@christang/keel 5.3.0 → 5.3.3

package/scripts/validate_plugin.py

@@ -37,8 +37,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.3.0"
-PROTOCOL_VERSION = "5.3.0"
+PACKAGE_VERSION = "5.3.3"
+PROTOCOL_VERSION = "5.3.3"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 OPENSPEC_CONFIG_PATH = Path("openspec/config.yaml")
@@ -99,7 +99,11 @@ RESIDENT_BLOCKS = [
             "keel gate task-start",
             "task capsule",
             "fingerprint",
-            "Touch is the write boundary",
+            # Prose, not a command: this sentence is the one that has actually
+            # been reworded under byte pressure, so it is matched as a topic —
+            # Touch and a `bound…` word in one statement. The other prose
+            # entries stay literal until one of them needs the same freedom.
+            re.compile(r"Touch\b[^\n]*\bbound", re.IGNORECASE),
             "read-only report/evidence",
             "native plugin",
             "keel --init",
@@ -491,9 +495,9 @@ def strip_template_checksum(content: str) -> tuple[str, str | None]:
     return "".join(kept), checksum
 
 
-def validate_resident_blocks(errors: list[str]) -> None:
+def validate_resident_blocks(errors: list[str], root: Path = ROOT) -> None:
     for block in RESIDENT_BLOCKS:
-        path = ROOT / block["path"]
+        path = root / block["path"]
         if not path.is_file():
             errors.append(f"{block['name']} is missing: {block['path']}")
             continue
@@ -519,9 +523,24 @@ def validate_resident_blocks(errors: list[str]) -> None:
                 f"budget is {max_lines}"
             )
 
+        # A required entry is one of two kinds, and they mean different things.
+        # A literal names a command, marker, or identifier: if the block no
+        # longer contains it exactly, it is telling a reader to run something
+        # that does not exist, so the check must fail. A pattern states a topic
+        # in prose: the concepts must remain, the wording may move — which it
+        # must be free to, because this block is under a line and byte budget
+        # and gets rewritten to fit.
         for required in block["required"]:
-            if required not in managed_block:
-                errors.append(f"{block['name']} missing required topic: {required}")
+            if isinstance(required, str):
+                if required not in managed_block:
+                    errors.append(
+                        f"{block['name']} missing required literal: {required}"
+                    )
+            elif not required.search(managed_block):
+                errors.append(
+                    f"{block['name']} missing required topic: "
+                    f"{required.pattern}"
+                )
 
         lowered = managed_block.lower()
         for forbidden in RESIDENT_FORBIDDEN_SNIPPETS:
@@ -1082,6 +1101,17 @@ def validate_skill_portability_policy_scenario() -> int:
     return 0
 
 
+def posix_paths(text: str) -> str:
+    """Fold path separators so an assertion does not encode the host's spelling.
+
+    Keel prints these paths through the host's path joiner, so the same doctor
+    line reads `.claude\\commands\\opsx` on Windows and `.claude/commands/opsx`
+    on a POSIX runner. Assertions state the forward-slash form and normalize the
+    captured output, rather than branching on the platform or accepting both.
+    """
+    return (text or "").replace("\\", "/")
+
+
 def validate_target_surface_scenario() -> int:
     with tempfile.TemporaryDirectory(prefix="keel-surface-") as raw_tmp:
         tmp = Path(raw_tmp)
@@ -1098,9 +1128,9 @@ def validate_target_surface_scenario() -> int:
             claude_doctor.returncode != 0
             or "Target surface:" not in claude_doctor.stdout
             or "OpenSpec commands: ok" not in claude_doctor.stdout
-            or ".claude\\commands\\opsx" not in claude_doctor.stdout
+            or ".claude/commands/opsx" not in posix_paths(claude_doctor.stdout)
             or "OpenSpec action skills: ok" not in claude_doctor.stdout
-            or ".claude\\skills" not in claude_doctor.stdout
+            or ".claude/skills" not in posix_paths(claude_doctor.stdout)
             or "bootstrap: ok" not in claude_doctor.stdout
             or "CLAUDE import: ok" not in claude_doctor.stdout
             or "native plugin runtime: manual" not in claude_doctor.stdout
@@ -1130,9 +1160,9 @@ def validate_target_surface_scenario() -> int:
         if (
             codex_doctor.returncode != 0
             or "OpenSpec commands: ok" not in codex_doctor.stdout
-            or codex_prompt_dir not in codex_doctor.stdout
+            or posix_paths(codex_prompt_dir) not in posix_paths(codex_doctor.stdout)
             or "OpenSpec action skills: ok" not in codex_doctor.stdout
-            or ".codex\\skills" not in codex_doctor.stdout
+            or ".codex/skills" not in posix_paths(codex_doctor.stdout)
             or "bootstrap: ok" not in codex_doctor.stdout
             or "native plugin runtime: manual" not in codex_doctor.stdout
             or "Target capabilities (codex):" not in codex_doctor.stdout
@@ -1173,9 +1203,9 @@ def validate_target_surface_scenario() -> int:
         if (
             opencode_doctor.returncode != 0
             or "OpenSpec commands: ok" not in opencode_doctor.stdout
-            or ".opencode\\commands" not in opencode_doctor.stdout
+            or ".opencode/commands" not in posix_paths(opencode_doctor.stdout)
             or "OpenSpec action skills: ok" not in opencode_doctor.stdout
-            or ".opencode\\skills" not in opencode_doctor.stdout
+            or ".opencode/skills" not in posix_paths(opencode_doctor.stdout)
             or "bootstrap: ok" not in opencode_doctor.stdout
             or "native plugin: manual" not in opencode_doctor.stdout
             or "Target capabilities (opencode):" not in opencode_doctor.stdout
@@ -1728,7 +1758,7 @@ def validate_authoring_continuity_scenario() -> int:
             change_root / "specs/demo/spec.md",
             "## ADDED Requirements\n",
         )
-        write_text(change_root / "tasks.md", "# Tasks\n\n## Tasks\n")
+        write_text(change_root / "tasks.md", "# Tasks\n\n## Invalidates\n\n- None.\n\n## Tasks\n")
         invalid = run_keel(invalid_repo, "context", "--json")
         invalid_payload = json.loads(invalid.stdout)
         if (
@@ -2497,7 +2527,9 @@ def write_gate_fixture(repo: Path, tasks: str, design: str = "## Context\n\nfixt
     change = repo / "openspec/changes/demo"
     write_text(
         change / "tasks.md",
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
+        "## Invalidates\n\n"
+        "- None.\n\n"
         "## Expectation Coverage\n\n"
         "- E1:\n"
         "  - Covered by: 1.1\n\n"
@@ -2595,7 +2627,7 @@ def validate_cli_scenario() -> int:
 
