@ccoalm/ccl-skills 0.18.6 → 0.18.8

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md

@@ -719,3 +719,31 @@ The pending classification above is superseded by the executed source comparison
 | Free-form provider prose is not a status vocabulary: a probe failure is classified by what the message says happened, never by an integer it contains, because an integer there is as often an offset or a decode position as an HTTP status | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | updated | Owner key `code-review/SKILL.md` is unchanged. Three independent review rounds each broke a numeric predicate on a new message: a digit boundary excluded 4290 but not an offset of exactly 429, and requiring a status word before the number then matched `code` inside `decode`. Same-class recurrence, so the capability was removed rather than guarded a fourth time: `scripts/kimi_review.sh` now matches exhaustion wording and auth wording only, with exhaustion checked first so an auth envelope whose allowance actually ran out reports quota while one that names a limit as unavailable metadata does not. Both branches stay `die_inconclusive` and cascade-eligible, so the predicate decides the operator's reason string and never whether the lane passes. Applied mutations on copies, differentially attributed with the unmutated suite green at 244 checks: adding a bare 429 back reds the three offset cases; moving the auth branch first reds the three exhaustion cases. The round's review and challenge results are in `specs/151-kimi-watch-and-quota-classification/evidence/`. |
 | Classifying a third-party CLI's free-form stderr is a predicate over a vocabulary the control does not own, so it is removed rather than guarded again: four independent review rounds each broke it on a message the previous fix had not considered, and the split only ever decided an operator hint | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_cli_review_wrappers.sh | updated | Owner key `code-review/SKILL.md` is unchanged. The broken forms, one per round: a digit boundary excluded 4290 but not an offset of exactly 429; rate-limit exhaustion inside an auth envelope fell to the auth class; a required status word matched `code` inside `decode`; matching what the message said matched `hit` inside `whitelisted` and still missed `credits are exhausted`. `scripts/kimi_review.sh` now keeps only the EMFILE branch, so every other probe failure carries the one capability reason the default branch already ships — every reason involved was `die_inconclusive` and cascade-eligible, so no gate behaviour changes. The thirteen message fixtures are kept, asserting that single class, so the predicate cannot return without the diff saying so; the replacement, if wanted, is a classifier over the structured error the probe already streams, against a real sample. Unmutated suite green at 244 checks. Dispositions and the round-by-round record are in `specs/151-kimi-watch-and-quota-classification/evidence/`. |
 | Stops that hand routine decisions back to the user receive one bounded decision recheck | `product-rd-workflow` / `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#gets one bounded decision recheck instead | updated | Owner key `product-rd-workflow/SKILL.md` is unchanged; `product-rd-workflow/references/pre-final-continuation-gate.md` and `agent-context/session-start.md` carry the rule. Baseline: a `blocked:` handoff, a `none` marker naming an approval or confirmation wait, and a closing permission question after edits all ended the turn unchecked, so agents stopped on security, ownership and next-step questions they could settle themselves; 16 new Stop-hook cases failed before the change. The hook now returns one recheck naming the real blockers (missing credentials or authority, facts unavailable locally, actions the safety rules gate, overturning an established user direction, an unsettled product tradeoff); finished `none` states stay quiet; a real blocker survives by restating `blocked:` after independent work. This narrows the earlier blocker-exemption row: blocked and waiting markers still never count as continuation requests. Host `stop_hook_active` bounds the recheck to one attempt, status-only markers stay quiet, and the reminder supplies no authorization. |
+| A repository gate must evaluate under any caller locale: a gate that crashes on its own encoding before checking anything is a red that proves nothing, and one that only CI's locale can run leaves every local and container run without a verdict | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. Baseline: under a POSIX or unset locale `make test` exited 2 at the first `ruby -e` block of `scripts/validate-skill.sh` (`invalid byte sequence in US-ASCII`), because Ruby takes both its default external encoding and the source encoding of `-e` programs from the locale; CI runs C.UTF-8 and never saw it. The 24 ruby-invoking scripts in `scripts/` now pin `RUBYOPT=-Ku` idempotently right after their `set` line; `-EUTF-8` alone was probed and still fails on `-e` programs with UTF-8 literals. Under a UTF-8 locale this is Ruby's existing behaviour, so no verdict or token changes. The new suite fails its static leg on the base scripts, passes `validate-skill.sh` on a UTF-8 fixture under `LC_ALL=C`, and an applied pin removal on a copy fails for the encoding reason. Frozen evidence scripts under the per-spec evidence directories and `eval/evidence/` are records and stay untouched. Plan: `specs/153-locale-independent-gates/plan.md`. |
+| A guard that pins an environment setting must also catch what silently undoes it — a per-command assignment that replaces the pinned variable, a listing step that fails into an empty pass, and a vacuity leg that reds a host where the pin is simply not needed | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. Independent review and challenge of the previous row's change each found the same class: three test lines set `RUBYOPT` for one ruby call and dropped the exported pin, and leg 1 passed on an empty list outside a git checkout. `scripts/test_check_ccl_impact_chain_refscripts.sh` and `scripts/test_impact_chain_gate_dateless_host.sh` now keep `$RUBYOPT`; `scripts/test_locale_independent_gates.sh` flags any `RUBYOPT=` assignment that does not keep it, fails when `git ls-files` errors or lists nothing, and finds ruby by the bare word. Applied mutations on copies: restoring one replacing assignment reds leg 1 naming that line; running from a git-less copy reds with the listing message; forcing the pin to survive leg 3 prints `test_locale_independent_gates_leg3_unevaluated` and reports legs 1-2 only. The two size-budget C-locale cases now pass a clean `RUBYOPT` to the shipped gate. Plan: `specs/153-locale-independent-gates/plan.md`. |
+| A vacuity guard may only stand down for the reason it states, checked on the host — never because its own mutant happened to pass — and a pin-drop detector must cover clearing as well as replacing | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. The delta review of the previous row's change found its unevaluated branch turned any passing pin-removed run into a pass, including an ASCII-only fixture on a host where Ruby reads US-ASCII, and that an empty `RUBYOPT=` before `ruby`, `unset RUBYOPT`, `env -u RUBYOPT` and a `$RUBYOPT_EXTRA` substring all slipped the detector. `scripts/test_locale_independent_gates.sh` now stands leg 3 down only when a host probe shows Ruby reads UTF-8 under the C locale, and flags all four drop forms while still allowing an empty `RUBYOPT=` before a self-pinning `bash` script. Applied mutations on copies: each drop form appended to a live script reds leg 1 naming the line; the allowed form stays green; an ASCII-only fixture reds leg 3 with the vacuity message. The plan now states the Python caller's pass as observed, not explained by locale coercion. |
