@ccoalm/ccl-skills 0.6.2 → 0.8.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/external-practice-controls.md

@@ -80,10 +80,14 @@ A `RED-baseline` row is only as good as the measurement behind it. The failure m
 
 **The one rule that matters: the grading standard must precede the change.** Not "write the rubric carefully afterwards" — afterwards you already know what the new text says, and the rubric grows into its shape. Either freeze the rubric before editing, or have a party that has not seen the candidate produce it. This repo already applies preregistration to *dispositions* (a preregistered reading rule committed before any run); apply it to the *instrument* too.
 
-Everything else is hygiene, but each was observed failing:
+**Its companion: the baseline must be one the thing under test cannot have moved.** A rubric frozen before the change still grades against *something*, and rubric discipline says nothing about whether that something held still. A baseline the candidate can write, a baseline read while another writer is mid-flight, a baseline ref that has drifted, and a baseline that was never established all produce a well-formed comparison with no anchor — and none of them announces itself. The first four rows below are that failure; the rest is hygiene. Every row was observed failing:
 
 | Failure | What it looked like | Rule |
 | --- | --- | --- |
+| Candidate-writable baseline | The reference the gate compared against was committed inside the same change-set the gate then judged, so the change could move its own reference point | The baseline must resolve to an immutable commit or frozen artifact **that the change did not author** — immutability is not independence. A candidate can commit a tuned fixture and cite that commit's SHA: perfectly immutable, still its own reference point. Require provenance older than the change (an ancestor of the merge-base with the target, or an artifact under separate control), and never a bare ref name (a ref is as movable as a file, so creating or re-pointing one satisfies "an explicit target ref" while moving the reference point). What is barred is the candidate's **working-tree** version of a file its diff touches; the **pre-change blob of that same file, read at an independent commit**, is the correct control arm — that is what `Transcribed arms` below means by extracting both arms from version control. A fixture authored alongside the change is self-authored evidence, and the **weaker ancestry check some harnesses run — verifying that the artifact *declares* an ancestor commit, rather than that the artifact itself predates the change — does not detect one tuned in that same change** (`validation-and-landing.md` records this for the golden-trace form). Requiring the artifact's own provenance to predate the change is what closes that hole; the declared-ancestor check alone does not |
+| Baseline read under a concurrent writer | A suite total was recorded while a mutation harness was still rewriting the tree, then reused as the stable prior; a size reading taken in a worktree holding a staged revert produced the opposite conclusion from the truth | Prefer a baseline that **cannot** move while you read it — but **naming an immutable source is not reading from one**: a suite or size command run in the live worktree consumes staged edits, generated files, and a sibling agent's writes while the record says the baseline was commit X. Read the baseline *out of* the immutable source — check it out into a clean location, or read the blob at that commit — and only then is a dirty candidate worktree irrelevant to it. For a genuinely *mutable* source the requirement is that nothing writes it **for the duration of the read** — quiesce the writers (stop the harness, watcher, or sibling agent; settle staged state) rather than sampling cleanliness, because a point-in-time `git status` says nothing about the next second — or label the reading `unstable` and do not let it serve as a baseline |
+| Base ref drift | The comparison resolved against a stale local ref, so the packet carried the upstream's newer fixes *reversed* and the reviewer raised findings against code that was already correct | Resolve the base at read time and prove it is current before comparing. A finding pointing at a file outside your own diff should trigger a base check **before you act on it either way** — do not rank the two: it is equally often a real completeness defect (an untouched consumer the changed contract broke), so verify the base rather than dismissing the finding |
+| Attribution with no base run | A red was reported as this change's regression; the identical failure reproduced on the unmodified base and was a pre-existing environment condition | Reproduce a failure on the unmodified base before attributing it to the change — "also red on base" is a result to record, not a step to skip (`product-rd-workflow/references/refactoring-discipline.md` owns the green-baseline-first form) |
 | Ceiling | The unchanged arm already passed 9/10, so no improvement was detectable | The arm you expect to fail must be *able* to fail; verify before comparing |
 | Vocabulary inheritance | Regex written after the new text; the old arm said the same thing in other words and scored 0 (`剥离` vs a regex for `剥掉`) | Grade the **obligation**, paraphrase-tolerant, by a grader blind to which arm produced the answer |
 | Tautology by construction | A "marker must be uniquely carried by this line" rule forced markers that only that line's vocabulary could satisfy — removing the line trivially removed the word | A validity constraint built for one polarity becomes a bias generator in the other: uniqueness is required of the **control**, never of the candidate (other carriers are the redundancy evidence, not an artifact) |
@@ -108,7 +112,7 @@ Referenced from `SKILL.md`'s "The mechanism underneath" rule. This section holds
 | [Anthropic, *Effective context engineering for AI agents*](https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents) | finite attention budget; "context rot" reported as gentler in some models but emerging across those tested; smallest-set-of-high-signal-tokens; the right-altitude failure modes | vendor engineering post — no dataset, n, or error bars; version-bound; commercially aligned with context-management tooling |
 | [OpenAI, *GPT-4.1 Prompting Guide*](https://developers.openai.com/cookbook/examples/gpt4-1_prompting_guide) | conflicting instructions tend to resolve to the one nearer the end; instructions at both ends of long context beat either alone; check-conflicts-first; a single clear sentence usually steers | same class; explicitly model-generation-bound ("GPT-4.1 tends to…") |
 | [OpenAI, *GPT-5.1 Prompting Guide*](https://cookbook.openai.com/examples/gpt-5/gpt-5-1_prompting_guide) | check-conflicts-first; a published metaprompt recipe for finding contradictions in your own system prompt | same class |
-| [RECAST](https://arxiv.org/html/2505.19030) | joint satisfaction degrades with constraint count; best model averaged 39.75% all-constraints-satisfied on their benchmark | benchmark paper proposing its own dataset and method — a low baseline flatters the contribution; that number is one hard benchmark's order of magnitude, not a usage failure rate |
+| [RECAST](https://arxiv.org/html/2505.19030) | joint satisfaction degrades sharply as constraint count grows — and it is already low at small counts. The metric for "all of them at once" is the paper's **OSR** (§4.1: "the HSR of all constraints, both rule-based and model-based, that are successfully satisfied simultaneously"). Across all 29 model rows of Table 1 the **ceiling** on OSR is **25.0** at Level 1, falling to **19.0 / 13.0 / 13.5** at Levels 2–4, whose constraint counts are **5 / 10 / 15 / all** (§B.4). So at five constraints no model held the whole set more than about a quarter of the time, and by fifteen none exceeded ~13% | benchmark paper proposing its own dataset and method — a low baseline flatters the contribution; these are one hard benchmark's order of magnitude, not a usage failure rate, and its constraints are generation-task instruction constraints rather than preconditions of a procedure, so transfer is by analogy. **Citation corrected 2026-08 against Table 1:** the widely quoted 39.75% is the **Average column of the single best-by-average row** (Gemini-2.5-Pro) — the arithmetic mean of that row's twelve MSR/RSR/OSR cells (sum 477; 477/12 = 39.75, confirmed) — **not** an all-constraints-satisfied rate, and it must not be cited as one. The two orderings differ: Gemini leads on Average while Qwen3-235B-A22B holds the highest Level-1 OSR, so do not carry "best model" across from one column to the other. Cite the OSR ceilings above |
 
