chore: refresh kendex renders

.agents/skills/bot-instructions/SKILL.md

@@ -13,6 +13,7 @@ metadata:
   bugs: "https://github.com/vanillagreencom/kendex/issues"
 tags: [review]
 repo-effects:
+  configured-by: bot-instructions
   summary: "Renders the enabled review-bot instruction files, the pointed code-review file and the owned Code Review Rules region in this repository."
   writes:
     - ".github/copilot-instructions.md"

.agents/skills/dev/workflows/dev-implement.md

@@ -184,9 +184,9 @@ A start `dev-validate-run` refuses as `run-live`, with exit 2 and the line `dev-
 
 For a test-only PR whose validation runs longer than 30 minutes and fails, run the failed target alone once under load. Record both results in `--validate-note` with the prefix `Test-only validation ceiling:`. Report the result and do not extend validation.
 
-A `dev-validate-run` verdict of `validate=FAILING` permits one correction inside this round only when the run log names every failing check's cause in files all added or changed in `git -C [WORKTREE_PATH] diff --cached --no-renames --name-only --diff-filter=AM [ROUND_BASE]`, whether or not the failing check's own file is in that diff. Name the first failing check and cause in `--validate-note`. Apply one correction and stage it. Start `dev-validate-run` once more on the final contents with the same validation mode and base, where supplied. Record that single rerun and its verdict in the same note. Then proceed to the artifact with that verdict. The dev agent completes this correction and rerun before writing the artifact, without an overseer ask or a recovery round.
+A `dev-validate-run` verdict of `validate=FAILING`, a failing required verification command, or another failing run listed in this validation gate permits one correction inside this round only when the run log names every failing check's cause in files all added or changed in `git -C [WORKTREE_PATH] diff --cached --no-renames --name-only --diff-filter=AM [ROUND_BASE]`; the correction may edit the failing check's own file outside that diff or the delegation's Location. Name the first failing check and cause in `--validate-note`. Apply one correction and stage it. Rerun the failed command once on the final contents, keeping the same validation mode and base, where supplied. Record that single rerun and its verdict in the same note. If the failed command was not `dev-validate-run` and its rerun passes, run `dev-validate-run` once on the corrected contents with the same validation mode and base. Use this refresh's run directory and verdict for the artifact, and record them in the same note. Then proceed to the artifact with that verdict. The dev agent completes this bounded correction sequence before writing the artifact, without an overseer ask or a recovery round.
 
-A failure outside that diff, a failure after the single rerun, or an infrastructure result (`no-verdict`, `state=timeout` or `state=lost`) permits no further validation run. The existing `no-verdict` scoped-suite route above still applies. A recorded context-handoff interruption follows the single recovery route in [dev SKILL.md § Long-Running Validation](../SKILL.md#long-running-validation). Any other validation failure ends the round. Record the failing result in the artifact and return it without another validation run.
+A failure outside that diff, a failure after the single rerun or the validation refresh, or an infrastructure result (`no-verdict`, `state=timeout` or `state=lost`) permits no further validation run. The existing `no-verdict` scoped-suite route above still applies. A recorded context-handoff interruption follows the single recovery route in [dev SKILL.md § Long-Running Validation](../SKILL.md#long-running-validation). Any other validation failure ends the round. Record the failing result in the artifact and return it without another validation run.
 
 For this validation gate, run no proof, rerun, receipt, isolation step, or approval step outside this list. Investigation runs follow [dev SKILL.md § Validation](../SKILL.md#validation). If an agent believes the list misses a rule, it records the proposal once under `### Proposed Rules` in the completion summary and in the matching return line. The orchestrator puts it once in the PR body. Neither role performs the proposed rule.
 

