docs: reference shared channel workspace standard

Merge pull request 'fix/a02-a04-global-gates' (#17 ) from fix/a02-a04-global-gates into test
fix: retain global review precedence in entry guidance
2026-11-05 19:11:27 +00:00 · 2026-10-26 04:36:20 -07:00 · 2026-10-26 11:34:06 +00:00 · 2026-10-26 11:31:49 +00:00 · 2026-10-26 03:26:59 -07:00 · 2026-10-26 10:24:59 +00:00
28 changed files with 302 additions and 759 deletions
@@ -1,77 +0,0 @@
 # Full-program responsibility consolidation
 Authorization: Piotras Board approval, [full approved program](https://discord.com/channels/1518726359512387766/1546489551235588138/1563064779772526616), as cited by the coordinating task. This local consolidation and canonical dependency binding makes no remote/runtime write, commit or publication. `SIMPLIFICATION.md` remains the historical minimum record.
 The subsequent `contracts-audit.md` authority report was read in full and the coordinating instruction adopted its mechanical A05/A06/A08 mappings and A17 chronology. Only A02/A04 remain unresolved policy choices; A17 later-resumption evidence remains a bounded discovery gap.
 ## Effective baseline and publication gate
 The installed `development-gates` 1.1.0 entry and review/CI reference carry complete-job-inventory, required aggregate and single-attempt safeguards; installed `devsecops-ci-cd-gitea-aerosim` 1.2.0 plus pipeline/conventions/Harbor references carry candidate image/chart packaging and aggregate inputs. Those inspected installed packages are the effective baseline, not unpublished additions in sibling worktrees. A separate worker reconciles their source packages. Before publication/adoption, verify complete published owner packages include these safeguards and record immutable revisions; this local result does not claim that reconciliation, publication or runtime refresh succeeded.
 Exact-worktree/process-CWD checks and API task/run/UI identifier distinction remain in planning reconciliation: the inspected owners do not yet fully carry them. Likewise exact-context preflight and base-image consumer/repair contracts remain here. No unmatched safeguard was removed merely because a destination seems plausible.
 ## Clause-level disposition
 | Finding | Implemented responsibility / retained clause / bounded remainder |
 |---|---|
 | A01 | Gate reference loads `development-gates` and its review/CI contract at candidate/CI/merge/integration decisions; attempt integrity and integration mechanics delegated. Six gate codes, all required validation classes, reviewer bindings, state transitions, deployment and handoff exits retained. A02/A04-sensitive sequence clauses retained rather than silently rewritten. |
 | A02 | **unresolved**: substantive push-versus-review order. Existing stage 3 steps 5–6 retained; empty kickoff visibility is not a resolution. Await separate exact owner/Board resolution before affected extraction or conflicting execution. |
 | A03 | Existing reviewer override preserved: main runtime reviews its candidate; AeroSim active worker reviews, main independently verifies evidence/remote effects. No second review worker or human-review dependency introduced; packet verification is not independent code review. |
 | A04 | **unresolved**: harmless-base-drift clause versus generic synchronize/re-review. Stage 4 steps 2–3 retained and conflict explicitly bounded; no new harmless-drift exception inferred. |
 | A05 | Removed stale “when practical” exemptions. AeroSim runtime binds observed product-reason unit RED, minimal GREEN/REFACTOR, isolated unpublished-delta discard only, preservation of unrelated/shared/integrated work, forward repair and honest historical missing RED. RootAtSkic alone grants a documented exception; no retrospective compliance. Central retains the same bounded discard/shared-work safeguard with its own project-authority exception; the generic owner update is coordinated separately. |
 | A06 | AeroSim worker contract now distinguishes durable coordination of the complete frozen wave from executable per-Task claims: ledger includes blocked/unadmitted members without promotion, one live worker per eligible Task, canonical documentation persistence, verified lock ownership and orphan recovery. Per-Task gate ordering preserves authorized independent parallelism. No new status/admission gate or invented schema. |
 | A07 | Planning/status/pitfalls load exact gates/integrity owners instead of repeating checkpoint algorithms. Retain Task-row semantics, current versus historical admission, non-approval interpretation, wave header/all-Task chapter, gate codes, source destinations and duplicate suppression. Full validator/build and exact-worktree residual checks retained. |
 | A08 | AeroSim binds one focused repair attempt or one hour (whichever first) to sole-executor evidence handoff to main, existing-domain-owner advice, same-gate safe forward repair and continued independent Tasks. Advice is not a second implementer/reviewer; worker replacement needs verified ownership loss and durable handover. Central generic role mapping is coordinated separately; no project authority broadening. |
 | A09 | AeroSim Actions reference is now overlay + exact CI owner/reference loads, not three duplicate workflow trees. Retains exact workflow names, all-app/code/image/chart/aggregate outcomes, credential and UAT boundaries. Runtime publication mechanics route to that owner; chart/GitOps integration bindings remain. Publication-ready owner verification is a hard prerequisite, not an assumption from sibling source edits. |
 | A10 | Already resolved; preserve Delivery static/build-time artifact validations and candidate image/chart packaging. All functional non-unit suites remain UAT-owned; E2E never installs Helm or builds/publishes images. |
 | A11 | Exact Task-release/unpadded-attempt branch naming, early visible PR, card links where applicable, `test` base, title equality and standing AeroSim merge delegation preserved. Generic branching cannot overwrite these project policies. |
 | A12 | Board remains sole shared-login owner with decision-point load and fail-closed behavior. Specialist recovery load remains; exact own-account delegation, all stricter preconditions, transport interlocks, code guards and three-layer readback retained byte-identically. Recovery publication provenance remains unverified; no invented repository mapping. |
 | A13 | Replaced repeated dataset/NFS/PV recipe with mandatory `home-v1--truenas` + `references/gondor-retained-application-storage.md` load before storage work. Durable non-deleting storage, environment isolation, approved authority and deployment-readiness remain. Selected Gondor skill and both AeroSim fallbacks retained; canonical GitOps, compatibility alias and generic base are installed and skill_view-tested by the parent, source `7ceb741c5fecbe34eb06e10a72e3ae26e3cc6f14`. No live StorageClass assertion. |
 | A14 | Gate preflight now loads the one retained runtime preflight. Runtime loads scripts/monorepo owners for repository-root execution and committed versions. Task/cache isolation, every execution context and repository-native complete validation retained. AeroSim nested-pnpm recovery routes to its verified documentation owner; central fallback retained because global same-name source identity is unresolved. |
 | A15 | Domain coverage remains Delivery-owned: five Ways of Working and five Engineering sections, verified not aspirational practice. Decision-point Docusaurus/Glossary loads own authoring/build/term mechanics. Removed duplicate synchronization enumeration in favor of entry/planning owners; no new documentation helper. |
 | A16 | Duplicate evidence/toolchain pitfalls become owner loads. Retain project lock-holder verification and complete base-image contract including credential-free candidate checks, trusted publication, immutable digest consumption and last known-good forward repair. No CI-owner ownership of that unmatched contract asserted. |
 | A17 | Authority audit found original RootAtSkic hourly/60-minute requests (1546990225669234820, 1550892376900509817) and explicit stop (1552094167901937676). AeroSim entry replaces unconditional scheduling with conditional mechanics and a versioned approval/stop/resumption record. Later bot-reported reconciler 6777dc7d3d82 does not prove reauthorization or current inventory; bounded resumption evidence remains outstanding. No scheduler mutation or unauthorized-job finding. See entry chronology for exact links. |
 | A18 | Eight-channel wording corrected in AeroSim gates; authorized channel boundary unchanged. Worker cache diagram no longer places Playwright/PostgreSQL under Delivery. DEV tuple, UAT verdict and verified separate Releases-channel handoff remain distinct; no `DONE` or release authority moved. |
 ## Verification contract
 Tests precede content edits. Whole-file hashes for intentionally thinned references are replaced with checks of exact protected clauses plus semantic routing/outcome tests, not with deletion of safety coverage. Unchanged metadata, authority blocks, self-recovery source and delegation guards retain original hashes. Run every test module (including standalone `main()` scripts), the recovery tests with their declared websocket dependency, local Markdown-link validation and `git diff --check`. Report local results only; no repository CI or publication is implied.
 ## Original consolidation verification result
 - Command: `/opt/hermes/.venv/bin/python tests/verify_full_program.py` — **21 checks passed**, including standalone test functions/main scripts that unittest discovery alone misses.
 - Local operational Markdown links: **29 resolved**; `git diff --check` passed.
 - Entry + all references: **80,924 → 76,537 bytes** (4,387 fewer). References alone: **57,907 → 53,520 bytes** (4,387 fewer). Audit records and tests excluded; new authority chronology/mappings are included. This is a measured reduction, not a dramatic token-saving claim.
 - Plain system Python lacked `websockets`; the existing Hermes venv supplied it. No dependency installation or runtime skill update was performed.
 - No remote CI/publication, live deployment, scheduler or account mutation was attempted. Required dependency publication readback and A02/A04 owner choice remain coordinating gates.
 ## Canonical dependency acceptance update
 The parent reports merged and installed owner packages: `development-gates` at `02e716ddff053c71a921839419ed2bd2334f1e67`, `development-integrity` at `3ca0fbb284b5eb194ad5ff1f2756f1fde0077c6a`, `development-method-ttd` at `d3d91be7bb2926b0f1bd16db60c0fe2250ed8d39`, and `development-durable-wave-execution` at `a180018ef3bc337bb1fbabd095fa7a4e13471fc5`. This supersedes their earlier pending reconciliation description above; it is coordinating evidence, not a runtime action performed here. GitOps canonical `development-gitops-argo-cd-home-gondor-v1`, alias and generic base were installed and skill_view-tested by the parent at source `7ceb741c5fecbe34eb06e10a72e3ae26e3cc6f14`. Conditional fallbacks remain for unavailable future installations. Other canonical owners are being published by the parent; no unverified publication success is inferred. Legacy source URLs and historical records remain provenance, not additional owners. `corp-v1-glossary` remains unchanged pending the public-to-private repository decision. A02/A04 still await human resolution.
 Canonical-binding verification: see [naming-delivery-review.md](naming-delivery-review.md) for the subsequently executed complete standalone harness results and unchanged golden-hash strategy.
 ## Final bounded owner consolidation
 This supersedes the earlier A14/A16 statements that reusable preflight/base-image mechanics lack an owner. Delivery retains the project bindings and outcomes; only the matched mechanics moved. A02/A04 and their golden clauses remain unchanged and unresolved.
 | Moved reusable clause | Exact source-owner section |
 |---|---|
 | version resolution, executable/version comparisons | `development-scripts/references/runtime-preflight.md` — Required inputs; Procedure 1–2 |
 | presence-only environment and repository identity/state checks | `development-scripts/references/runtime-preflight.md` — Procedure 3–4 |
 | same-context activation, inheritance failure classification and complete retry | `development-scripts/references/runtime-preflight.md` — Procedure 5; Failure and repair |
 | image folder/metadata, digest/tool/platform/user/workspace/trust assertions and lockfile parity | `devsecops-ci-cd-gitea/references/base-images.md` — Construction and static contract |
 | credential-free candidates and isolated trusted publication | `devsecops-ci-cd-gitea/references/base-images.md` — Candidate isolation and trusted publication |
 | full-source tags, direct Harbor readback, immutable retry and aggregates | `devsecops-ci-cd-gitea/references/base-images.md` — Immutable publication and direct readback |
 | digest consumer verification and forward repair mechanics | `devsecops-ci-cd-gitea/references/base-images.md` — Consumer verification and forward repair |
 | negative trigger/tag/secret/interpolation/digest/setup regression cases | `devsecops-ci-cd-gitea/references/base-images.md` — Fail-closed regression matrix |
 Immutable CI-owner acceptance: source `669e28eadfe79ac7cb3c10ccdea318dd5296d481`; installed/source base-image reference SHA-256 `1fb0e24ec5789b195be9ae35fbb9529fa1cab56112dae5baf9455284ca490e53`, independently compared locally. `owner-responsibility.json` covers both callers. Scripts source was inspected at HEAD `5960d5e74713e6b95a403962f479b2b97cb76286`, with reference content SHA-256 `07306382b8afe5c2d2e83e2955a04a1523d008e7e39cead7c7a1797bb6640462`; the content hash, not HEAD alone, identifies the inspected working-tree contract. Scripts semantic reconciliation/publication/install remains a parent gate before Delivery publication/adoption. Record the final immutable published revision and source/runtime equality there; no pending result is claimed here.
 Retained locally: every foreground shell/worktree/background process/worker/main review/CI context, stop-on-failed-preflight, selected Task containment/repository/revision/namespace and allowed command scope, complete repository CI, trusted `test` branch and named project base-image repository, immutable consumer evidence, separate UAT acceptance, forward repair and last known-good digest. All unique project chart/runtime/storage/recovery boundaries remain unchanged.
 Test manifest: `tests/owner-consolidation-manifest.json` preserves inspected owner text/hash and exact clause-to-section moves. Only the two intentionally moved runtime section hashes are retired into that manifest; semantic regression checks replace them. All unrelated golden hashes and canonical identity normalization are unchanged. New tests first failed on missing decision-point loads in both packages, before content edits.
 ## Published owner adoption checkpoint
 The final preflight owner is `global-skills/development-scripts` at `0e36552938da94c0539e39b35256b8effe34c25d`; the base-image owner is `global-skills/devsecops-ci-cd-gitea` at `669e28eadfe79ac7cb3c10ccdea318dd5296d481`. Both complete packages were authenticated-readback verified and installed byte-for-byte. The preflight hash is `07306382b8afe5c2d2e83e2955a04a1523d008e7e39cead7c7a1797bb6640462`; the base-image hash is `1fb0e24ec5789b195be9ae35fbb9529fa1cab56112dae5baf9455284ca490e53`. Earlier preparation-stage pending-owner statements above are historical and superseded by this checkpoint. Generic scripts preserves the existing Home/SKIC adoption body in a scoped reference; it does not silently replace the adopted bootstrap convention. No remote CI was configured for these two owner repositories; local contract tests and independent source review passed. This checkpoint resolves the owner-publication prerequisite only, not A02/A04, scheduler reauthorization, remaining organization visibility or other-project adoption decisions.
@@ -1,75 +0,0 @@
 # Bounded Delivery simplification — 2026-10-23
 ## Authority and boundary
 GUILD-IMP-20261023-delivery-existing-owners. Piotras (`501954115690168321`), verified Board member, approved “implement delivery skills proposal” in [Guild message 1563054836508008539](https://discord.com/channels/1518726359512387766/1542596418215092264/1563054836508008539), as supplied by the commissioning parent. This record does not claim an independent Discord re-audit.
 Implements only the [published recommendation / smallest useful change](https://pages.apps.lego-cloud.eu/corp-v1-aerosim/corp-v1-aerosim-documentation/engineering/skills-delivery-channel#smallest-useful-change), read from `delivery-proposal-refresh-20261023/engineering/skills-delivery-channel.mdx`, with [2026-10-23 source/finding evidence](https://pages.apps.lego-cloud.eu/corp-v1-aerosim/corp-v1-aerosim-documentation/evidence/delivery-skills-refresh-2026-10-23.json). Baseline: `225ae3b068d97748af69597353479eb9c26579fc`, version 1.14.1; candidate 1.14.2.