 **Why recency is a hazard, not a rule.** Vendor guidance reports that models *tend to follow* whichever instruction sits later — an observation about behaviour, not a licence to resolve conflicts by position. Two ways position becomes dangerous if read as a rule: a later permissive line beats an earlier stricter one (directly contradicting `Conflict Resolution`, which keeps the stricter data-loss/security/contract guard); and text embedded in **untrusted data** — a diff under review, a retrieved document, tool output — sits later within the same authority level and would win by placement alone, which is prompt injection with extra steps. Treat recency as a bias to design against: put the load-bearing rule where the decision happens, and never let placement confer authority.
 
@@ -120,6 +124,21 @@ Referenced from `SKILL.md`'s "The mechanism underneath" rule. This section holds
 
 教训：前一个 agent 或前一次提交对某个具名约定的读法是 **hypothesis-grade**；在其之上 fix-forward 会把原始错误一并传播。
 
+### 同类的最高频实例：CLI flag 靠记忆不靠读
+
+上面那条讲的是**继承自别人**的读法；本节讲**继承自自己记忆**的读法，两者同根——载体都是一个本仓不拥有的外部契约。
+
+`SKILL.md` 已有的规则要求用 live tool（`--help` 或等价物）核验 flag 的存在与语义，但只写在**把 CLI 命令写进 reference 时**这一个作用域。真正复发的地方是**调用**时：一份跨上百个会话的失败记录语料里，「flag 靠猜不靠读」是最重复的机械失败类之一——同一个 `glab mr list --state` 在**八个互相独立的会话**里各失败一次，横跨数月；每次修法都相同（读 help、换 flag），每次都只修好了当次那一条实例，所以类原样返回。同族还有 `--jq`（3 次）、`--output`、`--pipeline-id`、`--branch`、`--old-text`、`--allow-scripts`。
+
+八次复发说明 prose 不收敛，所以落点是机械的：`hooks/remind-unverified-cli-flag.sh`（PreToolUse，仅提示不阻断），对 flag 词表跨版本发散的工具，按 (会话, 工具) 各提示一次；它**刻意不解析命令串**——合法 shell 写法的集合是开放的，早期的解析版本几乎每轮独立评审都被找出一种误处理的合法写法。
+
+**谓词选择是这条里唯一承重的设计决定**：hook 认的是**工具身份**，不是「已知坏 flag」的清单。flag 清单是上游项目拥有的词表，上游每发一版就把控制打回原形——这正是本文件上一节所述「控制建立在自己不拥有的东西上」的形态，也是这个类跨多次落地反复回来的原因。工具名集合缓慢、有限、可由本仓拥有；flag 集合不是。代价是明写的：未列入的工具是**不触发**，这是刻意接受的残留，扩列表的判据是该工具已积累出记录在案的 flag 失败。
+
+可执行形态：
+
+- 给列表内的外部 CLI 传长 flag 之前，**必须先在本机读过该 CLI 的 help 输出**；未读过就用，属于把记忆当一手源。
+- 一条命令因无法识别的 flag 失败时，**不得**先改用法之外的东西——先怀疑该 flag 在本机这个版本不受支持。语料里多次出现「以为是用法错、其实是这版没这个 flag」。
+
 ## 只据内部语料的「深度提炼」：失败形态
 
 一次仅以内部 launch-SOP 为源的「深度提炼」会落出**看起来完整**的规则集，却从未核过这套技能声称代表的**公开实践**；下一个用户于是问「参考网上优秀实践了么 / did you check industry practice」。

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/extraction-quickstart.md

@@ -18,15 +18,15 @@ For maintainers running a fresh codebase / Figma / doc extraction. Read this fir
    ├─ b. Draft skill / reference (new or update existing)
    ├─ c. Sibling-generalization mini-map (which sibling skills may share / route)
    ├─ d. Sanitization pass with checklist (cheap, seconds)
-   ├─ e. Dual-track gate per mandatory table (deep, minutes)
-   │     ├─ Review pass (codex review --base) — fact / consistency / sanitization
-   │     └─ Challenge pass (codex exec adversarial) — race / data loss / security / algorithm
+   ├─ e. Owner review gate per mandatory table (deep, minutes)
+   │     ├─ Strict wording-only → one independent code-review pass
+   │     └─ Non-wording → extraction_review_gate review + at most two challenges
    ├─ f. Apply fixes, re-sanitize
    ├─ g. Commit per batch on a feature branch → MR pending review (never push to main)
    └─ h. Update charter completion log
                           │
 4. Closeout       → ~/.<host>/skills/.extraction-work/<project>-completion.md
-                    Final state + deferred backlog + lessons for future extractions
+                    Non-wording terminal ledger validator + final state + deferred backlog
                           │
 5. Provenance migration → ~/.<host>/.private-aliases/<project>.yaml
                     Move file keys / paths / counts / dates out of working files
@@ -91,9 +91,9 @@ For maintainers running a fresh codebase / Figma / doc extraction. Read this fir
 
