@ccoalm/ccl-skills 0.3.0 → 0.5.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/check-ccl-skills.sh

@@ -270,7 +270,18 @@ else
 end
 ' "$root"
 
-if leak_output="$(rg -n 'code\.[[:alnum:].-]+|figma\.com/files|[0-9]{8,}|\x{6559}\x{5e08}|\x{5b66}\x{751f}|\x{8003}\x{8bd5}|\x{5b66}\x{6821}|\x{9605}\x{5377}|\x{51fa}\x{5377}|\x{626b}\x{63cf}|\x{5b66}\x{60c5}' "$root"/skills/*/SKILL.md "$root"/skills/*/references/*.md 2>/dev/null)"; then
+# Public DOMAIN word list: a weak-proxy FALLBACK, not the authoritative R0 gate.
+# The real invariant — "this public text identifies one specific organization or
+# project" — is not decidable by a public regex, which is why the private alias
+# audit (ALIAS_AUDIT_CMD -> r0_status=private-ok) is authoritative and this list
+# only covers environments without it. Consequence, stated rather than fought:
+# these terms are ANOTHER domain's ordinary vocabulary, so they decay — a term
+# outlives the project it proxied for and then only produces false positives.
+# Maintain by RETIREMENT, not by growth: when a term no longer proxies anything
+# live, delete it (quantify current hits first, and keep a retained-term control
+# so the scan is proven still able to fail). Do not add generic technical words.
+# Both directions are pinned by test_entrypoint_domain_scan_terms.sh.
+if leak_output="$(rg -n 'code\.[[:alnum:].-]+|figma\.com/files|[0-9]{8,}|\x{6559}\x{5e08}|\x{5b66}\x{751f}|\x{8003}\x{8bd5}|\x{5b66}\x{6821}|\x{9605}\x{5377}|\x{51fa}\x{5377}|\x{5b66}\x{60c5}' "$root"/skills/*/SKILL.md "$root"/skills/*/references/*.md 2>/dev/null)"; then
   echo "$leak_output"
   echo "entrypoint_or_reference_domain_scan_failed" >&2
   exit 1
@@ -514,6 +525,159 @@ if [[ -n "${gid_hits//[$'\n']/}" ]]; then
 fi
 echo "git_identity_predicate_scan_ok"
 
+# Anti-pattern 28 — process liveness decided by an EXISTENCE test that a corpse answers
+# (see references/recurring-anti-patterns-checklist.md). A pid whose process has exited
+# but has not been reaped is still in the process table: it answers `kill -0`, and its
+# ppid still reads — as 1 once it is reparented. A check that concludes "alive" or
+# "orphaned and alive" from existence alone therefore says yes about a corpse, while the
+# verdict scans in the same suite exclude zombies and say gone — one process state, two
+# answers, and a probe that reds while the code under test is behaving.
+# Promoted from checklist to gate because the class recurred three times in CI on the
+# abort-leak probe, each time on a different assertion, each time asserting the probe's
+# environment rather than the suite.
+# Scope: `test_*.sh` / `test.sh` under the repo — the surface where such a predicate is a
+# TEST VERDICT rather than a signalling guard. Excluded on purpose: non-test shell (a
+# `kill -0` before signalling asks about existence, which is the right question there),
+# and WHOLE-LINE comments (this comment block names the banned spelling).
+# The predicate is the orphan-oracle shape specifically: a `ps -o ppid=` read compared
+# against init's pid on the same line. That shape has exactly one meaning — "has this
+# been reparented, i.e. is it a live orphan" — so precision is high; a ppid read used to
+# IDENTIFY a parent (the common use) is untouched. A process-state consult (`stat=` or a
+# helper whose name ends in `_state`) within the window clears the line, which is the fix.
+# Recall limits — stated so the contract is not overclaimed, per the checklist's
+# promotion guidance (high precision plus a documented recall limit beats broad matching
+# for a BLOCKING gate):
+#   1. `while kill -0 "$pid"` watchdog loops are NOT flagged. Two exist here; both wait on
+#      a direct child and `wait` for it immediately after, so the shell reaps it and the
+#      loop ends — a narrower risk than the shape above, and forcing churn on them would
+#      trade a real false-positive cost for an unproven gain.
+#   2. a liveness branch spelled with a bare `kill -0` inside a loop BODY.
+#   3. any dynamic or indirect spelling.
+# Those stay checklist plus adversarial-challenge checks.