.agents/skills/orch/scripts/oversee-report

@@ -160,7 +160,10 @@ Rows:
                   conventional-commit scope or right after Closes on a body
                   line, as a Claude cloud session's claude/ branch names no
                   item. The issue cell carries the
-                  PR number and the merge commit. Landed also lists each
+                  PR number and the merge commit, followed by the Linear
+                  item's live Done or Verifying state when available.
+                  GitHub items and reads with no state add no state.
+                  Landed also lists each
                   item with a direct-push cycle row recorded in fleet_log
                   since the last report. Its issue cell carries
                   `ITEM (direct push, SHA)`, with the commit's first 7
@@ -656,10 +659,12 @@ fi
 # guesses a tracker or a repo.
 TITLE=""
 WHY=""
+ITEM_STATE=""
 issue_cells() {
   local item="$1" fields tracker repo json
   TITLE=""
   WHY=""
+  ITEM_STATE=""
   if ! fields="$(jq -r --arg item "$item" '
     [.lanes[] | select(.item == $item)] | first // {}
     | "\(.tracker // "")\u001f\(.repo // "")"' <<<"$STATE_JSON")"; then
@@ -685,7 +690,9 @@ issue_cells() {
       # would otherwise nest the issue or drop its description.
       if ! json="$("$TRACKER" issues get "$item" --format=safe 2>"$WORK_DIR/tracker.err")"; then
         refuse tracker-read "$item" "$(cat "$WORK_DIR/tracker.err")"
-      fi ;;
+      fi
+      ITEM_STATE="$(jq -r '.state // "" | select(. == "Done" or . == "Verifying")' <<<"$json" 2>"$WORK_DIR/tracker.err")" \
+        || refuse tracker-read "$item" "$(cat "$WORK_DIR/tracker.err")" ;;
     *) TITLE="(tracker unknown)"; return 0 ;;
   esac
   # A read that answered with no title answered nothing this report can use.
@@ -724,6 +731,7 @@ table() {
   while IFS=$'\t' read -r item label; do
     [[ -n "$item" ]] || continue
     issue_cells "$item"
+    [[ "$name" != Landed* || -z "$ITEM_STATE" ]] || label+=" $ITEM_STATE"
     line="|"
     for column in "${COLUMNS[@]}"; do
       case "$column" in

.agents/skills/orch/scripts/oversee-watch

@@ -1338,7 +1338,8 @@ item_state_dir() { # ITEM
 # caller commits the lane's row and ends the long pass. A close ended midway
 # would lose a failure the row is reset to retry. The close is waited on in the
 # background, for tick_sleep's reason, and again after a TERM returns the wait
-# early. pass_stop spares its tree, read from CLOSE_PID_FILE.
+# early. The active marker precedes the fork, so pass_stop cannot find a close
+# child before it knows to spare it. The long pass still receives TERM.
 CLOSE_TERMED=""
 CLOSE_RESULT=failed
 lane_tracker_held() { # ITEM
@@ -1366,16 +1367,16 @@ close_hosted_lane() { # ITEM [--if-terminal]
   local out line path="" rc=0 close_pid
   CLOSE_RESULT=failed
   if lane_tracker_held "$1"; then CLOSE_RESULT=deferred; return 0; fi
+  : > "$CLOSE_ACTIVE_FILE" || return 1
   trap 'CLOSE_TERMED=1' TERM
   "$LANE_CLOSE" --state-dir "$FLEET_STATE_DIR" "$@" > "$WORK_DIR/lane-close.out" 2>&1 &
   close_pid=$!
-  printf '%s\n' "$close_pid" > "$CLOSE_PID_FILE"
   while :; do
     rc=0
     wait "$close_pid" || rc=$?
     [[ -n "$CLOSE_TERMED" && "$rc" -gt 128 ]] && kill -0 "$close_pid" 2>/dev/null || break
   done
-  rm -f -- "$CLOSE_PID_FILE"
+  rm -f -- "$CLOSE_ACTIVE_FILE"
   trap - TERM
   out="$(cat -- "$WORK_DIR/lane-close.out")"
   if [[ "$rc" -ne 0 ]] && tracker_quota_refusal "$WORK_DIR/lane-close.out"; then
@@ -1547,15 +1548,15 @@ command -v cksum >/dev/null 2>&1 || die command-missing "" "command=cksum"
 