 - When required: see `references/dual-track-review-gate.md` table.
 - Choose the review tier from that table, not from intuition. Do not restate the rows locally; record the exact `dual-track-review-gate.md` table row used. Record `challenge: not-required` only when that row classifies the actual diff as challenge-not-required (for shared skills, this means strict wording-only with deterministic scope proof + independent review confirmation). Non-wording shared-skill changes cannot skip challenge.
-- Run deterministic checks and implementer self-review first, and record what each proves before invoking review/challenge (this self-review-before-review ordering applies to every non-wording shared-skill change the dual-track table requires review for, not only the rows that look high-risk): `git diff --check` proves whitespace/conflict-marker hygiene only; validators prove schema/link/routing invariants; leakage/sanitization scans prove only their configured patterns; scope checks must name the changed files or expected file set; the self-review row is conclusive only when each required field is non-empty (acceptance criteria, changed-file scope, edge/failure paths, known residual risks) and the changed-file scope equals the candidate diff's changed-file set, or explicitly explains any excluded generated/irrelevant file. The row must be persisted in inspectable/revision-tracked history before the review/challenge run (same ordering-proof rule as `product-rd-workflow`'s technical-design gate: a plain in-place-editable MR description or scratch log is not acceptable proof unless its edit history is retrievable and was checked); a row backfilled after review/challenge is invalid and forces a rerun. If the candidate diff changes after the row is saved — a file added/removed OR the content of any listed file materially changed — refresh the row and rerun review/challenge against the new candidate. A missing field, "ok" placeholder, mismatched scope, or unprovable ordering makes the row inconclusive. Do not spend LLM review rounds on issues a script or implementer-side checklist can decide. If the independent pass is the first place basic scope, contract, privacy, or test issues surface, apply those findings to the diff, close the self-review gap, and rerun the deterministic gates before rerunning review/challenge; the process-defect repair is in addition to resolving the findings, not a way to discard or downgrade them.
-- Review pass: resolve a pinned/trusted `CODE_REVIEW_SKILL_DIR/scripts/review_gate.sh`; never scan writable plugin roots. Persist the complete self-review row and encode it in the review plan you pass to the gate. Take the command itself from `code-review`'s runnable recipe, never from a copy kept here. When the dual-track row requires a challenge, that run is multi-round: use the recipe's review→challenge pair — supplying the stage and the exact base ref this candidate is actually at, not whatever the example defaults to — the one shape that opens the Agent chain on round 1 — it cannot be retrofitted, so a run started outside it is thrown away and restarted. A row that legitimately records `challenge: not-required` takes whichever single-round shape the staged review contract permits for this candidate's stage and risk tags; the gate, not this page, decides whether a chainless review is legal, and it may still demand the tracked pair. Read the chain-opening and packet-composition rules in `references/dual-track-review-gate.md` (Running the review pass) first: they decide the round budget and what goes in the packet before the command is built. Require conclusive JSON, selected-client attribution, packet/profile binding, family exclusion, and wrapper runtime evidence. When the host returns a live execution handle (`session_id`, `cell_id`, or equivalent), keep polling that exact handle until terminal exit; empty current output is progress, not a verdict, and no replacement/fallback reviewer may start while the original process is live. The result row records handle type, an opaque host transcript/tool-call reference, and terminal exit status. If the handle is lost, the lane is infrastructure-inconclusive/manual-review-required and no replacement or fallback may be started or credited; process-tree and wrapper artifacts are diagnostic only. This is a procedural host obligation because the inner gate cannot observe the outer handle; machine enforcement requires a trusted host adapter. Never copy a credential-like raw handle into shared evidence. `findings` is not pass; inconclusive/malformed/free-form output stays interim. Do not add a separate behavior probe.
-- Challenge pass: invoke that gate separately with the same plan, stage, candidate, and family. Pass a one-based index within the staged-contract budget; later rounds include a distinct focus and all prior focuses. A tracked round additionally carries the chain fields defined in `code-review/references/staged-review-contract.md` (Agent review chain); follow that section for what each round must supply. Preserve a separate result row with the same binding, exclusion, egress, attribution, and conclusive checks. Review never satisfies challenge; missing/inconclusive required challenge keeps extraction interim.
