip() == "mcp_servers":
+        servers = tomllib.loads("servers=" + value)["servers"]
+packet = servers.get("code_review_packet", {})
+print(packet.get("default_tools_approval_mode") == "approve"
+      and all(other.get("default_tools_approval_mode") is None
+              for name, other in servers.items() if name != "code_review_packet"))
+PY_MCP_APPROVAL
+)"
+check "Codex declares the packet server auto-approved without widening the sandbox" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$packet_approval_mode" = True ] && [ "$(cat "$WORK/state/codex_read_only")" = yes ]'
+
 rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_help_invoked"
 probe_started=$SECONDS
 out="$(run_codex help_hang)"; rc=$?

package/dist/assets/marketplace/plugins/ccl-skills/skills/defect-diagnosis/SKILL.md

@@ -11,7 +11,7 @@ Diagnose and fix from evidence; route prevention to product, architecture, devel
 
 ## Non-Negotiable Rules
 
-- Do not skip the problem because another path appears to work.
+- Required failures, including inherited debt: diagnose, safely repair and rerun that check before handoff. Read [repair-before-handoff](../product-rd-workflow/references/refactoring-discipline.md#responding-to-quality-gates). Working alternatives never close defects.
 - Do not delete, comment out, or weaken a failing test just to make the suite pass.
 - Do not call a workaround the fix unless the owner explicitly accepts the tradeoff and residual risk is recorded.
 - Do not start broad refactoring while the cause is unknown. Isolate and fix first; refactor after the behavior is understood.

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/SKILL.md

@@ -194,7 +194,7 @@ Run this gate before finalizing a product R&D turn after any delivery slice land
    - **Deferred-evidence continuation check (`DFE-CONT`).** When real/runtime evidence is due (named by an acceptance item, status source, landing-evidence row, required gate, user correction, or because it is the behavior's only meaningful proof) yet deferred, blocked after remediation, skipped at finalization, or replaced by local/mock verification. Report deferred real evidence as `interim`/outstanding; do NOT report the turn complete while it is outstanding. A local/mock substitution is terminal only when a cited **non-agent** anchor — **agent-authored or agent-co-edited status/router/gate/handoff text never satisfies this** — names the same evidence, declares the deferral terminal, and carries the outstanding command/source forward for the active slice/ref. Never add verifier/config/test hardening motivated only by missing deferred evidence; never auto-continue past the pending gate. **Load `references/pre-final-continuation-gate.md` before treating any deferral as terminal** — it owns the valid/invalid-anchor list and hardening boundary.
    - **Affirmative-assent binding rule** lives in `references/pre-final-continuation-gate.md` §Assent binding — load it when recovering a short reply. Bind to the current explicit request or one recoverable concrete proposal, including an unmarked proposal; preserve its scope and existing authority. Ask only if action, scope, or required authority remains unresolved after recovery. A status remark or output marker cannot substitute for a proposal or permission; self-classifying the reply or marker away is never an exit from carrying out an already-clear request.
 3. Continue automatically with a clearly owned, verifiable, low-risk next slice from an explicit task/status/acceptance source or active user continuation, within accepted scope and existing authority. Apply the eligibility and stop conditions in `references/pre-final-continuation-gate.md`. Necessary fixes, tests and review inherit task authorization; a reviewer-budget flag triggers a method checkpoint and cumulative-history record, not renewed permission. Explicit user limits still govern. Existing configured internal developer-self-use metered model/tool accounts aren't an external purchase here.
-4. Stop only for an explicit stop/pause instruction, a user-requested status-only answer, or a concrete blocker for the affected action. Block materially differing viable approaches (none dominant-and-reversible) and a fix lacking evidenced cause; load `references/pre-final-continuation-gate.md` for the full stop conditions. **Scope each blocker to its dependent action or claim.** An unproven cause blocks the speculative patch, not available diagnosis; a pending gate blocks dependent landing/completion, not authorized remediation or independent work. Before ending, perform available in-scope diagnosis, owner discovery, remediation, live-handle monitoring or independent work. Quality-gate failures require diagnosis and available related behavior-preserving cleanup before escalation; preserve readability and compatibility, never game counters (`references/refactoring-discipline.md`). Never bypass the blocked gate, invent a pass, widen scope, or substitute unrelated hardening. Stop the task only at the user's stop/status-only instruction or when no safe authorized work remains. With one dominant reversible approach and no applicable stop condition, do not stop at a recommendation: deliver a tested reviewable draft.
+4. Stop only for an explicit stop/pause instruction, a user-requested status-only answer, a concrete blocker for the affected action, or no safe authorized work remains. Block materially differing viable approaches (none dominant-and-reversible) and a fix lacking evidenced cause; load `references/pre-final-continuation-gate.md` for the full stop conditions. **Scope each blocker to its dependent action or claim.** An unproven cause blocks the speculative patch, not available diagnosis; a pending gate blocks dependent landing/completion, not authorized remediation or independent work. Before ending, perform in-scope diagnosis, owner discovery, remediation or independent work, and poll any finite step you started to its result, never reporting it as running. Quality-gate failures require diagnosis and available related behavior-preserving cleanup before escalation; preserve readability and compatibility, never game counters (`references/refactoring-discipline.md`). Never bypass the blocked gate, invent a pass, widen scope, or substitute unrelated hardening. With one dominant reversible approach and no applicable stop condition, do not stop at a recommendation: deliver a tested reviewable draft.
 5. If stopping, state the concrete stop reason and the exact evidence checked; an assent-triggered `blocked:` outcome uses the action/scope-plus-blocker form and classifies the turn `interim`. Ask one concise in-turn question when ambiguity or missing authority blocks; explicit stop/pause needs no reconfirmation. A `continuing:` outcome proceeds with the named slice before finalizing. A silent/completion stop is invalid. Do not send a completion-only, solved, fixed, or fully-closed final response after a merge/sync while a required review/challenge is pending or inconclusive; report interim or blocked with the next unblock step.
 6. **Assent-outcome closeout check.** Every user reply immediately following an assistant message that states or implies a next action requires a visible `continuing:` or `blocked:` outcome before finalizing, even if the reply is not classified as assent; every explicit continuation request does too. Missing markers never waive it. Reconcile the current request, original proposal, scope/authority changes, tool/output evidence, and remaining blockers. Respect a current explicit stop or status-only request; name that reason in the blocked outcome without executing the prior proposal. Otherwise `continuing:` must be followed by execution in the same turn; a promised next step is not execution. If part remains blocked, report its pending state and independent work performed. A status-only handoff cannot discharge an unexecuted accepted action. Repair marker formatting; for short assent, if the original proposal cannot be recovered verbatim, select `blocked:` and ask. Formatting never requires clarification. Do not silently drop an accepted action or claim a pending gate passed.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/pre-final-continuation-gate.md

