bigpowers 2.86.1 → 2.86.3

package/.zcode/skills/wire-ci/SKILL.md

@@ -1,104 +1,112 @@
 ---
 name: wire-ci
 model: sonnet
-description: "CI pipeline setup with pre-built templates and local validation. Generates GitHub Actions workflows, validates YAML syntax and permissions, supports dry-run via act/gh. The CI equivalent of wire-observability."
+description: "CI pipeline setup with bundled, forge-neutral templates and local validation. Detects the forge from the git remote, generates workflows for supported forges, and skips honestly for the rest. The CI equivalent of wire-observability."
 ---
 
 # Wire CI
 
-> **HARD GATE** — Do not ship a project without CI. Run this skill before first merge to main or when adding CI to an existing project.
+> **HARD GATE (supported forges only)** — Do not ship a project without CI. Run this skill before first merge to main.
+>
+> On a forge bigpowers ships no templates for, this skill **is not a gate**: it reports the forge, explains what it cannot do, and exits 3. A gate that cannot run must not claim it did. See § Unsupported forges.
 >
 > **HARD GATE** — CI that is untestable locally will break every cycle. Always run `--validate` after generating workflows and `--dry-run` before pushing.
 
-Generate, validate, and test CI workflows. Detects your project type, copies org templates from `danielvm-git/.github/workflow-templates/`, and provides local verification to catch auth, permissions, and syntax issues before they reach CI.
+Generate, validate, and test CI workflows. Detects the forge and project type, copies a **bundled** template, and verifies locally before anything reaches CI.
 
-## What this sets up
+## Forge resolution
 
-1. **Test Build Release workflow** — `.github/workflows/test-build-release.yml` with lint → test → build → release (single pipeline, `needs:` chain)
-2. **Deploy workflow** — `.github/workflows/deploy.yml` triggered via `workflow_run` (BigBase/Pages stacks only; CLI/library repos omit this)
-3. **`--validate` mode** — checks YAML syntax, workflow permissions, required secrets, and common pitfalls
-4. **`--dry-run` mode** — runs workflows locally via `act` or `gh workflow run` to prove correctness before push
-5. **Failure pattern documentation** — common CI failure categories and their fixes
+`scripts/lib/detect-forge.sh` resolves the forge, first match wins: `BIGPOWERS_FORGE` env var → `forge:` in `specs/forge.yaml` → the `origin` remote URL → `unknown`.
 
-## Process
+```bash
+bash scripts/wire-ci.sh --detect     # report forge + stack, write nothing
+bash scripts/wire-ci.sh --plan       # show the template that would be used
+bash scripts/wire-ci.sh --apply      # write the workflow
+```
 
-### 1. Detect project type
+GitHub ships templates (`.github/workflows/`). GitLab, Bitbucket, Codeberg, and Gitea are detected but **unsupported** — `--apply` writes nothing and exits 3.
 
-Read the project root for manifest files to determine which template pair to copy:
+## Template source — configurable, bundled by default
 
-| Manifest | Type | Template pair (from `.github` repo) |
-|----------|------|-------------------------------------|
-| `Cargo.toml` | Rust | `test-build-release-monorepo.yml` + `deploy-monorepo.yml` (or monorepo subset) |
-| `package.json` | Node | `test-build-release-node.yml` + `deploy-node.yml` |
-| `setup.py` / `pyproject.toml` | Python | `test-build-release-python.yml` + `deploy-python.yml` |
-| `go.mod` | Go | `test-build-release-go.yml` + `deploy-go.yml` |
-| Static site (no server) | Static | `test-build-release-static.yml` + `deploy-static.yml` |
-| `Package.swift` | Swift | `test-build-release-swift.yml` only (no deploy yet) |
-| Multiple detected | Polyglot | `test-build-release-monorepo.yml` + `deploy-monorepo.yml` |
+Templates live in `docs/templates/ci/<forge>/` **inside the bigpowers package**, so there is no network dependency on any third party's repository. Override with `BIGPOWERS_CI_TEMPLATES=/path/to/your/templates`, laid out as `<root>/<forge>/test-build-release-<stack>.yml`.
 