 Central package only; no helper, dependency change, file removal, migration, policy choice, dependency-repository edit or documentation-project edit. This manifest is an audit artifact, not an operational loaded reference. Parent owns publication, runtime refresh and separately authorized semantic project adoption.
 ## Responsibility manifest
 Each row states the old rule/location, retained or single owner, and the new load point. Unlisted operational paragraphs remain unchanged.
 | Rule / before | After: owner and decision point | Retained outcome / limit |
 |---|---|---|
 | Login origin and authorized purpose — entry + runtime repeated Board policy | Board **Corp v1 System SSO Credential Use**; entry says load before login, runtime follows that binding | Origin/purpose verification remains mandatory; unavailable owner stops login |
 | Login secret names/runtime-only use — same two copies | Board; same pre-login load | Exact names retained in entry; no secret values introduced |
 | No inspect/print/hash/serialize/paste/log/screenshot/persist or unsafe transport — same copies | Board full policy, not a selected subset | Board rules 2–3 and 7–8 retain all restrictions and session safety |
 | Missing secret names only; never ask for values — same copies | Board rules 2–4, pre-login load | Injection only, no fallback secret |
 | Login is not account/credential/MFA/permissions/billing/destructive authority | Board plus short Delivery boundary | No recovery or additional authority granted |
 | Canonical lifecycle vocabulary repeated entry + status reference | Existing status reference owns full vocabulary; entry loads it before status action | Exact Task admission/claim, separate BLOCKED, TO_BE_RELEASED vs DONE retained in entry; full statuses unchanged in reference |
 | Ways of Working five sections repeated entry + failure reference | Existing failure reference owns domain coverage; entry loads it before edits | All ten domain sections remain; verified practice only, not aspirations |
 | Documentation platform mechanics | Global Docusaurus + project overlay; failure reference before authoring/validating | Source identity must match, not unrelated same-name VSSA installation; no domain/Diátaxis conflation |
 | Canonical reusable definitions | Existing global Glossary; failure reference before defining terms | Final top-level Glossary and domain links, not copied explanations |
 | Nested pnpm/Corepack bootstrap recipe — planning step 5 | Retained unchanged locally pending resolution of global Docusaurus runtime identity | Published owner has the procedure, but the installed name currently resolves to an unrelated source; no extraction to an unverified runtime owner |
 | Current checkpoint/report claims — planning steps 8/12 | Integrity evidence-first sequence; explicit before-report load in planning/status | Fresh source/merge distinction, revalidation on drift/merge/close, final equality and duplicate suppression retained locally |
 | Report shape and lifecycle meaning | Delivery status reference remains owner | Requested wave header, every Task, real owner, linked PR, gate codes, failure classification and no automatic DONE unchanged |
 | pnpm/script implementation routing — runtime Coding | Existing pnpm and scripts owners with source-table link and action triggers | Approved Feature/Task, structure/namespace, traceability, no unrelated refactor/fabrication remain |
 | Unit mechanics — runtime Unit testing | Explicit TTD action load added; existing generic owner already routed in entry | Existing bullets and Task stage left intact; no choice on discard/forward repair |
 | Failure diagnosis/forward-repair procedure repeated entry + failure reference | Existing failure reference; entry loads at observed failure | Complete reference repair and escalation text unchanged, including no premature stop/help-policy rewrite |
 | Build/CI failure classes repeated runtime + entry | Entry owns classes; runtime loads it and Integrity before reporting | Task CI job inventory and exact-head requirements untouched |
 | Base-image policy repeated entry + runtime | Existing runtime reference owns complete contract; entry loads before create/publish/consume | Digest, version/platform/non-root/tools, candidate secret isolation, immutable publication/readback, fail-closed tests, lockfile parity, separate layers, forward repair/last-good all retained |
 | Pitfalls duplicated entry + reference | Existing pitfalls reference, loaded on failed/resumed work and before status | Full reference unchanged; no safeguarding rule deleted |
 ## Verified existing sources
 Source audit used the published capture, not version-label equality. No owner content was copied into a new helper or changed in this task.
 - [Board login owner](https://gitea.lego-cloud.eu/skic-skills/channel-board-skic/src/commit/9170a6749f0adf5ec65fc99a645600cb471be9f1/SKILL.md): published/installed equal in evidence; loaded for comparison.
 - [Integrity reporting owner](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-integrity/src/commit/b677c99f24cbe83734a9d6a495e388837fc88701/SKILL.md): published/installed equal; loaded for comparison.
 - [Global Docusaurus](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/documentation-docusaurus/src/commit/699cf6786e02bef74e84ec64b5a6233d4839ed47/SKILL.md): full captured `remote_text` read from `delivery-refresh-evidence/documentation-source.json`, including nested-pnpm remedy. Direct unauthenticated fetch returned 404; no false live-readback claim. Skill loader resolves a different VSSA owner; operational loads now explicitly require correct provenance.
 - [Glossary](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/corp-v1-glossary/src/commit/24732bf6864a14f2d6aa6cccd7d9fc023438a42d/SKILL.md): retained existing route; no glossary procedure extracted.
 - [TTD](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-method-ttd/src/commit/2155b0a250cea282bf6628231d8e3de286522a86/SKILL.md): retained strict existing route, no discard-policy rewrite.
 - Ordinary Git, pnpm and scripts source links remain in the unchanged Development Skill Routing table. No Git procedure is extracted because exact Task/branch/readback requirements are tightly coupled to unresolved gates.
 ## Deferred findings and untouched boundaries
 A01: no gate algorithm extraction; published `development-gates` lacks installed complete-job-inventory protections. A02/A04: substantive push/review order and harmless-base-drift wording untouched. A03: main-session review/worker restrictions unchanged. A05: strict TTD route retained, weaker wording/local-discard versus valid-work forward repair not reconciled. A06: whole-wave claim mapping not chosen. A08: no help-threshold/worker-role decision. A09: project CI source/runtime drift not changed. A10: no obsolete Helm fix needed; current static artifact versus functional UAT boundary retained. A11: exact branch/title/attempt/early-PR identity untouched. A12: no recovery skill or authorization change. A13: GitOps loadability/storage source issues not solved; all runtime/storage safeguards retained. A14: exact-context preflight remains byte-identical. A15: domain/platform distinction retained. A16: base-image safeguard remains local, not delegated to an incomplete external owner. A17: no scheduler authority conclusion or job mutation. A18: central eight-channel boundary unchanged; no project cleanup here.
 The four complete files `task-delivery-gates.md`, `repository-entry-and-visibility.md`, `common-pitfalls.md`, `aerosim-lessons-review.md` are byte-identical. Runtime workspace, exact-context preflight/base-image/runtime-resource tail, failure-repair procedure and entry Authority/Escalation are hash-locked in tests. All 12 metadata dependencies and all 8 references remain.
 ## Validation and operational footprint
 Test-first: initial unittest run had 12 tests, with expected failures for missing load points and size reduction (2 failures). Final suite includes unittest classes and the three existing function-style routing tests through `unittest.FunctionTestCase`; plain discovery alone would miss those three. No network required by tests.
 Final local validation: `uv run --with pytest python -B -m pytest tests -q` — 16 tests passed. `git diff --check` passed. No remote CI workflow is configured. Publication/installation is separately verified by the parent.
 ## Measured operational footprint
 Includes entry and every reference; excludes this audit manifest, tests, adoption record and caches. No removed procedure was moved into an operationally loaded new file.
 | File | Before bytes | After bytes | Reduction |
 |---|---:|---:|---:|
 | `SKILL.md` | 27413 | 23017 | 4396 |
 | `references/aerosim-lessons-review.md` | 3400 | 3400 | 0 |
 | `references/common-pitfalls.md` | 2276 | 2276 | 0 |
 | `references/failure-and-documentation.md` | 4428 | 5136 | -708 |
 | `references/planning-artifact-reconciliation.md` | 6624 | 6621 | 3 |
 | `references/repository-entry-and-visibility.md` | 6514 | 6514 | 0 |
 | `references/runtime-and-ci.md` | 11078 | 10654 | 424 |
 | `references/status-and-reporting.md` | 5135 | 5385 | -250 |
 | `references/task-delivery-gates.md` | 17921 | 17921 | 0 |
 | **Total** | **84789** | **80924** | **3865 (4.56%)** |
@@ -1,26 +1,24 @@
 ---
 name: channel-delivery-skic
 description: "Use when operating or synchronizing a Corp v1 project's delivery channel. Drives coding, unit testing, build and continuous-integration health, attempts safe evidence-based fixes, escalates requirement or architecture contradictions, and maintains Ways of Working and Engineering documentation."
-version: 1.15.0
+version: 1.18.0
 author: Hermes Agent
 license: MIT
 metadata:
  hermes:
    tags: [corp-v1, discord, channel, delivery, coding, testing, ci]
-    related_skills: [channel-board-skic, discord, documentation-docusaurus, corp-v1-glossary, development-durable-wave-execution, development-gates, development-integrity, development-method-ttd, development-branching-strategy, development-monorepo-pnpm, development-scripts, development-gitops-argo-cd-home-gondor-v1]
+    related_skills: [channel-board-skic, discord, documentation-docusaurus-global, glossary-skic, development-durable-wave-execution, development-gates, development-integrity, development-method-ttd, development-branching-strategy, development-monorepo-pnpm, development-scripts, development-gitops-argo-cd-home-gondor-v1, ci-runtime-skic, delivery-docs, status-reporting-skic, development-security, development-security-skic, develop-monorepo-pnpm-app-skic, develop-monorepo-pnpm-package-skic]
 ---
 # SKIC Delivery Channel Reference
 ## Overview
 ## Hermes Kanban direct-link contract
 Whenever a response mentions a Hermes Kanban board, initiative, card, or task, it must include a direct dashboard link in the form `[descriptive board label](<dashboard-public-url>/kanban?board=<board-slug>)`. Resolve the dashboard public URL and exact board slug before reporting; never provide only a board name, slug, card count, “visible cards,” or “available in the dashboard.” If no task-specific deep link exists, link the board and include the exact task ID or title in the same statement. Project-adopted skills must replace this generic form with their verified project board URL.
 ## Canonical Scope Status Vocabulary
-Before reporting or changing lifecycle status, load [status-and-reporting.md](references/status-and-reporting.md) and read the project's current Ways of Working Scope page. That contract retains the complete canonical vocabulary, requested wave format and gate codes; `development-integrity` owns checkpoint claims. Delivery claims only an exact `READY_FOR_DELIVERY` Task into `IN_PROGRESS`, without a second Focus admission. `BLOCKED` remains a separate flag; merge/green CI is not `DONE`, and releasable application work normally ends Delivery at `TO_BE_RELEASED`.
+Before reporting or changing lifecycle status, load [status-and-reporting.md](references/status-and-reporting.md) and read the project's current Ways of Working Scope page. That binding loads `status-reporting-skic` for canonical vocabulary and requested wave format; local Task gates retain gate codes, and `development-integrity` owns checkpoint claims. Delivery claims only an exact `READY_FOR_DELIVERY` Task into `IN_PROGRESS`, without a second Focus admission. `BLOCKED` remains a separate flag; merge/green CI is not `DONE`, and releasable application work normally ends Delivery at `TO_BE_RELEASED`.
 This skill owns delivery health for a Corp v1 project. It monitors the project's `general`, `scope`, `architecture`, `ui-ux`, `kanban`, `delivery`, `uat`, and `releases` channels and implements only tasks whose parent Feature has explicit human `Approved for Implementation` evidence and whose exact Task status is `READY_FOR_DELIVERY`. That status is the Focus-admitted pickup handoff; no separate post-status admission gate exists.
@@ -28,44 +26,32 @@ Its scope includes coding, unit testing, builds, continuous integration, review
 Delivery owns application **unit testing only** plus static/build-time validation of the application artifacts it publishes: Dockerfiles, image/container contracts, publication records/workflows, and Helm chart linting/rendering/packaging. The project's standalone E2E repository under its UAT channel owns every functional non-unit suite and its fixtures, configuration, runner, and evidence: integration, browser, E2E, acceptance, security-boundary, performance, runtime-budget, smoke, regression, and deployed-environment testing. Delivery must not maintain or execute functional non-unit suites in the application repository. E2E must not install Helm or build/publish application images. It consumes UAT failures as defect evidence, fixes application code with unit-first TTD, and hands the corrected deployed tuple back to UAT.
-Load the global `documentation-docusaurus` skill from `https://gitea.lego-cloud.eu/home-v1-skills-code-agent/documentation-docusaurus` before changing documentation structure, navigation, Markdown/MDX, Docusaurus configuration, or builds.
+Before login or credential-bearing operations, load `development-security-skic` and `development-security`; stop if the authoritative Board policy cannot load. These owners govern the non-secret operation binding and exposure preflight, not new access authority.
-Load the global `corp-v1-glossary` skill from `https://gitea.lego-cloud.eu/home-v1-skills-code-agent/corp-v1-glossary` whenever project documentation needs to define or explain a reusable term. Maintain one canonical definition in the project's final top-level **Glossary** area and link to it from the owning domain page; do not duplicate glossary-style explanations across channel documentation.
+Before branch or script work, load the generic `development-branching-strategy` / `development-scripts` base alongside the named project overlay; inherit only non-conflicting mechanics.
 ## Shared Corp v1 System Login
 Before login, load `channel-board-skic` from [its authoritative source](https://gitea.lego-cloud.eu/skic-skills/channel-board-skic) and follow **Corp v1 System SSO Credential Use** in full. It owns origin/purpose verification, runtime-only `HL_V1_SSO_EMAIL` / `HL_V1_SSO_PASSWORD` handling, non-disclosure, missing-secret injection and session safety. If that policy cannot be loaded, stop before login. Secret availability is not authorization; Delivery grants no account recovery, credential/MFA, permission, billing, destructive-operation or unrelated-access authority.
 ## When to Use
 Use this skill when:
 - operating in `<code>-delivery`;
 - running its recurring synchronization job;
 - implementing or reviewing project code;
 - adding or repairing unit tests only; non-unit coverage is routed to the project's UAT channel and standalone E2E repository;
 - diagnosing build or CI failures;
 - checking implementation against requirements and ADRs;
 - maintaining delivery-oriented documentation.
 Do not use it to silently choose between contradictory requirements or architecture decisions, approve releases, or bypass review and branch protections.
 ## Development Skill Routing
 Before changing an application's configuration, startup/readiness/shutdown contract or integration boundaries, load `develop-monorepo-pnpm-app-skic`. Before changing a shared package's public API/exports, dependency boundary, version compatibility or published contents, load `develop-monorepo-pnpm-package-skic`. For a change crossing both boundaries, load both and identify producer/consumer responsibilities; do not infer impact solely from a directory name.
 These are **draft review aids, not approved standards**. Contributor input and project adoption approval are separate from source publication or this routing. Use them to identify questions and evidence against the Task's already approved contract; do not enforce a proposed convention without the relevant human owner's approval. They complement `development-monorepo-pnpm`, which continues to own workspace/build/package-manager mechanics. Review, CI, one implementation worker per Task, deployment and test-ownership gates remain unchanged; loading a draft grants no execution authority. Authoritative drafts: https://gitea.lego-cloud.eu/skic-skills/develop-monorepo-pnpm-app-skic and https://gitea.lego-cloud.eu/skic-skills/develop-monorepo-pnpm-package-skic.
