@ericrisco/rsc 1.0.13 → 1.0.14

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.13",
+  "version": "1.0.14",
   "counts": {
     "skills": 264
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "Eric Risco's agent-skills catalog as a granular, self-recommending CLI installer.",
   "type": "module",
   "bin": {

package/scripts/lib/behavior-score.js

@@ -41,7 +41,25 @@ export function aggregate(scenarios) {
   return { absoluteScore, lift, n: valid.length, dropped };
 }
 
-export function behavioralGate(agg) {
+// integrity is OPTIONAL and absent means "not checked", never "clean" — callers that predate the
+// integrity layer (holdoutGate, raw stdin scoring) keep their exact behaviour.
+//
+// A violated integrity is BLOCKED, not FAIL, and the distinction is the whole point: FAIL says "the
+// skill does not clear the bar" and sends someone to edit the skill. When the control read the
+// answer key, the only true statement is "this run measures nothing" — a different action entirely.
+export function behavioralGate(agg, integrity) {
+  if (integrity && integrity.ok === false) {
+    const vs = Array.isArray(integrity.violations) ? integrity.violations : [];
+    return {
+      pass: false,
+      blocked: true,
+      reasons: [integrity.reason || 'integrity check failed'],
+      mustFix: vs.length
+        ? vs.map((v) => `${v.kind}: ${v.agent} touched ${v.pattern} (x${v.count}) — re-run with the arm isolated.`)
+        : ['Re-run the eval with integrity verifiable; the scores from this run are not a measurement.'],
+      violations: vs,
+    };
+  }
   const reasons = [];
   const mustFix = [];
   if (!agg || agg.n === 0) {
@@ -118,7 +136,7 @@ export function formatHoldoutVerdict(scored, gate) {
 }
 
 // raw: { skillId, scenarios: [{index, xIsTreatment, gradeX, gradeY, error?}] }
-export function scoreFromRaw(raw) {
+export function scoreFromRaw(raw, integrity) {
   const scenarios = (raw && Array.isArray(raw.scenarios) ? raw.scenarios : []).map((s) => {
     if (!s || s.error || !s.gradeX || !s.gradeY) {
       return { index: s ? s.index : null, error: (s && s.error) || 'missing-grade', absolute: null, delta: null };
@@ -131,8 +149,9 @@ export function scoreFromRaw(raw) {
     return { index: s.index, treatment: t, baseline: b, absolute: d.absolute, delta: d.delta };
   });
   const agg = aggregate(scenarios);
-  const gate = behavioralGate(agg);
+  const gate = behavioralGate(agg, integrity);
   const out = { skillId: (raw && raw.skillId) || null, scenarios, aggregate: agg, gate };
+  if (integrity) out.integrity = integrity;
   // Carried through untouched so the hold-out verdict can echo the fresh scenario for hand-audit.
   if (raw && raw.holdoutScenario) out.holdoutScenario = raw.holdoutScenario;
   return out;
@@ -143,7 +162,18 @@ export function formatScorecard(scored) {
   const lines = [];
   lines.push(`# Behavioral scorecard — ${skillId || '(unknown skill)'}`);
   lines.push('');
-  lines.push(`**Verdict:** ${gate.pass ? 'PASS ✅' : 'FAIL ❌'}  ·  absolute ${agg.absoluteScore == null ? 'n/a' : agg.absoluteScore}/10 (gate >= ${ABS_MIN})  ·  lift ${agg.lift == null ? 'n/a' : agg.lift} (gate >= ${LIFT_MIN})  ·  n=${agg.n}${agg.dropped ? ` (${agg.dropped} dropped)` : ''}`);
+  if (gate.blocked) {
+    // Deliberately NO absolute and NO lift here. Printing them beside a block invites reading them
+    // anyway, and they are not measurements — that is exactly what the block is saying.
+    lines.push(`**Verdict:** BLOCKED ⛔  ·  ${gate.reasons[0]}`);
+    lines.push('');
+    lines.push('The scores from this run are withheld: they are not a measurement of this skill.');
+    lines.push('');
+    lines.push('**Integrity violations:**');
+    for (const f of gate.mustFix) lines.push(`- ${f}`);
+    return lines.join('\n');
+  }
+  lines.push(`**Verdict:** ${gate.pass ? 'PASS ✅' : 'FAIL ❌'}  ·  absolute ${agg.absoluteScore == null ? 'n/a' : agg.absoluteScore}/10 (gate >= ${ABS_MIN})  ·  lift ${agg.lift == null ? 'n/a' : agg.lift} (gate >= ${LIFT_MIN})  ·  n=${agg.n}${agg.dropped ? ` (${agg.dropped} dropped)` : ''}${scored.integrity ? '  ·  integrity verified' : '  ·  integrity NOT CHECKED (pass --transcripts)'}`);
   lines.push('');
   lines.push('| Scenario | Treatment | Baseline | Delta |');
   lines.push('|---|---|---|---|');

