devlyn-cli 2.10.0 → 3.0.0

package/scripts/lint-skills.sh

@@ -56,9 +56,16 @@ fi
 # plus the `_shared/` kernel. Keep this list single-source so all installed
 # mirror parity checks cover the same files.
 critical_path_files=$(cat <<'EOF'
+_shared/.ruff.toml
+_shared/process-evidence.py
+_shared/invocation-receipt.py
+_shared/role-config.py
+_shared/judge-role-evidence.py
 _shared/spec-verify-check.py
+_shared/judge-output-parser.py
 _shared/collect-codex-findings.py
 _shared/verify-merge-findings.py
+_shared/archive_run.py
 _shared/state-phase-write.py
 _shared/terminal-claim-check.py
 _shared/resolve-stop-hook.py
@@ -70,6 +77,7 @@ devlyn:ideate/references/project-mode.md
 devlyn:ideate/references/from-spec-mode.md
 devlyn:resolve/SKILL.md
 devlyn:queue/SKILL.md
+devlyn:engines/SKILL.md
 devlyn:resolve/references/state-schema.md
 devlyn:resolve/references/free-form-mode.md
 devlyn:resolve/references/phases/plan.md
@@ -152,6 +160,7 @@ offenders=$(git grep -Il -- 'mcp__codex-cli__' -- \
   ':!config/skills/preflight-workspace/**' \
   ':!benchmark/auto-resolve/external/**' \
   ':!benchmark/auto-resolve/results/**' \
+  ':!benchmark/ceiling/results/**' \
   ':!benchmark/auto-resolve/PILOT-RESULTS*' \
   2>/dev/null || true)
 if [ -z "$offenders" ]; then
@@ -176,6 +185,7 @@ offenders=$(git grep -Il -- 'Requires Codex MCP\|Codex MCP server\|Codex MCP ava
   ':!config/skills/preflight-workspace/**' \
   ':!benchmark/auto-resolve/external/**' \
   ':!benchmark/auto-resolve/results/**' \
+  ':!benchmark/ceiling/results/**' \
   ':!benchmark/auto-resolve/PILOT-RESULTS*' \
   2>/dev/null || true)
 if [ -z "$offenders" ]; then
@@ -204,8 +214,8 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# 4. No model-pinned Claude references, any generation, except the adjudicated
-#    SURFACE_CLOSE envelope whose requested id must equal CLI arg and modelUsage.
+# 4. No model-pinned Claude references, any generation, except the
+#    validated explicit-effort capability declaration.
 # ---------------------------------------------------------------------------
 section "Check 4: No model-pinned Claude references"
 offenders=$(grep -RInE 'Claude (Opus|Sonnet|Haiku|Fable)|claude-(opus|sonnet|haiku|fable)-[0-9]' \
@@ -214,7 +224,7 @@ offenders=$(grep -RInE 'Claude (Opus|Sonnet|Haiku|Fable)|claude-(opus|sonnet|hai
   | grep -v 'config/skills/devlyn:auto-resolve-workspace/' \
   | grep -v 'config/skills/devlyn:ideate-workspace/' \
   | grep -v 'config/skills/preflight-workspace/' \
-  | grep -vE '^config/skills/devlyn:resolve/SKILL\.md:[0-9]+:Freeze .*--tools "Read,Grep,Glob,Edit,Write" --dangerously-skip-permissions --model claude-sonnet-5 --output-format json --strict-mcp-config --mcp-config '\''\{"mcpServers":\{\}\}'\''.*, recording the same model at SPW spawn\.' \
+  | grep -vE '^config/skills/_shared/adapters/claude\.md:[0-9]+:<!-- devlyn-effort 2\.1\.263 claude-fable-5-1 low,medium,high,xhigh,max -->$' \
   | cut -d: -f1 \
   | sort -u \
   || true)
@@ -266,6 +276,105 @@ else
   bad "devlyn:design-ui must not be listed in OPTIONAL_ADDONS"
 fi
 
+# ---------------------------------------------------------------------------
+# 5b. Every completed managed-skills install writes its own version marker.
+# ---------------------------------------------------------------------------
+section "Check 5b: Installed skill roots carry exact version markers"
+if make_temp_dir tmp_install_marker /tmp/devlyn-install-marker.XXXXXX; then
+  marker_home="$tmp_install_marker/home"
+  marker_project="$tmp_install_marker/project"
+  timeout_low="$tmp_install_marker/timeout-low"
+  timeout_high="$tmp_install_marker/timeout-high"
+  installer="$PWD/bin/devlyn.js"
+  mkdir -p "$marker_home" "$marker_project" "$timeout_low/.claude" "$timeout_high/.claude"
+  printf '{"env":{"BASH_MAX_TIMEOUT_MS":"600000"}}\n' > "$timeout_low/.claude/settings.json"
+  printf '{"env":{"BASH_MAX_TIMEOUT_MS":"7200000"}}\n' > "$timeout_high/.claude/settings.json"
+
+  if (cd "$marker_project" \
+      && HOME="$marker_home" node "$installer" -y >"$tmp_install_marker/claude.log" 2>&1 \
+      && HOME="$marker_home" node "$installer" agents all >"$tmp_install_marker/agents.log" 2>&1) \
+      && (cd "$timeout_low" && HOME="$marker_home" node "$installer" -y >"$tmp_install_marker/timeout-low.log" 2>&1) \
+      && cp "$timeout_low/.claude/settings.json" "$tmp_install_marker/timeout-low-first.json" \
+      && (cd "$timeout_low" && HOME="$marker_home" node "$installer" -y >"$tmp_install_marker/timeout-low-second.log" 2>&1) \
+      && cmp -s "$timeout_low/.claude/settings.json" "$tmp_install_marker/timeout-low-first.json" \
+      && (cd "$timeout_high" && HOME="$marker_home" node "$installer" -y >"$tmp_install_marker/timeout-high.log" 2>&1); then
+    if python3 - "$installer" "$marker_home" "$marker_project" "$timeout_low" "$timeout_high" <<'PY'
+import json
+import pathlib
+import stat
+import sys
+
+installer = pathlib.Path(sys.argv[1])
+home = pathlib.Path(sys.argv[2])
+project = pathlib.Path(sys.argv[3])
+timeout_low = pathlib.Path(sys.argv[4])
+timeout_high = pathlib.Path(sys.argv[5])
+package = json.loads((installer.parent.parent / "package.json").read_text())
+expected = {"schemaVersion": 1, "package": package["name"], "version": package["version"]}
+roots = [
+    project / ".claude" / "skills",
+    home / ".codex" / "skills",
+    home / ".agents" / "skills",
+    home / ".grok" / "skills",
+]
+for root in roots:
+    marker = root / ".devlyn-install.json"
+    actual = json.loads(marker.read_text())
+    if actual != expected:
+        raise SystemExit(f"{marker}: expected {expected}, got {actual}")
+    if stat.S_IMODE(marker.stat().st_mode) != 0o600:
+        raise SystemExit(f"{marker}: expected mode 0600")
+    if list(root.glob(".devlyn-install.json.*.tmp")):
+        raise SystemExit(f"{root}: stale marker temp file")
+for target, expected_timeout in (
+    (project, "3600000"),
+    (timeout_low, "3600000"),
+    (timeout_high, "7200000"),
+):
+    env = json.loads((target / ".claude" / "settings.json").read_text())["env"]
+    if env.get("BASH_MAX_TIMEOUT_MS") != expected_timeout:
+        raise SystemExit(f"{target}: expected BASH_MAX_TIMEOUT_MS={expected_timeout}")
+    if "BASH_DEFAULT_TIMEOUT_MS" in env:
+        raise SystemExit(f"{target}: BASH_DEFAULT_TIMEOUT_MS must not be installed")
+PY
+    then
+      if grep -Fxq '.claude/skills/.devlyn-install.json' "$marker_project/.gitignore"; then
+        ok "managed roots have exact 0600 markers; Bash max is installed, raised, preserved, and idempotent"
+      else
+        bad "Claude project install must ignore its local marker"
+      fi
+    else
+      bad "completed installs must write the exact per-root marker"
+    fi
+  else
+    bad "isolated managed-skills install failed"
+  fi
+
+  incomplete="$tmp_install_marker/incomplete"
+  mkdir -p "$incomplete/package" "$incomplete/home/.codex/skills" "$incomplete/claude/.claude/skills" "$incomplete/codex"
+  cp -R bin config package.json "$incomplete/package/"
+  rm -rf "$incomplete/package/config/skills/devlyn:queue"
+  printf '{"version":"stale"}\n' > "$incomplete/home/.codex/skills/.devlyn-install.json"
+  printf '{"version":"stale"}\n' > "$incomplete/claude/.claude/skills/.devlyn-install.json"
+  if ! (cd "$incomplete/claude" \
+      && HOME="$incomplete/home" node "$incomplete/package/bin/devlyn.js" -y >"$incomplete/claude.log" 2>&1) \
+      && ! (cd "$incomplete/codex" \
+      && HOME="$incomplete/home" node "$incomplete/package/bin/devlyn.js" agents codex >"$incomplete/codex.log" 2>&1) \
+      && grep -Fq 'Incomplete devlyn skill install; missing: devlyn:queue' "$incomplete/claude.log" \
+      && grep -Fq 'Incomplete devlyn skill install; missing: devlyn:queue' "$incomplete/codex.log" \
+      && [ -d "$incomplete/claude/.claude/skills/devlyn:resolve" ] \
+      && [ -d "$incomplete/home/.codex/skills/devlyn:resolve" ] \
+      && [ ! -e "$incomplete/claude/.claude/skills/.devlyn-install.json" ] \
+      && [ ! -e "$incomplete/home/.codex/skills/.devlyn-install.json" ]; then
+    ok "incomplete Claude and Codex copies fail visibly without stale or replacement markers"
+  else
+    bad "incomplete Claude and Codex copies must fail visibly without an install marker"
+  fi
+  rm -rf "$tmp_install_marker"
+else
+  bad "could not allocate install-marker smoke directory"
+fi
+
 # ---------------------------------------------------------------------------
 # 6. Source ↔ installed mirror parity on critical path.
 # Only runs if .claude/skills exists (i.e. installer has been run).
@@ -292,6 +401,14 @@ check_skill_mirror_parity \
 