 Before CI/runtime/repair work load `ci-runtime-skic`; before status/blocker reports load `status-reporting-skic`; before documentation load `delivery-docs`; before authenticated operations load `development-security-skic` and `development-security`. Supply the concrete bindings in the matching local reference. Authoritative helper repositories: https://gitea.lego-cloud.eu/skic-skills/ci-runtime-skic, https://gitea.lego-cloud.eu/global-skills/delivery-docs, https://gitea.lego-cloud.eu/skic-skills/status-reporting-skic, https://gitea.lego-cloud.eu/global-skills/development-security and https://gitea.lego-cloud.eu/skic-skills/development-security-skic.
 This channel skill owns **delivery governance and project-channel coordination**. Reusable engineering procedures belong to the global `development-*` skills below; load the matching skill before the action and treat a project-adopted variant as the project-specific overlay when one exists.
 | Work | Required reusable skill | Authoritative Gitea source |
 |---|---|---|
-| dependency-wave claim, continuation, recovery, and closure | `development-durable-wave-execution` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-durable-wave-execution |
+| dependency-wave claim, continuation, recovery, and closure | `development-durable-wave-execution` | https://gitea.lego-cloud.eu/global-skills/development-durable-wave-execution |
-| immutable candidate review, exact-head CI, merge, and integration gates | `development-gates` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-gates |
+| immutable candidate review, exact-head CI, merge, and integration gates | `development-gates` | https://gitea.lego-cloud.eu/global-skills/development-gates |
-| delivery, CI, blocker, and completion reporting | `development-integrity` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-integrity |
+| delivery, CI, blocker, and completion reporting | `development-integrity` | https://gitea.lego-cloud.eu/global-skills/development-integrity |
-| behavior changes, defect fixes, and refactoring | `development-method-ttd` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-method-ttd |
+| behavior changes, defect fixes, and refactoring | `development-method-ttd` | https://gitea.lego-cloud.eu/global-skills/development-method-ttd |
-| branch naming, worktrees, PR topology, and base synchronization | `development-branching-strategy` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-branching-strategy |
+| branch naming, worktrees, PR topology, and base synchronization | `development-branching-strategy` | https://gitea.lego-cloud.eu/global-skills/development-branching-strategy |
-| pnpm/TypeScript monorepo implementation | `development-monorepo-pnpm` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-monorepo-pnpm |
+| pnpm/TypeScript monorepo implementation | `development-monorepo-pnpm` | https://gitea.lego-cloud.eu/global-skills/development-monorepo-pnpm |
-| Taskfile, `.scripts/`, shell wrappers, environment validation, and Devbox | `development-scripts` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-scripts |
+| Taskfile, `.scripts/`, shell wrappers, environment validation, and Devbox | `development-scripts` | https://gitea.lego-cloud.eu/global-skills/development-scripts |
-| Gondor Argo CD template, rendered desired state, and repository connection | `development-gitops-argo-cd-home-gondor-v1` | https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-gitops-argo-cd-gondor-v1 |
+| Gondor Argo CD template, rendered desired state, and repository connection | `development-gitops-argo-cd-home-gondor-v1` | https://gitea.lego-cloud.eu/home-gondor-v1-skills/development-gitops-argo-cd-home-gondor-v1 |
-The channel skill may narrow authority, lifecycle, workspace, visibility, handoff, and evidence requirements. When a project/channel overlay conflicts with a reusable skill on branch naming, human confirmation, worker count, review identity, merge authority, deployment authority, or release authority, the explicit project/channel overlay wins; inherit only the non-conflicting mechanics. It must not restate generic RED–GREEN–REFACTOR mechanics, shell-module layouts, pnpm workspace conventions, ordinary Git branching mechanics, exact-head gate algorithms, or Argo CD authoring procedures. Improve those reusable skills at their linked sources and keep only the project/channel overlay here.
+The channel skill may narrow authority, lifecycle, workspace, visibility, handoff, and evidence requirements. Project bindings must not contradict global skills. The global `development-gates` contract governs independent review, review-before-push ordering, candidate/base identity and CI. Project overlays supply branch naming, human ownership, one implementation worker, visibility and existing merge/deployment/release authority without weakening these gates; inherit only non-conflicting mechanics. It must not restate generic RED–GREEN–REFACTOR mechanics, shell-module layouts, pnpm workspace conventions, ordinary Git branching mechanics, exact-head gate algorithms, or Argo CD authoring procedures. Improve those reusable skills at their linked sources and keep only the project/channel overlay here.
 ## Implementation Entry Gate
@@ -87,9 +73,7 @@ Load `development-durable-wave-execution`, `development-branching-strategy`, and
 The Corp v1 overlay is narrower: every Task requires a dedicated visible branch and PR before substantive coding, and that PR must carry the Task ID, wave, planned scope, current state, exact head, and governed `test` base. If Gitea requires a delta, use an empty kickoff commit rather than a filler file. Read the branch and PR back before editing. One Task maps to one branch and PR unless Architecture or the human owner explicitly approves another topology.
 ## Proactive Iteration Requirement
 Every delivery iteration must complete at least one useful, safe activity for an implementation-approved Feature or delivery-health need: implement an unblocked task, add unit tests, diagnose/fix CI, improve build tooling, update real Ways of Working/Engineering guidance, verify dependency readiness, or document a concrete blocker with evidence. Never create filler changes. Select work only from exact Tasks in `READY_FOR_DELIVERY`; claiming one moves it to `IN_PROGRESS`. Keep architecture's approved task/dependency plan and project documentation current.
 ## Approved Information Boundary
@@ -124,27 +108,13 @@ Load `development-gates` before candidate review, remote CI, merge, or integrati
 Delivery still monitors repository-specific compile/type, unit-test, lint/format, dependency, packaging, workflow, image/container contract, Helm chart, and artifact-publication failures. Functional non-unit browser, integration, performance, security-boundary, and acceptance failures arrive as UAT evidence and are routed back for application remediation. A green local build is never remote CI evidence.
-### Per-project reusable CI base images
+Before base-image work, load `ci-runtime-skic` and [the project image binding](references/runtime-and-ci.md#per-project-reusable-ci-base-images).
 Each project should own `corp-v1-<code>/corp-v1-<code>-base-images` when stable runtimes or OS tools would otherwise be downloaded repeatedly in CI. Before creating, publishing or consuming an image, load [the project base-image bindings and required owner loads](references/runtime-and-ci.md#per-project-reusable-ci-base-images). It retains digest pinning, credential-free candidate validation, trusted integration-branch publication, immutable tags/digest readback, fail-closed tests and forward repair with the last known-good digest. Runtime smoke remains UAT-owned; reusable mechanics are owned by `devsecops-ci-cd-gitea` through that decision-point reference.
 ### Runtime-resource placement
 CI jobs and developer workstations must not provision databases, queues, object stores, caches, brokers, or other application runtime services. When implementation or validation needs such a resource, provision it under the owning application on the approved shared runtime platform through that project's GitOps repository, then consume it through a governed application or test interface.
 - Keep every non-production environment—including development, integration, test, staging, and preview—and all of its resources isolated from production and from other non-production environments. Destructive or concurrent validation requires a per-run database/schema/role or explicit serialization; it must not reset shared data.
 - CI may orchestrate exact-head validation, but it must not start application runtime-resource service containers or receive application-resource credentials. Harmless process-local test doubles and build tools are not runtime resources. Prefer a narrowly governed in-platform Job/Workflow trigger so a private resource does not need public, NodePort, or runner-network exposure.
 - Persistent storage must follow the project's named platform storage operations skill; load that skill before designing or mutating storage. If the project instead names an approved storage procedure, read that exact procedure and verify its current provenance before acting. If neither an approved skill nor an approved procedure is identified, stop and route the missing decision to Architecture/platform operations; do not infer a provider or provisioning method. Never accept a dynamically provisioned volume whose reclaim policy can delete durable data when the PVC is removed.
 - Secrets come from the approved external secret store; never commit connection strings or credentials.
 - Provision and verify required runtime resources before treating dependent application work as deployable. Missing infrastructure blocks deployment, not safe code-only work whose tests do not require that resource.
 ## Failure-Repair Workflow
-Load [failure-and-documentation.md](references/failure-and-documentation.md#failure-repair-workflow) when a build or CI failure is observed. It owns diagnosis, safe forward repair, affected validation, exact-head CI and escalation destinations. Keep repairable failures in the same Task/gate; pause only for the documented external, authority, decision or safety blocker. Never guess requirements or Architecture, weaken a gate or treat a blocker as passing.
+Load [failure-and-documentation.md](references/failure-and-documentation.md#failure-repair-workflow) when a build or CI failure is observed. It binds `ci-runtime-skic` for safe repair and `status-reporting-skic` for blocker routing, with existing gate owners for exact-head verification. Keep repairable failures in the same Task/gate; pause only for the documented external, authority, decision or safety blocker. Never guess requirements or Architecture, weaken a gate or treat a blocker as passing.
-## Documentation Ownership
+Before changing Ways of Working or Engineering, load `delivery-docs` and [the concrete documentation bindings](references/failure-and-documentation.md#documentation-ownership).
 Delivery owns verified Ways of Working and Engineering content, not documentation-platform mechanics. Before changing either area, load [the domain coverage contract](references/failure-and-documentation.md#documentation-ownership), the linked global `documentation-docusaurus` source and the project-adopted documentation overlay. Load `corp-v1-glossary` before defining reusable terms. Keep planned practice distinct from operational evidence.
 ## UI/UX Coordination
@@ -162,6 +132,8 @@ For frontend-affecting work, Delivery requires the approved UI/UX design package
 8. Maintain Ways of Working and Engineering pages when durable practice changed.
 9. Post a concise update with work completed, evidence, blockers, and required decisions.
 Do not silently choose between contradictory requirements or Architecture decisions, approve releases, or bypass review/branch protections.
 ## Authority and Escalation
 May autonomously:
@@ -193,43 +165,17 @@ Review provenance and exclusions: [AeroSim lessons review](references/aerosim-le
 Every project adoption must bind this channel to a dedicated local workspace under the active working root. Keep clones, worktrees, plans, reports, screenshots, generated artifacts, retained logs, and channel inputs inside that channel root. Use run-unique or task-specific children under `workspace/`; keep durable project truth in approved repositories. A local folder boundary organizes execution only—it neither broadens authority nor replaces remote evidence. Delivery adoptions should additionally use a channel-level `cache/` for reusable pinned toolchains and dependencies, while keeping Task evidence isolated by Task.
-## Project-Adoption Delivery Lessons
+## Decision-point references
-Use the exact Task-file state. The canonical progression is `IN_BACKLOG → READY_FOR_DELIVERY → IN_PROGRESS → TO_BE_RELEASED → DONE`; `BLOCKED` is a separate reasoned flag, and neither merge nor green CI means `DONE`. A Task already in `READY_FOR_DELIVERY` is Focus-admitted and pickup-ready; Delivery claims it by moving directly to `IN_PROGRESS` without inventing a second admission gate.
+Before selecting/continuing/reviewing/merging/handoff load [Task gates](references/task-delivery-gates.md); before branch/PR work load [repository entry](references/repository-entry-and-visibility.md). Before commands, CI, images or resource work load [runtime bindings](references/runtime-and-ci.md); before failure repair/docs load [failure/docs bindings](references/failure-and-documentation.md). Before planning changes load [planning reconciliation](references/planning-artifact-reconciliation.md); on failed/resumed gates load [exception checks](references/common-pitfalls.md).
-Keep exactly one Task active unless the adopted project authority explicitly defines another safe model. Establish a visible branch and PR before implementation, freeze Task/branch/PR identity, verify every review against the exact candidate head, and end Delivery ownership at `TO_BE_RELEASED`. Failed gates remain active and are repaired forward until they pass or a genuine external, authority, decision, or safety blocker is evidenced.
+Project adoptions may narrow implementation execution to a main session or prohibit implementation subagents/cron. Preserve that overlay without prohibiting independent read-only review; this reference grants no account recovery, permission, merge, release or deployment authority. Keep exactly one Task active unless explicit project authority defines another safe model. Freeze Task/branch/PR identity and retain exact-head review under the ordered gates.
-Load the matching detailed reference at the decision point—not from memory:
+When selectable controls are needed, provide complete options and their trade-offs, recommended first; follow the active interface's option-rendering contract without hiding consequences.
 - Task selection, execution, review, merge, and handoff: [references/task-delivery-gates.md](references/task-delivery-gates.md)
 - Status, wave, blocker, CI, and completion wording: [references/status-and-reporting.md](references/status-and-reporting.md)
 - Workspace, branch, PR, and visibility entry: [references/repository-entry-and-visibility.md](references/repository-entry-and-visibility.md)
 - Toolchain contexts, CI, images, and runtime placement: [references/runtime-and-ci.md](references/runtime-and-ci.md)
 - Failure repair and Delivery-owned documentation: [references/failure-and-documentation.md](references/failure-and-documentation.md)
 - Planning-artifact reconciliation: [references/planning-artifact-reconciliation.md](references/planning-artifact-reconciliation.md)
 - Gate failures, resumptions, blockers, merge, and completion: [references/common-pitfalls.md](references/common-pitfalls.md)
 Project adoptions may narrow execution to a named main session or prohibit subagents/cron. Preserve that project-local authority overlay; the central reference does not grant account recovery, permission changes, merge, release, or deployment authority.
-When selectable controls are needed, explain every complete option and its trade-offs in prose first, then use short `Option A`, `Option B`, and so on labels in the control. Put the recommended option first and keep button labels free of hidden consequences.
+Before final Delivery handoff, load [final verification](references/final-verification.md) and check the retained evidence against the ordered Task gates; do not repeat the checklist here.
 ## Common Pitfalls
 Load [common-pitfalls.md](references/common-pitfalls.md) on failed gates, resumed work and before blocker/CI/merge/completion reports. It retains the complete Delivery traps, including approval/admission, same-project scope, useful safe activity, real evidence and same-gate forward repair. These reminders do not replace the ordered Task gates.
 ## Verification Checklist
 - [ ] Only same-project channels and repositories were used.
 - [ ] Work maps to approved requirements/architecture.
 - [ ] Feature has explicit human `Approved for Implementation` evidence and a documented target version.
 - [ ] Selected tasks respect documented dependencies and carry exact Task `READY_FOR_DELIVERY` evidence.
 - [ ] At least one useful delivery activity was completed, or a concrete blocker was documented and routed.
 - [ ] Applicable project skills were loaded.
 - [ ] Tests and builds were actually run.
 - [ ] Remote branch and matching CI head SHA were verified.
 - [ ] Contradictions were escalated, not guessed through.
 - [ ] Ways of Working and Engineering documentation remains accurate.
 - [ ] Completed work includes exact evidence.
 ## Canonical naming and compatibility
@@ -239,3 +185,7 @@ Load [common-pitfalls.md](references/common-pitfalls.md) on failed gates, resume
 - Naming-only migration authorized by RootAtSkic in [presentation message 1562523679223578705](https://discord.com/channels/1518726359512387766/1543922127898415154/1562523679223578705). Repository ID, history, support files, project authority and organization ownership are preserved.
 - This is a reusable central reference, not a new shared Discord channel. Project adoptions use `channel-delivery-skic-<code>` and remain separately owned.
 - Current project channel: `<code>-delivery` inside `skic-<code>`.
 ## Channel workspace standard
 Load `channel-workspace-organization` for channel setup, file placement, and authorized workspace migration. Canonical standard: https://gitea.lego-cloud.eu/global-skills/channel-workspace-organization . Follow that shared policy rather than duplicating it here. Existing workspace bindings below remain current until an authorized migration is completed and verified; this reference alone does not relocate files or change bindings.
