@ccoalm/ccl-skills 0.15.4 → 0.15.5

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/staged-review-contract.md

@@ -16,6 +16,36 @@ The budget is a ceiling, not a quota: after a clean or fully source-refuted trac
 `autonomous_review_allowed=false`; release/high-risk still requires at least one
 challenge before this early close is eligible.
 
+## What `complete` closes, and what it does not
+
+`--mode complete` is the checkpoint for a chain whose findings were **shown to
+be wrong**. Every original occurrence must carry a `source_refuted`
+disposition; `unresolved`, `accepted_risk`, `accepted_tradeoff`, and
+`needs_human_decision` are refused, and that refusal is deliberate. The gate
+binds structure and provenance, never authority: it cannot tell a human
+acceptance from an agent that labelled its own findings accepted, so it does
+not let an acceptance close a machine checkpoint.
+
+**A chain whose findings are accepted, out of scope, or input defects is not
+stalled — it is simply not closed by this mode.** Such a round ends at its
+`findings` result with a recorded disposition per occurrence, and the round's
+own ledger carries the wider vocabulary. Do not read a refused `complete` as an
+unfinished review; read it as "no refutation was claimed". Reporting the round
+requires the dispositions, not a completion receipt.
+
+Two mechanics that cost time when they are discovered by experiment:
+
+- **`--stage` and `--risk-tag` must be passed to `complete`, not omitted.** The
+  binding predicate compares the prior rounds against the profile derived from
+  the arguments given here, so a risk-tagged chain checked without its tags
+  fails as an unbound candidate rather than as a mismatch.
+- **A round that edits `skills/code-review/scripts/**` cannot bind its own
+  earlier rounds.** `review_controller_sha256` covers every `.py` and `.sh`
+  there, so any further edit to the harness mid-round changes the controller
+  identity and both chain succession and `complete` refuse the earlier
+  receipts. Land every harness edit first, then run review and challenge back
+  to back with nothing changed in between.
+
 ## Plan and owner binding
 
 The plan is optional for `review` and `challenge` and required for `complete`.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/codex_review.sh

