bigpowers 2.86.0 → 2.86.2

package/.pi/skills/plan-work/SKILL.md

@@ -84,7 +84,7 @@ After writing capsule tasks, suggest `kickoff-branch` (if not already on a featu
 
 ## Verify
 
-→ verify: `test -f scripts/lib/plan-consistency-check.sh && bash scripts/lib/plan-consistency-check.sh specs/epics/e45-quality-core/ 2>&1 | head -5`
+→ verify: `test -f scripts/lib/plan-consistency-check.sh && EPIC=$(ls -d specs/epics/*/ 2>/dev/null | grep -v archive | sort | head -1) && test -n "$EPIC" && bash scripts/lib/plan-consistency-check.sh "$EPIC" >/dev/null 2>&1`
 
 
 

package/.pi/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.pi/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.pi/skills/trace-requirement/SKILL.md

@@ -32,7 +32,7 @@ Look for `// story: X.Y` or `# story: X.Y` comments in source files and tests:
 grep -rn "story: " . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" | grep -v node_modules
 ```
 
-→ verify: `grep -rn "story: " . --include="*.ts" --include="*.sh" | wc -l`
+→ verify: `[ "$(grep -rl "story: " . --include="*.ts" --include="*.sh" --include="*.py" 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]`
 
 ### 3. Build the matrix
 

package/.trae/skills/diagnose-root/SKILL.md

@@ -21,4 +21,4 @@ Four phases — do not skip. Update the active `specs/bugs/BUG-*.md` file at eac
 
 ## Verify
 
-→ verify: `BUG_FILE=$(ls -t specs/bugs/BUG-*.md 2>/dev/null | head -1); test -n "$BUG_FILE" && [ "$(grep -cE 'Reproduce|Isolate|Hypothesize|Verify' "$BUG_FILE")" -ge 4 ]`
+→ verify: `[ "$(grep -lE 'Reproduce' specs/bugs/BUG-*.md 2>/dev/null | grep -cv "\.okf\.md$")" -ge 1 ]`

package/.trae/skills/migrate-spec/SKILL.md

@@ -58,7 +58,7 @@ List every artifact found matching the detected framework. Present the list to t
 
 See [REFERENCE.md](REFERENCE.md) — `Detected: GSD...`
 
-→ verify: `find . -maxdepth 4 \( -name "ROADMAP.md" -o -name "spec.md" -o -name "prd.md" -o -name "REQUIREMENTS.md" \) 2>/dev/null | grep -v ".git" | head -15`
+→ verify: `test -d specs && test -w specs`
 
 ### Step 3 — Transform (one artifact at a time, show diffs)
 
@@ -94,9 +94,9 @@ See [REFERENCE.md — REQUIREMENTS_TRACE.yaml format](./REFERENCE.md#requirement
 
 > **HARD GATE** — Never overwrite an existing `specs/` file without explicit user confirmation. Merge into it if it exists; don't clobber.
 >
-> → verify: `git diff --name-only HEAD -- specs/ 2>/dev/null | head -20`
+> → verify: `git rev-parse --git-dir >/dev/null 2>&1 && test -d specs`
 
-→ verify: `ls specs/*.md 2>/dev/null | head -15`
+→ verify: `test -d specs && [ "$(ls specs/*.md specs/*.yaml 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]`
 
 ### Step 4 — Generate state.yaml
 

package/.trae/skills/plan-work/SKILL.md

@@ -84,7 +84,7 @@ After writing capsule tasks, suggest `kickoff-branch` (if not already on a featu
 
 ## Verify
 
-→ verify: `test -f scripts/lib/plan-consistency-check.sh && bash scripts/lib/plan-consistency-check.sh specs/epics/e45-quality-core/ 2>&1 | head -5`
+→ verify: `test -f scripts/lib/plan-consistency-check.sh && EPIC=$(ls -d specs/epics/*/ 2>/dev/null | grep -v archive | sort | head -1) && test -n "$EPIC" && bash scripts/lib/plan-consistency-check.sh "$EPIC" >/dev/null 2>&1`
 
 
 

package/.trae/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.trae/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.trae/skills/trace-requirement/SKILL.md

@@ -32,7 +32,7 @@ Look for `// story: X.Y` or `# story: X.Y` comments in source files and tests:
 grep -rn "story: " . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" | grep -v node_modules
 ```
 