+- Run deterministic checks and implementer self-review first, and record what each proves before invoking review/challenge (this self-review-before-review ordering applies to every non-wording shared-skill change the dual-track table requires review for, not only the rows that look high-risk): `git diff --check` proves whitespace/conflict-marker hygiene only; validators prove schema/link/routing invariants; leakage/sanitization scans prove only their configured patterns; scope checks must name the changed files or expected file set; the self-review row is conclusive only when each required field is non-empty (acceptance criteria, changed-file scope, edge/failure paths, known residual risks) and the changed-file scope equals the candidate diff's changed-file set, or explicitly explains any excluded generated/irrelevant file. Persist it before the review/challenge run in a fresh, non-overwritten task-evidence path outside the candidate diff, pass that exact file as the gate's review plan, and retain the gate result that binds its profile hash; do not edit the candidate merely to record self-review or review outcome, because that creates self-referential candidate churn. A candidate-local row is appropriate only when the row itself is a substantive deliverable under review. A plain in-place-editable MR description or scratch log is not ordering proof unless its edit history is retrievable and checked; a backfilled row is invalid and forces a rerun. If the candidate diff changes after the row is saved — a file added/removed OR the content of any listed file materially changed — refresh the row and rerun review/challenge against the new candidate. Changing only the external self-review record refreshes the profile binding; it does not by itself invalidate implementation tests or the candidate packet. A missing field, "ok" placeholder, mismatched scope, or unprovable ordering makes the row inconclusive. Do not spend LLM review rounds on issues a script or implementer-side checklist can decide. If the independent pass is the first place basic scope, contract, privacy, or test issues surface, apply those findings to the diff, close the self-review gap, and rerun the deterministic gates before rerunning review/challenge; the process-defect repair is in addition to resolving the findings, not a way to discard or downgrade them.
+- Review pass: persist the complete self-review row and encode it in the review plan. For a **non-wording** lane, resolve the repository-owned `scripts/extraction_review_gate.sh` and use it from round 1; never substitute the generic controller, scan writable plugin roots, or supply a caller-selected budget. For a strictly proven **wording-only** lane, use the generic `code-review` proof-bound single-review recipe in `code-review/references/staged-review-contract.md` and record `challenge: not-required`; require its controller-derived wording scope plus the independent `wording_only_boundary` confirmation. This is the only extraction path that stays outside the multi-round wrapper and terminal ledger; the gate, not this page, decides whether a chainless review is legal, and it may still demand the tracked pair. Take all controller options from that runnable recipe, supplying the actual stage and exact candidate rather than an example default. The non-wording chain cannot be retrofitted, so a run started outside its owner wrapper is thrown away and restarted. Read the chain-opening and packet-composition rules in `references/dual-track-review-gate.md` first. Require conclusive JSON, selected-client attribution, packet/profile binding, family exclusion, and wrapper runtime evidence. When the host returns a live execution handle (`session_id`, `cell_id`, or equivalent), keep polling that exact handle until terminal exit; empty current output is progress, not a verdict, and no replacement/fallback reviewer may start while the original process is live. The result row records handle type, an opaque host transcript/tool-call reference and terminal exit status. If the handle is lost, the lane is infrastructure-inconclusive/manual-review-required and no replacement or fallback may be started or credited; process-tree and wrapper artifacts are diagnostic only. This is a procedural host obligation because the inner gate cannot observe the outer handle. Never copy a credential-like raw handle into shared evidence. `findings` is not pass; inconclusive, malformed, or free-form output stays interim. Do not add a separate behavior probe.
+- Challenge pass: for a non-wording lane, invoke `scripts/extraction_review_gate.sh` separately with the same plan, stage, candidate, family and tracked chain. Pass the next one-based index; later rounds include a distinct focus and all prior focuses. Preserve a separate result row with the same binding, exclusion, egress, attribution and conclusive checks. Review never satisfies challenge; missing or inconclusive required challenge keeps extraction interim. A wording-only lane has no challenge pass.
 - Treat review/challenge as batch-level gates over the landing candidate, not as a per-bullet or per-line edit loop. Apply all findings from a round; when both lenses are required, re-run both on the updated candidate before landing.
 - Skipping a required challenge = work can only land as interim, not complete.
 