@@ -196,6 +196,142 @@ PROMPT_FILE="$RUN_ROOT/prompt.txt"
 SCHEMA_FILE="$RUN_ROOT/schema.json"
 RUN_WORKSPACE="$RUN_ROOT/workspace"
 mkdir -p "$RUN_WORKSPACE"
+# The reviewer runs from a private CODEX_HOME, not the user's. The user's home
+# carries MCP servers -- their own, plus any an installed plugin contributes --
+# and those servers run outside the CLI sandbox, so `--sandbox read-only` and
+# `--disable shell_tool` do not reach them. A tool call completes before
+# `audit_codex` can refuse the verdict, and a server auto-approves itself by
+# declaring `readOnlyHint`, which the CLI trusts, so a tool that executes
+# arbitrary code can be auto-approved while claiming to be read-only. Denying
+# them without naming them was measured and does not work
+# (`apps._default.default_tools_approval_mode` does not override the hint), and
+# naming them cannot work either: an override under `mcp_servers` for a
+# plugin-contributed server builds a transportless entry the CLI rejects
+# outright. So this run gets a home that never had them.
+#
+# Model preferences are carried across explicitly, because this lane is
+# contracted to review on the user's own default model and an empty home
+# silently substitutes the CLI default. That carry-over is an allowlist, and
+# deliberately not a denylist: a key this list has not heard of costs a
+# preference, while a key a denylist has not heard of would let an executable
+# server back in.
+RUNTIME_HOME="$RUN_ROOT/codex-home"
+mkdir -m 700 "$RUNTIME_HOME" \
+  || die_inconclusive runtime_home_unavailable local_tool_failure false
+AUTH_LINK_TARGET=""
+if [ -e "$SOURCE_HOME/auth.json" ]; then
+  # A link, not a copy: the CLI refreshes the credential in place, and the
+  # rotated token has to land in the user's own file. The link is re-checked
+  # after the run, because a replaced link means the credential was written
+  # into this run directory instead.
+  AUTH_LINK_TARGET="$SOURCE_HOME/auth.json"
+  ln -s "$AUTH_LINK_TARGET" "$RUNTIME_HOME/auth.json" \
+    || die_inconclusive runtime_home_auth_link_failed local_tool_failure false
+fi
+if [ -f "$SOURCE_HOME/config.toml" ]; then
+  python3 - "$SOURCE_HOME/config.toml" "$RUNTIME_HOME/config.toml" <<'PY_HOME_PREFERENCES' \
+    || die_inconclusive codex_home_preferences_unreadable capability_missing true
+import sys, tomllib
+from pathlib import Path
+
+# Model identity only, by KEY. `model_providers` is the exception worth naming:
+# its value is a subtree this list does not inspect, so the allowlist bounds
+# which keys travel, not everything that travels inside them. It is copied from
+# the host's own configuration into a run-scoped home, so it grants a provider
+# definition the host already had; narrowing it is a recorded follow-up.
+# Nothing here can introduce a tool, a server, a hook, or a skill.
+PREFERENCE_KEYS = (
+    "model",
+    "model_provider",
+    "model_providers",
+    "model_reasoning_effort",
+    "model_reasoning_summary",
+    "model_verbosity",
+    "service_tier",
+)
+try:
+    source = tomllib.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+except (OSError, UnicodeError, tomllib.TOMLDecodeError):
+    sys.exit(1)
+if not isinstance(source, dict):
+    sys.exit(1)
+
+
+ESCAPES = {"\\": "\\\\", '"': '\\"', "\b": "\\b", "\t": "\\t",
+           "\n": "\\n", "\f": "\\f", "\r": "\\r"}
+
+
+def render_string(value):
+    # A basic TOML string cannot carry a literal newline or control character,
+    # and a key is a string too: an unquoted `proxy.v1` would silently become a
+    # dotted path and rewrite the provider map this run is supposed to copy.
+    out = []
+    for character in value:
+        if character in ESCAPES:
+            out.append(ESCAPES[character])
+        elif ord(character) < 0x20 or ord(character) == 0x7F:
+            out.append("\\u%04X" % ord(character))
+        else:
+            out.append(character)
+    return '"' + "".join(out) + '"'
+
+
+def render(value):
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, (int, float)):
+        return repr(value)
+    if isinstance(value, str):
+        return render_string(value)
+    if isinstance(value, list):
+        return "[" + ", ".join(render(item) for item in value) + "]"
+    if isinstance(value, dict):
+        return "{" + ", ".join(
+            f"{render_string(key)} = {render(item)}" for key, item in value.items()
+        ) + "}"
+    raise TypeError(value)
+
+
+# A profile selects the model on many hosts, and the profile table itself is
+# not copied: it can carry approval, sandbox, or server settings this run must
+# not inherit. Resolve the selected profile's model identity into top-level
+# keys instead, so a profile-configured host keeps its own model rather than
+# silently falling back to the CLI default.
+resolved = {key: source[key] for key in PREFERENCE_KEYS if key in source}
+selected = source.get("profile")
+if selected is not None:
+    # A selected profile that cannot be resolved is refused, not skipped:
+    # falling through would run the review on a different model than the host
+    # explicitly asked for, which is the substitution this carry-over exists to
+    # prevent.
+    profiles = source.get("profiles")
+    profile = profiles.get(selected) if isinstance(profiles, dict) and isinstance(selected, str) else None
+    if not isinstance(selected, str) or not selected or not isinstance(profile, dict):
+        sys.exit(1)
+    for key in PREFERENCE_KEYS:
+        if key in profile:
+            resolved[key] = profile[key]
+lines = []
+try:
+    for key in PREFERENCE_KEYS:
+        if key in resolved:
+            lines.append(f"{render_string(key)} = {render(resolved[key])}")
+except TypeError:
+    sys.exit(1)
+Path(sys.argv[2]).write_text("".join(line + "\n" for line in lines), encoding="utf-8")
+PY_HOME_PREFERENCES
+  chmod 0600 "$RUNTIME_HOME/config.toml" 2>/dev/null || true
+fi
+if [ "$REVIEW_SKILL_COUNT" -gt 0 ]; then
+  # Copied, not linked: the CLI does not follow a symlinked skill directory,
+  # so a link here would silently cost the owner-skill binding.
+  mkdir -m 700 "$RUNTIME_HOME/skills" \
+    || die_inconclusive runtime_home_unavailable local_tool_failure false
+  for review_skill in "${REVIEW_SKILLS[@]}"; do
+    cp -R "$INSTALLED_SKILL_REGISTRY_ROOT/$review_skill" "$RUNTIME_HOME/skills/$review_skill" \
+      || die_inconclusive codex_installed_skill_unavailable capability_missing true
+  done
+fi
 MODEL=""
 PROVIDER="openai"
 FAMILY="openai"
@@ -261,34 +397,33 @@ import json, sys
 values = [sys.argv[2], "--packet", sys.argv[1], "--sha256", sys.argv[3], "--allow-search"]
 print('mcp_servers={code_review_packet={command=' + json.dumps(sys.executable)
       + ',args=[' + ','.join(json.dumps(value) for value in values)
-      + '],enabled=true,enabled_tools=["read_packet","search_packet"]}}')
+      + '],enabled=true,enabled_tools=["read_packet","search_packet"]'
+      + ',default_tools_approval_mode="approve"}}')
 PY_MCP_CONFIG
 )" || die_inconclusive packet_config_failed local_tool_failure false
-# TOML overrides merge server tables. Disable inherited servers for this run
-# without changing user configuration, then verify the effective public list.
+# Inherited MCP servers are data, not a boundary. Disabling them by name was
+# tried and cannot work: a plugin contributes its server outside `mcp_servers`,
+# so `mcp_servers.<name>={enabled=false}` builds a transportless entry and the
+# CLI refuses the whole configuration -- while leaving it enabled failed an
+# exactly-one-server count. Either branch dead-ended the lane before inference.
+# So this preflight verifies only that the frozen packet server is present and
+# bound to the exact interpreter, script, packet and digest this run created.
+#
+# Accepted residual, measured rather than assumed: other servers stay enabled
+# and CAN execute during a review. `audit_codex` refuses a verdict from any
+# stream containing a foreign mcp_tool_call, but it runs afterwards -- the call
+# has already completed, and a remote write or send cannot be undone by
+# rejecting the verdict. Auto-approval is not a defence either: a server opts
+# itself in by declaring `readOnlyHint` on a tool, which the CLI trusts, so a
+# tool that executes arbitrary code can be auto-approved while claiming to be
+# read-only. Two containment routes that name no server were measured and both
+# failed: a global `apps._default.default_tools_approval_mode` did not override
+# the hint, and `--disable plugins` would disable the reviewer's own installed
+# skill registry, which ships as a plugin. The owner accepted this residual for
+# this round; the route that would close it is a private CODEX_HOME seeded with
+# auth and the registry only, as the Kimi lane already does.
 CODEX_PACKET_CONFIG=(-c "$MCP_CONFIG" -c 'web_search="disabled"' -c 'approval_policy="never"')
-CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s 5s "$CODEX_BIN_PATH" mcp list --json "${CODEX_PACKET_CONFIG[@]}" >"$RUN_ROOT/mcp.json" 2>"$STDERR_FILE" \
-  || die_inconclusive codex_packet_tools_unavailable capability_missing true
-MCP_CONFIG="$(python3 - "$RUN_ROOT/mcp.json" "$MCP_CONFIG" <<'PY_MCP_OVERRIDES'
-import json, sys
-from pathlib import Path
-try:
-    rows = json.loads(Path(sys.argv[1]).read_text())
-    if not isinstance(rows, list):
-        raise ValueError()
-    disabled = []
-    for row in rows:
-        if not isinstance(row, dict) or not isinstance(row.get("name"), str) or not row["name"]:
-            raise ValueError()
-        if row["name"] != "code_review_packet":
-            disabled.append(json.dumps(row["name"]) + "={enabled=false}")
-    print(sys.argv[2][:-1] + "".join("," + entry for entry in disabled) + "}")
-except (OSError, ValueError, TypeError):
-    sys.exit(1)
-PY_MCP_OVERRIDES
-)" || die_inconclusive codex_packet_tools_unavailable capability_missing true
-CODEX_PACKET_CONFIG=(-c "$MCP_CONFIG" -c 'web_search="disabled"' -c 'approval_policy="never"')
-CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s 5s "$CODEX_BIN_PATH" mcp list --json "${CODEX_PACKET_CONFIG[@]}" >"$RUN_ROOT/mcp.json" 2>"$STDERR_FILE" \
+CODEX_HOME="$RUNTIME_HOME" timeout --kill-after=1s 5s "$CODEX_BIN_PATH" mcp list --json "${CODEX_PACKET_CONFIG[@]}" >"$RUN_ROOT/mcp.json" 2>"$STDERR_FILE" \
   || die_inconclusive codex_packet_tools_unavailable capability_missing true
 python3 - "$RUN_ROOT/mcp.json" "$PACKET_FILE" "$PACKET_SERVER" "$PACKET_SHA256" <<'PY_MCP_CHECK' \
   || die_inconclusive codex_packet_tools_unavailable capability_missing true
@@ -298,12 +433,30 @@ try:
     rows = json.loads(Path(sys.argv[1]).read_text())
     if not isinstance(rows, list):
         raise ValueError()
-    active = [row for row in rows if isinstance(row, dict) and row.get("enabled") is not False]
-    if len(active) != 1 or len(rows) != len([row for row in rows if isinstance(row, dict)]):
+    # Every row is validated before any filtering. Dropping the old enumeration
+    # also dropped its per-row name check, which let a malformed reply through
+    # whenever the malformed row happened to be disabled.
+    if any(
+        not isinstance(row, dict)
+        or not isinstance(row.get("name"), str)
+        or not row["name"]
+        for row in rows
+    ):
+        raise ValueError()
+    # Under the private home this is an invariant the run establishes, not a
+    # bet on the user's configuration: nothing else was ever there to enable.
+    # A second enabled server means the home leaked, so refuse.
+    # Two predicates, not one: exactly one row carries the packet name
+    # anywhere in the reply, and exactly one row is enabled at all. Checking
+    # only the enabled set would accept a correctly bound row beside a disabled
+    # duplicate of the same name.
+    named = [row for row in rows if row.get("name") == "code_review_packet"]
+    active = [row for row in rows if row.get("enabled") is not False]
+    if len(named) != 1 or len(active) != 1 or active[0] is not named[0]:
         raise ValueError()
     row = active[0]
     transport = row.get("transport", {})
-    if (row.get("name") != "code_review_packet" or row.get("enabled") is not True
+    if (row.get("enabled") is not True
         or transport.get("type") != "stdio" or transport.get("command") != sys.executable
         or transport.get("args") != [sys.argv[3], "--packet", sys.argv[2], "--sha256", sys.argv[4], "--allow-search"]
         or transport.get("env") or transport.get("env_vars") or transport.get("cwd")):
@@ -350,12 +503,17 @@ JSON
 fi
 
 run_started=$SECONDS
-CMUX_CODEX_HOOKS_DISABLED=1 CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s "${TIMEOUT}s" "$CODEX_BIN_PATH" exec --disable hooks --disable shell_tool --sandbox read-only --ephemeral --skip-git-repo-check \
+CMUX_CODEX_HOOKS_DISABLED=1 CODEX_HOME="$RUNTIME_HOME" timeout --kill-after=1s "${TIMEOUT}s" "$CODEX_BIN_PATH" exec --disable hooks --disable shell_tool --sandbox read-only --ephemeral --skip-git-repo-check \
   "${CODEX_PACKET_CONFIG[@]}" \
   --json --output-schema "$SCHEMA_FILE" --output-last-message "$RESULT_FILE" \
   -C "$RUN_WORKSPACE" - <"$PROMPT_FILE" >"$EVENTS" 2>"$STDERR_FILE"
 run_rc=$?
 run_elapsed=$((SECONDS - run_started))
+if [ -n "$AUTH_LINK_TARGET" ]; then
+  [ -L "$RUNTIME_HOME/auth.json" ] \
+    && [ "$(readlink "$RUNTIME_HOME/auth.json")" = "$AUTH_LINK_TARGET" ] \
+    || die_inconclusive codex_runtime_home_credential_moved binding_mismatch false
+fi
 if [ "$run_rc" != 0 ]; then
   if bash "$TIMEOUT_CLASSIFIER" "$run_rc" "$run_elapsed" "$TIMEOUT"; then
     die_inconclusive codex_timeout timeout true "$run_rc"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_cli_review_wrappers.sh