package/scripts/lib/eval-integrity.js

@@ -0,0 +1,154 @@
+// eval-integrity.js — is a behavioral eval run measuring anything at all?
+//
+// skill-behavior-eval promises to run each capability scenario "with and without the skill". The
+// "without" arm runs with full filesystem access inside this repo, where the skill under test IS a
+// file, and nothing stopped it reading that file. Measured in the 2026-08-18 run: the `verify`
+// baseline read skills/verify/SKILL.md 7 times AND skills/verify/evals/cases.yaml 4 times — the
+// very must_include list it was being graded against. It then produced "SUSTITUIDA", a word that
+// exists nowhere but the skill written the day before.
+//
+// A lift measured against a control that read the answer key is a lower bound of unknown size.
+// Publishing it as a number is the claim-without-evidence this repo keeps paying for (P2), and it
+// feeds skill-harden's --holdout, which decides what enters a 264-skill catalog.
+//
+// This module answers the question deterministically, from the transcripts themselves — never from
+// what an agent says about its own behaviour, which is the way this fails open.
+//
+// Design note: the pure functions take text, the reader touches disk. That split is what makes the
+// interesting logic testable without fixtures on disk.
+
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+// Prompt markers the workflow actually emits. tests/eval-integrity.test.js asserts each of these
+// still appears verbatim in scripts/skill-behavior-eval.workflow.js — without that tie, rewording a
+// prompt silently retires the classifier and every run starts reporting "clean".
+export const ROLE_MARKERS = {
+  grader: 'adversarial, independent grader',
+  treatment: '=== END SKILL ===',
+  loader: 'return its full text as',
+};
+
+// Write verbs that indicate a transcript actually WROTE a path rather than merely naming it. A
+// mention is not a mutation: the grader quotes repo paths constantly and is not violating anything.
+const WRITE_SIGNALS = [
+  'Write', 'Edit', 'MultiEdit', 'NotebookEdit',
+  'cat >', 'tee ', '>>', 'mv ', 'cp ', 'rm ',
+];
+
+// Paths an eval arm may never write. 02-DOCS is the project's brain and is untracked (P9), so a
+// stray write there has no undo.
+export const PROTECTED_PATHS = ['02-DOCS/wiki/'];
+
+/**
+ * Which arm produced this transcript. Order matters: a grader transcript quotes the skill body, so
+ * it would otherwise look like a treatment.
+ */
+export function classifyAgent(transcriptText) {
+  const t = String(transcriptText || '');
+  if (t.includes(ROLE_MARKERS.grader)) return 'grader';
+  if (t.includes(ROLE_MARKERS.treatment)) return 'treatment';
+  if (t.includes(ROLE_MARKERS.loader)) return 'loader';
+  return 'baseline';
+}
+
+const countOf = (text, needle) => {
+  let n = 0;
+  let i = text.indexOf(needle);
+  while (i !== -1) { n++; i = text.indexOf(needle, i + needle.length); }
+  return n;
+};
+
+/**
+ * findViolations({skillId, agents}) — agents: [{name, role, text}]
+ * Returns {ok, violations:[{kind, agent, pattern, count}]}.
+ *
+ * Only the baseline is judged on reads: the treatment is SUPPOSED to have the skill, and the loader
+ * reads both files by design. Every arm is judged on writes.
+ */
+export function findViolations({ skillId, agents }) {
+  if (!skillId) throw new Error('findViolations: skillId is required');
+  const violations = [];
+  const skillPath = `skills/${skillId}/SKILL.md`;
+  const rubricPath = `skills/${skillId}/evals/cases.yaml`;
+
+  for (const a of agents || []) {
+    const text = String(a.text || '');
+    if (a.role === 'baseline') {
+      // Graded separately: reading the skill removes the control; reading the rubric is reading the
+      // answer key, which also inflates the baseline's own score.
+      const skillHits = countOf(text, skillPath);
+      if (skillHits > 0) {
+        violations.push({ kind: 'baseline-read-skill', agent: a.name, pattern: skillPath, count: skillHits });
+      }
+      const rubricHits = countOf(text, rubricPath);
+      if (rubricHits > 0) {
+        violations.push({ kind: 'baseline-read-rubric', agent: a.name, pattern: rubricPath, count: rubricHits });
+      }
+    }
+    if (a.role === 'baseline' || a.role === 'treatment') {
+      for (const p of PROTECTED_PATHS) {
+        if (!text.includes(p)) continue;
+        // Require a write verb near the path, or a mention becomes a violation and the grader's
+        // quotations would block every run.
+        const wrote = WRITE_SIGNALS.some((verb) => {
+          let i = text.indexOf(p);
+          while (i !== -1) {
+            const window = text.slice(Math.max(0, i - 400), i + 400);
+            if (window.includes(verb)) return true;
+            i = text.indexOf(p, i + p.length);
+          }
+          return false;
+        });
+        if (wrote) {
+          violations.push({ kind: 'wrote-protected-path', agent: a.name, pattern: p, count: countOf(text, p) });
+        }
+      }
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+
+/** Read a workflow transcript directory into [{name, role, text}]. Throws if unreadable. */
+export function readAgents(dir) {
+  if (!dir) throw new Error('readAgents: transcripts dir is required');
+  const st = statSync(dir); // throws ENOENT — deliberately not caught here
+  if (!st.isDirectory()) throw new Error(`readAgents: not a directory: ${dir}`);
+  return readdirSync(dir)
+    .filter((f) => /^agent-.*\.jsonl$/.test(f))
+    .map((f) => {
+      const text = readFileSync(join(dir, f), 'utf8');
+      return { name: f, role: classifyAgent(text), text };
+    });
+}
+
+/**
+ * checkIntegrity({skillId, transcriptsDir}) → {ok, blocked, reason, violations, counts}
+ *
+ * FAILS CLOSED. A missing dir, an unreadable dir, or zero baseline transcripts all return
+ * blocked — never a silent pass. "We could not look" must never render as "we looked and it was
+ * fine", which is the single failure mode this whole file exists for.
+ */
+export function checkIntegrity({ skillId, transcriptsDir }) {
+  let agents;
+  try {
+    agents = readAgents(transcriptsDir);
+  } catch (e) {
+    return { ok: false, blocked: true, reason: `integrity not verifiable: ${e.message}`, violations: [], counts: {} };
+  }
+  const counts = agents.reduce((acc, a) => { acc[a.role] = (acc[a.role] || 0) + 1; return acc; }, {});
+  if (!counts.baseline) {
+    return {
+      ok: false, blocked: true,
+      reason: `integrity not verifiable: no baseline transcript found in ${transcriptsDir}`,
+      violations: [], counts,
+    };
+  }
+  const { ok, violations } = findViolations({ skillId, agents });
+  if (ok) return { ok: true, blocked: false, reason: 'integrity verified', violations: [], counts };
+  return {
+    ok: false, blocked: true,
+    reason: `${violations.length} integrity violation(s) — this run measures nothing`,
+    violations, counts,
+  };
+}