@@ -119,6 +119,7 @@ For maintainers running a fresh codebase / Figma / doc extraction. Read this fir
 - File: `~/.<host>/skills/.extraction-work/<project>-completion.md`
 - Final state: which batches done, which deferred, which sources unavailable.
 - Lessons: what surprised; what would change in next extraction; what to add to skill-extraction-workflow.
+- For every non-wording review chain, build the receipt-bound closeout ledger and run `scripts/validate_extraction_review_state.py <closeout.json>` before reporting a terminal state. A clean Round 2 plus its exact-candidate completion receipt may validate as `ready_for_human_decision`; Round 3 findings validate as `continuation_authorization_required`; a second ordered base drift validates as `baseline_race`. Unknown, stale, omitted, or invalid evidence remains `interim`. The strict wording-only single-review path records its independent review row but does not fabricate a multi-round ledger.
 
 ### 5. Provenance migration
 
@@ -147,8 +148,9 @@ Skip this step when nothing transferable surfaced.
 |---|---|---|
 | Anti-pattern grep panel | `references/recurring-anti-patterns-checklist.md` | Every commit; ~30s |
 | `check-ccl-skills.sh` | `scripts/check-ccl-skills.sh` | Every commit; ~10s |
-| `codex review --base <sha>` | shell, in shared skill repo | When the mandatory dual-track table requires independent review (every shared-skill change); ~5-10 min |
-| `codex exec` adversarial prompt | shell, in shared skill repo | When the mandatory dual-track table requires challenge (every non-wording shared-skill change); ~10-15 min |
+| Generic `code-review` gate | repository-owned skill | Strict wording-only independent review; ~5-10 min |
+| `scripts/extraction_review_gate.sh` | this skill package | Non-wording review plus at most two challenges; ~5-15 min each |
+| `scripts/validate_extraction_review_state.py <closeout.json>` | this skill package | Every non-wording terminal checkpoint |
 | Source-read fallback ladder | `SKILL.md` Source-read remediation | When a source read fails or times out |
 | Sibling mini-map | `SKILL.md` Step 4 stack-specific updates | Every stack-specific change |
 | Private alias map `audit_cmd` | `~/.<host>/.private-aliases/<project>.yaml` or process-retro profile | Every commit's R0 audit |

