@ccoalm/ccl-skills 0.16.0 → 0.17.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/SKILL.md

@@ -74,7 +74,7 @@ Positive challenge capacity opens it at index 1; budget zero is untracked.
 The sole release/high-risk budget-zero exception is a controller-proved
 `markdown-punctuation-only` review: it requires `wording_only_boundary`, permits
 no `complete`, and rejects an author assertion alone (recipe:
-`references/staged-review-contract.md`). After a clean/source-refuted tracked
+`references/wording-only-review.md`). After a clean/source-refuted tracked
 challenge, `complete` may close early and preserve unused rounds. Every result
 exposes controller-owned `self_review_gate`; an outstanding checkpoint blocks
 only external review or completion, not implementation or tests. Even a passed
@@ -280,7 +280,7 @@ For diffs over roughly 2,000 changed lines or 50 files, split review/challenge b
 
 Never treat a timeout, silence, or empty output as approval or "no findings": any timeout is inconclusive, and the final status must say `inconclusive` with the timeout reason so downstream review or merge state cannot treat the missing lane as approval. A live host execution handle such as `session_id` or `cell_id` means the same command is still running; poll that exact handle to terminal exit, and never start a replacement/fallback while its process is live. Do not use a 30 second silence as a review failure — narrow diff reviews legitimately take 2-3 minutes and broad reviews about 5. Challenge makes one formal Claude invocation; review and consult may make at most two only for their existing bounded result-recovery paths. After that, mark the Claude lane inconclusive and apply fallback only if the owning gate allows it. The wrapper traps TERM/INT/HUP and emits terminal `operator_interrupt`; the gate never starts another client after an operator interruption. SIGKILL and host crashes cannot be trapped, so non-zero exit without valid JSON remains inconclusive/manual-review-required, never as success. The timeout bound is per formal invocation, not per wrapper run; outer timeouts must cover the mode's worst case and must never kill the wrapper and then treat the killed output as success. For a yielded run, the caller's lane evidence records handle type, an opaque host transcript/tool-call reference rather than a raw credential-like handle, and terminal exit status. If that handle is lost, the lane is infrastructure-inconclusive/manual-review-required and no replacement or fallback may be started or credited; a `ps`/process-tree capture and wrapper artifacts are diagnostic only and cannot reconstruct the missing terminal result. The outer host assigns this handle after launch, so this is a host-workflow obligation rather than a controller-owned field; exact enforcement requires a trusted host adapter. Recovery detail and timing formulas live in `references/timeout-auth-and-capabilities.md`.
 
-`review_gate.sh` also enforces a cumulative reviewer-lane budget: `--total-timeout` defaults to 2400 seconds, accepts 5 to 3600, reserves ten controller seconds, and divides the remainder by the mode's maximum invocation count. Starting a lane requires at least 21 seconds for review or 16 for challenge, plus setup overhead; smaller accepted values fail closed. Git preflight subprocesses share this deadline; direct filesystem reads still need the host's outer timeout. A timed-out client process group gets bounded cleanup and may cascade only while enough total budget remains. Total exhaustion returns terminal inconclusive `gate_timeout`; killed output is never a verdict. Timing details live in `references/timeout-auth-and-capabilities.md`.
+`review_gate.sh` also enforces a cumulative reviewer-lane budget (`--total-timeout`), shared by git preflight but not by direct filesystem reads, which still need the host's outer timeout. Its default, range, reserved controller seconds, per-invocation division, and per-mode fail-closed minimums are in `references/timeout-auth-and-capabilities.md`. A timed-out client process group gets bounded cleanup and may cascade only while enough total budget remains. Total exhaustion returns terminal inconclusive `gate_timeout`; killed output is never a verdict.
 
 ## Auth And CLI Pitfalls
 
@@ -311,7 +311,8 @@ activation was observed; only a public event/export may populate
 