@@ -1,30 +0,0 @@
 # Naming Delivery review
 ## Outcome
 Applied the seven requested canonical skill-identity bindings only inside the two assigned Delivery source packages. Operational entry/reference loads and routing tests use canonical names. AeroSim retains exactly **18 direct dependencies**; central Delivery retains its original **12**. Compatibility aliases are not added as owners. Completed responsibility consolidation and all retained gate, recovery, worker, storage, UAT and authority clauses remain intact.
 ## Preservation and evidence
 - Original checksum manifests were not edited or regenerated. Golden comparisons reverse only the explicit seven identity substitutions before matching protected clauses/checksums; original hashes remain authoritative.
 - Added exact dependency-list/count/uniqueness tests against Git HEAD, reversible mapping tests, negative policy-mutation checks, and operational legacy-load detection. Generic Discord tags, runtime workspace/environment names and provenance URLs are not normalized.
 - Historical SIMPLIFICATION/ADOPTION records and legacy source URLs remain unchanged as provenance. Canonical repository publication is the parent's work; this local review does not invent new repository URLs or claim publication of those pending owner packages.
 - FULL-PROGRAM.md now cites Piotras Board approval plainly at message `1563064779772526616`. Its acceptance update records parent-reported GitOps canonical+alias+generic-base install/skill_view verification at `7ceb741c5fecbe34eb06e10a72e3ae26e3cc6f14`, plus merged/installed gates `02e716ddff053c71a921839419ed2bd2334f1e67`, integrity `3ca0fbb284b5eb194ad5ff1f2756f1fde0077c6a`, TTD `d3d91be7bb2926b0f1bd16db60c0fe2250ed8d39` and wave `a180018ef3bc337bb1fbabd095fa7a4e13471fc5`.
 - `corp-v1-glossary` identity/source unchanged: public-to-private transfer needs a decision. **A02/A04 remain unresolved and require a human choice.** A17 bounded resumption-evidence gap remains unchanged.
 ## Executed local verification
 Using `/opt/hermes/.venv/bin/python` with each package's standalone `verify_full_program.py`:
 | Package | unittest | standalone functions/main | total | local links | diff check |
 |---|---:|---:|---:|---:|---|
 | channel-delivery-skic | 22 | 3 | 25 | 29 | passed |
 | channel-delivery-skic-aerosim | 32 | 4 | 36 | 36 | passed |
 Central operational content: 80,924 HEAD baseline → 76,535 bytes; AeroSim: 105,884 → 104,686 bytes. These retain consolidation reductions despite longer canonical names.
 ## Changed files / limits
 Both packages: SKILL.md, FULL-PROGRAM.md, runtime-and-ci.md, affected routing/semantic tests, golden-comparison tests and standalone verifier import setup. AeroSim additionally: planning-artifact-reconciliation.md, failure-and-documentation.md and gitea-actions-policy.md. Added `canonical_identity.py` and `test_canonical_identity.py` under each existing harness directory, and this review report.
 Existing worktree modifications were preserved. No commit, push, install, scheduler/account operation or runtime write occurred. No owner publication performed here. Initial local mapping regex was corrected before verification; all final standalone harness checks pass. No unresolved local test failures.
@@ -1,21 +1,5 @@
-# the adopted project Delivery Pitfalls
+# Delivery exception checks
-Load this reference when a gate fails, when work resumes after interruption, or before reporting a blocker, CI result, merge, or completion.
+On failed gates or resumption, load [Task gates](task-delivery-gates.md) and [planning reconciliation](planning-artifact-reconciliation.md) to verify original admission, current claim and visibility; merged planning text is not implementation approval.
-Before execution, load [runtime-and-ci.md](runtime-and-ci.md#execution-context-toolchain-preflight) for exact-context preflight. Before claims, load `development-gates` and `development-integrity`, then [status-and-reporting.md](status-and-reporting.md) and [planning-artifact-reconciliation.md](planning-artifact-reconciliation.md) for project formatting, semantic reconciliation and duplicate suppression.
+Load `ci-runtime-skic` before command/repair work, `delivery-docs` before recording operational practice, and `status-reporting-skic` before blocker or completion wording. These owners carry their topic pitfalls once; do not repeat them here.
 ## Common Pitfalls
 1. Patching symptoms before understanding root cause.
 2. Changing requirements or architecture implicitly through code.
 3. Editing without loading applicable project engineering skills.
 4. Skipping tests for behavioral fixes.
 5. Updating documentation with aspirational rather than actual practice.
 6. Inspecting another project.
 7. Starting implementation because requirements exist but human implementation approval is absent.
 8. Ignoring architecture task dependencies, the Task's `READY_FOR_DELIVERY` handoff, or target-version allocation.
 9. Posting passive status when safe implementation, testing, diagnosis, or documentation work is available.
 10. Treating a human-merged planning or Architecture documentation PR as implementation approval.
 11. Treating an ideation-board entry, generated presentation, or broad approval as equivalent to an exact Task `READY_FOR_DELIVERY` transition—or requiring a second admission after that verified transition.
 12. Editing in a local-only worktree or on a differently named local branch before the exact remote branch and PR head are visible and verified.
 13. Stopping at a repairable gate failure, abandoning the active Task, or starting another Task instead of fixing forward and rerunning the gate until it passes.
@@ -1,56 +1,13 @@
-# the adopted project Failure and Documentation Operations
+# Project failure and documentation bindings
 Load this reference when repairing a failure or changing Delivery-owned project documentation.
 ## Failure-Repair Workflow
-When a build or CI failure is observed:
+Before diagnosis or forward repair, load `ci-runtime-skic` for the same-gate repair loop and [Unit testing](runtime-and-ci.md#unit-testing) for local TTD/exception authority. Before blocker communication, load `status-reporting-skic` for the evidence packet and owner routing. Keep the selected Task/gate; never weaken requirements to pass it.
 1. verify repository, linked branch and PR, exact failed command/file/test/job, failure class, and exact logs;
 2. reproduce locally when feasible;
 3. determine root cause before editing;
 4. compare the intended fix against approved FR/NFRs, ADRs, architecture documentation, and project conventions;
 5. load `development-method-ttd` and [runtime-and-ci.md — Unit testing](runtime-and-ci.md#unit-testing); observe the product-reason unit failure before behavior changes;
 6. implement the smallest safe forward fix, preserving valid shared work and missing-RED honesty;
 7. run local validation;
 8. commit and push through the approved branch workflow;
 9. inspect CI for the exact new head SHA;
 10. report evidence and remaining risk;
 11. repeat diagnosis, repair, and affected validation until the active gate passes.
 The skill must continue with a safe forward fix when the failure and expected behavior are clear. A repairable failure does not end the Task or authorize moving to another gate or Task. If evidence is insufficient, requirements/architecture conflict, an external dependency is unavailable, or the required action exceeds authority, keep the Task in the same gate, record the separate blocker with evidence and owner, and raise the issue in the relevant channel:
 - requirement/product ambiguity → `general` and/or `architecture` as appropriate;
 - architecture contradiction → `architecture`;
 - release policy/readiness ambiguity → `releases`;
 - implementation-only blocker → `delivery`.
 Never guess the team's intended direction, weaken a gate, or treat a blocker as a passed gate. Resume the same gate and continue the repair loop when the blocker is removed.
 ## Documentation Ownership
-Before authoring or validating documentation, load `documentation-docusaurus` from [the global source](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/documentation-docusaurus) and the project-adopted documentation overlay for Diátaxis, Markdown/MDX, navigation and build mechanics. Verify source identity: an unrelated same-name installation is not this global owner. Before defining reusable terms, load `corp-v1-glossary` from [its source](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/corp-v1-glossary); it owns canonical definitions in the final top-level Glossary and domain-page links. If the required owner cannot be loaded, stop the affected documentation action.
+Before changing Delivery-owned Ways of Working or Engineering, load `delivery-docs` for coverage and evidence-to-page reconciliation. Bind the authoring owner to `documentation-docusaurus-global` at https://gitea.lego-cloud.eu/home-v1-skills-code-agent/documentation-docusaurus, plus the project-adopted overlay. Before defining reusable terms, bind/load `glossary-skic` at https://gitea.lego-cloud.eu/home-v1-skills-code-agent/glossary-skic. Stop if the source-qualified owner is unavailable; an unrelated same-name runtime skill is not that owner.
 Delivery retains these domain outcomes in two areas:
 ### Ways of Working — five sections
 1. **Delivery workflow** — intake, prioritization, implementation states, and definition of done.
 2. **Branching and reviews** — branch conventions, pull requests, approvals, and merge expectations.
 3. **Planning and ownership** — backlog, sequencing, owners, dependencies, blockers, and escalation.
 4. **Quality practices** — review standards, test strategy, defect handling, and evidence expectations.
 5. **Collaboration and decisions** — channel routing, handoffs, decision references, and communication norms.
 ### Engineering — five sections
 1. **Repository and workspace** — monorepo/application/package structure and local prerequisites.
 2. **Development and unit testing** — commands, unit-test fixtures, debugging, Delivery artifact validation, and the handoff to UAT for every functional non-unit suite.
 3. **Build and continuous integration** — pipelines, checks, artifacts, runners, and failure diagnosis.
 4. **Packaging and deployment preparation** — containers, Helm/GitOps interfaces, configuration, and release inputs.
 5. **Operations and troubleshooting** — observability, known failure modes, recovery checks, and evidence collection.
 Update these pages from verified project practice. Do not document a planned process as already operational.
 ## Synchronization Workflow
-Before reconciling planning/Architecture/Kanban changes, load [planning-artifact-reconciliation.md](planning-artifact-reconciliation.md) for Task-row semantics and its verification-owner loads. Use the entry skill's synchronization/iteration contract for useful safe work and current documentation. Reconcile only changed evidence; do not duplicate its workflow here.
+Before reconciling planning/Architecture/Kanban changes load [planning-artifact-reconciliation.md](planning-artifact-reconciliation.md); follow the entry skill's single synchronization workflow for useful safe work and domain-owner loads.
@@ -0,0 +1,16 @@
 # Final Delivery verification
 - [ ] Only same-project channels and repositories were used.
 - [ ] Work maps to approved requirements/architecture.
 - [ ] Feature has explicit human `Approved for Implementation` evidence and a documented target version.
 - [ ] Selected tasks respect documented dependencies and carry exact Task `READY_FOR_DELIVERY` evidence.
 - [ ] At least one useful delivery activity was completed, or a concrete blocker was documented and routed.
 - [ ] Applicable project skills were loaded.
 - [ ] Tests and builds were actually run.
 - [ ] Remote branch and matching CI head SHA were verified.
 - [ ] Contradictions were escalated, not guessed through.
 - [ ] Ways of Working and Engineering documentation remains accurate.
 - [ ] Completed work includes exact evidence.
 Apply this evidence checklist before a final Delivery handoff. It checks the existing gates; it grants no new authority and is not another implementation stage.
@@ -6,9 +6,9 @@ Use when planning or readiness documentation changes while implementation remain
 Before verifying a PR or CI, run `skill_view(name="development-gates")` and load its `references/review-ci-merge-contract.md`: **Evidence model**, **Attempt integrity**, and **Concurrent publication** own candidate/remote equality, complete successful job inventory including aggregates, and separate integration evidence. Do not use a successful listed-task subset as a gate.
-Before reporting, load `skill_view(name="development-integrity")` and its `references/remote-checkpoint-matrix.md` for the current remote checkpoint, changed-head invalidation and candidate-versus-integration claims; then load [status-and-reporting.md](status-and-reporting.md) for Delivery formatting. Preserve project reviewer/merge authority; A02/A04 review-order/base-drift remain bounded unresolved clauses, not implicitly settled by these loads.
+Before reporting, load `skill_view(name="development-integrity")` and its `references/remote-checkpoint-matrix.md` for the current remote checkpoint, changed-head invalidation and candidate-versus-integration claims; then load [status-and-reporting.md](status-and-reporting.md) for Delivery formatting. Preserve project merge authority; A02/A04 follow global independent review-before-push and any-target-base-change invalidation without local exceptions.
-Before validation, load `documentation-docusaurus` and the project-adopted overlay through [Documentation Ownership](failure-and-documentation.md#documentation-ownership); verify source identity. Run the complete repository validator and production build with frozen-lockfile installation and `git diff --check`. The global owner identity mismatch remains unresolved: retain the bounded nested-pnpm fallback below, not an assumed replacement owner.
+Before validation, load `documentation-docusaurus-global` and the project-adopted overlay through [Documentation Ownership](failure-and-documentation.md#documentation-ownership); verify source identity. Run the complete repository validator and production build with frozen-lockfile installation and `git diff --check`. Generic and VSSA packages now have separate source-qualified names. Retain the bounded nested-pnpm fallback below until that procedure is present in the generic owner; identity repair alone does not establish procedural coverage.
 If child scripts cannot find pnpm, use `corepack enable --install-directory <cache>/pnpm-bin`, prepend that temporary shim directory to `PATH`, and rerun the declared command. Keep shim/dependency caches outside commits and verify the worktree remains clean.
@@ -23,6 +23,8 @@ Delivery must verify the Feature decision and exact Task `READY_FOR_DELIVERY` st
 Before any implementation or repository content change begins on a newly claimed the adopted project Task, establish and verify all of these Gitea checkpoints:
 Visibility-only kickoff commits contain no file/tree changes. This exception does not authorize a substantive push: freeze and independently review every implementation or documentation candidate before publication.
 1. Create the dedicated local branch with the required Task branch name, create an empty kickoff commit if needed, and push that exact branch immediately.
 2. Open a visible pull request from that exact branch to `test` before editing a repository file. Do not wait for implementation, tests, review, or a finished diff.
 3. Put the Task ID, wave, planned scope, and current Task state in the PR so the active project authority and the team can monitor progress from the beginning.
@@ -1,40 +1,10 @@
-# the adopted project Runtime and CI
+# Project runtime bindings
-Load this reference before login, toolchain execution, CI work, image publication, or Gondor resource work.
+Before commands, CI changes, image publication, resource work or repair, load `ci-runtime-skic` and follow its full procedure with these bindings. Before login or credential-bearing operations, load `development-security-skic` and `development-security`; Board policy remains authoritative. Stop the affected action when an owner cannot load.
 ## Channel-owned workspace
-Resolve the channel root as `<code>-delivery/` under the active user's working root:
+Bind the project channel root under the active working root, Task `workspace/<TASK_ID>/`, reusable `cache/` and channel-provided `uploads/`. The shared owner defines cache contents, optional folders, real-CWD containment and exact-context preflight; this binding does not authorize execution outside the selected Task.
 ```text
 <code>-delivery/
 ├── cache/                 # reusable channel toolchains and technical dependencies
 ├── uploads/
 └── workspace/
    └── <TASK_ID>/
        ├── application/       # always: repository clone
        ├── documentation/     # always: repository clone
        ├── review/            # optional: only when separate review files are needed
        ├── cache/             # optional: only when a Task-specific cache is needed
        ├── tmp/               # optional: only when temporary Task files are needed
        ├── logs/              # optional: only when logs must be retained
        └── artifacts/         # optional: only when outputs must be retained
 ```
 - `cache/` contains reusable technical dependencies installed by Delivery, including pinned Node/pnpm toolchains, Nginx binaries, and package-manager download caches. Browser/Playwright dependencies for non-unit suites belong to the UAT workspace and E2E repository. Reuse verified entries across Tasks instead of reinstalling them. Version or digest cache paths when compatibility matters, verify the resolved executable and version in every execution context, and never store credentials, Task evidence, repository content, or mutable application state there.