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/firing-point-placement.md

@@ -56,6 +56,14 @@ Observed shape: an entry judged as configuration how-to produced several rounds
 
 When you land an owner gate as a *field in a record* — a checklist row, a boundary-record line, a CLI flag taking owner names, a "decision:" slot — that field is fillable without invoking the owner, and filling it is what *feels* like discharging the gate, so the record reads complete while none of the owner's mechanical rules fired. Any field naming an owner therefore carries an explicit invoke bar on its triggered values, and the coverage question is a **set-diff over every owner-naming field in that record**, not a fix for the one owner that just failed (the recurrence shape: a record whose salient fields carry the bar while its siblings silently do not). Prefer a firing point the controller cannot route around: when the gated action produces no local artifact — delegation dispatch being the worked case, where substance is produced by a worker and the controller edits nothing — every edit-triggered and dirty-tree-triggered backstop stays silent, so the gate must hang on the action itself (`hooks/guard-delegation-owner.sh` asks once per session at dispatch when the delegation owner was never invoked).
 
+### The option-set sibling (a menu whose every choice violates a standing gate)
+
+Same forgery surface, one step earlier: instead of filling a field, the agent **asks the user to choose** — and every option it drafted violates a rule that was already mandatory. The user's selection then reads as authorization, so the violation lands wearing a decision it never needed. This is strictly worse than filling a field alone, because the record now carries a human's name on it.
+
+Observed shape (round 059): a distillation round asked the user how a reusable cross-line lesson should land and offered three options — write it into per-line memory, build a sync mechanism, merge the two stores. The Core Rules already required a **shared** artifact and explicitly classify a memory-only landing as insufficient, so no option on the menu could be chosen legally. The user caught it by asking "不是到共享技能么"; nothing in the workflow would have.
+
+The bar: **before offering the user a choice, check each drafted option against the standing gates for that decision, and drop or relabel any option that a rule already forbids.** A menu is a claim that every item on it is permissible. If the gates leave only one legal option, that is not a decision to delegate — do it and say why the alternatives were unavailable; if they leave none, the gate itself is what needs the user's ruling, and that is the question to ask instead. The recurrence signal is a user correction that names a rule rather than a preference ("shouldn't this go to X?"), which is a gate-violation report, not a change of mind — classify it as `failure/correction` and run the correction RCA rather than simply re-asking with a better menu.
+
 ### The IMPOSSIBLE-invocation value (a bar with no legal third value forges itself)
 
 An invoke bar — or a mandatory-read/mandatory-load gate ("read `X.md` before answering") — **that names no legal value for the case where the invocation is IMPOSSIBLE (no file tool in this session, artifact absent, load fails) forges itself.** Such gates are usually written as a pair: skipping the read is forbidden AND answering from memory is *also* a violation. When the read is unavailable, every action the agent can take is a violation, so the cheapest exit is to assert the gate was satisfied — and if the gate's evidence is a fixed attestation string, that string is emitted by an agent that read nothing and the record reads compliant to every downstream consumer.

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/parallel-stack-references-pattern.md

@@ -49,11 +49,12 @@ Each file has the same H2 structure. The **stack-specific implementation pattern
 
 ## The sibling-sync invariant — what mirrors, what diverges
 
-Mirrored sections must match in **meaning**, not necessarily in punctuation. The acceptable divergences, enumerated:
+Mirrored sections must be **byte-identical — no normalization**. The machine gate `../scripts/check-parallel-stack-parity.sh` (wired into `check-ccl-skills.sh`, regression-pinned by `test_check_ccl_parallel_stack_parity.sh`) diffs each pair's mirrored region — the exact heading line `## When this applies / does not apply` through the stack-glue H2, each marker matched as an exact whole line exactly once and in order — with zero rewriting.
 