         write_text(
             repo / "openspec/changes/status-drift/tasks.md",
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "## Tasks\n\n"
             "- [x] A1 implementation **未提交**\n\n"
             "## Execution Status\n\n"
@@ -2618,7 +2650,7 @@ def validate_cli_scenario() -> int:
 
         write_text(
             repo / "openspec/changes/status-drift/tasks.md",
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "> Boundary: tasks.md is the source for the current change's slice checklist and logical completion only. Completion state is only `[x]` / `[ ]`; progress and the default next slice are derived from the checklist. Do not record commit hashes, branch/merge state, dirty/uncommitted state, or manually computed completion counts. Durable work state belongs in OpenSpec; HANDOFF is only an explicit pointer override.\n\n"
             "## Tasks\n\n"
             "- [x] A1 implementation\n\n"
@@ -2636,7 +2668,7 @@ def validate_cli_scenario() -> int:
 
         write_text(
             repo / "openspec/changes/archive/2026-07-09-finished/tasks.md",
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [x] A1 implementation\n\n"
             "## Evidence\n\n"
             "- Scope check: pre-existing dirty paths were not attributed to this task.\n",
@@ -2832,7 +2864,7 @@ def validate_stateless_continuity_scenario() -> int:
 
         write_text(
             repo / "openspec/changes/other/tasks.md",
-            "# Tasks\n\n- [ ] 1.1 Other task\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Other task\n",
         )
         write_text(
             repo / "keel/HANDOFF.md",
@@ -2892,7 +2924,7 @@ def validate_stateless_continuity_scenario() -> int:
 
         write_text(
             tasks_path,
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [x] 1.1 First slice\n"
             "- [x] 1.2 Second slice\n",
         )
@@ -3012,7 +3044,7 @@ def validate_stateless_continuity_scenario() -> int:
         stale_repo.mkdir()
         write_text(
             stale_repo / "openspec/changes/current/tasks.md",
-            "# Tasks\n\n- [ ] 1.1 Current task\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Current task\n",
         )
         write_text(
             stale_repo / "keel/HANDOFF.md",
@@ -3037,7 +3069,7 @@ def validate_stateless_continuity_scenario() -> int:
 
         write_text(
             stale_repo / "openspec/changes/current/tasks.md",
-            "# Tasks\n\n- [x] 1.1 Current task\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [x] 1.1 Current task\n",
         )
         write_text(
             stale_repo / "keel/HANDOFF.md",
@@ -3064,7 +3096,7 @@ def validate_stateless_continuity_scenario() -> int:
 
         write_text(
             stale_repo / "openspec/changes/current/tasks.md",
-            "# Tasks\n\n- [ ] 1.1 Current task\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Current task\n",
         )
         write_text(
             stale_repo / "keel/HANDOFF.md",
@@ -3409,7 +3441,7 @@ def task_contract_fixture(
     command_lines = "".join(f"    - {item}\n" for item in commands)
     evidence_lines = "".join(f"    - {item}\n" for item in evidence)
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Exercise task contract\n"
         "  - Owner: keel-agent\n"
         f"  - Mode: {mode}\n"
@@ -3446,6 +3478,246 @@ def task_contract_fixture(
     )
 