 - `uploads/` contains files supplied through this channel. It is not a repository checkout or build directory.
 - Create one `workspace/<TASK_ID>/` directory per Task.
 - During `GATE_001_PREP`, create only the required repository clones: `application/` and `documentation/`. If a Task genuinely needs another repository, clone it as another clearly named child.
 - Do not create Task-local `review/`, `cache/`, `tmp/`, `logs/`, or `artifacts/` speculatively. Create each folder only when a concrete activity for that Task needs it.
 - Use Task-local `review/` only for a separate review checkout or review output. Use Task-local `cache/` only for non-reusable data bound to that Task; reusable installed technical dependencies belong in the channel-level `cache/`. Use `tmp/`, `logs/`, and `artifacts/` only for their named Task-local purpose.
 - Run dependency installation, generation, tests, and builds inside the applicable repository clone using that repository's normal paths. Copy or export outputs to `artifacts/` only when they must be retained separately.
 - Keep every optional folder inside the selected Task directory. Never share it between Tasks or place it at the channel root.
 - Before every local repository command, resolve the real working directory and require it to be inside the selected Task directory. A command running elsewhere is invalid evidence and must stop before mutation.
 - Do not reuse another Task's clone or support folder as a shortcut. Resume only from the selected Task's own workspace after fetching and matching its visible PR head.
 ## Shared Corp v1 System Login
 Before login, load `channel-board-skic` and follow its complete **Corp v1 System SSO Credential Use** policy through [Delivery's source/authority binding](../SKILL.md#shared-corp-v1-system-login). Stop if unavailable; secret access grants no additional authority.
 ## Delivery Responsibilities
@@ -42,43 +12,24 @@ Before login, load `channel-board-skic` and follow its complete **Corp v1 System
 Load `development-monorepo-pnpm` for pnpm/TypeScript implementation and `development-scripts` for Taskfile, shell, environment and Devbox work, using their [source links and project-overlay precedence](../SKILL.md#development-skill-routing). Preserve project structure/namespace; implement only approved Features and authorized Tasks with small, traceable changes, no unrelated refactors and no fabricated results.
 ### Unit testing
 Load `development-method-ttd` before every behavior change, defect fix or refactor. Follow its mandatory failing-test-first unit workflow and retain real commands/results; request non-unit coverage from UAT. Exceptions require the authorized project owner explicitly approving a documented exception. Discard/start-over applies only to the executor's isolated, unpublished experimental delta, preserving unrelated or valid work. Never rewrite shared history, delete another worker's changes or revert integrated work. Repair shared/integrated code forward, record historical missing RED honestly and never claim retrospective tests proved test-first compliance; seek the named project-authority exception if compliant repair cannot satisfy the gate.
 ### Build and continuous integration
-Use [Delivery's build/CI responsibilities](../SKILL.md#build-and-continuous-integration) for the required failure classes and UAT remediation boundary. Before reporting CI, load `development-integrity` through [status-and-reporting.md](status-and-reporting.md); a local build is not remote CI evidence. Task gate job inventory and exact-head checks still apply.
+Load `ci-runtime-skic`, `development-gates` and `development-integrity`; preserve the required job inventory and local gate order in [Task gates](task-delivery-gates.md). Before Actions or publication load `devsecops-ci-cd-gitea` and the bound project overlay.
 ### Execution-context toolchain preflight
-Immediately before every repository operation, load `skill_view(name="development-scripts", file_path="references/runtime-preflight.md")` for exact-context checks and repair, plus `skill_view(name="development-monorepo-pnpm", file_path="references/workspace-and-tooling.md")` for committed versions. Load `development-scripts` for the selected repository's script overlay; generic mechanics never replace project authority.
+Before each foreground/background/worktree/worker/review/CI command, load `ci-runtime-skic` and its exact-context preflight, including `development-scripts` → `references/runtime-preflight.md` and `development-monorepo-pnpm` → `references/workspace-and-tooling.md`. Supply the selected Task/repository, branch/PR/revision, allowed scope and `CORP_V1_<CODE>_*` non-secret environment names. Load `development-scripts` for the repository overlay.
 Treat every foreground shell, detached worktree, background process, worker, Hermes main-session review command, and CI job as a separate execution context. Complete the applicable preflight in that exact context before execution; the full owner procedure is mandatory for a Node/pnpm repository or any command that may invoke Node or pnpm. Stop on failed preflight or an unavailable owner; do not run the original command until its complete preflight passes.
 Delivery supplies the selected Task directory, selected repository, expected branch/PR/revision, required non-secret environment names under `CORP_V1_<CODE>_*`, and allowed command scope. Preserve Task/cache isolation and real-CWD containment above. Preflight does not authorize resource-dependent tests, functional non-unit suites, credentials, Devbox execution or deployment; the existing project boundary decides allowed operations. Narrow local checks never replace complete repository CI, all required jobs/aggregates or exact-head evidence in [Task gates](task-delivery-gates.md).
 Before Delivery publication/install or operational adoption, verify the published and installed owner reference covers the mapped safeguards and record its immutable owner revision and reference hash. The adopted immutable owner revisions and reference hashes are recorded in FULL-PROGRAM.md and the owner-consolidation manifest; a sibling source checkout is not installed-owner evidence. If that gate is unresolved, stop adoption rather than silently weakening preflight. See [FULL-PROGRAM.md](../FULL-PROGRAM.md#final-bounded-owner-consolidation) for inspected evidence.
 ### Per-project reusable CI base images
-the adopted project owns `corp-v1-<code>/corp-v1-<code>-base-images` as the reusable CI-image repository. Use it when stable runtimes or operating-system tools would otherwise be downloaded repeatedly in application jobs.
+Bind `corp-v1-<code>/corp-v1-<code>-base-images`, trusted publication branch `test`. Before image work load `ci-runtime-skic` for digest consumption and forward-repair safeguards and its required `devsecops-ci-cd-gitea` reference loads.
 Before creating, validating, publishing, consuming or repairing a base image, load `skill_view(name="devsecops-ci-cd-gitea", file_path="references/base-images.md")`, then its `references/pipeline-workflow.md` and `references/harbor-auth.md` trust/credential contracts. The owner carries construction, credential-free candidate validation, immutable publication/readback, fail-closed regressions and consumer verification mechanics. Stop if unavailable; retain all project-specific image requirements rather than replacing them with generic defaults.
 - Publish only from the trusted `test` branch of the selected project base-image repository; candidate checks remain credential-free. The global owner's configurable branch does not change this binding.
 - Consume the directly verified immutable digest in project workflows, never `latest`, a mutable tag or an unverified local name. Keep the first real Gitea build, Harbor publication, digest readback and consumer workflow at the exact PR-head SHA as separate Delivery evidence layers.
 - Runtime smoke and published-digest runtime acceptance belong to UAT, separately from Delivery static/unit validation. No publication or consumer success implies deployment or UAT acceptance.
 - Repair image or publication failures forward only. Preserve the last known-good digest for consumers until the replacement image and consuming workflow pass exact-head CI and applicable UAT acceptance.
 Owner adoption evidence: global CI source `669e28eadfe79ac7cb3c10ccdea318dd5296d481`; inspected source and installed `references/base-images.md` are byte-identical (SHA-256 `1fb0e24ec5789b195be9ae35fbb9529fa1cab56112dae5baf9455284ca490e53`). Its `owner-responsibility.json` maps both Delivery contracts. Reverify the complete published owner package and project CI overlay at adoption; this is owner-policy evidence, not a consumer build, publication or runtime result.
 ### Gondor runtime-resource placement
-The adopted project CI jobs and developer workstations must not provision PostgreSQL, queues, object stores, caches, brokers, or other application runtime services. Load `development-gitops-argo-cd-home-gondor-v1` before defining or changing Gondor desired state. Render the committed project template separately into one repository per environment; Delivery may update only the repository assigned to its non-production environment, while production remains outside Delivery authority unless an explicit project overlay says otherwise.
+Before resource/storage work load `ci-runtime-skic` for isolation, secret-store, retained-storage and selected GitOps owner/fallback procedures. Bind the approved template and separate desired-state repository for each environment. Only the project-approved non-production environment is within Delivery authority; missing storage/platform authorization blocks mutation.
 - Keep every non-production the adopted project environment—including development, integration, test, staging, and preview—and all of its resources isolated from production and from other non-production environments. Destructive or concurrent validation requires a per-run database/schema/role or explicit serialization; it must not reset shared data.
 - Delivery CI may orchestrate exact-head unit/build validation, but it must not start application runtime-resource service containers or receive application-resource credentials. Harmless process-local unit-test doubles and build tools are not runtime resources. UAT owns resource-dependent tests and their restricted execution; Delivery only provisions an approved development dependency and hands its exact identity to UAT. Do not expose PostgreSQL or another internal resource through Ingress, NodePort, LoadBalancer, or a runner-accessible public endpoint.
 - Before storage design or mutation, load `truenas` and `references/gondor-retained-application-storage.md`. That owner supplies dataset/NFS, retained static PV/PVC and live StorageClass verification; stop if unavailable. Durable storage must not use a deletion-reclaim policy. The load grants no platform authority and does not assert current live storage state.
 - Use only External Secrets backed by the existing Bitwarden `ClusterSecretStore`; never commit connection strings or credentials.
 - Provision and verify required Gondor resources before deploying dependent the adopted project code. Resource-independent implementation may proceed, but deployment remains blocked until the dependency is healthy and consumed by the application.
@@ -1,81 +1,5 @@
-# the adopted project Status and Reporting
+# Project reporting bindings
-Before reporting, load [development-integrity](https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-integrity) for checkpoint claims and implementation-versus-closure evidence. Delivery retains the vocabulary/format below and its existing review, gate, repair/help and scheduler boundaries; this load resolves none of those policy questions.
+Before Task/wave/CI/blocker/completion reports or lifecycle changes, load `status-reporting-skic` and `development-integrity` (including `references/remote-checkpoint-matrix.md`). The shared reporter owns vocabulary and templates; the current project Scope record remains authoritative.
-## Scope Status Vocabulary
+Bind the active project status-request authority, actual Release Task Board selector, Scope record and release owner before reporting. Missing records mean status unverified. No report changes admission, release authority or scheduler policy.
 Before reporting or changing any lifecycle status, read the project's current `ways-of-working/scope.md`. Use only the values defined there.
 Ideas, Epics, and Features:
 ```text
 IN_BACKLOG → IN_DESIGN → READY_FOR_DELIVERY → IN_DELIVERY → TO_BE_RELEASED → DONE
 ```
 Tasks:
 ```text
 IN_BACKLOG → READY_FOR_DELIVERY → IN_PROGRESS → TO_BE_RELEASED → DONE
 ```
 `READY_FOR_DELIVERY` is the exact Task's Focus-admitted, pickup-ready state. It means Architecture, dependencies, implementation boundaries, verification steps, and Kanban selection are complete; implementation has not started. Delivery claims that Task by moving it directly to `IN_PROGRESS`. Never require or invent a second Focus-admission decision after `READY_FOR_DELIVERY`.
 `CANCELLED` is an exceptional terminal status. `BLOCKED` is a separate flag with a reason and evidence; it never replaces the lifecycle status.
 Never invent, abbreviate, or substitute lifecycle values such as `Ready`, `Active`, `Delivered`, `Complete`, `Awaiting CI`, or `Overrun`. Those phrases may describe activity only when clearly separated from the status field. If the status cannot be verified, report `status unverified` and inspect the source record rather than guessing.
 A merge or successful CI does not automatically mean `DONE`. Releasable application Tasks normally move from `IN_PROGRESS` to `TO_BE_RELEASED`; `DONE` requires the applicable release or completion evidence. Status reports must show the exact value even when a separate plain-language action is also included.
 ## Wave Status Report
 When the active project authority explicitly asks for project, delivery, blocker, progress, or wave status, begin the status report with this exact first-line structure, with no text before it:
 ```text
 wave-previous: <previous wave> | wave-current: <current wave> | wave-next: <next wave>
 ```
 Each value must be an actual dependency-wave label calculated by the the adopted project Release Task Board, such as `Wave 11`, `Wave 12`, or `Wave 13`. Never substitute activities, work descriptions, statuses, invented phases, or ad hoc labels. Resolve the current wave and its adjacent existing waves from the Board selector and task assignments; do not infer them from conversation wording. Use `none` only when the Board has no previous or next wave.
 Do not repeat the wave header or task chapter in ordinary acknowledgements, implementation narration, questions, or non-status replies. Use them only when the active project authority explicitly asks for status.
 ### Current-wave task chapter
 Immediately after the header in a requested status report, include:
 ```text
 ## Wave XX (Current)
 - TASK-XXXX — <status> — Responsible: <Hermes main session or concrete owning process>
 ```
 Replace `XX` with the current Board wave number. List every Task assigned to that wave—never a sample or only changed Tasks—and use each Task's verified flow status. For responsibility, name Hermes main session when it actively owns the Task; otherwise name the concrete owning process, such as Delivery pickup, implementation/review, integration, or Release handoff. When no active executor or owning process exists, say `Unassigned`; never invent an agent, process, or ownership. Refresh the Board/task records and live process state before reporting when they may have changed.
 ### Human-facing delivery updates
 In every implementation, review, CI, blocker, merge, handoff, or completion update, lead with the linked branch and pull request where the work is visible. The next line must identify the Task, exact Task status, active gate code, and gate title:
 ```text
 <TASK_ID> | <TASK_STATUS> | <GATE_CODE> — <GATE_TITLE>
 ```
 Example:
 ```text
 TASK-0084 | IN_PROGRESS | GATE_003_TASK_IMPLEMENTATION — Implement and Review the Task
 ```
 While work remains inside a gate, continue reporting that same code. When its exit gate passes, report the transition explicitly:
 ```text
 GATE_003_TASK_IMPLEMENTATION passed → GATE_004_TASK_PR_CI
 ```
 When blocked, name the gate where progress stopped:
 ```text
 BLOCKED at GATE_004_TASK_PR_CI — Verify and Merge the Task PR
 ```
 Do not invent a separate phase or shorthand. Do not lead with or routinely include commit SHAs, tree hashes, digests, internal worktree paths, or temporary review-commit identities; retain those for automated verification and provide them only when the active project authority asks for audit detail or when an identity mismatch itself is the blocker.
 When anything fails, identify the exact failed command, file, test, or CI job. State its failure classification—application code, test assertion, workflow, infrastructure, credentials, or local execution environment—then provide the expected behavior and observed behavior, whether repository or remote state changed, and the concrete repair or owner. Never summarize a failure as only “validation failed”, “review failed”, or “CI failed”.
@@ -5,7 +5,7 @@ This file contains the ordered Delivery overlay for delivering one the adopted p
 Before candidate review, CI, merge or integration verification, run `skill_view(name="development-gates")` and load `references/review-ci-merge-contract.md`. Its Evidence model and Attempt integrity own immutable identities, complete required job/aggregate inventory, one successful attempt and separate integration evidence. Use those mechanics at each stage; retain the local exit outcomes and reviewer/authority bindings below. Missing owner guidance blocks the affected gate.
