claude-dev-env 1.93.0 → 1.94.0

package/skills/bugteam/scripts/test_bugteam_preflight.py

@@ -1,316 +1,41 @@
-"""Tests for bugteam_preflight git hooks path verification.
+"""Smoke tests for the skill-path preflight wrap.
 
-Covers:
-- core.hooksPath unset: exits non-zero with correction message
-- core.hooksPath pointing to the correct claude hooks dir: exits zero
-- core.hooksPath pointing elsewhere (husky override): exits non-zero
-- core.hooksPath with trailing slash: must still pass after normalization
+Behavioral coverage lives at
+``_shared/pr-loop/scripts/tests/test_preflight.py``.
 """
 
 from __future__ import annotations
 
 import importlib.util
-import subprocess
-import sys
 from pathlib import Path
 from types import ModuleType
-from unittest.mock import MagicMock, patch
 
-import pytest
 
-
-def _load_preflight_module() -> ModuleType:
+def _load_wrap_module() -> ModuleType:
     module_path = Path(__file__).parent / "bugteam_preflight.py"
-    spec = importlib.util.spec_from_file_location("bugteam_preflight", module_path)
-    assert spec is not None
-    assert spec.loader is not None
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
-
-
-bugteam_preflight = _load_preflight_module()
-
-
-def _make_completed_process(
-    stdout: str, returncode: int
-) -> subprocess.CompletedProcess:
-    process = MagicMock(spec=subprocess.CompletedProcess)
-    process.stdout = stdout
-    process.returncode = returncode
-    return process
-
-
-def test_should_exit_nonzero_when_core_hooks_path_unset(capsys: pytest.CaptureFixture[str]) -> None:
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process("", returncode=1)
-        exit_code = bugteam_preflight.verify_git_hooks_path(Path("."))
-    assert exit_code != 0
-    captured = capsys.readouterr()
-    assert "core.hooksPath" in captured.err
-    assert "npx claude-dev-env" in captured.err or "git config" in captured.err
-
-
-def test_should_exit_zero_when_core_hooks_path_points_to_claude_hooks(tmp_path: Path) -> None:
-    claude_hooks_path = tmp_path / ".claude" / "hooks" / "git-hooks"
-    claude_hooks_path.mkdir(parents=True)
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process(
-            str(claude_hooks_path) + "\n", returncode=0
-        )
-        exit_code = bugteam_preflight.verify_git_hooks_path(Path("."))
-    assert exit_code == 0
-
-
-def test_should_exit_nonzero_when_core_hooks_path_points_elsewhere(capsys: pytest.CaptureFixture[str]) -> None:
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process(
-            "/some/other/path/.husky\n", returncode=0
-        )
-        exit_code = bugteam_preflight.verify_git_hooks_path(Path("."))
-    assert exit_code != 0
-    captured = capsys.readouterr()
-    assert "core.hooksPath" in captured.err
-
-
-def test_should_include_correction_commands_in_error_message(capsys: pytest.CaptureFixture[str]) -> None:
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process("", returncode=1)
-        bugteam_preflight.verify_git_hooks_path(Path("."))
-    captured = capsys.readouterr()
-    assert (
-        "npx claude-dev-env" in captured.err
-        or "git config --global core.hooksPath" in captured.err
-    )
-
-
-def test_main_should_exit_nonzero_when_hooks_path_unset() -> None:
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process("", returncode=1)
-        exit_code = bugteam_preflight.main(["--no-pytest"])
-    assert exit_code != 0
-
-
-def test_main_should_continue_when_hooks_path_valid(tmp_path: Path) -> None:
-    claude_hooks_path = tmp_path / ".claude" / "hooks" / "git-hooks"
-    claude_hooks_path.mkdir(parents=True)
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process(
-            str(claude_hooks_path) + "\n", returncode=0
-        )
-        exit_code = bugteam_preflight.main(["--no-pytest"])
-    assert exit_code == 0
-
-
-def test_should_accept_hooks_path_with_trailing_slash() -> None:
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process(
-            "/home/user/.claude/hooks/git-hooks/\n", returncode=0
-        )
-        exit_code = bugteam_preflight.verify_git_hooks_path(Path("."))
-    assert exit_code == 0, (
-        "hooksPath with trailing slash must pass verification after normalization"
-    )
-
-
-def test_should_exit_zero_when_hooks_path_set_at_repo_scope(tmp_path: Path) -> None:
-    claude_hooks_path = tmp_path / ".claude" / "hooks" / "git-hooks"
-    claude_hooks_path.mkdir(parents=True)
-    repo_root = tmp_path / "my-repo"
-    repo_root.mkdir()
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process(