 
+# task-start requires a change to declare what it invalidates, so every fixture
+# that expects to start a task carries the cheapest legitimate answer. Scenarios
+# exercising the declaration itself replace this block.
+INVALIDATES_NONE = "## Invalidates\n\n- None.\n\n"
+
+
+INVALIDATION_ENTRIES = (
+    '- I1: "Touch is the write boundary" — assets/bootstrap/AGENTS.md.'
+    " Updated by: 1.1\n"
+    '- I2: "does not accept a GitHub issue URL" —'
+    " keel/archive/follow-ups/note.md."
+    " Discard reason: archive notes are historical evidence.\n"
+    '- I3: "the suite is not portable" — README.md.'
+    " Durable owner: https://example.invalid/issues/1\n"
+)
+
+
+def invalidation_repo(root: Path, name: str, section: str | None) -> Path:
+    repo = root / name
+    # A real Contract anchor, so the missing-section case can prove that a
+    # failing authoring gate leaves the anchor untouched rather than merely
+    # failing earlier for want of one.
+    body = task_contract_fixture(evidence=("Contract: pending", "M1: pending"))
+    body = body.replace(INVALIDATES_NONE, "" if section is None else section)
+    write_text(repo / "openspec/changes/demo/tasks.md", body)
+    return repo
+
+
+def validate_task_start_invalidation_scenario() -> int:
+    label = "task-start-invalidation"
+
+    def gate(repo: Path, *extra: str) -> tuple[subprocess.CompletedProcess[str], dict]:
+        result = run_keel(
+            repo, "gate", "task-start", ".",
+            "--change", "demo", "--task", "1.1", "--json", *extra,
+        )
+        payload = json.loads(result.stdout) if result.stdout.strip() else {}
+        return result, payload
+
+    def codes(payload: dict) -> set[str]:
+        return {item.get("code") for item in payload.get("problems", [])}
+
+    def messages(payload: dict) -> str:
+        return " ".join(item.get("message", "") for item in payload.get("problems", []))
+
+    with tempfile.TemporaryDirectory(
+        prefix="keel-invalidation-", ignore_cleanup_errors=True
+    ) as raw:
+        tmp = Path(raw)
+
+        # A change that never answered the question cannot start, and the
+        # refusal writes nothing — the guard manifest and the Contract anchor
+        # are both withheld, so a failed authoring gate leaves no state behind.
+        missing = invalidation_repo(tmp, "missing", None)
+        tasks_before = (missing / "openspec/changes/demo/tasks.md").read_text(
+            encoding="utf-8"
+        )
+        result, payload = gate(missing, "--record")
+        if (
+            payload.get("status") != "fail"
+            or "invalidation-declaration" not in codes(payload)
+        ):
+            report(f"{label} accepted a change with no invalidation section.")
+            report(repr(payload.get("problems")))
+            return 1
+        if (missing / "keel/guard.json").exists():
+            report(f"{label} wrote a guard manifest for a failing authoring gate.")
+            return 1
+        if (missing / "openspec/changes/demo/tasks.md").read_text(
+            encoding="utf-8"
+        ) != tasks_before:
+            report(f"{label} recorded a Contract anchor for a failing gate.")
+            return 1
+
+        none_repo = invalidation_repo(tmp, "none", INVALIDATES_NONE)
+        _, none_payload = gate(none_repo, "--no-guard")
+        if none_payload.get("status") != "pass":
+            report(f"{label} refused a legitimate declaration of nothing.")
+            report(repr(none_payload.get("problems")))
+            return 1
+
+        full_repo = invalidation_repo(
+            tmp, "full", "## Invalidates\n\n" + INVALIDATION_ENTRIES + "\n"
+        )
+        _, full_payload = gate(full_repo, "--no-guard")
+        if full_payload.get("status") != "pass":
+            report(f"{label} refused well-formed entries covering all three closures.")
+            report(repr(full_payload.get("problems")))
+            return 1
+
+        # The declaration is change-level bookkeeping, not task authority: two
+        # changes whose tasks are byte-identical must compile the same capsule
+        # however differently they answered this question.
+        none_print = none_payload.get("contract", {}).get("fingerprint", {}).get("value")
+        full_print = full_payload.get("contract", {}).get("fingerprint", {}).get("value")
+        if not none_print or none_print != full_print:
+            report(
+                f"{label} let the invalidation section move the capsule "
+                f"fingerprint: {none_print} vs {full_print}"
+            )
+            return 1
+
+        # A location list only ever names files the author already recalled,
+        # which is the failure this section exists to prevent, so an entry
+        # without the searchable wording is refused.
+        no_phrase = invalidation_repo(
+            tmp,
+            "no-phrase",
+            "## Invalidates\n\n- I1: AGENTS.md and README.md. Updated by: 1.1\n\n",
+        )
+        _, no_phrase_payload = gate(no_phrase, "--no-guard")
+        if (
+            no_phrase_payload.get("status") != "fail"
+            or "I1" not in messages(no_phrase_payload)
+        ):
+            report(f"{label} accepted an entry with no searchable phrase.")
+            report(repr(no_phrase_payload.get("problems")))
+            return 1
+
+        unclosed = invalidation_repo(
+            tmp,
+            "unclosed",
+            '## Invalidates\n\n- I1: "Touch is the write boundary" — AGENTS.md.\n\n',
+        )
+        _, unclosed_payload = gate(unclosed, "--no-guard")
+        if (
+            unclosed_payload.get("status") != "fail"
+            or "I1" not in messages(unclosed_payload)
+        ):
+            report(f"{label} accepted an entry that never closed.")
+            report(repr(unclosed_payload.get("problems")))
+            return 1
+
+        unknown_owner = invalidation_repo(
+            tmp,
+            "unknown-task",
+            '## Invalidates\n\n- I1: "Touch is the write boundary" — AGENTS.md.'
+            " Updated by: 9.9\n\n",
+        )
+        _, unknown_payload = gate(unknown_owner, "--no-guard")
+        if unknown_payload.get("status") != "fail":
+            report(f"{label} accepted an updater task that does not exist.")
+            return 1
+
+        if not codes(payload):
+            report(f"{label} reported a failure with no problem code.")
+            return 1
+
+    report(f"{label} scenario passed.")
+    return 0
+
+
+SCHEMA_COPY_PAIRS = (
+    (
+        "openspec/schemas/keel-spec-driven/templates/tasks.md",
+        "assets/openspec/schemas/keel-spec-driven/templates/tasks.md",
+    ),
+    (
+        "openspec/schemas/keel-spec-driven/schema.yaml",
+        "assets/openspec/schemas/keel-spec-driven/schema.yaml",
+    ),
+)
+
+
+def validate_invalidation_authoring_surface_scenario() -> int:
+    label = "invalidation-authoring-surface"
+
+    # The two schema copies are the repo-local one OpenSpec resolves and the
+    # packaged one `keel --init` writes. compact-task-authoring already means to
+    # assert they agree, but its canonical root does not exist in this layout, so
+    # its rglob compares nothing; this states the pair explicitly.
+    for local, packaged in SCHEMA_COPY_PAIRS:
+        local_text = (ROOT / local).read_text(encoding="utf-8")
+        packaged_text = (ROOT / packaged).read_text(encoding="utf-8")
+        if local_text != packaged_text:
+            report(f"{label} schema copies diverge: {local} vs {packaged}")
+            return 1
+
+    template = (
+        ROOT / "openspec/schemas/keel-spec-driven/templates/tasks.md"
+    ).read_text(encoding="utf-8")
+    for marker in ("## Invalidates", "- None.", "- I1:"):
+        if marker not in template:
+            report(f"{label} tasks template lacks the invalidation section: {marker}")
+            return 1
+
+    schema = (
+        ROOT / "openspec/schemas/keel-spec-driven/schema.yaml"
+    ).read_text(encoding="utf-8")
+    for marker in ("## Invalidates", "Updated by:", "Discard reason:"):
+        if marker not in schema:
+            report(
+                f"{label} authoring instruction does not describe the "
+                f"invalidation section: {marker}"
+            )
+            return 1
+
+    resident = resident_session_start_section(ROOT / "AGENTS.md")
+    agents = (ROOT / "AGENTS.md").read_text(encoding="utf-8")
+    if resident is None:
+        report(f"{label} resident AGENTS.md has no Session Start section.")
+        return 1
+    for marker in ("## Invalidates", "## Expectation Coverage"):
+        if marker not in agents:
+            report(f"{label} resident protocol does not name {marker}.")
+            return 1
+
+    # An author who scaffolds and fills in the tasks must not additionally have
+    # to discover this section, so the template's own answer has to satisfy the
+    # gate. Placeholders are filled generically; the assertion is narrow on
+    # purpose — no invalidation problem may survive.
+    filled = re.sub(r"<!--[\s\S]*?-->", "", template)
+    filled = filled.replace("<strategy>", "evidence-first")
+    filled = re.sub(r"<[^<>\n]+>", "concrete authored value", filled)
+    with tempfile.TemporaryDirectory(
+        prefix="keel-invalidation-surface-", ignore_cleanup_errors=True
+    ) as raw:
+        repo = Path(raw) / "scaffold"
+        write_text(repo / "openspec/changes/demo/tasks.md", filled)
+        started = run_keel(
+            repo, "gate", "task-start", ".",
+            "--change", "demo", "--task", "1.1", "--json", "--no-guard",
+        )
+        payload = json.loads(started.stdout) if started.stdout.strip() else {}
+        offenders = [
+            item for item in payload.get("problems", [])
+            if str(item.get("code", "")).startswith("invalidation-")
+        ]
+        if offenders:
+            report(
+                f"{label} a filled-in scaffold still fails the invalidation "
+                "gate, so the template's own answer is not usable."
+            )
+            report(repr(offenders))
+            return 1
+
+    report(f"{label} scenario passed.")
+    return 0
+
+
 def validate_task_contract_core_scenario() -> int:
     with tempfile.TemporaryDirectory(prefix="keel-task-contract-") as raw_tmp:
         repo = Path(raw_tmp)
@@ -3690,7 +3962,7 @@ def task_capsule_expanded_fixture() -> str:
 