-**Bounded unresolved A02/A04:** substantive push/review order and “base drift is harmless” remain recorded local clauses pending the separate exact resolution. This consolidation does not choose between them and the reusable owner's ordering/base rule. Do not treat the load as approval of a new exception; route an affected conflict before acting.
+**Global gate alignment (A02/A04):** apply `development-gates` without project exceptions to review independence, substantive push ordering or base-change invalidation. Visibility-only kickoff publication does not publish implementation. The sequence below also applies to documentation claims/handoffs and GitOps candidates, not only application changes.
 ## End-to-End Task Delivery Gates
@@ -17,7 +17,7 @@ These gates are mandatory and ordered. Each `GATE_###_NAME` code is the stable i
 Before repository entry, load [repository-entry-and-visibility.md](repository-entry-and-visibility.md) for the complete entry/branch/visibility contract and [runtime-and-ci.md](runtime-and-ci.md#channel-owned-workspace) for required clones, optional directories, reusable cache and Task isolation. These remain mandatory gate inputs, not optional background reading.
-Hermes main session owns the Task, performs implementation and exact-head review, and communicates with the active project authority. Local repository tools execute deterministic commands. Gitea Actions runs remote CI. Gondor/GitOps is used only by an approved deployment or Release process. Cron never owns or continues a Task. No implementation or review subagent may work on the selected Task.
+Hermes main session owns the Task, performs implementation and obtains independent exact-head review, and communicates with the active project authority. Local repository tools execute deterministic commands. Gitea Actions runs remote CI. Gondor/GitOps is used only by an approved deployment or Release process. Cron never owns or continues a Task. No second implementation worker may work on the selected Task. A separate read-only reviewer is required; review is not implementation ownership.
 Verification is part of each stage, not a separate end checklist. Before leaving a stage, pass its **Exit gate** and retain the evidence named there. Every Delivery progress, blocker, CI, merge, handoff, and completion update must name the active gate code and title. When a gate passes, report the passed gate code and the next gate code. At every stage, use only the adopted project's eight project channels, load the references and engineering skills required for that action, route contradictions instead of guessing, and report failures with the exact command, file, test, or CI job.
@@ -29,7 +29,7 @@ Before repairing any failed check/review/CI/publication/exit condition, load [Fa
 **Repository and branch:** Read documentation remote `test` before branching. Establish fresh `application/` and `documentation/` clones inside the selected Task workspace under the loaded entry contract. Application branch: `<release>/<TASK_ID>-<short-explanation>-<attempt>`; documentation claim branch: `<release>/<TASK_ID>-start-delivery-<attempt>`. Each PR title equals its branch and targets `test`.
-**Runtime:** Hermes main session verifies eligibility, creates and reads back the application branch and PR without editing repository content, then creates the documentation branch and PR, updates the Task file, runs documentation checks, and merges the documentation PR only after its checks pass. Gitea Actions runs remote checks. Do not use HermesSubAgent or cron.
+**Runtime:** Hermes main session verifies eligibility, creates and reads back the application branch and PR without editing repository content, then creates the documentation branch and PR, updates the Task file, runs documentation checks, and merges the documentation PR only after its checks pass. Gitea Actions runs remote checks. No implementation subagent or cron; obtain independent read-only review before substantive documentation publication.
 **Required work:** Apply the loaded entry contract to exactly one current-wave `READY_FOR_DELIVERY` Task: Feature approval, dependencies, Architecture/requirements, target release and UI/UX readiness. Inspect only the adopted project’s eight channels. Establish and read back the application branch/PR before any edit. In the Task’s documentation clone add the hash-linked `READY_FOR_DELIVERY` to `IN_PROGRESS` event with actor, time, Task, wave, branch/PR evidence, previous hash and new hash; validate/review/merge it.
@@ -49,7 +49,7 @@ Before repairing any failed check/review/CI/publication/exit condition, load [Fa
 **Repository and branch:** Use `<code>-delivery/workspace/<TASK_ID>/application/` on the existing application Task branch and PR. Application source, unit tests, configuration, application-documentation changes, builds, and image/container/Helm artifact validation stay in that clone and branch. Every functional non-unit suite stays in the UAT-owned E2E repository. If a separate review checkout or output is needed, create and use `review/` under the same Task directory.
-**Runtime:** Main session implements and reviews inside the selected Task workspace. Load runtime preflight before every execution context and create optional folders only for concrete needs. No implementation/review subagent, human-review dependency or cron.
+**Runtime:** Main session is the sole implementer inside the selected Task workspace. The reviewer must not be the candidate implementer: obtain a separate read-only reviewer who must not edit, push, merge or become a second implementer. Load runtime preflight before every execution context and create optional folders only for concrete needs. No new human-review dependency or cron ownership.
 **Required work:**
@@ -57,22 +57,23 @@ Before repairing any failed check/review/CI/publication/exit condition, load [Fa
 2. Load `development-method-ttd` and follow mandatory failing-unit-test-first TTD for defects, new behavior and refactors; only an explicitly approved documented exception from the authorized project owner permits departure. Request non-unit coverage from UAT. Tooling, environment and credential failures are not product-test evidence.
 3. Implement only the approved Task, one behavior slice at a time. Keep the diff small, cover normal, edge, and failure behavior, avoid unrelated refactors, and repair forward without reverting valid work.
 4. Run all applicable focused and full unit tests, lint, format checks, typecheck or compile, production build, production dependency audit, static checks, generated-artifact checks, and Delivery-owned Dockerfile/image/container/publication/Helm artifact validations, plus `git diff --check` and repository-state checks. Do not run functional integration, browser, security-boundary, performance, or acceptance suites in Delivery; request and consume those results from UAT.
-5. After local checks pass, commit and push the Task changes without rewriting history. Read back the remote branch and PR and verify that the local checked revision, remote branch head, and PR head are identical.
+5. Freeze and commit the complete locally validated candidate without rewriting shared history. Record candidate head/tree, target-base SHA and merge-base; require a clean candidate worktree. Do not push substantive changes yet.
-6. Hermes main session reviews that exact PR head for logic, security, acceptance coverage, production-path use, and test gaps. Tests alone are not the review. The main session must inspect the complete diff and relevant production paths, record a pass/fail verdict for the exact revision, and remain accountable for that verdict. If review finds a problem, remain in `GATE_003_TASK_IMPLEMENTATION`: repair it on the same Task branch, rerun affected local checks, push the new PR head, and review that exact head again.
+6. Obtain independent logic/security review of that exact local candidate, including acceptance coverage, production-path use and test gaps. Tests alone are not the review. Record reviewer identity, base/head/tree and PASS/FAIL. Remote CI is not required to issue code-review PASS; publication readiness remains false until its later gates pass. If review finds a problem, stay in `GATE_003_TASK_IMPLEMENTATION`: the sole implementer repairs locally, reruns affected checks, freezes the new commit, and has the reviewer review that exact head again before its next substantive push. Any candidate change invalidates PASS.
 7. Push only the exact reviewed head after PASS and verify remote branch/PR head equality with the checked and reviewed local commit. If any identity differs, stop and reconcile; never transfer a verdict to a different head. Required exact-head remote CI is verified in Stage 4.
-**Exit gate:** Task-workspace/preflight rules and all local checks pass; every acceptance criterion has implementation/test evidence; `development-gates` candidate identity matches remote branch/PR and exact-head review has no unresolved finding. Later edits keep/return the Task to `GATE_003_TASK_IMPLEMENTATION` until affected checks, push/readback and review pass. Failure reports use [status-and-reporting.md](status-and-reporting.md): exact command/file/test/finding, observed versus expected behavior, failure class, mutation state and repair/owner.
+**Exit gate:** Task-workspace/preflight rules and all local checks pass; every acceptance criterion has implementation/test evidence; `development-gates` candidate identity matches remote branch/PR and exact-head review has no unresolved finding. Later edits keep/return the Task to `GATE_003_TASK_IMPLEMENTATION` until affected checks, independent local review and then push/readback pass. Failure reports use [status-and-reporting.md](status-and-reporting.md): exact command/file/test/finding, observed versus expected behavior, failure class, mutation state and repair/owner.
 ### Stage 4 — `GATE_004_TASK_PR_CI` — Verify and Merge the Task PR
 **Repository and branch:** Use the application PR and `application/` clone inside the selected Task workspace, targeting `corp-v1-<code>/corp-v1-<code>` `test`; then fetch and read the resulting application `test` revision in that same clone after merge.
-**Runtime:** Gitea Actions runs PR CI. Hermes main session verifies CI and PR state, confirms its own exact-head review still covers the PR head, performs the authorized Gitea merge, and reads back the merge result. No subagent reviews or merges.
+**Runtime:** Gitea Actions runs PR CI. Hermes main session verifies CI and PR state, confirms independent exact-head review still covers the PR head, performs the authorized Gitea merge, and reads back the merge result. The read-only reviewer never merges; the authorized main session remains the sole writer.
 **Required work:**
 1. Apply the loaded `development-gates` attempt-integrity contract to all required Delivery jobs: unit tests, lint, typecheck, build, static security and artifact validation, including the required aggregate.
-2. Immediately before merge, re-read the PR and current application `test`. Confirm that the PR remains open, its head is unchanged, its base is `test`, its branch equals the reviewed PR head, required CI is green, review still matches, the PR is mergeable, and base drift is harmless.
+2. Immediately before merge, re-read the PR and current application `test`. Confirm that the PR remains open, its head is unchanged, its base is `test`, its branch equals the reviewed PR head, required CI is green, review still matches, the PR is mergeable, and the target-base SHA still equals the reviewed base. Any target-base SHA change invalidates merge readiness, even when candidate head/tree is unchanged; refresh/synchronize and repeat validation and independent review under `development-gates`. There is no local harmless-drift exception.
-3. If conflict resolution, rebase, or any file/tree change is required, return to `GATE_003_TASK_IMPLEMENTATION`; repeat affected local checks, push/readback, and review for the new PR head; then restart `GATE_004_TASK_PR_CI` for that exact head.
+3. If conflict resolution, rebase, or any file/tree change is required, return to `GATE_003_TASK_IMPLEMENTATION`; repeat affected local checks, independent review of the frozen local candidate, and then push/readback for the new PR head; then restart `GATE_004_TASK_PR_CI` for that exact head.
 4. Apply the loaded owner’s reviewed-head merge and separate integration readback contract within existing merge authority.
 **Exit gate:** All required PR CI succeeds on the exact reviewed PR head; the final pre-merge check refers to that same head; the PR is merged; and the exact application `test` integration revision is known. The Task remains `IN_PROGRESS`; merge alone does not mean `TO_BE_RELEASED` or `DONE`.
@@ -0,0 +1,25 @@
 {
  "retained": [
    "channel-board-skic",
    "discord",
    "documentation-docusaurus-global",
    "glossary-skic",
    "development-durable-wave-execution",
    "development-gates",
    "development-integrity",
    "development-method-ttd",
    "development-branching-strategy",
    "development-monorepo-pnpm",
    "development-scripts",
    "development-gitops-argo-cd-home-gondor-v1"
  ],
  "additional": [
    "ci-runtime-skic",
    "delivery-docs",
    "status-reporting-skic",
    "development-security",
    "development-security-skic",
    "develop-monorepo-pnpm-app-skic",
    "develop-monorepo-pnpm-package-skic"
  ]
 }
@@ -0,0 +1,28 @@
 [
  {
    "path": "references/task-delivery-gates.md",
    "sha256": "6ecc350c0aaa66551a4bcd9a5da278c55980cce783eaf563a1a7546c1d5ac588"
  },
  {
    "path": "references/repository-entry-and-visibility.md",
    "sha256": "ee89ad297ea28e5a393b8a7e53de487883e64c720276f4055e368086d1c0ba65"
  },
  {
    "path": "references/planning-artifact-reconciliation.md",
    "sha256": "8676cb832199c4e11acc0f9f3abc649364a9ed6eec83d561ffd9c21bc556c3af"
  },
  {
    "path": "references/aerosim-lessons-review.md",
    "sha256": "e66dbafba963f95831ed230b15cee67b23677024bdbf464dae8cb2deb906a96e"
  },
  {
    "path": "SKILL.md",
    "heading": "Authority and Escalation",
    "sha256": "85635a7e636529593e5ed98ff8884b7078e429123442c59ae4f7db94cc1e0e40"
  },
  {
    "path": "SKILL.md",
    "heading": "UI/UX Coordination",
    "sha256": "c7331b08010fc4f931543a5ced352cc05d16df122aea2abafc3b3221da05b18d"
  }
 ]
@@ -0,0 +1,15 @@
 {
  "home-v1-skills-code-agent/development-gates": "global-skills/development-gates",
  "home-v1-skills-code-agent/development-integrity": "global-skills/development-integrity",
  "home-v1-skills-code-agent/development-method-ttd": "global-skills/development-method-ttd",
  "home-v1-skills-code-agent/development-durable-wave-execution": "global-skills/development-durable-wave-execution",
  "home-v1-skills-code-agent/development-monorepo-pnpm": "global-skills/development-monorepo-pnpm",
  "home-v1-skills-code-agent/development-branching-strategy": "global-skills/development-branching-strategy",
  "home-v1-skills-code-agent/development-scripts": "global-skills/development-scripts",
  "home-v1-skills-code-agent/devsecops-ci-cd-gitea": "global-skills/devsecops-ci-cd-gitea",
  "corp-v1-aerosim-skills-code-agent/documentation-docusaurus-aerosim": "skic-aerosim-skills/documentation-docusaurus-skic-aerosim",
  "corp-v1-aerosim-skills-code-agent/development-scripts-aerosim": "skic-aerosim-skills/development-scripts-skic-aerosim",
  "corp-v1-aerosim-skills-code-agent/development-branching-strategy-aerosim": "skic-aerosim-skills/development-branching-strategy-skic-aerosim",
  "corp-v1-aerosim-skills-code-agent/devsecops-ci-cd-gitea-aerosim": "skic-aerosim-skills/devsecops-ci-cd-gitea-skic-aerosim",
  "home-v1-skills-code-agent/development-gitops-argo-cd-gondor-v1": "home-gondor-v1-skills/development-gitops-argo-cd-home-gondor-v1"
 }
@@ -0,0 +1,13 @@
 from pathlib import Path
 import os
 ROOT=Path(__file__).resolve().parents[1]
 def owner(name):
    base=Path(os.environ.get('DELIVERY_OWNER_ROOT',str(ROOT.parent)))
    direct=base/name/'SKILL.md'
    found=[direct] if direct.is_file() else list(base.glob('*/'+name+'/SKILL.md'))
    if len(found)!=1: raise RuntimeError('Owner missing or ambiguous: '+name+' under '+str(base))
    return found[0].read_text()
 def effective(path):
    text=(ROOT/path).read_text()
    routes={'references/runtime-and-ci.md':['ci-runtime-skic'], 'references/status-and-reporting.md':['status-reporting-skic'], 'references/failure-and-documentation.md':['ci-runtime-skic','status-reporting-skic','delivery-docs']}
    return text+'\n'+'\n'.join(owner(n) for n in routes.get(path,[]))
@@ -1,32 +1,4 @@
 [
  {
    "path": "references/task-delivery-gates.md",
    "pattern": "^5\\. After local checks pass,.*$",
    "hashes": [
      "e4e6ae6f894fdb0b5dc1779b7037c39eb476ee80620f93a253c4a68ea4adabd1"
    ]
  },
  {
    "path": "references/task-delivery-gates.md",
    "pattern": "^6\\. (?:The active executor|Hermes main session) reviews.*$",
    "hashes": [
      "63acb91e7391daac3af378032e4842ef7da6d03ff1f1939016180f9fffb5f86c"
    ]
  },
  {
    "path": "references/task-delivery-gates.md",
    "pattern": "^2\\. Immediately before merge,.*$",
    "hashes": [
      "fb6968a7bea4662e945ca914c53988cc1d9d72b02681384f7041a89ad347c229"
    ]
  },
  {
    "path": "references/task-delivery-gates.md",
    "pattern": "^3\\. If conflict resolution,.*$",
    "hashes": [
      "6052be5ba307b088499acdc0abcecbea36719695f423e6e9b888027d85867e89"
    ]
  },
  {
    "path": "references/task-delivery-gates.md",
    "pattern": "^\\*\\*Exit gate:\\*\\* All required PR CI.*$",
@@ -0,0 +1 @@
 0d7de8761e3c27908cef45c05a16e36cc36dce0dd428027002c632c34c8448bf
@@ -39,7 +39,7 @@ class LessonsContract(unittest.TestCase):
    def test_contract_1(self):
        text = (ROOT / 'SKILL.md').read_text()
        self.assertIn('<code>-uat', text)
-        self.assertIn('version: 1.15.0', text)
+        self.assertIn('version: 1.18.0', text)
    def test_stage_five_scope_and_authority(self):
        text = (ROOT / "references/task-delivery-gates.md").read_text()
@@ -50,7 +50,7 @@ class LessonsContract(unittest.TestCase):
        self.assertIn("If the project requires deployment before", stage)
        self.assertNotIn("only if the Task explicitly includes", stage)
        self.assertIn("image/container/Helm artifact validation", text)
-        self.assertIn("No implementation or review subagent", text)
+        self.assertIn("No second implementation worker", text)
 if __name__ == "__main__":
@@ -1,47 +0,0 @@
 """Canonical bindings preserve owners and original checksum sensitivity."""