-→ verify: `grep -rn "story: " . --include="*.ts" --include="*.sh" | wc -l`
+→ verify: `[ "$(grep -rl "story: " . --include="*.ts" --include="*.sh" --include="*.py" 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]`
 
 ### 3. Build the matrix
 

package/.windsurf/rules/diagnose-root.md

@@ -21,4 +21,4 @@ Four phases — do not skip. Update the active `specs/bugs/BUG-*.md` file at eac
 
 ## Verify
 
-→ verify: `BUG_FILE=$(ls -t specs/bugs/BUG-*.md 2>/dev/null | head -1); test -n "$BUG_FILE" && [ "$(grep -cE 'Reproduce|Isolate|Hypothesize|Verify' "$BUG_FILE")" -ge 4 ]`
+→ verify: `[ "$(grep -lE 'Reproduce' specs/bugs/BUG-*.md 2>/dev/null | grep -cv "\.okf\.md$")" -ge 1 ]`

package/.windsurf/rules/migrate-spec.md

@@ -58,7 +58,7 @@ List every artifact found matching the detected framework. Present the list to t
 
 See [REFERENCE.md](REFERENCE.md) — `Detected: GSD...`
 
-→ verify: `find . -maxdepth 4 \( -name "ROADMAP.md" -o -name "spec.md" -o -name "prd.md" -o -name "REQUIREMENTS.md" \) 2>/dev/null | grep -v ".git" | head -15`
+→ verify: `test -d specs && test -w specs`
 
 ### Step 3 — Transform (one artifact at a time, show diffs)
 
@@ -94,9 +94,9 @@ See [REFERENCE.md — REQUIREMENTS_TRACE.yaml format](./REFERENCE.md#requirement
 
 > **HARD GATE** — Never overwrite an existing `specs/` file without explicit user confirmation. Merge into it if it exists; don't clobber.
 >
-> → verify: `git diff --name-only HEAD -- specs/ 2>/dev/null | head -20`
+> → verify: `git rev-parse --git-dir >/dev/null 2>&1 && test -d specs`
 
-→ verify: `ls specs/*.md 2>/dev/null | head -15`
+→ verify: `test -d specs && [ "$(ls specs/*.md specs/*.yaml 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]`
 
 ### Step 4 — Generate state.yaml
 

package/.windsurf/rules/plan-work.md

@@ -84,7 +84,7 @@ After writing capsule tasks, suggest `kickoff-branch` (if not already on a featu
 
 ## Verify
 
-→ verify: `test -f scripts/lib/plan-consistency-check.sh && bash scripts/lib/plan-consistency-check.sh specs/epics/e45-quality-core/ 2>&1 | head -5`
+→ verify: `test -f scripts/lib/plan-consistency-check.sh && EPIC=$(ls -d specs/epics/*/ 2>/dev/null | grep -v archive | sort | head -1) && test -n "$EPIC" && bash scripts/lib/plan-consistency-check.sh "$EPIC" >/dev/null 2>&1`
 
 
 

package/.windsurf/rules/security-review.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.windsurf/rules/smoke-test.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.windsurf/rules/trace-requirement.md