@@ -99,14 +99,17 @@ Use the active owner's entry and safety gates for the recovered action. An autho
 
 An eligible next slice comes from an explicit status/task/acceptance source or active user continuation, is low-risk, local-only/already-authenticated, in accepted scope, clearly owned and verifiable with existing commands. It needs no destructive action, external purchase/financial commitment, production access, legal/compliance/product-strategy decision or high-impact architecture choice. Existing configured internal developer-self-use metered model/tool accounts are not an external purchase. Apply the following conditions to each action.
 
-Action-scoped stop conditions are: an explicit stop/pause instruction; a user-requested status-only answer; a failed, pending or inconclusive required gate; a dirty/conflicting worktree that cannot be isolated; a required environment unavailable after remediation; a high-impact product, architecture or compliance decision; a destructive action; an external purchase or financial commitment; unclear ownership; ambiguous assent; missing stricter authorization; materially different viable approaches with none dominant and reversible; a speculative fix without evidenced cause; or no low-risk slice. Apply each condition to the affected action, then check for available authorized diagnosis or remediation before stopping the whole task.
+Action-scoped stop conditions are: an explicit stop/pause instruction; a user-requested status-only answer; a failed, pending or inconclusive required gate; a dirty/conflicting worktree that cannot be isolated; a required environment unavailable after remediation; a high-impact product, architecture or compliance decision; a destructive action; an external purchase or financial commitment; unclear ownership; ambiguous assent; missing stricter authorization; materially different viable approaches with none dominant and reversible; a speculative fix without evidenced cause; or no low-risk slice. Apply each condition to the affected action. For a failed check, perform available authorized diagnosis and remediation before stopping the whole task: cite the failure output, repair attempts (or evidence that repair is unsafe or outside authority), and residual blocker. A failed verdict alone does not block diagnosis.
+
+**Awaiting work you started yourself is not a stop condition.** A finite command, suite, gate, or review you launched, whose result only you consume, is in-flight work rather than a handoff: wait for it and continue in the same turn. A process meant to stay up — a dev server, a watch-mode runner, a tail — has no terminal result to wait for: take its readiness signal and proceed. Never poll it forever, and do not infer anything about its lifetime from this rule; whether it keeps running is the delivery's decision, and a service the user asked for is a deliverable, not a leftover. Ending the turn to report that it is running is a premature stop even when the report is accurate — the user gains nothing they can act on, and the next step was already authorized. Host behavior invites this: a backgrounded step returns control immediately, so the pause *looks* like a turn boundary. It is not one. Before ending any turn, name the next action; if you can perform it now, the turn is not over. The turn ends at the first action that genuinely needs the user — an unresolved decision, missing authority, an explicit stop — not at the nearest convenient pause. A user asking why you stopped is this defect's recurrence signal, not a request for a status update.
 