 # ---------------------------------------------------------------------------
 # 6b. VERIFY merge verdict binding self-test.
+for helper in role-config judge-role-evidence; do
+  if python3 "config/skills/_shared/$helper.py" --self-test >/dev/null 2>&1; then
+    ok "$helper.py self-test passed"
+  else
+    bad "$helper.py self-test failed"
+  fi
+done
+
 #     F23 full-pipeline prompt-fix rerun exposed a real failure where Codex
 #     pair-JUDGE emitted HIGH findings but state kept pair_judge as
 #     PASS_WITH_ISSUES. Routing severity must be deterministic, not prose.
@@ -302,6 +419,7 @@ if python3 config/skills/_shared/verify-merge-findings.py --self-test >/dev/null
 else
   bad "verify-merge-findings.py self-test failed"
 fi
+
 if ! grep -Fq 'def pair_trigger_skip_contract_violation' config/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq 'def pair_trigger_missing_contract_violation' config/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq 'def pair_trigger_reason_completeness_violation' config/skills/_shared/verify-merge-findings.py \
@@ -366,7 +484,6 @@ fi
 verify_merge_risk_profile_guard_missing=0
 for file in \
   config/skills/_shared/verify-merge-findings.py \
-  .claude/skills/_shared/verify-merge-findings.py \
   .agents/skills/_shared/verify-merge-findings.py; do
   if ! grep -Fq 'def risk_profile_contract_violation' "$file" \
     || ! grep -Fq 'verify-risk-profile-malformed' "$file" \
@@ -380,15 +497,52 @@ if [ $verify_merge_risk_profile_guard_missing -eq 0 ]; then
   ok "verify-merge-findings.py risk_profile shape guard is mirrored"
 fi
 
+section "Check 6b1: Process evidence runner is sealed"
+if python3 config/skills/_shared/process-evidence.py --self-test >/dev/null 2>&1; then
+  ok "process-evidence.py self-test passed"
+else
+  bad "process-evidence.py self-test failed"
+fi
+if ! grep -Fq 'PHASES = {"implement", "build_gate", "verify"}' config/skills/_shared/process-evidence.py \
+  || ! grep -Fq 'classification' config/skills/_shared/process-evidence.py \
+  || ! grep -Fq 'validate_bound_carrier' config/skills/_shared/process-evidence.py \
+  || ! grep -Fq 'validate_summary_commands' config/skills/_shared/process-evidence.py; then
+  bad "process-evidence.py must preserve phase identity, capability classification, and bound-byte validation"
+fi
+
+section "Check 6b2: Codex invocation receipts are phase-owned"
+if python3 config/skills/_shared/invocation-receipt.py --self-test >/dev/null 2>&1; then
+  ok "invocation-receipt.py self-test passed"
+else
+  bad "invocation-receipt.py self-test failed"
+fi
+if ! grep -Fq 'sandbox must remain workspace-write' config/skills/_shared/invocation-receipt.py \
+  || ! grep -Fq 'SCHEMA_VERSION = "2.0"' config/skills/_shared/invocation-receipt.py \
+  || ! grep -Fq 'sandbox_workspace_write.network_access' config/skills/_shared/invocation-receipt.py \
+  || ! grep -Fq 'forbidden Codex bypass flag' config/skills/_shared/invocation-receipt.py \
+  || ! grep -Fq 'forbidden Codex sandbox: danger-full-access' config/skills/_shared/codex-monitored.sh \
+  || ! grep -Fq 'DEVLYN_INVOCATION_RECEIPT' config/skills/_shared/codex-monitored.sh; then
+  bad "Codex invocation receipts must bind phase identity and reject authority widening"
+fi
+
 section "Check 6c: Codex stdout collection writes canonical pair findings"
 if python3 config/skills/_shared/collect-codex-findings.py --self-test >/dev/null 2>&1; then
   ok "collect-codex-findings.py self-test passed"
 else
   bad "collect-codex-findings.py self-test failed"
 fi
+# iter-0082: the frozen collector contract — every negative through every ingress
+# path, plus real judge captures replayed against hand-verified expectations.
+# The self-test above is unit-shaped; this is the integration bar against real bytes.
+if python3 benchmark/ceiling/probes/r-weld-0082/test-collector-contract.py >/dev/null 2>&1; then
+  ok "collector contract (iter-0082 negatives + real-capture corpus) passed"
+else
+  bad "collector contract failed — run benchmark/ceiling/probes/r-weld-0082/test-collector-contract.py"
+fi
 if ! grep -Fq 'def reject_json_constant' config/skills/_shared/collect-codex-findings.py \
-  || ! grep -Fq 'loads_strict_json(raw)' config/skills/_shared/collect-codex-findings.py \
-  || ! grep -Fq 'NaN Codex stdout finding must not normalize' config/skills/_shared/collect-codex-findings.py; then
+  || ! grep -Fq 'PARSER["collect_stdout"]' config/skills/_shared/collect-codex-findings.py \
+  || ! grep -Fq 'parse_constant=reject_json_constant' config/skills/_shared/judge-output-parser.py \
+  || ! grep -Fq 'NaN pair-JUDGE stdout finding' config/skills/_shared/collect-codex-findings.py; then
   bad "collect-codex-findings.py must reject non-standard JSON constants in pair-JUDGE stdout"
 fi
 
@@ -405,6 +559,7 @@ if ! grep -Fq 'SAFE_RUN_ID_RE' config/skills/_shared/archive_run.py \
   || ! grep -Fq 'invalid JSON numeric constant: NaN' config/skills/_shared/archive_run.py \
   || ! grep -Fq '"verify.pair.findings.jsonl"' config/skills/_shared/archive_run.py \
   || ! grep -Fq '"verify-merge.summary.json"' config/skills/_shared/archive_run.py \
+  || ! grep -Fq '"verify.primary.timeout.json"' config/skills/_shared/archive_run.py \
   || ! grep -Fq '"surface-close.output.json"' config/skills/_shared/archive_run.py \
   || ! grep -Fq '"*-judge.*"' config/skills/_shared/archive_run.py; then
   bad "archive_run.py must safely archive pair/risk-probe evidence and reject unsafe run ids"
@@ -417,17 +572,50 @@ if python3 config/skills/_shared/state-phase-write.py --self-test >/dev/null 2>&
 else
   bad "state-phase-write.py SURFACE_CLOSE self-test failed"
 fi
+if python3 - <<'PY'
+import ast
+import runpy
+
+entries = ["src/{a,b}/**"]
+paths = ("src/a/example.py", "src/b/example.py", "src/c/example.py")
+expected = (True, True, False)
+sources = {"path_matches_surface": [], "validate_surface_brace_glob": []}
+for name in ("state-phase-write.py", "spec-verify-check.py"):
+    path = f"config/skills/_shared/{name}"
+    module = runpy.run_path(path)
+    actual = tuple(module["path_matches_surface"](path, entries) for path in paths)
+    assert actual == expected, (name, actual)
+    tree = ast.parse(open(path, encoding="utf-8").read())
+    text = open(path, encoding="utf-8").read()
+    for function_name in sources:
+        function = next(node for node in tree.body if isinstance(node, ast.FunctionDef) and node.name == function_name)
+        sources[function_name].append(ast.get_source_segment(text, function))
+    for invalid in ("src/{a,b", "src/{a,}/**", "src/{a,{b,c}}", "src/{a,**}"):
+        try:
+            module["path_matches_surface"]("src/a/example.py", [invalid])
+        except ValueError as exc:
+            assert invalid in str(exc) and "supported form" in str(exc)
+        else:
+            raise AssertionError((name, invalid))
+for function_name, bodies in sources.items():
+    assert bodies[0] == bodies[1], f"{function_name} bodies differ"
+PY
+then
+  ok "brace-glob surface matching and errors are byte-parity checked in both consumers"
+else
+  bad "brace-glob surface matching or errors drifted between state and spec checks"
+fi
 if ! grep -Fq 'rollback_surface_delta' config/skills/_shared/state-phase-write.py \
   || ! grep -Fq 'validate_surface_adjudication' config/skills/_shared/state-phase-write.py \
   || ! grep -Fq 'validate_surface_execution' config/skills/_shared/state-phase-write.py \
   || ! grep -Fq 'phases.surface_close spawn requires --engine claude' config/skills/_shared/state-phase-write.py \
-  || ! grep -Fq 'phases.surface_close spawn requires --model' config/skills/_shared/state-phase-write.py \
+  || ! grep -Fq 'SURFACE_CLOSE requires canonical native JSON' config/skills/_shared/state-phase-write.py \
   || ! grep -Fq 'BLOCKED:surface-close-input-mismatch' config/skills/_shared/state-phase-write.py \
   || ! grep -Fq 'surface-check' config/skills/_shared/state-phase-write.py \
   || ! grep -Fq 'surface-rollback' config/skills/_shared/state-phase-write.py; then
   bad "state-phase-write.py must mechanically adjudicate, audit, guard, and roll back SURFACE_CLOSE"
 fi
-for tree in config/skills .claude/skills .agents/skills; do
+for tree in config/skills .agents/skills; do
   skill="$tree/devlyn:resolve/SKILL.md"
   phase="$tree/devlyn:resolve/references/phases/surface-close.md"
   if ! grep -Fq '## PHASE 2.5: SURFACE_CLOSE' "$skill" \
@@ -437,7 +625,7 @@ for tree in config/skills .claude/skills .agents/skills; do
     || ! grep -Fq 'auto_surface_close_claude_unavailable' "$skill" \
     || ! grep -Fq 'canonical body VERBATIM' "$skill" \
     || ! grep -Fq 'run-bounded.py 600 -- claude -p' "$skill" \
-    || ! grep -Fq -- '--tools "Read,Grep,Glob,Edit,Write" --dangerously-skip-permissions --model claude-sonnet-5 --output-format json --strict-mcp-config --mcp-config '\''{"mcpServers":{}}'\''' "$skill" \
+    || ! grep -Fq -- '--tools "Read,Grep,Glob,Edit,Write" --dangerously-skip-permissions --output-format json --strict-mcp-config --mcp-config '\''{"mcpServers":{}}'\''' "$skill" \
     || ! grep -Fq '.devlyn/surface-close.output.json' "$skill" \
     || ! grep -Fq '**Common post-fix checkpoint (BUILD_GATE and VERIFY):**' "$skill" \
     || ! grep -Fq 'durability-enforce --round <n> --origin-phase <build_gate|verify>' "$skill" \
@@ -481,16 +669,6 @@ if ! grep -Fq 'generated criteria carrier was not staged into .devlyn/spec-verif
   || ! grep -Fq 'def source_integrity_error' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'source.criteria_sha256 mismatch' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'Generated criteria were written without one' config/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'generated criteria carrier was not staged into .devlyn/spec-verify.json' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'spec source with mismatched source.spec_sha256 was accepted' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'spec source with matching source.spec_sha256 was not staged' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'source.spec_sha256 mismatch' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'generated criteria without a JSON carrier was accepted' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'generated criteria without source.criteria_sha256 was accepted' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'generated criteria with mismatched source.criteria_sha256 was accepted' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'def source_integrity_error' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'source.criteria_sha256 mismatch' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'Generated criteria were written without one' .claude/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'generated criteria carrier was not staged into .devlyn/spec-verify.json' .agents/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'spec source with mismatched source.spec_sha256 was accepted' .agents/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'spec source with matching source.spec_sha256 was not staged' .agents/skills/_shared/spec-verify-check.py \
@@ -527,27 +705,6 @@ if ! grep -Fq 'def validate_present_solo_headroom_hypothesis' config/skills/_sha
   || ! grep -Fq 'weak sibling solo-headroom hypothesis was accepted by --check-expected' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'docs-style solo-headroom hypothesis was rejected by --check' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'docs-style sibling solo-headroom command was rejected by --check-expected' config/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'def validate_present_solo_headroom_hypothesis' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'def state_requires_risk_probes' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'def risk_probes_state_error' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq -- '--include-risk-probes accepted missing required risk-probes.jsonl' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq -- '--include-risk-probes accepted non-boolean risk_probes_enabled' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq -- '--include-risk-probes accepted non-object risk_profile' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'def validate_risk_probes_cover_solo_headroom_hypothesis' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'def has_backticked_observable_miss_command' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'backticked command/observable line that exposes the miss' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'weak solo-headroom hypothesis was accepted by --check' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'descriptive backtick solo-headroom hypothesis was accepted by --check' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'risk probe missing solo-headroom command coverage was accepted' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'risk probe with unrelated solo-headroom derived_from was accepted' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'risk-probes[0].derived_from must reference the solo-headroom hypothesis bullet' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'solo-headroom command in a later risk probe was accepted' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'solo-headroom command prefix match was accepted' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq '(?<![A-Za-z0-9_.:/=-])' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'risk-probes[0].cmd must contain a solo-headroom hypothesis observable command' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'weak sibling solo-headroom hypothesis was accepted by --check-expected' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'docs-style solo-headroom hypothesis was rejected by --check' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'docs-style sibling solo-headroom command was rejected by --check-expected' .claude/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'def validate_present_solo_headroom_hypothesis' .agents/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'def state_requires_risk_probes' .agents/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'def risk_probes_state_error' .agents/skills/_shared/spec-verify-check.py \