 WORK_DIR="$(mktemp -d)"
 # Where the long pass the main loop forks spools its lines and names the
-# lane-close it runs, named here for the EXIT and TERM traps below.
+# active lane-close, named here for the EXIT and TERM traps below.
 LONG_PID=""
 LONG_OUT="$WORK_DIR/long.out"
 LONG_ERR="$WORK_DIR/long.err"
 LONG_STATUS="$WORK_DIR/long.status"
 LONG_DONE="$WORK_DIR/long.done"
 LONG_READY="$WORK_DIR/long.ready"
 LONG_PRINTED=0
-CLOSE_PID_FILE="$WORK_DIR/close.pid"
+CLOSE_ACTIVE_FILE="$WORK_DIR/close.active"
 # Only the parent prints the protocol. The checkpoint ends at a complete
 # event block, and the saved line count keeps the final drain from replaying it.
 long_output() { # [ready]
@@ -1617,23 +1618,22 @@ trap on_exit EXIT
 # TERM, the stop every start takes, ends a long pass in flight and its whole
 # tree, `timeout`'s process group among it, parent first so nothing new starts
 # under it, rather than on_exit waiting it out beside the next watch; its spool
-# is still printed. An ended one is not signalled. Its lane-close's tree is
-# spared, read second so a child the close starts between reads is in it
-# (close_hosted_lane).
+# is still printed. An ended one is not signalled. During a close only the
+# long pass is signalled: it notes TERM and finishes its close and lane row.
 tree_pids() { # PID
   ps -A -o pid= -o ppid= 2>/dev/null | awk -v root="$1" '{ kids[$2] = kids[$2] " " $1 }
     END { q[n = 1] = root; for (i = 1; i <= n; i++) { print q[i]
       m = split(kids[q[i]], k, " "); for (j = 1; j <= m; j++) q[++n] = k[j] } }'
 }
 TICK_SLEEP_PID=""
 pass_stop() {
-  local pid tree spared=" "
+  local pid tree closing=""
   [[ -z "$TICK_SLEEP_PID" ]] || kill -TERM "$TICK_SLEEP_PID" 2>/dev/null || :
   if [[ -n "$LONG_PID" && ! -e "$LONG_DONE" ]]; then
     tree="$(tree_pids "$LONG_PID")"
-    [[ ! -s "$CLOSE_PID_FILE" ]] || spared+="$(tree_pids "$(cat -- "$CLOSE_PID_FILE")" | tr '\n' ' ')"
+    [[ ! -e "$CLOSE_ACTIVE_FILE" ]] || closing=1
     for pid in $tree; do
-      [[ "$spared" != *" $pid "* ]] || continue
+      [[ -z "$closing" || "$pid" == "$LONG_PID" ]] || continue
       kill -TERM "$pid" 2>/dev/null || :
     done
   fi