+liveness_hits=""
+liveness_list=$(mktemp "${TMPDIR:-/tmp}/ccl-skills-liveness.XXXXXX") || {
+  echo "liveness_predicate_scan_error: mktemp failed" >&2; exit 1; }
+# Guarded rather than the `${var:-/dev/null}` idiom: this trap is installed
+# unconditionally, so an unset var would make the cleanup `rm -f /dev/null` — a no-op for
+# an unprivileged user and a deleted device node for a root container. Never name a path
+# in a removal that a fallback can turn into someone else's file.
+liveness_scan_cleanup() {
+  [ -n "${liveness_list:-}" ] && [ -e "${liveness_list:-}" ] && rm -f "$liveness_list"
+  [ -n "${gid_list:-}" ] && [ -e "${gid_list:-}" ] && rm -f "$gid_list"
+  return 0
+}
+trap liveness_scan_cleanup EXIT
+# Same traversal hardening as Anti-pattern 27, and for the same reason: every leg here
+# exists because its absence makes the gate print "ok" for a scan that did not happen.
+if find -L "$root" -name '*.sh' -type f -print0 > "$liveness_list" 2>/dev/null; then
+  liveness_find_rc=0
+else
+  liveness_find_rc=$?
+fi
+if [[ "$liveness_find_rc" -ne 0 ]]; then
+  rm -f "$liveness_list"
+  echo "liveness_predicate_scan_error: find exited $liveness_find_rc — the walk is INCOMPLETE, which is not the same as clean" >&2
+  exit 1
+fi
+while IFS= read -r -d '' liveness_file; do
+  [[ -n "$liveness_file" ]] || continue
+  case "${liveness_file##*/}" in test_*.sh|test.sh) : ;; *) continue ;; esac
+  # `[^=]*[^!=]=` rather than `.*=`: an unrestricted `.*` swallows the `!` of a `!=`, so
+  # the negated assertion `[ "$(ps -o ppid= -p "$pid")" != "1" ]` — which checks a process
+  # is NOT reparented, the opposite of the banned oracle — was reported as a violation.
+  # A false positive on a blocking gate is the failure this checklist's promotion
+  # guidance weighs heaviest, because it is what gets a gate loosened until it catches
+  # nothing.
+  if liveness_out="$(grep -nE 'ps[[:space:]]+-o[[:space:]]+ppid=[^=]*[^!=]=[[:space:]]*"?1"?[[:space:]]*\]' "$liveness_file" 2>/dev/null)"; then
+    liveness_rc=0
+  else
+    liveness_rc=$?
+  fi
+  if [[ "$liveness_rc" -gt 1 ]]; then
+    rm -f "$liveness_list"
+    echo "liveness_predicate_scan_error: grep exited $liveness_rc while scanning ${liveness_file#"$root"/} — unreadable or I/O failure means the result is UNKNOWN, not clean" >&2
+    exit 1
+  fi
+  [[ "$liveness_rc" -eq 0 ]] || continue
+  while IFS= read -r liveness_line; do
+    [[ -n "$liveness_line" ]] || continue
+    liveness_no="${liveness_line%%:*}"
+    liveness_text="${liveness_line#*:}"
+    [[ "$liveness_text" =~ ^[[:space:]]*# ]] && continue
+    # Window clear: a process-state consult within two lines either side is the fix, so
+    # a corrected site stops being reported without needing a waiver marker.
+    liveness_lo=$(( liveness_no > 2 ? liveness_no - 2 : 1 ))
+    liveness_hi=$(( liveness_no + 2 ))
+    # Whole-line comments are dropped before the window is inspected: a prose mention
+    # such as a TODO naming the helper would otherwise clear a real violation beside it,
+    # and the gate would print ok for a line it had actually found. The waiver must be
+    # CODE that consults process state, not a note saying someone should.
+    # Only WHOLE-LINE comments are dropped, matching how the hit line itself is filtered.
+    # Stripping trailing comments would need to decide whether a `#` opens a comment or
+    # belongs to `${var#prefix}`, which needs a shell parser — the same call Anti-pattern
+    # 27 makes above. Recall limit: a mention in a TRAILING comment can still clear the
+    # window; the checklist row records it.
+    liveness_win="$(sed -n "${liveness_lo},${liveness_hi}p" "$liveness_file" 2>/dev/null |
+                      grep -vE '^[[:space:]]*#' || true)"
+    # A direct `ps -o stat=` in the window is the consult itself. Anchored on `-o stat=`
+    # rather than bare `stat=`: an unrelated assignment such as `stat=unknown` is not a
+    # process-state read, and accepting it was the fourth way this waiver was found to
+    # clear a real hit.