-**CLI/library repos** (no hosted target): copy only `test-build-release-<stack>.yml` → `test-build-release.yml`. The `release` job is terminal; skip `deploy.yml`. See `docs/how-to/migrate-ci-cd/migration-plan.md` § CLI and library repos.
+## What this sets up
 
-If no manifest is found, prompt the user to specify the type or pass `--type <rust|node|python|go|static|swift>`.
+1. **Test Build Release workflow** — lint → test → build → release in one `needs:` chain
+2. **`--validate` mode** — YAML syntax, workflow permissions, required secrets, common pitfalls
+3. **`--dry-run` mode** — runs workflows locally via `act` before push
+4. **Failure pattern documentation** — see the table below
 
-### 2. Copy test-build-release template
+Deploy workflows are **not** bundled: they are platform-specific. See [REFERENCE.md](REFERENCE.md) for a worked example.
 
-Copy the matching template from `~/Developer/.github/workflow-templates/` to `.github/workflows/test-build-release.yml`. **Do not rename the workflow `name:` field** — deploy listens for `"Test Build Release"`.
+## Process
+
+### 1. Detect forge and stack
+
+```bash
+bash scripts/wire-ci.sh --detect
+```
 
-Edit placeholders: `APP_TYPE`, `SITE_URL`, language versions.
+Stack detection reads the project root:
 
-See [REFERENCE.md](REFERENCE.md) for stack-specific job shapes.
+| Manifest | Stack | Bundled template |
+|----------|-------|------------------|
+| `Cargo.toml` | Rust | `test-build-release-rust.yml` |
+| `package.json` | Node | `test-build-release-node.yml` |
+| `pyproject.toml` / `setup.py` | Python | `test-build-release-python.yml` |
+| `go.mod` | Go | `test-build-release-go.yml` |
 
-### 3. Copy deploy template (hosted stacks only)
+No recognized manifest → exit 3 with the list of manifests it looked for. Do not guess.
 
-If the project deploys to BigBase or GitHub Pages:
+### 2. Apply the template
 
 ```bash
-cp ~/Developer/.github/workflow-templates/deploy-${STACK}.yml .github/workflows/deploy.yml
+bash scripts/wire-ci.sh --apply
 ```
 
-Configure `BIGBASE_SITE_ID`, `BIGBASE_DEPLOY_TOKEN`, and matching `SITE_URL`. Deploy runs via `workflow_run` after TBR succeeds on `main` with `cancel-in-progress: false`.
+**Do not rename the workflow `name:` field** — deploy listens for `"Test Build Release"`.
 
-Skip this step for CLI/library repos.
+Edit placeholders after copying: language versions, `APP_TYPE`, `SITE_URL`.
 
-### 4. Validate workflows (`--validate`)
+### 3. Unsupported forges
 
-Run `wire-ci --validate` to check all generated workflow files:
+`--apply` writes nothing and exits 3. Your options, in the order the runner prints them:
 
-See [REFERENCE.md](REFERENCE.md)
+- point `BIGPOWERS_CI_TEMPLATES` at templates for your forge
+- pin `forge: github` in `specs/forge.yaml` if the remote is misdetected
+- write the CI config by hand
 
-**Exit codes:**
-- `0` — all checks pass (no errors)
-- `1` — YAML syntax errors found
-- `2` — validation warnings only (missing permissions, secrets, etc.)
+Contributing a `docs/templates/ci/gitlab/` set and adding `gitlab` to `FORGE_SUPPORTED_LIST` is the natural next slice — per-forge command mapping (`gh pr checks` → `glab ci status`) is not implemented yet.
 
-### 5. Dry-run workflows (`--dry-run`)
+### 4. Validate workflows (`--validate`)
 
-Attempt to run the generated workflows locally to catch errors before push:
+See [REFERENCE.md](REFERENCE.md). Exit codes: `0` clean, `1` YAML syntax errors, `2` warnings only.
+
+### 5. Dry-run workflows (`--dry-run`)
 
-See [REFERENCE.md](REFERENCE.md)
+See [REFERENCE.md](REFERENCE.md).
 
 > **act** runs workflows in a local Docker environment — the most accurate pre-push validation.
-> **gh workflow run** sends the workflow to GitHub but doesn't execute locally — useful for checking YAML parsing but not for testing the actual steps.
+> **gh workflow run** sends the workflow to GitHub but does not execute locally.
 