 ## Reference Loading
 
-- `references/staged-review-contract.md` — required review-plan schema, stage concerns, high-risk depth, prompt layers, and challenge budget. Load before review/challenge.
+- `references/staged-review-contract.md` — review-plan schema, stage concerns, high-risk depth, prompt layers, challenge budget. Load before review/challenge.
+- `references/wording-only-review.md` — the proof-bound wording-only single review. Load when claiming it.
 - `references/manual-invocation-and-prompts.md` — manual command shape, filesystem-boundary text, and the review/challenge prompt templates. Load only when debugging or patching the wrapper or its prompt construction.
 - `references/timeout-auth-and-capabilities.md` — wait-policy timing tables, the numbered auth-recovery procedure, per-mode tool-flag matrix, and CLI capability adoption notes. Load on timeout/auth failures or when maintaining wrapper flag adoption.
 - `references/client-routing.md` — `review_gate.sh` client order, family exclusion, egress, Kimi/Codex boundaries, OpenCode user-model binding, and concurrency rollback. Load when running or diagnosing review/challenge routing.
@@ -341,8 +342,9 @@ In the final work summary, include:
 - mode: review, challenge, complete, or consult
 - command scope, not the full prompt unless useful
 - result: blocking findings, no blocking findings, or inconclusive
-- the reviewed identity — a hash of the exact diff packet reviewed, **required** whenever the reviewed content includes staged, unstaged, untracked, or generated files (later worktree edits keep the same base/head SHA, so SHA alone cannot detect the change); the base/head commit SHA alone suffices only for a clean, fully-committed candidate tree. A review/challenge `no blocking findings` is valid **only** for that exact reviewed content: any later edit, rebase, amend, or new commit voids it and requires a fresh run (mirrors the agentic candidate-SHA binding). A caller — especially one invoking this skill standalone, outside a controller that already tracks the head SHA — must not reuse a prior pass as approval for changed content.
+- the reviewed identity — a hash of the exact diff packet reviewed, **required** whenever the reviewed content includes staged, unstaged, untracked, or generated files (later worktree edits keep the same base/head SHA, so SHA alone cannot detect the change); the base/head commit SHA alone suffices only for a clean, fully-committed candidate tree. A `no blocking findings` result is valid **only** for that exact content: any later edit, rebase, amend, or new commit voids it and requires a fresh run (mirrors the agentic candidate-SHA binding), and no caller — least of all one invoking this skill standalone, outside a controller tracking the head SHA — may reuse a prior pass as approval for changed content.
 - any follow-up fixes made because of the review
+- if `recurring_findings_design_check` fired, the `keep`/`delete`/`narrow`/`replace` decision, what it recurred across, and who ratified it
 - if skipped or inconclusive, the exact reason
 - for a host-yielded execution, the handle type, opaque host transcript/tool-call reference, and terminal exit status; if the handle was lost, record that infrastructure-inconclusive state, diagnostic artifacts, and that fallback was unavailable; never persist a credential-like raw handle in shared evidence
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/staged-review-contract.md

@@ -58,7 +58,12 @@ hand-attested plan (`review_plan_source=implementer-supplied` otherwise).
 Self-review accumulates stage concerns: explore covers correctness and
 safety; build adds failure paths, tests, and compatibility; release adds rollout
 and operations. High-risk input raises depth to release and adds
-`high_risk_boundary`.
+`high_risk_boundary`. That set has one owner, and
+`review_gate.sh --print-required-concerns --stage <stage> [--risk-tag <tag>]`
+prints it, so a caller building a plan derives the list instead of keeping a copy
+that silently stops satisfying the gate when the set changes. It prints what the
+PLAN owes: the synthetic challenge slot and the wording-only boundary, which the
+controller adds for the reviewer and never for the plan, are absent.
 
 The serialized plan is at most 32,000 bytes and `intent` is 8..4,000
 characters. Those are validation limits, not permission for a caller to slice a
@@ -168,6 +173,28 @@ top-level agents, commands, hooks, or MCP servers is not loaded.
 Wrappers keep an explicit selected-owner count instead of testing empty Bash
 arrays under `set -u`, preserving the no-owner lane on Bash 3.2.
 
+### The claim-strength walk, and why the late correction is not cheaper
+
+`claim_strength` is a required self-review concern at build and release depth. The
+plan walks the candidate's load-bearing claims — absolutes, universals, causal
+statements, exhaustiveness — and for each one either names evidence that would
+survive a challenge or weakens the claim on the spot. It is owed before round 1
+because that is the only point in a round where correcting a claim is free: once a
+round binds the candidate, an edit inside a selected owner package voids every
+receipt bound to it, so a sentence that claims too much costs exactly what a changed
+predicate costs. The concern also reaches the reviewer, so a claim that survives the
+walk comes back as a round-1 finding — inside the fix batch the round was going to
+pay for anyway — rather than at closeout, where the remaining moves are a fresh chain
+or leaving it standing.
+
+There is deliberately no cheap late path. The proof-bound single review
+(`wording-only-review.md`) refuses any changed non-punctuation character, which is
+exactly what weakening a claim is, and an exception keyed on the author's own "this
+edit only weakens a claim" is an assertion the controller cannot re-derive — a waiver
+of that shape was carried here once and removed, because a predicate that approximates
+meaning keeps admitting shapes it did not anticipate. The price stays uniform in both
+directions; the walk is what moves the correction to where the price is zero.
+
 ## Base-derived packet input boundary
 
 `--base` freezes the tracked diff plus every non-ignored untracked path in
@@ -226,126 +253,9 @@ later round read more than an earlier one.
 