+    if printf '%s' "$liveness_win" | grep -qE '\-o[[:space:]]*stat='; then
+      continue
+    fi
+    # Otherwise the window may CALL a state helper — but only one this file actually
+    # defines and which itself consults process state. Accepting any `*_state` token
+    # made an unrelated `record_state "$pid"` read as remediation and skipped a real
+    # hit, which is a hole rather than a stated recall limit.
+    # The file must also actually consult process state somewhere, so a file with no
+    # `stat=` at all cannot be cleared by a bookkeeping helper that merely ends in
+    # `_state`. Recall limit: a file that separately defines such a helper AND reads
+    # process state elsewhere clears the window without proving the two are connected —
+    # tying a call to its definition needs a shell parser, the same call made above.
+    # Deliberately POSIX-portable: `\b` and BSD-sed `\?` are not, and a silently failing
+    # match here would loosen the gate on exactly the host that runs it most.
+    # The named helper's OWN BODY must reach a process-state read. Checking "the file
+    # defines it" and "the file reads state somewhere" as two independent facts let a
+    # hollow helper plus an unrelated `ps -o stat=` elsewhere clear a real hit — the two
+    # conditions were never tied to each other. awk rather than sed: BSD sed lacks `\?`
+    # and a silently failing match here loosens the gate on the host that runs it most.
+    liveness_helper_ok=0
+    while IFS= read -r liveness_helper; do
+      [[ -n "$liveness_helper" ]] || continue
+      if awk -v fn="$liveness_helper" '
+           $0 ~ "^[[:space:]]*(function[[:space:]]+)?" fn "[[:space:]]*\\(\\)" {
+             # The declaration line is part of the body: a one-line definition both opens
+             # and closes here. Skipping it with a bare `next` left `inbody` set through
+             # `fn() { echo live; }` and credited the NEXT function\047s state read to this
+             # hollow one.
+             if ($0 ~ /-o[[:space:]]*stat=/) { found = 1; exit }
+             if ($0 ~ /}/) { exit }
+             inbody = 1
+             next
+           }
+           inbody && /-o[[:space:]]*stat=/ { found = 1; exit }
+           inbody && /^[[:space:]]*}/ { exit }
+           END { exit !found }
+         ' "$liveness_file" 2>/dev/null; then
+        liveness_helper_ok=1
+        break
+      fi
+    done < <(printf '%s\n' "$liveness_win" | grep -oE '[A-Za-z_][A-Za-z0-9_]*_state' | sort -u)
+    [[ "$liveness_helper_ok" -eq 1 ]] && continue
+    liveness_hits+="${liveness_file#"$root"/}:$liveness_line"$'\n'
+  done <<< "$liveness_out"
+done < "$liveness_list"
+rm -f "$liveness_list"
+if [[ -n "${liveness_hits//[$'\n']/}" ]]; then
+  # Trailing newline restored explicitly: command substitution strips it, which ran the
+  # last hit and the diagnosis together on one line.
+  printf '%s\n' "$(printf '%s' "$liveness_hits" | sort)"
+  echo "liveness_predicate_scan_failed: the lines above decide that a process is a LIVE orphan from a ppid read alone, which an unreaped corpse answers the same way — the check says alive while the suite's own verdict scans exclude zombies and say gone. Consult process STATE (\`ps -o stat=\`, or a helper that returns live/zombie/absent) before concluding liveness. See skill-extraction-workflow/references/recurring-anti-patterns-checklist.md (Anti-pattern 28)." >&2
+  exit 1
+fi
+echo "liveness_predicate_scan_ok"
+
 # Evidence-card leak PREFLIGHT (best-effort, NOT the gate of record): catches obvious
 # card-shaped markdown accidentally committed under skills/** (L0 storage rule, see
 # l0-l1-l2-routing.md). Delegated to a dedicated, self-tested detector. The gate runs the

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/eval-health.rb

@@ -1,13 +1,13 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-# F4 health roll-up — advisory composite score (0-10) + trend over time.
+# F4 signal dashboard — advisory display roll-up (0-10) + same-stick change.
 #
-# Rolls the F4 signals up into ONE weighted 0-10 number plus a trend, so the
-# question "is the skill repo trending healthier or worse?" has an answer. This
-# is the pattern OpenSSF Scorecard uses for repos (per-check 0-10 -> risk-weighted
-# aggregate 0-10, tracked over time); gstack-health uses the same shape for code
-# repos. We adapt it to F4 skill-eval signals — we do NOT score code tools.