@@ -574,29 +731,22 @@ else
   ok "spec-verify-check.py rejects weak solo-headroom hypotheses"
 fi
 if ! grep -Fq 'requires `.devlyn/risk-probes.jsonl`' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'requires `.devlyn/risk-probes.jsonl`' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'requires `.devlyn/risk-probes.jsonl`' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'missing `.devlyn/risk-probes.jsonl` is a CRITICAL mechanical blocker' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'missing `.devlyn/risk-probes.jsonl` is a CRITICAL mechanical blocker' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'missing `.devlyn/risk-probes.jsonl` is a CRITICAL mechanical blocker' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'requires that file when `state.risk_profile.risk_probes_enabled == true`' config/skills/devlyn:resolve/references/phases/build-gate.md \
-  || ! grep -Fq 'requires that file when `state.risk_profile.risk_probes_enabled == true`' .claude/skills/devlyn:resolve/references/phases/build-gate.md \
   || ! grep -Fq 'requires that file when `state.risk_profile.risk_probes_enabled == true`' .agents/skills/devlyn:resolve/references/phases/build-gate.md \
   || ! grep -Fq 'Malformed `state.risk_profile` is also CRITICAL because it can hide enabled risk probes' config/skills/devlyn:resolve/references/phases/build-gate.md \
-  || ! grep -Fq 'Malformed `state.risk_profile` is also CRITICAL because it can hide enabled risk probes' .claude/skills/devlyn:resolve/references/phases/build-gate.md \
   || ! grep -Fq 'Malformed `state.risk_profile` is also CRITICAL because it can hide enabled risk probes' .agents/skills/devlyn:resolve/references/phases/build-gate.md \
   || ! grep -Fq 'When `state.risk_profile.risk_probes_enabled == true`, missing `.devlyn/risk-probes.jsonl` is also CRITICAL' config/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq 'When `state.risk_profile.risk_probes_enabled == true`, missing `.devlyn/risk-probes.jsonl` is also CRITICAL' .claude/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq 'When `state.risk_profile.risk_probes_enabled == true`, missing `.devlyn/risk-probes.jsonl` is also CRITICAL' .agents/skills/devlyn:resolve/references/phases/verify.md; then
   bad "BUILD_GATE and VERIFY must fail closed when enabled risk probes are missing"
 else
   ok "BUILD_GATE and VERIFY require enabled risk probes"
 fi
 if grep -Fq 'or any(char.isspace() for char in stripped)' config/skills/_shared/spec-verify-check.py \
-  || grep -Fq 'or any(char.isspace() for char in stripped)' .claude/skills/_shared/spec-verify-check.py \
   || grep -Fq 'or any(char.isspace() for char in stripped)' .agents/skills/_shared/spec-verify-check.py \
   || grep -Fq 'or any(char.isspace() for char in stripped)' config/skills/_shared/verify-merge-findings.py \
-  || grep -Fq 'or any(char.isspace() for char in stripped)' .claude/skills/_shared/verify-merge-findings.py \
   || grep -Fq 'or any(char.isspace() for char in stripped)' .agents/skills/_shared/verify-merge-findings.py \
   || grep -Fq 'or any(char.isspace() for char in stripped)' benchmark/auto-resolve/scripts/pair_evidence_contract.py; then
   bad "solo-headroom command detection must not treat descriptive whitespace as a command"
@@ -604,10 +754,8 @@ else
   ok "solo-headroom command detection rejects descriptive whitespace"
 fi
 if ! grep -Fq '"printf",' config/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq '"printf",' .claude/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '"printf",' .agents/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '"printf",' config/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq '"printf",' .claude/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq '"printf",' .agents/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq '"printf",' benchmark/auto-resolve/scripts/pair_evidence_contract.py; then
   bad "solo-headroom command detection must keep explicit printf command support"
@@ -622,10 +770,8 @@ import sys
 files = [
     pathlib.Path("benchmark/auto-resolve/scripts/pair_evidence_contract.py"),
     pathlib.Path("config/skills/_shared/spec-verify-check.py"),
-    pathlib.Path(".claude/skills/_shared/spec-verify-check.py"),
     pathlib.Path(".agents/skills/_shared/spec-verify-check.py"),
     pathlib.Path("config/skills/_shared/verify-merge-findings.py"),
-    pathlib.Path(".claude/skills/_shared/verify-merge-findings.py"),
     pathlib.Path(".agents/skills/_shared/verify-merge-findings.py"),
 ]
 names = [
@@ -702,13 +848,16 @@ fi
 if ! grep -Fq '"uses_visible_input_key_names"' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '"asserts_visible_output_key_names"' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '"asserts_no_unexpected_output_keys"' config/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'shape_contract co-occurring with error_contract without' config/skills/_shared/spec-verify-check.py \
+  || ! grep -Fq 'shape_contract claiming visible exact error object without' config/skills/_shared/spec-verify-check.py \
+  || ! grep -Fq 'visible_text_names_exact_json_error_object' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'JSON error object shape_contract with exact object evidence was rejected' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'shape_contract without any evidence was accepted' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'shape_contract with exact key evidence was rejected' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '`shape_contract` when the visible text names exact keys' config/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq '`shape_contract` must' config/skills/devlyn:resolve/SKILL.md; then
-  bad "risk-probe shape contracts must require exact visible input/output key evidence unconditionally, and asserts_exact_error_object when co-occurring with error_contract/http_error_contract"
+  || ! grep -Fq 'visible_text_names_exact_json_error_object' config/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq '`shape_contract` must' config/skills/devlyn:resolve/SKILL.md \
+  || ! grep -Fq 'visible_text_names_exact_json_error_object' config/skills/devlyn:resolve/SKILL.md; then
+  bad "risk-probe shape contracts must require exact visible input/output key evidence unconditionally, and asserts_exact_error_object when the probe claims the visible text names an exact JSON error object"
 fi
 if ! grep -Fq '"auth_signature_contract"' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '"idempotency_replay"' config/skills/_shared/spec-verify-check.py \
@@ -751,40 +900,28 @@ if [ $expected_check_missing -eq 0 ]; then
   ok "ideate docs require --check-expected for sibling expected contracts"
 fi
 if ! grep -Fq 'any present actionable solo-headroom hypothesis' config/skills/devlyn:ideate/SKILL.md \
-  || ! grep -Fq 'any present actionable solo-headroom hypothesis' .claude/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'any present actionable solo-headroom hypothesis' .agents/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'any present actionable solo-headroom hypothesis' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'any present actionable solo-headroom hypothesis' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'any present actionable solo-headroom hypothesis' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'any present actionable solo-headroom hypothesis' config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'any present actionable solo-headroom hypothesis' .claude/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'any present actionable solo-headroom hypothesis' .agents/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'any present actionable solo-headroom hypothesis' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'any present actionable solo-headroom hypothesis' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'any present actionable solo-headroom hypothesis' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq "legacy inline \`## Verification\` JSON carrier" config/skills/devlyn:ideate/SKILL.md \
-  || ! grep -Fq "legacy inline \`## Verification\` JSON carrier" .claude/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq "legacy inline \`## Verification\` JSON carrier" .agents/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq "legacy inline \`## Verification\` JSON carrier" config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq "legacy inline \`## Verification\` JSON carrier" .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq "legacy inline \`## Verification\` JSON carrier" .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq "legacy inline \`## Verification\` JSON carrier" config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq "legacy inline \`## Verification\` JSON carrier" .claude/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq "legacy inline \`## Verification\` JSON carrier" .agents/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq "inline \`## Verification\` JSON carrier" config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq "inline \`## Verification\` JSON carrier" .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq "inline \`## Verification\` JSON carrier" .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' config/skills/devlyn:ideate/SKILL.md \
-  || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .claude/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .agents/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .claude/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .agents/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .agents/skills/devlyn:resolve/SKILL.md; then
   bad "ideate/resolve docs must describe mechanical solo-headroom validation"
 else
@@ -805,18 +942,6 @@ if ! grep -Fq 'def validate_expected_against_sibling_spec' config/skills/_shared
   || ! grep -Fq 'actionable solo ceiling avoidance was rejected by --check' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'weak sibling solo ceiling avoidance was accepted by --check-expected' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'actionable sibling solo ceiling avoidance was rejected by --check-expected' config/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'backticked_observable_miss_commands(spec_text)' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'observable command must match spec.expected.json' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'observable command must match `## Verification` JSON carrier' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'mismatched inline solo-headroom command was accepted by --check' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'matched inline solo-headroom command was rejected by --check' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'mismatched sibling solo-headroom command was accepted by --check-expected' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'matched sibling solo-headroom command was rejected by --check-expected' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'def validate_present_solo_ceiling_avoidance' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'weak solo ceiling avoidance was accepted by --check' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'actionable solo ceiling avoidance was rejected by --check' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'weak sibling solo ceiling avoidance was accepted by --check-expected' .claude/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'actionable sibling solo ceiling avoidance was rejected by --check-expected' .claude/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'backticked_observable_miss_commands(spec_text)' .agents/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'observable command must match spec.expected.json' .agents/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'observable command must match `## Verification` JSON carrier' .agents/skills/_shared/spec-verify-check.py \