 from pathlib import Path
 import hashlib
 import re
 import subprocess
 import unittest
 from canonical_identity import IDENTITIES, canonicalize, original_identity
 ROOT = Path(__file__).resolve().parents[1]
 class CanonicalIdentity(unittest.TestCase):
    def test_exact_identity_and_dependency_count(self):
        current = (ROOT / 'SKILL.md').read_text()
        baseline = subprocess.check_output(['git', 'show', 'HEAD:SKILL.md'], cwd=ROOT, text=True)
        def deps(text):
            return re.search(r'related_skills: \[(.*?)\]', text)[1].split(', ')
        expected = [IDENTITIES.get(v, v) for v in deps(baseline)]
        self.assertEqual(deps(current), expected)
        self.assertEqual(len(expected), 18 if ROOT.name.endswith('aerosim') else 12)
        self.assertEqual(len(set(expected)), len(expected))
        self.assertIn('corp-v1-glossary', expected)
        self.assertFalse(set(expected) & set(IDENTITIES))
    def test_mapping_is_reversible_and_not_a_general_rewrite(self):
        self.assertEqual(len(IDENTITIES), len(set(IDENTITIES.values())))
        for old, new in IDENTITIES.items():
            text = f'Load `{old}`; skill_view(name="{old}"); https://example/{old}; /opt/data/{old}/'
            mapped = canonicalize(text)
            self.assertIn(f'`{new}`', mapped)
            self.assertEqual(original_identity(mapped), text)
        text = 'tags: [corp-v1, discord, channel] /opt/data/corp-v1-aerosim-delivery/ gondor-v1-aerosim-dev'
        self.assertEqual(original_identity(text), text)
    def test_golden_normalization_still_detects_policy_mutation(self):
        for old in IDENTITIES:
            baseline = f'Load `{old}` before mutation; stop if unavailable.'
            canonical = canonicalize(baseline)
            digest = lambda t: hashlib.sha256(original_identity(t).encode()).hexdigest()
            self.assertEqual(digest(canonical), digest(baseline))
            self.assertNotEqual(digest(canonical.replace('stop', 'continue')), digest(baseline))
    def test_no_legacy_operational_loads(self):
        for path in [ROOT / 'SKILL.md', *ROOT.glob('references/*.md')]:
            text = path.read_text()
            self.assertEqual(canonicalize(text), text, str(path))
 if __name__ == '__main__':
    unittest.main()
@@ -1,18 +1,19 @@
 from pathlib import Path
 from disposition_support import effective
 ROOT = Path(__file__).resolve().parents[1]
 SKILL = (ROOT / "SKILL.md").read_text(encoding="utf-8")
-RUNTIME = (ROOT / "references/runtime-and-ci.md").read_text(encoding="utf-8")
+RUNTIME = effective("references/runtime-and-ci.md")
 REFERENCES = {
-    "development-durable-wave-execution": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-durable-wave-execution",
+    "development-durable-wave-execution": "https://gitea.lego-cloud.eu/global-skills/development-durable-wave-execution",
-    "development-gates": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-gates",
+    "development-gates": "https://gitea.lego-cloud.eu/global-skills/development-gates",
-    "development-integrity": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-integrity",
+    "development-integrity": "https://gitea.lego-cloud.eu/global-skills/development-integrity",
-    "development-method-ttd": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-method-ttd",
+    "development-method-ttd": "https://gitea.lego-cloud.eu/global-skills/development-method-ttd",
-    "development-branching-strategy": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-branching-strategy",
+    "development-branching-strategy": "https://gitea.lego-cloud.eu/global-skills/development-branching-strategy",
-    "development-monorepo-pnpm": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-monorepo-pnpm",
+    "development-monorepo-pnpm": "https://gitea.lego-cloud.eu/global-skills/development-monorepo-pnpm",
-    "development-scripts": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-scripts",
+    "development-scripts": "https://gitea.lego-cloud.eu/global-skills/development-scripts",
-    "development-gitops-argo-cd-home-gondor-v1": "https://gitea.lego-cloud.eu/home-v1-skills-code-agent/development-gitops-argo-cd-gondor-v1",
+    "development-gitops-argo-cd-home-gondor-v1": "https://gitea.lego-cloud.eu/home-gondor-v1-skills/development-gitops-argo-cd-home-gondor-v1",
 }
@@ -26,7 +27,8 @@ def test_delivery_reference_routes_reusable_development_procedures() -> None:
 def test_generic_automation_is_owned_by_development_scripts() -> None:
    assert "`development-scripts` owns Taskfile, `.scripts/`" in SKILL
    assert "must not restate generic RED–GREEN–REFACTOR mechanics" in SKILL
-    assert "the explicit project/channel overlay wins" in SKILL
+    assert "Project bindings must not contradict global skills" in SKILL
    assert "the explicit project/channel overlay wins" not in SKILL
 def test_gitops_reference_requires_one_environment_per_repository() -> None:
@@ -0,0 +1,75 @@
 """Disposition regression: immutable authority, concrete loads and moved policy."""
 from pathlib import Path
 import hashlib,json,re,unittest
 from disposition_support import ROOT,owner,effective
 TESTS=Path(__file__).parent
 class Disposition(unittest.TestCase):
    def test_authority_and_unresolved_gates_unchanged(self):
        mapping=json.loads((TESTS/'disposition-url-map.json').read_text())
        for f in json.loads((TESTS/'disposition-protected.json').read_text()):
            t=(ROOT/f['path']).read_text()
            for old,new in mapping.items(): t=t.replace('https://gitea.lego-cloud.eu/'+new,'https://gitea.lego-cloud.eu/'+old)
            t=t.replace('glossary-skic','corp-v1-glossary')
            if 'heading' in f: t=re.search(r'^## '+re.escape(f['heading'])+r'\n.*?(?=^## |\Z)',t,re.M|re.S).group()
            if 'block' in f: t=re.search(r'<!-- '+f['block']+r':BEGIN -->.*?<!-- '+f['block']+r':END -->',t,re.S).group()
            self.assertEqual(hashlib.sha256(t.rstrip().encode()).hexdigest(),f['sha256'],f)
    def test_all_retained_and_real_additional_dependencies(self):
        t=(ROOT/'SKILL.md').read_text(); d=json.loads((TESTS/'disposition-dependencies.json').read_text())
        actual=re.search(r'related_skills: \[(.*?)\]',t).group(1).split(', ')
        self.assertEqual(actual,d['retained']+d['additional']); self.assertEqual(len(actual),len(set(actual)))
        self.assertIn('develop-monorepo-pnpm-app-skic',actual); self.assertIn('develop-monorepo-pnpm-package-skic',actual)
        self.assertIn('draft review aids, not approved standards',t)
        for n in d['additional']:
            self.assertIn('`'+n+'`',t)
        for n in ['gitops-manifest-engineering','gondor-v1-nodes']:
            self.assertIn(n,t if ROOT.name.endswith('aerosim') else owner('ci-runtime-skic'))
    def test_no_removed_reports_or_empty_sections(self):
        t=(ROOT/'SKILL.md').read_text()
        for n in ['ADOPTION.md','FULL-PROGRAM.md','naming-delivery-review.md','SIMPLIFICATION.md']:self.assertFalse((ROOT/n).exists())
        for h in ['Overview','When to Use','Common Pitfalls','Project-Adoption Delivery Lessons','Proactive Iteration Requirement','Verification Checklist','Shared Corp v1 System Login','Documentation Ownership']:
            self.assertNotIn('## '+h+'\n',t)
        self.assertIn('## Synchronization Workflow',t)
        if not ROOT.name.endswith('aerosim'):
            self.assertIn('references/final-verification.md',t)
            self.assertTrue((ROOT/'references/final-verification.md').is_file())
    def test_complete_vocabulary_and_templates_moved_once(self):
        t=owner('status-reporting-skic').split('## Scope Status Vocabulary',1)[1].split('## Blocker routing',1)[0]
        self.assertEqual(hashlib.sha256(('## Scope Status Vocabulary'+t).rstrip().encode()).hexdigest(),(TESTS/'report-format.sha256').read_text().strip())
        local=(ROOT/'references/status-and-reporting.md').read_text()
        self.assertNotIn('wave-previous:',local)
        self.assertIn('status-reporting-skic',local);self.assertIn('development-integrity',local)
    def test_scoped_owner_mechanics_and_fail_closed_loads(self):
        ci=owner('ci-runtime-skic')
        for s in ['every foreground shell','last known-good digest','credential-free','per-run database/schema/role','deletion-reclaim','Bitwarden','exact-context','stop','self-hosted-service-account-recovery','truenas','references/base-images.md','references/runtime-preflight.md','repeat diagnosis, repair','same Task/gate','Before Delivery publication/install or operational adoption','complete published and installed owner packages','immutable owner revision and reference hash','Stop adoption if this evidence is unresolved']:
            self.assertIn(s,ci)
        for s in ['devsecops-ci-cd-gitea-skic-aerosim','development-scripts-skic-aerosim','gitops-manifest-engineering','gondor-v1-nodes']:
            self.assertIn(s,ci)
        local=(ROOT/'references/runtime-and-ci.md').read_text()
        self.assertIn('ci-runtime-skic',local);self.assertIn('development-security-skic',local)
        self.assertNotIn('├── cache/',local)
        self.assertIn('isolated, unpublished experimental delta',local)
        self.assertIn('historical missing RED',local)
    def test_documentation_outcomes_and_binding(self):
        docs=owner('delivery-docs'); local=(ROOT/'references/failure-and-documentation.md').read_text()
        for s in ['five sections','Delivery workflow','Collaboration and decisions','Packaging and deployment preparation','Operations and troubleshooting','planned process as already operational','source identity','read back']:
            self.assertIn(s,docs)
        self.assertNotIn('### Ways of Working',local);self.assertIn('delivery-docs',local)
        self.assertIn('glossary-skic',local)
        self.assertIn('documentation-docusaurus-skic-aerosim' if ROOT.name.endswith('aerosim') else 'documentation-docusaurus-global',local)
    def test_security_preserves_single_policy_owner(self):
        security=owner('development-security-skic'); generic=owner('development-security')
        for s in ['channel-board-skic','Corp v1 System SSO Credential Use','Stop before login','development-security','Central Delivery gains no self-recovery authority']:
            self.assertIn(s,security)
        self.assertNotIn('HL_V1_SSO_PASSWORD',security+generic)
        for s in ['presence only','never inspect, hash or measure','generic 401/403','separately verified delegation','not authority']:
            self.assertIn(s,generic)
    def test_local_markdown_targets_and_anchors_exist(self):
        for p in [ROOT/'SKILL.md',*ROOT.glob('references/*.md')]:
            for link in re.findall(r'\]\(([^)]+)\)',p.read_text()):
                if '://' in link or link.startswith('<'):continue
                path,_,anchor=link.partition('#');dest=p.parent/path if path else p
                self.assertTrue(dest.is_file(),(p,link))
                if anchor:
                    anchors={re.sub(r'[^\w -]','',h.lower()).replace(' ','-') for h in re.findall(r'^#+ (.*)',dest.read_text(),re.M)}
                    self.assertIn(anchor,anchors,(p,link))
 if __name__=='__main__':unittest.main()
@@ -0,0 +1,8 @@
 from pathlib import Path
 import unittest
 class DraftRouting(unittest.TestCase):
 def test_scoped_draft_decision_points(self):
  text=(Path(__file__).resolve().parents[1]/'SKILL.md').read_text()
  for marker in ['startup/readiness/shutdown','public API/exports','develop-monorepo-pnpm-app-skic','develop-monorepo-pnpm-package-skic','draft review aids, not approved standards','do not enforce a proposed convention','one implementation worker per Task','loading a draft grants no execution authority','workspace/build/package-manager mechanics']:
   self.assertIn(marker,text)
 if __name__=='__main__':unittest.main()
@@ -1,55 +0,0 @@
 """Full-program consolidation: owner routing and retained policy safeguards."""