package/scripts/skill-behavior-eval.js

@@ -1,15 +1,25 @@
 #!/usr/bin/env node
 // skill-behavior-eval.js — turn the behavior workflow's raw JSON into a scorecard.
 // Usage:
-//   node scripts/skill-behavior-eval.js --score   <raw.json>   (or pipe raw JSON on stdin with -)
+//   node scripts/skill-behavior-eval.js --score   <raw.json> [--transcripts <dir>]
 //   node scripts/skill-behavior-eval.js --holdout <raw.json>   (fresh-scenario transfer gate)
 // Exits 0 if the gate passes, 1 if it fails/blocks, 2 on usage/parse error.
 //
+// --transcripts runs the integrity check (scripts/lib/eval-integrity.js) over the workflow's agent
+// transcripts: did the "without the skill" arm read the skill, or its grading rubric, or write into
+// 02-DOCS? Any of those and the verdict is BLOCKED and the numbers are withheld, because a lift
+// measured against a contaminated control is not a measurement.
+//
+// Without --transcripts the scorecard says "integrity NOT CHECKED" on the verdict line. That is
+// deliberate: the flag is optional so existing callers keep working, so silence must not read as
+// clean.
+//
 // --holdout exists so the fix loop's blocking decision is a comparison of numbers an agent reports,
 // never a judgement an agent makes (constitution P1).
 