 ## Proof-bound wording-only single review
 
-The wording-only exception is one untracked `review` with
-`challenge_budget=0`; it is not a chain, challenge, or `complete` checkpoint.
-Supply `--wording-only-proof-file` to bind the exception to the exact packet.
-Without that proof, an explore/build budget-zero review remains an ordinary
-single review and cannot be recorded as the wording-only exception;
-release/high-risk budget zero fails before inference.
-
-At release depth, including depth raised by a high-risk tag, only a
-controller-proved `markdown-punctuation-only` check may use this exception.
-`markdown-token-replacement` remains available for explore/build budget-zero
-review, but it cannot waive the release/high-risk challenge: byte-exact token
-replacement does not prove that the old and new tokens have the same meaning.
-
-The proof is a single-link regular UTF-8 JSON file of at most 16,000 bytes:
-
-```json
-{"schema_version":1,"candidate_sha256":"<packet-sha256>","check":{"kind":"markdown-punctuation-only"}}
-```
-
-The other fixed check is
-`markdown-token-replacement`, whose `check` also contains `old_token`,
-`new_token`, and integer `expected_count` (1..100). The controller never trusts
-a caller-supplied pass result. It reparses the frozen packet and derives the
-status, files, changed-line count, replacement count, and scope SHA-256.
-
-The accepted packet is deliberately narrow: a canonical full-context unified
-Git diff, LF-terminated, at most 200,000 bytes, changing existing regular
-Markdown files inside exactly one existing non-linked skill package. Every
-file's first hunk starts at line 1 so frontmatter is inspectable. Adds,
-deletes, renames, multi-skill changes, frontmatter or `description` edits,
-non-regular Git modes, custom/compact packets, extra context outside the diff,
-and files without a final newline fail closed. `markdown-punctuation-only`
-accepts only one-for-one plain-prose line replacements whose non-punctuation
-characters remain identical; numeric tokens must additionally survive
-byte-for-byte (deleting the dot in `5.5` is a threshold change, not
-punctuation), and a question mark may not be added or removed (a statement
-turned into a question is a meaning change). Lines must start at column zero
-and contain prose; line adds/deletes, Markdown headings, lists, block quotes,
-links, tables, inline code, fenced or indented code, and raw HTML `pre`/`code`
-containers fail closed. `markdown-token-replacement` requires every changed
-line pair to differ only by the named whole-token replacement, with the exact
-total count, and rejects packets whose changed lines touch a Markdown or HTML
-code container.
-
-This recipe produces the exact packet and proof without a second parser or a
-pretend verifier command. Set `WORDING_KIND=markdown-punctuation-only`, or set
-`WORDING_KIND=markdown-token-replacement` plus `WORDING_OLD`, `WORDING_NEW`, and
-`WORDING_COUNT`:
-
-```bash
-: "${CODE_REVIEW_SKILL_DIR:?set the installed code-review skill directory}"
-: "${REPO_ROOT:?set the absolute repository root}"
-: "${REVIEW_BASE:?set the exact base ref}"
-: "${SKILL_NAME:?set the one existing skill package name}"
-: "${REVIEW_STAGE:?set explore, build, or release}"
-: "${IMPLEMENTER_FAMILY:?set the implementer model family}"
-: "${REVIEW_PLAN_FILE:?set the absolute review-plan JSON path}"
-: "${REVIEW_EVIDENCE_DIR:?set an existing durable private evidence directory}"
-: "${WORDING_KIND:?set one supported wording-only check kind}"
-
-umask 077
-WORDING_RUN_DIR="$(mktemp -d "$REVIEW_EVIDENCE_DIR/wording-review.XXXXXX")" || exit 1
-WORDING_DIFF="$WORDING_RUN_DIR/candidate.diff"
-WORDING_PROOF="$WORDING_RUN_DIR/proof.json"
-WORDING_RESULT="$WORDING_RUN_DIR/review.json"
-
-git -C "$REPO_ROOT" diff --no-color --no-ext-diff --no-textconv --full-index \
-  --src-prefix=a/ --dst-prefix=b/ --unified=1000000 \
-  "$REVIEW_BASE" -- "skills/$SKILL_NAME" >"$WORDING_DIFF" || exit 1
-
-python3 - "$WORDING_DIFF" "$WORDING_PROOF" "$WORDING_KIND" \
-  "${WORDING_OLD:-}" "${WORDING_NEW:-}" "${WORDING_COUNT:-0}" <<'PY'
-import hashlib
-import json
-import sys
-from pathlib import Path
-
-diff_path, proof_path = map(Path, sys.argv[1:3])
-kind, old, new, count = sys.argv[3:]
-check = {"kind": kind}
-if kind == "markdown-token-replacement":
-    check.update(old_token=old, new_token=new, expected_count=int(count))
-elif kind != "markdown-punctuation-only":
-    raise SystemExit("unsupported WORDING_KIND")
-payload = {
-    "schema_version": 1,
-    "candidate_sha256": hashlib.sha256(diff_path.read_bytes()).hexdigest(),
-    "check": check,
-}
-proof_path.write_text(
-    json.dumps(payload, ensure_ascii=False, separators=(",", ":")) + "\n",
-    encoding="utf-8",
-)
-PY
-
-WORDING_RISK_ARGS=()
-for tag in ${REVIEW_RISK_TAGS:-}; do WORDING_RISK_ARGS+=(--risk-tag "$tag"); done
-if ! bash "$CODE_REVIEW_SKILL_DIR/scripts/review_gate.sh" \
-  --mode review --stage "$REVIEW_STAGE" --challenge-budget 0 \
-  --cwd "$REPO_ROOT" --diff-file "$WORDING_DIFF" \
-  --review-plan-file "$REVIEW_PLAN_FILE" \
-  --wording-only-proof-file "$WORDING_PROOF" \
-  ${WORDING_RISK_ARGS[@]+"${WORDING_RISK_ARGS[@]}"} \
-  --implementer-family "$IMPLEMENTER_FAMILY" >"$WORDING_RESULT"; then
-  cat "$WORDING_RESULT" >&2
-  exit 1
-fi
-cat "$WORDING_RESULT"
-```
-
-A valid result carries `wording_only_proof_sha256`, controller-derived
-`wording_only_scope.status=passed`, and a reviewed
-`wording_only_boundary` concern. That concern independently confirms the edit
-changes no trigger, scope, routing, validation, acceptance, rule, threshold,
-boundary, frontmatter, description, or other meaning. If it is missing,
-inconclusive, or reports a possible semantic change, the wording-only exception
-does not apply: use the normal challenge and behavioral-evidence path. Any
-candidate edit regenerates the packet and proof and requires a new review.
-Keep the diff, proof, and result together; a digest whose source artifact was
-deleted is not independently auditable evidence.
+The wording-only exception — its depth limits, the proof schema, the accepted
+packet, the recipe that produces both, and how a valid result is read — is
+specified in `wording-only-review.md`.
 