-            str(claude_hooks_path) + "\n", returncode=0
-        )
-        exit_code = bugteam_preflight.verify_git_hooks_path(repo_root)
-    assert exit_code == 0, (
-        "verify_git_hooks_path must accept a valid path returned by effective "
-        "config query (not restricted to --global scope)"
-    )
-    called_command = mock_run.call_args[0][0]
-    assert "--global" not in called_command, (
-        "verify_git_hooks_path must query effective config, not --global only"
-    )
-    assert "-C" in called_command, (
-        "verify_git_hooks_path must use git -C <repo_root> for repo-effective config"
-    )
-    dash_c_index = called_command.index("-C")
-    assert called_command[dash_c_index + 1] == str(repo_root), (
-        "git -C must receive the resolved repository root path"
-    )
-
-
-def test_verify_git_hooks_path_accepts_none_repository_root(tmp_path: Path) -> None:
-    """When repository_root is None, the call must use git's cwd-effective config.
-
-    Binds the documented optional contract: passing None must not raise and must
-    omit the `-C <root>` arguments so git falls back to the working directory.
-    """
-    claude_hooks_path = tmp_path / ".claude" / "hooks" / "git-hooks"
-    claude_hooks_path.mkdir(parents=True)
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process(
-            str(claude_hooks_path) + "\n", returncode=0
-        )
-        exit_code = bugteam_preflight.verify_git_hooks_path(None)
-    assert exit_code == 0
-    called_command = mock_run.call_args[0][0]
-    assert "-C" not in called_command, (
-        "verify_git_hooks_path(None) must omit -C so git uses cwd-effective config"
-    )
-
-
-def test_should_accept_hooks_path_with_backslash_and_trailing_slash() -> None:
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process(
-            "C:\\Users\\user\\.claude\\hooks\\git-hooks\\\n", returncode=0
-        )
-        exit_code = bugteam_preflight.verify_git_hooks_path(Path("."))
-    assert exit_code == 0, (
-        "Windows hooksPath with trailing backslash must pass after normalization"
-    )
-
-
-def test_should_exit_nonzero_when_git_executable_not_found(
-    capsys: pytest.CaptureFixture[str],
-) -> None:
-    """Preflight must not crash with a traceback when git is missing from PATH."""
-    with patch("subprocess.run", side_effect=FileNotFoundError()):
-        exit_code = bugteam_preflight.verify_git_hooks_path(Path("."))
-    assert exit_code != 0, (
-        "FileNotFoundError from subprocess.run must produce a non-zero exit, "
-        "not a propagated traceback"
-    )
-    captured = capsys.readouterr()
-    assert "git" in captured.err.lower(), (
-        "Error message must mention git so the user knows what is missing"
-    )
-    assert (
-        "npx claude-dev-env" in captured.err
-        or "git config --global core.hooksPath" in captured.err
-    ), "Error message must include the enforcement-absent remediation hints"
-
-
-def test_should_exit_nonzero_when_subprocess_run_raises_os_error(
-    capsys: pytest.CaptureFixture[str],
-) -> None:
-    """Preflight must surface a clean error for other OS-level git launch failures."""
-    with patch("subprocess.run", side_effect=OSError("permission denied")):
-        exit_code = bugteam_preflight.verify_git_hooks_path(Path("."))
-    assert exit_code != 0, (
-        "OSError from subprocess.run must produce a non-zero exit, "
-        "not a propagated traceback"
-    )
-    captured = capsys.readouterr()
-    assert "bugteam_preflight" in captured.err, (
-        "Error message must be prefixed with the preflight tool name for context"
-    )
-    assert "permission denied" in captured.err, (
-        "Error message must include the underlying OSError detail for diagnosis"
-    )
-
-
-def test_has_pytest_configuration_finds_pytest_ini(tmp_path: Path) -> None:
-    """has_pytest_configuration must detect pytest.ini at the repo root.
-
-    Regression for loop1-17/loop1-18: the literals "pytest.ini",
-    "pyproject.toml", and "[tool.pytest" were inlined in production function
-    bodies; centralizing them in bugteam_scripts_constants and importing here
-    pins the contract.
-    """
-    repository_root = tmp_path / "repo"
-    repository_root.mkdir()
-    (repository_root / "pytest.ini").write_text("[pytest]\n", encoding="utf-8")
-    assert bugteam_preflight.has_pytest_configuration(repository_root) is True
-
-
-def test_has_pytest_configuration_finds_pyproject_pytest_section(
-    tmp_path: Path,
-) -> None:
-    repository_root = tmp_path / "repo"