+# Shows the F4 dimensions together and retains a weighted 0-10 display value plus
+# a same-corpus/dimensions delta for compatibility with existing reports. The
+# shape resembles OpenSSF Scorecard, but the value is not a verdict that the
+# skill repository is globally better or worse: these dimensions have different
+# semantics, and a quality or safety failure is never averaged away.
 #
 # Dimensions (each scored 0-10, risk-weighted OpenSSF-style):
 #   structural      weight 10 (Critical)  — validate-skill.sh: skills load / no leakage
@@ -29,7 +29,8 @@
 # (structural validation + Tier-1 blocking findings) remain the source of truth
 # and block independently of this score. Per Goodhart's law ("when a measure
 # becomes a target, it ceases to be a good measure"), a composite that became a
-# merge gate would just get gamed; it stays a lens, not a gate. The history file
+# merge gate would just get gamed; it stays a navigation lens, not a gate or an
+# acceptance grade. The history file
 # is git-ignored for the same reason — a committed number invites tuning the
 # number instead of the repo.
 #
@@ -289,7 +290,14 @@ unless no_write
 end
 
 report = entry.merge(
+  # `band` keeps its name and values for existing report consumers, but the
+  # machine surface must not be the one place the withdrawal does not reach: a
+  # consumer reads this JSON, not the header line, and CLEAN / WARNING / NEEDS
+  # WORK / CRITICAL is grade vocabulary that gets quoted as an acceptance verdict.
+  # The qualifier therefore travels as its own field rather than only in `puts`.
   "band" => band(composite),
+  "band_semantics" => "navigation-only display label; not an acceptance grade or an overall-quality verdict",
+  "score_semantics" => "weighted display roll-up over the dims present in this run; comparable only against the same corpus and dims",
   "weights_present" => present.to_h { |k, _| [k.to_s, RISK[k]] },
   "details" => dims.to_h { |k, d| [k.to_s, d[:detail]] },
   "trend" => trend,
@@ -306,13 +314,18 @@ if out_json
 end
 
 unless quiet
-  puts "F4 HEALTH ROLL-UP (advisory — not a gate)"
+  puts "F4 SIGNAL DASHBOARD (advisory — not a gate or overall-quality verdict)"
   puts "  repo=#{repo_sha} corpus=#{corpus} dims=#{present_dims.join(',')}"
   dims.each do |k, d|
     s = d[:score].nil? ? "  -  " : format("%2d/10", d[:score])
     puts "  #{k.to_s.ljust(15)} #{s}  #{d[:detail]}"
   end
-  puts "  COMPOSITE  #{format('%.1f', composite)}/10  #{band(composite)}"
+  # The band label carries grade vocabulary (CLEAN / WARNING / NEEDS WORK /
+  # CRITICAL) that reads as an acceptance verdict and gets quoted downstream as
+  # one. The header withdrew that claim; printing the bare label next to the
+  # number would have left the executable surface contradicting the withdrawal,
+  # so the qualifier travels with the label rather than only with the header.
+  puts "  DISPLAY ROLL-UP  #{format('%.1f', composite)}/10  #{band(composite)} (navigation only, not an acceptance grade)"
   if prior_comparable
     arrow = trend.positive? ? "IMPROVING +#{trend}" : (trend.negative? ? "DECLINING #{trend}" : "FLAT")
     puts "  trend vs #{prior_comparable['repo_sha']} (same corpus+dims): #{arrow}"
@@ -321,7 +334,7 @@ unless quiet
   else
     puts "  trend: first run — no history yet"
   end
-  puts "  (binary gates still block independently of this number; history=#{history}, git-ignored)"
+  puts "  (inspect dimensions and task evidence; gates block independently; history=#{history}, git-ignored)"
 end
 
 exit 0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/impact-chain-gate.rb

@@ -299,7 +299,11 @@ end
 # changed owner at all, so the entire row evaluation was skipped and the
 # surviving row was never even looked at. With no ledger change there are no
 # added rows, so the skip stays exactly as cheap as before for unrelated diffs.
-if upstream.any? || changed_paths.include?(LEDGER_PATH)
+# The routing task bank joins the entry condition (045): a commit that moves only
+# `eval/routing-tasks.jsonl` changes no owner package and need not touch the
+# ledger, so without this the whole block — including the bank-evidence
+# obligation written for exactly that change — was never entered.