 ### 6. Document common CI failure patterns
 
-Add the following to the project's documentation or CLAUDE.md after setup:
-
 | Failure | Cause | Fix |
 |---------|-------|-----|
-| `npm publish` fails | `NPM_TOKEN` not set as repo secret | Add `NPM_TOKEN` to GitHub repo secrets |
-| `semantic-release` fails on push | Missing `permissions: contents: write` | Add `permissions: contents: write` to release job |
-| `cargo publish` auth fail | `CARGO_REGISTRY_TOKEN` not set | Add token to `~/.cargo/config.toml` or env |
-| `go vet` fails | Go version mismatch | Match `go.mod` `go` directive with setup-go version |
-| `cargo clippy` errors | New lints in Rust nightly | `cargo clippy --fix` or allow specific lints |
-| `act` not found | Docker not running or act not installed | `brew install act` / `docker ps` to verify Docker |
-| Hardcoded Node version stale | `.nvmrc` exists but workflow uses hardcoded version | Use `node-version-file: .nvmrc` instead |
-| Deploy never runs | TBR workflow renamed | Keep `name: Test Build Release` in test-build-release.yml |
-| Release rebuilds binary | Artifact not downloaded | `release` job must `download-artifact` from `build` |
+| `npm publish` fails | `NPM_TOKEN` not set as repo secret | Add `NPM_TOKEN` to repo secrets |
+| `semantic-release` fails on push | Missing `permissions: contents: write` | Add it to the release job |
+| `cargo publish` auth fail | `CARGO_REGISTRY_TOKEN` not set | Add token to env or `~/.cargo/config.toml` |
+| `go vet` fails | Go version mismatch | Use `go-version-file: go.mod` |
+| `cargo clippy` errors | New nightly lints | Pin the toolchain; `cargo clippy --fix` |
+| `act` not found | Docker not running or act missing | `brew install act`; `docker ps` |
+| Hardcoded Node version stale | `.nvmrc` exists but workflow hardcodes | Use `node-version-file: .nvmrc` |
+| Deploy never runs | TBR workflow renamed | Keep `name: Test Build Release` |
+| Release rebuilds binary | Artifact not downloaded | `release` must `download-artifact` from `build` |
 
 ## Verify
 
-→ verify: `test -f skills/wire-ci/REFERENCE.md && test -f .github/workflows/sync-skills.yml`
+→ verify: `bash scripts/wire-ci.sh --self-test`
+→ verify: `test -f docs/templates/ci/github/test-build-release-node.yml && test -f scripts/lib/detect-forge.sh`
 → verify: `grep -q wire-ci SKILL-INDEX.md`
 
 ---
@@ -121,19 +129,26 @@ Add the following to the project's documentation or CLAUDE.md after setup:
 ### Create CI for a Go project (TBR + optional deploy)
 
 ```bash
-# Copy org templates
-cp ~/Developer/.github/workflow-templates/test-build-release-go.yml .github/workflows/test-build-release.yml
-cp ~/Developer/.github/workflow-templates/deploy-go.yml .github/workflows/deploy.yml
+# Resolve forge + stack, then apply the bundled template
+bash scripts/wire-ci.sh --detect
+bash scripts/wire-ci.sh --apply
 
 wire-ci --validate
 wire-ci --dry-run
 ```
 
+To use your own org templates instead of the bundled ones:
+
+```bash
+BIGPOWERS_CI_TEMPLATES=/path/to/your/templates bash scripts/wire-ci.sh --apply
+```
+
 ### Create CI for a CLI tool (TBR only, no deploy)
 
 ```bash
-cp ~/Developer/.github/workflow-templates/test-build-release-go.yml .github/workflows/test-build-release.yml
+bash scripts/wire-ci.sh --apply
 # Edit release job to download build artifact — see big-release dogfood
+# CLI/library repos: delete deploy.yml; the release job is terminal.
 
 wire-ci --validate
 ```
@@ -277,6 +292,10 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ github.event.workflow_run.id }}
           path: deploy-meta
+      # BigBase-specific composite action, not a bigpowers default: this deploy
+      # example targets the author's own hosting stack. Replace it with your
+      # platform's deploy step (or drop the deploy job entirely for CLI and
+      # library repos). bigpowers itself ships no deploy templates. (GH #104)
       - uses: danielvm-git/.github/actions/bigbase-deploy@9c56ac10c629f3baa110ddb19136579e3c90d690  # v1
         with:
           site_id: ${{ secrets.BIGBASE_SITE_ID }}