 def task_capsule_compact_fixture() -> str:
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Exercise task contract\n"
         "  - Covers:\n"
         "    - E1: Public behavior passes.\n"
@@ -4233,7 +4505,7 @@ TRACKER_OWNER = "https://github.com/TanglmChris/keel/issues/12"
 def tracker_owner_tasks(findings: str, closure: str) -> str:
     """One complete, checked task plus one Expectation Coverage closure line."""
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "## Expectation Coverage\n\n"
         "- E1:\n"
         f"  - {closure}\n\n"
@@ -5137,7 +5409,7 @@ def validate_task_capsule_scenario() -> int:
 
         close_task = (
             completion_task
-            .replace("# Tasks\n\n", "# Tasks\n\n## Expectation Coverage\n\n"
+            .replace("# Tasks\n\n## Invalidates\n\n- None.\n\n", "# Tasks\n\n## Invalidates\n\n- None.\n\n## Expectation Coverage\n\n"
                      "- E1:\n  - Covered by: 1.1\n\n## 1. Work\n\n")
             .replace("- [ ] 1.1", "- [x] 1.1")
         )
@@ -5197,7 +5469,7 @@ def validate_core_gates_scenario() -> int:
         tasks_path = repo / "openspec/changes/demo/tasks.md"
         write_text(
             tasks_path,
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [ ] 1.1 Incomplete task\n"
             "  - Owner: keel-agent\n",
         )
@@ -5232,7 +5504,7 @@ def validate_core_gates_scenario() -> int:
 
         write_text(
             tasks_path,
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [ ] 1.1 Complete executable task\n"
             "  - Owner: keel-agent\n"
             "  - Mode: implementation\n"
@@ -5382,7 +5654,7 @@ def validate_core_gates_scenario() -> int:
             findings: str = "none",
         ) -> str:
             return (
-                "# Tasks\n\n"
+                "# Tasks\n\n## Invalidates\n\n- None.\n\n"
                 "- [ ] 1.1 Complete behavior\n"
                 "  - Owner: keel-agent\n"
                 "  - Mode: implementation\n"
@@ -5501,7 +5773,7 @@ def validate_core_gates_scenario() -> int:
         )
         write_text(
             completion_repo / "openspec/changes/follow-up/tasks.md",
-            "# Tasks\n\n- [ ] 1.1 Own the finding\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Own the finding\n",
         )
         owned_finding = run_keel(
             completion_repo,
@@ -5819,7 +6091,7 @@ def validate_core_gates_scenario() -> int:
             if extra_touch:
                 touch += "    - src/extra.js\n"
             return (
-                "# Tasks\n\n"
+                "# Tasks\n\n## Invalidates\n\n- None.\n\n"
                 "- [ ] 1.1 Record behavior\n"
                 "  - Owner: keel-agent\n"
                 "  - Mode: implementation\n"
@@ -6037,7 +6309,7 @@ def validate_core_gates_scenario() -> int:
         def close_task(checked: bool, review_status: str = "pass") -> str:
             mark = "x" if checked else " "
             return (
-                "# Tasks\n\n"
+                "# Tasks\n\n## Invalidates\n\n- None.\n\n"
                 "## Expectation Coverage\n\n"
                 "- E1:\n"
                 "  - Covered by: 1.1\n\n"
@@ -6196,7 +6468,7 @@ def validate_core_gates_scenario() -> int:
 
 def validate_scope_rename_attribution_scenario() -> int:
     rename_task = (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Complete behavior\n"
         "  - Owner: keel-agent\n"
         "  - Mode: implementation\n"
@@ -6399,7 +6671,7 @@ def validate_target_capability_adapters_scenario() -> int:
 
             write_text(
                 repo / "openspec/changes/demo/tasks.md",
-                "# Tasks\n\n- [ ] 1.1 Incomplete\n  - Owner: keel-agent\n",
+                "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Incomplete\n  - Owner: keel-agent\n",
             )
             gate = run_keel(
                 repo,
@@ -6825,6 +7097,31 @@ def session_start_context(result: subprocess.CompletedProcess[str]) -> str | Non
     return output.get("additionalContext")
 