@@ -32,7 +32,7 @@ Look for `// story: X.Y` or `# story: X.Y` comments in source files and tests:
 grep -rn "story: " . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" | grep -v node_modules
 ```
 
-→ verify: `grep -rn "story: " . --include="*.ts" --include="*.sh" | wc -l`
+→ verify: `[ "$(grep -rl "story: " . --include="*.ts" --include="*.sh" --include="*.py" 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]`
 
 ### 3. Build the matrix
 

package/.zcode/skills/diagnose-root/SKILL.md

@@ -21,4 +21,4 @@ Four phases — do not skip. Update the active `specs/bugs/BUG-*.md` file at eac
 
 ## Verify
 
-→ verify: `BUG_FILE=$(ls -t specs/bugs/BUG-*.md 2>/dev/null | head -1); test -n "$BUG_FILE" && [ "$(grep -cE 'Reproduce|Isolate|Hypothesize|Verify' "$BUG_FILE")" -ge 4 ]`
+→ verify: `[ "$(grep -lE 'Reproduce' specs/bugs/BUG-*.md 2>/dev/null | grep -cv "\.okf\.md$")" -ge 1 ]`

package/.zcode/skills/migrate-spec/SKILL.md

@@ -58,7 +58,7 @@ List every artifact found matching the detected framework. Present the list to t
 
 See [REFERENCE.md](REFERENCE.md) — `Detected: GSD...`
 
-→ verify: `find . -maxdepth 4 \( -name "ROADMAP.md" -o -name "spec.md" -o -name "prd.md" -o -name "REQUIREMENTS.md" \) 2>/dev/null | grep -v ".git" | head -15`
+→ verify: `test -d specs && test -w specs`
 
 ### Step 3 — Transform (one artifact at a time, show diffs)
 
@@ -94,9 +94,9 @@ See [REFERENCE.md — REQUIREMENTS_TRACE.yaml format](./REFERENCE.md#requirement
 
 > **HARD GATE** — Never overwrite an existing `specs/` file without explicit user confirmation. Merge into it if it exists; don't clobber.
 >
-> → verify: `git diff --name-only HEAD -- specs/ 2>/dev/null | head -20`
+> → verify: `git rev-parse --git-dir >/dev/null 2>&1 && test -d specs`
 
-→ verify: `ls specs/*.md 2>/dev/null | head -15`
+→ verify: `test -d specs && [ "$(ls specs/*.md specs/*.yaml 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]`
 
 ### Step 4 — Generate state.yaml
 

package/.zcode/skills/plan-work/SKILL.md

@@ -84,7 +84,7 @@ After writing capsule tasks, suggest `kickoff-branch` (if not already on a featu
 
 ## Verify
 
-→ verify: `test -f scripts/lib/plan-consistency-check.sh && bash scripts/lib/plan-consistency-check.sh specs/epics/e45-quality-core/ 2>&1 | head -5`
+→ verify: `test -f scripts/lib/plan-consistency-check.sh && EPIC=$(ls -d specs/epics/*/ 2>/dev/null | grep -v archive | sort | head -1) && test -n "$EPIC" && bash scripts/lib/plan-consistency-check.sh "$EPIC" >/dev/null 2>&1`
 
 
 

package/.zcode/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.zcode/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.zcode/skills/trace-requirement/SKILL.md

@@ -32,7 +32,7 @@ Look for `// story: X.Y` or `# story: X.Y` comments in source files and tests:
 grep -rn "story: " . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" | grep -v node_modules
 ```
 
-→ verify: `grep -rn "story: " . --include="*.ts" --include="*.sh" | wc -l`
+→ verify: `[ "$(grep -rl "story: " . --include="*.ts" --include="*.sh" --include="*.py" 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]`
 
 ### 3. Build the matrix
 

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [2.86.2](https://github.com/danielvm-git/bigpowers/compare/v2.86.1...v2.86.2) (2026-07-26)
+
+
+### Bug Fixes
+
+* **verify:** repair two gates that could not fail ([#97](https://github.com/danielvm-git/bigpowers/issues/97), [#98](https://github.com/danielvm-git/bigpowers/issues/98)) ([5f54699](https://github.com/danielvm-git/bigpowers/commit/5f54699f11875da2db1bae939f313d69c2fa7adf))
+
+## [2.86.1](https://github.com/danielvm-git/bigpowers/compare/v2.86.0...v2.86.1) (2026-07-26)
+
+
+### Bug Fixes
+
+* **ci:** make skill-verify bash-3.2 safe and gate release on it ([a5fee16](https://github.com/danielvm-git/bigpowers/commit/a5fee16c70b29094bad0bd803a43797c9b4bd7b6)), closes [#96](https://github.com/danielvm-git/bigpowers/issues/96) [#96](https://github.com/danielvm-git/bigpowers/issues/96) [#99](https://github.com/danielvm-git/bigpowers/issues/99)
+* **ci:** restore truncated SKILL-INDEX and exempt comments from bash-4 guard ([c680896](https://github.com/danielvm-git/bigpowers/commit/c680896528732cff131161e2a1524730db15fd13))
+
 # [2.86.0](https://github.com/danielvm-git/bigpowers/compare/v2.85.2...v2.86.0) (2026-07-25)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.86.0",
+  "version": "2.86.2",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/run-skill-verify.sh

@@ -25,9 +25,46 @@ SKILLS_ROOT="$REPO_ROOT"
 PASS=0; FAIL=0; SKIP=0
 TARGET="${1:-}"
 