 ## Agent review chain
 
@@ -362,8 +272,10 @@ index 1; an untracked initial review is single-round and therefore uses budget 0
 candidate can never be challenged inside it. One succeeding chain may open at
 index 1 in `challenge` mode by supplying `--predecessor-chain-result-file` — the
 ended chain's terminal receipt — instead of an in-chain prior result. The
-controller accepts it only when that receipt is a tracked challenge at its own
-chain's terminal index, carries this chain's `review_scope_sha256` and matching
+controller accepts it only when that receipt is the tracked round its chain ended
+on — a terminal challenge, or a round-1 review whose own
+arithmetic still reports its challenge unspent — carrying this chain's
+`review_scope_sha256` and matching
 stage/depth/risk-tags/budget, preserves the controller digest, owner-selection
 source, and selected owner names, and binds a candidate that DIFFERS from this
 packet: the owner-package digest is the one binding allowed to move, because its
@@ -375,6 +287,24 @@ differ from every focus the ended chain spent. The result records
 satisfied self-review trigger. Succession carries history rather than resetting
 it: consumers still sum rounds across both chains.
 
+A chain ends where the candidate moves, and a fix applied straight after the review
+moves the owner digest exactly as one applied after the challenge does. Requiring a
+challenge receipt here never protected the landing candidate — the succession
+challenge binds that either way — it only forced the challenge to be spent on a
+candidate the author had already decided to replace. The single class that stops
+being owed is a challenge on a candidate that will never land, which carries no
+evidence about the one that does; every other binding is unchanged, the candidate
+must still have moved, succession still does not compose, and this path spends
+fewer rounds than the old one, never more. What bounds it is the receipt's own arithmetic, and that is a
+forgery guard rather than a history check: a genuine round-1 review reads the same
+whether its chain later ran a challenge or not, so a caller who spent the challenge
+and presents only the review is accepted, and the successor inherits no challenge
+focuses — a focus that chain did spend can be spent again. This is the same
+omitted-history boundary the rest of this contract states rather than a new one, and
+the closeout validator's ordered receipt set is where a retained challenge receipt
+would show it; no check at the succession call site can close it, and none is
+claimed.
+
 The chain binds task scope, candidate identity per round, result hashes, mode,
 status, challenge focus, controller, and selected owners. The opaque
 `review_scope_sha256` always hashes normalized intent, acceptance, stage/depth,
@@ -430,6 +360,26 @@ checkpoint, and before a completion claim. Findings never produce a blind
 review-fix-review loop: they block another reviewer call, return to implementer
 triage, and still allow implementation, tests, and independent runnable work.
 