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+## [2.86.3](https://github.com/danielvm-git/bigpowers/compare/v2.86.2...v2.86.3) (2026-07-26)
+
+
+### Bug Fixes
+
+* **adapters:** make copy-mode context wiring idempotent ([2154e5f](https://github.com/danielvm-git/bigpowers/commit/2154e5f55140c8cb8f9c0ea22a7ea7bacf55f99e)), closes [#106](https://github.com/danielvm-git/bigpowers/issues/106)
+* **specs:** give e60s01 a runnable verify ([585f0aa](https://github.com/danielvm-git/bigpowers/commit/585f0aa78ecc25dba5c13fccd1090c1b626900af)), closes [#106](https://github.com/danielvm-git/bigpowers/issues/106)
+* **sync:** restore .pi and .gemini artifacts dropped by a concurrent sync ([b901340](https://github.com/danielvm-git/bigpowers/commit/b901340d08cbd74e34853beb8e9aad6fbec66698))
+* **test:** scope agy gemini-path assertion to install_agy body ([1ac37f0](https://github.com/danielvm-git/bigpowers/commit/1ac37f0c0673e031996b7d9dde8ba0304d2a6ca1)), closes [#106](https://github.com/danielvm-git/bigpowers/issues/106)
+* **test:** stop ta_cleanup EXIT trap forcing exit 1 ([cd409ef](https://github.com/danielvm-git/bigpowers/commit/cd409efcf2d8d92f8796114f50871cd55538067d)), closes [#106](https://github.com/danielvm-git/bigpowers/issues/106)
+* **verify:** execute story-level verify: commands ([#106](https://github.com/danielvm-git/bigpowers/issues/106)) ([9b3f82a](https://github.com/danielvm-git/bigpowers/commit/9b3f82a18c18014a70380e1062de81c268639ef9)), closes [#96](https://github.com/danielvm-git/bigpowers/issues/96)
+* **verify:** story-level verify and CI template fix ([#104](https://github.com/danielvm-git/bigpowers/issues/104), [#106](https://github.com/danielvm-git/bigpowers/issues/106)) ([049c7c9](https://github.com/danielvm-git/bigpowers/commit/049c7c9529fa0584b6823033e68e2fb7281ff750))
+* **wire-ci:** un-hardcode template source, skip unsupported forges ([#104](https://github.com/danielvm-git/bigpowers/issues/104)) ([31a6fac](https://github.com/danielvm-git/bigpowers/commit/31a6fac06f823b55a00b38637d06f01b555b25c8))
+
+## [2.86.2](https://github.com/danielvm-git/bigpowers/compare/v2.86.1...v2.86.2) (2026-07-26)
+
+
+### Bug Fixes
+
+* **verify:** repair two gates that could not fail ([#97](https://github.com/danielvm-git/bigpowers/issues/97), [#98](https://github.com/danielvm-git/bigpowers/issues/98)) ([5f54699](https://github.com/danielvm-git/bigpowers/commit/5f54699f11875da2db1bae939f313d69c2fa7adf))
+
 ## [2.86.1](https://github.com/danielvm-git/bigpowers/compare/v2.86.0...v2.86.1) (2026-07-26)
 
 

package/SKILL-INDEX.md

@@ -65,7 +65,7 @@
 | 37 | Build | `quick-fix` | "Streamlined fast-path for trivial data-only fixes — no TDD, no branching cere | ✅ Active |
 | 38 | Build | `setup-environment` | Pre-install dependencies and configure tools before development work begins. Use | ✅ Active |
 | 39 | Build | `spike-prototype` | Throw-away prototype for unknown problem spaces. Output is learning notes in spe | ✅ Active |
-| 40 | Build | `wire-ci` | "CI pipeline setup with pre-built templates and local validation. Generates GitH | ✅ Active |
+| 40 | Build | `wire-ci` | "CI pipeline setup with bundled, forge-neutral templates and local validation. D | ✅ Active |
 | 41 | Build | `wire-observability` | Add structured JSON logging, observability commands, and idempotent setup script | ✅ Active |
 | 42 | Verify | `audit-code` | Self-review checklist for the coding agent to run before dispatching a reviewer. | ✅ Active |
 | 43 | Verify | `context7-mcp` | Fetch current library docs via Context7 MCP instead of training data. Use when u | ✅ Active |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.86.1",
+  "version": "2.86.3",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/lib/context-wire.sh