-- **Routing references** — Go's "route to `api-security-boundaries.md`" vs Python's "route to `web-framework-boundaries.md`" is fine; each stack's reference tree differs. This is the **one allowed mirrored-section divergence** and is explicitly stated in the sibling-sync header.
-- **Examples that name the stack** — when a mirrored section names a generic example, it can use a stack-neutral placeholder ("the session-level tenant variable") and let the stack-glue section name the specific syntax.
-- **Length differences from stack-neutral phrasing** — Go-rendered and Python-rendered phrasings of the same concept can differ in length by a few words.
+- **Routing references that legitimately differ per tree are written inline for both trees**: `` `x.md` `` on the Python tree / `` `y.md` `` on the Go tree — the same bytes in both files. Two earlier gate versions instead normalized references before diffing (a `<REF>` mask, then a per-pair mapping table), and two adversarial rounds each found a fresh way lossy rewriting could mask real drift (an or-list's second element swapped; a canonical pointer replaced by a mapped name; a self-reference via name mapping). The normalization capability was **removed rather than patched again** — with byte-diff there is nothing to abuse, and adding a new legitimate divergence means writing the dual-tree phrasing into both files, which is exactly the reviewable edit the contract wants.
+- **Sibling skill names inside the mirrored region** follow the same rule: name both trees or neither; the self-referential file headers (Sibling sync / Sanitization boundary) sit *above* the mirrored region and may keep naming only the partner file.
+
+Everything else in the mirrored region must be byte-identical too: when a mirrored section needs a generic example, use one stack-neutral placeholder rendering ("the session-level tenant variable", "the stack-glue section names the specific primitive") **and use the same rendering in both files**, letting the stack-glue section name the specific syntax. The earlier looseness ("match in meaning, phrasing may differ by a few words") is retired: meaning-equivalent-but-textually-different renderings are exactly where real drift hid — a rule on one side was silently replaced by a pointer on the other and survived several review rounds under the "same meaning" reading. Known residual, accepted and documented in the script: moving both stop markers earlier in one change shrinks the compared region symmetrically — that is a visible contract edit in the review diff, not something the gate distinguishes. The optional `## Topic-extension backlog` H2 after stack-glue is mirrored by convention but sits outside the strict gate (its section rule allows near-identical wording so it can name vendors/engines); keep it in sync by review.
 
 Hard constraints that must NOT diverge:
 - **Concept set** — every rule, every gate, every carve-out present in one mirrored section is present in the other.

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/r0-leakage-audit.md

@@ -42,6 +42,108 @@ The closeout row must name which private profile was used: `project-alias`, `pro
 
 Pre-existing leakage from earlier extractions may be tracked as `known_debt` in the alias YAML and explicitly excluded from blocking the current change. New or modified content MUST remain zero-hit — `known_debt` cannot waive a newly introduced label.
 