 
+# The projection is delivered through additionalContext, which the host injects
+# into the agent and never renders for the human. Every branch must therefore
+# carry the instruction to relay it, including — especially — the degraded ones,
+# because a projection nobody sees is a projection nobody checks.
+SESSION_START_DISCLOSURE = "to the user in your first reply"
+
+# A host loads its plugins once per session, so the projection can be absent for
+# reasons no repository check can see. The resident protocol is the carrier of
+# last resort and must state the same obligation without trading away the
+# continuity rules it already carried.
+RESIDENT_SESSION_START_REQUIRED = (
+    SESSION_START_DISCLOSURE,
+    "keel context",
+    "never infer continuity from native memory",
+)
+
+
+def resident_session_start_section(path: Path) -> str | None:
+    text = path.read_text(encoding="utf-8")
+    match = re.search(
+        r"^## Session Start$(.*?)^## ", text, re.MULTILINE | re.DOTALL
+    )
+    return match.group(1) if match else None
+
+
 def validate_native_plugin_session_start_scenario() -> int:
     real_cli = f'node "{ROOT / "bin/keel.js"}"'
     codex_event = {"hook_event_name": "SessionStart", "source": "startup"}
@@ -6872,6 +7169,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             or "demo#1.1" not in codex_context
             or "task-start" not in codex_context
             or "disposable" not in codex_context
+            or SESSION_START_DISCLOSURE not in codex_context
         ):
             report(
                 "native-plugin-session-start ready projection lacks concise "
@@ -6883,6 +7181,24 @@ def validate_native_plugin_session_start_scenario() -> int:
                 report("native-plugin-session-start projection overstepped.")
                 return 1
 
+        idle_repo = tmp / "idle"
+        (idle_repo / "openspec/changes").mkdir(parents=True)
+        idle_result = run_session_start_hook(
+            idle_repo, codex_event, keel_cli=real_cli
+        )
+        idle_context = session_start_context(idle_result)
+        if (
+            idle_result.returncode != 0
+            or not idle_context
+            or "idle" not in idle_context
+            or SESSION_START_DISCLOSURE not in idle_context
+        ):
+            report(
+                "native-plugin-session-start idle projection did not disclose "
+                "its status to the user: " + repr(idle_context)
+            )
+            return 1
+
         ambiguous_repo = tmp / "ambiguous"
         ambiguous_repo.mkdir()
         for change in ("alpha", "beta"):
@@ -6899,6 +7215,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             or not ambiguous_context
             or "ambiguous" not in ambiguous_context
             or "keel context" not in ambiguous_context
+            or SESSION_START_DISCLOSURE not in ambiguous_context
             or "alpha#1.1" in ambiguous_context
         ):
             report(
@@ -6928,6 +7245,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             or not missing_context
             or "missing or incompatible" not in missing_context
             or "keel context" not in missing_context
+            or SESSION_START_DISCLOSURE not in missing_context
         ):
             report("native-plugin-session-start missing-CLI fallback failed.")
             report(repr(missing_context))
@@ -6950,6 +7268,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             malformed_result.returncode != 0
             or not malformed_context
             or "malformed" not in malformed_context
+            or SESSION_START_DISCLOSURE not in malformed_context
         ):
             report("native-plugin-session-start malformed-output fallback failed.")
             report(repr(malformed_context))
@@ -6975,6 +7294,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             hang_result.returncode != 0
             or not hang_context
             or "failed or timed out" not in hang_context
+            or SESSION_START_DISCLOSURE not in hang_context
         ):
             report("native-plugin-session-start timeout fallback failed.")
             report(repr(hang_context))
@@ -6995,6 +7315,21 @@ def validate_native_plugin_session_start_scenario() -> int:
         )
         return 1
 
+    resident = resident_session_start_section(ROOT / "AGENTS.md")
+    if resident is None:
+        report(
+            "native-plugin-session-start resident AGENTS.md has no Session "
+            "Start section."
+        )
+        return 1
+    for needle in RESIDENT_SESSION_START_REQUIRED:
+        if needle not in resident:
+            report(
+                "native-plugin-session-start resident Session Start section is "
+                f"missing: {needle}"
+            )
+            return 1
+
     report("native-plugin-session-start scenario passed.")
     return 0
 
@@ -7024,8 +7359,11 @@ def validate_native_plugin_marketplaces_scenario() -> int:
     codex = shutil.which("codex")
     claude = claude_cli()
     if codex is None or claude is None:
-        report("native-plugin-marketplaces requires codex and claude CLIs.")
-        return 1
+        return skip_scenario(
+            "native-plugin-marketplaces",
+            "requires the codex and claude CLIs, which are not installed; it "
+            "probes native marketplace behavior no CI runner provides",
+        )
 
     with tempfile.TemporaryDirectory(prefix="keel-native-market-") as raw_tmp:
         tmp = Path(raw_tmp)
@@ -7680,7 +8018,7 @@ def validate_native_runtime_projection_scenario() -> int:
 
     def projection_task(acceptance: str = "observable result") -> str:
         return (
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [ ] 1.1 Project selected behavior\n"
             "  - Owner: keel-agent\n"
             "  - Mode: implementation\n"
@@ -8274,7 +8612,7 @@ NATIVE_GOAL_VERSION = "keel-native-goal/v1"
 
 
 def _goal_tasks_file(blocks: list[str]) -> str:
-    return "# Tasks\n\n" + "\n\n".join(blocks) + "\n"
+    return "# Tasks\n\n## Invalidates\n\n- None.\n\n" + "\n\n".join(blocks) + "\n"
 
 
 def _goal_task_block(
@@ -8893,7 +9231,7 @@ def validate_fast_pre_push_doctor_scenario() -> int:
 
 def validate_verify_layer_tag_scenario() -> int:
     fixture = (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Exercise the verification-layer tag\n"
         "  - Covers:\n"
         "    - E1: Public behavior passes.\n"
@@ -10129,8 +10467,11 @@ def validate_native_plugin_install_matrix_scenario() -> int:
     codex = shutil.which("codex")
     claude = claude_cli()
     if codex is None or claude is None:
-        report("native-plugin-install-matrix requires codex and claude CLIs.")
-        return 1
+        return skip_scenario(
+            "native-plugin-install-matrix",
+            "requires the codex and claude CLIs, which are not installed; it "
+            "probes native install behavior no CI runner provides",
+        )
 