@@ -54,6 +54,15 @@ wire_context_mode() {
     symlink|copy)
       [[ -n "$file" ]] || { echo "context-wire: file required for mode=$mode" >&2; return 1; }
       if [[ "$mode" == "copy" ]]; then
+        [[ -f "$src" ]] || { echo "context-wire: source missing: $src" >&2; return 1; }
+        # Already wired — nothing to do. kilocode and windsurf declare
+        # `mode: copy, file: AGENTS.md` in targets.yaml, and the source is also
+        # AGENTS.md, so a bare `cp` fails with "are identical" and made
+        # wire_context non-idempotent. wire_symlink_or_copy already guards this;
+        # the copy branch did not. (#106)
+        if [[ -f "$file" ]] && cmp -s "$src" "$file" 2>/dev/null; then
+          return 0
+        fi
         cp "$src" "$file"
       else
         wire_symlink_or_copy "$src" "$file"

package/scripts/lib/detect-forge.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# story: GH-104-forge-neutrality
+# detect-forge.sh — resolve which git forge a project uses.
+#
+# bigpowers ships to solo devs generally, but its CI advice assumed GitHub
+# everywhere (GH #104). This is the seam: skills ask which forge is in play and
+# what it supports, instead of hardcoding `gh` and `.github/workflows/`.
+#
+# Resolution order (first match wins):
+#   1. BIGPOWERS_FORGE environment variable  — explicit override
+#   2. forge: key in specs/forge.yaml        — per-project setting
+#   3. the `origin` remote URL               — inferred
+#   4. "unknown"                             — no remote, or an unrecognized host
+#
+# Source this file, then call detect_forge / forge_is_supported / forge_ci_path.
+
+if [[ -n "${DETECT_FORGE_LOADED:-}" ]]; then return 0; fi
+DETECT_FORGE_LOADED=1
+
+FORGE_UNKNOWN="unknown"
+
+# Forges whose CI templates bigpowers actually ships. Anything else must be
+# reported honestly and skipped — never silently handed GitHub Actions config.
+FORGE_SUPPORTED_LIST="github"
+
+_forge_from_remote_url() {
+  local url="$1"
+  case "$url" in
+    "") echo "$FORGE_UNKNOWN" ;;
+    *github.com[:/]*|*github.*.com[:/]*) echo "github" ;;
+    *gitlab.com[:/]*|*gitlab.*[:/]*)     echo "gitlab" ;;
+    *bitbucket.org[:/]*)                 echo "bitbucket" ;;
+    *codeberg.org[:/]*)                  echo "codeberg" ;;
+    *gitea.*[:/]*)                       echo "gitea" ;;
+    *) echo "$FORGE_UNKNOWN" ;;
+  esac
+}
+
+_forge_from_config() {
+  local repo_root="$1"
+  local config="$repo_root/specs/forge.yaml"
+  [[ -f "$config" ]] || return 1
+  local value
+  value=$(grep -E '^forge:' "$config" 2>/dev/null | head -1 \
+    | sed -E 's/^forge:[[:space:]]*//; s/^"(.*)"$/\1/; s/[[:space:]]*$//')
+  [[ -n "$value" ]] || return 1
+  printf '%s' "$value"
+}
+
+# Echo the forge id. Never fails — an undetectable forge is "unknown", which
+# callers must treat as "skip honestly", not as "assume GitHub".
+detect_forge() {
+  local repo_root="${1:-.}"
+
+  if [[ -n "${BIGPOWERS_FORGE:-}" ]]; then
+    printf '%s\n' "$BIGPOWERS_FORGE"
+    return 0
+  fi
+
+  local configured
+  if configured=$(_forge_from_config "$repo_root"); then
+    printf '%s\n' "$configured"
+    return 0
+  fi
+
+  local url
+  url=$(git -C "$repo_root" remote get-url origin 2>/dev/null || echo "")
+  _forge_from_remote_url "$url"
+}
+
+forge_is_supported() {
+  local forge="$1"
+  case " $FORGE_SUPPORTED_LIST " in
+    *" $forge "*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# Where a forge expects its CI config. Empty for unsupported forges — callers
+# must check forge_is_supported first rather than treating "" as a path.
+forge_ci_path() {
+  local forge="$1"
+  case "$forge" in
+    github) echo ".github/workflows" ;;
+    gitlab) echo ".gitlab-ci.yml" ;;
+    *) echo "" ;;
+  esac
+}
+
+# Root of the bundled CI templates. Overridable so a user can point at their own
+# org templates; the previous hardcoded `danielvm-git/.github` made every
+# installation depend on one person's personal repository.
+#
+# Resolved against the bigpowers package — NOT the target project. Templates
+# ship with bigpowers; deriving this from the project being wired would look for
+# them inside the user's repo, where they do not exist.
+forge_template_root() {
+  if [[ -n "${BIGPOWERS_CI_TEMPLATES:-}" ]]; then
+    printf '%s' "$BIGPOWERS_CI_TEMPLATES"
+    return 0
+  fi
+  local package_root
+  package_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+  printf '%s' "$package_root/docs/templates/ci"
+}