@@ -698,18 +698,31 @@ if [ "${1:-}" = mcp ] && [ "${2:-}" = list ]; then
   fi
   python3 - "$@" <<'PY_MCP_LIST'
 import json, os, sys, tomllib
+from pathlib import Path
 
 arguments = iter(sys.argv[1:])
 servers = {}
-inherited_names = {
-    "inherited_mcp": "unrelated",
-    "inherited_mcp_dot": "unrelated.name",
-    "inherited_mcp_space": "unrelated name",
-    "inherited_mcp_quote": 'unrelated"name',
-}
-inherited_name = inherited_names.get(os.environ.get("STUB_BEHAVIOR"))
-if inherited_name is not None:
-    servers[inherited_name] = {"command": "/bin/false", "args": [], "enabled": True}
+plugin_sourced = set()
+# Inherited servers come from the home the CLI was actually handed, never from
+# the test's own environment: whether the reviewer sees a user's server is
+# exactly the question, and a stub that injects one regardless of the home
+# could not tell a private home from the user's.
+home = Path(os.environ.get("CODEX_HOME", ""))
+home_config = home / "config.toml" if os.environ.get("CODEX_HOME") else None
+if home_config is not None and home_config.exists():
+    try:
+        home_data = tomllib.loads(home_config.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, tomllib.TOMLDecodeError):
+        home_data = {}
+    for inherited_name, inherited in (home_data.get("mcp_servers") or {}).items():
+        if isinstance(inherited, dict):
+            servers[inherited_name] = dict(inherited)
+            servers[inherited_name].setdefault("enabled", True)
+# A plugin contributes its server outside `mcp_servers`, which is why an
+# override under that table cannot reach it.
+if os.environ.get("CODEX_HOME") and (home / "plugins" / "provided.json").exists():
+    servers["plugin_provided"] = {"command": "/bin/false", "args": [], "enabled": True}
+    plugin_sourced.add("plugin_provided")
 for argument in arguments:
     if argument in {"-c", "--config"}:
         # Codex splits the override path separately from its TOML value;
@@ -724,18 +737,76 @@ for argument in arguments:
         else:
             continue
         for name, settings in configured_servers.items():
+            if name in plugin_sourced:
+                # A plugin contributes its server outside `mcp_servers`, so an
+                # override under that table builds an entry with no transport
+                # and the CLI refuses to load the configuration at all.
+                sys.stderr.write(
+                    "Error: failed to load bootstrap configuration\n\n"
+                    "Caused by:\n    invalid transport\n"
+                    "    in `mcp_servers." + name + "`\n")
+                sys.exit(1)
             servers.setdefault(name, {}).update(settings)
-print(json.dumps([
+rows = [
     {"name": name, "enabled": server.get("enabled", True),
      "transport": {"type": "stdio", "command": server["command"],
                    "args": server.get("args", [])}}
     for name, server in servers.items()
-]))
+]
+if os.environ.get("STUB_MALFORMED_DISABLED_ROW"):
+    # The malformed row is disabled: a check that filters before validating
+    # would never look at it.
+    bad = {"missing": {}, "empty": {"name": ""}, "nonstring": {"name": 7}}[
+        os.environ["STUB_MALFORMED_DISABLED_ROW"]]
+    rows.append({**bad, "enabled": False,
+                 "transport": {"type": "stdio", "command": "/bin/false", "args": []}})
+if os.environ.get("STUB_DUPLICATE_PACKET_ROW") == "1":
+    # A JSON array can carry the same name twice; a dict of servers cannot.
+    rows.append({"name": "code_review_packet", "enabled": False,
+                 "transport": {"type": "stdio", "command": "/bin/false", "args": []}})
+print(json.dumps(rows))
 PY_MCP_LIST
   exit $?
 fi
 touch "$state/codex_invoked"
 printf '%s' "$0" >"$state/codex_argv0"
+printf '%s' "${CODEX_HOME:-}" >"$state/codex_home"
+if [ "${STUB_REPLACE_AUTH_LINK:-}" = 1 ] && [ -n "${CODEX_HOME:-}" ]; then
+  rm -f "$CODEX_HOME/auth.json"
+  printf '%s\n' '{"tokens":{"access":"rotated"}}' >"$CODEX_HOME/auth.json"
+fi
+python3 - "${CODEX_HOME:-}" "$state/codex_home_shape" <<'PY_HOME_SHAPE'
+import json, os, sys, tomllib
+from pathlib import Path
+
+# The wrapper deletes its run directory on exit, so the private home can only
+# be inspected from inside the run.
+home = Path(sys.argv[1]) if sys.argv[1] else None
+shape = {"home": sys.argv[1], "config_keys": [], "has_mcp_servers": None,
+         "has_plugins": None, "auth_link": None}
+if home is not None:
+    config = home / "config.toml"
+    if config.exists():
+        try:
+            data = tomllib.loads(config.read_text(encoding="utf-8"))
+        except (OSError, UnicodeError, tomllib.TOMLDecodeError):
+            data = {"__unreadable__": True}
+        shape["config_keys"] = sorted(data)
+        shape["has_mcp_servers"] = "mcp_servers" in data
+        shape["model"] = data.get("model")
+        shape["model_reasoning_effort"] = data.get("model_reasoning_effort")
+        providers = data.get("model_providers")
+        shape["provider_keys"] = sorted(providers) if isinstance(providers, dict) else None
+    else:
+        shape["has_mcp_servers"] = False
+    shape["has_plugins"] = (home / "plugins").exists()
+    auth = home / "auth.json"
+    if auth.is_symlink():
+        shape["auth_link"] = os.readlink(auth)
+    elif auth.exists():
+        shape["auth_link"] = "__regular_file__"
+Path(sys.argv[2]).write_text(json.dumps(shape), encoding="utf-8")
+PY_HOME_SHAPE
 printf '%s' "${CMUX_CODEX_HOOKS_DISABLED:-}" >"$state/codex_cmux_hooks_disabled"
 last_message=""
 has_model=no
@@ -1802,16 +1873,29 @@ out="$(run_codex packet_tampered)"; rc=$?
 check "Codex rejects altered packet tool bytes through wrapper and parser" \
   '[ "$rc" = 2 ] && [ "$(field reason_code "$out")" = binding_mismatch ] && [ "$(field cascade_eligible "$out")" = False ]'
 
-for inherited_mcp_case in inherited_mcp inherited_mcp_dot inherited_mcp_space inherited_mcp_quote; do
-  case "$inherited_mcp_case" in
-    inherited_mcp) inherited_mcp_name=unrelated ;;
-    inherited_mcp_dot) inherited_mcp_name=unrelated.name ;;
-    inherited_mcp_space) inherited_mcp_name='unrelated name' ;;
-    inherited_mcp_quote) inherited_mcp_name='unrelated"name' ;;
-  esac
+# A user's own server, however its name is spelled, must not reach the reviewer
+# and must not be touched: the wrapper neither disables it nor names it.
+inherited_index=0
+for inherited_mcp_name in 'unrelated' 'unrelated.name' 'unrelated name' 'unrelated"name'; do
+  inherited_index=$((inherited_index + 1))
+  inherited_source="$WORK/codex-inherited-$inherited_index"
+  mkdir -p "$inherited_source"
+  python3 - "$inherited_source/config.toml" "$inherited_mcp_name" <<'PY_INHERITED_SOURCE'
+import json, sys
+from pathlib import Path
+
+Path(sys.argv[1]).write_text(
+    "[mcp_servers]\n"
+    + json.dumps(sys.argv[2])
+    + ' = { command = "/bin/false", args = [] }\n',
+    encoding="utf-8",
+)
+PY_INHERITED_SOURCE
+  printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$inherited_source/auth.json"
+  chmod 0600 "$inherited_source/auth.json"
   rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
-  out="$(run_codex "$inherited_mcp_case")"; rc=$?
-  inherited_mcp_disabled="$(python3 - "$inherited_mcp_name" "$WORK/state/codex_configs" <<'PY_MCP_DISABLED'
+  out="$(run_codex pass claude "$inherited_source")"; rc=$?
+  inherited_mcp_untouched="$(python3 - "$inherited_mcp_name" "$WORK/state/codex_configs" <<'PY_MCP_UNTOUCHED'
 import sys, tomllib
 from pathlib import Path
 