+if upstream.any? || changed_paths.include?(LEDGER_PATH) || changed_paths.include?("eval/routing-tasks.jsonl")
   # Rows are collected PER ROUND and carry the scope they were authored against,
   # so the classifiers below judge a row against its own round's diff. Reading the
   # cumulative register diff instead would re-judge every earlier round's rows
@@ -1338,4 +1342,302 @@ if upstream.any? || changed_paths.include?(LEDGER_PATH)
     behavior_failures.each { |path| warn "  incomplete: #{path}" }
     exit 1
   end
+
+  # ---- 045: an obligation whose skip leaves no artifact is not enforced ------
+  # Round 044 withdrew several overclaims and, in the same move, demoted the
+  # obligations riding on them into advisories. Five consecutive challenge rounds
+  # returned one shape: the entry condition is stated by the party the obligation
+  # constrains, and SKIPPING IT PRODUCES NOTHING for a reviewer to notice missing.
+  # A reviewer cannot refuse an absent claim.
+  #
+  # Both checks below key on facts of the DIFF — which file changed, which key a
+  # row carries — never on prose semantics. That is deliberate and is the whole
+  # difference from the proxy predicates this repository has repeatedly watched
+  # get walked through: a proxy asks "does this text look like it did the thing",
+  # an invariant asks "is the artifact there". Skipping either obligation now
+  # leaves a detectable absence, which is the half the demotion removed.
+  #
+  # Scope limit, stated here so a later round does not read more into it: these
+  # close OMISSION, not MISCLASSIFICATION. `result-class` is still chosen by the
+  # author, and a bank-evidence locator is not proof the bank actually ran. What
+  # changes is that a silent skip becomes a visible claim the review can accept
+  # or refuse — which is exactly what round 044's reviewer said was missing.
+  fragment_value = lambda do |text, key|
+    text.to_s.split(";").each do |fragment|
+      m = fragment.match(/\A\s*#{Regexp.escape(key)}:\s*(.+?)\s*\z/i)
+      return m[1] if m
+    end
+    nil
+  end
+  declaring_row = lambda do |row|
+    row[:behavior].to_s.split(";").any? { |f| f.match?(/\A\s*behavioral-evidence:/i) }
+  end
+
+  result_classes = %w[failure stable-success insufficient-evidence]
+  # A round is held only to the grammar ITS OWN HEAD declares. Adding a required
+  # field would otherwise refuse every historical round the moment anyone replays
+  # it — which the verdict-differential suite correctly reports as a regression,
+  # and which would make the row grammar permanently unextendable. This is not a
+  # date or commit-id grandfather clause (those are proxies that drift): the
+  # predicate is whether the ledger at that round's head defines the field, so a
+  # round that was never told cannot be refused for not knowing.
+  grammar_marker = "result-class: failure|stable-success|insufficient-evidence"
+  grammar_declared_cache = {}
+  grammar_declared_at = lambda do |ref|
+    grammar_declared_cache[ref] ||= begin
+      bytes = raw_blob_at.call(ref, LEDGER_PATH)
+      next false unless bytes
+      # The DECLARATION is prose, and only prose declares. Scanning the whole blob
+      # let a round delete the declaring paragraph while dropping the same literal
+      # into an ordinary ledger ROW: both sides then read as declared, the
+      # withdrawal check stays empty, and every later round keeps being judged by
+      # a grammar the authority no longer states. Rows quote and describe; they do
+      # not legislate, so a marker sitting inside one is not a declaration.
+      bytes.dup.force_encoding(Encoding::UTF_8).each_line.any? do |line|
+        !line.lstrip.start_with?("|") && line.include?(grammar_marker)
+      end
+    end
+  end
+  # Scoped to rows that resolve to an owner THIS round changed — the same subject
+  # set every other per-row check uses. Walking `rows` instead swept in every
+  # historical ledger line whenever the round's base did not already contain it
+  # (a shallow fixture base, a branch cut far back), turning an append-only ledger
+  # into something that fails on its own past. The obligation is on the round
+  # being judged, not on the file it appends to.
+  # Declared -> undeclared is not a legitimate history, it is the off switch.
+  # Without this, deleting or rewording the paragraph makes both checks skip and
+  # the round is indistinguishable from one that predates them — a silent
+  # disarm wearing the shape of the very non-retroactivity rule that permits it.
+  # Withdrawing the grammar deliberately is still possible; it just cannot be
+  # done quietly, which is the whole subject of this round.
+  grammar_withdrawn = round_bounds.select do |span_base, span_head|
+    grammar_declared_at.call(span_base) && !grammar_declared_at.call(span_head)
+  end
+  unless grammar_withdrawn.empty?