 Check continuation on every user reply immediately following assistant prose that states or implies a next action, and on any explicit continuation request, regardless of landing status. Do not first require classifying the reply as assent; visibly report the continuing or blocked outcome even when the reply changes scope or stops the proposed action. Short replies include `ok`, `yes`, `可以`, `好`, `继续`, `proceed`, `do it`, `go ahead`, and `👍`; interpret them against the recovered action rather than formatting alone.
 
 - Select `continuing: <action and scope>` when that action is clear and authorized, then execute it in the same turn. A tool call and its result or a produced artifact establish execution; the label alone does not.
 - A blocked patch, review, or landing does not block every action. Keep that dependent action/claim pending while continuing available diagnosis, bounded remediation, monitoring of the existing live handle, or independent accepted work. These paths retain their own scope and permission checks; they cannot bypass the blocked gate or substitute unrelated hardening for missing evidence.
-- A failed quality gate calls for a repair that preserves its purpose. Before asking the user to choose a workaround, inspect and perform a safe structural cleanup related to the current change when available, then rerun the gate and affected tests. Follow [refactoring discipline](refactoring-discipline.md#responding-to-quality-gates): preserve behavior, compatibility and readability; do not shrink identifiers or necessary comments, weaken a baseline or rewrite history solely to make the counter pass. If no safe in-scope repair remains, report the evidence and the actual decision needed.
+- A failed quality gate calls for a repair that preserves its purpose. Before asking the user to choose a workaround, inspect and perform a safe structural cleanup necessary for the authorized delivery when available, including baseline failures that block it, then rerun the gate and affected tests. Follow [refactoring discipline](refactoring-discipline.md#responding-to-quality-gates): preserve behavior, compatibility and readability; do not shrink identifiers or necessary comments, weaken a baseline or rewrite history solely to make the counter pass. If no safe in-scope repair remains, report the evidence and the actual decision needed.
 - Independent work must neither depend on the pending verdict nor modify the candidate being evaluated. Name the pending gate and the independence basis when continuing. A candidate-changing fix is remediation, not independent work: let the existing run reach a terminal state, then refresh affected evidence and re-enter the owning gate. The deferred-evidence hardening prohibition still applies.
+- A self-initiated step still running is `continuing:`, never `blocked:` and never a final response. Poll it to a terminal result, act on that result, and only then re-enter this gate. A step whose terminal result cannot be obtained after the normal remediation — it hangs, or its handle is lost — is the ordinary unavailable-environment case and blocks that dependent action, with the failure and the remediation attempted cited.
 - Select `blocked: <action and scope> — <specific blocker>` when the remaining action needs an unresolved decision/authority or no safe authorized work remains after remediation. Cite the actual evidence; ask only for the missing decision or permission. An explicit stop/pause or status-only request blocks executing the prior proposal: name that reason in the outcome, answer the requested status, and do not reconfirm the stop.
 - Apply landing-state proof to landing claims and derivation of post-landing work. For an authorized local investigation with no landed slice, record that landing checks do not apply and perform the investigation.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/refactoring-discipline.md

@@ -15,7 +15,8 @@ Use this when improving code structure, splitting responsibilities, reducing dup
 