+**Findings that come back are a design question.** When a round returns findings and
+the history it carries already holds one — an earlier round of this chain, or the
+predecessor chain a succession names — the gate adds
+`recurring_findings_design_check` to the required triggers and
+`decide_keep_delete_narrow_replace` to the allowed actions. It blocks nothing that
+`findings_returned` does not already block; what it adds is the question the next
+patch would walk past: whether the reviewed surface should exist in this shape at
+all, answered as `keep`, `delete`, `narrow`, or `replace`, resting on the rounds and
+findings it recurred across, and ratified by a risk owner other than the one
+proposing it. `../../skill-extraction-workflow/SKILL.md` owns that rule; this is where
+it fires, because the situation arises inside a chain and that skill is usually not
+loaded there. Two findings rounds need not share a class, so the trigger over-fires
+by design — answering an inapplicable question costs a line, and the round it saves
+does not.
+
+The count is what the controller can prove, and no more: the rounds of this chain plus
+the predecessor a succession names, which is why the trigger reaches across a chain
+break at all (Chain succession, below). Succession does not compose, so a third chain
+opened fresh carries no history and the recurrence becomes the round's own record.
+
 A passed final external round returns
 `next_action=deep_self_review_before_completion` and remains
 `completion_gated=true`. `--mode complete` accepts one exact-candidate passed