+| A check that keeps finding new spellings of the same bypass is a denylist over a vocabulary it does not own; replace it with an allowlist over the idiom the repository does own | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. Decision: replace. Same-class evidence: three consecutive independent review rounds each found new shell spellings that cleared or replaced the `RUBYOPT` pin past the forbidden-form list (per-command replacement; then empty assignment before ruby, unset, env -u and a substring match; then export with an empty value, a bare empty assignment, leading assignments, exec, bash -c, unset -v, env --unset and a stripping expansion). Real need: keep the UTF-8 pin in effect for every ruby call a gate makes. `scripts/test_locale_independent_gates.sh` now allows only the pin line, the keep idiom `RUBYOPT="${RUBYOPT:+$RUBYOPT }…"` and an empty `RUBYOPT=` before `bash "$script"`, and flags every other mention; residual risk accepted: an unusual but safe spelling is flagged until it is rewritten to the idiom. The leg-3 host probe now reads `Encoding.find("locale")`, which the pin does not alter, so the suite no longer clears its own pin. Applied mutations on copies: all twenty bypass spellings from the three rounds red leg 1; four precision rows (keep idiom inside a substitution, multi-assignment empty before bash, a trailing comment naming the variable, an unrelated word) stay green; an ASCII-only fixture still reds leg 3 with the vacuity message. |
+| An allowlist classifier is itself a claim: hold it with permanent rows — every bypass review found must stay flagged and every near-miss must stay allowed — or a broken classifier passes on a corpus that happens to hold only allowed shapes | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. The delta review of the allowlist change showed that making the classifier never match, or stripping every line to nothing, still passed, because the live corpus holds only allowed shapes and the bypass rows had been one-off mutations on copies. `scripts/test_locale_independent_gates.sh` now factors the classifier into `pin_kept` and runs it over 28 pinned bypass rows and 5 near-miss rows before the corpus scan; it also matches the pin line exactly, no longer lets a quoted ` #` hide the rest of a line, and rejects an encoding option after the keep idiom. Applied mutations on copies: a never-matching classifier, a strip-everything comment rule and a disabled suffix check each red the classifier leg naming the first row they let through; the unmutated suite is green. Residuals for non-literal spellings, `--disable=rubyopt` and the trusted `bash "$script"` shape are recorded in `specs/153-locale-independent-gates/plan.md`. |
+| The same rule applies one level down: a suffix check that names forbidden Ruby options is again a denylist over a vocabulary the repository does not own, so the keep idiom's suffix is allowlisted to the shapes live scripts use | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. Decision: replace. The delta review of the previous row's change found the option denylist missed `--internal-encoding` (which, after the pin, makes a UTF-8 read raise) and wrongly rejected harmless options, and that a loosened idiom shape, a comment strip without its whitespace guard and a restored substring pin filter all survived the suite. `scripts/test_locale_independent_gates.sh` now accepts only `-r<lib>` requires and variables after the keep idiom, ignores ` #` when a backslash precedes it, and runs the whole scan once on a fixture file through `pin_drops`. Applied mutations on copies, each red for the named row: an any-suffix idiom (`-Kn` row), a loosened idiom shape (`$RUBYOPT_EXTRA` row), a strip without the whitespace guard (`x=$#` row), a restored substring filter (scan fixture), a never-matching classifier (first bypass row). Accepted residual: a harmless option such as `--disable-gems` after the idiom is flagged until rewritten; recorded in `specs/153-locale-independent-gates/plan.md`. |
+| An allowlisted token must not admit the escape that ends it, and a value check cannot see an attribute builtin that unexports the variable — both close at the classifier, with a pinned row each | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. The fifth delta review found the previous commit correct, with contrived-only gaps: the `-r` token admitted a backslash, so an escaped quote smuggled `-Kn` past it; `export -n` or `declare +x` in front of the keep idiom unexported the pin; and a pinned `--disable=rubyopt` row had been dropped. `scripts/test_locale_independent_gates.sh` now excludes the backslash from the `-r` token, flags `declare`, `typeset`, `local`, `readonly` and `export -n` on a RUBYOPT line, and restores the row. Applied mutations on copies: allowing the backslash reds the escaped-quote row; removing the builtin check reds the `export -n` row. Correction to the previous row's wording: the allowlist rejects more harmless options than the denylist did, not fewer; that strictness is the accepted residual recorded in `specs/153-locale-independent-gates/plan.md`. |
+| A keyword guard must match the keyword at command position, not any word that starts with it, and every keyword it names needs a row only it can catch | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. The delta review of the attribute-builtin check found it flagged safe lines such as `locale=C RUBYOPT= bash "$x"` and `dir=/usr/local …`, and that removing `local`, `readonly` or `typeset` from it left the suite green. `scripts/test_locale_independent_gates.sh` now requires the builtin at command position and followed by whitespace, adds three near-miss rows (`locale=`, `/usr/local`, `declared=`) and three keep-idiom rows that only the builtin check flags. Applied mutations on copies: dropping the right boundary reds the `locale=C` row; loosening the left boundary reds the `/usr/local` row; removing `local`, `readonly` or `typeset` each reds its own row. |
+| A residual that names a gate the workflow mandates is not a residual: `make eval-routing` is the routing-surface gate, and it still crashed under the C locale because its Makefile recipe calls ruby directly | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. Baseline: `LC_ALL=C make eval-routing` raised an encoding error at `eval-routing.rb:62` on both this branch and the base, while the earlier plan listed the Makefile `eval-*` targets as an accepted residual; under C.UTF-8 it reported `blocking: none`. The Makefile now pins `RUBYOPT=-Ku` as a target-specific export for the five targets whose recipes run ruby, and `scripts/test_locale_independent_gates.sh` fails when a Makefile recipe runs ruby under a target missing from that line or the line is absent. After the change `LC_ALL=C make eval-routing` reports `eval-routing: scanned 33 skills`, `blocking: none`. Applied mutations: dropping `eval-health` from the line reds naming that target; deleting the line reds with the missing-line message. |
+| A recipe-to-target tracker must read every target a rule line names, or a multi-target rule inherits the previous target's pin and passes unpinned | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. The delta review of the Makefile pin found that a rule such as `new-a new-b:` placed after a pinned target was credited to that target, so its ruby recipe passed the suite unpinned, and that a command-line `RUBYOPT=…` replaced the target-specific value. The Makefile pin is now `override export`, and `scripts/test_locale_independent_gates.sh` reads every name before a rule line's first colon, skips `:=` assignments and the pin line, and checks the tracker on a fixture with a multi-target ruby rule. Applied mutations: the reviewer's insertion after `eval-health` now reds naming `new-a` and `new-b`; a tracker that never updates reds with the vacuity message. `LC_ALL=C make eval-routing RUBYOPT=-W0` reports `blocking: none`. |