@@ -833,147 +958,106 @@ if ! grep -Fq 'def validate_expected_against_sibling_spec' config/skills/_shared
 fi
 if ! grep -Fq 'Verification includes at least one compound scenario that exercises the interaction end-to-end' \
   config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'Verification includes at least one compound scenario that exercises the interaction end-to-end' \
-    .claude/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'Verification includes at least one compound scenario that exercises the interaction end-to-end' \
-    .agents/skills/devlyn:ideate/references/spec-template.md; then
+  || ! grep -Fq 'Verification includes at least one compound scenario that exercises the interaction end-to-end' .agents/skills/devlyn:ideate/references/spec-template.md; then
   bad "ideate spec template must require compound interaction verification for pair-relevant high-risk specs"
 else
   ok "ideate spec template requires compound interaction verification for pair-relevant specs"
 fi
 if ! grep -Fq 'ask for one concrete compound' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'ask for one concrete compound' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'ask for one concrete compound' .agents/skills/devlyn:ideate/references/elicitation.md; then
   bad "ideate elicitation must ask for compound interaction scenarios when pair-relevant risks appear"
 else
   ok "ideate elicitation asks for compound interaction scenarios when pair-relevant risks appear"
 fi
 if ! grep -Fq 'solo-headroom hypothesis inside `## Verification`' config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'solo-headroom hypothesis inside `## Verification`' .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'solo-headroom hypothesis inside `## Verification`' .agents/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'ask for one solo-headroom hypothesis' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'ask for one solo-headroom hypothesis' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'ask for one solo-headroom hypothesis' .agents/skills/devlyn:ideate/references/elicitation.md; then
   bad "ideate must require a visible solo-headroom hypothesis for benchmark and pair-evidence specs"
 else
   ok "ideate requires solo-headroom hypothesis for benchmark and pair-evidence specs"
 fi
 if ! grep -Fq 'must literally contain `solo-headroom hypothesis`' config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'must literally contain `solo-headroom hypothesis`' .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'must literally contain `solo-headroom hypothesis`' .agents/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'backticked line itself must contain `miss`' config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'backticked line itself must contain `miss`' .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'backticked line itself must contain `miss`' .agents/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq '`solo_claude`, `miss`, and a backticked observable command' config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq '`solo_claude`, `miss`, and a backticked observable command' .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq '`solo_claude`, `miss`, and a backticked observable command' .agents/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'command/observable' config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'command/observable' .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'command/observable' .agents/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'must literally contain `solo-headroom hypothesis`' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'must literally contain `solo-headroom hypothesis`' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'must literally contain `solo-headroom hypothesis`' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'line itself must contain `miss`' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'line itself must contain `miss`' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'line itself must contain `miss`' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'Do not write a benchmark/risk-probe/pair-evidence spec until this' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'Do not write a benchmark/risk-probe/pair-evidence spec until this' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'Do not write a benchmark/risk-probe/pair-evidence spec until this' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'spec not ready — solo-headroom hypothesis required' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'spec not ready — solo-headroom hypothesis required' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'spec not ready — solo-headroom hypothesis required' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq '`solo_claude`, `miss`, and a backticked observable command' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq '`solo_claude`, `miss`, and a backticked observable command' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq '`solo_claude`, `miss`, and a backticked observable command' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'command/observable' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'command/observable' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'command/observable' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'Verification literally contains `solo-headroom hypothesis`, `solo_claude`' config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'Verification literally contains `solo-headroom hypothesis`, `solo_claude`' .claude/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'Verification literally contains `solo-headroom hypothesis`, `solo_claude`' .agents/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'backticked line itself must contain `miss`' config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'backticked line itself must contain `miss`' .claude/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'backticked line itself must contain `miss`' .agents/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'command/observable' config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'command/observable' .claude/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'command/observable' .agents/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .claude/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .agents/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq "source for VERIFY's canonical \`spec.solo_headroom_hypothesis\` trigger reason" config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq "source for VERIFY's canonical \`spec.solo_headroom_hypothesis\` trigger reason" .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq "source for VERIFY's canonical \`spec.solo_headroom_hypothesis\` trigger reason" .agents/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'spec.expected.json.verification_commands[].cmd' .agents/skills/devlyn:ideate/references/spec-template.md; then
   bad "ideate solo-headroom hypothesis prompt must match the actionable checker contract"
 else
   ok "ideate solo-headroom hypothesis prompt matches checker contract"
 fi
 if ! grep -Fq 'quick mode must not infer a solo-headroom hypothesis' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'quick mode must not infer a solo-headroom hypothesis' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'quick mode must not infer a solo-headroom hypothesis' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'do not infer a solo-headroom hypothesis' config/skills/devlyn:ideate/SKILL.md \
-  || ! grep -Fq 'do not infer a solo-headroom hypothesis' .claude/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'do not infer a solo-headroom hypothesis' .agents/skills/devlyn:ideate/SKILL.md; then
   bad "ideate quick mode must not invent solo-headroom hypotheses"
 else
   ok "ideate quick mode does not invent solo-headroom hypotheses"
 fi
 if ! grep -Fq 'solo ceiling avoidance' config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'solo ceiling avoidance' .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'solo ceiling avoidance' .agents/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'rejected or solo-saturated controls such as `S2`-`S6`' config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'rejected or solo-saturated controls such as `S2`-`S6`' .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'rejected or solo-saturated controls such as `S2`-`S6`' .agents/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'Solo ceiling avoidance' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'Solo ceiling avoidance' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'Solo ceiling avoidance' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'spec not ready — solo ceiling avoidance required' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'spec not ready — solo ceiling avoidance required' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'spec not ready — solo ceiling avoidance required' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'pair-evidence not ready — Pair-candidate headroom is unproven until the spec states solo ceiling avoidance' config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'pair-evidence not ready — Pair-candidate headroom is unproven until the spec states solo ceiling avoidance' .claude/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'pair-evidence not ready — Pair-candidate headroom is unproven until the spec states solo ceiling avoidance' .agents/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'also do not infer solo ceiling avoidance' config/skills/devlyn:ideate/SKILL.md \
-  || ! grep -Fq 'also do not infer solo ceiling avoidance' .claude/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'also do not infer solo ceiling avoidance' .agents/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'per-feature Verification must also include a solo ceiling avoidance note' config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'per-feature Verification must also include a solo ceiling avoidance note' .claude/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'per-feature Verification must also include a solo ceiling avoidance note' .agents/skills/devlyn:ideate/references/project-mode.md; then
   bad "ideate must require solo ceiling avoidance for new unmeasured pair candidates"
 else
   ok "ideate requires solo ceiling avoidance for new unmeasured pair candidates"
 fi
 if ! grep -Fq 'complexity: medium' config/skills/devlyn:ideate/references/spec-template.md \
-  || ! grep -Fq 'complexity: medium' .claude/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'complexity: medium' .agents/skills/devlyn:ideate/references/spec-template.md \
   || ! grep -Fq 'Complexity signal' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'Complexity signal' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'Complexity signal' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'downstream VERIFY pair-trigger signal' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'downstream VERIFY pair-trigger signal' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'downstream VERIFY pair-trigger signal' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'complexity=medium default' config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'complexity=medium default' .claude/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'complexity=medium default' .agents/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'supported `complexity` frontmatter' config/skills/devlyn:ideate/SKILL.md \
-  || ! grep -Fq 'supported `complexity` frontmatter' .claude/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'supported `complexity` frontmatter' .agents/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'supported `complexity` frontmatter' config/skills/devlyn:ideate/references/elicitation.md \
-  || ! grep -Fq 'supported `complexity` frontmatter' .claude/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'supported `complexity` frontmatter' .agents/skills/devlyn:ideate/references/elicitation.md \
   || ! grep -Fq 'supported `complexity` frontmatter' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'supported `complexity` frontmatter' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'supported `complexity` frontmatter' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'sibling spec `complexity` frontmatter' config/skills/devlyn:ideate/SKILL.md \