-    repository_root.mkdir()
-    (repository_root / "pyproject.toml").write_text(
-        "[tool.pytest.ini_options]\nminversion = '6.0'\n", encoding="utf-8"
-    )
-    assert bugteam_preflight.has_pytest_configuration(repository_root) is True
-
-
-def test_has_pytest_configuration_returns_false_without_either_file(
-    tmp_path: Path,
-) -> None:
-    repository_root = tmp_path / "repo"
-    repository_root.mkdir()
-    assert bugteam_preflight.has_pytest_configuration(repository_root) is False
-
-
-def test_main_should_halt_when_env_var_lists_bugteam(
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
-) -> None:
-    """CLAUDE_REVIEWS_DISABLED=bugteam must halt preflight with the dedicated exit code."""
-    monkeypatch.setenv("CLAUDE_REVIEWS_DISABLED", "bugteam")
-    monkeypatch.delenv("BUGTEAM_PREFLIGHT_SKIP", raising=False)
-    exit_code = bugteam_preflight.main(["--no-pytest"])
-    assert exit_code == bugteam_preflight.EXIT_CODE_BUGTEAM_DISABLED_VIA_ENV
-    captured = capsys.readouterr()
-    assert "CLAUDE_REVIEWS_DISABLED" in captured.err
-    assert "bugteam" in captured.err
-
-
-def test_main_should_continue_when_env_var_omits_bugteam(
-    monkeypatch: pytest.MonkeyPatch,
-    tmp_path: Path,
-) -> None:
-    """CLAUDE_REVIEWS_DISABLED without the bugteam token must not halt preflight."""
-    monkeypatch.setenv("CLAUDE_REVIEWS_DISABLED", "copilot,bugbot")
-    monkeypatch.delenv("BUGTEAM_PREFLIGHT_SKIP", raising=False)
-    claude_hooks_path = tmp_path / ".claude" / "hooks" / "git-hooks"
-    claude_hooks_path.mkdir(parents=True)
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process(
-            str(claude_hooks_path) + "\n", returncode=0
-        )
-        exit_code = bugteam_preflight.main(["--no-pytest"])
-    assert exit_code != bugteam_preflight.EXIT_CODE_BUGTEAM_DISABLED_VIA_ENV
-
-
-def test_main_should_halt_when_env_var_contains_uppercase_or_whitespace_bugteam_token(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Token matching must be case-insensitive and whitespace-tolerant."""
-    monkeypatch.setenv("CLAUDE_REVIEWS_DISABLED", " BugTeam , copilot ")
-    monkeypatch.delenv("BUGTEAM_PREFLIGHT_SKIP", raising=False)
-    exit_code = bugteam_preflight.main(["--no-pytest"])
-    assert exit_code == bugteam_preflight.EXIT_CODE_BUGTEAM_DISABLED_VIA_ENV
-
-
-def _was_called_with_argument(
-    mock_subprocess_run: MagicMock, argument_token: str
-) -> bool:
-    return any(
-        argument_token in each_call_args[0][0]
-        for each_call_args in mock_subprocess_run.call_args_list
-    )
-
-
-def test_verify_git_hooks_path_invokes_self_heal_before_effective_query(
-    tmp_path: Path,
-) -> None:
-    """verify_git_hooks_path must delegate to the shared self-heal helper before --get."""
-    canonical_hooks_path = tmp_path / ".claude" / "hooks" / "git-hooks"
-    canonical_hooks_path.mkdir(parents=True)
-    with patch("subprocess.run") as mock_run:
-        mock_run.return_value = _make_completed_process(
-            str(canonical_hooks_path) + "\n", returncode=0
-        )
-        bugteam_preflight.verify_git_hooks_path(tmp_path)
-    assert _was_called_with_argument(mock_run, "--get-all"), (
-        "verify_git_hooks_path must run the --local --get-all read for self-heal"
-    )
-    assert _was_called_with_argument(mock_run, "--get"), (
-        "verify_git_hooks_path must still run the effective --get verification"
-    )
-    first_called_command = mock_run.call_args_list[0][0][0]
-    assert "--get-all" in first_called_command, (
-        "Self-heal must run BEFORE the effective config query, not after"
-    )
+    specification = importlib.util.spec_from_file_location(
+        "bugteam_preflight",
+        module_path,
+    )
+    assert specification is not None
+    assert specification.loader is not None
+    wrap_module = importlib.util.module_from_spec(specification)
+    specification.loader.exec_module(wrap_module)
+    return wrap_module
+
+
+def test_wrap_main_delegates_to_shared_module() -> None:
+    wrap_module = _load_wrap_module()
+    assert wrap_module.main.__module__ == "preflight"
+    shared_filename = Path(wrap_module.main.__code__.co_filename).name
+    assert shared_filename == "preflight.py"
+
+
+def test_wrap_main_help_exits_cleanly() -> None:
+    wrap_module = _load_wrap_module()
+    try:
+        wrap_module.main(["--help"])
+    except SystemExit as exit_signal:
+        assert exit_signal.code in (0, None)
+        return
+    raise AssertionError("main(['--help']) must raise SystemExit")