package/scripts/lib/extract-story-verify.py

@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+# story: BUG-2026-07-26-story-verify-never-executed
+"""Emit executable story-level verify directives from epic capsules.
+
+Tier-2 half of the verify arc (GH #106). Tier 1 is SKILL.md -> verify:, run by
+run-skill-verify.sh. This walks specs/epics/*/epic.yaml plus any
+*-tasks.yaml siblings and prints one TSV record per story that declares a
+verify command:
+
+    <story_id>\t<source_path>\t<status>\t<verify_command>
+
+Newlines inside a folded/literal YAML block are collapsed to single spaces so
+each record stays on one line for the bash caller.
+"""
+
+import glob
+import os
+import sys
+
+try:
+    import yaml
+except ImportError:  # pragma: no cover - resolved by scripts/lib/python-env.sh
+    sys.exit("extract-story-verify: PyYAML missing — pip install -r requirements.txt")
+
+FIELD_SEPARATOR = "\t"
+UNKNOWN_STATUS = "unknown"
+
+
+def _flatten(command):
+    """Collapse a multi-line YAML scalar into one whitespace-normalized line."""
+    return " ".join(str(command).split())
+
+
+def _story_records(stories, source_path):
+    """Yield (id, source, status, verify) for each story declaring a verify."""
+    for story in stories or []:
+        if not isinstance(story, dict):
+            continue
+        verify = story.get("verify")
+        story_id = story.get("id")
+        if not verify or not story_id:
+            continue
+        status = story.get("status") or UNKNOWN_STATUS
+        yield (str(story_id), source_path, str(status), _flatten(verify))
+
+
+def _load_yaml(path):
+    """Parse a YAML file, reporting the offending path on failure."""
+    with open(path, encoding="utf-8") as handle:
+        try:
+            return yaml.safe_load(handle)
+        except yaml.YAMLError as exc:
+            raise SystemExit(
+                f"extract-story-verify: cannot parse {path}: {exc}\n"
+                "  Expected valid YAML; fix the capsule before running the gate."
+            )
+
+
+def _tasks_records(tasks_path):
+    """Extract verify records from a *-tasks.yaml, which nests under `tasks:`."""
+    doc = _load_yaml(tasks_path)
+    if not isinstance(doc, dict):
+        return []
+    story_id = doc.get("story") or doc.get("id")
+    records = list(_story_records(doc.get("stories"), tasks_path))
+    for task in doc.get("tasks") or []:
+        if not isinstance(task, dict) or not task.get("verify"):
+            continue
+        task_id = task.get("id") or story_id
+        if not task_id:
+            continue
+        status = task.get("status") or doc.get("status") or UNKNOWN_STATUS
+        records.append(
+            (str(task_id), tasks_path, str(status), _flatten(task["verify"]))
+        )
+    return records
+
+
+def collect_records(repo_root):
+    """Gather every story/task verify directive across all epic capsules."""
+    records = []
+    epic_glob = os.path.join(repo_root, "specs", "epics", "*", "epic.yaml")
+    for epic_path in sorted(glob.glob(epic_glob)):
+        doc = _load_yaml(epic_path)
+        if isinstance(doc, dict):
+            records.extend(_story_records(doc.get("stories"), epic_path))
+
+    tasks_glob = os.path.join(repo_root, "specs", "epics", "*", "*-tasks.yaml")
+    for tasks_path in sorted(glob.glob(tasks_glob)):
+        records.extend(_tasks_records(tasks_path))
+    return records
+
+
+def main():
+    repo_root = sys.argv[1] if len(sys.argv) > 1 else "."
+    for record in collect_records(repo_root):
+        rel = os.path.relpath(record[1], repo_root)
+        print(FIELD_SEPARATOR.join([record[0], rel, record[2], record[3]]))
+
+
+if __name__ == "__main__":
+    main()