-  || ! grep -Fq 'sibling spec `complexity` frontmatter' .claude/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'sibling spec `complexity` frontmatter' .agents/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'sibling spec `complexity` frontmatter' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'sibling spec `complexity` frontmatter' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'sibling spec `complexity` frontmatter' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'Frontmatter has `id`, `title`, `kind`, `status: planned`, `complexity`' config/skills/devlyn:ideate/SKILL.md \
-  || ! grep -Fq 'Frontmatter has `id`, `title`, `kind`, `status: planned`, `complexity`' .claude/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'Frontmatter has `id`, `title`, `kind`, `status: planned`, `complexity`' .agents/skills/devlyn:ideate/SKILL.md; then
   bad "ideate specs must emit complexity frontmatter for resolve pair triggers"
 else
@@ -981,163 +1065,97 @@ else
 fi
 if ! grep -Fq 'warning: Verification may need one compound end-to-end scenario before pair-relevant risks are measurable' \
   config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'warning: Verification may need one compound end-to-end scenario before pair-relevant risks are measurable' \
-    .claude/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'warning: Verification may need one compound end-to-end scenario before pair-relevant risks are measurable' \
-    .agents/skills/devlyn:ideate/references/from-spec-mode.md; then
+  || ! grep -Fq 'warning: Verification may need one compound end-to-end scenario before pair-relevant risks are measurable' .agents/skills/devlyn:ideate/references/from-spec-mode.md; then
   bad "ideate from-spec mode must warn when preserved high-risk specs lack compound verification"
 else
   ok "ideate from-spec mode warns on pair-relevant specs with weak verification"
 fi
 if ! grep -Fq 'pair-evidence not ready — Pair-candidate headroom is unproven until the spec states a solo-headroom hypothesis' \
   config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'pair-evidence not ready — Pair-candidate headroom is unproven until the spec states a solo-headroom hypothesis' \
-    .claude/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'pair-evidence not ready — Pair-candidate headroom is unproven until the spec states a solo-headroom hypothesis' \
-    .agents/skills/devlyn:ideate/references/from-spec-mode.md \
+  || ! grep -Fq 'pair-evidence not ready — Pair-candidate headroom is unproven until the spec states a solo-headroom hypothesis' .agents/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'Do not call' config/skills/devlyn:ideate/references/from-spec-mode.md \
-  || ! grep -Fq 'Do not call' .claude/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'Do not call' .agents/skills/devlyn:ideate/references/from-spec-mode.md \
   || ! grep -Fq 'announcement must say `pair-evidence not ready`' config/skills/devlyn:ideate/SKILL.md \
-  || ! grep -Fq 'announcement must say `pair-evidence not ready`' .claude/skills/devlyn:ideate/SKILL.md \
   || ! grep -Fq 'announcement must say `pair-evidence not ready`' .agents/skills/devlyn:ideate/SKILL.md; then
   bad "ideate from-spec mode must warn when pair-candidate specs lack solo-headroom hypothesis"
 else
   ok "ideate from-spec mode warns on missing solo-headroom hypothesis"
 fi
 if ! grep -Fq 'per-feature Verification must' config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'per-feature Verification must' .claude/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'per-feature Verification must' .agents/skills/devlyn:ideate/references/project-mode.md; then
   bad "ideate project mode must require compound verification inside each pair-relevant feature spec"
 else
   ok "ideate project mode keeps compound verification inside pair-relevant feature specs"
 fi
 if ! grep -Fq 'per-feature Verification must include a solo-headroom' config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'per-feature Verification must include a solo-headroom' .claude/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'per-feature Verification must include a solo-headroom' .agents/skills/devlyn:ideate/references/project-mode.md \
-  || rg -q 'Context or Verification' config/skills/devlyn:ideate/references .claude/skills/devlyn:ideate/references .agents/skills/devlyn:ideate/references; then
+  || grep -rq 'Context or Verification' config/skills/devlyn:ideate/references .agents/skills/devlyn:ideate/references; then
   bad "ideate project mode must keep solo-headroom hypothesis inside each pair-candidate feature spec"
 else
   ok "ideate project mode keeps solo-headroom hypothesis inside each pair-candidate feature spec"
 fi
-if ! grep -Fq 'feature spec must literally contain' \
-  config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'feature spec must literally contain' \
-    .claude/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'feature spec must literally contain' \
-    .agents/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq '`solo-headroom hypothesis`, `solo_claude`, `miss`, and a backticked' \
-    config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq '`solo-headroom hypothesis`, `solo_claude`, `miss`, and a backticked' \
-    .claude/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq '`solo-headroom hypothesis`, `solo_claude`, `miss`, and a backticked' \
-    .agents/skills/devlyn:ideate/references/project-mode.md \
+if ! grep -Fq 'feature spec must literally contain' config/skills/devlyn:ideate/references/project-mode.md \
+  || ! grep -Fq 'feature spec must literally contain' .agents/skills/devlyn:ideate/references/project-mode.md \
+  || ! grep -Fq '`solo-headroom hypothesis`, `solo_claude`, `miss`, and a backticked' config/skills/devlyn:ideate/references/project-mode.md \
+  || ! grep -Fq '`solo-headroom hypothesis`, `solo_claude`, `miss`, and a backticked' .agents/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'behavior a capable' config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'behavior a capable' .claude/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'behavior a capable' .agents/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'backticked line itself must' config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'backticked line itself must' .claude/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'backticked line itself must' .agents/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'command/observable' \
-    config/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'command/observable' \
-    .claude/skills/devlyn:ideate/references/project-mode.md \
-  || ! grep -Fq 'command/observable' \
-    .agents/skills/devlyn:ideate/references/project-mode.md; then
+  || ! grep -Fq 'command/observable' config/skills/devlyn:ideate/references/project-mode.md \
+  || ! grep -Fq 'command/observable' .agents/skills/devlyn:ideate/references/project-mode.md; then
   bad "ideate project mode solo-headroom prompt must keep the actionable checker contract"
 else
   ok "ideate project mode solo-headroom prompt keeps checker contract"
 fi
 
-if ! grep -Fq 'If the visible spec includes a solo-headroom hypothesis, the first probe must' \
-  config/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'If the visible spec includes a solo-headroom hypothesis, the first probe must' \
-    .claude/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'If the visible spec includes a solo-headroom hypothesis, the first probe must' \
-    .agents/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'When the visible spec includes a solo-headroom hypothesis, the first probe must' \
-    config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'When the visible spec includes a solo-headroom hypothesis, the first probe must' \
-    .claude/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'When the visible spec includes a solo-headroom hypothesis, the first probe must' \
-    .agents/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'its `cmd` must contain the hypothesis'\''s backticked' \
-    config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'its `cmd` must contain the hypothesis'\''s backticked' \
-    .claude/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'its `cmd` must contain the hypothesis'\''s backticked' \
-    .agents/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'its `derived_from` must reference the hypothesis bullet' \
-    config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'its `derived_from` must reference the hypothesis bullet' \
-    .claude/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'its `derived_from` must reference the hypothesis bullet' \
-    .agents/skills/devlyn:resolve/SKILL.md; then
+if ! grep -Fq 'If the visible spec includes a solo-headroom hypothesis, the first probe must' config/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq 'If the visible spec includes a solo-headroom hypothesis, the first probe must' .agents/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq 'When the visible spec includes a solo-headroom hypothesis, the first probe must' config/skills/devlyn:resolve/SKILL.md \
+  || ! grep -Fq 'When the visible spec includes a solo-headroom hypothesis, the first probe must' .agents/skills/devlyn:resolve/SKILL.md \
+  || ! grep -Fq 'its `cmd` must contain the hypothesis'\''s backticked' config/skills/devlyn:resolve/SKILL.md \
+  || ! grep -Fq 'its `cmd` must contain the hypothesis'\''s backticked' .agents/skills/devlyn:resolve/SKILL.md \
+  || ! grep -Fq 'its `derived_from` must reference the hypothesis bullet' config/skills/devlyn:resolve/SKILL.md \
+  || ! grep -Fq 'its `derived_from` must reference the hypothesis bullet' .agents/skills/devlyn:resolve/SKILL.md; then
   bad "resolve risk-probe prompts must consume solo-headroom hypothesis before pair-evidence work"
 else
   ok "resolve risk-probe prompts consume solo-headroom hypothesis"
 fi
-if ! grep -Fq 'the behavior the spec says `solo_claude` is expected to miss' \
-  config/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'the behavior the spec says `solo_claude` is expected to miss' \
-    .claude/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'the behavior the spec says `solo_claude` is expected to miss' \
-    .agents/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'exercise the stated `solo_claude` miss' \
-    config/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'exercise the stated `solo_claude` miss' \
-    .claude/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'exercise the stated `solo_claude` miss' \
-    .agents/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'with a `cmd` containing the hypothesis'\''s' \
-    config/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'with a `cmd` containing the hypothesis'\''s' \
-    .claude/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq 'with a `cmd` containing the hypothesis'\''s' \
-    .agents/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq '`derived_from` pointing at the hypothesis' \
-    config/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq '`derived_from` pointing at the hypothesis' \
-    .claude/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq '`derived_from` pointing at the hypothesis' \
-    .agents/skills/devlyn:resolve/references/phases/probe-derive.md; then
+if ! grep -Fq 'the behavior the spec says `solo_claude` is expected to miss' config/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq 'the behavior the spec says `solo_claude` is expected to miss' .agents/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq 'exercise the stated `solo_claude` miss' config/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq 'exercise the stated `solo_claude` miss' .agents/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq 'with a `cmd` containing the hypothesis'\''s' config/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq 'with a `cmd` containing the hypothesis'\''s' .agents/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq '`derived_from` pointing at the hypothesis' config/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq '`derived_from` pointing at the hypothesis' .agents/skills/devlyn:resolve/references/phases/probe-derive.md; then
   bad "resolve risk-probe solo-headroom prompt must target the stated solo_claude miss"
 else
   ok "resolve risk-probe solo-headroom prompt targets the stated solo_claude miss"
 fi
-if ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one of the two targeted' \
+if ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one targeted review must use' \
   config/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one of the two targeted' \
-    .claude/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one of the two targeted' \
+  || ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one targeted review must use' \
     .agents/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one of those targeted probes must' \
+  || ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one targeted review must use' \