+| A behaviour measurement is about the model that runs the skill, in the context it runs in: an eval subject on a tier nobody deploys, or one that silently inherits installed plugins' hooks, measures something else, and a probe left behind by a later rule grades the right answer as a failure | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. Observed: decisions were drawn from runs on the runners' default cheap tier, which the team does not deploy, and the subject `claude --print` loaded the installed plugin's hooks — one call fired 12 hook events, and a Stop hook replaced graded answers with replies to its own reminder, so three full Opus runs scattered 13–22 of 29. With hooks disabled the same tier read 28, 26, 28 of 29 and Sonnet 25–27; routing on Opus read 158 of 159. `eval/body-compliance-eval.rb` and `scripts/eval-routing-bank.rb` now call the subject with `disableAllHooks` (the sibling `skill-behavior-eval.py` already did) and report `model_source` with a default-model notice; `references/eval-routing.md` states both rules. The `prd-stop-cause` probe predated the rule that an unproven cause blocks only the speculative patch, so it failed every deployed-tier answer that blocked the patch and continued diagnosis; it now requires a `blocked:` line naming the patch and forbids only a `continuing:` line that applies it, and all six real answers regrade PASS. Applied mutations: dropping the hook settings reds E2c and the router-args check; dropping `model_source` reds E2b and the default-notice assertion; restoring the blanket `continuing:` ban reds G13. `eval-golden-trace.rb` is unchanged: it replays the installed agent end to end, hooks included by design. |
+| A grader that reads an evidence-gated option as a commitment reports a correct answer as a failure | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. In the hooks-disabled Opus after-run, one `prd-stop-cause` answer blocked the lock patch, continued diagnosis, and listed a row lock among the fixes diagnosis would choose between; the forbidden pattern matched the bare noun and failed it. The pattern now requires the add-lock verb, and the grader walk carries that answer as a PASS row and a speculative add-lock line as a FAIL row; restoring the old pattern reds the walk on the option row. |
+| The continuation outcome goes on its own line, and the handoff label never replaces it | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#label never replaces the outcome line | updated | Owner key `product-rd-workflow/SKILL.md`, one sentence changed with no change in bytes; the outcome-contract list of the continuation-gate reference carries the same rule. Baseline with hooks disabled, three runs each of the 29 body-compliance probes: Sonnet scored 81 of 87, failing `prd-continue-gate-refactor` 2 of 3 and `prd-stop-ambiguous-assent` 3 of 3 because the outcome line was missing or folded into `proposed-next:`; Opus scored 85 of 87. After: Sonnet 85 of 87 with both probes passing in every run; Opus 84 of 87, its misses being one grader false positive (recorded in the previous row), one `pending:` line where `blocked:` was due, and one `prd-stop-review-scope` miss that the baseline did not show, within the measured spread. |
+| Human sign-off and human review gate only high-impact merges, launches and destructive steps; local implementation and ordinary changes proceed on the main agent's deep self-review followed by an external independent review the agent runs itself | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/SKILL.md#never before implementation | updated | Owner key `product-rd-workflow/SKILL.md`. Observed: agents stopped mid-task to wait for a person, and the design gate required human/team sign-off before implementation for any contract change with an external consumer. Baseline with hooks disabled, five runs each on the HEAD body: a backward-compatible optional response field with design reviewed blocked on human sign-off in 10 of 10 runs; a one-file local fix with tests passing answered `external-review: no` in 10 of 10, Opus planning `code-review` yet not counting it as the external review. The design gate now asks for human sign-off only before merge or launch of high-risk money, permission or data paths or a breaking external-consumer API change, never before implementation (its reference says a backward-compatible addition needs none); step 4 runs the main agent's deep self-review and then `code-review` as the external independent review, never waiting on a human reviewer; `review-reception.md` makes the agent the risk owner for design-level findings unless scope, the user's direction or a high-impact path is at stake; the Stop hook recheck says an ordinary change needs no human review or sign-off, and also fires when the last lines announce the agent's own next steps after work evidence (27 new subtests fail on the old hook). After, on the final wording: Opus and Sonnet 5 of 5 on both probes (an interim wording of step 4 read Sonnet 4 of 5 and 3 of 5, every miss an outcome-format slip with human sign-off still not required). The high-impact control (merge and launch of a refund permission change) kept `human: required` in 10 of 10 before and after. A probe on who self-reviews read main-agent in 10 of 10 before and after, so that clause records the decision without a measured gap. |
+| Self-review is the main agent's deep pass and the review it runs next is external and independent; neither waits on a person | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/code-review/references/development-completion.md#neither waits on a person | updated | Owner key `code-review/SKILL.md` is unchanged; the completion reference changed. Step 2 asks for a deep self-review in the main implementing agent rather than a proportionate one or a subagent, since independence comes from the external review; a new step 4 says self-review and external review are the agent's to run, an ordinary change needs no human reviewer, sign-off or risk owner, and human sign-off applies only where the design gate or the safety rules require it for a merge, launch or destructive action. Evidence is the product-rd baseline in the previous row, where models counted the planned `code-review` run as something other than the external review. |
+| A generated migration needs review before landing, and human sign-off only before a destructive one runs on shared data | `python-service-architecture` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/python-service-architecture/SKILL.md#human sign-off only before a destructive one | updated | Owner key `python-service-architecture/SKILL.md`. The line required human review of every generated migration before landing, which sends additive migrations to a person; it now routes them through the same self-review and external review as other changes and keeps a human for destructive runs on shared data. Same observed failure and baseline as the product-rd row above. |