@@ -1821,15 +1905,140 @@ for override in path.read_text().splitlines() if path.exists() else []:
     key, value = override.split("=", 1)
     if key.strip() == "mcp_servers":
         tables.append(tomllib.loads("servers=" + value)["servers"])
+    elif key.strip().startswith("mcp_servers."):
+        tables.append({key.strip().split(".")[1]: {}})
 print(len(tables) == 1
-      and tables[0].get(sys.argv[1], {}).get("enabled") is False
-      and "code_review_packet" in tables[0])
-PY_MCP_DISABLED
+      and sys.argv[1] not in tables[0]
+      and list(tables[0]) == ["code_review_packet"])
+PY_MCP_UNTOUCHED
+)"
+  check "Codex never reaches or names the user's own MCP server ($inherited_mcp_name)" \
+    '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ] && [ "$inherited_mcp_untouched" = True ]'
+done
+
+# The shape that used to dead-end the preflight: a server contributed outside
+# `mcp_servers`, which no override under that table can reach.
+plugin_source="$WORK/codex-plugin-source"
+mkdir -p "$plugin_source/plugins"
+printf '%s\n' '{"server":"plugin_provided"}' >"$plugin_source/plugins/provided.json"
+printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$plugin_source/auth.json"
+chmod 0600 "$plugin_source/auth.json"
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
+out="$(run_codex pass claude "$plugin_source")"; rc=$?
+check "Codex reviews on a host whose plugin contributes an MCP server" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ]'
+
+# A canned verdict cannot prove the repair: a CLI that accepts the configuration
+# and still refuses read_packet would pass every assertion above. This one
+# replays the real packet server's bytes through the parser on that same host.
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_packet_call"
+out="$(run_codex packet_read claude "$plugin_source")"; rc=$?
+check "Codex completes a real frozen packet read on a plugin-contributing host" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$(cat "$WORK/state/codex_packet_call")" = read_packet ]'
+
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_home"
+mkdir -p "$WORK/codex-foreign-source"
+printf '%s\n' 'profile = "review"' '' '[profiles.review]' 'model = "seeded-model"' 'model_reasoning_effort = "xhigh"' \
+  '' '[model_providers."proxy.v1"]' 'name = "line one\\nline two"' '' '[mcp_servers.foreign]' 'command = "/bin/false"' 'args = []' \
+  >"$WORK/codex-foreign-source/config.toml"
+printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$WORK/codex-foreign-source/auth.json"
+chmod 0600 "$WORK/codex-foreign-source/auth.json"
+out="$(run_codex pass claude "$WORK/codex-foreign-source")"; rc=$?
+private_home_shape="$(python3 - "$WORK/state/codex_home_shape" "$WORK/codex-foreign-source" <<'PY_PRIVATE_HOME'
+import json, os, sys
+from pathlib import Path
+
+
+def normalized(value):
+    # TMPDIR here can carry a trailing separator, so the recorded and expected
+    # paths differ as strings while naming the same file.
+    return Path(os.path.normpath(str(value))) if value else None
+
+
+path = Path(sys.argv[1])
+if not path.exists():
+    print("no-run-observed"); raise SystemExit
+shape = json.loads(path.read_text(encoding="utf-8"))
+source = normalized(sys.argv[2])
+home = normalized(shape.get("home"))
+if home is None or home == source or source in home.parents:
+    print("shares-user-home"); raise SystemExit
+if shape.get("has_mcp_servers") is not False or shape.get("has_plugins") is not False:
+    print("inherited-servers-present"); raise SystemExit
+if shape.get("model") != "seeded-model" or shape.get("model_reasoning_effort") != "xhigh":
+    print("model-preference-lost"); raise SystemExit
+if shape.get("provider_keys") != ["proxy.v1"]:
+    print("provider-key-mangled"); raise SystemExit
+if normalized(shape.get("auth_link")) != source / "auth.json":
+    print("credential-not-linked"); raise SystemExit
+print("private")
+PY_PRIVATE_HOME
 )"
-  check "Codex encodes and disables the inherited MCP key ($inherited_mcp_case)" \
-    '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ] && [ "$inherited_mcp_disabled" = True ]'
+check "Codex reviews from a private home that never carried the user's MCP servers" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$private_home_shape" = private ]'
+
+# The link back to the user's credential is what keeps a rotated token in the
+# user's own file; a CLI that replaced it with a regular file would leave the
+# credential inside this run directory instead. Prove the post-run check fires.
+rm -f "$WORK/state/codex_invoked"
+# A host that names a profile it does not define must not quietly review on a
+# different model; the wrapper refuses instead of falling through.
+mkdir -p "$WORK/codex-broken-profile"
+printf '%s\n' 'profile = "missing"' 'model = "top-level-model"' >"$WORK/codex-broken-profile/config.toml"
+printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$WORK/codex-broken-profile/auth.json"
+chmod 0600 "$WORK/codex-broken-profile/auth.json"
+rm -f "$WORK/state/codex_invoked"
+out="$(run_codex pass claude "$WORK/codex-broken-profile")"; rc=$?
+check "Codex refuses a selected profile it cannot resolve instead of substituting a model" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_home_preferences_unreadable ] && [ ! -e "$WORK/state/codex_invoked" ]'
+
+# A malformed row that happens to be disabled must still fail the preflight;
+# filtering before validating would step over it.
+for malformed in missing empty nonstring; do
+  export STUB_MALFORMED_DISABLED_ROW="$malformed"
+  rm -f "$WORK/state/codex_invoked"
+  out="$(run_codex pass)"; rc=$?
+  unset STUB_MALFORMED_DISABLED_ROW
+  check "Codex refuses a malformed disabled MCP row ($malformed name)" \
+    '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_packet_tools_unavailable ] && [ ! -e "$WORK/state/codex_invoked" ]'
 done
 
+# The enabled-set check alone would accept one correctly bound row beside a
+# disabled duplicate of the same name, so the uniqueness claim needs its own case.
+export STUB_DUPLICATE_PACKET_ROW=1
+rm -f "$WORK/state/codex_invoked"
+out="$(run_codex pass)"; rc=$?
+unset STUB_DUPLICATE_PACKET_ROW
+check "Codex refuses a duplicated packet-server row even when the duplicate is disabled" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_packet_tools_unavailable ] && [ ! -e "$WORK/state/codex_invoked" ]'
+
+export STUB_REPLACE_AUTH_LINK=1
+out="$(run_codex pass claude "$WORK/codex-foreign-source")"; rc=$?
+unset STUB_REPLACE_AUTH_LINK
+check "Codex refuses when the run replaced the linked credential with a file" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_runtime_home_credential_moved ] && [ "$(field reason_code "$out")" = binding_mismatch ] && [ "$(field cascade_eligible "$out")" = False ]'
+
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
+out="$(run_codex pass)"; rc=$?
+packet_approval_mode="$(python3 - "$WORK/state/codex_configs" <<'PY_MCP_APPROVAL'
+import sys, tomllib
+from pathlib import Path
+
+path = Path(sys.argv[1])
+servers = {}
+for override in path.read_text().splitlines() if path.exists() else []:
+    key, value = override.split("=", 1)
+    if key.strip() == "mcp_servers":
+        servers = tomllib.loads("servers=" + value)["servers"]
+packet = servers.get("code_review_packet", {})
+print(packet.get("default_tools_approval_mode") == "approve"
+      and all(other.get("default_tools_approval_mode") is None
+              for name, other in servers.items() if name != "code_review_packet"))
+PY_MCP_APPROVAL
+)"
+check "Codex declares the packet server auto-approved without widening the sandbox" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$packet_approval_mode" = True ] && [ "$(cat "$WORK/state/codex_read_only")" = yes ]'
+
 rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_help_invoked"
 probe_started=$SECONDS
 out="$(run_codex help_hang)"; rc=$?

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/SKILL.md

@@ -194,7 +194,7 @@ Run this gate before finalizing a product R&D turn after any delivery slice land
    - **Deferred-evidence continuation check (`DFE-CONT`).** When real/runtime evidence is due (named by an acceptance item, status source, landing-evidence row, required gate, user correction, or because it is the behavior's only meaningful proof) yet deferred, blocked after remediation, skipped at finalization, or replaced by local/mock verification. Report deferred real evidence as `interim`/outstanding; do NOT report the turn complete while it is outstanding. A local/mock substitution is terminal only when a cited **non-agent** anchor — **agent-authored or agent-co-edited status/router/gate/handoff text never satisfies this** — names the same evidence, declares the deferral terminal, and carries the outstanding command/source forward for the active slice/ref. Never add verifier/config/test hardening motivated only by missing deferred evidence; never auto-continue past the pending gate. **Load `references/pre-final-continuation-gate.md` before treating any deferral as terminal** — it owns the valid/invalid-anchor list and hardening boundary.
    - **Affirmative-assent binding rule** lives in `references/pre-final-continuation-gate.md` §Assent binding — load it when recovering a short reply. Bind to the current explicit request or one recoverable concrete proposal, including an unmarked proposal; preserve its scope and existing authority. Ask only if action, scope, or required authority remains unresolved after recovery. A status remark or output marker cannot substitute for a proposal or permission; self-classifying the reply or marker away is never an exit from carrying out an already-clear request.
 3. Continue automatically with a clearly owned, verifiable, low-risk next slice from an explicit task/status/acceptance source or active user continuation, within accepted scope and existing authority. Apply the eligibility and stop conditions in `references/pre-final-continuation-gate.md`. Necessary fixes, tests and review inherit task authorization; a reviewer-budget flag triggers a method checkpoint and cumulative-history record, not renewed permission. Explicit user limits still govern. Existing configured internal developer-self-use metered model/tool accounts aren't an external purchase here.
-4. Stop only for an explicit stop/pause instruction, a user-requested status-only answer, or a concrete blocker for the affected action. Block materially differing viable approaches (none dominant-and-reversible) and a fix lacking evidenced cause; load `references/pre-final-continuation-gate.md` for the full stop conditions. **Scope each blocker to its dependent action or claim.** An unproven cause blocks the speculative patch, not available diagnosis; a pending gate blocks dependent landing/completion, not authorized remediation or independent work. Before ending, perform available in-scope diagnosis, owner discovery, remediation, live-handle monitoring or independent work. Quality-gate failures require diagnosis and available related behavior-preserving cleanup before escalation; preserve readability and compatibility, never game counters (`references/refactoring-discipline.md`). Never bypass the blocked gate, invent a pass, widen scope, or substitute unrelated hardening. Stop the task only at the user's stop/status-only instruction or when no safe authorized work remains. With one dominant reversible approach and no applicable stop condition, do not stop at a recommendation: deliver a tested reviewable draft.
+4. Stop only for an explicit stop/pause instruction, a user-requested status-only answer, a concrete blocker for the affected action, or no safe authorized work remains. Block materially differing viable approaches (none dominant-and-reversible) and a fix lacking evidenced cause; load `references/pre-final-continuation-gate.md` for the full stop conditions. **Scope each blocker to its dependent action or claim.** An unproven cause blocks the speculative patch, not available diagnosis; a pending gate blocks dependent landing/completion, not authorized remediation or independent work. Before ending, perform in-scope diagnosis, owner discovery, remediation or independent work, and poll any finite step you started to its result, never reporting it as running. Quality-gate failures require diagnosis and available related behavior-preserving cleanup before escalation; preserve readability and compatibility, never game counters (`references/refactoring-discipline.md`). Never bypass the blocked gate, invent a pass, widen scope, or substitute unrelated hardening. With one dominant reversible approach and no applicable stop condition, do not stop at a recommendation: deliver a tested reviewable draft.
 5. If stopping, state the concrete stop reason and the exact evidence checked; an assent-triggered `blocked:` outcome uses the action/scope-plus-blocker form and classifies the turn `interim`. Ask one concise in-turn question when ambiguity or missing authority blocks; explicit stop/pause needs no reconfirmation. A `continuing:` outcome proceeds with the named slice before finalizing. A silent/completion stop is invalid. Do not send a completion-only, solved, fixed, or fully-closed final response after a merge/sync while a required review/challenge is pending or inconclusive; report interim or blocked with the next unblock step.
 6. **Assent-outcome closeout check.** Every user reply immediately following an assistant message that states or implies a next action requires a visible `continuing:` or `blocked:` outcome before finalizing, even if the reply is not classified as assent; every explicit continuation request does too. Missing markers never waive it. Reconcile the current request, original proposal, scope/authority changes, tool/output evidence, and remaining blockers. Respect a current explicit stop or status-only request; name that reason in the blocked outcome without executing the prior proposal. Otherwise `continuing:` must be followed by execution in the same turn; a promised next step is not execution. If part remains blocked, report its pending state and independent work performed. A status-only handoff cannot discharge an unexecuted accepted action. Repair marker formatting; for short assent, if the original proposal cannot be recovered verbatim, select `blocked:` and ask. Formatting never requires clarification. Do not silently drop an accepted action or claim a pending gate passed.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/pre-final-continuation-gate.md

@@ -101,12 +101,15 @@ An eligible next slice comes from an explicit status/task/acceptance source or a
 
 Action-scoped stop conditions are: an explicit stop/pause instruction; a user-requested status-only answer; a failed, pending or inconclusive required gate; a dirty/conflicting worktree that cannot be isolated; a required environment unavailable after remediation; a high-impact product, architecture or compliance decision; a destructive action; an external purchase or financial commitment; unclear ownership; ambiguous assent; missing stricter authorization; materially different viable approaches with none dominant and reversible; a speculative fix without evidenced cause; or no low-risk slice. Apply each condition to the affected action. For a failed check, perform available authorized diagnosis and remediation before stopping the whole task: cite the failure output, repair attempts (or evidence that repair is unsafe or outside authority), and residual blocker. A failed verdict alone does not block diagnosis.
 
+**Awaiting work you started yourself is not a stop condition.** A finite command, suite, gate, or review you launched, whose result only you consume, is in-flight work rather than a handoff: wait for it and continue in the same turn. A process meant to stay up — a dev server, a watch-mode runner, a tail — has no terminal result to wait for: take its readiness signal and proceed. Never poll it forever, and do not infer anything about its lifetime from this rule; whether it keeps running is the delivery's decision, and a service the user asked for is a deliverable, not a leftover. Ending the turn to report that it is running is a premature stop even when the report is accurate — the user gains nothing they can act on, and the next step was already authorized. Host behavior invites this: a backgrounded step returns control immediately, so the pause *looks* like a turn boundary. It is not one. Before ending any turn, name the next action; if you can perform it now, the turn is not over. The turn ends at the first action that genuinely needs the user — an unresolved decision, missing authority, an explicit stop — not at the nearest convenient pause. A user asking why you stopped is this defect's recurrence signal, not a request for a status update.
+
 Check continuation on every user reply immediately following assistant prose that states or implies a next action, and on any explicit continuation request, regardless of landing status. Do not first require classifying the reply as assent; visibly report the continuing or blocked outcome even when the reply changes scope or stops the proposed action. Short replies include `ok`, `yes`, `可以`, `好`, `继续`, `proceed`, `do it`, `go ahead`, and `👍`; interpret them against the recovered action rather than formatting alone.
 
 - Select `continuing: <action and scope>` when that action is clear and authorized, then execute it in the same turn. A tool call and its result or a produced artifact establish execution; the label alone does not.
 - A blocked patch, review, or landing does not block every action. Keep that dependent action/claim pending while continuing available diagnosis, bounded remediation, monitoring of the existing live handle, or independent accepted work. These paths retain their own scope and permission checks; they cannot bypass the blocked gate or substitute unrelated hardening for missing evidence.
 - A failed quality gate calls for a repair that preserves its purpose. Before asking the user to choose a workaround, inspect and perform a safe structural cleanup necessary for the authorized delivery when available, including baseline failures that block it, then rerun the gate and affected tests. Follow [refactoring discipline](refactoring-discipline.md#responding-to-quality-gates): preserve behavior, compatibility and readability; do not shrink identifiers or necessary comments, weaken a baseline or rewrite history solely to make the counter pass. If no safe in-scope repair remains, report the evidence and the actual decision needed.
 - Independent work must neither depend on the pending verdict nor modify the candidate being evaluated. Name the pending gate and the independence basis when continuing. A candidate-changing fix is remediation, not independent work: let the existing run reach a terminal state, then refresh affected evidence and re-enter the owning gate. The deferred-evidence hardening prohibition still applies.
+- A self-initiated step still running is `continuing:`, never `blocked:` and never a final response. Poll it to a terminal result, act on that result, and only then re-enter this gate. A step whose terminal result cannot be obtained after the normal remediation — it hangs, or its handle is lost — is the ordinary unavailable-environment case and blocks that dependent action, with the failure and the remediation attempted cited.
 - Select `blocked: <action and scope> — <specific blocker>` when the remaining action needs an unresolved decision/authority or no safe authorized work remains after remediation. Cite the actual evidence; ask only for the missing decision or permission. An explicit stop/pause or status-only request blocks executing the prior proposal: name that reason in the outcome, answer the requested status, and do not reconfirm the stop.
 - Apply landing-state proof to landing claims and derivation of post-landing work. For an authorized local investigation with no landed slice, record that landing checks do not apply and perform the investigation.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md

@@ -659,3 +659,8 @@ The pending classification above is superseded by the executed source comparison
 | Required failures inherited from a baseline remain part of an authorized repair task | `defect-diagnosis` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/defect-diagnosis/SKILL.md#Required failures, including inherited debt | updated | Owner key `defect-diagnosis/SKILL.md`. The entry now requires diagnosis, safe repair and rerunning the original check, with a mandatory handoff reference. A synthetic deletion of the new entry makes its named retention assertion fail in the shared implementation-retention fixture; the unchanged control passes. Advisory cases F35-F38 in `eval/behavior-fixtures.jsonl` distinguish inherited blockers, unsafe repair, status-only and diagnosis scope. These checks establish text retention and reviewable scenarios, not a measured increase in autonomous delivery. |
 | Delivery blockers require bounded repair evidence before an exception or blocked handoff | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/refactoring-discipline.md#Treat a required-check failure that blocks this delivery as work to resolve | updated | Owner key `product-rd-workflow/SKILL.md`. The quality-gate response and `skills/product-rd-workflow/references/pre-final-continuation-gate.md` preserve the check purpose, require repair attempts or evidence of an unsafe or unauthorized repair, and leave optional findings separate. Deleting each added retention predicate makes its own assertion fail in the shared implementation-retention fixture; controls pass. Earlier explicit-context task replay already chose repair, so the change makes the inherited-blocker and handoff rules explicit without claiming a demonstrated task-level improvement. |
 | Retention checks must include every input surface when executed from an isolated fixture | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_controlled_escalation_pins.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. New repair and goal-authorization assertions in `skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh` read the root contract and release documents. The prior isolated copy omitted those inputs and failed its clean control; copying them restores the 52-mutation controlled-escalation walk. Eleven new repair and authorization predicates also fail under individual deletion, with passing controls. Goal-authorized delivery remains bounded by the requested target, caller authority, explicit stop or narrow scope, and actual host enforcement. Advisory cases F39-F40 cover release continuation and unrelated protected actions; static pins do not implement a permission system or prove agent compliance. |
+| A packet-only reviewer runs from a private home that never carried the user's MCP servers, rather than disabling them by name | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | updated | Owner key `code-review/SKILL.md`. Two faults on codex-cli 0.153.4. Every frozen-packet tool call was refused before it ran: `approval_policy="never"` with a sandbox lacking full disk write access leaves no auto-approve branch, so the packet server now declares `default_tools_approval_mode="approve"` for itself while the sandbox and policy stay unchanged. Separately, the preflight disabled every other server by name; a plugin contributes its server outside `mcp_servers`, so that override builds a transportless entry the CLI rejects outright, while leaving it enabled failed an exactly-one-server count -- the lane could not run at all on such a host. Removing the enumeration made the lane usable and made foreign servers reachable: measured, the host's own `node_repl` ran its `js` tool to completion during a packet-only review, and a stub was auto-approved purely by declaring `readOnlyHint`, which the CLI trusts from the server itself. Global approval-mode defaults did not override that hint and disabling plugins would disable the reviewer's own registry, so the run now gets a private `CODEX_HOME`: linked credential, carried model preference, copied owner skills, nothing else. Two draft claims are withdrawn rather than edited away -- that the parser's after-the-fact audit contained a foreign call, and that a hostile diff was a demonstrated path to one (two attempts did not reproduce it). `origin/dev` is not the unsafe baseline: its per-name disable works for config-declared servers and fails only for plugin-contributed ones. RED-baseline: seven wrapper assertions fail against `origin/dev`'s wrapper and the private-home assertion fails against the mid-round one; all pass on the final candidate. |
+| Work the agent started itself and still awaits is not a stop condition: it polls that step to a terminal result and continues in the same turn | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#A self-initiated step still running is | updated | Owner key `product-rd-workflow/SKILL.md`. Observed twice in one session: after launching a test suite or gate whose result only it would consume, the agent ended the turn to report that the step was running; the user had to ask why it stopped, then named the stopping itself as the defect. The gate already said not to stop at a recommendation and to continue with an owned low-risk slice, so content was not the gap -- the stop-condition list simply did not name this shape, and the host returns control the moment a step is backgrounded, which makes the pause look like a turn boundary. Landed as a firing mechanism rather than a discipline reminder: the reference names awaiting a FINITE self-started step as a non-condition, requires naming the next action before any turn ends, and adds an outcome-contract line making a still-running self-initiated step `continuing:` rather than `blocked:` or a final response; the entrypoint carries the same clause so the rule fires without opening the reference. Independent review caught the first wording as an over-broad absolute -- a dev server or watch-mode runner has no terminal result, so the rule would have demanded indefinite polling; it now takes a readiness signal and says nothing about the process lifetime: a later challenge showed that shutting it down at closeout destroys a service that is itself the requested deliverable, so the clause stops prescribing what it does not own. RED-baseline (applied, differential): deleting each of the four clauses reds only its own assertion in the shared implementation-gates fixture (`test_ai_coding_implementation_gates.sh`) with no other assertion failing, and the unmutated control passes. |
+| The shared implementation-gates fixture pins the continuation gate's non-stop clauses, so a later edit cannot silently delete them | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. The sibling row for `product-rd-workflow` records the failure itself; this row records why the fix cannot regress silently. Four assertions were added to the fixture -- the reference's non-stop clause, its turn-end firing check, its outcome-contract line, and the entrypoint's own clause. The fourth was added after independent review observed that the outcome-contract line could be deleted with every assertion still green, which is the same false-green shape the pins exist to prevent. RED-baseline (applied, differential): deleting each protected sentence reds only its owning assertion, with every other assertion passing and the unmutated control clean, so a partial deletion is attributable rather than lost in an aggregate failure. The fixture was chosen over a new suite because it already owns cross-owner rule-retention pins; no new registration surface is introduced. |
+| The landing binder names the ordering cause at the failure point: evidence a round adds that stays inside the candidate is listed when nothing binds | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/review_ledger_binding.py | updated | Owner key `skill-extraction-workflow/SKILL.md`. Third occurrence of one class. The rule that bound evidence is committed before the review rounds already exists verbatim in the quickstart and already carries a register row marked observed twice in consecutive rounds; this round hit it again because the round was driven from the delivery and review owners and never opened that quickstart. Two prior landings answered the recurrence with more prose, so this one changes the mechanism instead: when nothing binds, the binder enumerates the added evidence that is NOT excluded -- the complement of the receipt exclusion it already computes -- and states that only added JSON carrying a candidate_sha256 is excluded, so committing a base attestation or excerpt after the rounds moves the candidate out from under their receipts. RED-baseline (applied): on this round's own failing candidate the pre-change binder reported only that nothing bound it, naming neither the file nor the ordering; the changed binder lists `landing-base.txt` and the round's markdown dispositions and states the ordering. The five binding suites pass unchanged. The diagnosis now reaches an agent at the moment it fails rather than requiring it to know which document to open. |
+| A harness whose RECORDS are the evidence — an evaluation or benchmark runner, a conformance suite feeding a comparison, an A/B or regression rig — can be corrupted by the data it produces in three ways that all read green: absence stored as a bare null cannot separate confirmed-absent from never-observed, planned units and retries sharing one counter let a retry move the denominator, and a later attempt overwrites an earlier failure. Its own record layer is a high-risk failure class of the same standing as the canonical list, and is built against these before the happy path | `testing-strategy` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: file:skills/testing-strategy/references/ci-fixtures-and-flake-control.md#Absence carries a coded reason beside the value | updated | `testing-strategy/SKILL.md` is the owner key and is unchanged this round: the entrypoint is over its size budget and the growth gate blocks it, so the rule lands in `testing-strategy/references/ci-fixtures-and-flake-control.md` and is reached as a failure class from the canonical high-risk list in `testing-strategy/references/scenario-testing.md`, an enumeration the entrypoint already tells readers to walk. RED baseline: a paired walk over real artifacts — a held-out harness that contributed nothing to deriving the rules fails all three rows, each defect named by exactly one row while the other two do not mention it, while the control harness passes two and partially satisfies the first, so the check discriminates rather than accepting whatever is put to it. `observed-failure` is `no` deliberately: no malfunction of an existing repository rule was recorded this round, and the delta is measured against the held-out artifact rather than against a regression this repository observed; `result-class` is `failure` because that held-out artifact does exhibit all three defects the rule names. Sources read this round: the health-interchange data-absent-reason code system, a monitoring query language's absent-vector operators, and the controlled-trial reporting guidance for the flow diagram and per-group denominators. Known limit, stated in the landed text itself: the assembled rule has no located prior name, and measurement system analysis is the adjacent established field covering instrument accuracy and repeatability rather than record integrity. |

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py

@@ -299,12 +299,17 @@ def added_evidence_paths(repo_root: Path, base: str) -> list[str]:
     """
     result = subprocess.run(
         [
-            "git", "-C", str(repo_root), "diff", "--name-only",
+            "git", "-C", str(repo_root), "diff", "--name-only", "-z",
             "--diff-filter=A", base, "HEAD", "--", EVIDENCE_ROOT,
         ],
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE,
+        # A pathname is bytes, and -z hands them over raw. Strict decoding would
+        # turn one undecodable filename into a crash inside a gate whose job is
+        # to fail cleanly, so undecodable bytes survive as surrogates and simply
+        # do not match the evidence pattern.
         text=True,
+        errors="surrogateescape",
         check=False,
     )
     if result.returncode != 0:
@@ -313,14 +318,47 @@ def added_evidence_paths(repo_root: Path, base: str) -> list[str]:
             f"{result.stderr.strip()}"
         )
     excluded: list[str] = []
-    for line in result.stdout.splitlines():
-        if not EVIDENCE_MEMBER.match(line):
+    # -z output is NUL-separated and never C-quoted, so a path carrying a
+    # non-ASCII byte is enumerated as itself rather than as an escaped literal
+    # that no pattern here would match.
+    for line in result.stdout.split("\0"):
+        if not line or not EVIDENCE_MEMBER.match(line):
             continue
         if is_candidate_receipt(repo_root, line):
             excluded.append(line)
     return excluded
 
 
+def bound_evidence_paths(repo_root: Path, base: str) -> list[str]:
+    """Evidence this round ADDS that stays inside the candidate.
+
+    The complement of the exclusion, reported when nothing binds. Committing one
+    of these after the review rounds moves the candidate out from under their
+    receipts, and the failure that surfaces -- nothing binds -- names neither the
+    file nor the ordering. This class has now been observed three times; the
+    diagnosis belongs where the failure appears, not in a document the round has
+    to know to open.
+    """
+    result = subprocess.run(
+        [
+            "git", "-C", str(repo_root), "diff", "--name-only", "-z",
+            "--diff-filter=A", base, "HEAD", "--", EVIDENCE_ROOT,
+        ],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        errors="surrogateescape",
+        check=False,
+    )
+    if result.returncode != 0:
+        return []
+    return [
+        line
+        for line in result.stdout.split("\0")
+        if line and EVIDENCE_MEMBER.match(line) and not is_candidate_receipt(repo_root, line)
+    ]
+
+
 def is_candidate_receipt(repo_root: Path, path_value: str) -> bool:
     """Whether the committed blob at this path is a receipt about a candidate.
 
@@ -1094,6 +1132,19 @@ def bind_candidate(
             "  no committed ledger records this candidate; run the extraction review "
             "lane against the final, committed tree"
         )
+    inside = bound_evidence_paths(repo_root, fork)
+    if inside:
+        binding.failure.append(
+            "  this round added evidence that stays inside the candidate: "
+            + ", ".join(inside[:5])
+            + ("" if len(inside) <= 5 else f", and {len(inside) - 5} more")
+        )
+        binding.failure.append(
+            "  only added JSON carrying a candidate_sha256 is excluded, so bound "
+            "evidence such as base attestations and excerpts must be committed "
+            "BEFORE the review rounds; committing it after moves the candidate out "
+            "from under their receipts"
+        )
     return binding
 
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh

@@ -36,6 +36,12 @@ assert_contains "$PRODUCT_SKILL" 'gaps block `complete`' "product workflow gate
 assert_contains "$PRODUCT_SKILL" "references/implementation-completeness-and-minimality.md" "product workflow pointer"
 assert_contains "$PRODUCT_REF" "Requirement / acceptance point | Source decision | Implementation surface | Verification | Fresh evidence | Status" "acceptance closure matrix"
 assert_contains "$PRODUCT_REF" "New concept | Current acceptance point or hard constraint | Simpler alternative | Decision" "concept delta matrix"
+assert_contains "$PRE_FINAL_REF" "Awaiting work you started yourself is not a stop condition." "continuation gate (self-initiated in-flight work is not a stop)"
+assert_contains "$PRE_FINAL_REF" "is in-flight work rather than a handoff: wait for it and continue in the same turn" "continuation gate (in-flight obligation)"
+assert_contains "$PRE_FINAL_REF" "Before ending any turn, name the next action; if you can perform it now, the turn is not over." "continuation gate (turn-end firing check)"
+assert_contains "$PRODUCT_SKILL" "poll any finite step you started to its result, never reporting it as running" "continuation gate (entry firing signal)"
+assert_contains "$PRE_FINAL_REF" "is \`continuing:\`, never \`blocked:\` and never a final response. Poll it to a terminal result" "continuation gate (outcome-contract clause)"
+assert_contains "$PRE_FINAL_REF" "has no terminal result to wait for: take its readiness signal and proceed" "continuation gate (persistent-process exception)"
 assert_contains "$PRODUCT_REF" "Passing one question never compensates for failing the other." "independent axes"
 assert_contains "$PRODUCT_REF" 'An implementer may not silently downscope a point' "no self-downscope"
 assert_contains "$PRODUCT_REF" 'hypothetical reuse are not evidence' "no speculative concepts"

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/ci-fixtures-and-flake-control.md

@@ -89,6 +89,20 @@ When claiming tests pass, report:
 
 Do not report "tests pass" from memory or from a previous turn. Verification must be fresh for the current change.
 
+## Evidence-Record Integrity For Measurement Harnesses
+
+Fires when the deliverable is a harness whose RECORDS are the evidence — an evaluation or benchmark runner, a conformance suite feeding a comparison, an A/B or regression measurement rig — rather than a suite whose deliverable is pass/fail. Reached as a failure class from `scenario-testing.md` (High-Risk Failure Classes). Such a harness can be corrupted by the data it produces, in three ways that all read green. Build the record layer against these before the happy path; retrofitting means re-judging records already collected. This is one layer upstream of the entry rule that assigns absence assertions to the producing layer: that rule says where absence can be PROVEN, these say whether the record can express WHICH absence occurred at all.
+
+- **Absence carries a coded reason beside the value — never a bare null, never a new value-type.** One null cannot say whether the thing was confirmed not to exist or was never observed, and here those are opposite facts: the first is a result about the system under measurement, the second is a hole in the measurement. Put the reason in a sibling field from a closed vocabulary separating at least *confirmed absent*, *asked but unavailable*, and *not attempted* — they imply opposite retry decisions, so collapsing them also destroys the scheduling signal. Keep it beside the value, not inside its type: the relational model's own two-marker proposal (missing-but-applicable vs missing-but-inapplicable) needed four-valued logic and was never widely adopted, while the health-interchange standard's data-absent-reason coding works because it is an adjacent field only its readers pay for. Make the claim cost evidence — accept *confirmed absent* only with the retrievable observation that established it, or a writer clears a failure by asserting absence. And give absence its own assertion: a threshold over values cannot see a series that is not there, which is why a monitoring query language needs a dedicated absent-vector operator to alert on a series that stopped arriving.
+- **Report the flow counts per compared arm, not only per run; caps are the secondary control.** Planned units, extra attempts, and blocked units must be separately counted and reported, so a reader can check the denominator instead of trusting a label — and broken out per arm or per analysis being compared, together with the mix of absence reasons. A run-level total hides the asymmetry that is precisely the bias below: ten blocked units on one side and none on the other reads green in the totals while the comparison is already spoiled. Controlled-trial reporting guidance is explicit that the denominator belongs to *each group* in *every* analysis, not to the study as a whole; it also dropped the requirement to *declare* an analysis intention-to-treat — because no label reliably says who was actually included — and replaced it with that required flow of numbers. Keep caps, but a cap nobody can audit against reported counts is a claim, not a control.
+- **Retain the earliest decisive outcome; record why later attempts happened.** A retry must not replace a failure that already occurred. Keep every attempt and let a unit's recorded outcome be the earliest decisive one — including a failure that first appears on a later attempt after an inconclusive earlier one. Trial reporting is again the shape to copy: post-hoc change is not forbidden, it is required to be reported with its reason. An automatic retry that overwrites the first attempt produces exactly this corruption: the symptom is hidden, the run still reports itself complete, and the reported pass rate stops being a number a release decision can rest on.
+
+Why this is not cosmetic: in a measurement harness missingness is rarely random — evidence is missing BECAUSE the run failed, the missing-not-at-random case — so dropping incomplete units biases the comparison toward whatever produced them.
+
+Verify by building the harness's own negative cases first: one unit per absence reason, one that spends an extra attempt, and one that fails and then succeeds. A harness that cannot distinguish those three in its own output is not ready to measure anything else. Route the online-signal form of the absence rule — a metric that stopped arriving versus one reporting zero — to `platform-observability`.
+
+Boundary: this is an assembled rule, not a named discipline. Measurement system analysis is the adjacent established field, and it covers instrument accuracy and repeatability, not record integrity.
+
 ## Conditional-Skip × Job-Selection Executed-Count Guards
 
 Strongest form — a per-file invariant: the expected-file list derives from the job's own selection manifest, per job/environment (static; never from post-skip collection, which already lacks the silently-skipped file, and never shared across env-split jobs where different files legitimately run), and each expected file collects AND executes > 0 tests, with a missing-optional-dependency skip a hard failure in the job that exists to provide that dependency, never an "expected skip".

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/scenario-testing.md

@@ -76,7 +76,7 @@ Use this matrix when a web or app surface contains many charts, grouped tables,
 
 ## High-Risk Failure Classes
 
-The risk matrix for a high-risk workflow covers the triggered failure classes from this canonical list: duplicate submit/callback/message/job restart, permission service uncertainty, cross-tenant/user/resource mismatch, partial money/quota side effects, AI provider/model failure, unclear final status after refresh/offline, and missing trace/support identifier. Cover each triggered class at the lowest layer that can prove the invariant.
+The risk matrix for a high-risk workflow covers the triggered failure classes from this canonical list: duplicate submit/callback/message/job restart, permission service uncertainty, cross-tenant/user/resource mismatch, partial money/quota side effects, AI provider/model failure, unclear final status after refresh/offline, and missing trace/support identifier. When the deliverable is itself a measurement harness — an evaluation or benchmark runner, a conformance suite feeding a comparison, an A/B or regression rig — its own record layer is a class of the same standing: absence reading as a pass, a retry moving the denominator, and a later attempt overwriting an earlier failure (`ci-fixtures-and-flake-control.md`, Evidence-Record Integrity For Measurement Harnesses). Cover each triggered class at the lowest layer that can prove the invariant.
 
 Cross-reference: `non-functional-specialized-scenarios.md` (High-risk resilience boundaries) states the launch-gate counterpart — which classes require scenario tests or drills at release. That is a gate-criteria list; this is the test-matrix failure-class list. The two complement each other and neither replaces the other.
 

package/dist/assets/release.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "npmPackage": "@ccoalm/ccl-skills",
-  "version": "0.15.4",
-  "sourceCommit": "d7de4f677054e4fb1dd59835fdde19faf42607da",
+  "version": "0.15.5",
+  "sourceCommit": "88e842ffb4ab944dde3179fa5a8e43755fbba27a",
   "sourceState": "clean",
   "files": [
     {
@@ -287,7 +287,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/code-review/references/staged-review-contract.md",
-      "sha256": "dfa8a7956c7a03ab1c3ff12159b122277f35eb5f6310ef6f5ba0604aae380140",
+      "sha256": "900f09bfc21bdd78c9bf85794a361ae35dbf5b1ce0ae1910baa1991615b51093",
       "mode": 420
     },
     {
@@ -317,7 +317,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/code-review/scripts/codex_review.sh",
-      "sha256": "25ddfdbc658a1dba22fca49e317ee37a8305341fc5e5474ffb95451b6a94a058",
+      "sha256": "9b98ba819ed9baee557c43aa735ab006e0dfb4e02e0e337cdca5e4867845c105",
       "mode": 493
     },
     {
@@ -412,7 +412,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/code-review/scripts/test_cli_review_wrappers.sh",
-      "sha256": "3939d9751665987312d7c36489913205adaaaebece05e38248ebc24526e9e2b8",
+      "sha256": "bd67dcc75343071913411c43fe727d4e4361318318fe85c7f350cd9f000f2c79",
       "mode": 493
     },
     {
@@ -1402,7 +1402,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/pre-final-continuation-gate.md",
-      "sha256": "0d72f01b9b668ff1d0b5065efa85a88e453959d427ee8357dcc2a62eaa4895d7",
+      "sha256": "084b801e8eb4c0d3ccabf102d7bc75721a00666030f3fcbc00dd74d5725ac408",
       "mode": 420
     },
     {
@@ -1477,7 +1477,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/product-rd-workflow/SKILL.md",
-      "sha256": "bf87f0f199ca93916ab3e22d5ef4fab624c336aab7374fec350a3f5242c03878",
+      "sha256": "b33441326e6dfe9ec2a587d80cb27344c9cbd6c32f7a3ca672615c3f0e6d2055",
       "mode": 420
     },
     {
@@ -2132,7 +2132,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md",
-      "sha256": "2027a21f0375bcf1b82dc3aefd2ad78d0d10030cbcc2c2a4e9c317f2442f831e",
+      "sha256": "a1f297987a1c91f283d83ede2bd1994b727316a45e978b3480dec6a556644e3a",
       "mode": 420
     },
     {
@@ -2272,7 +2272,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py",
-      "sha256": "19771e040412508c08eb5f591358d2a5da454d63426eb0c4c1eec6244850fe2b",
+      "sha256": "a75b043aa63e278a45e3c31f418b042a0ffbef3497ff4c1e139f777bd72e6d29",
       "mode": 493
     },
     {
@@ -2297,7 +2297,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh",
-      "sha256": "724d0d05a01e23f8b8c09d9bc1a0ec124da98a6d8c05e7decfcde1d35f6b8875",
+      "sha256": "e51dac3a34fa51656f4d096a2ce568aebd6fbc528d30d12f98cebfdc91cc8921",
       "mode": 493
     },
     {
@@ -2732,7 +2732,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/testing-strategy/references/ci-fixtures-and-flake-control.md",
-      "sha256": "139a79639c172c7b67f2960c254d5bd258a961bac57d619025b549967f2933cd",
+      "sha256": "9796ba2af7da8ff4eedfd3fe6e233a92cded263cae06347e34a089289af8f89f",
       "mode": 420
     },
     {
@@ -2782,7 +2782,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/testing-strategy/references/scenario-testing.md",
-      "sha256": "bdc079ede939c444cf907f278f58a03a0c25f1596671af21deeeb602c49a5031",
+      "sha256": "fd14402d13d610621b7b1dab87f422ff9ed6fa20a2071ef8c46e8281f3d6a199",
       "mode": 420
     },
     {
@@ -3433,5 +3433,5 @@
       "mode": 420
     }
   ],
-  "snapshotHash": "34e610a93af18f577b2e1b56c2a956b97960c85fccbbdb392e1daa4962359ac1"
+  "snapshotHash": "098f8ae71c1a51738986e49cf1667aaa62e714b3c4b10d4ff96b0a08f2655d96"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccoalm/ccl-skills",
-	"version": "0.15.4",
+	"version": "0.15.5",
   "description": "Reusable workflows that help coding agents plan, build, test, review, and release software — for Claude Code, Codex, and OpenCode",
 	"keywords": ["skills", "agent-skills", "claude", "claude-code", "codex", "opencode", "agent", "ai", "ai-agents", "cli", "anthropic", "developer-tools"],
   "type": "module",