     config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one of those targeted probes must' \
-    .claude/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one of those targeted probes must' \
+  || ! grep -Fq 'If the spec includes a solo-headroom hypothesis, one targeted review must use' \
     .agents/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'using the hypothesis'\''s backticked observable command as its command anchor' \
+  || ! grep -Fq 'hypothesis'\''s backticked observable command as the exact anchor' \
     config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'using the hypothesis'\''s backticked observable command as its command anchor' \
-    .claude/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'using the hypothesis'\''s backticked observable command as its command anchor' \
+  || ! grep -Fq 'hypothesis'\''s backticked observable command as the exact anchor' \
     .agents/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'hypothesis'\''s backticked observable command as its command anchor' \
+  || ! grep -Fq 'hypothesis'\''s backticked observable command as its exact anchor' \
     config/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq 'hypothesis'\''s backticked observable command as its command anchor' \
-    .claude/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq 'hypothesis'\''s backticked observable command as its command anchor' \
+  || ! grep -Fq 'hypothesis'\''s backticked observable command as its exact anchor' \
     .agents/skills/devlyn:resolve/references/phases/verify.md; then
   bad "resolve pair-JUDGE prompts must prioritize solo-headroom hypothesis"
 else
   ok "resolve pair-JUDGE prompts prioritize solo-headroom hypothesis"
 fi
 if ! grep -Fq 'The `--engine` flag does not disable default pairing' config/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq 'The `--engine` flag does not disable default pairing' .claude/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq 'The `--engine` flag does not disable default pairing' .agents/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq 'the second judge uses the OTHER engine by default when available' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'the second judge uses the OTHER engine by default when available' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'the second judge uses the OTHER engine by default when available' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq '_shared/adapters/<name>.md' config/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq '`## Invocation`' config/skills/devlyn:resolve/references/phases/verify.md \
@@ -1149,22 +1167,16 @@ else
   ok "engine-neutral pair-judge dual declaration (iter-0060) in sync"
 fi
 if ! grep -Fq '`complexity.high`, `complexity.large`' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq '`complexity.high`, `complexity.large`' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq '`complexity.high`, `complexity.large`' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq '`spec.complexity.high`, `spec.complexity.large`' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq '`spec.complexity.high`, `spec.complexity.large`' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq '`spec.complexity.high`, `spec.complexity.large`' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'Legacy complexity values remain accepted only for archived compatibility' config/skills/devlyn:resolve/references/state-schema.md \
-  || ! grep -Fq 'Legacy complexity values remain accepted only for archived compatibility' .claude/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq 'Legacy complexity values remain accepted only for archived compatibility' .agents/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq '`complexity.high`, `complexity.large`, `spec.complexity.high`, `spec.complexity.large`' config/skills/devlyn:resolve/references/state-schema.md \
-  || ! grep -Fq '`complexity.high`, `complexity.large`, `spec.complexity.high`, `spec.complexity.large`' .claude/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq '`complexity.high`, `complexity.large`, `spec.complexity.high`, `spec.complexity.large`' .agents/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq '`complexity.large`, `spec.complexity.high`, `spec.complexity.large`,' config/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq '`complexity.large`, `spec.complexity.high`, `spec.complexity.large`,' .claude/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq '`complexity.large`, `spec.complexity.high`, `spec.complexity.large`,' .agents/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq '`spec.solo_headroom_hypothesis`, `risk.high`, `risk_probes.enabled`,' config/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq '`spec.solo_headroom_hypothesis`, `risk.high`, `risk_probes.enabled`,' .claude/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq '`spec.solo_headroom_hypothesis`, `risk.high`, `risk_probes.enabled`,' .agents/skills/devlyn:resolve/references/phases/verify.md; then
   bad "resolve VERIFY docs must distinguish current large complexity, legacy high state, and legacy large spec compatibility"
 else
@@ -1187,23 +1199,6 @@ if ! grep -Fq 'def spec_has_solo_headroom_hypothesis' config/skills/_shared/veri
   || ! grep -Fq 'spec_has_solo_headroom_hypothesis(' config/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq ') is False' config/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq ') is True' config/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'def spec_has_solo_headroom_hypothesis' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'spec.solo_headroom_hypothesis' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'and "solo_claude" in lower' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'and "miss" in lower' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'OBSERVABLE_COMMAND_MARKERS = ("command", "observable", "expose")' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'def is_command_like_backtick' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'for key in ("spec_path", "criteria_path")' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'has_backticked_observable_command(text)' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'Observable command: `node check.js` exposes behavior' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'observable `SOLO_CLAUDE` exposes the miss' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'observable `priority rollback` exposes the miss' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'implementation token `rollback`' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq '`SOLO_CLAUDE` should miss' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq '{"source": {"criteria_path": str(criteria_path)}}' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq 'spec_has_solo_headroom_hypothesis(' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq ') is False' .claude/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq ') is True' .claude/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq 'def spec_has_solo_headroom_hypothesis' .agents/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq 'spec.solo_headroom_hypothesis' .agents/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq 'and "solo_claude" in lower' .agents/skills/_shared/verify-merge-findings.py \
@@ -1221,63 +1216,43 @@ if ! grep -Fq 'def spec_has_solo_headroom_hypothesis' config/skills/_shared/veri
   || ! grep -Fq 'spec_has_solo_headroom_hypothesis(' .agents/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq ') is False' .agents/skills/_shared/verify-merge-findings.py \
   || ! grep -Fq ') is True' .agents/skills/_shared/verify-merge-findings.py \
-  || ! grep -Fq '`spec.solo_headroom_hypothesis`' \
-    config/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq '`spec.solo_headroom_hypothesis`' \
-    .claude/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq '`spec.solo_headroom_hypothesis`' \
-    .agents/skills/devlyn:resolve/references/phases/verify.md \
+  || ! grep -Fq '`spec.solo_headroom_hypothesis`' config/skills/devlyn:resolve/references/phases/verify.md \
+  || ! grep -Fq '`spec.solo_headroom_hypothesis`' .agents/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq '`spec.solo_headroom_hypothesis`' config/skills/devlyn:resolve/references/state-schema.md \
-  || ! grep -Fq '`spec.solo_headroom_hypothesis`' .claude/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq '`spec.solo_headroom_hypothesis`' .agents/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq 'same actionable solo-headroom hypothesis is a VERIFY pair-trigger reason' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'same actionable solo-headroom hypothesis is a VERIFY pair-trigger reason' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'same actionable solo-headroom hypothesis is a VERIFY pair-trigger reason' .agents/skills/devlyn:resolve/SKILL.md; then
   bad "resolve VERIFY pair trigger must include actionable solo-headroom hypothesis specs"
 else
   ok "resolve VERIFY pair trigger includes actionable solo-headroom hypothesis specs"
 fi
 if ! grep -Fq 'pair_evidence_intent' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'pair_evidence_intent' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'pair_evidence_intent' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'has_actionable_solo_headroom' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'has_actionable_solo_headroom' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'has_actionable_solo_headroom' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'state.source.type = "generated"' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'state.source.type = "generated"' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'state.source.type = "generated"' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'state.source.criteria_path = ".devlyn/criteria.generated.md"' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'state.source.criteria_path = ".devlyn/criteria.generated.md"' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'state.source.criteria_path = ".devlyn/criteria.generated.md"' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'state.source.criteria_sha256' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'state.source.criteria_sha256' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'state.source.criteria_sha256' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'state.source.criteria_sha256` for generated free-form mode' config/skills/devlyn:resolve/references/phases/verify.md \
-  || ! grep -Fq 'state.source.criteria_sha256` for generated free-form mode' .claude/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq 'state.source.criteria_sha256` for generated free-form mode' .agents/skills/devlyn:resolve/references/phases/verify.md \
   || ! grep -Fq 'Free-form sets `type: "generated"`' config/skills/devlyn:resolve/references/state-schema.md \
-  || ! grep -Fq 'Free-form sets `type: "generated"`' .claude/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq 'Free-form sets `type: "generated"`' .agents/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq 'backticked observable command line that itself contains `miss`' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'backticked observable command line that itself contains `miss`' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'backticked observable command line that itself contains `miss`' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'BLOCKED:solo-headroom-hypothesis-required' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'BLOCKED:solo-headroom-hypothesis-required' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'BLOCKED:solo-headroom-hypothesis-required' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'pair-evidence intent without an actionable solo-headroom hypothesis must halt' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'pair-evidence intent without an actionable solo-headroom hypothesis must halt' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'pair-evidence intent without an actionable solo-headroom hypothesis must halt' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'preserve that literal hypothesis in `.devlyn/criteria.generated.md`' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'preserve that literal hypothesis in `.devlyn/criteria.generated.md`' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'preserve that literal hypothesis in `.devlyn/criteria.generated.md`' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'emit the canonical `spec.solo_headroom_hypothesis` pair trigger reason' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'emit the canonical `spec.solo_headroom_hypothesis` pair trigger reason' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'emit the canonical `spec.solo_headroom_hypothesis` pair trigger reason' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq '/devlyn:ideate` guidance for `BLOCKED:solo-headroom-hypothesis-required`' config/skills/devlyn:resolve/references/state-schema.md \