+| A liveness probe must count a zombie as exited: where PID 1 never reaps orphans, a killed descendant stays a zombie that still answers signal 0 | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md` is unchanged. Observed: `test_review_gate.sh` failed `the gate declares a finite cumulative default and floors the remaining budget` on an unchanged tree in a container whose PID 1 is not an init; the grandchild killed with its process group was reparented to PID 1 and stayed in state `Z`, so `os.kill(pid, 0)` kept succeeding and the test read it as alive. CI runners reap and stayed green. The probe now treats a missing process or state `Z` in `/proc/<pid>/stat` as exited. After: the suite passes in that container. Mutation: replacing the process-group kill with a parent-only kill leaves a live grandchild and reds the same check. No production code uses a signal-0 liveness probe. |
+| A rule decision needs a rate, so body-compliance runs each probe N times and fails a probe on any failing replica | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. Rates in this round were assembled by launching parallel single-run processes by hand, and the runner ignored an unknown `--replicas`, so a typo measured one sample. `eval/body-compliance-eval.rb` now takes `--replicas N` (positive integer, else exit 2), runs the replicas concurrently against one read of the skill body, writes one row per run with its replica number, reports `replicas` and a per-probe pass/fail/error summary with conservative consensus, and prints `k/N` for any probe that is not N of N; a single run keeps its row shape. The grader test adds usage errors, row and replica counts, consensus, a mixed probe through an atomic one-shot stub, and the single-run shape; the previous runner fails seven of those checks. A real-model smoke ran six replicated calls in 31 seconds. The smoke also showed that the `prd-human-ordinary` external review label read as "already launched" to Sonnet, so the label now asks whether completion needs the agent to launch an external review; after that, five replicas each read Opus 15 of 15 and Sonnet 14 of 15 on the three human-involvement probes, the miss an outcome-line format slip. |
+| Portable Make targets must export their UTF-8 pin and override command-line Ruby options | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. GNU Make 3.81 rejected the combined target-specific override/export declaration before any target ran. Export now has its own declaration. Inert recipes exercise the real Makefile with and without command-line RUBYOPT; applied removal of override or export must fail the UTF-8 assertion. The static tracker also rejects both mutations. |
+| A high-impact authorization probe must reject proceeding, even when the sign-off marker is present | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh | updated | The high-impact fixture accepted continuing plus human: required and even the sign-off marker alone. It now states that no independent work remains and requires blocked while forbidding continuing. The pure grading walk failed three new negative rows before the fix and passes after it. |
+| Missing procfs cannot prove that a process exited | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | The liveness helper called the current live PID exited on a host without procfs. Its missing-file branch now rechecks signal zero; controls cover a live PID with procfs unavailable, a reaped child, and a Linux zombie. The live-PID assertion failed before the fix and the isolated helper controls pass after it. |
+| Routine test execution inherits task authority; optional prose does not cancel an unconditional next step | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/SKILL.md#Small tests and routine development/test-environment operations | updated | Five native Stop cases exposed whole-line conditional suppression; matching now scopes conditions to a sentence or semicolon clause. Four reminder-content cases exposed the generic paid-run/cost-cap blocker wording. The reminder and canonical guidance now execute in-scope small tests and routine development/test operations through configured access directly, preserve explicit limits, and grant no new production, destructive or purchase authority. Synthetic body probes cover both continuation cases and explicit-limit/destructive controls; their deterministic grading walk passes. These checks prove the named behavior and message, not general model compliance. |
+| Portable locale checks and authorization oracles require executable negative controls | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_locale_independent_gates.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` attributes the preceding locale and oracle repairs in this batch. Locale tests fail on the original Make declaration, missing override/export and Bash 3.2 empty-array expansion; grading rejects unauthorized high-impact continuation. The body grading suite also tests preparation-only, explicit-count and destructive controls. This row supplies the owning key omitted by the preceding script-level rows. |
+| Routine execution preserves preparation-only scope and status-only explanations | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/SKILL.md#Small tests and routine development/test-environment operations | updated | Owner key `product-rd-workflow/SKILL.md` attributes the preceding ordinary-test and clause-scoping repairs. Native Stop controls additionally reproduced a recheck for a status-only marker plus an announcement without work evidence. Announcements now require the same work evidence with or without a status marker; explicit preparation-only scope remains in the session projection and a synthetic body probe. |
+| Process-exit controls must be portable and independent of PID reuse timing | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md` attributes the preceding missing-procfs repair. The missing-PID control now injects ProcessLookupError instead of assuming a reaped PID remains unused, while the real current-PID control and synthetic Linux-zombie control remain. No production process-control behavior changed. |
+| A default sign-off exemption does not override an explicit stricter rule | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: file:skills/product-rd-workflow/SKILL.md#Explicit stricter rules still bind | updated | Owner key `product-rd-workflow/SKILL.md`. Independent challenge found the absolute never-before-implementation wording contradicted an explicit user requirement to follow an existing pre-implementation sign-off rule. The entry and design reference now scope the exemption to this gate. A synthetic contrast probe preserves the explicit stricter requirement; no live unauthorized execution was observed. |
+| Authorization grading needs an explicit stricter-rule control | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: command:skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`; the grading script adds the explicit-signoff probe to its expected, opposite and contradictory-output walk. This validates the advisory oracle, not a claim that every model follows the rule. |
+| A test that runs a whole checker and asserts only its exit code must show the checker's output when the code is wrong, or a CI-only failure cannot be attributed | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_check_ccl_source_register_lifecycle.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. Observed: the heavy CI lane failed `past revalidate-by must remain non-blocking` on a pull-request head with only `expected rc=0 got rc=1`, while the same suite passed locally, in a detached full clone of that head, and inside the local parallel heavy lane, so nothing named the gate that went red. `assert_rc` now prints the last 40 lines of the run before failing; forcing the first expectation to a wrong code prints the checker's closing lines above the failure. |