 import { readFileSync } from 'node:fs';
 import { scoreFromRaw, formatScorecard, holdoutGate, formatHoldoutVerdict } from './lib/behavior-score.js';
+import { checkIntegrity } from './lib/eval-integrity.js';
 
 function readInput(argPath) {
   if (argPath && argPath !== '-') return readFileSync(argPath, 'utf8');
@@ -25,12 +35,21 @@ function main() {
   }
   let raw;
   try {
-    raw = JSON.parse(readInput(args[1]));
+    raw = JSON.parse(readInput(args[1] && args[1] !== '--transcripts' ? args[1] : '-'));
   } catch (e) {
     process.stderr.write(`parse error: ${e.message}\n`);
     process.exit(2);
   }
-  const scored = scoreFromRaw(raw);
+  const ti = args.indexOf('--transcripts');
+  const transcriptsDir = ti !== -1 ? args[ti + 1] : null;
+  if (ti !== -1 && !transcriptsDir) {
+    process.stderr.write('--transcripts needs a directory\n');
+    process.exit(2);
+  }
+  const integrity = transcriptsDir
+    ? checkIntegrity({ skillId: (raw && raw.skillId) || '', transcriptsDir })
+    : undefined;
+  const scored = scoreFromRaw(raw, integrity);
   if (mode === '--holdout') {
     const gate = holdoutGate(scored);
     process.stdout.write(formatHoldoutVerdict(scored, gate) + '\n');

package/scripts/skill-behavior-eval.workflow.js

@@ -90,6 +90,10 @@ if (!loaded || !Array.isArray(loaded.scenarios) || loaded.scenarios.length === 0
   return { skillId, scenarios: [], error: 'no-capability-scenarios' }
 }
 
+// A distinct write zone per (scenario, arm). Under .rsc/, which is already gitignored, so an eval
+// write can neither dirty the tracked tree nor show up later as an abandoned diff.
+const sandbox = (index, arm) => `.rsc/eval-sandbox/${skillId}/${arm}-${index}/`
+
 phase('Execute & Grade')
 const results = await pipeline(
   loaded.scenarios,
@@ -97,7 +101,18 @@ const results = await pipeline(
   (sc, _orig, index) => parallel([
     () => agent(
       `Complete this task fully and concretely. Produce the ACTUAL deliverable the task asks for, ` +
-      `not a description of how you would do it.\n\nTASK:\n${sc.scenario}`,
+      `not a description of how you would do it.\n\n` +
+      // The baseline IS the control. Reading the skill destroys the only thing this arm is for, so
+      // the prohibition carries its reason — a rule without one gets rationalised away first. This
+      // is guidance, not a barrier: the barrier is the post-hoc check in scripts/lib/eval-integrity.js,
+      // which BLOCKS the run if this arm touched the skill or its rubric.
+      `CONSTRAINTS — you are the control arm of a measurement:\n` +
+      `- Do NOT read anything under skills/ . You are the "without the skill" arm; if you read the ` +
+      `skill under test there is no control and the measurement is void.\n` +
+      `- Do NOT read any evals/cases.yaml — that is the rubric you are being graded against.\n` +
+      `- The repository is READ-ONLY. Never write to 02-DOCS/ or to any tracked file.\n` +
+      `- Write every file you produce under ${sandbox(index, 'baseline')} .\n\n` +
+      `TASK:\n${sc.scenario}`,
       { label: `baseline:${index}`, phase: 'Execute & Grade' },
     ),
     () => agent(
@@ -105,6 +120,13 @@ const results = await pipeline(
       `skills/${loaded.skillId}/references/; read them if the skill points you there.\n\n` +
       `=== SKILL: ${loaded.skillId} ===\n${loaded.skillBody}\n=== END SKILL ===\n\n` +
       `Complete this task fully and concretely. Produce the ACTUAL deliverable, not a description.\n\n` +
+      // Both arms once wrote the same path (02-DOCS/wiki/sdd/specs/magic-link-login.md) and one
+      // clobbered the other mid-run, so the grader scored a file that no longer existed. A distinct
+      // sandbox per arm makes that collision impossible by construction rather than by luck.
+      `CONSTRAINTS:\n` +
+      `- The repository is READ-ONLY. Never write to 02-DOCS/ or to any tracked file: this is a ` +
+      `measurement, and it must not mutate the project it runs inside.\n` +
+      `- Write every file you produce under ${sandbox(index, 'treatment')} .\n\n` +
       `TASK:\n${sc.scenario}`,
       { label: `treatment:${index}`, phase: 'Execute & Grade' },
     ),