 from pathlib import Path
 import unittest
 from canonical_identity import original_identity
 ROOT=Path(__file__).resolve().parents[1]
 def read(p): return (ROOT/p).read_text()
 class FullProgram(unittest.TestCase):
    def test_exact_owner_loads_replace_duplicate_algorithms(self):
        p=read('references/planning-artifact-reconciliation.md')
        for s in ['skill_view(name="development-gates")','skill_view(name="development-integrity")','exact Task row','historical','no second Focus-admission','run_number','head.ref']:
            self.assertIn(s,p)
        self.assertNotIn('Require each matching task to report',p)
        self.assertLess(len(p.encode()),5000)
        g=read('references/task-delivery-gates.md')
        self.assertIn('skill_view(name="development-gates")',g)
        self.assertNotIn('first when practical',g)
        self.assertNotIn('seven project channels',g)
        self.assertIn('A02/A04',g)
        for i in range(1,7): self.assertIn(f'GATE_{i:03}_',g)
    def test_storage_and_ttd_decision_loads(self):
        r=read('references/runtime-and-ci.md')
        self.assertIn('references/gondor-retained-application-storage.md',r)
        self.assertIn('before storage design or mutation',r.lower())
        self.assertNotIn('before fixing when practical',r)
        self.assertIn('development-method-ttd',r)
        self.assertIn('isolated, unpublished experimental delta',r)
        self.assertIn('historical missing RED',r)
        self.assertNotIn('5. implement the smallest safe fix;\n6. add/update tests',read('references/failure-and-documentation.md'))
        self.assertIn('last known-good digest',r)
        self.assertIn('every foreground shell',r)
    def test_clause_disposition_covers_program_without_inventing_resolution(self):
        p=read('FULL-PROGRAM.md')
        for i in range(1,19): self.assertIn(f'| A{i:02} |',p)
        for s in ['1563064779772526616','unresolved','installed','publication','A02','A04','A06','A08','A17']:
            self.assertIn(s,p)
    def test_original_protected_clauses_remain_exact(self):
        import re, json, hashlib
        for rule in json.loads((Path(__file__).parent/'full-program-preserved.json').read_text()):
            matches=re.findall(rule['pattern'],original_identity(read(rule['path'])),re.M)
            self.assertEqual([hashlib.sha256(m.encode()).hexdigest() for m in matches],rule['hashes'],rule['path']+' '+rule['pattern'])
    def test_project_specific_boundaries(self):
        if not (ROOT/'references/single-subagent-task-delivery.md').exists(): return
        w=read('references/single-subagent-task-delivery.md')
        self.assertNotIn('│   ├── playwright/',w)
        self.assertNotIn('│   ├── postgresql/',w)
        self.assertIn('belong to UAT',w)
        g=read('references/task-delivery-gates.md')
        self.assertIn('per Task',g)
        self.assertNotIn('or start the next Task before',g)
        c=read('references/gitea-actions-policy.md')
        for s in ['skill_view(name="devsecops-ci-cd-gitea-skic-aerosim")','references/pipeline-workflow.md','CI / Branch Readiness','CI / Pull Request Validation','CD / Test Artifact Publication','publication','UAT','all applications']:
            self.assertIn(s,c)
        self.assertNotIn('## 1. Non-default branch',c)
        self.assertLess(len(c.encode()),3200)
 if __name__=='__main__': unittest.main()
@@ -0,0 +1,34 @@
 """Central executable policy follows the global exact-candidate gates."""
 from pathlib import Path
 import unittest
 ROOT = Path(__file__).resolve().parents[1]
 class GlobalGateAlignment(unittest.TestCase):
    def test_review_before_substantive_push(self):
        gates = (ROOT/'references/task-delivery-gates.md').read_text()
        stage = gates.split('### Stage 3')[1].split('### Stage 4')[0]
        self.assertLess(stage.index('5. Freeze'), stage.index('6. Obtain independent'))
        self.assertLess(stage.index('6. Obtain independent'), stage.index('7. Push only'))
        self.assertIn('before its next substantive push', stage)
        self.assertIn('reviewer must not be the candidate implementer', stage)
        self.assertIn('read-only reviewer', stage)
        self.assertNotIn('push the new PR head, and review', gates)
        self.assertNotIn('No implementation or review subagent', gates)
    def test_any_base_change_invalidates_readiness(self):
        gates = (ROOT/'references/task-delivery-gates.md').read_text()
        self.assertIn('Any target-base SHA change invalidates merge readiness', gates)
        self.assertIn('even when candidate head/tree is unchanged', gates)
        self.assertNotIn('base drift is harmless', gates)
        self.assertNotIn('push/readback, and review', gates)
    def test_kickoff_and_cross_repository_scope(self):
        entry = (ROOT/'references/repository-entry-and-visibility.md').read_text()
        self.assertIn('no file/tree changes', entry)
        self.assertIn('does not authorize a substantive push', entry)
        gates = (ROOT/'references/task-delivery-gates.md').read_text()
        self.assertIn('documentation claims/handoffs and GitOps candidates', gates)
    def test_no_unresolved_policy_marker(self):
        for path in [ROOT/'SKILL.md', *ROOT.glob('references/*.md')]:
            text = path.read_text()
            self.assertNotIn('Bounded unresolved A02/A04', text)
            self.assertNotIn('A02/A04 review-order/base-drift remain bounded unresolved', text)
 if __name__ == '__main__':
    unittest.main()
@@ -1,39 +0,0 @@
 """Moved owner mechanics and retained caller authority, independently runnable."""
 from pathlib import Path
 import hashlib
 import json
 import unittest
 ROOT = Path(__file__).resolve().parents[1]
 class OwnerConsolidation(unittest.TestCase):
    def test_owner_evidence_and_clause_mapping(self):
        manifest=json.loads((Path(__file__).parent/'owner-consolidation-manifest.json').read_text())
        self.assertEqual(len(manifest['superseded_golden_rules']),2)
        self.assertEqual(len(manifest['moved_clauses']),8)
        for owner in manifest['owners'].values():
            self.assertEqual(hashlib.sha256(owner['evidence_text'].encode()).hexdigest(),owner['sha256'])
            self.assertEqual(len(owner['inspected_head']),40)
        for move in manifest['moved_clauses']:
            text=manifest['owners'][move['owner_key']]['evidence_text']
            for heading in move['section'].split('; '):
                self.assertIn('## '+heading.split(' 1')[0].split(' 3')[0].split(' 5')[0],text)
        pre=manifest['owners']['preflight']['evidence_text']
        for term in ['command -v node','pnpm --version','without reading or printing their values','linked branch/PR identity','repeat the complete preflight','never an application-code or test failure']:
            self.assertIn(term,pre)
        base=manifest['owners']['base_images']['evidence_text']
        for term in ['without registry credentials','full 40-character source revision','shell interpolation','wrong upstream or consumer digests','pnpm install --frozen-lockfile --ignore-scripts','numeric non-root identity','CA trust','last known-good digest']:
            self.assertIn(term,base)
    def test_exact_decision_loads_and_local_boundaries(self):
        text=(ROOT/'references/runtime-and-ci.md').read_text()
        manifest=json.loads((Path(__file__).parent/'owner-consolidation-manifest.json').read_text())
        for owner in manifest['owners'].values():
            self.assertIn('skill_view(name="'+owner['owner']+'", file_path="'+owner['reference']+'")',text)
        for clause in manifest['retained_local']:
            self.assertIn(clause,text)
        for clause in ['before every repository operation','Node/pnpm repository','CORP_V1_','publication/install','immutable owner revision','forward only','replacement image and consuming workflow pass exact-head CI']:
            self.assertIn(clause,text)
        self.assertNotIn('neither owner currently replaces',text)
        self.assertNotIn('1. resolve the repository-required Node',text)
        self.assertNotIn('- Keep one folder per image',text)
        repo='corp-v1-aerosim/corp-v1-aerosim-base-images' if ROOT.name.endswith('aerosim') else 'corp-v1-<code>/corp-v1-<code>-base-images'
        self.assertIn(repo,text)
 if __name__=='__main__': unittest.main()
@@ -1,54 +0,0 @@
 """Offline bounded simplification contract; no dependency or network mutation."""
 from pathlib import Path
 import hashlib
 import unittest
 ROOT = Path(__file__).resolve().parents[1]
 class SimplificationContract(unittest.TestCase):
    def test_retained_safety_sections(self):
        for (path, start, end), digest in SECTIONS.items():
            text = (ROOT / path).read_text().split(start, 1)[1]
            if end:
                text = text.split(end, 1)[0]
            self.assertEqual(hashlib.sha256(text.encode()).hexdigest(), digest, (path, start))
    def test_dependencies_unchanged(self):
        self.assertIn(DEPS, (ROOT / 'SKILL.md').read_text())
    def test_unresolved_gates_and_safety_files_unchanged(self):
        for name, digest in PROTECTED.items():
            self.assertEqual(hashlib.sha256((ROOT / name).read_bytes()).hexdigest(), digest, name)
    def test_decision_point_loads(self):
        for name, markers in {
            'SKILL.md': ['Before login, load', 'skic-skills/channel-board-skic', 'version: 1.15.0'],
            'references/runtime-and-ci.md': ['Before login, load', 'Load `development-method-ttd`', 'Load `development-monorepo-pnpm`'],
            'references/status-and-reporting.md': ['Before reporting, load', 'home-v1-skills-code-agent/development-integrity'],
            'references/planning-artifact-reconciliation.md': ['corepack enable --install-directory', 'Before reporting, load'],
            'references/failure-and-documentation.md': ['Before authoring or validating documentation, load', 'home-v1-skills-code-agent/corp-v1-glossary'],
        }.items():
            for marker in markers:
                self.assertIn(marker, (ROOT / name).read_text(), (name, marker))
    def test_no_helper_or_reference_removed(self):
        self.assertEqual({p.name for p in (ROOT / 'references').glob('*.md')}, REFERENCES)
        self.assertNotIn('SIMPLIFICATION.md', (ROOT / 'SKILL.md').read_text())
    def test_retained_reporting_and_planning_guards(self):
        status = (ROOT / 'references/status-and-reporting.md').read_text()
        for marker in ['wave-previous:', 'List every Task', 'GATE_003_TASK_IMPLEMENTATION', 'status unverified', 'exact failed command']:
            self.assertIn(marker, status)
        planning = (ROOT / 'references/planning-artifact-reconciliation.md').read_text()
        for marker in ['complete successful job inventory including aggregates', 'run_number', 'semantics', 'If the PR merged or closed', 'no second Focus-admission', 'configured silent response']:
            self.assertIn(marker, planning)
    def test_operational_size_reduction(self):
        paths = [ROOT / 'SKILL.md', *ROOT.glob('references/*.md')]
        self.assertLess(sum(len(p.read_bytes()) for p in paths), BASELINE_BYTES)
 DEPS = '    related_skills: [channel-board-skic, discord, documentation-docusaurus, corp-v1-glossary, development-durable-wave-execution, development-gates, development-integrity, development-method-ttd, development-branching-strategy, development-monorepo-pnpm, development-scripts, development-gitops-argo-cd-home-gondor-v1]'
 PROTECTED = {'references/repository-entry-and-visibility.md': 'f040d6f57c4ec5faf4527296f7f71a751fab2153809e2dbe20c90cf2d582a77d', 'references/aerosim-lessons-review.md': '03873d038f146e28ea648c95f7c2e32d2648d1b5eaa963fb635980fe6e814514'}
 REFERENCES = {'task-delivery-gates.md', 'common-pitfalls.md', 'failure-and-documentation.md', 'runtime-and-ci.md', 'repository-entry-and-visibility.md', 'aerosim-lessons-review.md', 'planning-artifact-reconciliation.md', 'status-and-reporting.md'}
 SECTIONS = {('references/runtime-and-ci.md', '## Channel-owned workspace', '## Shared Corp'): '48d1e74b737db691ec31ac593400d59abc7d4eed4cd67b2f12f8a428a48034b5', ('SKILL.md', '## Authority and Escalation', '## Evidence Requirements'): 'e3c566055d9d04d3ab0286e6e5035a8c30f66a81b17b4d0379e8010dead3fa83'}
 BASELINE_BYTES = 84789
@@ -1,45 +1,7 @@
-"""Run every unittest, standalone test function and main-style contract."""
+"""Validate the current bounded source contract, not full-program completion."""
 from pathlib import Path
-import importlib.util
+import subprocess,sys
 import inspect
 import json
 import re
 import subprocess
 import sys
 import unittest
 ROOT=Path(__file__).resolve().parents[1]
-TESTS=Path(__file__).resolve().parent
+if __name__=='__main__':
-sys.path.insert(0, str(TESTS))
+    print('Source-contract checks only; A17 and deferred helpers are not completion claims.',flush=True)
-suite=unittest.TestSuite()
+    subprocess.run([sys.executable,'-m','pytest','-q',str(Path(__file__).parent)],cwd=ROOT,check=True)
 modules=[]
 for path in sorted(TESTS.glob('test_*.py')):
    spec=importlib.util.spec_from_file_location('verify_'+path.stem,path)
    assert spec is not None and spec.loader is not None
    module=importlib.util.module_from_spec(spec)
    sys.modules[spec.name]=module
    spec.loader.exec_module(module)
    modules.append(module)
    suite.addTests(unittest.defaultTestLoader.loadTestsFromModule(module))
 result=unittest.TextTestRunner(verbosity=1).run(suite)
 if not result.wasSuccessful(): sys.exit(1)
 standalone=0
 for module in modules:
    for name,fn in inspect.getmembers(module,inspect.isfunction):
        if name.startswith('test_') or name=='main':
            fn()
            standalone+=1
 files=[ROOT/'SKILL.md',*sorted(ROOT.glob('references/*.md'))]
 links=0
 for path in files:
    for link in re.findall(r'\]\(([^)]+)\)',path.read_text()):
        if '://' in link or link.startswith(('#','<')): continue
        target=link.split('#')[0]
        if target:
            assert (path.parent/target).exists(),(path,link)
            links+=1
 subprocess.run(['git','diff','--check'],cwd=ROOT,check=True)
 before=sum(len(subprocess.check_output(['git','show','HEAD:'+str(p.relative_to(ROOT))],cwd=ROOT)) for p in files)
 after=sum(p.stat().st_size for p in files)
 ref_before=before-len(subprocess.check_output(['git','show','HEAD:SKILL.md'],cwd=ROOT))
 ref_after=after-(ROOT/'SKILL.md').stat().st_size
 print(json.dumps({'package':ROOT.name,'unittest':result.testsRun,'standalone':standalone,'total':result.testsRun+standalone,'local_links':links,'diff_check':'passed','operational_bytes_before':before,'operational_bytes_after':after,'reference_bytes_before':ref_before,'reference_bytes_after':ref_after},indent=2))
Author	SHA1	Message	Date
jarvis-at-skic	3f8e13141e	docs: reference shared channel workspace standard	2026-11-05 19:11:27 +00:00
jarvis-at-skic	e5d00989e7	Merge pull request 'fix/a02-a04-global-gates' (#17 ) from fix/a02-a04-global-gates into test	2026-10-26 04:36:20 -07:00
jarvis-at-skic	818869fae9	fix: retain global review precedence in entry guidance	2026-10-26 11:34:06 +00:00
jarvis-at-skic	35f0a7259c	fix: align Central independent review and base invalidation gates	2026-10-26 11:31:49 +00:00
jarvis-at-skic	8c39ebe70e	Merge pull request 'fix: Delivery source identity and bounded helper routing' (#16 ) from fix/delivery-source-identity-t3c6f0036 into test	2026-10-26 03:26:59 -07:00
jarvis-at-skic	0776bacd25	test: align expected version with source identity release	2026-10-26 10:24:59 +00:00
jarvis-at-skic	9d1a6dd44d	fix: qualify Delivery sources and preserve compatibility	2026-10-26 10:22:35 +00:00
jarvis-at-skic	2e7f6618b6	chore: open scoped Delivery source correction	2026-10-26 10:17:40 +00:00
jarvis-at-skic	db3115aa86	Merge pull request 'Implement Delivery responsibility dispositions: channel-delivery-skic' (#15 ) from refactor/dispositions-7c5c1457 into test	2026-10-23 01:16:08 -07:00
jarvis-at-skic	1bff2cefab	refactor: implement concrete Delivery responsibility dispositions	2026-10-23 08:11:40 +00:00
jarvis-at-skic	cb6b41f1a5	chore: open scoped disposition implementation	2026-10-23 07:53:07 +00:00
jarvis-at-skic	a1741dc061	Merge pull request 'Implement full Delivery program: channel-delivery-skic' (#14 ) from refactor/delivery-full-program into test	2026-10-22 23:39:47 -07:00
		`@@ -0,0 +1 @@`
							`0d7de8761e3c27908cef45c05a16e36cc36dce0dd428027002c632c34c8448bf`