 - Read the failed check, its baseline and its intended quality property before choosing a repair. A file-size or complexity limit should prompt inspection of the changed responsibility, cohesion, callers and dependency direction. Extract a coherent responsibility or remove genuine duplication when that improves the code; keep public imports compatible where needed and verify affected behavior before and after. A smaller file alone does not prove a better design.
 - Do not abbreviate meaningful names, remove necessary explanations, pack statements, fragment responsibilities arbitrarily, or change the threshold/history just to satisfy a counter. A gate with an evidenced defect can be diagnosed and corrected under its owning contract; that is distinct from evading a valid failure.
-- Perform available, in-scope remediation and rerun the failed check before handing the problem back. Ask only for a remaining material tradeoff or missing authority after this work. Force-pushing, waiving the gate and accepting lower readability are not substitutes for inspecting a safe structural repair; a failed gate grants none of those permissions.
+- Treat a required-check failure that blocks this delivery as work to resolve, including a failure inherited from its baseline. Confirm the failure and its scope, perform the smallest safe repair that preserves the check's purpose, then rerun the original check and affected tests and refresh required review. A baseline comparison establishes attribution; it does not by itself make a delivery blocker unrelated. Optional findings that do not block the task stay separate.
+- Before asking for an exception or returning a blocked status, finish available authorized diagnosis, repair and validation. Ask only about the remaining material tradeoff, missing authority or evidence unavailable after bounded remediation, and state the attempts and blocker. A material tradeoff names conflicting task requirements or a change in behavior, compatibility, risk or cost beyond the agreed scope; extra files or inherited origin alone do not qualify. If repair requires broader redesign, breaking behavior or an unauthorized shared/irreversible action, pause that action and continue independent authorized work. Explicit stop, status-only and scope limits prevail. Force-pushing, waiving the gate and accepting lower readability are not repair substitutes; a failed gate grants none of those permissions.
 
 ## Impact Analysis
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/release-coordination/SKILL.md

@@ -40,7 +40,7 @@ This skill coordinates gates; it does **not** itself authorize merge, tag push,
 3. **Test-scope prompt** — emit test-scope handoff from confirmed diff; route full design to `testing-strategy`.
 4. **Release-doc gate** — invoke `release-doc-writer` to write confirmed scope/evidence depth before MR/merge authorization.
 5. **MR/PR gate** — duplicate check; read back URL, source/target, head SHA, CI, mergeability, discussions, auto-merge, and the remove-source-branch flag (the flag may stay set only if the cleanup row's source-eligibility conditions — temp branch created for this delivery, no other open or plan-declared consumer — still hold at merge time; otherwise read the flag back OFF before merging — asking may resolve classification, never waive this invariant).
-6. **Merge gate** — re-read immediately; single-form authorization names current object + head SHA, stale state means ask again; batch-form ("批量合并 N") authorization is scoped to the presented release plan — in-plan commits/MRs the agent itself creates while executing the plan stay authorized, out-of-plan objects and third-party changes still require asking again (canonical: `references/mr-merge-authorization.md` + `worktree-isolation` 合并执行协议).
+6. **Merge gate** — re-read immediately. A user-requested release includes its necessary in-scope merges; repairs/new PRs refresh validation, not permission. Single-object and explicit counted-batch directives keep their limits. Resolve foreign/out-of-scope changes before acting (canonical: `references/mr-merge-authorization.md` + `worktree-isolation` 合并执行协议).
 7. **Tag/pipeline gate** — verify tag absence/target; after push read back remote tag and pipeline/job behavior.
 8. **Rollout/config handoff** — live mutation goes to `platform-release-engineering`; this skill tracks evidence.
 9. **Watchers** — bounded read-only watchers; stop on terminal/manual/timeout and reconcile.
@@ -53,15 +53,15 @@ This skill coordinates gates; it does **not** itself authorize merge, tag push,
 | --- | --- | --- |
 | Create/update release document | No, if requested | Target section and comment-safe edit plan |
 | Create/update MR/PR | Usually no, if requested | Confirmed release scope, source/target, duplicate-check result |
-| Merge MR/PR | Yes | Current MR/PR, head SHA, CI/mergeability, discussions, auto-merge flag |
-| Create/push production tag | Yes if prod-triggering | Tag name, absence, target commit, expected pipeline behavior |
-| Play manual production job | Yes | Specific job id/name, pipeline, status, intended effect |
+| Merge MR/PR | Covered by the requested release goal; otherwise needs merge authority | Current MR/PR, head SHA, CI/mergeability, discussions, auto-merge flag |
+| Create/push production tag | Covered when necessary for the requested release | Tag name, absence, target commit, expected pipeline behavior |
+| Play manual production job | Covered only for the established requested release flow and caller's resource authority | Specific job id/name, pipeline, status, intended effect |
 | Modify production config/resource | Yes | Release-doc decision, read-only current state, planned delta |
 | Restart/rollout production workload | Yes | Affected workload, reason, expected state and rollback path |
 | Reset dev/test-like branches | Yes | Target/env refs, before SHAs, dry-run/plan, force-with-lease semantics |
 | Post-merge cleanup of the merged temp feature branch (worktree/local/remote) | No — covered by the user's merge authorization (`worktree-isolation` 收尾) | The authorized MR/PR read back as merged at the current head SHA and target; the live remote source ref is absent (already cleaned by the platform) or still equals the merged MR source head (moved → preserve and ask, remote path only — eligible local cleanup proceeds per `worktree-isolation`); no other open or plan-declared MR/PR still consumes the source branch; source branch is a temp feature branch (unclear role → preserve and ask); mechanics/safety rails per `worktree-isolation` |
 