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/wording-only-review.md

@@ -0,0 +1,136 @@
+# Proof-bound wording-only single review
+
+The wording-only exception to `staged-review-contract.md`: when one review may
+stand in for the review-plus-challenge pair, what the controller re-derives
+before it will say so, and how to produce the packet and proof it accepts.
+
+## The exception and its depth limits
+
+The wording-only exception is one untracked `review` with
+`challenge_budget=0`; it is not a chain, challenge, or `complete` checkpoint.
+Supply `--wording-only-proof-file` to bind the exception to the exact packet.
+Without that proof, an explore/build budget-zero review remains an ordinary
+single review and cannot be recorded as the wording-only exception;
+release/high-risk budget zero fails before inference.
+
+At release depth, including depth raised by a high-risk tag, only a
+controller-proved `markdown-punctuation-only` check may use this exception.
+`markdown-token-replacement` remains available for explore/build budget-zero
+review, but it cannot waive the release/high-risk challenge: byte-exact token
+replacement does not prove that the old and new tokens have the same meaning.
+
+## The proof
+
+The proof is a single-link regular UTF-8 JSON file of at most 16,000 bytes:
+
+```json
+{"schema_version":1,"candidate_sha256":"<packet-sha256>","check":{"kind":"markdown-punctuation-only"}}
+```
+
+The other fixed check is
+`markdown-token-replacement`, whose `check` also contains `old_token`,
+`new_token`, and integer `expected_count` (1..100). The controller never trusts
+a caller-supplied pass result. It reparses the frozen packet and derives the
+status, files, changed-line count, replacement count, and scope SHA-256.
+
+## The accepted packet
+
+The accepted packet is deliberately narrow: a canonical full-context unified
+Git diff, LF-terminated, at most 200,000 bytes, changing existing regular
+Markdown files inside exactly one existing non-linked skill package. Every
+file's first hunk starts at line 1 so frontmatter is inspectable. Adds,
+deletes, renames, multi-skill changes, frontmatter or `description` edits,
+non-regular Git modes, custom/compact packets, extra context outside the diff,
+and files without a final newline fail closed. `markdown-punctuation-only`
+accepts only one-for-one plain-prose line replacements whose non-punctuation
+characters remain identical; numeric tokens must additionally survive
+byte-for-byte (deleting the dot in `5.5` is a threshold change, not
+punctuation), and a question mark may not be added or removed (a statement
+turned into a question is a meaning change). Lines must start at column zero
+and contain prose; line adds/deletes, Markdown headings, lists, block quotes,
+links, tables, inline code, fenced or indented code, and raw HTML `pre`/`code`
+containers fail closed. `markdown-token-replacement` requires every changed
+line pair to differ only by the named whole-token replacement, with the exact
+total count, and rejects packets whose changed lines touch a Markdown or HTML
+code container.
+
+## Producing the packet and proof
+
+This recipe produces the exact packet and proof without a second parser or a
+pretend verifier command. Set `WORDING_KIND=markdown-punctuation-only`, or set
+`WORDING_KIND=markdown-token-replacement` plus `WORDING_OLD`, `WORDING_NEW`, and
+`WORDING_COUNT`:
+
+```bash
+: "${CODE_REVIEW_SKILL_DIR:?set the installed code-review skill directory}"
+: "${REPO_ROOT:?set the absolute repository root}"
+: "${REVIEW_BASE:?set the exact base ref}"
+: "${SKILL_NAME:?set the one existing skill package name}"
+: "${REVIEW_STAGE:?set explore, build, or release}"
+: "${IMPLEMENTER_FAMILY:?set the implementer model family}"
+: "${REVIEW_PLAN_FILE:?set the absolute review-plan JSON path}"
+: "${REVIEW_EVIDENCE_DIR:?set an existing durable private evidence directory}"
+: "${WORDING_KIND:?set one supported wording-only check kind}"
+
+umask 077
+WORDING_RUN_DIR="$(mktemp -d "$REVIEW_EVIDENCE_DIR/wording-review.XXXXXX")" || exit 1
+WORDING_DIFF="$WORDING_RUN_DIR/candidate.diff"
+WORDING_PROOF="$WORDING_RUN_DIR/proof.json"
+WORDING_RESULT="$WORDING_RUN_DIR/review.json"
+
+git -C "$REPO_ROOT" diff --no-color --no-ext-diff --no-textconv --full-index \
+  --src-prefix=a/ --dst-prefix=b/ --unified=1000000 \
+  "$REVIEW_BASE" -- "skills/$SKILL_NAME" >"$WORDING_DIFF" || exit 1
+
+python3 - "$WORDING_DIFF" "$WORDING_PROOF" "$WORDING_KIND" \
+  "${WORDING_OLD:-}" "${WORDING_NEW:-}" "${WORDING_COUNT:-0}" <<'PY'
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+diff_path, proof_path = map(Path, sys.argv[1:3])
+kind, old, new, count = sys.argv[3:]
+check = {"kind": kind}
+if kind == "markdown-token-replacement":
+    check.update(old_token=old, new_token=new, expected_count=int(count))
+elif kind != "markdown-punctuation-only":
+    raise SystemExit("unsupported WORDING_KIND")
+payload = {
+    "schema_version": 1,
+    "candidate_sha256": hashlib.sha256(diff_path.read_bytes()).hexdigest(),
+    "check": check,
+}
+proof_path.write_text(
+    json.dumps(payload, ensure_ascii=False, separators=(",", ":")) + "\n",
+    encoding="utf-8",
+)
+PY
+
+WORDING_RISK_ARGS=()
+for tag in ${REVIEW_RISK_TAGS:-}; do WORDING_RISK_ARGS+=(--risk-tag "$tag"); done
+if ! bash "$CODE_REVIEW_SKILL_DIR/scripts/review_gate.sh" \
+  --mode review --stage "$REVIEW_STAGE" --challenge-budget 0 \
+  --cwd "$REPO_ROOT" --diff-file "$WORDING_DIFF" \
+  --review-plan-file "$REVIEW_PLAN_FILE" \
+  --wording-only-proof-file "$WORDING_PROOF" \
+  ${WORDING_RISK_ARGS[@]+"${WORDING_RISK_ARGS[@]}"} \
+  --implementer-family "$IMPLEMENTER_FAMILY" >"$WORDING_RESULT"; then
+  cat "$WORDING_RESULT" >&2
+  exit 1
+fi
+cat "$WORDING_RESULT"
+```
+
+## Validating the result
+
+A valid result carries `wording_only_proof_sha256`, controller-derived
+`wording_only_scope.status=passed`, and a reviewed
+`wording_only_boundary` concern. That concern independently confirms the edit
+changes no trigger, scope, routing, validation, acceptance, rule, threshold,
+boundary, frontmatter, description, or other meaning. If it is missing,
+inconclusive, or reports a possible semantic change, the wording-only exception
+does not apply: use the normal challenge and behavioral-evidence path. Any
+candidate edit regenerates the packet and proof and requires a new review.
+Keep the diff, proof, and result together; a digest whose source artifact was
+deleted is not independently auditable evidence.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/review_gate.py