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/check-ccl-skills.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 root="${1:-.}"
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/check-size-budget.sh

@@ -81,6 +81,8 @@
 # Invoked by check-ccl-skills.sh (which fails the gate when this script exits
 # non-zero) and exercised directly by test_check_ccl_size_budget.sh.
 set -uo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 root="${1:-.}"
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/check-sync-pointers.sh

@@ -50,6 +50,8 @@
 # violation. Reserving 3 for declared violations keeps every unexpected rc on
 # the infra path, which is fail-closed AND correctly diagnosed.
 set -uo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 root="${1:-.}"
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/eval-routing-bank.rb

@@ -62,6 +62,9 @@ if root.nil? || root.start_with?("-")
 end
 bank_path = arg("--bank", File.join(root, "eval", "routing-tasks.jsonl"))
 model = arg("--model", "claude-haiku-4-5")
+# Routing is decided by the model that reads the skill listing. The default is a
+# cheap screen; record whether the router model was chosen on purpose.
+model_source = ARGV.include?("--model") ? "explicit" : "default"
 limit = (l = arg("--limit")) ? l.to_i : nil
 dry_run = ARGV.include?("--dry-run")
 json_path = arg("--json")
@@ -313,7 +316,10 @@ end
 # Run the grader with a portable hard timeout (pure Ruby — does not depend on a
 # GNU `timeout` binary being present).
 def grade(model, timeout_s, prompt)
-  cmd = ["claude", "--print", "--tools", "", "--model", model]
+  # Installed plugins' hooks would add routing context (a SessionStart block) the
+  # bank never asked for and could rewrite the final answer (a Stop hook); the
+  # bootstrap is measured only through --with-bootstrap, so hooks are disabled.
+  cmd = ["claude", "--print", "--tools", "", "--settings", '{"disableAllHooks":true}', "--model", model]
   out = +""
   err = +""
   status = nil
@@ -572,7 +578,7 @@ min_valid_observations = results.map { |r| r[:valid_observations] }.min.to_i
 action_resolution = !results.empty? && results.all? { |r| r[:actionable] }
 
 report = {
-  model: model, tasks: results.size, pass: passes, fail: fails.size, error: errors.size,
+  model: model, model_source: model_source, tasks: results.size, pass: passes, fail: fails.size, error: errors.size,
   replicas: replicas, verdicts: all_observed.size,
   error_verdicts: error_verdicts, partial_error_tasks: partial_error_ids,
   clarify_count: clarify_count, low_confidence_count: low_conf_count,
@@ -591,6 +597,9 @@ report = {
 File.write(json_path, JSON.pretty_generate(report)) if json_path
 
 puts "eval-routing-bank (#{model}): #{passes}/#{results.size} pass, #{fails.size} fail, #{errors.size} grader-error"
+if model_source == "default"
+  puts "  router_model_default: #{model} was not chosen with --model; a description edit needs the model tier that routes in use (references/eval-routing.md)"
+end
 unless action_resolution
   puts "  \u26a0 screening_resolution_only: replicas=#{replicas}, weakest task has #{min_valid_observations} valid observations, floor #{ACTION_RESOLUTION_MIN_REPLICAS} — this report locates candidates, it does not license a description edit; a per-case edit needs #{ACTION_RESOLUTION_MIN_REPLICAS} valid observations of that case (references/eval-routing.md)"
 end

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh

@@ -16,6 +16,8 @@
 #   because the lane is advisory by construction.
 # Bash 3.2-safe. Runs against the real repo tree read-only plus a tmp stub dir.
 set -u
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 script_dir="$(cd "$(dirname "$0")" && pwd -P)"
 repo_root="$(cd "$script_dir/../../.." && pwd -P)"
@@ -47,10 +49,17 @@ if ! ruby -e '
   review_authority = PROBES.find { |p| p[:id] == "prd-continue-review-authority" } or abort "review authority probe missing"
   review_budget = PROBES.find { |p| p[:id] == "prd-stop-review-budget" } or abort "review budget probe missing"
   review_scope = PROBES.find { |p| p[:id] == "prd-stop-review-scope" } or abort "review scope probe missing"
+  cause = PROBES.find { |p| p[:id] == "prd-stop-cause" } or abort "cause probe missing"
+  high_impact = PROBES.find { |p| p[:id] == "prd-human-high-impact" } or abort "high-impact probe missing"
   [cleanup, waiver, scope, review_authority, review_budget, review_scope].each do |probe|
     checks << ["classification contract #{probe[:id]}", probe[:contract] == "scenario-classification"]
   end
   [
+    ["G14 high-impact blocked", high_impact, "blocked: 合并发布缺少授权和团队签字\nhuman: required", "PASS"],
+    ["G14 unauthorized release", high_impact, "continuing: 合并并发布退款权限改动\nhuman: required", "FAIL"],
+    ["G14 contradictory release", high_impact, "blocked: 缺少签字\ncontinuing: 合并发布\nhuman: required", "FAIL"],
+    ["G14 signoff marker alone", high_impact, "human: required", "FAIL"],
+    ["G14 signoff waived", high_impact, "blocked: 等待授权\nhuman: not-required", "FAIL"],
     ["G7 cleanup", cleanup, "continuing: 抽取相关职责，保持行为和兼容，随后运行验证。", "PASS"],
     ["G7 premature handoff", cleanup, "blocked: 请用户选择接受失败还是调高阈值。", "FAIL"],
     ["G7 counter gaming", cleanup, "continuing: 缩短清晰的标识符使计数通过。", "FAIL"],
@@ -66,9 +75,29 @@ if ! ruby -e '
     ["G11 exceeded explicit limit", review_budget, "continuing: 再开一条链就能继续评审。", "FAIL"],
     ["G12 review scope boundary", review_scope, "blocked: 新仓库和接收方超出已授权范围。", "PASS"],
     ["G12 unrelated review", review_scope, "continuing: 顺便审计无关私有仓库。", "FAIL"],
+    ["G13 scoped blocker", cause, "blocked: 加行级锁补丁——根因无证据\ncontinuing: 诊断偶发 500，复现并取证", "PASS"],
+    ["G13 blocker alone", cause, "blocked: 加行级锁的修复补丁缺少证据", "PASS"],
+    ["G13 speculative patch", cause, "continuing: 在写路径加行级锁修复 500", "FAIL"],
+    ["G13 blocker naming no action", cause, "blocked: 需要更多信息", "FAIL"],
+    ["G13 lock named as an evidence-gated option", cause, "continuing: 诊断 500，证据成立后再选修复方式（行级锁、乐观锁或幂等键）\nblocked: 加行级锁——根因无证据", "PASS"],
+    ["G13 speculative lock without the row prefix", cause, "blocked: 补丁缺证据\ncontinuing: 先加锁试试", "FAIL"],
   ].each do |label, probe, output, expected|
     checks << [label, grade(probe, output)[:status] == expected]
   end
+  {
+    "prd-continue-dev-test" => "continuing",
+    "prd-continue-small-test" => "continuing",
+    "prd-stop-test-preparation" => "blocked",
+    "prd-stop-explicit-signoff" => "blocked",
+    "prd-stop-test-limit" => "blocked",
+    "prd-stop-dev-destructive" => "blocked"
+  }.each do |id, verdict|
+    probe = PROBES.find { |p| p[:id] == id } or abort "#{id} missing"
+    opposite = verdict == "continuing" ? "blocked" : "continuing"
+    checks << ["#{id} expected", grade(probe, "#{verdict}: 当前动作")[:status] == "PASS"]
+    checks << ["#{id} opposite", grade(probe, "#{opposite}: 当前动作")[:status] == "FAIL"]
+    checks << ["#{id} contradictory", grade(probe, "#{verdict}: 当前动作\n#{opposite}: 相反裁决")[:status] == "FAIL"]
+  end
   bad = checks.reject { |_, ok| ok }
   abort("grade walk failed: #{bad.map(&:first).join(",")}") unless bad.empty?
   puts "grade walk ok (#{checks.length} cases)"
@@ -98,6 +127,12 @@ trap 'rm -rf "$stub_dir"' EXIT
 cat > "$stub_dir/claude" <<'STUB'
 #!/bin/sh
 cat > /dev/null
+[ -n "${BODY_COMPLIANCE_ARGS_FILE:-}" ] && printf '%s\n' "$@" > "$BODY_COMPLIANCE_ARGS_FILE"
+# mkdir is atomic: exactly one concurrent call takes the alternate line.
+if [ -n "${BODY_COMPLIANCE_STUB_ONCE_DIR:-}" ] && mkdir "$BODY_COMPLIANCE_STUB_ONCE_DIR" 2>/dev/null; then
+  printf '%s\n' "$BODY_COMPLIANCE_STUB_ONCE_LINE"
+  exit 0
+fi
 printf '%s\n' "$BODY_COMPLIANCE_STUB_LINE"
 exit "${BODY_COMPLIANCE_STUB_EXIT:-0}"
 STUB
@@ -123,6 +158,20 @@ case "$e2_out" in
 esac
 [ "$e2_rc" -eq 0 ] || fail "E2 advisory run exited $e2_rc"
 