package/skills/copilot-finding-triage/SKILL.md

@@ -1,19 +1,25 @@
 ---
 name: copilot-finding-triage
 description: >-
-  Sorts each Copilot gate finding from a converge run into one of two tiers and
-  routes it: a self-healing finding is auto-fixed, pushed, and counted toward
-  convergence with no user page, while a code concern pages the user over ntfy
-  and holds the run behind a 45-minute gate. Triggers: 'copilot finding triage',
-  'user review gate', 'tier copilot findings', 'triage the copilot gate'.
+  Sorts each Copilot gate finding from a converge run into one of two tiers, then
+  verifies each code concern with an executed check before routing it: a
+  self-healing finding is auto-fixed, pushed, and counted toward convergence with
+  no user page; a confirmed or refuted code concern is handled by the run with its
+  check evidence; only a code concern the check leaves inconclusive pages the user
+  over ntfy and holds the run behind a 45-minute gate. Triggers: 'copilot finding
+  triage', 'user review gate', 'tier copilot findings', 'triage the copilot gate'.
 ---
 
 # Copilot Finding Triage
 
-After a converge run's Copilot gate returns its findings, this skill sorts each
-one into a tier and acts on it. Findings scoped to style, type hints, or tests
-heal themselves inside the run. A logic, security, or behavior finding pages the user
-and holds the run until they answer or a 45-minute deadline passes.
+After a converge run's Copilot gate returns its findings, this skill tiers each
+one, verifies every code concern with an executed check, then acts on it.
+Findings scoped to style, type hints, or tests heal themselves inside the run. A
+logic, security, or behavior finding goes to a verifier that runs a check against
+HEAD: a confirmed defect joins the fix round carrying its repro, a refuted claim
+is answered on the thread with the check evidence, and only a finding the check
+leaves inconclusive pages the user and holds the run until they answer or a
+45-minute deadline passes.
 
 ## When this applies
 
@@ -22,7 +28,6 @@ inside one of these callers:
 
 - `autoconverge` — the single-run converge workflow, at its Copilot wait-gate.
 - `pr-converge` — the looping converge workflow, at each Copilot tick.
-- `copilot-review` — the standalone Copilot babysitter.
 
 Each caller already fetches the review and carries a fix-and-push flow. This
 skill decides, per finding, whether that flow runs on its own or waits behind
@@ -40,12 +45,48 @@ Read the complete rubric in `reference/tier-rubric.md`. The short form:
   product decision. Logic or correctness defects, security, data handling,
   error-handling semantics, and concurrency.
 