package/scripts/lib/fail-open-detect.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# story: BUG-2026-07-26-story-verify-never-executed
+# fail-open-detect.sh — shared verify-directive fail-open detector.
+#
+# Extracted from run-skill-verify.sh (#96) so tier-1 (SKILL.md → verify:) and
+# tier-2 (epic.yaml story verify:, #106) share ONE detector. A new evasion
+# idiom must be rejected everywhere at once; two copies would drift.
+#
+# Source this file, then call is_fail_open_directive "<cmd>".
+
+if [[ -n "${FAIL_OPEN_DETECT_LOADED:-}" ]]; then return 0; fi
+FAIL_OPEN_DETECT_LOADED=1
+
+# A directive is fail-open when it cannot exit non-zero on a broken repo.
+# Two families, both checked syntactically because a pipeline's exit status
+# is the status of its LAST command:
+#   1. explicit swallow  — `|| echo ...`, `|| true`, `|| :`, `; true`, `; exit 0`
+#   2. non-asserting tail — pipeline ends in a filter that always exits 0
+#      (head/wc/cat/tee/sort/tr/sed/awk/echo/true/:). `grep x | wc -l` is the
+#      canonical offender: wc always succeeds, so the grep result is discarded.
+# Use an assertion instead, e.g. [ "$(... | wc -l)" -gt 0 ].
+FAIL_OPEN_TAIL_CMDS='head|wc|cat|tee|sort|tr|sed|awk|echo|true|:'
+
+is_fail_open_directive() {
+  local cmd="$1"
+
+  # Family 1: explicit exit-status swallowing.
+  if echo "$cmd" | grep -qE '\|\|[[:space:]]*(echo|true|:)|;[[:space:]]*(true|:|exit[[:space:]]+0)[[:space:]]*$'; then
+    return 0
+  fi
+
+  # Family 2: pipeline whose last stage never fails.
+  # Strip $(...) first — a pipe inside a command substitution feeds an
+  # assertion, e.g. [ "$(ls x | wc -l)" -gt 0 ], and is NOT fail-open.
+  local stripped="$cmd" prev=""
+  while [ "$stripped" != "$prev" ]; do
+    prev="$stripped"
+    stripped=$(printf '%s' "$stripped" | sed 's/\$([^()]*)/SUBST/g')
+  done
+
+  # Only inspect the segment after the final `|` that is not part of `||`.
+  local tail_seg
+  tail_seg=$(printf '%s' "$stripped" | sed 's/||/\
+/g' | tail -1)
+  case "$tail_seg" in
+    *\|*)
+      tail_seg=${tail_seg##*|}
+      tail_seg=$(printf '%s' "$tail_seg" | sed 's/^[[:space:]]*//')
+      echo "$tail_seg" | grep -qE "^($FAIL_OPEN_TAIL_CMDS)([[:space:]]|$)" && return 0
+      ;;
+  esac
+
+  return 1
+}
+
+# A verify string must be a runnable command, not prose. Guards the e60s01 class:
+# `node bin/bigpowers.js setup (interactive in TTY)` is documentation, and a
+# story gate that cannot be executed is as useless as one never executed.
+#
+# Two conditions, both required. The leading-token check alone accepts the
+# example above (it starts with `node`), so shape is also checked with `bash -n`
+# — the parenthetical is a syntax error, which is exactly what marks it as prose.
+is_executable_verify() {
+  local cmd="$1"
+  echo "$cmd" | grep -qE '^[a-zA-Z][a-zA-Z0-9_.-]*\b|^\[' || return 1
+  bash -n -c "$cmd" 2>/dev/null
+}

package/scripts/lib/golden-suite-gates.sh

@@ -18,6 +18,10 @@ GOLDEN_GATES=(
   "import-boundaries:bash scripts/check-import-boundaries.sh:false"
   "skill-catalog:bash scripts/validate-skill-catalog.sh:false"
   "specs-parse:bash scripts/validate-specs-yaml.sh:false"
+  # Tier 2 of the verify arc (#106): executes the verify: of every story marked
+  # done. Tier 1 (SKILL.md) is run-skill-verify.sh in golden-suite.yml.
+  "story-verify-selftest:bash scripts/run-story-verify.sh --self-test:false"
+  "story-verify:bash scripts/run-story-verify.sh:false"
 )
 