-  || ! grep -Fq '/devlyn:ideate` guidance for `BLOCKED:solo-headroom-hypothesis-required`' .claude/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq '/devlyn:ideate` guidance for `BLOCKED:solo-headroom-hypothesis-required`' .agents/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq '/devlyn:ideate` guidance after `BLOCKED:solo-headroom-hypothesis-required`' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq '/devlyn:ideate` guidance after `BLOCKED:solo-headroom-hypothesis-required`' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq '/devlyn:ideate` guidance after `BLOCKED:solo-headroom-hypothesis-required`' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'Free-form goals that ask for benchmark evidence, pair-evidence, risk-probe' README.md \
   || ! grep -Fq '`/devlyn:resolve` stops with `BLOCKED:solo-headroom-hypothesis-required`' README.md \
@@ -1287,22 +1262,16 @@ else
   ok "resolve free-form mode blocks pair-evidence goals without actionable solo-headroom hypothesis"
 fi
 if ! grep -Fq 'unmeasured_pair_candidate_intent' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'unmeasured_pair_candidate_intent' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'unmeasured_pair_candidate_intent' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'has_solo_ceiling_avoidance' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'has_solo_ceiling_avoidance' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'has_solo_ceiling_avoidance' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'BLOCKED:solo-ceiling-avoidance-required' config/skills/devlyn:resolve/references/free-form-mode.md \
-  || ! grep -Fq 'BLOCKED:solo-ceiling-avoidance-required' .claude/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'BLOCKED:solo-ceiling-avoidance-required' .agents/skills/devlyn:resolve/references/free-form-mode.md \
   || ! grep -Fq 'unmeasured pair-candidate intent without solo ceiling avoidance must halt' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq 'unmeasured pair-candidate intent without solo ceiling avoidance must halt' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq 'unmeasured pair-candidate intent without solo ceiling avoidance must halt' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq '/devlyn:ideate` guidance after `BLOCKED:solo-ceiling-avoidance-required`' config/skills/devlyn:resolve/SKILL.md \
-  || ! grep -Fq '/devlyn:ideate` guidance after `BLOCKED:solo-ceiling-avoidance-required`' .claude/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq '/devlyn:ideate` guidance after `BLOCKED:solo-ceiling-avoidance-required`' .agents/skills/devlyn:resolve/SKILL.md \
   || ! grep -Fq '/devlyn:ideate` guidance for `BLOCKED:solo-ceiling-avoidance-required`' config/skills/devlyn:resolve/references/state-schema.md \
-  || ! grep -Fq '/devlyn:ideate` guidance for `BLOCKED:solo-ceiling-avoidance-required`' .claude/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq '/devlyn:ideate` guidance for `BLOCKED:solo-ceiling-avoidance-required`' .agents/skills/devlyn:resolve/references/state-schema.md \
   || ! grep -Fq '`/devlyn:resolve` stops with `BLOCKED:solo-ceiling-avoidance-required`' README.md; then
   bad "resolve free-form mode must block new unmeasured pair candidates without solo ceiling avoidance"
@@ -1367,11 +1336,61 @@ if [ $verify_mech_missing -eq 0 ]; then
   ok "spec-verify VERIFY output routes into verify-merge-findings.py"
 fi
 
+section "Check 6i1: Verification provenance contract is wired"
+verification_provenance_missing=0
+for file in \
+  config/skills/devlyn:resolve/SKILL.md \
+  .agents/skills/devlyn:resolve/SKILL.md
+do
+  if ! grep -Fq 'resolved BUILD_GATE engine through the fresh-worker route' "$file" \
+    || ! grep -Fq 'BLOCKED:build-env-underprovisioned' "$file" \
+    || ! grep -Fq '.devlyn/<primary-engine>-judge.stdout' "$file" \
+    || ! grep -Fq '.devlyn/<other-engine>-judge.stdout' "$file" \
+    || ! grep -Fq 'state-bound process-evidence manifest/raw stream' "$file"; then
+    bad "$file — orchestrator provenance/capability/archive contract missing"
+    verification_provenance_missing=1
+  fi
+done
+for file in \
+  config/skills/devlyn:resolve/references/phases/verify.md \
+  .agents/skills/devlyn:resolve/references/phases/verify.md
+do
+  if ! grep -Fq 'executable verification belongs exclusively to MECHANICAL' "$file" \
+    || ! grep -Fq 'native read/search tools or non-mutating shell commands' "$file" \
+    || ! grep -Fq 'JUDGE does not execute literal verification, lint, test, build, risk-probe, or' "$file" \
+    || ! grep -Fq 'newly invented interaction commands.' "$file" \
+    || ! grep -Fq '.devlyn/<primary-engine>-judge.stdout' "$file" \
+    || ! grep -Fq '.devlyn/<other-engine>-judge.stdout' "$file" \
+    || ! grep -Fq 'process-evidence manifest and raw stdout/stderr streams' "$file"; then
+    bad "$file — JUDGE sealed-evidence contract missing"
+    verification_provenance_missing=1
+  fi
+  if grep -Fq 'execute at least one combined adversarial check' "$file" \
+    || grep -Fq 'Execute at most two targeted probes' "$file" \
+    || grep -Fq "repo's CLI/API/test runner" "$file"; then
+    bad "$file — stale JUDGE command-execution instruction remains"
+    verification_provenance_missing=1
+  fi
+done
+for file in \
+  config/skills/devlyn:resolve/SKILL.md \
+  .agents/skills/devlyn:resolve/SKILL.md \
+  config/skills/devlyn:resolve/references/phases/verify.md \
+  .agents/skills/devlyn:resolve/references/phases/verify.md
+do
+  if grep -Eiq 'executes? no commands|no code-mutation or command-execution tools|do not receive command-execution tools' "$file"; then
+    bad "$file — blanket JUDGE inspection prohibition remains"
+    verification_provenance_missing=1
+  fi
+done
+if [ $verification_provenance_missing -eq 0 ]; then
+  ok "BUILD_GATE, sealed JUDGE inputs, canonical captures, and archive flow are wired"
+fi
+
 section "Check 6j: VERIFY default pair dispatches concurrently"
 pair_trigger_order_missing=0
 for file in \
   config/skills/devlyn:resolve/SKILL.md \
-  .claude/skills/devlyn:resolve/SKILL.md \
   .agents/skills/devlyn:resolve/SKILL.md
 do
   if ! grep -Fq 'Verify dual-judge is default-when-available' "$file" \
@@ -1387,7 +1406,6 @@ do
 done
 for file in \
   config/skills/devlyn:resolve/references/phases/verify.md \
-  .claude/skills/devlyn:resolve/references/phases/verify.md \
   .agents/skills/devlyn:resolve/references/phases/verify.md
 do
   if ! grep -Fq 'Pair-mode (default when OTHER engine is available)' "$file" \
@@ -1403,7 +1421,6 @@ do
 done
 for file in \
   config/skills/devlyn:resolve/references/state-schema.md \
-  .claude/skills/devlyn:resolve/references/state-schema.md \
   .agents/skills/devlyn:resolve/references/state-schema.md
 do
   if ! grep -Fq '"version": "3.0"' "$file" \
@@ -1421,6 +1438,37 @@ if [ $pair_trigger_order_missing -eq 0 ]; then
   ok "VERIFY default pair dispatches concurrently"
 fi
 
+section "Check 6k: PLAN route is orchestrator-fixed"
+plan_route_ok=1
+for plan_route_file in "config/skills/devlyn:resolve/SKILL.md" CLAUDE.md AGENTS.md \
+  "config/skills/devlyn:engines/SKILL.md" ".agents/skills/devlyn:resolve/SKILL.md" \
+  ".agents/skills/devlyn:engines/SKILL.md"; do
+  [ -f "$plan_route_file" ] || plan_route_ok=0
+done
+sed -n '/^<engine_routing>$/,/^<\/engine_routing>$/p' "config/skills/devlyn:resolve/SKILL.md" \
+  | grep -Fq 'PLAN is orchestrator-fixed and never inherits `--engine`, an executor pin, or `state.engine`' || plan_route_ok=0
+sed -n '/^## PHASE 1: PLAN$/,/^## PHASE 1.5/p' "config/skills/devlyn:resolve/SKILL.md" \
+  | grep -Fq 'PLAN is orchestrator-fixed and never inherits `--engine`, an executor pin, or `state.engine`' || plan_route_ok=0
+grep -Fq 'PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin' CLAUDE.md || plan_route_ok=0
+grep -Fq 'PLAN is orchestrator-fixed and never inherits `--engine` or the executor pin' AGENTS.md || plan_route_ok=0
+grep -Fq 'PLAN is orchestrator-fixed and never follows the pin' config/skills/devlyn:engines/SKILL.md || plan_route_ok=0
+if grep -En '([Ee]xecutor|Default engine: Claude for)[^[:cntrl:]]{0,80}PLAN[[:space:]]*/[[:space:]]*IMPLEMENT([[:space:]]*/[[:space:]]*BUILD_GATE)?[[:space:]]*/[[:space:]]*CLEANUP' \
+    config/skills/devlyn:resolve/SKILL.md \
+    CLAUDE.md \
+    AGENTS.md \
+    README.md \
+    config/skills/devlyn:engines/SKILL.md \
+    .agents/skills/devlyn:resolve/SKILL.md \
+    .agents/skills/devlyn:engines/SKILL.md \
+    >/dev/null 2>&1; then
+  plan_route_ok=0
+fi
+if [ $plan_route_ok -eq 1 ]; then
+  ok "PLAN is orchestrator-fixed: exact declarations locked on all surfaces, no executor-role enumeration"
+else
+  bad "PLAN route contract violated: a locked orchestrator-fixed declaration is missing or an executor-role enumeration re-teaches PLAN"
+fi
+
 section "Check 6h: No undocumented spec.expected.json.browser_flows field"
 browser_flow_refs=$(grep -RInF 'spec.expected.json.browser_flows' \
   config/skills README.md bin/ package.json 2>/dev/null || true)
@@ -1511,6 +1559,72 @@ fi
 #      The wrapper owns the flag expansion; skill docs own requiring
 #      CODEX_MONITORED_ISOLATED=1 for probe-derive and pair-JUDGE.
 # ---------------------------------------------------------------------------
+section "Check 10a0: Codex primary VERIFY budget is bounded and mirrored"
+primary_verify_missing=0
+primary_verify_route='CODEX_MONITORED_ISOLATED=1 CODEX_MONITORED_TIMEOUT_SEC=600 bash "$CODEX_MONITORED_PATH" -C "$PWD" -s read-only -c model_reasoning_effort=high "<primary prompt>" >.devlyn/codex-judge.stdout 2>.devlyn/codex-judge.stderr'
+for file in \
+  config/skills/devlyn:resolve/SKILL.md \
+  .agents/skills/devlyn:resolve/SKILL.md \
+  config/skills/devlyn:resolve/references/phases/verify.md \
+  .agents/skills/devlyn:resolve/references/phases/verify.md
+do
+  if { ! grep -Fxq "$primary_verify_route" "$file" \
+      && ! grep -Fq "\`$primary_verify_route\`" "$file"; } \
+    || ! grep -Fq '.devlyn/verify.primary.timeout.json' "$file" \
+    || ! grep -Fq 'pair-style `TIMEOUT`' "$file"; then
+    bad "$file — Codex primary-JUDGE route/timeout authority missing"
+    primary_verify_missing=1
+  fi
+done
+for file in \
+  config/skills/devlyn:resolve/references/phases/verify.md \
+  .agents/skills/devlyn:resolve/references/phases/verify.md
+do
+  for needle in \
+    'one broad pass over the' \
+    'It then makes one' \
+    'targeted interaction pass over the clauses the broad pass left unresolved.' \
+    'Before any third pass' \
+    'verdict-binding BLOCKED coverage finding'
+  do
+    if ! grep -Fq "$needle" "$file"; then
+      bad "$file — bounded primary review instruction missing: $needle"
+      primary_verify_missing=1
+    fi
+  done
+done
+for file in \
+  config/skills/_shared/adapters/codex.md \
+  .agents/skills/_shared/adapters/codex.md
+do
+  for needle in \
+    'batch related reads' \
+    'sealed parity proves' \
+    'Open self-test bodies or MECHANICAL raw streams only for a'
+  do
+    if ! grep -Fq "$needle" "$file"; then
+      bad "$file — Codex bounded retrieval tactic missing: $needle"
+      primary_verify_missing=1
+    fi
+  done
+done
+for file in \
+  config/skills/_shared/verify-merge-findings.py \
+  .agents/skills/_shared/verify-merge-findings.py \
+  config/skills/_shared/archive_run.py \
+  .agents/skills/_shared/archive_run.py \
+  config/skills/_shared/resolve-bootstrap.py \
+  .agents/skills/_shared/resolve-bootstrap.py
+do
+  if ! grep -Fq 'verify.primary.timeout.json' "$file"; then
+    bad "$file — primary timeout deterministic/archive contract missing"
+    primary_verify_missing=1
+  fi
+done
+if [ $primary_verify_missing -eq 0 ]; then
+  ok "Codex primary VERIFY is bounded, fail-closed, archived, and mirrored"
+fi
+
 section "Check 10a: Bounded Codex calls use isolated wrapper mode"
 isolation_missing=0
 for needle in \
@@ -1572,12 +1686,18 @@ cat > "$tmp_iso/codex" <<'EOF'
 printf '%s\n' "$@" > "$CODEX_FAKE_ARGS_OUT"
 EOF
   chmod +x "$tmp_iso/codex"
-  CODEX_FAKE_ARGS_OUT="$tmp_iso/args.txt" \
-  CODEX_MONITORED_ISOLATED=1 \
-  CODEX_MONITORED_HEARTBEAT=999 \
-  CODEX_BIN="$tmp_iso/codex" \
-    bash config/skills/_shared/codex-monitored.sh -s read-only prompt \
-    >"$tmp_iso/stdout.txt" 2>"$tmp_iso/stderr.txt"
+  (
+    unset DEVLYN_INVOCATION_RUN_ID DEVLYN_INVOCATION_PHASE \
+      DEVLYN_INVOCATION_ROUND DEVLYN_INVOCATION_WORKDIR \
+      DEVLYN_INVOCATION_PROMPT_FILE DEVLYN_INVOCATION_SESSION_FILE \
+      DEVLYN_INVOCATION_RECEIPT
+    CODEX_FAKE_ARGS_OUT="$tmp_iso/args.txt" \
+    CODEX_MONITORED_ISOLATED=1 \
+    CODEX_MONITORED_HEARTBEAT=999 \
+    CODEX_BIN="$tmp_iso/codex" \
+      bash config/skills/_shared/codex-monitored.sh -s read-only prompt \
+      >"$tmp_iso/stdout.txt" 2>"$tmp_iso/stderr.txt"
+  )
   iso_exit=$?