@@ -14,6 +14,7 @@ from pathlib import Path, PurePosixPath
 import signal
 import stat
 import subprocess
+import sys
 import tempfile
 import time
 from typing import Any
@@ -370,6 +371,10 @@ STAGE_CONCERNS = {
             "compatibility",
             "Compatibility, maintainability, and unnecessary-complexity regressions.",
         ),
+        (
+            "claim_strength",
+            "Claims the cited evidence does not carry: absolutes, universals, causal statements, exhaustiveness.",
+        ),
     ),
     "release": (
         ("correctness", "Functional correctness and acceptance coverage."),
@@ -397,6 +402,10 @@ STAGE_CONCERNS = {
             "observability_operations",
             "Operational visibility, diagnosis, support, and recovery evidence.",
         ),
+        (
+            "claim_strength",
+            "Claims the cited evidence does not carry: absolutes, universals, causal statements, exhaustiveness.",
+        ),
     ),
 }
 HIGH_RISK_TAGS = {
@@ -1730,25 +1739,56 @@ def _validate_chain_succession(
     if prior.get("predecessor_chain_id") is not None:
         reject("predecessor is itself a succession round; succession does not compose")
     prior_budget = prior.get("challenge_budget")
+    prior_mode = prior.get("mode")
     if (
         prior.get("schema_version") != 3
-        or prior.get("mode") != "challenge"
+        or prior_mode not in ("review", "challenge")
         or prior.get("status") not in ("passed", "findings")
         or prior.get("review_chain_tracked") is not True
         or not isinstance(prior_budget, int)
         or isinstance(prior_budget, bool)
         or prior_budget < 1
     ):
-        reject("predecessor is not a tracked challenge receipt")
-    if (
-        prior.get("autonomous_review_index") != prior_budget + 1
-        or prior.get("challenge_index") != prior_budget
-        or prior.get("autonomous_reviews_remaining") != 0
-        or prior.get("autonomous_review_allowed") is not False
-    ):
-        # Terminality is the receipt's own arithmetic, not just its index: a
-        # forged receipt can carry a terminal index while every other field still
-        # says the chain has rounds left.
+        reject("predecessor is not a tracked review or challenge receipt")
+    # Terminality is the receipt's own arithmetic, not just its index: a forged
+    # receipt can carry a terminal index while every other field still says the
+    # chain has rounds left.
+    #
+    # A chain ends where the candidate moves, and a fix applied straight after the
+    # REVIEW moves the owner digest exactly as one applied after the challenge
+    # does, so a review can be the last round its chain ever had. Requiring a
+    # challenge receipt here did not protect the landing candidate -- the
+    # succession challenge binds that either way -- it only forced the challenge to
+    # be spent on a candidate the author had already decided to replace. The one
+    # class this stops owing is a challenge on a candidate that will never land,
+    # which carries no evidence about what does. Everything else is unchanged: the
+    # candidate must still have moved, succession still does not compose, and the
+    # per-chain budget is untouched (this path spends fewer rounds, never more).
+    if prior_mode == "challenge":
+        chain_ended = (
+            prior.get("autonomous_review_index") == prior_budget + 1
+            and prior.get("challenge_index") == prior_budget
+            and prior.get("autonomous_reviews_remaining") == 0
+            and prior.get("autonomous_review_allowed") is False
+        )
+    else:
+        # The review is round 1 with its chain's challenge still unspent -- as the
+        # receipt itself reports it. This is a FORGERY guard, not a history check:
+        # a genuine round-1 review reads the same whether its chain later ran a
+        # challenge or not, because a stateless controller sees only the receipt it
+        # is handed. A caller who spent the challenge and presents only the review
+        # is therefore accepted here, and the successor inherits no challenge
+        # focuses, so a focus that chain really did spend can be spent again. That
+        # is the same omitted-history boundary the rest of this contract states,
+        # and the closeout validator's ordered receipt set is where a retained
+        # challenge receipt would show it; nothing at this call site can close it.
+        chain_ended = (
+            prior.get("autonomous_review_index") == 1
+            and prior.get("challenge_index") == 0
+            and prior.get("autonomous_reviews_remaining") == prior_budget
+            and prior.get("autonomous_review_allowed") is True
+        )
+    if not chain_ended:
         reject("predecessor is not its chain's terminal round")
     predecessor_chain_id = prior.get("review_chain_id")
     if not isinstance(predecessor_chain_id, str) or not predecessor_chain_id.strip():
@@ -1800,6 +1840,10 @@ def _validate_chain_succession(
         "result_sha256": result_hash,
         "candidate_sha256": prior_candidate_hash,
         "focuses": focuses,
+        # The budget is one review plus one challenge, so a fix ends the chain and the
+        # second findings round lands HERE rather than in-chain. Carrying the ended
+        # chain's verdict is what lets the recurrence be counted at all.
+        "returned_findings": prior.get("status") == "findings",
     }
 
 
@@ -3161,6 +3205,7 @@ def freeze_review_profile(
     previous_challenge_focuses: list[str] = []
     prior_review_result_hashes: list[str] = []
     prior_review_candidate_hashes: list[str] = []
+    prior_findings_rounds = 0
     succession: dict[str, Any] | None = None
     inherited_challenge_focuses: list[str] = []
     if review_chain_tracked:
@@ -3309,6 +3354,8 @@ def freeze_review_profile(
                 previous_challenge_focuses.append(focus)
             prior_review_result_hashes.append(result_hash)
             prior_review_candidate_hashes.append(prior_candidate_hash)
+            if prior.get("status") == "findings":
+                prior_findings_rounds += 1
         if challenge_focus and challenge_focus in (
             previous_challenge_focuses + inherited_challenge_focuses
         ):
@@ -3329,6 +3376,9 @@ def freeze_review_profile(
                 "review_chain_required",
             )
 