 GOLDEN_GREEN='\033[0;32m'

package/scripts/lib/plan-consistency-check.sh

@@ -10,6 +10,15 @@ if [[ -z "$CAPSULE" || ! -d "$CAPSULE" ]]; then
   exit 2
 fi
 
+SCRIPT_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_LIB_DIR/../.." && pwd)"
+# shellcheck source=fail-open-detect.sh
+source "$SCRIPT_LIB_DIR/fail-open-detect.sh"
+# shellcheck source=python-env.sh
+source "$SCRIPT_LIB_DIR/python-env.sh"
+resolve_python >/dev/null 2>&1 || true
+PYTHON_BIN="${PYTHON:-python3}"
+
 EPIC_YAML="$CAPSULE/epic.yaml"
 CRITICAL=0
 HIGH=0
@@ -74,8 +83,23 @@ for tasks in "${TASKS[@]+"${TASKS[@]}"}"; do
       && report MED "Story $sid spec contains ambiguous/TBD markers"
   fi
 
-  grep -qE '^[[:space:]]*verify:' "$tasks" \
-    || report CRITICAL "Story $sid tasks.yaml missing runnable verify: commands"
+  # Presence is necessary but not sufficient — the word "runnable" in the old
+  # message was aspirational: nothing checked shape, and nothing executed it.
+  # Execution happens later in scripts/run-story-verify.sh (#106), which gates
+  # only `done` stories. At plan time the code may not exist yet, so assert what
+  # can be asserted now: the directive parses as a command and can fail.
+  if ! grep -qE '^[[:space:]]*verify:' "$tasks"; then
+    report CRITICAL "Story $sid tasks.yaml missing runnable verify: commands"
+  else
+    verify_cmd="$("$PYTHON_BIN" "$SCRIPT_LIB_DIR/extract-story-verify.py" "$REPO_ROOT" 2>/dev/null \
+      | awk -F'\t' -v s="$sid" '$1 == s { print $4; exit }')"
+    if [[ -n "$verify_cmd" ]]; then
+      is_executable_verify "$verify_cmd" \
+        || report CRITICAL "Story $sid verify: is prose, not a runnable command: $verify_cmd"
+      is_fail_open_directive "$verify_cmd" \
+        && report CRITICAL "Story $sid verify: is fail-open (cannot exit non-zero): $verify_cmd"
+    fi
+  fi
   grep -qE '^status:[[:space:]]*(failing|todo|passing)' "$tasks" \
     || report MED "Story $sid tasks.yaml should use status: failing|passing ledger (e45s06)"
 done

package/scripts/lib/test-assertions.sh

@@ -4,7 +4,17 @@
 if [[ -n "${TEST_ASSERTIONS_LOADED:-}" ]]; then return 0; fi
 TEST_ASSERTIONS_LOADED=1
 
-ta_cleanup() { [[ -n "${TA_TMPDIR:-}" && -d "$TA_TMPDIR" ]] && rm -rf "$TA_TMPDIR"; }
+# Registered as `trap ta_cleanup EXIT`. The exit status of an EXIT trap's last
+# command replaces the script's own, so this MUST end with an explicit success:
+# the old `[[ ... ]] && rm -rf ...` one-liner returned 1 whenever TA_TMPDIR was
+# unset, silently forcing every caller to exit 1 while printing "0 failed".
+# That single line broke 22 story verifies across the integration epics (#106).
+ta_cleanup() {
+  if [[ -n "${TA_TMPDIR:-}" && -d "$TA_TMPDIR" ]]; then
+    rm -rf "$TA_TMPDIR"
+  fi
+  return 0
+}
 
 ta_pass() { echo "  PASS $1"; TA_PASS=$((TA_PASS + 1)); }