package/skills/author-skill/SKILL.md

@@ -148,6 +148,7 @@ A skill ships only when every box is checked or a miss is consciously justified.
 - [ ] **Concrete tooling delegated** to the stack skills rather than reinvented.
 - [ ] **evals present** — `cases.yaml` (≥5 `should_trigger` incl. non-obvious, ≥4 `should_not_trigger` each with a real-sibling `route_to`, ≥1 `capability` with a `must_include` rubric) + an honest `README.md`. `scripts/eval-lint.sh` passes — but it only checks presence and the counts (≥5/≥4/≥1) and that those keys are lists; the `route_to`-points-at-a-real-sibling, non-obvious phrasings, and `must_include` quality are yours to verify here, not the linter's.
 - [ ] **verify.sh** present iff the skill has a checkable artifact; process skills rely on evals.
+- [ ] **Every `must_include` item discriminates** — answerable by the scenario's task, plausibly caused by the skill and plausibly missed without it. An item *both* arms fail measures nothing and lowers the absolute; it has turned a real PASS into a FAIL here. → `references/eval-authoring.md`.
 - [ ] **Sibling links resolve** — every `../x/SKILL.md` points to a skill that exists.
 - [ ] **Wired** — `tags` + `recommends` set, `npm run manifest` re-run, and `npm run validate` / `npm run manifest:check` pass (manifest current, no dangling recommends).
 

package/skills/author-skill/references/eval-authoring.md

@@ -63,6 +63,40 @@ The `must_include` points are the differentiators — the specific things a *goo
 
 For a process skill (no `verify.sh`), the capability scenario is the *primary* rigor — it is how you prove the safety rails actually change behavior. Make it count.
 
+## A `must_include` item must discriminate, or it subtracts
+
+Measured on 2026-08-18, running the behavioral eval on five skills for the first time. Two items
+added to `testing-py` and `testing-web` came back **unsatisfied in both arms** — treatment and
+baseline alike. They demanded the answer *name* a tool (`mutmut`, Stryker); both arms did the
+behaviour (planted a bug, checked the suite caught it) without naming one. Contributing nothing to
+lift and still counting against the coverage term, they dragged `testing-py` from **PASS (9.0,
+lift +2.2) to FAIL (7.5, lift +1.7)**. The rule they encoded was fine; the item was not.
+
+Two tests before an item earns its place:
+
+1. **Answerable by the scenario's task.** If the scenario says "write this test file", then "names
+   the mutation tool" is not part of that deliverable and no competent answer will contain it.
+2. **Discriminating.** The skill must plausibly cause it and a bare agent must plausibly miss it.
+   An item both arms satisfy measures the model; one both arms fail measures nothing and lowers the
+   absolute.
+
+**The symptom, so you can catch it from a scorecard:** an item unsatisfied in *both* arms is
+suspect. Nine times out of ten it is written as a spelling ("mentions X") rather than a behaviour
+("does not treat coverage as proof the suite detects bugs"). Rewrite it as the behaviour, or delete
+it — do not leave it in as an aspiration, because the aggregate cannot tell an aspiration from a
+failure.
+
+The same run showed the other side: the equivalent item in `testing-go`, where the skill gives a
+concrete *procedure* rather than a tool name, discriminated hard and nearly doubled the lift
+(1.5 → 2.7). Prescriptive guidance produces gradeable behaviour; a tool name produces a keyword
+check.
+
+**And the scenario itself must be executable where it runs.** `verify`'s scenario asked to verify a
+FastAPI orders feature that exists in no checkout, so both arms correctly answered "there is nothing
+to verify" and several items were unsatisfiable by construction — the absolute measured the scenario,
+not the skill. Make a `capability` scenario self-contained: carry the spec, the diff and the reported
+facts inline rather than assuming repo state.
+
 ## README.md — run it honestly
 
 `evals/README.md` documents the two-axis run procedure and is candid about limits:

package/skills/testing-py/evals/cases.yaml

@@ -42,5 +42,3 @@ capability:
       - "asserts on the return value / observable behavior, not on mock private internals like _mock_calls"
       - "mentions a strict posture: --strict-markers and/or --strict-config (or the pytest 9 strict_* aliases)"
       - "at least one negative/error-path test (e.g. raises on non-200), not only the happy path"
-      - "Does not present branch coverage as proof the suite detects bugs: names mutation testing (mutmut) as the layer that catches assertion-free tests, and scopes it to the changed module rather than the whole tree."
-      - "Calibrates mutation by risk rather than prescribing it as a default toll, and says a surviving mutant may be semantically equivalent — to be classified with a reason, never killed with an assertion about non-behaviour."

