diff --git a/.gitignore b/.gitignore
index 32e35a7c..de7677b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,7 @@ CLAUDE.md
 .claude/
 .project-memory/
 .superpowers/
+docs/superpowers/
 **/data/jwt-signing-key.xml
 local-nuget-feed/
 docker/asterisk-config/keys/
diff --git a/docs/specs/2026-03-31-v121-operations-design.md b/docs/specs/2026-03-31-v121-operations-design.md
index 492a7d27..1243eb15 100644
--- a/docs/specs/2026-03-31-v121-operations-design.md
+++ b/docs/specs/2026-03-31-v121-operations-design.md
@@ -1,6 +1,13 @@
 # v1.2.1 "Operations" Design Spec
 
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.
+> **Superseded — execution procedure.** This is a dated design record, preserved as written on its
+> date. The banner that stood here ordered a sub-skill of a third-party process plugin that is **not
+> installed** in the active Claude config, so the instruction could not be carried out;
+> **verbara-meta/ADR-0023** retired it. How a `tasks.md` is shaped now lives in this repo's own
+> `openspec/config.yaml` — `rules.tasks` (three phases: A foundation batched, B critical components one
+> focused subagent each, C integration batched, a fresh subagent per task) — and the verification gate
+> lives in its `context:`, delivered verbatim by `openspec instructions`. Read the body below as
+> history, not as instruction.
 
 **Goal:** Deliver runtime cluster management, tenant impersonation, and AOT hardening for production multi-instance deployments.
 
diff --git a/openspec/config.yaml b/openspec/config.yaml
index d383de22..03046ff5 100644
--- a/openspec/config.yaml
+++ b/openspec/config.yaml
@@ -21,6 +21,11 @@ context: |
   -> RateLimiter -> Authentication -> Authorization (invariant: tenant resolution MUST precede rate limiting
   so per-tenant buckets partition correctly — Program.cs is authoritative; post-auth middlewares follow).
 
+  Verification gate (verbara-meta/ADR-0023, non-negotiable):
+  - Before any commit or push, run the fast, deterministic, non-service steps of this repo's own
+    .github/workflows/ci.yml on the integrated branch — build plus the touched tests plus `openspec validate`
+    is a strict subset, because a tree-scanning guard is tripped by a change anywhere.
+
   Cross-repo standards (CI gating, context hygiene, branch protection) live in the private verbara-meta repo as ADRs.
 
 rules:
@@ -41,7 +46,8 @@ rules:
   tasks:
     - "When the change spans repos, spell out the cross-repo sequence: edit Sdk/Pro -> dotnet pack to local-nuget-feed -> clear NuGet cache -> dotnet restore the consumer."
     - "Verification tasks MUST include `dotnet test` green and CI green, with zero warnings (TreatWarningsAsErrors). EXCEPTION — frontend-only changes hosted here under the hub rule (verbara-meta/ADR-0005): verification is the Web gate set instead (`npm run build`, `npx vitest run`, `npx eslint .`, i18n parity green)."
-    - "Use Subagent-Driven Development with FCM batching: Phase A foundation (batch) -> Phase B critical components (focused) -> Phase C integration (batch)."
+    - "Order execution in three phases — A foundation (batched), B critical components (one focused subagent each), C integration (batched) — with a fresh subagent per task, never inline in the main session."
+    - "For a bug fix, write the failing regression test first, against the unfixed code, and paste its failure verbatim into `tasks.md`. For new capability, tests may batch into Phase C."
 
 operations:
   apply: