@ccoalm/ccl-skills 0.15.4 → 0.16.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_gate.sh

@@ -1679,7 +1679,7 @@ diff_alternate = root / "alternate.patch"
 diff_source.write_bytes(original_diff)
 diff_alternate.write_bytes(alternate_diff)
 with replace_after_symlink_check(diff_source, diff_alternate):
-    packet_path, digest, _, _ = review_gate.freeze_packet(
+    packet_path, digest, _candidate, _n, _, _ = review_gate.freeze_packet(
         SimpleNamespace(
             cwd=str(root), diff_file=str(diff_source), base=None, paths=[]
         ),
@@ -1774,6 +1774,241 @@ file_input_race_rc=$?
 check "diff, prior, and completion inputs are read once from a bounded opened descriptor" \
   '[ "$file_input_race_rc" = 0 ] && [ "$file_input_race_probe" = open_once_file_inputs_ok ]'
 
+# The reviewer's packet and the landing candidate are two objects. A widened
+# packet exists so a reviewer can judge a claim against code outside the diff;
+# the candidate exists so the merge-side binder can recompute what actually
+# lands. Aliasing them made the two mutually exclusive: widening produced a
+# receipt the binder could never match. These assert the split and the one
+# invariant that replaces the equality -- the candidate appears in the packet
+# verbatim, so nothing lands that its reviewer did not read.
+subject_packet_probe="$(
+PYTHONPATH="$WORK/harness/scripts" python3 - "$WORK" <<'PY'
+import hashlib
+import subprocess
+import sys
+import time
+from pathlib import Path
+from types import SimpleNamespace
+
+import review_gate
+
+root = Path(sys.argv[1]) / "subject-vs-packet"
+root.mkdir()
+# Packet files live OUTSIDE the repository on purpose: the base-derived
+# candidate includes untracked files, so a packet written into the worktree
+# would become part of the very candidate it has to contain.
+outside = Path(sys.argv[1]) / "subject-vs-packet-packets"
+outside.mkdir()
+
+
+def git(*args):
+    subprocess.run(
+        ["git", "-C", str(root), *args],
+        check=True,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+
+
+git("init", "-q")
+git("config", "user.email", "fixture@example.invalid")
+git("config", "user.name", "fixture")
+(root / "landing.txt").write_text("old\n", encoding="utf-8")
+(root / "context.txt").write_text("context-base\n", encoding="utf-8")
+git("add", "landing.txt", "context.txt")
+git("commit", "-qm", "base")
+base = subprocess.run(
+    ["git", "-C", str(root), "rev-parse", "HEAD"],
+    check=True,
+    capture_output=True,
+    text=True,
+).stdout.strip()
+(root / "landing.txt").write_text("new\n", encoding="utf-8")
+
+
+def freeze(*, diff_file=None, paths=(), base_ref=base, wording=None):
+    return review_gate.freeze_packet(
+        SimpleNamespace(
+            cwd=str(root),
+            diff_file=str(diff_file) if diff_file else None,
+            base=base_ref,
+            paths=list(paths),
+            wording_only_proof_file=wording,
+        ),
+        time.monotonic() + 30,
+    )
+
+
+def digest(value: bytes) -> str:
+    return hashlib.sha256(value).hexdigest()
+
+
+def expect_refused(label, **kwargs):
+    try:
+        result = freeze(**kwargs)
+    except review_gate.GateError as exc:
+        return exc
+    result[0].unlink()
+    raise AssertionError(label)
+
+
+# The base-derived subject: exactly what the landing binder recomputes.
+subject_path, subject_hash, subject_candidate_hash, subject_n, subject_paths, _ = freeze()
+subject_bytes = subject_path.read_bytes()
+subject_path.unlink()
+assert subject_hash == digest(subject_bytes)
+assert subject_candidate_hash == subject_hash
+assert subject_n == len(subject_bytes)
+assert subject_paths == ["landing.txt"], subject_paths
+
+# A7 -- with no --diff-file the two hashes are the same value, as they are today.
+plain_path, plain_packet_hash, plain_candidate_hash, _plain_n, plain_paths, _ = freeze()
+plain_path.unlink()
+assert plain_packet_hash == subject_hash
+assert plain_candidate_hash == subject_hash
+assert plain_paths == ["landing.txt"], plain_paths
+
+# A1/A2/A3 -- a widened packet carries the whole subject plus context the
+# reviewer needs. The packet hash is the widened bytes; the candidate hash is
+# still the base-derived subject the binder will recompute.
+context = (
+    b"\n--- context: skills/code-review/SKILL.md (unchanged, for judgment) ---\n"
+    b"the sibling clause the changed lines must not contradict\n"
+)
+widened = outside / "widened.patch"
+widened.write_bytes(subject_bytes + context)
+wide_path, wide_packet_hash, wide_candidate_hash, wide_n, wide_paths, _ = freeze(
+    diff_file=widened
+)
+try:
+    assert wide_packet_hash == digest(subject_bytes + context)
+    assert wide_candidate_hash == subject_hash
+    assert wide_packet_hash != wide_candidate_hash
+    # The reviewer is told where the candidate ends; without that, appended
+    # hunks that continue or appear to revert the diff are indistinguishable
+    # from candidate content in a packet-bounded read.
+    assert wide_n == len(subject_bytes), wide_n
+    # A10 -- candidate paths follow the subject, not the packet, so owner
+    # selection and the wording-only changed-file comparison stay bound to what
+    # lands rather than to whatever context was appended.
+    assert wide_paths == ["landing.txt"], wide_paths
+finally:
+    wide_path.unlink()
+
+# A5 -- a packet missing part of the candidate is refused. This is the property
+# the equality used to provide for free.
+truncated = outside / "truncated.patch"
+truncated.write_bytes(subject_bytes[: len(subject_bytes) // 2] + context)
+exc = expect_refused(
+    "a packet missing part of the candidate was accepted", diff_file=truncated
+)
+assert "BEGIN" in str(exc), str(exc)
+
+# A6 -- context appended passes; context spliced into the middle of the
+# candidate does not, because then the candidate is no longer in the packet
+# verbatim and no cheap check can tell a splice from a silent edit.
+split = len(subject_bytes) // 2
+interleaved = outside / "interleaved.patch"
+interleaved.write_bytes(subject_bytes[:split] + context + subject_bytes[split:])
+expect_refused(
+    "a packet interleaving context inside the candidate was accepted",
+    diff_file=interleaved,
+)
+
+# A11 -- context BEFORE the candidate is refused even though the candidate is
+# present verbatim. A bare containment test accepts this, and an adversarial
+# round showed what it buys: a sanitized decoy diff read as the change while the
+# real candidate reads as trailing context.
+prepended = outside / "prepended.patch"
+prepended.write_bytes(context + subject_bytes)
+exc = expect_refused(
+    "a packet preceding the candidate with other content was accepted",
+    diff_file=prepended,
+)
+assert "BEGIN" in str(exc), str(exc)
+
+# A4 -- a packet with no relation to the candidate is refused.
+unrelated = outside / "unrelated.patch"
+unrelated.write_bytes(b"diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -1 +1 @@\n-a\n+b\n")
+expect_refused("an unrelated packet was accepted", diff_file=unrelated)
+
+# A8 -- --diff-file alone keeps today's meaning: no base, so no subject, and
+# the candidate hash stays the packet's own hash.
+alone_path, alone_packet_hash, alone_candidate_hash, _n, _, _ = freeze(
+    diff_file=widened, base_ref=None
+)
+alone_path.unlink()
+assert alone_packet_hash == digest(subject_bytes + context)
+assert alone_candidate_hash == alone_packet_hash
+
+# A9 -- the wording-only proof is a machine check over a full-context
+# base-derived diff and has no meaning over an author-assembled packet.
+proof = outside / "wording-only.json"
+proof.write_text("{}", encoding="utf-8")
+expect_refused(
+    "a wording-only proof was accepted over an author-assembled packet",
+    diff_file=widened,
+    wording=str(proof),
+)
+# ... in the COMBINED form. Bare --diff-file with a wording-only proof stays
+# accepted, which the cases above this block exercise throughout; the boundary
+# is where a base-derived candidate and author-assembled bytes would both be in
+# play with nothing saying which one the proof's scope describes.
+result = freeze(diff_file=widened, base_ref=None, wording=str(proof))
+result[0].unlink()
+
+# A12 -- an empty base-derived candidate is refused rather than trivially
+# satisfying the prefix check, which every packet does for empty bytes.
+empty_repo = Path(sys.argv[1]) / "empty-candidate"
+empty_repo.mkdir()
+subprocess.run(["git", "-C", str(empty_repo), "init", "-q"], check=True)
+subprocess.run(
+    ["git", "-C", str(empty_repo), "config", "user.email", "fixture@example.invalid"],
+    check=True,
+)
+subprocess.run(
+    ["git", "-C", str(empty_repo), "config", "user.name", "fixture"], check=True
+)
+(empty_repo / "kept.txt").write_text("unchanged\n", encoding="utf-8")
+subprocess.run(
+    ["git", "-C", str(empty_repo), "add", "kept.txt"],
+    check=True,
+    stdout=subprocess.DEVNULL,
+)
+subprocess.run(
+    ["git", "-C", str(empty_repo), "commit", "-qm", "base"],
+    check=True,
+    stdout=subprocess.DEVNULL,
+)
+empty_base = subprocess.run(
+    ["git", "-C", str(empty_repo), "rev-parse", "HEAD"],
+    check=True,
+    capture_output=True,
+    text=True,
+).stdout.strip()
+try:
+    review_gate.freeze_packet(
+        SimpleNamespace(
+            cwd=str(empty_repo),
+            diff_file=str(widened),
+            base=empty_base,
+            paths=[],
+            wording_only_proof_file=None,
+        ),
+        time.monotonic() + 30,
+    )
+except review_gate.GateError as exc:
+    assert exc.reason_code == "empty_diff", exc.reason_code
+else:
+    raise AssertionError("an empty base-derived candidate was accepted")
+
+print("subject_packet_split_ok")
+PY
+)"
+subject_packet_rc=$?
+check "a widened packet keeps the base-derived candidate and must contain it verbatim" \
+  '[ "$subject_packet_rc" = 0 ] && [ "$subject_packet_probe" = subject_packet_split_ok ]'
+
 reset_case missing_coverage passed unavailable
 out="$(run_gate --diff-file "$WORK/secret-diff.patch")"; rc=$?
 check "missing coverage cannot widen egress for a secret-bearing diff without approval" \

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/SKILL.md

@@ -194,7 +194,7 @@ Run this gate before finalizing a product R&D turn after any delivery slice land
    - **Deferred-evidence continuation check (`DFE-CONT`).** When real/runtime evidence is due (named by an acceptance item, status source, landing-evidence row, required gate, user correction, or because it is the behavior's only meaningful proof) yet deferred, blocked after remediation, skipped at finalization, or replaced by local/mock verification. Report deferred real evidence as `interim`/outstanding; do NOT report the turn complete while it is outstanding. A local/mock substitution is terminal only when a cited **non-agent** anchor — **agent-authored or agent-co-edited status/router/gate/handoff text never satisfies this** — names the same evidence, declares the deferral terminal, and carries the outstanding command/source forward for the active slice/ref. Never add verifier/config/test hardening motivated only by missing deferred evidence; never auto-continue past the pending gate. **Load `references/pre-final-continuation-gate.md` before treating any deferral as terminal** — it owns the valid/invalid-anchor list and hardening boundary.
    - **Affirmative-assent binding rule** lives in `references/pre-final-continuation-gate.md` §Assent binding — load it when recovering a short reply. Bind to the current explicit request or one recoverable concrete proposal, including an unmarked proposal; preserve its scope and existing authority. Ask only if action, scope, or required authority remains unresolved after recovery. A status remark or output marker cannot substitute for a proposal or permission; self-classifying the reply or marker away is never an exit from carrying out an already-clear request.
 3. Continue automatically with a clearly owned, verifiable, low-risk next slice from an explicit task/status/acceptance source or active user continuation, within accepted scope and existing authority. Apply the eligibility and stop conditions in `references/pre-final-continuation-gate.md`. Necessary fixes, tests and review inherit task authorization; a reviewer-budget flag triggers a method checkpoint and cumulative-history record, not renewed permission. Explicit user limits still govern. Existing configured internal developer-self-use metered model/tool accounts aren't an external purchase here.
-4. Stop only for an explicit stop/pause instruction, a user-requested status-only answer, or a concrete blocker for the affected action. Block materially differing viable approaches (none dominant-and-reversible) and a fix lacking evidenced cause; load `references/pre-final-continuation-gate.md` for the full stop conditions. **Scope each blocker to its dependent action or claim.** An unproven cause blocks the speculative patch, not available diagnosis; a pending gate blocks dependent landing/completion, not authorized remediation or independent work. Before ending, perform available in-scope diagnosis, owner discovery, remediation, live-handle monitoring or independent work. Quality-gate failures require diagnosis and available related behavior-preserving cleanup before escalation; preserve readability and compatibility, never game counters (`references/refactoring-discipline.md`). Never bypass the blocked gate, invent a pass, widen scope, or substitute unrelated hardening. Stop the task only at the user's stop/status-only instruction or when no safe authorized work remains. With one dominant reversible approach and no applicable stop condition, do not stop at a recommendation: deliver a tested reviewable draft.
+4. Stop only for an explicit stop/pause instruction, a user-requested status-only answer, a concrete blocker for the affected action, or no safe authorized work remains. Block materially differing viable approaches (none dominant-and-reversible) and a fix lacking evidenced cause; load `references/pre-final-continuation-gate.md` for the full stop conditions. **Scope each blocker to its dependent action or claim.** An unproven cause blocks the speculative patch, not available diagnosis; a pending gate blocks dependent landing/completion, not authorized remediation or independent work. Before ending, perform in-scope diagnosis, owner discovery, remediation or independent work, and poll any finite step you started to its result, never reporting it as running. Quality-gate failures require diagnosis and available related behavior-preserving cleanup before escalation; preserve readability and compatibility, never game counters (`references/refactoring-discipline.md`). Never bypass the blocked gate, invent a pass, widen scope, or substitute unrelated hardening. With one dominant reversible approach and no applicable stop condition, do not stop at a recommendation: deliver a tested reviewable draft.
 5. If stopping, state the concrete stop reason and the exact evidence checked; an assent-triggered `blocked:` outcome uses the action/scope-plus-blocker form and classifies the turn `interim`. Ask one concise in-turn question when ambiguity or missing authority blocks; explicit stop/pause needs no reconfirmation. A `continuing:` outcome proceeds with the named slice before finalizing. A silent/completion stop is invalid. Do not send a completion-only, solved, fixed, or fully-closed final response after a merge/sync while a required review/challenge is pending or inconclusive; report interim or blocked with the next unblock step.
 6. **Assent-outcome closeout check.** Every user reply immediately following an assistant message that states or implies a next action requires a visible `continuing:` or `blocked:` outcome before finalizing, even if the reply is not classified as assent; every explicit continuation request does too. Missing markers never waive it. Reconcile the current request, original proposal, scope/authority changes, tool/output evidence, and remaining blockers. Respect a current explicit stop or status-only request; name that reason in the blocked outcome without executing the prior proposal. Otherwise `continuing:` must be followed by execution in the same turn; a promised next step is not execution. If part remains blocked, report its pending state and independent work performed. A status-only handoff cannot discharge an unexecuted accepted action. Repair marker formatting; for short assent, if the original proposal cannot be recovered verbatim, select `blocked:` and ask. Formatting never requires clarification. Do not silently drop an accepted action or claim a pending gate passed.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/pre-final-continuation-gate.md

@@ -101,12 +101,15 @@ An eligible next slice comes from an explicit status/task/acceptance source or a
 
 Action-scoped stop conditions are: an explicit stop/pause instruction; a user-requested status-only answer; a failed, pending or inconclusive required gate; a dirty/conflicting worktree that cannot be isolated; a required environment unavailable after remediation; a high-impact product, architecture or compliance decision; a destructive action; an external purchase or financial commitment; unclear ownership; ambiguous assent; missing stricter authorization; materially different viable approaches with none dominant and reversible; a speculative fix without evidenced cause; or no low-risk slice. Apply each condition to the affected action. For a failed check, perform available authorized diagnosis and remediation before stopping the whole task: cite the failure output, repair attempts (or evidence that repair is unsafe or outside authority), and residual blocker. A failed verdict alone does not block diagnosis.
 
+**Awaiting work you started yourself is not a stop condition.** A finite command, suite, gate, or review you launched, whose result only you consume, is in-flight work rather than a handoff: wait for it and continue in the same turn. A process meant to stay up — a dev server, a watch-mode runner, a tail — has no terminal result to wait for: take its readiness signal and proceed. Never poll it forever, and do not infer anything about its lifetime from this rule; whether it keeps running is the delivery's decision, and a service the user asked for is a deliverable, not a leftover. Ending the turn to report that it is running is a premature stop even when the report is accurate — the user gains nothing they can act on, and the next step was already authorized. Host behavior invites this: a backgrounded step returns control immediately, so the pause *looks* like a turn boundary. It is not one. Before ending any turn, name the next action; if you can perform it now, the turn is not over. The turn ends at the first action that genuinely needs the user — an unresolved decision, missing authority, an explicit stop — not at the nearest convenient pause. A user asking why you stopped is this defect's recurrence signal, not a request for a status update.
+
 Check continuation on every user reply immediately following assistant prose that states or implies a next action, and on any explicit continuation request, regardless of landing status. Do not first require classifying the reply as assent; visibly report the continuing or blocked outcome even when the reply changes scope or stops the proposed action. Short replies include `ok`, `yes`, `可以`, `好`, `继续`, `proceed`, `do it`, `go ahead`, and `👍`; interpret them against the recovered action rather than formatting alone.
 
 - Select `continuing: <action and scope>` when that action is clear and authorized, then execute it in the same turn. A tool call and its result or a produced artifact establish execution; the label alone does not.
 - A blocked patch, review, or landing does not block every action. Keep that dependent action/claim pending while continuing available diagnosis, bounded remediation, monitoring of the existing live handle, or independent accepted work. These paths retain their own scope and permission checks; they cannot bypass the blocked gate or substitute unrelated hardening for missing evidence.
 - A failed quality gate calls for a repair that preserves its purpose. Before asking the user to choose a workaround, inspect and perform a safe structural cleanup necessary for the authorized delivery when available, including baseline failures that block it, then rerun the gate and affected tests. Follow [refactoring discipline](refactoring-discipline.md#responding-to-quality-gates): preserve behavior, compatibility and readability; do not shrink identifiers or necessary comments, weaken a baseline or rewrite history solely to make the counter pass. If no safe in-scope repair remains, report the evidence and the actual decision needed.
 - Independent work must neither depend on the pending verdict nor modify the candidate being evaluated. Name the pending gate and the independence basis when continuing. A candidate-changing fix is remediation, not independent work: let the existing run reach a terminal state, then refresh affected evidence and re-enter the owning gate. The deferred-evidence hardening prohibition still applies.
+- A self-initiated step still running is `continuing:`, never `blocked:` and never a final response. Poll it to a terminal result, act on that result, and only then re-enter this gate. A step whose terminal result cannot be obtained after the normal remediation — it hangs, or its handle is lost — is the ordinary unavailable-environment case and blocks that dependent action, with the failure and the remediation attempted cited.
 - Select `blocked: <action and scope> — <specific blocker>` when the remaining action needs an unresolved decision/authority or no safe authorized work remains after remediation. Cite the actual evidence; ask only for the missing decision or permission. An explicit stop/pause or status-only request blocks executing the prior proposal: name that reason in the outcome, answer the requested status, and do not reconfirm the stop.
 - Apply landing-state proof to landing claims and derivation of post-landing work. For an authorized local investigation with no landed slice, record that landing checks do not apply and perform the investigation.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md

@@ -659,3 +659,23 @@ The pending classification above is superseded by the executed source comparison
 | Required failures inherited from a baseline remain part of an authorized repair task | `defect-diagnosis` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/defect-diagnosis/SKILL.md#Required failures, including inherited debt | updated | Owner key `defect-diagnosis/SKILL.md`. The entry now requires diagnosis, safe repair and rerunning the original check, with a mandatory handoff reference. A synthetic deletion of the new entry makes its named retention assertion fail in the shared implementation-retention fixture; the unchanged control passes. Advisory cases F35-F38 in `eval/behavior-fixtures.jsonl` distinguish inherited blockers, unsafe repair, status-only and diagnosis scope. These checks establish text retention and reviewable scenarios, not a measured increase in autonomous delivery. |
 | Delivery blockers require bounded repair evidence before an exception or blocked handoff | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/refactoring-discipline.md#Treat a required-check failure that blocks this delivery as work to resolve | updated | Owner key `product-rd-workflow/SKILL.md`. The quality-gate response and `skills/product-rd-workflow/references/pre-final-continuation-gate.md` preserve the check purpose, require repair attempts or evidence of an unsafe or unauthorized repair, and leave optional findings separate. Deleting each added retention predicate makes its own assertion fail in the shared implementation-retention fixture; controls pass. Earlier explicit-context task replay already chose repair, so the change makes the inherited-blocker and handoff rules explicit without claiming a demonstrated task-level improvement. |
 | Retention checks must include every input surface when executed from an isolated fixture | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_controlled_escalation_pins.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. New repair and goal-authorization assertions in `skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh` read the root contract and release documents. The prior isolated copy omitted those inputs and failed its clean control; copying them restores the 52-mutation controlled-escalation walk. Eleven new repair and authorization predicates also fail under individual deletion, with passing controls. Goal-authorized delivery remains bounded by the requested target, caller authority, explicit stop or narrow scope, and actual host enforcement. Advisory cases F39-F40 cover release continuation and unrelated protected actions; static pins do not implement a permission system or prove agent compliance. |
+| A packet-only reviewer runs from a private home that never carried the user's MCP servers, rather than disabling them by name | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | updated | Owner key `code-review/SKILL.md`. Two faults on codex-cli 0.153.4. Every frozen-packet tool call was refused before it ran: `approval_policy="never"` with a sandbox lacking full disk write access leaves no auto-approve branch, so the packet server now declares `default_tools_approval_mode="approve"` for itself while the sandbox and policy stay unchanged. Separately, the preflight disabled every other server by name; a plugin contributes its server outside `mcp_servers`, so that override builds a transportless entry the CLI rejects outright, while leaving it enabled failed an exactly-one-server count -- the lane could not run at all on such a host. Removing the enumeration made the lane usable and made foreign servers reachable: measured, the host's own `node_repl` ran its `js` tool to completion during a packet-only review, and a stub was auto-approved purely by declaring `readOnlyHint`, which the CLI trusts from the server itself. Global approval-mode defaults did not override that hint and disabling plugins would disable the reviewer's own registry, so the run now gets a private `CODEX_HOME`: linked credential, carried model preference, copied owner skills, nothing else. Two draft claims are withdrawn rather than edited away -- that the parser's after-the-fact audit contained a foreign call, and that a hostile diff was a demonstrated path to one (two attempts did not reproduce it). `origin/dev` is not the unsafe baseline: its per-name disable works for config-declared servers and fails only for plugin-contributed ones. RED-baseline: seven wrapper assertions fail against `origin/dev`'s wrapper and the private-home assertion fails against the mid-round one; all pass on the final candidate. |
+| Work the agent started itself and still awaits is not a stop condition: it polls that step to a terminal result and continues in the same turn | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#A self-initiated step still running is | updated | Owner key `product-rd-workflow/SKILL.md`. Observed twice in one session: after launching a test suite or gate whose result only it would consume, the agent ended the turn to report that the step was running; the user had to ask why it stopped, then named the stopping itself as the defect. The gate already said not to stop at a recommendation and to continue with an owned low-risk slice, so content was not the gap -- the stop-condition list simply did not name this shape, and the host returns control the moment a step is backgrounded, which makes the pause look like a turn boundary. Landed as a firing mechanism rather than a discipline reminder: the reference names awaiting a FINITE self-started step as a non-condition, requires naming the next action before any turn ends, and adds an outcome-contract line making a still-running self-initiated step `continuing:` rather than `blocked:` or a final response; the entrypoint carries the same clause so the rule fires without opening the reference. Independent review caught the first wording as an over-broad absolute -- a dev server or watch-mode runner has no terminal result, so the rule would have demanded indefinite polling; it now takes a readiness signal and says nothing about the process lifetime: a later challenge showed that shutting it down at closeout destroys a service that is itself the requested deliverable, so the clause stops prescribing what it does not own. RED-baseline (applied, differential): deleting each of the four clauses reds only its own assertion in the shared implementation-gates fixture (`test_ai_coding_implementation_gates.sh`) with no other assertion failing, and the unmutated control passes. |
+| The shared implementation-gates fixture pins the continuation gate's non-stop clauses, so a later edit cannot silently delete them | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. The sibling row for `product-rd-workflow` records the failure itself; this row records why the fix cannot regress silently. Four assertions were added to the fixture -- the reference's non-stop clause, its turn-end firing check, its outcome-contract line, and the entrypoint's own clause. The fourth was added after independent review observed that the outcome-contract line could be deleted with every assertion still green, which is the same false-green shape the pins exist to prevent. RED-baseline (applied, differential): deleting each protected sentence reds only its owning assertion, with every other assertion passing and the unmutated control clean, so a partial deletion is attributable rather than lost in an aggregate failure. The fixture was chosen over a new suite because it already owns cross-owner rule-retention pins; no new registration surface is introduced. |
+| The landing binder names the ordering cause at the failure point: evidence a round adds that stays inside the candidate is listed when nothing binds | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/review_ledger_binding.py | updated | Owner key `skill-extraction-workflow/SKILL.md`. Third occurrence of one class. The rule that bound evidence is committed before the review rounds already exists verbatim in the quickstart and already carries a register row marked observed twice in consecutive rounds; this round hit it again because the round was driven from the delivery and review owners and never opened that quickstart. Two prior landings answered the recurrence with more prose, so this one changes the mechanism instead: when nothing binds, the binder enumerates the added evidence that is NOT excluded -- the complement of the receipt exclusion it already computes -- and states that only added JSON carrying a candidate_sha256 is excluded, so committing a base attestation or excerpt after the rounds moves the candidate out from under their receipts. RED-baseline (applied): on this round's own failing candidate the pre-change binder reported only that nothing bound it, naming neither the file nor the ordering; the changed binder lists `landing-base.txt` and the round's markdown dispositions and states the ordering. The five binding suites pass unchanged. The diagnosis now reaches an agent at the moment it fails rather than requiring it to know which document to open. |
+| A harness whose RECORDS are the evidence — an evaluation or benchmark runner, a conformance suite feeding a comparison, an A/B or regression rig — can be corrupted by the data it produces in three ways that all read green: absence stored as a bare null cannot separate confirmed-absent from never-observed, planned units and retries sharing one counter let a retry move the denominator, and a later attempt overwrites an earlier failure. Its own record layer is a high-risk failure class of the same standing as the canonical list, and is built against these before the happy path | `testing-strategy` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: file:skills/testing-strategy/references/ci-fixtures-and-flake-control.md#Absence carries a coded reason beside the value | updated | `testing-strategy/SKILL.md` is the owner key and is unchanged this round: the entrypoint is over its size budget and the growth gate blocks it, so the rule lands in `testing-strategy/references/ci-fixtures-and-flake-control.md` and is reached as a failure class from the canonical high-risk list in `testing-strategy/references/scenario-testing.md`, an enumeration the entrypoint already tells readers to walk. RED baseline: a paired walk over real artifacts — a held-out harness that contributed nothing to deriving the rules fails all three rows, each defect named by exactly one row while the other two do not mention it, while the control harness passes two and partially satisfies the first, so the check discriminates rather than accepting whatever is put to it. `observed-failure` is `no` deliberately: no malfunction of an existing repository rule was recorded this round, and the delta is measured against the held-out artifact rather than against a regression this repository observed; `result-class` is `failure` because that held-out artifact does exhibit all three defects the rule names. Sources read this round: the health-interchange data-absent-reason code system, a monitoring query language's absent-vector operators, and the controlled-trial reporting guidance for the flow diagram and per-group denominators. Known limit, stated in the landed text itself: the assembled rule has no located prior name, and measurement system analysis is the adjacent established field covering instrument accuracy and repeatability rather than record integrity. |
+| The reviewer's packet and the landing candidate are two objects: `--diff-file` widens what the reviewer reads while `--base` keeps `candidate_sha256` the base-derived identity the merge-side binder recomputes, and the gate accepts the combination only when the packet BEGINS with that candidate, byte for byte | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/review_gate.py | `updated` | Owner key `code-review/SKILL.md`. Observed failure: the previous round's first review chain returned five findings of one class -- the code a containment claim depends on is not in the packet -- and answering them was impossible, because the skill tells the author that insufficient input is an input defect to be answered by widening the packet and rerunning the lane, while `freeze_packet` refused `--diff-file` together with `--base` and recorded `candidate_sha256` as the packet's own hash, so a widened rerun produced a receipt `review_ledger_binding.py` can never match. Following the contract produced evidence the merge side rejects. The controller now computes the candidate from the base independently of the packet, accepts the combination only when the packet begins with that candidate, and derives `candidate_paths` from the candidate so owner selection and the wording-only `changed_files` comparison cannot be widened by appended context; the in-chain checks that asserted the two hashes were equal now compare candidate to candidate, which is what lets a later round in one chain read more than an earlier one. Backward compatibility is byte-exact: with no `--diff-file` both hashes keep today's value, and `--diff-file` alone keeps today's meaning. The anchor is a prefix rather than a bare containment test because the round's adversarial challenge showed what containment alone buys: a packet PRECEDING the candidate with a sanitized decoy diff passes, and the reviewer then reads the decoy as the change and the real candidate as trailing context -- the repository's authoring rule already said context sits on top of the candidate, and until this round it was documented and unenforced. RED-baseline (applied, differential): collapsing the candidate identity back into the packet hash reds only the new acceptance case in `test_review_gate.sh` while its other 268 cases pass; removing the anchor check reds that same case alone; the unmutated control is green. Recorded because it cost a red rather than being reasoned out: the packet file must live outside the repository, because the base-derived candidate includes untracked files and a packet written into the worktree becomes part of the candidate it has to contain. |
+| The binding gate's cross-side agreement is asserted rather than assumed: a widened packet's recorded candidate identity must equal the one the gate recomputes, and the base and paths for that comparison come from the gate's own scope resolution rather than being rebuilt by hand | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh | `updated` | Owner key `skill-extraction-workflow/SKILL.md`. `review_ledger_binding.py` has no behavior delta of its own -- it never passes `--diff-file`, so its candidate and its packet stay the same bytes -- and the honest record of that is a mutation which does NOT discriminate: making it return the packet hash instead of the candidate hash leaves all 85 binder cases green. So what lands here is the cross-side assertion, because the claim that motivated the change spans both sides and neither suite alone can hold it. The binder suite now freezes a widened packet through the controller and requires the identity recorded for it to equal the one this gate recomputes. It derives the base and the paths from `candidate_scope` instead of hand-building them, which is itself the finding: the base is a fork point and the paths carry the receipt exclusions the round has already added, so `--print-candidate` is the authority an author reads rather than a value an author reconstructs. RED-baseline (applied, differential): collapsing the controller's candidate identity into the packet hash reds this case alone while the other 85 pass, and the unmutated control is green. |
+| A reviewer wrapper classifies a transport failure from the transport's own error channel, not from whichever stream is habitual: a CLI run under a structured-output flag reports supply and credential failures as events on stdout, so a classifier reading stderr alone reports a routine quota exhaustion as an unclassifiable client fault and stops the lane instead of cascading; and because only the transport's TOP-LEVEL error events count, model-authored text quoting the reviewed packet cannot steer that decision. Every transport failure additionally carries a bounded, redacted excerpt of what the transport said, because a failure whose captured streams are deleted leaves nothing that can contradict a wrong hypothesis | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/codex_review.sh | `updated` | Owner key `code-review/SKILL.md`. Observed failure: the codex lane returned `codex_run_failed` / `unknown_client_failure` three rounds running, and the recorded suspicion was packet size. Both halves were wrong. A 20KB packet reproduces the failure identically, and the preserved run directory shows the account's usage limit announced on the event stream while stderr carried only an unrelated models-manager message -- the quota regex matches the first file and not the second, and the wrapper greps only the second. Invoking the CLI directly against the user's own home returns the same message, so the condition is account-level rather than wrapper-induced. The cost is not cosmetic: `review_gate.py` admits a cascade only for a reason code in `CANDIDATE_LOCAL_CODES` carrying `cascade_eligible` true, `quota` is in that set and `unknown_client_failure` is not, so the misclassification produced `stop_reviewer_lane` and the recovery was an operator reordering the clients by hand. Why the wrong hypothesis survived three rounds is the second half of the rule: the EXIT trap removes the run directory with both captured streams, and the receipt held only an exit code, so rounds 122 and 123 left six receipts with no codex record between them and nothing in the repository could contradict the size theory. RED-baseline (applied): eight assertions written against the unchanged wrapper each fail on the row they name; four single-predicate mutations then turn exactly their predicted rows red and no others -- removing the top-level restriction reds the two rows proving packet-derived text cannot classify, removing redaction reds the two redaction rows, removing the bound reds the truncation row, and restoring the stderr-only grep reds the two event-stream rows. Two rows are green on the unchanged baseline by construction and it is the mutations, not the rows, that establish their meaning. Recorded because each cost a red rather than being reasoned out: a heredoc nested in a command substitution is scanned by Bash 3.2 for shell quoting, so an apostrophe in a comment inside it ends the parse of the whole script; and a fixture carrying a literal credential-shaped value is refused by this repository's own credential scanner, which is the scanner behaving correctly. |
+| A redactor guarding an evidence excerpt keys on the SHAPE of an assignment, not on a list of credential-sounding key names: the value of every `key=value` and quoted `"key": "value"` pair is removed whatever the key is called, while the key and any prose that is not assignment-shaped survive so the excerpt still says what failed | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/codex_review.sh | `updated` | Owner key `code-review/SKILL.md`. Observed failure, twice in one round on the same predicate: the first review chain found that anchoring a word boundary before the keyword made `access_token=` and `client_secret=` unmatchable, because `_` is itself a word character, and the list was widened; the succeeding chain's challenge then found `session=`, `cookie=`, `auth=`, `code=` and `bearer=` still missing, plus quoted JSON forms. Widening a third time was the obvious move and is the one this row rejects: a list of credential-sounding names has no state in which it is finished, so the recurrence is evidence that the predicate is a proxy rather than the invariant. The list is deleted. What replaces it does not read the key at all. The cost is real and accepted: an informative `error=timeout` loses its value too, which is why the key is preserved rather than the whole pair, and why prose is left alone -- the message this round exists to classify contains no assignment and passes through whole, verified against the live condition rather than argued. RED-baseline (applied): a fixture carrying six unlisted key names and two quoted forms fails against the widened list and passes against the shape rule, and it is the only row that moves. Recorded because it cost a red rather than being reasoned out: this gate judges per commit, so a register row for an owner package must land in the same commit as the package change, not in a later one. |
+| When a failure destroys its own evidence, the fix is to stop destroying it, not to copy an excerpt somewhere durable: the run directory holding the captured streams survives a failed run and the receipt names it, while the receipt itself carries only the transport's own error message. Arbitrary process output never reaches a committed artifact, so no filter over it has to be complete | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/codex_review.sh | `updated` | Owner key `code-review/SKILL.md`. This supersedes the excerpt-plus-redactor shape two rows above, and the reason is measured rather than argued: three review chains each found a different escape from the same filter -- a key name the list lacked (`access_token`), an assignment form the shape rule lacked (`session=`, quoted JSON), and URL userinfo, which is not an assignment at all. Replacing the name list with a shape rule was recorded as an invariant change and was not one: names and shapes are both enumerations of how a secret might look, so the recurrence continued. The predicate was never completable, because the input was arbitrary process output and the property wanted of it -- that nothing secret-shaped survives -- is not decidable. What ends it is removing the input: raw stderr has no path into the receipt. The original defect was also misread on the way in. `RUN_ROOT` is deleted by the EXIT trap, so the streams that named the cause were gone at the moment the cause became interesting; the minimal repair for that is to keep the directory on failure, which also leaves the whole streams for diagnosis rather than 600 redacted bytes. The directory is mode 0700 under TMPDIR and holds exactly what it held while the run was in flight, so nothing is exposed that was not already, and reclaiming it stays the platform's temp-directory lifetime. Stated limit, not claimed away: a CLI-authored error message can still echo a credential, so the redaction stays as defence in depth -- it is no longer the control the safety rests on. RED-baseline (applied): restoring the stderr fallback reds the row asserting stderr is not quoted; deleting the directory on failure reds the two preservation rows; dropping the userinfo strip or the quoted-value alternation reds the shape row; each mutation reds only its own rows. The redaction fixtures were moved onto the event stream in the same change, because on stderr they would have asserted nothing under the new design. |
+| A test fixture that only LOOKS like a credential is still a credential to every scanner that guards a boundary, so a fixture exercising a redactor assembles its credential-shaped values at runtime rather than writing them into the repository | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | `updated` | Owner key `code-review/SKILL.md`. Observed twice in one round against two different guards. A literal `sk-` token in the fixture was refused by this repository's own credential scanner in `validate-skill.sh`, turning `make test` red. A URL written with credentials in its userinfo component, in the same fixture, was later refused by the review gate's egress tripwire, which returned `egress_denied` and stopped the review lane before any reviewer ran -- and would have done so on every later review of this repository, because the fixture lives in the tracked tree that every packet carries. Both guards were behaving correctly; the fixture was the defect. Approving the egress by flag was available and rejected: it would spend a real control on synthetic data and teach the flag as routine. Assembling the value inside the fixture at runtime keeps the test at full strength -- the wrapper still sees the whole shape -- while the shape never exists in a tracked file. RED-baseline (applied): the suite is green with the assembled value and the redaction rows still red under their mutations, and the literal form is absent from the tree. |
+| A test that reads a path out of a receipt expands it before touching the filesystem: a path recorded with the home directory elided is correct in the receipt and meaningless to a filesystem check, so the check false-REDs on exactly the hosts where the eliding fires | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | `updated` | Owner key `code-review/SKILL.md`. Raised by the landing review and confirmed by hand rather than reasoned about: with TMPDIR under the home directory the wrapper records `transport_run_dir` as `~/.cache/.../codex-review.9YWG3E`, and the assertion's `[ -d ... ]` then tests a literal tilde path. The failure mode is a false RED, never a false GREEN, which is why it is a portability defect rather than a correctness one -- but a shared suite that reds on someone else's machine costs them the same time it would cost here. The suite's own TMPDIR is not under the home directory, so no row exercises the expansion; the tilde form was reproduced directly against the wrapper instead, and that is the evidence, not a suite row. |
+| Eliding a home directory out of a persisted path compares PHYSICAL paths on both sides, not the literal environment variable: a home spelled with a trailing slash, or reached through a symlink, is the same directory, and a literal comparison leaves the username in the artifact on exactly the hosts that spell it differently | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/codex_review.sh | `updated` | Owner key `code-review/SKILL.md`. Raised by the landing challenge against the eliding this round had just added, and it is the same class the round spent three chains on in a different place: matching one spelling of a thing is not matching the thing. `cd \| pwd -P` on both sides normalizes trailing slashes and symlinks in one move rather than enumerating the ways a path can be written, and the redactor gets the same treatment through a set of home spellings applied longest-first. RED-baseline (applied): a row exporting a home with a trailing slash and a TMPDIR beneath it reds against the literal comparison and greens against the physical one, and reverting only the physical resolution reds that row alone. Recorded because it cost a red: the suite's `run_codex` helper pins TMPDIR, so a row needing a TMPDIR under a specific home has to invoke the wrapper directly instead of through the helper -- the helper silently won, and the row failed for a reason that had nothing to do with the fix. |
+| A guard's fixture must be inert to every OTHER rule in the same pipeline, or the guard cannot fail when its own rule is deleted: a secret shaped like a neighbouring rule's input is removed by that neighbour, and the row stays green over the hole it was written to watch | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | `updated` | Owner key `code-review/SKILL.md`. Found by the landing challenge, not by the mutation pass that was supposed to catch exactly this: the row guarding the URL query strip used `?token=abc123`, which the assignment redactor rewrites on its own, so deleting the query strip left the row green and a bare non-assignment query secret would have reached a committed receipt with no red row anywhere. The earlier mutation run did remove the query strip and did report the row red -- but that run predated the assignment redactor, so the coverage it proved expired when a later rule was added and nothing re-established it. That is the reusable part: a mutation result is evidence about the pipeline as it stood, and adding a rule can silently subsume a neighbour's fixture. RED-baseline (applied, after the fixture was changed to a non-assignment shape): deleting the query strip reds that row alone, and the unmutated control is green. |
+| A rule that strips a delimited region consumes to the LAST delimiter the region can legally contain, not the first: URL userinfo may itself contain the separator, so a non-greedy strip leaves the tail of the secret behind | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/codex_review.sh | `updated` | Owner key `code-review/SKILL.md`. Fourth consecutive chain to find something in the same defence-in-depth redactor, and the count is the point rather than the individual defect: the class is bounded only because the redactor is no longer what the safety rests on -- raw process output has no path into a committed receipt, so what remains is a narrowing series of improvements to a secondary control rather than an open hole. This one: excluding the separator from the consumed class stopped the strip at the first one, so a password containing a literal separator left its tail. Consuming greedily to the last separator before the path boundary closes the whole shape rather than the one spelling that was reported. RED-baseline (applied): a fixture whose password contains the separator reds against the non-greedy rule and greens against the greedy one, and reverting only that character class reds that row alone. |
+| A fixture built to exercise a redactor is chosen so that no PART of it reads as a different sensitive shape: a reviewer quoting the finding puts the fixture into a committed receipt, where every other content gate then reads it | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | `updated` | Owner key `code-review/SKILL.md`. Third distinct guard this round has tripped on its own test data, after the credential scanner and the egress tripwire. The userinfo fixture needed a password containing the separator; with a dotted host, the tail of that password plus the host reads as an email address, and the public-sanitization gate refused the receipt a reviewer wrote it into. A host without a dot exercises the same wrapper behaviour and forms no such shape. The reusable part is the indirection: the fixture is not what the gate scans -- the receipt is, and its content is chosen by a reviewer quoting the fixture, so the fixture has to be clean under every gate rather than under the one it was written for. Also recorded here because it cost a full CI round: `check-public-sanitization.py` and `review_ledger_binding.py` run in CI's repository-gates job and are absent from `make test`, so a green local run is not evidence about those two. |
+| A fixture that FAILS TO PRODUCE its input turns every assertion reading that input green, so a change to a fixture is verified by observing the input it emits, not by the suite's exit status: a green suite is exactly what a dead fixture produces | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | `updated` | Owner key `code-review/SKILL.md`. Landed and caught by the next review round, which is the honest record: an edit to the fixture indented one statement inside an embedded interpreter block, the interpreter died before emitting anything, the wrapper fell through to its no-output placeholder, and five redaction assertions passed over a placeholder while the suite reported its success token. The mutation evidence recorded for those rows was true when taken and had silently expired. Two rules follow, and the second is the one that would have caught it: after changing a fixture, observe the input it now emits; and re-run the mutation for the rows that fixture feeds rather than citing the earlier run. RED-baseline (applied, after the indentation was corrected): removing the redactor reds all five rows and the unmutated control is green -- which is the check that was missing, because the same removal against the broken fixture left all five green. |
+| A value used as a redaction NEEDLE is rejected when it is only structure: a home directory of `/` is a legitimate environment and a catastrophic needle, because replacing it rewrites every separator in the text and disables every rule that runs after it | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/codex_review.sh | `updated` | Owner key `code-review/SKILL.md`. Raised by the landing review against the normalization the previous round added: gathering every spelling of the home directory is right, but a spelling that carries no content is not a path to elide. With `HOME=/` -- root, or an arbitrary-uid container -- the needle set contained `/`, the replacement ran before the URL rules, and the excerpt came out mangled with its credentials intact. The general shape is that a needle derived from the environment needs a content test, not only a presence test. RED-baseline (applied): a row invoking the wrapper with `HOME=/` reds without the content test and greens with it, and removing only that test reds that row alone. |
+| A filter over free text in a persisted artifact is replaced by having no free text: "nothing secret-shaped survives" is not decidable over arbitrary text, so an adversarial reviewer can always spell one more escape, and the terminal state is a constant the input cannot influence rather than a filter that keeps growing | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/codex_review.sh | `updated` | Owner key `code-review/SKILL.md`. The measurement is the row: eight review chains after the input was already narrowed to CLI-authored error messages, each found a different escape -- an unlisted key name, an assignment form, URL userinfo, a password containing the separator, a fixture whose own shape tripped a neighbouring gate, an escaped quote closing a quoted value early, an uppercase scheme, a separator-only home used as a needle. Every one was real and none was derivable from the previous one. Two intermediate diagnoses were wrong on the way and are recorded above: swapping a key-name list for an assignment-shape rule was called an invariant change and was another enumeration, and narrowing the input was called sufficient when it only slowed the rate. What ends the class is that the receipt now carries a constant and the transport's output stays in the preserved run directory. The property is stated as equality with that constant, which a test can hold, instead of the absence of a list of shapes, which no test can. RED-baseline (applied): echoing the extracted message into the receipt reds the invariant row, and the unmutated control is green. Cost, recorded because the next round should be able to weigh it: each chain was roughly twelve minutes of wall clock, and the merge gate accepts no open challenge finding, so there was no landing state that carried the residue. |
+| A fixture string is read by every scanner in the repository, not only by the suite it belongs to, so it is chosen to be inert under all of them: a host:port that exists only inside a quoted test payload still reads as a listening port to a lane-isolation scanner | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | `updated` | Owner key `code-review/SKILL.md`. Fourth guard this round to reject the round's own test data, after the credential scanner, the egress tripwire and the public-sanitization gate. The userinfo fixture carried a port it never needed, and the parallel-lane isolation scanner reads any host:port in a lane member as evidence that concurrent suites could race on it. Dropping the port exercises the same wrapper behaviour. Recorded as one rule with the three before it: the cost of learning this one guard at a time was a full verification cycle each, and the cheaper order is to sweep every local gate after touching a fixture, before spending a review chain on the candidate. RED-baseline (applied): `test_lane_isolation.py` reds on the ported form and greens on the bare host, with the wrapper suite green either way -- which is why the suite alone was not evidence. |

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py

@@ -299,12 +299,17 @@ def added_evidence_paths(repo_root: Path, base: str) -> list[str]:
     """
     result = subprocess.run(
         [
-            "git", "-C", str(repo_root), "diff", "--name-only",
+            "git", "-C", str(repo_root), "diff", "--name-only", "-z",
             "--diff-filter=A", base, "HEAD", "--", EVIDENCE_ROOT,
         ],
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE,
+        # A pathname is bytes, and -z hands them over raw. Strict decoding would
+        # turn one undecodable filename into a crash inside a gate whose job is
+        # to fail cleanly, so undecodable bytes survive as surrogates and simply
+        # do not match the evidence pattern.
         text=True,
+        errors="surrogateescape",
         check=False,
     )
     if result.returncode != 0:
@@ -313,14 +318,47 @@ def added_evidence_paths(repo_root: Path, base: str) -> list[str]:
             f"{result.stderr.strip()}"
         )
     excluded: list[str] = []
-    for line in result.stdout.splitlines():
-        if not EVIDENCE_MEMBER.match(line):
+    # -z output is NUL-separated and never C-quoted, so a path carrying a
+    # non-ASCII byte is enumerated as itself rather than as an escaped literal
+    # that no pattern here would match.
+    for line in result.stdout.split("\0"):
+        if not line or not EVIDENCE_MEMBER.match(line):
             continue
         if is_candidate_receipt(repo_root, line):
             excluded.append(line)
     return excluded
 
 
+def bound_evidence_paths(repo_root: Path, base: str) -> list[str]:
+    """Evidence this round ADDS that stays inside the candidate.
+
+    The complement of the exclusion, reported when nothing binds. Committing one
+    of these after the review rounds moves the candidate out from under their
+    receipts, and the failure that surfaces -- nothing binds -- names neither the
+    file nor the ordering. This class has now been observed three times; the
+    diagnosis belongs where the failure appears, not in a document the round has
+    to know to open.
+    """
+    result = subprocess.run(
+        [
+            "git", "-C", str(repo_root), "diff", "--name-only", "-z",
+            "--diff-filter=A", base, "HEAD", "--", EVIDENCE_ROOT,
+        ],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        errors="surrogateescape",
+        check=False,
+    )
+    if result.returncode != 0:
+        return []
+    return [
+        line
+        for line in result.stdout.split("\0")
+        if line and EVIDENCE_MEMBER.match(line) and not is_candidate_receipt(repo_root, line)
+    ]
+
+
 def is_candidate_receipt(repo_root: Path, path_value: str) -> bool:
     """Whether the committed blob at this path is a receipt about a candidate.
 
@@ -405,14 +443,14 @@ def candidate_hash(module: types.ModuleType, repo_root: Path, base: str, paths:
         paths=list(paths),
         wording_only_proof_file=None,
     )
-    packet_path, packet_sha256, _paths, _secrets = module.freeze_packet(
+    packet_path, _packet_sha256, candidate_sha256, _bytes, _paths, _secrets = module.freeze_packet(
         args, time.monotonic() + 120
     )
     try:
         Path(packet_path).unlink(missing_ok=True)
     except OSError:
         pass
-    return packet_sha256
+    return candidate_sha256
 
 
 def canonical_digest(value: object) -> str:
@@ -1094,6 +1132,19 @@ def bind_candidate(
             "  no committed ledger records this candidate; run the extraction review "
             "lane against the final, committed tree"
         )
+    inside = bound_evidence_paths(repo_root, fork)
+    if inside:
+        binding.failure.append(
+            "  this round added evidence that stays inside the candidate: "
+            + ", ".join(inside[:5])
+            + ("" if len(inside) <= 5 else f", and {len(inside) - 5} more")
+        )
+        binding.failure.append(
+            "  only added JSON carrying a candidate_sha256 is excluded, so bound "
+            "evidence such as base attestations and excerpts must be committed "
+            "BEFORE the review rounds; committing it after moves the candidate out "
+            "from under their receipts"
+        )
     return binding
 
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh

@@ -36,6 +36,12 @@ assert_contains "$PRODUCT_SKILL" 'gaps block `complete`' "product workflow gate
 assert_contains "$PRODUCT_SKILL" "references/implementation-completeness-and-minimality.md" "product workflow pointer"
 assert_contains "$PRODUCT_REF" "Requirement / acceptance point | Source decision | Implementation surface | Verification | Fresh evidence | Status" "acceptance closure matrix"
 assert_contains "$PRODUCT_REF" "New concept | Current acceptance point or hard constraint | Simpler alternative | Decision" "concept delta matrix"
+assert_contains "$PRE_FINAL_REF" "Awaiting work you started yourself is not a stop condition." "continuation gate (self-initiated in-flight work is not a stop)"
+assert_contains "$PRE_FINAL_REF" "is in-flight work rather than a handoff: wait for it and continue in the same turn" "continuation gate (in-flight obligation)"
+assert_contains "$PRE_FINAL_REF" "Before ending any turn, name the next action; if you can perform it now, the turn is not over." "continuation gate (turn-end firing check)"
+assert_contains "$PRODUCT_SKILL" "poll any finite step you started to its result, never reporting it as running" "continuation gate (entry firing signal)"
+assert_contains "$PRE_FINAL_REF" "is \`continuing:\`, never \`blocked:\` and never a final response. Poll it to a terminal result" "continuation gate (outcome-contract clause)"
+assert_contains "$PRE_FINAL_REF" "has no terminal result to wait for: take its readiness signal and proceed" "continuation gate (persistent-process exception)"
 assert_contains "$PRODUCT_REF" "Passing one question never compensates for failing the other." "independent axes"
 assert_contains "$PRODUCT_REF" 'An implementer may not silently downscope a point' "no self-downscope"
 assert_contains "$PRODUCT_REF" 'hypothetical reuse are not evidence' "no speculative concepts"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh

@@ -903,6 +903,74 @@ else
     '{ [ "$real_rc" = 0 ] && { case "$real_out" in [0-9a-f]*) [ ${#real_out} = 64 ];; *) false;; esac || case "$real_out" in *review_ledger_binding_no_change*) true;; *) false;; esac; }; } || { [ "$real_rc" = 1 ] && case "$real_out" in *"cannot freeze the candidate packet"*"review packet exceeds 200000 bytes"*) true;; *) false;; esac; }'
 fi
 
+# The point of splitting the candidate from the packet is that a round which
+# widened its packet to answer an evidence-gap finding still produces a receipt
+# this gate can accept. That claim spans both sides, so it is asserted across
+# both: the identity the controller records for a widened packet must be the
+# identity this gate recomputes from the repository. Mutate the gate to return
+# the packet hash instead and this goes red while nothing else does.
+printf 'widened-candidate\n' >>"$REPO/skills/skill-extraction-workflow/SKILL.md"
+git -C "$REPO" add -A
+git -C "$REPO" commit -qm widened
+WIDENED_BASE="$BASE"
+GATE_CANDIDATE="$(run_gate --base "$WIDENED_BASE" --print-candidate)"
+controller_candidate="$(
+CONTROLLER_DIR="$(dirname "$CONTROLLER")" REPO="$REPO" BASE="$WIDENED_BASE" \
+  GATE="$GATE" WORK="$WORK" python3 - <<'PY' 2>&1
+import importlib.util
+import os
+import sys
+import time
+from pathlib import Path
+from types import SimpleNamespace
+
+sys.path.insert(0, os.environ["CONTROLLER_DIR"])
+import review_gate
+
+spec = importlib.util.spec_from_file_location("binder", os.environ["GATE"])
+binder = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(binder)
+
+repo = Path(os.environ["REPO"])
+# An author cannot hand-build these: the base is a fork point and the paths
+# carry the receipt exclusions this round already added. Both come from the gate
+# that will judge the receipt, which is what makes it one identity.
+base, _excludes, paths, _changed = binder.candidate_scope(
+    repo, os.environ["BASE"], (".",)
+)
+
+
+def freeze(**overrides):
+    args = SimpleNamespace(
+        cwd=str(repo),
+        diff_file=None,
+        base=base,
+        paths=list(paths),
+        wording_only_proof_file=None,
+    )
+    for key, value in overrides.items():
+        setattr(args, key, value)
+    return review_gate.freeze_packet(args, time.monotonic() + 60)
+
+
+narrow_path, _narrow_packet, narrow_candidate, _n, _p, _s = freeze()
+subject = narrow_path.read_bytes()
+narrow_path.unlink()
+
+# Outside the repository: the candidate includes untracked files.
+widened = Path(os.environ["WORK"]) / "widened-for-binder.patch"
+widened.write_bytes(subject + b"\n--- appended context for the reviewer ---\n")
+wide_path, wide_packet, wide_candidate, _wn, _p, _s = freeze(diff_file=str(widened))
+wide_path.unlink()
+
+assert wide_packet != wide_candidate, "the widened packet must not be its own candidate"
+assert wide_candidate == narrow_candidate, "widening moved the candidate"
+print(wide_candidate)
+PY
+)"
+check "a widened packet records the candidate identity this gate recomputes" \
+  '[ ${#GATE_CANDIDATE} = 64 ] && [ "$controller_candidate" = "$GATE_CANDIDATE" ]'
+
 if [ "$fails" -gt 0 ]; then
   echo "test_review_ledger_binding: $fails failing case(s)" >&2
   exit 1

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/ci-fixtures-and-flake-control.md

@@ -89,6 +89,20 @@ When claiming tests pass, report:
 
 Do not report "tests pass" from memory or from a previous turn. Verification must be fresh for the current change.
 
+## Evidence-Record Integrity For Measurement Harnesses
+
+Fires when the deliverable is a harness whose RECORDS are the evidence — an evaluation or benchmark runner, a conformance suite feeding a comparison, an A/B or regression measurement rig — rather than a suite whose deliverable is pass/fail. Reached as a failure class from `scenario-testing.md` (High-Risk Failure Classes). Such a harness can be corrupted by the data it produces, in three ways that all read green. Build the record layer against these before the happy path; retrofitting means re-judging records already collected. This is one layer upstream of the entry rule that assigns absence assertions to the producing layer: that rule says where absence can be PROVEN, these say whether the record can express WHICH absence occurred at all.
+
+- **Absence carries a coded reason beside the value — never a bare null, never a new value-type.** One null cannot say whether the thing was confirmed not to exist or was never observed, and here those are opposite facts: the first is a result about the system under measurement, the second is a hole in the measurement. Put the reason in a sibling field from a closed vocabulary separating at least *confirmed absent*, *asked but unavailable*, and *not attempted* — they imply opposite retry decisions, so collapsing them also destroys the scheduling signal. Keep it beside the value, not inside its type: the relational model's own two-marker proposal (missing-but-applicable vs missing-but-inapplicable) needed four-valued logic and was never widely adopted, while the health-interchange standard's data-absent-reason coding works because it is an adjacent field only its readers pay for. Make the claim cost evidence — accept *confirmed absent* only with the retrievable observation that established it, or a writer clears a failure by asserting absence. And give absence its own assertion: a threshold over values cannot see a series that is not there, which is why a monitoring query language needs a dedicated absent-vector operator to alert on a series that stopped arriving.
+- **Report the flow counts per compared arm, not only per run; caps are the secondary control.** Planned units, extra attempts, and blocked units must be separately counted and reported, so a reader can check the denominator instead of trusting a label — and broken out per arm or per analysis being compared, together with the mix of absence reasons. A run-level total hides the asymmetry that is precisely the bias below: ten blocked units on one side and none on the other reads green in the totals while the comparison is already spoiled. Controlled-trial reporting guidance is explicit that the denominator belongs to *each group* in *every* analysis, not to the study as a whole; it also dropped the requirement to *declare* an analysis intention-to-treat — because no label reliably says who was actually included — and replaced it with that required flow of numbers. Keep caps, but a cap nobody can audit against reported counts is a claim, not a control.
+- **Retain the earliest decisive outcome; record why later attempts happened.** A retry must not replace a failure that already occurred. Keep every attempt and let a unit's recorded outcome be the earliest decisive one — including a failure that first appears on a later attempt after an inconclusive earlier one. Trial reporting is again the shape to copy: post-hoc change is not forbidden, it is required to be reported with its reason. An automatic retry that overwrites the first attempt produces exactly this corruption: the symptom is hidden, the run still reports itself complete, and the reported pass rate stops being a number a release decision can rest on.
+
+Why this is not cosmetic: in a measurement harness missingness is rarely random — evidence is missing BECAUSE the run failed, the missing-not-at-random case — so dropping incomplete units biases the comparison toward whatever produced them.
+
+Verify by building the harness's own negative cases first: one unit per absence reason, one that spends an extra attempt, and one that fails and then succeeds. A harness that cannot distinguish those three in its own output is not ready to measure anything else. Route the online-signal form of the absence rule — a metric that stopped arriving versus one reporting zero — to `platform-observability`.
+
+Boundary: this is an assembled rule, not a named discipline. Measurement system analysis is the adjacent established field, and it covers instrument accuracy and repeatability, not record integrity.
+
 ## Conditional-Skip × Job-Selection Executed-Count Guards
 
 Strongest form — a per-file invariant: the expected-file list derives from the job's own selection manifest, per job/environment (static; never from post-skip collection, which already lacks the silently-skipped file, and never shared across env-split jobs where different files legitimately run), and each expected file collects AND executes > 0 tests, with a missing-optional-dependency skip a hard failure in the job that exists to provide that dependency, never an "expected skip".

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/scenario-testing.md

@@ -76,7 +76,7 @@ Use this matrix when a web or app surface contains many charts, grouped tables,
 
 ## High-Risk Failure Classes
 
-The risk matrix for a high-risk workflow covers the triggered failure classes from this canonical list: duplicate submit/callback/message/job restart, permission service uncertainty, cross-tenant/user/resource mismatch, partial money/quota side effects, AI provider/model failure, unclear final status after refresh/offline, and missing trace/support identifier. Cover each triggered class at the lowest layer that can prove the invariant.
+The risk matrix for a high-risk workflow covers the triggered failure classes from this canonical list: duplicate submit/callback/message/job restart, permission service uncertainty, cross-tenant/user/resource mismatch, partial money/quota side effects, AI provider/model failure, unclear final status after refresh/offline, and missing trace/support identifier. When the deliverable is itself a measurement harness — an evaluation or benchmark runner, a conformance suite feeding a comparison, an A/B or regression rig — its own record layer is a class of the same standing: absence reading as a pass, a retry moving the denominator, and a later attempt overwriting an earlier failure (`ci-fixtures-and-flake-control.md`, Evidence-Record Integrity For Measurement Harnesses). Cover each triggered class at the lowest layer that can prove the invariant.
 
 Cross-reference: `non-functional-specialized-scenarios.md` (High-risk resilience boundaries) states the launch-gate counterpart — which classes require scenario tests or drills at release. That is a gate-criteria list; this is the test-matrix failure-class list. The two complement each other and neither replaces the other.