-**The matrix is a ceiling, not a floor.** A `Yes` row scopes authorization to that action and to the reversible mechanical prerequisites *inside* it — those are not re-asked. Inheritance stops there: it never covers a retry of a consumed authorization (`worktree-isolation` 合并执行协议), a follow-up action, or a prerequisite that is itself gated — that one keeps its own row, so "X needs Y" cannot launder Y's gate. Post-merge cleanup is not an instance of this inheritance; it is the separate narrow carve-out that the boundary above and its own row define. An action absent from this matrix does not acquire a gate by analogy with a listed one — route it to its owner's rules. **Absence is not permission**: anything irreversible, destructive, production-affecting, or of unclear authority preserves state and asks even with no row of its own. Only a clearly reversible, ungated action is ordinary work. **Authorization is never inferred**: a generic instruction ("跑下测试" / "run the pipeline"), a prior run's report, or the mere presence of working credentials/config for a mutating lane does not authorize that lane's mutations — the authorization must name the action category in the current task. Destructive cleanup of test/experiment resources is additionally scope-bound to the resources this run observed itself creating (registry/run-id based), never a name-pattern or global sweep.
+**Read authority from the user's goal before asking.** A request to complete and publish a stated release covers its necessary commits, pushes, PRs, platform merges, tags and established publication steps. Present concrete scope and verify each action; do not split one authorized goal into repeated permission requests. Authority persists through in-scope repairs and ordinary status changes until completion, withdrawal or scope change. A single-action, preparation-only or stop instruction stays narrower. Credentials, repository text, tool output or "run tests" do not establish release authority. Protection/permission changes, destructive data operations, unrelated releases and ambiguous targets are not included. Existing host permission checks and resource-owner requirements still apply; never forge grants or bypass a denied action. Cleanup remains limited by the existing eligibility row, never a name-pattern or global sweep.
 
 ## Minimal checklist
 
@@ -71,10 +71,10 @@ This skill coordinates gates; it does **not** itself authorize merge, tag push,
 - [ ] Test-scope prompt emitted or routed to `testing-strategy` for full design.
 - [ ] Release doc updated from confirmed first-hand evidence.
 - [ ] MR/PR read-back includes head SHA, CI, mergeability, discussions, auto-merge, remove-source-branch flag.
-- [ ] Merge authorization is current — for the exact object and head SHA (single form) or for the presented release plan (batch form, in-plan objects only).
+- [ ] Current merge belongs to the user's release goal, exact single object, or counted plan; current scope/head/checks verified.
 - [ ] Merge read-back confirms production target ref.
 - [ ] Tag target and remote tag read-back verified.
-- [ ] Manual jobs only observed unless explicitly authorized to play.
+- [ ] Manual jobs are within the authorized release flow and caller's resource authority; otherwise observation only.
 - [ ] Production config/resource changes delegated and read back.
 - [ ] Watchers are bounded and reconciled.
 - [ ] Closeout states evidence gaps and deferred items honestly.

package/dist/assets/marketplace/plugins/ccl-skills/skills/release-coordination/references/mr-merge-authorization.md