-A finding that straddles both tiers sorts to CODE CONCERN. Any doubt routes to
-the user gate.
+A finding that straddles both tiers sorts to CODE CONCERN. Any doubt about the
+tier sorts the finding to CODE CONCERN.
+
+## The verification stage
+
+Tiering names who might act; the verification stage between tiering and the user
+gate settles it for every code concern. Each code-concern finding goes to its own
+verifier agent, all in parallel, inside the run. The verifier runs a check
+against the flagged HEAD and returns one of three verdicts.
+
+**The governing rule: a verdict is conclusive only if an actual check was
+executed.** Reading the source and reasoning about it, however sound, never
+produces a conclusive verdict. A check is a concrete command the verifier runs
+against the flagged HEAD — executing the code path with crafted inputs, forcing
+the claimed error condition, or running a purpose-built test — whose captured
+output demonstrates the behavior in question. Each verdict carries
+`{verdict, checkCommand, checkOutput, evidence}`; a conclusive verdict whose
+`checkCommand` or `checkOutput` is empty carries no executed check, so the run
+downgrades it to inconclusive.
+
+- **CONFIRMED** — the check reproduces the defect. The finding becomes
+  self-healing: it joins the fix round carrying its repro. The fix re-runs the
+  same repro check and shows it passes, adds the repro to the test suite as a
+  regression test where the suite covers that surface, lands in one commit and
+  pushes, replies to the thread with the fix SHA plus the before/after check
+  output, and resolves the thread. No page.
+- **REFUTED** — the check shows the code already behaves correctly in the exact
+  scenario the finding claims is broken. The run replies to the thread with the
+  command(s) and captured output, resolves the thread, and counts the finding
+  clean. No page.
+- **INCONCLUSIVE** — everything else: no runnable check exists, the check is
+  infeasible in this environment, the results are ambiguous, or the fix needs a
+  product decision between defensible behaviors. The verifier defaults to
+  inconclusive, and any doubt sorts here. These findings, and only these, flow
+  into the user gate.
+
+A run with zero inconclusive findings never reaches the user gate.
 
 ## Self-healing flow
 
-A self-healing finding never pages the user.
+A self-healing finding never pages the user. This covers a finding tiered
+self-healing and a code concern the verifier confirmed.
 
 1. Fix the finding through the caller's existing fix flow.
 2. Verify the fix.
@@ -54,16 +95,18 @@ A self-healing finding never pages the user.
 
 ## User gate protocol
 
-Run this protocol when one or more CODE CONCERN findings sit on the round's HEAD.
+Run this protocol when one or more code-concern findings stayed inconclusive
+after verification on the round's HEAD.
 
 ### Step 1 — Page the user
 
 Run `scripts/notify_ntfy.py` with:
 
 - `--title` naming the PR.
-- `--message` summarizing each code-concern finding, one line each, as
-  `file:line — severity — one sentence`. Build the body from
-  `templates/notification.md`.
+- `--message` summarizing each inconclusive finding, one line each, as
+  `file:line — severity — one sentence`, followed by the verifier's one-line
+  evidence note stating what check was attempted and why it was not decisive.
+  Build the body from `templates/notification.md`.
 - `--click-url` set to the Copilot review URL, so tapping the page opens the
   review.
 
@@ -82,17 +125,22 @@ moment the script exits zero.
 - If the deadline passes with no answer, run the caller's normal teardown and
   report the un-reviewed findings in the final report.
 
-### Step 3 — Self-healing findings run in parallel
+### Step 3 — Self-healing and confirmed findings run in parallel
 
-Self-healing findings on the same HEAD do not wait for the gate. Fix, verify,
-commit, and push them through the caller's fix flow, and count the round toward
-convergence.
+Self-healing findings and confirmed code concerns on the same HEAD do not wait
+for the gate. Fix, verify, commit, and push them through the caller's fix flow,
+and count the round toward convergence. A confirmed finding carries its repro, so
+its fix re-runs that same check and posts the before/after output on the thread.
 
 ## Gate checklist
 
 - [ ] Every finding on HEAD carries a tier.
 - [ ] Each self-healing finding is fixed, verified, and pushed.
-- [ ] Each code-concern finding appears as one line in the ntfy body.
+- [ ] Each code-concern finding carries a verifier verdict from an executed check.
+- [ ] Each confirmed finding is fixed with its repro re-run and pushed.
+- [ ] Each refuted finding's thread carries the check evidence and is resolved.
+- [ ] Each inconclusive finding appears as one line in the ntfy body with its
+      evidence note.
 - [ ] The page carries the PR name, the per-finding summary, and the review URL.
 - [ ] `scripts/notify_ntfy.py` exited zero before the 45-minute clock started.
 - [ ] The wakeup is armed for 45 minutes from a delivered page.
@@ -102,9 +150,9 @@ convergence.
 
 | Path | Role |
 |------|------|
-| `SKILL.md` | This hub: when it applies, the tier split, the gate protocol. |
-| `reference/tier-rubric.md` | The complete tier rubric and the behavior-safe test. |
-| `templates/notification.md` | The ntfy message body for a code-concern page. |
+| `SKILL.md` | This hub: when it applies, the tier split, the verification stage, the gate protocol. |
+| `reference/tier-rubric.md` | The complete tier rubric, the three verdicts, and the executed-check standard. |
+| `templates/notification.md` | The ntfy message body for an inconclusive-finding page. |
 | `scripts/notify_ntfy.py` | The ntfy publish CLI. |
 | `scripts/test_notify_ntfy.py` | Tests for the publish CLI. |
 
@@ -116,9 +164,13 @@ convergence.
 - **A failed page is not consent.** A failed ntfy POST holds the gate open. It
   does not auto-approve the round. Read the script's non-zero exit as a page that
   never reached the user, and keep the run held.
-- **Doubt sorts to CODE CONCERN.** When a finding could sit in either tier,
-  classify it as a code concern and page the user. The safe default never
-  auto-fixes a finding that might change runtime behavior.
+- **A conclusive verdict needs an executed check.** Source reading, however
+  sound, never confirms or refutes a finding. A confirmed or refuted verdict
+  whose `checkCommand` or `checkOutput` is empty downgrades to inconclusive and
+  pages the user.
+- **Doubt sorts to INCONCLUSIVE.** When an executed check does not pin down the
+  behavior, the verifier defaults to inconclusive and the finding pages the user.
+  The safe default never auto-fixes a finding whose behavior a check did not show.
 - **The 45-minute clock starts at page success.** The timer starts when the page
   reaches the user, which is the moment `scripts/notify_ntfy.py` exits zero, not
   the moment the finding is classified.

package/skills/copilot-finding-triage/reference/tier-rubric.md

@@ -1,17 +1,19 @@
 # Tier Rubric
 
-Every Copilot finding on the round's HEAD sorts into one of two tiers. The tier
-decides who acts: the run fixes a self-healing finding on its own, and the run
-pages the user for a code concern.
+Every Copilot finding on the round's HEAD passes through two stages: tiering,
+then — for a code concern — an executed-check verification stage that decides who
+acts. Tiering sorts a finding into one of two tiers. The run fixes a self-healing
+finding on its own; a code concern goes to a verifier agent, and only a finding
+the verifier leaves inconclusive pages the user.
 
 ## The two tiers
 
-| Tier | Who acts | Page the user | Counts toward convergence |
-|------|----------|---------------|---------------------------|
+| Tier | Next step | Page the user | Counts toward convergence |
+|------|-----------|---------------|---------------------------|
 | SELF-HEALING | The run auto-fixes | No | Yes |
-| CODE CONCERN | The user decides | Yes | Held until the user answers or the deadline passes |
+| CODE CONCERN | An executed-check verifier decides | Only when the verifier's verdict is inconclusive | Confirmed and refuted count; inconclusive holds until the user answers or the deadline passes |
 
-## The test that splits them
+## The test that splits the tiers
 
 A finding is SELF-HEALING when its fix cannot change what a production caller
 observes at runtime. A finding is a CODE CONCERN when its fix changes runtime
@@ -42,8 +44,65 @@ weigh a tradeoff.
 - Concurrency.
 - Anything whose fix changes observable production behavior.
 
-## When a finding sits on the line
+A finding that touches both tiers sorts to CODE CONCERN. Any doubt about the tier
+sorts the finding to CODE CONCERN.
 
-A finding that touches both tiers sorts to CODE CONCERN. Any doubt about whether
-a fix stays behavior-safe routes the finding to the user gate. The safe default
-pages a person; it never auto-fixes a finding that might change runtime behavior.
+## The verification stage
+
+Every code-concern finding goes to its own verifier agent, all in parallel,
+inside the run. The verifier decides one of three verdicts by executing a check
+against the flagged HEAD.
+
+**The governing rule: a verdict is conclusive only if an actual check was
+executed.** Reading the source and reasoning about it, however sound, never
+produces a conclusive verdict. A check is a concrete command the verifier runs
+against the flagged HEAD — executing the flagged code path with crafted inputs,
+forcing the claimed error condition, or running a purpose-built test — whose
+captured output demonstrates the behavior in question. Source inspection points
+the check at the right place; it is never itself grounds for a conclusive verdict.
+
+Each verdict carries `{verdict, checkCommand, checkOutput, evidence}`. A
+conclusive verdict whose `checkCommand` or `checkOutput` is empty carries no
+executed check, so the run downgrades it to inconclusive.
+
+| Verdict | What the executed check shows | Who acts | Page the user |
+|---------|-------------------------------|----------|---------------|
+| CONFIRMED | The check tangibly reproduces the defect | The run auto-fixes | No |
+| REFUTED | The check tangibly shows the code already behaves correctly in the exact scenario the finding claims is broken | The run replies and resolves | No |
+| INCONCLUSIVE | Everything else | The user decides | Yes |
+
+### CONFIRMED
+
+The executed check reproduces the defect; the evidence carries the exact
+command(s) and the captured output. Only a confirmed verdict makes a
+code-concern finding self-healing. The finding joins the round's fix list
+carrying its repro, and the fix:
+
+1. Re-runs the same repro check and shows it passes.
+2. Adds the repro to the repo's test suite as a regression test where the suite
+   covers that surface.
+3. Lands in one commit and pushes.
+4. Replies to the thread with the fix SHA plus the before/after check output,
+   then resolves the thread.
+
+The loop resumes on its own. No page.
+
+### REFUTED
+
+The executed check demonstrates the code already behaves correctly in the exact
+scenario the finding claims is broken. The run replies to the thread with the
+command(s) and captured output, resolves the thread, and counts the finding
+clean. No page.
+
+### INCONCLUSIVE
+
+Everything else: no runnable check exists, the check is infeasible in this
+environment, the results are ambiguous, or the fix needs a product decision
+between defensible behaviors. A finding that is not tangibly reproducible is not
+self-healing. These findings, and only these, flow into the user gate.
+
+## The default is inconclusive
+
+The verifier defaults to inconclusive. Any doubt sorts to inconclusive, and an
+inconclusive finding pages the user. The safe default pages a person; it never
+auto-fixes a finding whose behavior an executed check did not pin down.

package/skills/copilot-finding-triage/templates/notification.md

@@ -13,10 +13,12 @@ Copilot code concern on PR {pr_number}: {short_pr_title}
 ## Body
 
 ```
-{finding_count} code concern(s) need your call on PR {pr_number} ({head_sha}):
+{finding_count} code concern(s) survived verification as inconclusive and need your call on PR {pr_number} ({head_sha}):
 
 - {file_1}:{line_1} — {severity_1} — {one_sentence_concern_1}
+  Check: {evidence_note_1}
 - {file_2}:{line_2} — {severity_2} — {one_sentence_concern_2}
+  Check: {evidence_note_2}
 
 Review: {review_url}
 Reply within 45 minutes or the run tears down and reports these findings unreviewed.
@@ -24,10 +26,13 @@ Reply within 45 minutes or the run tears down and reports these findings unrevie
 
 ## Field notes
 
-- `{finding_count}` counts the CODE CONCERN findings on this HEAD, not the
-  self-healing ones.
+- `{finding_count}` counts the inconclusive findings on this HEAD — the code
+  concerns an executed check left undecided — not the self-healing, confirmed, or
+  refuted ones.
 - Each bullet holds one finding: its `file:line`, its severity, and one sentence
   naming the concern.
+- `{evidence_note_N}` is the verifier's one-line note stating what check was
+  attempted and why it was not decisive.
 - `{review_url}` is the same URL passed as `--click-url`, so the reader sees it
   in the body and reaches it by tapping the message.
 - The 45-minute clock starts when the page reaches the user, which is the moment

package/skills/everything-search/SKILL.md

@@ -13,8 +13,7 @@ Search files instantly on Windows using the Everything command-line interface (e
 
 ## Hard limits
 
-- **Scope every search.** Pass a project path, an `ext:`/`dm:`/`size:` filter, or a name pattern. A bare whole-drive scan or a network-share sweep is out of bounds.
-- **Fall back on failure.** When `es.exe` fails or returns nothing, try to start it. if that doesn't work, prompt the user to decide next steps: grep, debug further, etc.
+Scope and fallback policy: `packages/claude-dev-env/rules/es-exe-file-search.md`.
 
 ## Instructions