     expected_version = json.loads(
         (ROOT / "package.json").read_text(encoding="utf-8")
@@ -10283,7 +10624,7 @@ def validate_native_plugin_install_matrix_scenario() -> int:
 def guard_task_fixture(checked: bool = False) -> str:
     box = "x" if checked else " "
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         f"- [{box}] 1.1 Exercise guarded feature\n"
         "  - Covers:\n"
         "    - E1: Guarded public behavior passes.\n"
@@ -10383,7 +10724,7 @@ RECORD_LAYER_SPEC = (
 def record_layer_tasks(checked: bool = False, touch: str = "src/feature.js") -> str:
     box = "x" if checked else " "
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         f"- [{box}] 1.1 Exercise guarded feature\n"
         "  - Covers:\n"
         "    - demo-cap / Guarded behavior holds / Guarded public behavior passes\n"
@@ -10399,7 +10740,7 @@ def record_layer_tasks(checked: bool = False, touch: str = "src/feature.js") ->
 
 def mode_fixture_tasks(mode: str, touch: str) -> str:
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Establish the version baseline\n"
         f"  - Mode: {mode}\n"
         "  - Covers:\n"
@@ -10415,6 +10756,335 @@ def mode_fixture_tasks(mode: str, touch: str) -> str:
     )
 