   if [ $iso_exit -ne 0 ]; then
     bad "codex-monitored.sh isolated fake invocation exited $iso_exit"
@@ -1615,6 +1735,34 @@ else
   while IFS= read -r f; do bad "$f"; done <<< "$shared_path_offenders"
 fi
 
+section "Check 10a2: Bounded non-interactive calls discard inherited input"
+if python3 - <<'PY'
+import json, subprocess, sys
+
+prompt = "sealed argv prompt\n두 번째 줄"
+poison = b"OPERATOR_HEREDOC_SHOULD_NOT_BECOME_USER_INPUT\n"
+child = (
+    "import json,sys,time; "
+    "print(json.dumps({'argv':sys.argv[1:],'stdin_hex':sys.stdin.buffer.read().hex()},ensure_ascii=False),flush=True); "
+    "print('stderr preserved',file=sys.stderr,flush=True); "
+    "time.sleep(float(sys.argv[2])); raise SystemExit(int(sys.argv[3]))"
+)
+for label, delay, code, expected_exit in (("normal", 0, 0, 0), ("nonzero", 0, 17, 17), ("timeout", 30, 0, 124)):
+    args = [prompt, str(delay), str(code)]
+    result = subprocess.run(
+        [sys.executable, "config/skills/_shared/run-bounded.py", "1", "--", sys.executable, "-c", child, *args],
+        input=poison, capture_output=True, timeout=9,
+    )
+    assert result.returncode == expected_exit, (label, result.returncode)
+    assert json.loads(result.stdout) == {"argv": args, "stdin_hex": ""}, (label, result.stdout)
+    assert result.stderr == b"stderr preserved\n", (label, result.stderr)
+PY
+then
+  ok "run-bounded.py closes child stdin and preserves argv, streams, exits and timeout"
+else
+  bad "run-bounded.py inherited-input/exit/timeout regression failed"
+fi
+
 # ---------------------------------------------------------------------------
 # 10b. Shared routing docs must describe the current 2-skill surface.
 #      A stale auto-resolve/preflight/ideate-CHALLENGE reference can misroute
@@ -2640,7 +2788,7 @@ if ! grep -Fq 'solo_claude beats bare' benchmark/auto-resolve/scripts/build-pair
   || ! grep -Fq 'wrong mapping' benchmark/auto-resolve/scripts/test-build-pair-eligible-manifest.sh; then
   offenders="${offenders}"$'\n'"build-pair-eligible-manifest.py must use arm-mapped clean scores for F9 and L1<=L0 promotion"
 fi
-if [ -d benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F16-cli-quote-tax-rules ] \
+if [ -f benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F16-cli-quote-tax-rules/judge.json ] \
   && ! python3 benchmark/auto-resolve/scripts/full-pipeline-pair-gate.py \
     --run-id 20260510-f16-f23-f25-combined-proof \
     --pair-arm l2_risk_probes \
@@ -2651,7 +2799,7 @@ if [ -d benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F16-c
     --out-md /tmp/devlyn-lint-f16-f23-f25-pair-gate.md >/dev/null 2>&1; then
   offenders="${offenders}"$'\n'"current local artifacts for 20260510-f16-f23-f25-combined-proof must re-gate as PASS"
 fi
-if [ -d benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/F21-cli-scheduler-priority ] \
+if [ -f benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/F21-cli-scheduler-priority/judge.json ] \
   && ! python3 benchmark/auto-resolve/scripts/full-pipeline-pair-gate.py \
     --run-id 20260511-f21-current-riskprobes-v1 \
     --pair-arm l2_risk_probes \
@@ -3399,7 +3547,7 @@ if ! grep -Fq '"max_observed_pair_solo_wall_ratio": 2.2506234413965087' benchmar
 fi
 if make_temp_dir package_results /tmp/devlyn-lint-package-results.XXXXXX \
   && make_temp_dir package_audit /tmp/devlyn-lint-package-audit.XXXXXX \
-  && make_temp_file package_audit_stdout /tmp/devlyn-lint-package-audit.XXXXXX.out; then
+  && make_temp_file package_audit_stdout /tmp/devlyn-lint-package-audit.out.XXXXXX; then
   cp -R benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof "$package_results/"
   cp -R benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1 "$package_results/"
   for rejected_run in \
@@ -3507,9 +3655,10 @@ PY
 else
   offenders="${offenders}"$'\n'"packaged pair evidence subset could not allocate temporary audit workspace"
 fi
-if make_temp_file pack_json /tmp/devlyn-lint-pack.XXXXXX.json \
-  && npm pack --dry-run --json > "$pack_json" 2>/dev/null; then
-  if ! node - "$pack_json" <<'NODE'
+if make_temp_file pack_json /tmp/devlyn-lint-pack.json.XXXXXX \
+  && make_temp_dir pack_cache /tmp/devlyn-lint-pack-cache.XXXXXX; then
+  if npm_config_cache="$pack_cache" npm pack --dry-run --json > "$pack_json" 2>/dev/null; then
+    if ! node - "$pack_json" <<'NODE'
 const fs = require("fs");
 const path = require("path");
 const packPath = process.argv[2];
@@ -3534,10 +3683,14 @@ const required = [
   "benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/headroom-gate.json",
   "benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/full-pipeline-pair-gate.md",
   "benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/full-pipeline-pair-gate.json",
+  "benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F16-cli-quote-tax-rules/l2_risk_probes/result.json",
+  "benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F23-cli-fulfillment-wave/l2_risk_probes/result.json",
+  "benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F25-cli-cart-promotion-rules/l2_risk_probes/result.json",
   "benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/headroom-gate.md",
   "benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/headroom-gate.json",
   "benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/full-pipeline-pair-gate.md",
   "benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/full-pipeline-pair-gate.json",
+  "benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/F21-cli-scheduler-priority/l2_risk_probes/result.json",
   "benchmark/auto-resolve/results/20260512-f2-medium-headroom/headroom-gate.json",
   "benchmark/auto-resolve/results/20260512-f31-seat-rebalance-headroom/headroom-gate.json",
   "benchmark/auto-resolve/results/20260512-f32-subscription-renewal-headroom/headroom-gate.json",
@@ -3595,13 +3748,17 @@ if (forbidden.length > 0) {
   process.exit(2);
 }
 NODE
-  then
-    offenders="${offenders}"$'\n'"npm pack dry-run must include benchmark runner/gate regression tests, all shadow fixture files, retired fixture replay docs, and exclude pycache artifacts"
+    then
+      offenders="${offenders}"$'\n'"npm pack dry-run must include benchmark runner/gate regression tests, all shadow fixture files, retired fixture replay docs, and exclude pycache artifacts"
+    fi
+  else
+    offenders="${offenders}"$'\n'"npm pack dry-run failed while checking benchmark runner/gate regression tests"
   fi
 else
-  offenders="${offenders}"$'\n'"npm pack dry-run failed while checking benchmark runner/gate regression tests"
+  offenders="${offenders}"$'\n'"npm pack dry-run could not allocate temporary package workspace"
 fi
 [ -n "${pack_json:-}" ] && rm -f "$pack_json"
+[ -n "${pack_cache:-}" ] && rm -rf "$pack_cache"
 non_executable_shell_scripts=$(find benchmark/auto-resolve/scripts -maxdepth 1 -name '*.sh' -type f ! -perm -111 -print | sort)
 if [ -n "$non_executable_shell_scripts" ]; then
   while IFS= read -r f; do
@@ -3957,7 +4114,7 @@ else
   else
     bad "idgen temp files unavailable; cannot verify determinism"
   fi
-  if make_temp_dir tmp_bad && make_temp_file idgen_nan_out /tmp/pair-plan-idgen-nan.XXXXXX.out; then
+  if make_temp_dir tmp_bad && make_temp_file idgen_nan_out /tmp/pair-plan-idgen-nan.out.XXXXXX; then
     cp -R "$fixture/." "$tmp_bad/"
     printf '{"verification_commands": NaN}\n' > "$tmp_bad/expected.json"
     if python3 "$idgen" --fixture "$tmp_bad" --generated-at 2026-04-29T18:30:00Z >"$idgen_nan_out" 2>&1; then
@@ -3968,7 +4125,7 @@ else
     rm -rf "$tmp_bad" "$idgen_nan_out"
   fi
 
-  if make_temp_file bad_plan && make_temp_file plan_lint_nan_out /tmp/pair-plan-lint-nan.XXXXXX.out; then
+  if make_temp_file bad_plan && make_temp_file plan_lint_nan_out /tmp/pair-plan-lint-nan.out.XXXXXX; then
     printf '{"schema_version": NaN}\n' > "$bad_plan"
     if python3 benchmark/auto-resolve/scripts/pair-plan-lint.py --plan "$bad_plan" --quiet >"$plan_lint_nan_out" 2>&1; then
       bad "pair-plan-lint.py accepted NaN in pair-plan.json"