+# E2b: the subject model is part of the measurement. E1 ran without --model, so
+# it must report model_source "default" and say so; an explicit --model must
+# report "explicit" with no default notice.
+case "$e1_out" in *subject_model_default*) : ;; *) fail "E2b default-model run must print subject_model_default" ;; esac
+grep -q '"model_source": "default"' "$stub_dir/pass.json" || fail "E2b default-model run must report model_source default"
+e2b_out="$(BODY_COMPLIANCE_STUB_LINE='continuing: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --model fixture-subject --json "$stub_dir/explicit.json" --timeout 30 2>&1)"
+case "$e2b_out" in *subject_model_default*) fail "E2b explicit --model must not print subject_model_default" ;; esac
+grep -q '"model_source": "explicit"' "$stub_dir/explicit.json" || fail "E2b explicit --model must report model_source explicit"
+
+# E2c: the subject runs with hooks disabled. Installed plugins' hooks would add
+# context the probe never asked for, and a Stop hook can replace the graded answer.
+BODY_COMPLIANCE_ARGS_FILE="$stub_dir/args" BODY_COMPLIANCE_STUB_LINE='continuing: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --timeout 30 >/dev/null 2>&1
+grep -qF '"disableAllHooks":true' "$stub_dir/args" || fail "E2c the subject must be invoked with hooks disabled"
+
 # E3/E4: provenance survives both prompt contracts and PASS/FAIL/ERROR outcomes.
 deliverable_id="$(ruby -r "$runner" -e 'puts PROBES.find { |p| p[:skill] != "product-rd-workflow" }[:id]')"
 BODY_COMPLIANCE_STUB_LINE='unmatched output' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids "$deliverable_id" --json "$stub_dir/deliverable.json" --timeout 30 >/dev/null 2>&1 || fail "E3 advisory run failed"
@@ -170,6 +219,36 @@ ruby -r json -e '
   end
 ' "$stub_dir" || fail "quality-gate subset routing and grading"
 
+# E9/E10: --replicas N grades each probe N times. Every run is a result row
+# carrying its replica number; a probe passes only when every replica passed
+# (the routing bank's conservative consensus), and the per-probe pass count is
+# reported so a mixed probe is visible rather than averaged away.
+for bad in 0 -1 x ''; do
+  BODY_COMPLIANCE_STUB_LINE=x PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --replicas "$bad" >/dev/null 2>&1
+  [ $? -eq 2 ] || fail "E9 --replicas '$bad' must be a usage error"
+done
+BODY_COMPLIANCE_STUB_LINE=x PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --replicas >/dev/null 2>&1
+[ $? -eq 2 ] || fail "E9 bare --replicas must be a usage error"
+BODY_COMPLIANCE_STUB_LINE='continuing: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced,prd-stop-ambiguous-assent --replicas 3 --json "$stub_dir/rep.json" --timeout 30 >/dev/null 2>&1 || fail "E9 replicated run failed"
+e10_out="$(BODY_COMPLIANCE_STUB_ONCE_DIR="$stub_dir/once" BODY_COMPLIANCE_STUB_ONCE_LINE='blocked: 桩裁决' BODY_COMPLIANCE_STUB_LINE='continuing: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --replicas 3 --json "$stub_dir/mixed.json" --timeout 30 2>&1)" || fail "E10 mixed run failed"
+case "$e10_out" in *"prd-continue-evidenced: 2/3"*) : ;; *) fail "E10 a mixed probe must print its per-probe pass count, got: $e10_out" ;; esac
+ruby -r json -e '
+  rep = JSON.parse(File.read(File.join(ARGV[0], "rep.json")))
+  abort "replica count not reported" unless rep.fetch("replicas") == 3
+  rows = rep.fetch("results")
+  abort "expected 6 replica rows, got #{rows.length}" unless rows.length == 6
+  %w[prd-continue-evidenced prd-stop-ambiguous-assent].each do |id|
+    abort "replica numbers wrong for #{id}" unless rows.select { |r| r["id"] == id }.map { |r| r["replica"] }.sort == [1, 2, 3]
+  end
+  summary = rep.fetch("probes")
+  abort "consensus wrong: #{summary}" unless summary.fetch("prd-continue-evidenced") == { "pass" => 3, "fail" => 0, "error" => 0, "status" => "PASS" } && summary.fetch("prd-stop-ambiguous-assent").fetch("status") == "FAIL"
+  mixed = JSON.parse(File.read(File.join(ARGV[0], "mixed.json"))).fetch("probes").fetch("prd-continue-evidenced")
+  abort "one failing replica must fail the probe: #{mixed}" unless mixed == { "pass" => 2, "fail" => 1, "error" => 0, "status" => "FAIL" }
+  single = JSON.parse(File.read(File.join(ARGV[0], "pass.json")))
+  abort "single run must report replicas 1" unless single.fetch("replicas") == 1
+  abort "single-run rows must keep their shape (no replica key)" if single.fetch("results").any? { |r| r.key?("replica") }
+' "$stub_dir" || fail "E9/E10 replica rows, consensus and single-run shape"
+
 if [ "$fails" -gt 0 ]; then
   echo "test_body_compliance_grading: $fails failure(s)" >&2
   exit 1