 
+def validate_runner_skip_accounting_scenario() -> int:
+    """Issue #10: the suite could not pass anywhere the native CLIs are absent.
+
+    Two of seventy scenarios probe native runtimes and used to `return 1` when
+    the CLI was missing, so no CI runner could ever go green. A skip must be
+    reported and counted, never conflated with a pass or a failure.
+    """
+    label = "runner-skip-accounting"
+    runner = str(ROOT / "scripts/validate_plugin.py")
+
+    def run_registry(results: str) -> subprocess.CompletedProcess[str]:
+        """Drive run_all over synthetic scenario results in a child process.
+
+        run_all dispatches each scenario as its own subprocess, which reads the
+        real registry from disk, so a substituted registry would be ignored.
+        The accounting is the behavior under test, so the process fan-out is
+        replaced with fixed (name, code, output) triples instead.
+        """
+        program = (
+            "import sys\n"
+            f"src = open({runner!r}, encoding='utf-8').read()\n"
+            "ns = {'__name__': 'v', '__file__': %r}\n" % runner
+            + "exec(compile(src, %r, 'exec'), ns)\n" % runner
+            + f"results = {results}\n"
+            "ns['SCENARIOS'] = tuple((n, None) for n, _, _ in results)\n"
+            "ns['run_baseline'] = lambda: 0\n"
+            "ns['run_scenario_processes'] = lambda names, jobs: results\n"
+            "sys.exit(ns['run_all'](2))\n"
+        )
+        return subprocess.run(
+            [sys.executable, "-c", program],
+            capture_output=True, text=True, encoding="utf-8", errors="replace",
+            cwd=str(ROOT),
+        )
+
+    # A skipping scenario must not fail the run, must be named, and must be
+    # excluded from the verified count; a failing one must still fail it.
+    both = run_registry(
+        "[('fake-skip', 3, 'fake-skip scenario skipped: the frob CLI\\n'),"
+        " ('fake-pass', 0, 'fake-pass scenario passed.\\n')]"
+    )
+    out = (both.stdout or "") + (both.stderr or "")
+    if both.returncode != 0:
+        report(f"{label}: a skipping scenario must not fail the run.")
+        report(out.strip())
+        return 1
+    for needle in ("fake-skip", "skipped", "the frob CLI", "plus 1 scenario"):
+        if needle not in out:
+            report(f"{label}: the summary must report {needle!r}; got:\n{out.strip()}")
+            return 1
+    if "fake-pass" in out.split("passed:")[-1]:
+        report(f"{label}: a passing scenario must not be listed as skipped.")
+        report(out.strip())
+        return 1
+
+    mixed = run_registry(
+        "[('fake-skip', 3, 'fake-skip scenario skipped: the frob CLI\\n'),"
+        " ('fake-fail', 1, 'fake-fail scenario failed.\\n')]"
+    )
+    mixed_out = (mixed.stdout or "") + (mixed.stderr or "")
+    if mixed.returncode == 0 or "failed for: fake-fail" not in mixed_out:
+        report(
+            f"{label}: a skip beside a failure must still fail the run and name "
+            "the failure."
+        )
+        report(mixed_out.strip())
+        return 1
+    if "fake-skip" in mixed_out.split("failed for:")[-1]:
+        report(f"{label}: a skipped scenario must not be named as a failure.")
+        report(mixed_out.strip())
+        return 1
+
+    # The two real native-runtime scenarios must take the skip path, not fail,
+    # when their CLI cannot be resolved.
+    for name in ("native-plugin-marketplaces", "native-plugin-install-matrix"):
+        blinded = subprocess.run(
+            [sys.executable, runner, "--scenario", name],
+            capture_output=True, text=True, encoding="utf-8", errors="replace",
+            cwd=str(ROOT),
+            env={**os.environ, "PATH": str(ROOT), "PATHEXT": ""},
+        )
+        blinded_out = (blinded.stdout or "") + (blinded.stderr or "")
+        if blinded.returncode != 3 or "skipped" not in blinded_out:
+            report(
+                f"{label}: {name} must exit 3 with a reported skip when its CLI "
+                f"cannot be resolved; got {blinded.returncode}."
+            )
+            report(blinded_out.strip())
+            return 1
+        if "codex" not in blinded_out:
+            report(f"{label}: {name}'s skip does not name the runtime it needed.")
+            report(blinded_out.strip())
+            return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def sibling_scope_tasks(sibling_checked: bool, sibling_touch: str) -> str:
+    """Two tasks: 1.1 owns `shared.js`, 1.2 is the one being completed."""
+
+    def task(task_id: str, title: str, checked: bool, touch: str) -> str:
+        mark = "x" if checked else " "
+        return (
+            f"- [{mark}] {task_id} {title}\n"
+            "  - Covers:\n"
+            "    - E1: public behavior\n"
+            "  - Touch:\n"
+            + "".join(f"    - {entry}\n" for entry in touch.split(","))
+            + "  - Verify:\n"
+            "    - Strategy: evidence-first\n"
+            "    - M1: node test.js\n"
+            "  - Evidence:\n"
+            "    - M1: verified\n"
+            "    - Review:\n"
+            "      - Status: pass\n"
+            "      - Acceptance check: reviewed\n"
+            "      - Scope check: reviewed\n"
+            "      - Findings: none\n"
+            "    - Blocker: none\n"
+        )
+
+    return (
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
+        "## 1. Work\n\n"
+        + task("1.1", "Own the shared file", sibling_checked, sibling_touch)
+        + "\n"
+        + task("1.2", "Own its own file", False, "src/mine.js")
+        + "\n## Expectation Coverage\n\n- None.\n"
+    )
+
+
+def validate_completed_sibling_attribution_scenario() -> int:
+    """Issue #13 item 2: a finished task's uncommitted work blamed the next one.
+
+    `--base HEAD` cannot tell who wrote a path, so a sibling that already passed
+    its own completion gate had its files attributed to whoever ran next. The
+    workaround — commit per task — was correct but implicit, and the diagnostic
+    named a file the author never touched.
+    """
+    label = "completed-sibling-attribution"
+
+    def complete(sibling_checked: bool, sibling_touch: str = "src/shared.js"):
+        with tempfile.TemporaryDirectory(prefix="keel-sibling-scope-") as raw:
+            repo = Path(raw)
+            for name in ("src/shared.js", "src/mine.js", "src/stray.js"):
+                write_text(repo / name, "// base\n")
+            write_text(
+                repo / "openspec/changes/demo/tasks.md",
+                sibling_scope_tasks(sibling_checked, sibling_touch),
+            )
+            for args in (
+                ["init", "--quiet"],
+                ["-c", "user.email=t@e", "-c", "user.name=t", "add", "-A"],
+                [
+                    "-c", "user.email=t@e", "-c", "user.name=t",
+                    "commit", "--quiet", "-m", "base",
+                ],
+            ):
+                done = subprocess.run(
+                    ["git", *args], cwd=repo, capture_output=True, text=True
+                )
+                if done.returncode != 0:
+                    report(f"{label}: git {args[0]} failed: {done.stderr}")
+                    return None
+            # The sibling's work and an undeclared stray, both uncommitted.
+            write_text(repo / "src/shared.js", "// sibling's uncommitted work\n")
+            write_text(repo / "src/stray.js", "// nobody declared this\n")
+            result = run_keel(
+                repo, "gate", "task-complete",
+                "--change", "demo", "--task", "1.2", "--base", "HEAD", "--json",
+            )
+            return json.loads(result.stdout) if result.stdout else {}
+
+    owned = complete(sibling_checked=True)
+    if owned is None:
+        return 1
+    outside = [
+        item.get("message", "")
+        for item in owned.get("problems", [])
+        if item.get("code") == "outside-touch"
+    ]
+    if any("src/shared.js" in message for message in outside):
+        report(
+            f"{label}: a completed sibling's declared file was still attributed "
+            f"to the selected task: {outside}"
+        )
+        return 1
+    if not any("src/stray.js" in message for message in outside):
+        report(
+            f"{label}: a path no task declares must still fail: {outside}"
+        )
+        return 1
+    warnings = " ".join(owned.get("warnings", []))
+    if "src/shared.js" not in warnings or "1.1" not in warnings:
+        report(
+            f"{label}: the exclusion must be reported, naming the path and the "
+            f"completed task that declares it; got {owned.get('warnings')}"
+        )
+        return 1
+
+    unchecked = complete(sibling_checked=False)
+    if unchecked is None:
+        return 1
+    unchecked_outside = [
+        item.get("message", "")
+        for item in unchecked.get("problems", [])
+        if item.get("code") == "outside-touch"
+    ]
+    if not any("src/shared.js" in message for message in unchecked_outside):
+        report(
+            f"{label}: an unchecked sibling's Touch must grant nothing: "
+            f"{unchecked_outside}"
+        )
+        return 1
+
+    no_touch = complete(sibling_checked=True, sibling_touch="none")
+    if no_touch is None:
+        return 1
+    none_outside = [
+        item.get("message", "")
+        for item in no_touch.get("problems", [])
+        if item.get("code") == "outside-touch"
+    ]
+    if not any("src/shared.js" in message for message in none_outside):
+        report(
+            f"{label}: a sibling whose Touch is none must contribute no claim: "
+            f"{none_outside}"
+        )
+        return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_resident_topic_matching_scenario() -> int:
+    """Issue #15 item 1: required entries were named topics, matched as prose.
+
+    The bootstrap is under a line and byte budget, so its wording gets rewritten
+    to fit — and every rewrite of a pinned sentence failed the check that was
+    supposed to prove only that the topic was still covered.
+    """
+    label = "resident-topic-matching"
+    source = (ROOT / "assets/bootstrap/AGENTS.md").read_text(encoding="utf-8")
+    original = "Touch is the write boundary for product files;"
+    if original not in source:
+        report(
+            f"{label}: the fixture's anchor sentence is not in the bootstrap; "
+            "update this scenario alongside the wording."
+        )
+        return 1
+
+    def errors_for(text: str) -> list[str]:
+        with tempfile.TemporaryDirectory(prefix="keel-resident-topic-") as raw:
+            root = Path(raw)
+            write_text(root / "assets/bootstrap/AGENTS.md", text)
+            found: list[str] = []
+            validate_resident_blocks(found, root)
+            return found
+
+    def touch_errors(text: str) -> list[str]:
+        return [item for item in errors_for(text) if "Touch" in item or "bound" in item]
+
+    baseline = errors_for(source)
+    if baseline:
+        report(f"{label}: the unmodified bootstrap must pass: {baseline}")
+        return 1
+
+    # A rewording that keeps both concepts in one statement must pass.
+    reworded = source.replace(
+        original, "Touch bounds product writes, not the task's own records;"
+    )
+    if touch_errors(reworded):
+        report(
+            f"{label}: a rewording that keeps the topic was rejected: "
+            f"{touch_errors(reworded)}"
+        )
+        return 1
+
+    # Deleting the statement must still fail.
+    deleted = source.replace(original, "")
+    if not touch_errors(deleted):
+        report(f"{label}: deleting the boundary statement did not fail the check.")
+        return 1
+
+    # Mentioning only one of the topic's words must not satisfy it.
+    partial = source.replace(original, "Touch the files you declared;")
+    if not touch_errors(partial):
+        report(
+            f"{label}: a statement mentioning only Touch, with no boundary "
+            "concept, satisfied the topic."
+        )
+        return 1
+
+    # A renamed command must still fail, and be reported as a literal.
+    renamed = source.replace("keel context", "keel status")
+    literal_errors = [item for item in errors_for(renamed) if "keel context" in item]
+    if not literal_errors:
+        report(f"{label}: renaming a required command did not fail the check.")
+        return 1
+    if not any("literal" in item for item in literal_errors):
+        report(
+            f"{label}: a missing command must be reported as a missing literal, "
+            f"distinguishably from a missing topic: {literal_errors}"
+        )
+        return 1
+    if any("literal" in item for item in touch_errors(deleted)):
+        report(
+            f"{label}: a missing topic must not be reported as a missing "
+            f"literal: {touch_errors(deleted)}"
+        )
+        return 1
+
+    if (ROOT / "assets/bootstrap/AGENTS.md").read_text(encoding="utf-8") != source:
+        report(f"{label}: the shipped bootstrap was left modified.")
+        return 1
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
 def validate_repo_action_mode_scenario() -> int:
     """Issue #8 example 2: a repository action had no legal contract.
 