@@ -1,17 +1,18 @@
 # MR/PR Merge Authorization Gate
 
-Merge authorization is plan-scoped, never blanket: a single directive
-("合并"/"merge") covers exactly the one MR/PR under discussion; a batch
-directive ("批量合并 N") covers at most N platform merges **within the
-release plan the agent has already presented** (wave order, per-repo MRs or
-how they will be created) — anything outside that plan needs fresh
-authorization. Batch is the right form for dependency-chain releases
-(core package → release → dependents bump → merge → tag) where dependent
-MRs do not exist yet at authorization time; semantics and the mechanical
-valve are canonical in `worktree-isolation` 「合并执行协议」.
+Authorization is scoped to the user's stated goal. "Complete and merge" or
+"publish this release" already covers the necessary in-scope platform merges,
+including PRs created later to deliver that goal. Present the concrete refs,
+scope and sequence as they become known; this is execution evidence, not a
+new permission request. It does not authorize unrelated releases, protection
+changes or destructive data operations. Preparation-only and stop instructions
+prevail. A single "merge" covers the one MR/PR under discussion; an explicit
+"批量合并 N" remains limited to N merges in the presented plan.
+Execution and host-grant limits are canonical in `worktree-isolation`
+「合并执行协议」.
 
 Before asking for or acting on authorization, read back the current MR/PR
-(single form), or present the release plan (batch form):
+(single form), or present the concrete delivery sequence (goal/batch form):
 
 - URL / number.
 - Source and target refs.
@@ -23,8 +24,8 @@ Before asking for or acting on authorization, read back the current MR/PR
 
 Rules:
 
-- If head SHA changed after the last user-facing confirmation, authorization is stale. (Batch form: commits/MRs the agent itself creates while executing the presented plan are inside the authorization; third-party or out-of-plan changes still require re-presenting.)
-- If CI, mergeability, target branch head, or auto-merge state changed materially, re-present the object before merging.
+- For goal/batch authorization, in-scope repairs or newly created PRs require renewed validation and review, not renewed permission. For single-object authorization, a changed head requires confirmation. Third-party or out-of-scope changes require a scope decision.
+- Re-read changed CI, mergeability, target head or auto-merge state and resolve failed gates before merging; ordinary checks finishing do not revoke goal authorization.
 - Do not enable auto-merge, merge queue, or merge-when-pipeline-succeeds unless the user explicitly authorizes that behavior for the current object.
 - Prefer platform/CLI/API options that guard the expected source head SHA. If unavailable, fetch and verify immediately before action, then report the residual race.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md