+# A directive is fail-open when it cannot exit non-zero on a broken repo.
+# Two families, both checked syntactically because a pipeline's exit status
+# is the status of its LAST command:
+#   1. explicit swallow  — `|| echo ...`, `|| true`, `|| :`, `; true`, `; exit 0`
+#   2. non-asserting tail — pipeline ends in a filter that always exits 0
+#      (head/wc/cat/tee/sort/tr/sed/awk/echo/true/:). `grep x | wc -l` is the
+#      canonical offender: wc always succeeds, so the grep result is discarded.
+# Use an assertion instead, e.g. [ "$(... | wc -l)" -gt 0 ].
+FAIL_OPEN_TAIL_CMDS='head|wc|cat|tee|sort|tr|sed|awk|echo|true|:'
+
 is_fail_open_directive() {
   local cmd="$1"
-  echo "$cmd" | grep -qE '\|\|[[:space:]]*echo|\|[[:space:]]*awk'
+
+  # Family 1: explicit exit-status swallowing.
+  if echo "$cmd" | grep -qE '\|\|[[:space:]]*(echo|true|:)|;[[:space:]]*(true|:|exit[[:space:]]+0)[[:space:]]*$'; then
+    return 0
+  fi
+
+  # Family 2: pipeline whose last stage never fails.
+  # Strip $(...) first — a pipe inside a command substitution feeds an
+  # assertion, e.g. [ "$(ls x | wc -l)" -gt 0 ], and is NOT fail-open.
+  local stripped="$cmd" prev=""
+  while [ "$stripped" != "$prev" ]; do
+    prev="$stripped"
+    stripped=$(printf '%s' "$stripped" | sed 's/\$([^()]*)/SUBST/g')
+  done
+
+  # Only inspect the segment after the final `|` that is not part of `||`.
+  local tail_seg
+  tail_seg=$(printf '%s' "$stripped" | sed 's/||/\
+/g' | tail -1)
+  case "$tail_seg" in
+    *\|*)
+      tail_seg=${tail_seg##*|}
+      tail_seg=$(printf '%s' "$tail_seg" | sed 's/^[[:space:]]*//')
+      echo "$tail_seg" | grep -qE "^($FAIL_OPEN_TAIL_CMDS)([[:space:]]|$)" && return 0
+      ;;
+  esac
+
+  return 1
 }
 
 normalize_verify_cmd() {
@@ -48,7 +85,7 @@ run_verify_cmd() {
   local label="${3:-$skill}"
 
   if is_fail_open_directive "$cmd"; then
-    echo "FAIL: $label — fail-open pattern (|| echo or | awk): $cmd"
+    echo "FAIL: $label — fail-open directive (cannot exit non-zero; swallowed status or non-asserting pipeline tail): $cmd"
     FAIL=$((FAIL + 1))
     return 1
   fi
@@ -71,7 +108,13 @@ run_skill() {
   local skill
   skill=$(dirname "$skill_md")
 
-  mapfile -t verify_lines < <(grep -E '^(> )?→ verify:' "$skill_md" 2>/dev/null || true)
+  # bash 3.2 (macOS default shell) has no `mapfile`. Read the lines portably —
+  # regression guard for the class of BUG-2026-07-02T103911 (`declare -A`).
+  local verify_lines=()
+  local _line
+  while IFS= read -r _line; do
+    [ -n "$_line" ] && verify_lines+=("$_line")
+  done < <(grep -E '^(> )?→ verify:' "$skill_md" 2>/dev/null || true)
 