+    warn "impact_chain_grammar_withdrawn: a round removed the ledger's declaration-fragment paragraph, which would disable `result-class` and `bank-evidence` for every later round"
+    warn "  note: the checks are gated on the head-declared grammar so history is not judged by rules it was never told. That gate reads an ABSENT declaration as `before the rule`; a declaration that was present and is now gone is a withdrawal, and it has to be argued rather than committed"
+    # Name only a remediation this gate actually implements. An earlier version of
+    # this line offered "land the withdrawal with a named risk owner", and no code
+    # here parses any such artifact — the refusal was unconditional, so the
+    # message promised a way through that did not exist and the round had none.
+    # The escape is deliberately NOT built: a data-side waiver token for a
+    # mechanical obligation is the self-adjudication surface this round removes.
+    # Withdrawing the obligation means removing the triggers, which is a reviewable
+    # code diff rather than a line someone writes about themselves.
+    warn "  fix: restore the `result-class: failure|stable-success|insufficient-evidence` definition in #{LEDGER_PATH}. There is no data-side waiver: to retire the obligation, remove the checks in this file in their own reviewed change"
+    grammar_withdrawn.each { |base, head| warn "  round: #{base}..#{head}" }
+    exit 1
+  end
+
+  # EVERY declaring row of a round whose head declares the grammar, not only rows
+  # that resolve to a changed owner. Scoping by owner was the first attempt at
+  # non-retroactivity, and it left its own hole: a round that changes only the
+  # routing bank has no changed owner, so a declaring row with no `result-class`
+  # was never examined at all. Non-retroactivity is the grammar gate's job and it
+  # does that job alone; making the owner set do it too bought nothing and cost a
+  # false green. A row that declares an impact chain owes its class, whatever the
+  # round happened to touch.
+  result_class_failures = rows.select do |row|
+    next false unless declaring_row.call(row)
+    next false unless grammar_declared_at.call(row[:scope].head)
+    value = fragment_value.call(row[:behavior], "result-class")
+    !(value && result_classes.include?(value.downcase))
+  end.uniq { |row| row[:line] }
+  unless result_class_failures.empty?
+    warn "impact_chain_result_class_missing: an added row declaring behavioral-evidence carries no usable `result-class`"
+    warn "  note: omitting the cell was the cheapest of the three bypasses review found — static checks pass, nothing emits `interim`, and the reviewer has no field to accept or refuse. The value stays the author's call; its ABSENCE no longer does"
+    warn "  fix: add `result-class: #{result_classes.join('|')}` to the row's declaration fragments"
+    result_class_failures.each { |row| warn "  row: #{row[:line].to_s.sub(/^\+/, '').strip}" }
+    exit 1
+  end
+
+  # Trigger A: a change to the routing surface owes bank evidence.
+  bank_relative = "eval/routing-tasks.jsonl"
+  description_entry_at = lambda do |ref, relative|
+    bytes = raw_blob_at.call(ref, relative)
+    next nil if bytes.nil?
+    parts = split_frontmatter.call(bytes.dup.force_encoding(Encoding::UTF_8))
+    next nil unless parts
+    entry = split_description_entry.call(parts[0])
+    entry && entry[1]
+  end
+  # `upstream` keys are owner-relative (`<owner>/SKILL.md`) while changed_paths and
+  # blob lookups are repo-relative; the same `skills/` prefix the evidence-file
+  # check applies. Without it the description branch silently never fired and the
+  # two cases that DO carry evidence passed for the wrong reason — a false green
+  # that only the paired no-evidence cases could expose.
+  # Owner-scoped ONLY. An earlier version also returned true here whenever the bank
+  # had changed, on the reasoning that the bank is everyone's routing surface. In a
+  # multi-round range that conflated two different subjects: the round that moved
+  # the bank then demanded an owner-specific row from every owner the RANGE had
+  # touched, including owners changed in some other round for unrelated reasons —
+  # so adding a later, unrelated commit changed the verdict on an earlier one. The
+  # bank is its own subject and is checked as one; this predicate answers only
+  # "did THIS owner move ITS OWN description in THIS round".
+  description_touched = lambda do |scope, path|
+    relative = "skills/#{path}"
+    next false unless scope.changed_paths.include?(relative)
+    base_entry = description_entry_at.call(scope.base, relative)
+    head_entry = description_entry_at.call(scope.head, relative)
+    # "No head entry" is two different things and only one of them is exempt.
+    # The FILE being gone (deleted, renamed away) is exempt: its description did
+    # not move, the file did, and the rename machinery owns that case. The file
+    # still being there with its description entry REMOVED is the opposite — the
+    # skill stops advertising what reaches it, which is a routing-surface change
+    # as much as rewording one. Collapsing both into `head_entry.nil?` let a
+    # description be deleted in place with no evidence and no refusal.