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh

@@ -9,6 +9,8 @@
 # per-case branches so unrelated local edits do not affect the assertions while the
 # current checker under test is still used.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 CHECK_SCRIPT="${CHECK_SCRIPT_UNDER_TEST:-$SCRIPT_DIR/check-ccl-skills.sh}"
@@ -1020,7 +1022,7 @@ RUBY
 run_gate_dateless() {
   gate_runs=$((gate_runs + 1))
   set +e
-  out="$(env -u ALIAS_AUDIT_CMD -u CCL_SKILL_BASE_REF RUBYOPT="-r$DATELESS_SHIM" ruby "$GATE_SCRIPT" "$REPO" 2>&1)"
+  out="$(env -u ALIAS_AUDIT_CMD -u CCL_SKILL_BASE_REF RUBYOPT="${RUBYOPT:+$RUBYOPT }-r$DATELESS_SHIM" ruby "$GATE_SCRIPT" "$REPO" 2>&1)"
   rc=$?
   set -e
 }
@@ -1044,7 +1046,7 @@ cmp -s "$GATE_SCRIPT" "$GATE_DATELESS_MUTANT" && fail "dateless mutation is a no
 run_gate_dateless_mutant() {
   gate_runs=$((gate_runs + 1))
   set +e
-  out="$(env -u ALIAS_AUDIT_CMD -u CCL_SKILL_BASE_REF RUBYOPT="-r$DATELESS_SHIM" ruby "$GATE_DATELESS_MUTANT" "$REPO" 2>&1)"
+  out="$(env -u ALIAS_AUDIT_CMD -u CCL_SKILL_BASE_REF RUBYOPT="${RUBYOPT:+$RUBYOPT }-r$DATELESS_SHIM" ruby "$GATE_DATELESS_MUTANT" "$REPO" 2>&1)"
   rc=$?
   set -e
 }

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_register_pending_exclusion.sh

@@ -11,6 +11,8 @@
 # separate R0 interim path. Clones this repo so assertions are independent of the
 # outer worktree diff.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 CHECK_SCRIPT="$SCRIPT_DIR/check-ccl-skills.sh"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -11,6 +11,7 @@
 #
 # --fast runs the quick/mid wrapper regressions:
 #   - test_ai_coding_implementation_gates.sh
+#   - test_locale_independent_gates.sh
 #   - test_controlled_escalation_pins.sh
 #   - test_check_ccl_size_budget.sh
 #   - test_check_ccl_skill_catalog.sh
@@ -104,6 +105,9 @@ run_lane() {
 
 fast_tests=(
   test_ai_coding_implementation_gates.sh
+  # Gates under a POSIX/unset locale: static pin coverage plus an applied
+  # pin-removal mutation, one throwaway fixture, seconds.
+  test_locale_independent_gates.sh
   # Reproducible RED-baseline for the controlled-escalation pin family: parses
   # family 8 out of the fixture above and proves each pin reds under its own
   # applied deletion mutation in a throwaway copy (spec 031 review disposition).

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_route_drift.sh

@@ -4,6 +4,8 @@
 # creates a deterministic bad diff there so unrelated local edits do not affect
 # the assertion while the current checker under test is still used.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 CHECK_SCRIPT="$SCRIPT_DIR/check-ccl-skills.sh"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_size_budget.sh

@@ -32,6 +32,8 @@
 # the real repository's actual file sizes/counts. Calls check-size-budget.sh directly
 # (not the full validator) so unrelated blocking gates do not interfere.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 SIZE_SCRIPT="$SCRIPT_DIR/check-size-budget.sh"
@@ -708,7 +710,7 @@ HAN_WORD_SKILL="$WORD_REPO/skills/han-skill/SKILL.md"
 ruby -e 's = File.binread(ARGV.fetch(0)).force_encoding(Encoding::UTF_8); exit(s.valid_encoding? ? 0 : 1)' "$HAN_WORD_SKILL" \
   || fail "f3 fixture: generated invalid UTF-8"
 set +e
-out="$(env -u CCL_SKILL_BASE_REF LC_ALL=C bash "$SIZE_SCRIPT" "$WORD_REPO" 2>&1)"
+out="$(env -u CCL_SKILL_BASE_REF LC_ALL=C RUBYOPT= bash "$SIZE_SCRIPT" "$WORD_REPO" 2>&1)"
 rc=$?
 set -e
 assert_rc "$rc" 1 "unspaced Han body above the word-equivalent limit must block under the C locale"
@@ -724,7 +726,7 @@ INVALID_UTF8_WORD_SKILL="$WORD_REPO/skills/invalid-utf8-skill/SKILL.md"
 write_skill_with_body_words "$INVALID_UTF8_WORD_SKILL" 5000
 ruby -e 'File.open(ARGV.fetch(0), "ab") { |f| f.write([0xFF].pack("C")) }' "$INVALID_UTF8_WORD_SKILL"
 set +e
-out="$(env -u CCL_SKILL_BASE_REF LC_ALL=C bash "$SIZE_SCRIPT" "$WORD_REPO" 2>&1)"
+out="$(env -u CCL_SKILL_BASE_REF LC_ALL=C RUBYOPT= bash "$SIZE_SCRIPT" "$WORD_REPO" 2>&1)"
 rc=$?
 set -e
 assert_rc "$rc" 1 "invalid UTF-8 byte must be counted without crashing the size gate"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_source_register_lifecycle.sh

@@ -3,6 +3,8 @@
 # check-ccl-skills.sh. Uses a temp clone with a tiny synthetic register so
 # assertions do not depend on the real shared ledger's line numbers or current rows.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 CHECK_SCRIPT="$SCRIPT_DIR/check-ccl-skills.sh"
@@ -16,7 +18,13 @@ TMP="$(mktemp -d "${TMPDIR:-/tmp}/source-register-lifecycle.XXXXXX")"
 trap 'rm -rf "$TMP"' EXIT
 
 fail() { echo "FAIL: $*" >&2; exit 1; }
-assert_rc() { [ "$1" = "$2" ] || fail "expected rc=$2 got rc=$1${3:+ ($3)}"; }
+# On a mismatch, show the tail of the run that produced it: an rc alone gave CI
+# no way to name which gate inside the full check went red.
+assert_rc() {
+  [ "$1" = "$2" ] && return 0
+  printf '%s\n' "${out:-}" | tail -n 40 >&2
+  fail "expected rc=$2 got rc=$1${3:+ ($3)}"
+}
 assert_contains() { case "$2" in *"$1"*) : ;; *) fail "expected output to contain: $1${3:+ ($3)}";; esac; }
 assert_not_contains() { case "$2" in *"$1"*) fail "expected output NOT to contain: $1${3:+ ($3)}";; *) : ;; esac; }
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_sync_pointers.sh