+    if succession is not None and succession["returned_findings"]:
+        prior_findings_rounds += 1
+
     self_review_satisfied_triggers: list[str] = []
     if args.mode in ("review", "challenge"):
         self_review_satisfied_triggers.append("before_external_review")
@@ -3401,6 +3451,7 @@ def freeze_review_profile(
             succession["candidate_sha256"] if succession else None
         ),
         "self_review_satisfied_triggers": self_review_satisfied_triggers,
+        "prior_findings_rounds": prior_findings_rounds,
         "required_concerns": [
             {"id": concern_id, "description": description}
             for concern_id, description in reviewer_concern_pairs
@@ -4168,7 +4219,52 @@ def build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+PRINT_REQUIRED_CONCERNS_FLAG = "--print-required-concerns"
+
+
+def _print_required_concerns(argv: list[str]) -> int:
+    """Print the concern ids a review plan must cover, one per line.
+
+    The plan's required set is derived from the stage and the risk tags, and a
+    caller that hardcodes its own copy of that list drifts the moment the set
+    changes -- measured as five suites whose fixtures stopped satisfying the gate
+    when one concern was added, none of which the fast lane could report because
+    the runner aborts at its first failing target. The list has exactly one owner;
+    this prints it so callers derive instead of duplicating.
+
+    Deliberately narrower than the reviewer's concern set: this answers what the
+    PLAN owes, so the synthetic challenge slot and the wording-only boundary --
+    which the controller adds for the reviewer, never for the plan -- are absent.
+    """
+    parser = argparse.ArgumentParser(prog="review_gate.py", add_help=True)
+    parser.add_argument(PRINT_REQUIRED_CONCERNS_FLAG, action="store_true", required=True)
+    parser.add_argument("--stage", choices=("explore", "build", "release"), default="build")
+    parser.add_argument("--risk-tag", action="append", default=[])
+    args = parser.parse_args(argv)
+    # The same tag validation the run path applies. Without it the printer answers for
+    # inputs the enforcer refuses, which is the printer/enforcer divergence this export
+    # exists to remove -- a caller deriving from a malformed tag would get a list where
+    # the real round fails closed.
+    for index, tag in enumerate(args.risk_tag):
+        if not tag or len(tag) > 80 or any(ch.isspace() for ch in tag):
+            parser.error(f"invalid risk tag at index {index}")
+    stage_rank = {"explore": 0, "build": 1, "release": 2}
+    depth = "release" if HIGH_RISK_TAGS.intersection(args.risk_tag) else args.stage
+    if stage_rank[depth] < stage_rank[args.stage]:
+        depth = args.stage
+    ids = [concern_id for concern_id, _ in STAGE_CONCERNS[depth]]
+    if HIGH_RISK_TAGS.intersection(args.risk_tag):
+        ids.append("high_risk_boundary")
+    for concern_id in ids:
+        print(concern_id)
+    return 0
+
+
 def main(argv: list[str] | None = None) -> int:
+    if PRINT_REQUIRED_CONCERNS_FLAG in (sys.argv[1:] if argv is None else argv):
+        # Answered before the run parser, which requires --mode/--cwd/--implementer-family
+        # for an actual review; asking what a plan owes needs none of them.
+        return _print_required_concerns(sys.argv[1:] if argv is None else argv)
     script_dir = Path(__file__).resolve().parent
     packet_path: Path | None = None
     profile_path: Path | None = None
@@ -4560,6 +4656,7 @@ def main(argv: list[str] | None = None) -> int:
                         "deep_self_review",
                         "continue_implementation",
                     ]
+                    recurring_findings = profile["prior_findings_rounds"] > 0
                     if result["autonomous_review_allowed"]:
                         next_action = "implementer_self_review"
                         review_state = "findings_pending"
@@ -4573,6 +4670,18 @@ def main(argv: list[str] | None = None) -> int:
                         )
                         allowed_self_review_actions.append("continue_independent_work")
                     allowed_self_review_actions.append("resolve_review_findings")
+                    if recurring_findings:
+                        # Findings have now come back across rounds. The next patch is
+                        # not the default move: decide whether the reviewed surface
+                        # should exist in this shape at all. Two rounds of findings need
+                        # not share a class, so this over-fires by design -- answering an
+                        # inapplicable question is cheap, and the miss it prevents is not.
+                        required_self_review_triggers.append(
+                            "recurring_findings_design_check"
+                        )
+                        allowed_self_review_actions.append(
+                            "decide_keep_delete_narrow_replace"
+                        )
                     current_self_review_gate = self_review_gate(
                         required_triggers=required_self_review_triggers,
                         satisfied_triggers=profile["self_review_satisfied_triggers"],