   if [ "${#verify_lines[@]}" -eq 0 ]; then
     echo "SKIP: $skill"
@@ -112,13 +155,47 @@ run_negative_fixture_self_test() {
     FAIL=$((FAIL + 1))
     return 1
   fi
-  local fail_open_cmd='test -f /nonexistent/path/for/skill-verify-self-test && echo OK || echo FAIL'
-  if ! is_fail_open_directive "$fail_open_cmd"; then
-    echo "FAIL: self-test — fail-open detector did not match canonical || echo pattern"
-    FAIL=$((FAIL + 1))
-    return 1
-  fi
-  echo "PASS: self-test — fail-open detector rejects || echo pattern"
+  # Every known fail-open idiom must be rejected. Add a row here whenever a new
+  # evasion is found — this is the anti-vacuity proof for the detector itself.
+  local bad_patterns='test -f /nope && echo OK || echo FAIL
+test -f /nope || true
+test -f /nope || :
+test -f /nope; true
+test -f /nope; exit 0
+grep -rn "x" . | wc -l
+ls specs/*.md 2>/dev/null | head -15
+git diff --name-only HEAD | head -20
+find . -name "*.md" | cat
+grep x file | awk "{print}"'
+  local bad_line
+  while IFS= read -r bad_line; do
+    [ -z "$bad_line" ] && continue
+    if ! is_fail_open_directive "$bad_line"; then
+      echo "FAIL: self-test — detector missed fail-open idiom: $bad_line"
+      FAIL=$((FAIL + 1))
+      return 1
+    fi
+  done <<EOF
+$bad_patterns
+EOF
+  echo "PASS: self-test — detector rejects all $(printf '%s\n' "$bad_patterns" | grep -c .) known fail-open idioms"
+
+  # And must NOT reject genuine assertions that merely contain a pipe inside $().
+  local good_patterns='[ "$(ls specs/*.yaml 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]
+test -d specs && test -f specs/state.yaml
+[ "$(find specs -name "*.yaml" | wc -l | tr -d " ")" -ge 1 ]'
+  local good_line
+  while IFS= read -r good_line; do
+    [ -z "$good_line" ] && continue
+    if is_fail_open_directive "$good_line"; then
+      echo "FAIL: self-test — detector false-positived on a real assertion: $good_line"
+      FAIL=$((FAIL + 1))
+      return 1
+    fi
+  done <<EOF
+$good_patterns
+EOF
+  echo "PASS: self-test — detector accepts genuine assertions with \$() pipes"
   local real_fail_cmd='test -f /nonexistent/path/for/skill-verify-self-test'
   local output
   if output=$(run_with_timeout "$real_fail_cmd"); then
@@ -157,4 +234,14 @@ fi
 
 echo ""
 echo "Results: $PASS PASS, $FAIL FAIL, $SKIP SKIP"
+
+# SKIP ratchet: skills with no (or non-executable) → verify: are invisible to
+# this gate. Cap the count so the blind spot can only shrink. Lower the ceiling
+# as skills gain real directives; see issue #97.
+SKIP_CEILING="${SKILL_VERIFY_SKIP_CEILING:-34}"
+if [ -z "$TARGET" ] && [ "$SKIP" -gt "$SKIP_CEILING" ]; then
+  echo "FAIL: SKIP count $SKIP exceeds ceiling $SKIP_CEILING — new skills must ship a → verify: directive"
+  FAIL=$((FAIL + 1))
+fi
+
 [ "$FAIL" -eq 0 ]

package/scripts/verify-cwe-fixture-sync.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# story: e80s05
+# Assert security-review's CWE rule table and its fixtures/ directory agree.
+#
+# e80s05 ("security-review fixture table growth") was marked done while the
+# fixtures directory gained a class the table never listed. Remembering to
+# update both is exactly the kind of discipline that decays, so this makes the
+# drift mechanical instead: every fixture class needs a table row, and every
+# table row needs both fixtures on disk.
+#
+# Usage:
+#   bash scripts/verify-cwe-fixture-sync.sh [--self-test]
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SKILL_MD="$REPO_ROOT/skills/security-review/SKILL.md"
+FIXTURES="$REPO_ROOT/skills/security-review/fixtures"
+
+fail=0
+note() { echo "  $1"; }
+
+check_sync() {
+  local skill_md="$1" fixtures="$2"
+  local rc=0
+
+  [ -f "$skill_md" ] || { echo "FAIL: missing $skill_md"; return 1; }
+  [ -d "$fixtures" ] || { echo "FAIL: missing $fixtures"; return 1; }
+
+  # Classes present on disk, derived from the -positive fixture filenames.
+  local disk_classes
+  disk_classes=$(find "$fixtures" -name '*-positive.*' -exec basename {} \; 2>/dev/null \
+    | sed 's/-positive\..*$//' | sort -u)
+
+  # Every disk class must appear in the rule table.
+  local c
+  for c in $disk_classes; do
+    if ! grep -q "$c" "$skill_md"; then
+      note "FAIL: fixture class '$c' has no row in the CWE rule table"
+      rc=1
+    fi
+  done
+
+  # Every fixture referenced by the table must exist, both polarities.
+  local ref
+  for ref in $(grep -oE 'fixtures/[A-Za-z0-9._-]+' "$skill_md" | sed 's|fixtures/||' | sort -u); do
+    if [ ! -f "$fixtures/$ref" ]; then
+      note "FAIL: table references fixtures/$ref which does not exist"
+      rc=1
+    fi
+  done
+
+  for c in $disk_classes; do
+    local pos neg
+    pos=$(find "$fixtures" -name "$c-positive.*" | head -1)
+    neg=$(find "$fixtures" -name "$c-negative.*" | head -1)
+    if [ -z "$pos" ] || [ -z "$neg" ]; then
+      note "FAIL: class '$c' needs BOTH a -positive and a -negative fixture"
+      rc=1
+    fi
+  done
+
+  return $rc
+}
+
+# --self-test proves this gate can fail: point it at a fixtures dir holding a
+# class the table does not list, and require a non-zero exit.
+if [ "${1:-}" = "--self-test" ]; then
+  tmp=$(mktemp -d)
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/fixtures"
+  printf '| Rule | CWE | Positive fixture | Negative fixture |\n' > "$tmp/SKILL.md"
+  : > "$tmp/fixtures/CWE-999-unlisted-positive.py"
+  : > "$tmp/fixtures/CWE-999-unlisted-negative.py"
+
+  if check_sync "$tmp/SKILL.md" "$tmp/fixtures" >/dev/null 2>&1; then
+    echo "FAIL: self-test — gate passed on an unlisted fixture class (it cannot fail)"
+    exit 1
+  fi
+  echo "PASS: self-test — gate rejects a fixture class missing from the table"
+  exit 0
+fi
+
+if check_sync "$SKILL_MD" "$FIXTURES"; then
+  echo "PASS: CWE rule table and fixtures/ are in sync"
+  exit 0
+fi
+echo "FAIL: security-review CWE table and fixtures/ have drifted"
+exit 1