@@ -10893,7 +11563,7 @@ def validate_touch_write_guard_scenario() -> int:
 
 def compaction_task_fixture() -> str:
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Exercise compaction continuity\n"
         "  - Covers:\n"
         "    - E1: Continuity survives compaction.\n"
@@ -11603,6 +12273,33 @@ def validate_validation_runner_scenario() -> int:
         report("validation-runner: README does not document the parallel runner.")
         return 1
 
+    # The full gate must actually run somewhere other than one author's machine:
+    # a workflow drives the same single entry point on push and pull request,
+    # and the release workflow keeps its own tag guard rather than becoming the
+    # suite's only runner.
+    workflow_path = ROOT / ".github/workflows/test.yml"
+    if not workflow_path.is_file():
+        report(
+            "validation-runner: no .github/workflows/test.yml, so the full gate "
+            "runs only in the local pre-push hook."
+        )
+        return 1
+    workflow = workflow_path.read_text(encoding="utf-8")
+    for needle in ("npm test", "npm ci", "pull_request", "push:", "ubuntu-latest"):
+        if needle not in workflow:
+            report(
+                "validation-runner: the full-gate workflow does not declare "
+                f"{needle!r}."
+            )
+            report(workflow)
+            return 1
+    publish = (ROOT / ".github/workflows/publish.yml").read_text(encoding="utf-8")
+    if "does not match package.json version" not in publish:
+        report(
+            "validation-runner: the release workflow lost its tag/version guard."
+        )
+        return 1
+
     # Behavioral: the parallel machinery preserves registry order, keeps a
     # passing scenario's buffered output, and fails loudly on a bad entry.
     ordered = run_scenario_processes(
@@ -11752,6 +12449,17 @@ SCENARIOS: tuple = (
     ("touch-write-guard", validate_touch_write_guard_scenario),
     ("touch-guard-record-layer", validate_touch_guard_record_layer_scenario),
     ("repo-action-mode", validate_repo_action_mode_scenario),
+    ("runner-skip-accounting", validate_runner_skip_accounting_scenario),
+    ("resident-topic-matching", validate_resident_topic_matching_scenario),
+    ("task-start-invalidation", validate_task_start_invalidation_scenario),
+    (
+        "invalidation-authoring-surface",
+        validate_invalidation_authoring_surface_scenario,
+    ),
+    (
+        "completed-sibling-attribution",
+        validate_completed_sibling_attribution_scenario,
+    ),
     ("touch-guard-drift", validate_touch_guard_drift_scenario),
     ("touch-guard-surface", validate_touch_guard_surface_scenario),
     ("plugin-compaction-continuity", validate_plugin_compaction_continuity_scenario),
@@ -11868,6 +12576,19 @@ def validate_archive_overlay_hygiene(errors: list[str]) -> None:
         )
 
 
+# Exit code 3 means "this scenario did not run because an external runtime it
+# probes is absent". 0 is pass, 1 is fail, 2 is an unknown scenario or a usage
+# error, so conflating an unavailable runtime with either would hide both. The
+# reason is narrow on purpose: an inconvenient assertion, a hard fixture, or a
+# platform difference is a failure, never a skip.
+SKIPPED = 3
+
+
+def skip_scenario(label: str, reason: str) -> int:
+    report(f"{label} scenario skipped: {reason}")
+    return SKIPPED
+
+
 def run_baseline() -> int:
     errors: list[str] = []
     validate_manifest(errors)
@@ -11899,19 +12620,29 @@ def run_all(jobs: int) -> int:
     # completion, buffered output is replayed in registry order, and every
     # failure is named in one summary.
     failures = []
+    skipped = []
     if run_baseline() != 0:
         failures.append("baseline")
     ordered = run_scenario_processes([name for name, _ in SCENARIOS], jobs)
     for name, code, output in ordered:
         sys.stdout.write(output)
-        if code != 0:
+        if code == SKIPPED:
+            skipped.append(name)
+        elif code != 0:
             failures.append(name)
     if failures:
         report(f"validation --all failed for: {', '.join(failures)}")
         return 1
-    report(
-        f"validation --all passed: baseline plus {len(SCENARIOS)} scenarios."
+    # The verified count excludes skips, so the number that lands in evidence is
+    # the number actually run, and every skip is named with the run.
+    verified = len(SCENARIOS) - len(skipped)
+    summary = (
+        f"validation --all passed: baseline plus {verified} "
+        f"scenario{'' if verified == 1 else 's'}"
     )
+    if skipped:
+        summary += f", {len(skipped)} skipped: {', '.join(skipped)}"
+    report(f"{summary}.")
     return 0