+### Shared Git and PR text
+
+Git history and forge metadata are shared publication surfaces even when the
+repository files are clean. The repository-owned
+`skills/skill-extraction-workflow/scripts/shared_git_surface_gate.py` therefore
+scans the exact candidate commit range, current branch name, and available PR
+title/body text for AI session links or identifiers, model session/co-author
+trailers, AI author/committer identities, generated footers,
+conversation-process labels, and external-source provenance wording. Common
+Markdown list (including GFM task lists), quote, heading, and nested wrappers
+are presentation only and do not bypass any line-oriented class. The gate
+reports only surface, locator, and category so neither a finding nor an error
+diagnostic repeats the identifier, ref, path, or raw tool error it is blocking.
+Candidate commit metadata is requested from Git as UTF-8 regardless of the
+repository's ambient log-output encoding. Invalid UTF-8 or a Unicode
+replacement character fails closed with only the commit locator and field
+name, rather than silently erasing a CJK-only match. Each candidate's bounded
+raw commit object is also checked before pretty formatting; an embedded NUL is
+rejected because Git would otherwise truncate the visible message at that byte.
+The batch response is length-parsed and bound one-for-one to the separately
+enumerated full object IDs; abbreviated diagnostic locators are never used for
+identity or ordering decisions.
+`--repo` is the single repository identity. Every Git subprocess drops ambient
+repository-routing variables that could replace its worktree, refs, object
+store, ancestry, index, or namespace; a caller cannot point the gate at a clean
+decoy with `GIT_DIR` while the prohibited candidate lives elsewhere. This gate
+is a worktree pre-push/CI lane, not a receive-pack quarantine, so quarantine
+object-store overrides are not accepted.
+All object reads disable local replacement refs, which alter only the local
+view and are not the bytes a push publishes. A non-empty legacy
+`info/grafts` file likewise fails closed because it can rewrite the visible
+parent chain without changing the commit objects sent by a push.
+
+The base priority is explicit `--base-ref`, then the trusted PR event, then
+`CCL_SKILL_BASE_REF`, then a repository-declared default; an unresolved selected
+base is an error. The trusted event outranks ambient environment configuration
+so a CI process variable cannot silently move the base forward and narrow the
+event-defined candidate range. Only
+history outside the selected `<merge-base>..<candidate-head>` range may be
+`known_debt`; the merge-base itself is target-side history and is not a candidate
+commit. Candidate commits, the current destination branch, and current PR text
+have zero exceptions, including a violation hidden in an earlier candidate
+commit behind a clean HEAD. CI runs the gate on direct pushes to `dev`/`main`
+and on PR `edited` events because title/body changes do not require a new
+commit. Before a PR is created or edited, pass its exact proposed title and
+body through `--pr-text-file`; a local run with neither an event nor that file
+has checked no PR text. The optional pre-push hook is early feedback; the
+protected CI check is the merge boundary.
+
+The repository command fallback `origin/dev` applies only to the normal
+feature→dev lane. Promotion or any other target passes that target explicitly
+(for example, `--base-ref origin/main` for dev→main); a default is not evidence
+of the intended landing target. The pre-push hook uses an existing destination ref's remote SHA
+as its base only when that destination is an actual landing target (`dev` or
+`main`); ambient `CCL_SKILL_BASE_REF` cannot replace that SHA. The environment
+base may delimit a new zero-OID landing target. Every non-delete pushed ref is
+scanned at its own local object ID and destination name without checking it
+out. An ordinary feature ref always uses an explicitly bound landing target or
+the pushed remote's `dev` tracking ref; if that ref is absent, fetch it or set
+`CCL_SKILL_BASE_REF`. Its existing remote feature tip is still candidate history
+and must never become the base/`known_debt`. A new
+`dev`/`main` destination without an explicit base fails closed. Provider aliases
+are shared across the provider-shaped
+surface patterns, but unknown future AI providers remain an enumerated-pattern
+coverage risk; the shared prose prohibition is broader than the currently
+recognized provider names.
+
+Co-author detection also has an intentional precision boundary. An
+unambiguous product display name such as `Claude Code` or `Codex`, a bounded
+model/product-qualified form such as `Claude Sonnet`, `OpenAI Codex`, or
+`ChatGPT-5`, or a known
+provider GitHub App account carrying the `[bot]` suffix, is blocked with any
+email. Account matching accepts GitHub slug separators, so `claude-code[bot]`
+and `copilot-swe-agent[bot]` remain the same known-provider class. A known
+provider `[bot]` account in the email local part is also sufficient when the
+display name is neutral, with only the standard optional numeric GitHub ID
+prefix accepted before that exact account. A provider token embedded as a
+suffix inside another bot account is not treated as the provider. An exact
+single-name alias that can also be a person's name needs an independent
+`noreply`/`no-reply`/`bot` email signal. This keeps a human whose
+real name matches an alias from being mechanically rejected, but it also means
+an AI trailer that deliberately uses such an ambiguous name plus an ordinary
+email is not detectable from the trailer alone. The root prohibition still
+applies; proposed text with that ambiguity needs human readback rather than a
+claim that the local gate proved every model co-author absent. Candidate author
+and committer fields use a narrower rule: only unambiguous product names,
+known-provider `[bot]` display names, or known-provider `[bot]` email accounts
+with only an optional numeric GitHub ID prefix are blocked. A generic `noreply`
+address is a normal human privacy setting there, so an ambiguous single-name
+identity remains an explicit human-readback coverage gap; unrelated automation
+bots and accounts that only end in a provider token are not reclassified as AI.
+
+The current deterministic event surface does not fetch historical PR comments,
+labels, or a platform-generated custom merge message. Those remain prohibited
+by the root contract, but are an explicit coverage gap requiring forge-side
+readback/enforcement; they are not reclassified as `known_debt` merely because
+this local scanner cannot observe them. A pushed tag is scanned on every
+surface the object graph carries: destination name, pointed-to commit range,
+and each annotated tag-object layer's own message and tagger identity (nested
+tags are peeled with a bounded depth, and an unresolvable or over-deep tag
+chain fails closed).
+
 ## Fail-Closed Clause — Maintainer Discipline
 
 Every new sanitized label introduced in this commit (e.g. an angle-bracket capability token like `<some-capability>`, a class tier like `<class-A1>`, or any other invented short name that stands for a real source artifact) MUST exist in the maintainer's alias YAML before the commit lands.