+    if head_entry.nil?
+      next false if raw_blob_at.call(scope.head, relative).nil?
+      next !base_entry.nil?
+    end
+    # A path with a head entry and NO base entry is a routing surface being
+    # CREATED — a first description decides which requests reach a new skill, so
+    # it is the largest routing-surface change there is, not an exemption. An
+    # earlier version skipped it as "conservative"; review named that as the hole
+    # it is. The one creation that is not a new routing surface is a rename's
+    # target, where the same description arrives under a new path — git proves
+    # that pairing, so it is excluded on evidence rather than on shape.
+    if base_entry.nil?
+      pair = scope.rename_pairs.find { |_from, to| "#{to}/SKILL.md" == path }
+      if pair
+        # A rename is excluded because the SAME description arrived under a new
+        # path. Excluding the target without checking that made rename+reword in
+        # one commit a free routing change: the target is exempt as "just a
+        # rename" and the source is exempt for having no head entry, so the edit
+        # rides in between them. Compare across the pair — the exemption is for
+        # a description that did not change, not for a path that moved.
+        from_entry = description_entry_at.call(scope.base, "skills/#{pair[0]}/SKILL.md")
+        next true if from_entry.nil?
+        next from_entry != head_entry
+      end
+      next true
+    end
+    base_entry != head_entry
+  end
+  # A downscope is allowed — skipping the measurement is sometimes right — but it
+  # must land somewhere a reader reaches. Requiring the token in a changed spec
+  # keeps `downscoped:` from becoming the next self-adjudicated exit: the author
+  # still decides, and still has to write the decision down where review sees it.
+  downscope_recorded = lambda do |scope, token|
+    # The token has to be a TOKEN. `\S+` accepted `-`, and a substring search then
+    # found it in the bullet punctuation of any changed spec line — so
+    # `downscoped:-` discharged the obligation against a record that says nothing.
+    # A downscope is a decision someone has to be able to look up; a character
+    # that occurs incidentally in prose cannot be that. Eight or more, starting
+    # alphanumeric, and no whitespace: long enough not to collide by accident,
+    # loose enough not to dictate a naming scheme.
+    next false unless token.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]{7,}\z/)
+    # The spec must record the DECLARATION, verbatim — `downscoped:<token>` — not
+    # merely contain the token somewhere. Searching for the bare token let a
+    # common word discharge the obligation against a line that happens to use it
+    # ("Bank evidence anchor …" satisfied `downscoped:evidence`), which is the
+    # silent self-adjudication this gate exists to close, rebuilt out of substring
+    # matching. Requiring the full spelling makes the recorded line say what it is.
+    # Bounded, not substring. `include?("downscoped:TOK")` also matched a spec that
+    # records `downscoped:TOKLONGER` — a strict prefix of somebody else's token
+    # discharging this row — and matched `not-downscoped:TOK` too, which records
+    # the opposite. The declaration has to end where the row's token ends and to
+    # start at the keyword.
+    needle = /(?<![A-Za-z0-9._-])downscoped:#{Regexp.escape(token)}(?![A-Za-z0-9._-])/
+    scope.changed_paths.any? do |relative|
+      next false unless relative.start_with?("specs/") && relative.end_with?(".md")
+      added_lines_for.call(scope, relative).any? { |line| line.match?(needle) }
+    end
+  end
+
+  # Evaluated PER ROUND, not per owner. Two defects independent review found in
+  # the per-owner shape, both of which let the obligation evaporate:
+  #   - a diff that changes ONLY `eval/routing-tasks.jsonl` has no changed owner,
+  #     so the per-owner loop was never entered and the routing bank could move
+  #     with no evidence at all. The first fixture missed it by also touching an
+  #     owner, which is how a hole hides behind a green case.
+  #   - `triggered` and `satisfied` each scanned every row of the owner across ALL
+  #     rounds, so one round's valid locator satisfied a different round's naked
+  #     routing-surface change. The obligation belongs to the round that incurred
+  #     it; the row that discharges it has to sit in the same round.
+  bank_evidence_failures = []
+  # Iterating the ROUNDS, not the rows: grouping by row scope meant a round that
+  # moved the bank and appended no ledger row had no scope to inspect, so the one
+  # change that needs no owner and no row escaped entirely. The first fixture for
+  # this hid it by also appending a row — twice now a green case has stood in
+  # front of the hole it was written to cover.