.agents/skills/reviewer/SKILL.md

@@ -91,7 +91,7 @@ Mutation proves an instrument can fail; stability proves it fails only for the r
 .agents/skills/reviewer/scripts/mutation-stability --worktree [WORKTREE_PATH] --sha [SHA] --test '[TEST_CMD]' --build '[BUILD_CMD]' --mutate '[MUTATE_CMD]'
 ```
 
-- Scope `TEST_CMD` to the changed instrument's rows when the suite supports a filter. Otherwise use the suite. Clean repeats stop starting after `--stability-budget` seconds, with at least two completed runs unless `--stability` is 1, and at most `--stability` runs. A started run keeps `--timeout`, so the stability phase is bounded by budget plus two timeouts, excluding extraction and cleanup. The defaults are 60 seconds and 300 seconds. Report the completed sample count; a budget-limited sample proves only those runs.
+- Run only the changed instrument's rows in `TEST_CMD`. If the suite has no case filter, write a wrapper that runs only those rows. Clean repeats stop starting after `--stability-budget` seconds, with at least two completed runs unless `--stability` is 1, and at most `--stability` runs. A started run keeps `--timeout`, so the stability phase is bounded by budget plus two timeouts, excluding extraction and cleanup. The defaults are 60 seconds and 300 seconds. Report the completed sample count; a budget-limited sample proves only those runs.
 
 - A call that can outlast one foreground tool call runs through the orch job runner per [orch waiter-launch.md](../orch/references/waiter-launch.md) § Launch, with `[RUN_DIR]` from `mktemp -d "${TMPDIR:-/tmp}/waiter.XXXXXX"` in place of the worktree's `tmp/`, where the `reviewer-read-only` hook refuses the `launch.sh` write. Wait for its end inside your own turn, never through § Completion's monitor: run the foreground poll `sh -c 'bound=$(command -v timeout || command -v gtimeout) || { printf "%s\n" "reviewer: missing-command commands=timeout,gtimeout" >&2; exit 127; }; exec "$bound" "$@"' sh 540 sh -c 'until test -s "[RUN_DIR]/wait.exit"; do sleep 30; done'` under the harness's maximum command timeout, and run it again for as long as it exits 124. Never end the turn while `wait.exit` is empty and never wait for a completion notice: a subagent whose turn has ended is not woken when the run ends. Then read `wait.exit`, whose nonzero code stays nonzero, and the `mutation: … stability: …` line in `[RUN_DIR]/wait.log`. Never wait on `pgrep -f` or `ps | grep` of the command: the pattern also stands in the waiting shell's own command line, so the wait matches itself and never sees the run end.
 - Choose a control that reaches the new or changed instrument through its real entry point.

.claude/hooks/command-safety.sh

@@ -274,7 +274,7 @@ environment_head() { # command kind; updates pos, syntax_head and arg_roles
 # unproved. This grants no argument, body-data or direct-filter permission.
 environment_main_evidence() {
   local value evidence continuation=$'\\\n'
-  local opaque_re='(^|[^A-Za-z0-9_])(env|printenv|export|declare|typeset|show-environment)([^A-Za-z0-9_]|$)|(^|[^A-Za-z0-9_-])set([^A-Za-z0-9_-]|$)|/proc/[^[:space:]]*/environ'
+  local opaque_re='(^|[^A-Za-z0-9_.-])(env|printenv|export|declare|typeset|show-environment)([^A-Za-z0-9_.-]|$)|(^|[^A-Za-z0-9_-])set([^A-Za-z0-9_-]|$)|/proc/[^[:space:]]*/environ'
   for value in "$@"; do
     evidence=${value//"$continuation"/}
     evidence=${evidence//[\'\"\\]/}

.codex/hooks/command-safety.sh

@@ -274,7 +274,7 @@ environment_head() { # command kind; updates pos, syntax_head and arg_roles
 # unproved. This grants no argument, body-data or direct-filter permission.
 environment_main_evidence() {
   local value evidence continuation=$'\\\n'
-  local opaque_re='(^|[^A-Za-z0-9_])(env|printenv|export|declare|typeset|show-environment)([^A-Za-z0-9_]|$)|(^|[^A-Za-z0-9_-])set([^A-Za-z0-9_-]|$)|/proc/[^[:space:]]*/environ'
+  local opaque_re='(^|[^A-Za-z0-9_.-])(env|printenv|export|declare|typeset|show-environment)([^A-Za-z0-9_.-]|$)|(^|[^A-Za-z0-9_-])set([^A-Za-z0-9_-]|$)|/proc/[^[:space:]]*/environ'
   for value in "$@"; do
     evidence=${value//"$continuation"/}
     evidence=${evidence//[\'\"\\]/}

.github/hooks/command-safety.sh

@@ -274,7 +274,7 @@ environment_head() { # command kind; updates pos, syntax_head and arg_roles
 # unproved. This grants no argument, body-data or direct-filter permission.
 environment_main_evidence() {
   local value evidence continuation=$'\\\n'
-  local opaque_re='(^|[^A-Za-z0-9_])(env|printenv|export|declare|typeset|show-environment)([^A-Za-z0-9_]|$)|(^|[^A-Za-z0-9_-])set([^A-Za-z0-9_-]|$)|/proc/[^[:space:]]*/environ'
+  local opaque_re='(^|[^A-Za-z0-9_.-])(env|printenv|export|declare|typeset|show-environment)([^A-Za-z0-9_.-]|$)|(^|[^A-Za-z0-9_-])set([^A-Za-z0-9_-]|$)|/proc/[^[:space:]]*/environ'
   for value in "$@"; do
     evidence=${value//"$continuation"/}
     evidence=${evidence//[\'\"\\]/}