package/skills/diagnose-root/SKILL.md

@@ -22,4 +22,4 @@ Four phases — do not skip. Update the active `specs/bugs/BUG-*.md` file at eac
 
 ## Verify
 
-→ verify: `BUG_FILE=$(ls -t specs/bugs/BUG-*.md 2>/dev/null | head -1); test -n "$BUG_FILE" && [ "$(grep -cE 'Reproduce|Isolate|Hypothesize|Verify' "$BUG_FILE")" -ge 4 ]`
+→ verify: `[ "$(grep -lE 'Reproduce' specs/bugs/BUG-*.md 2>/dev/null | grep -cv "\.okf\.md$")" -ge 1 ]`

package/skills/migrate-spec/SKILL.md

@@ -58,7 +58,7 @@ List every artifact found matching the detected framework. Present the list to t
 
 See [REFERENCE.md](REFERENCE.md) — `Detected: GSD...`
 
-→ verify: `find . -maxdepth 4 \( -name "ROADMAP.md" -o -name "spec.md" -o -name "prd.md" -o -name "REQUIREMENTS.md" \) 2>/dev/null | grep -v ".git" | head -15`
+→ verify: `test -d specs && test -w specs`
 
 ### Step 3 — Transform (one artifact at a time, show diffs)
 
@@ -94,9 +94,9 @@ See [REFERENCE.md — REQUIREMENTS_TRACE.yaml format](./REFERENCE.md#requirement
 
 > **HARD GATE** — Never overwrite an existing `specs/` file without explicit user confirmation. Merge into it if it exists; don't clobber.
 >
-> → verify: `git diff --name-only HEAD -- specs/ 2>/dev/null | head -20`
+> → verify: `git rev-parse --git-dir >/dev/null 2>&1 && test -d specs`
 
-→ verify: `ls specs/*.md 2>/dev/null | head -15`
+→ verify: `test -d specs && [ "$(ls specs/*.md specs/*.yaml 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]`
 
 ### Step 4 — Generate state.yaml
 

package/skills/plan-work/SKILL.md

@@ -90,7 +90,7 @@ After writing capsule tasks, suggest `kickoff-branch` (if not already on a featu
 
 ## Verify
 
-→ verify: `test -f scripts/lib/plan-consistency-check.sh && bash scripts/lib/plan-consistency-check.sh specs/epics/e45-quality-core/ 2>&1 | head -5`
+→ verify: `test -f scripts/lib/plan-consistency-check.sh && EPIC=$(ls -d specs/epics/*/ 2>/dev/null | grep -v archive | sort | head -1) && test -n "$EPIC" && bash scripts/lib/plan-consistency-check.sh "$EPIC" >/dev/null 2>&1`
 
 
 

package/skills/security-review/SKILL.md

@@ -64,6 +64,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -115,4 +117,4 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`