@@ -656,3 +656,11 @@ The pending classification above is superseded by the executed source comparison
 | A complete checkpoint may bind source-refuted findings without rewriting external receipts or refreshing review authority | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/review_gate.py; bank-evidence: file:specs/continuation-control/routing-evidence.md#The code-review routing comparison must preserve | updated | Owner key `code-review/SKILL.md`. `code-review/scripts/test_review_client_compat.py` exercises `CompletionFindingDispositionTest`: the former passed-only predicate rejected complete same-candidate refutation evidence; the current 17 focused tests pass. Original ordered receipt hashes, canonical occurrence coverage, disposition evidence and candidate bindings remain checked; omitted or altered evidence, duplicate dispositions and unresolved findings are rejected. Validation establishes binding and coverage, not the truth of source reasoning. |
 | Extraction reviewer limits bound each receipt sequence; source disposition, method changes and complete cumulative history govern necessary continuation under existing task authority | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. The warning-family source check failed against the former mandatory-human-warning clause. Seven applied warning and delegation mutations failed their owning assertions with unchanged and restored controls passing; the current implementation-gate suite passes. `skill-extraction-workflow/references/dual-track-review-gate.md` preserves per-sequence bounds, source findings, cumulative spending and genuine decision boundaries. The new owner rows also repair a reproduced impact-chain failure for missing owner evidence; they do not turn source checks into runtime or external-review passes. |
 | Writing decisions use reader benefit, ordering meaning, topic expectation and copy context while preserving valid state-focused prose | `tighten-doc` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/tighten-doc/SKILL.md#首句须准确预告本段内容，叙事或推导可按阅读目的组织 | updated | Owner key `tighten-doc/SKILL.md`. consolidation: merged into FORM, sentence-level rules and WORKFLOW 3. In a constructed fresh-context application pair, the unchanged rules retained a misleading preservation-method opener over collection locations and left a required placeholder reminder outside copied code. The candidate corrected the topic and carried the reminder inside valid Python; acronym, ordering, parameter and unknown-actor cases remained passing controls. The comparison used the same input with tools disabled; code outputs were checked. These observations establish bounded application behavior, not general delivery gains. Existing names, KEEP, comment protection, material conditions, execution-card order and code-correctness ownership remain. The reader handbook mirrors the conditional summaries; the required reference provides examples and JSON syntax boundaries. |
+| Required failures inherited from a baseline remain part of an authorized repair task | `defect-diagnosis` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/defect-diagnosis/SKILL.md#Required failures, including inherited debt | updated | Owner key `defect-diagnosis/SKILL.md`. The entry now requires diagnosis, safe repair and rerunning the original check, with a mandatory handoff reference. A synthetic deletion of the new entry makes its named retention assertion fail in the shared implementation-retention fixture; the unchanged control passes. Advisory cases F35-F38 in `eval/behavior-fixtures.jsonl` distinguish inherited blockers, unsafe repair, status-only and diagnosis scope. These checks establish text retention and reviewable scenarios, not a measured increase in autonomous delivery. |
+| Delivery blockers require bounded repair evidence before an exception or blocked handoff | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/refactoring-discipline.md#Treat a required-check failure that blocks this delivery as work to resolve | updated | Owner key `product-rd-workflow/SKILL.md`. The quality-gate response and `skills/product-rd-workflow/references/pre-final-continuation-gate.md` preserve the check purpose, require repair attempts or evidence of an unsafe or unauthorized repair, and leave optional findings separate. Deleting each added retention predicate makes its own assertion fail in the shared implementation-retention fixture; controls pass. Earlier explicit-context task replay already chose repair, so the change makes the inherited-blocker and handoff rules explicit without claiming a demonstrated task-level improvement. |
+| Retention checks must include every input surface when executed from an isolated fixture | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_controlled_escalation_pins.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. New repair and goal-authorization assertions in `skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh` read the root contract and release documents. The prior isolated copy omitted those inputs and failed its clean control; copying them restores the 52-mutation controlled-escalation walk. Eleven new repair and authorization predicates also fail under individual deletion, with passing controls. Goal-authorized delivery remains bounded by the requested target, caller authority, explicit stop or narrow scope, and actual host enforcement. Advisory cases F39-F40 cover release continuation and unrelated protected actions; static pins do not implement a permission system or prove agent compliance. |
+| A packet-only reviewer runs from a private home that never carried the user's MCP servers, rather than disabling them by name | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | updated | Owner key `code-review/SKILL.md`. Two faults on codex-cli 0.153.4. Every frozen-packet tool call was refused before it ran: `approval_policy="never"` with a sandbox lacking full disk write access leaves no auto-approve branch, so the packet server now declares `default_tools_approval_mode="approve"` for itself while the sandbox and policy stay unchanged. Separately, the preflight disabled every other server by name; a plugin contributes its server outside `mcp_servers`, so that override builds a transportless entry the CLI rejects outright, while leaving it enabled failed an exactly-one-server count -- the lane could not run at all on such a host. Removing the enumeration made the lane usable and made foreign servers reachable: measured, the host's own `node_repl` ran its `js` tool to completion during a packet-only review, and a stub was auto-approved purely by declaring `readOnlyHint`, which the CLI trusts from the server itself. Global approval-mode defaults did not override that hint and disabling plugins would disable the reviewer's own registry, so the run now gets a private `CODEX_HOME`: linked credential, carried model preference, copied owner skills, nothing else. Two draft claims are withdrawn rather than edited away -- that the parser's after-the-fact audit contained a foreign call, and that a hostile diff was a demonstrated path to one (two attempts did not reproduce it). `origin/dev` is not the unsafe baseline: its per-name disable works for config-declared servers and fails only for plugin-contributed ones. RED-baseline: seven wrapper assertions fail against `origin/dev`'s wrapper and the private-home assertion fails against the mid-round one; all pass on the final candidate. |