+  round_bounds.each do |span_base, span_head|
+    scope = scope_at.call(span_base, span_head)
+    scope_rows = rows.select { |row| row[:scope].head == span_head }
+    # Same head-declared-grammar rule as `result-class` above, and for the same
+    # reason: the paragraph that defines `bank-evidence` also dates it.
+    next unless grammar_declared_at.call(scope.head)
+    bank_changed = scope.changed_paths.include?(bank_relative)
+    triggered_owners = (upstream + lineage_extra.keys).uniq.select do |path|
+      description_touched.call(scope, path)
+    end
+    # A package that did not exist at the round's base is not in the owner set —
+    # the set is built from CHANGED owners, and a brand-new skill has nothing to
+    # have changed. Its first description is still a routing surface being
+    # created, so it is picked up from the changed paths directly rather than
+    # being silently outside the trigger because of how the owner set is built.
+    created_surfaces = scope.changed_paths.filter_map do |relative|
+      next unless relative.start_with?("skills/") && relative.end_with?("/SKILL.md")
+      path = relative.sub(%r{\Askills/}, "")
+      next if triggered_owners.include?(path)
+      next unless description_touched.call(scope, path)
+      path
+    end
+    triggered_owners |= created_surfaces
+    next if !bank_changed && triggered_owners.empty?
+    # Discharged PER SUBJECT, not per round. Scanning the whole round meant that
+    # when two owners changed their descriptions, one owner's valid locator
+    # marked the round satisfied and the other could omit its evidence entirely —
+    # the obligation is incurred by each owner that moved its routing surface, so
+    # each has to carry its own.
+    row_satisfies = lambda do |row, self_owner|
+      value = fragment_value.call(row[:behavior], "bank-evidence")
+      next false unless value
+      if (m = value.match(/\Adownscoped:(\S+)\z/i))
+        downscope_recorded.call(scope, m[1])
+      else
+        # A locator pointing back into the owner's own package is the change, not
+        # evidence about it. Without this a description edit satisfies its own
+        # bank obligation by citing the very line it just wrote — an artifact that
+        # exists and proves nothing, which is the shape this whole round removes.
+        # Checked on the PATH after stripping the kind prefix, not on the `file:`
+        # spelling: the first version matched `file:skills/<owner>/` only, so an
+        # owner that also touched a script in its own package could cite it as
+        # `command:skills/<owner>/scripts/…` and validate the change as evidence
+        # about itself. Both locator forms name a path; the ban is about the path.
+        if self_owner
+          located = value.sub(/\A(?:command|file):/i, "").sub(/#.*\z/m, "")
+          # Normalize before the prefix test. A raw `start_with?` compares one
+          # spelling of a path, and `./skills/<owner>/…` or a `a/../` detour names
+          # the same file while missing the check — the ban is on the LOCATION, so
+          # it has to be decided on a canonical form of it.
+          segments = []
+          located.split("/").each do |seg|
+            next if seg.empty? || seg == "."
+            seg == ".." ? segments.pop : segments << seg
+          end
+          next false if segments.take(2) == ["skills", self_owner]
+        end
+        locator_valid.call(scope, value)
+      end
+    end
+    triggered_owners.each do |path|
+      owner = path.sub(%r{/SKILL\.md\z}, "")
+      owner_scope_rows = rows_by_upstream_path[path].select { |row| row[:scope].head == scope.head }
+      bank_evidence_failures << path unless owner_scope_rows.any? { |row| row_satisfies.call(row, owner) }
+    end
+    if bank_changed
+      # The bank is nobody's package, so any row of this round may discharge it;
+      # what it may not be is absent.
+      bank_evidence_failures << bank_relative unless scope_rows.any? { |row| row_satisfies.call(row, nil) }
+    end
+  end
+  bank_evidence_failures.uniq!
+  unless bank_evidence_failures.empty?
+    warn "impact_chain_bank_evidence_missing: a round that changed the routing surface carries no bank evidence for that owner"
+    warn "  note: the routing surface is the SKILL.md frontmatter `description` entry and `#{bank_relative}`. The measurement protocol says it is mandatory, but nothing produced or consumed it, so not running it left no absence to detect — the reviewer saw a candidate, not a gap"
+    warn "  fix: add `bank-evidence: command:<changed executable>` or `bank-evidence: file:<changed markdown>#<unique anchor>` to that owner's row; to skip the run deliberately use `bank-evidence: downscoped:<token>` and record the same token in this round's spec, so the downscope is itself an artifact"
+    bank_evidence_failures.each { |path| warn "  owes bank evidence: #{path}" }
+    exit 1
+  end
 end