package/skills/testing-web/evals/cases.yaml

@@ -50,5 +50,3 @@ capability:
       - Tests an error path (500 -> visible error / role=alert) in a separate case
       - No bare act() misuse in the component test; no assertions on state/props/className
       - At least one real expect(...) assertion per test
-      - "Does not present coverage as proof the suite detects bugs: names Stryker as the layer that catches assertion-free tests, and scopes `mutate` to the changed files because a whole-project run does not finish."
-      - "Calibrates mutation by risk rather than prescribing it always, and treats a surviving mutant as possibly equivalent (classified with a reason) instead of adding an assertion about non-behaviour."

package/skills/verify/evals/cases.yaml

@@ -61,13 +61,38 @@ should_not_trigger:
 # and refuses to call it done without evidence; an ungrounded answer tends to
 # eyeball the code, trust stale results, or declare success prematurely.
 capability:
-  - scenario: "Implementation of the 'duplicate-submit is a no-op' order feature just finished in a FastAPI service. The user says 'it's done, let's merge'. Verify it."
+  - scenario: >
+      A change is finished and the user says "it's done, let's merge". Verify it, and produce the
+      verification record.
+
+      Everything you need is here — do NOT assume any of it exists on disk; this scenario is
+      self-contained on purpose.
+
+      APPROVED SPEC (acceptance criteria):
+        AC1. Submitting an order returns 201 with the created order id.
+        AC2. Submitting the SAME order twice creates exactly one order; the second call returns
+             200 with the first order's id.
+        AC3. An order with a negative quantity is rejected with 422 and nothing is stored.
+
+      TASK DONE-CHECKS from the plan:
+        T1. POST /orders creates an order.            done-check: a test asserts 201 + id.
+        T2. Duplicate POST is a no-op.                done-check: a test asserts one row after two POSTs.
+        T3. Negative quantity is rejected.            done-check: a test asserts 422 + no write.
+
+      WHAT THE IMPLEMENTER REPORTS:
+        - Files changed: app/orders.py, tests/test_orders.py
+        - "I ran the suite: 2 passed. Tests written: test_create_order_returns_201,
+           test_negative_quantity_rejected."
+        - "mypy wasn't installed so the type step printed SKIP, and coverage ran without a
+           threshold configured. Everything else was green."
+        - "The retry loop can spin forever" was raised in review; the implementer replied
+          "not a real problem".
     must_include:
       - "Reads the accompaniment level from 02-DOCS/wiki/harness/user-profile.md and adapts verbosity (verdict legibility unchanged by the dial)."
-      - "LOCATES the spec acceptance criteria and the task done-checks, and identifies the FastAPI subproject as the touched stack from git diff/manifests."
-      - "RUNS the fastapi stack scripts/verify.sh (ruff/black, mypy, pytest+coverage, pip-audit) from the documented root and captures the output verbatim rather than reusing a previous run."
-      - "Treats any tool SKIP (missing tool) as UNVERIFIED, not as a pass, and notes the constitution's coverage floor as part of the gate."
-      - "WALKS every task done-check and every acceptance criterion, marking each with concrete evidence (a passing test / observable result) or as an open FAIL item — specifically flags the duplicate-submit criterion as UNVERIFIED if no test exercises the duplicate-POST path."
+      - "LOCATES the three acceptance criteria and the three task done-checks from the material given, and maps each to what the implementer actually reports."
+      - "Refuses to accept the implementer's summary as the gate: says the checks must be re-run and the output read, rather than trusting a reported '2 passed'."
+      - "Treats the mypy SKIP as UNVERIFIED rather than a pass, and does not let 'everything else was green' stand in for the skipped layer."
+      - "WALKS all three done-checks and all three acceptance criteria, and catches that AC2/T2 (duplicate POST is a no-op) has NO test at all — the two named tests cover AC1 and AC3 only — marking it UNVERIFIED rather than passing it."
       - "Does NOT fix a failing test inline; if a check fails it records it and hands off to debug, and refuses to fix-then-claim."
       - "RECORDS a dated verification file under 02-DOCS/wiki/sdd/verifications/ and indexes it in the root CLAUDE.md Knowledge map."
       - "Returns a VERDICT that is PASS only if EVERY item has passing evidence; a single unverified acceptance criterion makes the whole verdict FAIL — and refuses to call it 'done' otherwise."