+| Work the agent started itself and still awaits is not a stop condition: it polls that step to a terminal result and continues in the same turn | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#A self-initiated step still running is | updated | Owner key `product-rd-workflow/SKILL.md`. Observed twice in one session: after launching a test suite or gate whose result only it would consume, the agent ended the turn to report that the step was running; the user had to ask why it stopped, then named the stopping itself as the defect. The gate already said not to stop at a recommendation and to continue with an owned low-risk slice, so content was not the gap -- the stop-condition list simply did not name this shape, and the host returns control the moment a step is backgrounded, which makes the pause look like a turn boundary. Landed as a firing mechanism rather than a discipline reminder: the reference names awaiting a FINITE self-started step as a non-condition, requires naming the next action before any turn ends, and adds an outcome-contract line making a still-running self-initiated step `continuing:` rather than `blocked:` or a final response; the entrypoint carries the same clause so the rule fires without opening the reference. Independent review caught the first wording as an over-broad absolute -- a dev server or watch-mode runner has no terminal result, so the rule would have demanded indefinite polling; it now takes a readiness signal and says nothing about the process lifetime: a later challenge showed that shutting it down at closeout destroys a service that is itself the requested deliverable, so the clause stops prescribing what it does not own. RED-baseline (applied, differential): deleting each of the four clauses reds only its own assertion in the shared implementation-gates fixture (`test_ai_coding_implementation_gates.sh`) with no other assertion failing, and the unmutated control passes. |
+| The shared implementation-gates fixture pins the continuation gate's non-stop clauses, so a later edit cannot silently delete them | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. The sibling row for `product-rd-workflow` records the failure itself; this row records why the fix cannot regress silently. Four assertions were added to the fixture -- the reference's non-stop clause, its turn-end firing check, its outcome-contract line, and the entrypoint's own clause. The fourth was added after independent review observed that the outcome-contract line could be deleted with every assertion still green, which is the same false-green shape the pins exist to prevent. RED-baseline (applied, differential): deleting each protected sentence reds only its owning assertion, with every other assertion passing and the unmutated control clean, so a partial deletion is attributable rather than lost in an aggregate failure. The fixture was chosen over a new suite because it already owns cross-owner rule-retention pins; no new registration surface is introduced. |
+| The landing binder names the ordering cause at the failure point: evidence a round adds that stays inside the candidate is listed when nothing binds | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/review_ledger_binding.py | updated | Owner key `skill-extraction-workflow/SKILL.md`. Third occurrence of one class. The rule that bound evidence is committed before the review rounds already exists verbatim in the quickstart and already carries a register row marked observed twice in consecutive rounds; this round hit it again because the round was driven from the delivery and review owners and never opened that quickstart. Two prior landings answered the recurrence with more prose, so this one changes the mechanism instead: when nothing binds, the binder enumerates the added evidence that is NOT excluded -- the complement of the receipt exclusion it already computes -- and states that only added JSON carrying a candidate_sha256 is excluded, so committing a base attestation or excerpt after the rounds moves the candidate out from under their receipts. RED-baseline (applied): on this round's own failing candidate the pre-change binder reported only that nothing bound it, naming neither the file nor the ordering; the changed binder lists `landing-base.txt` and the round's markdown dispositions and states the ordering. The five binding suites pass unchanged. The diagnosis now reaches an agent at the moment it fails rather than requiring it to know which document to open. |
+| A harness whose RECORDS are the evidence — an evaluation or benchmark runner, a conformance suite feeding a comparison, an A/B or regression rig — can be corrupted by the data it produces in three ways that all read green: absence stored as a bare null cannot separate confirmed-absent from never-observed, planned units and retries sharing one counter let a retry move the denominator, and a later attempt overwrites an earlier failure. Its own record layer is a high-risk failure class of the same standing as the canonical list, and is built against these before the happy path | `testing-strategy` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: file:skills/testing-strategy/references/ci-fixtures-and-flake-control.md#Absence carries a coded reason beside the value | updated | `testing-strategy/SKILL.md` is the owner key and is unchanged this round: the entrypoint is over its size budget and the growth gate blocks it, so the rule lands in `testing-strategy/references/ci-fixtures-and-flake-control.md` and is reached as a failure class from the canonical high-risk list in `testing-strategy/references/scenario-testing.md`, an enumeration the entrypoint already tells readers to walk. RED baseline: a paired walk over real artifacts — a held-out harness that contributed nothing to deriving the rules fails all three rows, each defect named by exactly one row while the other two do not mention it, while the control harness passes two and partially satisfies the first, so the check discriminates rather than accepting whatever is put to it. `observed-failure` is `no` deliberately: no malfunction of an existing repository rule was recorded this round, and the delta is measured against the held-out artifact rather than against a regression this repository observed; `result-class` is `failure` because that held-out artifact does exhibit all three defects the rule names. Sources read this round: the health-interchange data-absent-reason code system, a monitoring query language's absent-vector operators, and the controlled-trial reporting guidance for the flow diagram and per-group denominators. Known limit, stated in the landed text itself: the assembled rule has no located prior name, and measurement system analysis is the adjacent established field covering instrument accuracy and repeatability rather than record integrity. |