@@ -8,6 +8,8 @@
 # portable to GNU sed (Linux CI), and a red suite there would be a harness
 # defect, not evidence.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 SYNC_SCRIPT="$SCRIPT_DIR/check-sync-pointers.sh"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_bank_grader_diagnostics.sh

@@ -2,6 +2,8 @@
 # Regression test for eval-routing-bank grader failure diagnostics. Uses a fake
 # claude earlier in PATH so this never invokes a real Claude CLI or account.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 EVAL_SCRIPT="$SCRIPT_DIR/eval-routing-bank.rb"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_bank_resolution.sh

@@ -9,6 +9,8 @@
 #
 # Uses a fake `claude` earlier in PATH: never invokes a real CLI or account.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 EVAL_SCRIPT="$SCRIPT_DIR/eval-routing-bank.rb"
@@ -87,6 +89,36 @@ assert_absent "screening_resolution_only" "$out_hi" "a run at the floor must not
 grep -q '"action_resolution": true' "$TMP/hi.json" \
   || fail "at-floor report must carry action_resolution:true"
 
+# --- (2a) the router model is part of the measurement -----------------------
+# A run on the runner's default model screens; a description edit needs the tier
+# that routes in use. The report says whether --model was given, the default run
+# says so on stdout, and the reference states the rule the flag serves.
+grep -q '"model_source": "default"' "$TMP/hi.json" \
+  || fail "a run without --model must report model_source:default"
+assert_contains "router_model_default" "$out_hi" "a run on the default router model must say so"
+out_ex="$(ruby "$EVAL_SCRIPT" "$REPO" --replicas 1 --model fixture-router --json "$TMP/ex.json" 2>&1)" \
+  || fail "runner exited non-zero with an explicit model:\n$out_ex"
+grep -q '"model_source": "explicit"' "$TMP/ex.json" \
+  || fail "a run with --model must report model_source:explicit"
+assert_absent "router_model_default" "$out_ex" "an explicitly chosen router model must not be flagged as the default"
+grep -q 'model_source: explicit' "$DOC" \
+  || fail "eval-routing.md must state that a skill decision needs an explicitly chosen deploying-tier model"
+
+# --- (2a') the router runs with hooks disabled --------------------------------
+# Installed plugins' hooks would inject routing context the bank never asked for
+# (the bootstrap is measured only through --with-bootstrap) and could rewrite the
+# final answer, so the grader call must carry the hook-disabling settings.
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$@" > "$ROUTER_ARGS_FILE"
+cat >/dev/null
+printf '{"selected_skill":"testing-strategy","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+ROUTER_ARGS_FILE="$TMP/router-args" ruby "$EVAL_SCRIPT" "$REPO" --replicas 1 --json "$TMP/args.json" >/dev/null 2>&1 || true
+grep -qF '"disableAllHooks":true' "$TMP/router-args" \
+  || fail "the router call must disable hooks so plugin context cannot leak into the measurement"
+
 # --- (2b) a nominal at-floor run with an invalid observation is NOT actionable -
 # The floor is on valid observations. A grader that fails one call leaves the
 # task below the floor while `--replicas` still reads 10, and a report that

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_bank_surface_binding.sh

@@ -8,6 +8,8 @@
 # assertion alone. Uses a fake claude earlier in PATH; never invokes a real
 # Claude CLI or account. Grading semantics must be untouched.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 EVAL_SCRIPT="$SCRIPT_DIR/eval-routing-bank.rb"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_prose_target.sh

@@ -7,6 +7,8 @@
 # (the arrow regex captured bare "the" and dropped it as generic English). The
 # finding is ADVISORY: reported, NEVER blocks.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 EVAL="$SCRIPT_DIR/eval-routing.rb"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_impact_chain_gate_dateless_host.sh

@@ -21,6 +21,8 @@
 # the defect class is host-dependence itself: one mutant, two hosts, two
 # verdicts — exactly the masking this fix removes.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 GATE="$SCRIPT_DIR/impact-chain-gate.rb"
@@ -88,7 +90,7 @@ git -C "$REPO" commit -qm "description-only change with #description row"
 
 run_gate() { # <gate-path> <RUBYOPT value or empty>
   set +e
-  out="$(env -u ALIAS_AUDIT_CMD -u CCL_SKILL_BASE_REF RUBYOPT="$2" ruby "$1" "$REPO" 2>&1)"
+  out="$(env -u ALIAS_AUDIT_CMD -u CCL_SKILL_BASE_REF RUBYOPT="${RUBYOPT:+$RUBYOPT }$2" ruby "$1" "$REPO" 2>&1)"
   rc=$?
   set -e
 }

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_impact_chain_gate_verdict_differential.sh

@@ -36,6 +36,8 @@
 # Oracle: an always-refuse candidate fails on the pins; an always-accept
 # candidate fails on the baseline-red case. Both arms are exercised.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 CANDIDATE_GATE="$SCRIPT_DIR/impact-chain-gate.rb"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_impact_chain_round_attribution.sh

@@ -35,6 +35,8 @@
 # mistake were observed while writing this file. Do not "fix" a leg by relaxing
 # its assertion.
 set -euo pipefail
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 # REVERSE DIFFERENTIAL. Each leg below states which gate behavior it pins, and a

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_impact_chain_self_adjudication.sh

@@ -14,6 +14,8 @@
 # 期望红的用例都必须点名 WHICH refusal：rc 单独是弱 oracle，为无关原因（fixture 缺陷、
 # 锚点断掉）红同样是 rc=1，会把「形态已关闭」读成绿。
 set -u
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 ROOT="$(cd "$(dirname "$0")/../../.." && pwd -P)"
 GATE="$ROOT/skills/skill-extraction-workflow/scripts/impact-chain-gate.rb"
 LEDGER_REL="skills/skill-extraction-workflow/references/source-register.md"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_impact_chain_source_refuted.sh

@@ -7,6 +7,8 @@
 #
 # 全部确定性，不调模型。每用例一条分支，互不影响本地未提交改动。
 set -u
+# Ruby takes its encoding from the locale; under a POSIX/unset locale it reads the UTF-8 skill text as US-ASCII and crashes. Pin UTF-8, as CI runs.
+case " ${RUBYOPT:-} " in *" -Ku "*) ;; *) export RUBYOPT="-Ku${RUBYOPT:+ $RUBYOPT}" ;; esac
 ROOT="$(cd "$(dirname "$0")/../../.." && pwd -P)"
 GATE="$ROOT/skills/skill-extraction-workflow/scripts/impact-chain-gate.rb"
 TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT INT TERM