docs: reconcile accepted temporary-tree guard referrals

docs/HANDOFF.md

@@ -1,3 +1,12 @@
+# FW00 referral dispositions — 2026-10-13
+
+[Current packet](evidence/runs/2026-10-13-fw00-referrals.md) closes only B-160's
+accepted source-lint port and retains B-159 as partial/open. Next: accept SEO's
+remaining scanner through its owner, then reconcile B-159 with source evidence.
+This docs-only change requires focused checks, peer review and normal PR admission.
+
+---
+
 # Current work — agent-stack 0.28.2 published
 
 The bounded restart correction is published from accepted source

docs/evidence/backlog.md

@@ -46,8 +46,8 @@ row per line, appended, so two runs closing two rows do not land on the same lin
 | B-158 | **The residue-ledger check misses an aliased temp-dir call.** `TEMP_MAKERS` (`test/validate.py`) excludes every dotted receiver but `tempfile.`, so `import tempfile as tf; tf.mkdtemp()` and `from tempfile import mkdtemp as m` pass. make-skill 0.31.0 ported this check and closed the gap there (any receiver, renamed from-imports refused, two negative controls); port that back. No current file here uses an alias. | make-skill W4-B seam reading, 2026-10-12 | 1 | 0 | 1 | **1** | **closed in v0.27.1 (2026-10-12)** — `TEMP_MAKERS` is make-skill 0.31.0's pattern (any single receiver, one-line renaming from-import refused); the alias and renamed-import negative controls in `test/validate.py` were watched failing on the old pattern (`B-158 self-test: a temp-dir call through a module alias (\`tf.\`) was not found`, `… a renamed from-import of a temp-dir maker was not found`), then passed. Evidence: verification.md, v0.27.1 |
 | AG-06a | **A temp tree created outside `test/` is still invisible.** `check_temp_trees_go_through_the_residue_ledger` reads this repository's own suite. A tree made by anything else — a script under `plugins/`, a future helper outside `test/` — is not accounted for, and `residue.report()` counts only what `workspace()` handed out. The mechanism catches a *reviewed* bypass; it does not observe `$TMPDIR`. Observing it would mean a run claiming ownership of directories it cannot prove it made, which is the reaping mistake `agent-sync` refuses by design. | AG-06 port, 2026-08-20; plan R28 of the hub's 2026-10-11 integration waves | 1 | 0 | 1 | **1** | **closed in v0.27.1 (2026-10-12)** for the static half: the check now reads every `*.py` the repository ships or runs (`test/` recursively, `plugins/`, `bin/`) with exact-path, exact-count, reasoned exemptions (`test/residue.py` 1, `agent-harness/scripts/audit_agent.py` 2). Its first run refused a real bypass, `test/audit_regressions/instruction_budget.py` line 21, now `residue.workspace()`. Plants: an aliased maker in a plugin script, a renamed from-import under `bin/`, a third maker in `audit_agent.py` — each refused by file and line. What stays true: the check reads source, it does not observe `$TMPDIR`; that half stays with AG-06b's content fingerprint. Evidence: verification.md, v0.27.1 |
 | AG-06b | **The 2592 existing trees are reported and left alone.** `find "$TMPDIR" -maxdepth 4 -type f -path '*/copy/sub/b.sh' \| wc -l` → **2592** on 2026-08-20, of which **16 were added by this run's own verification** — one run of the leaking fixture before the port, and one of the v0.12.0 archive's copy of it. They are plain `tmpXXXXXXXX` and indistinguishable from every other program's, so they are named rather than swept. The identical fixture still leaks in **`seo-aeo-audit`**, which another agent holds; referred, not edited. | AG-06 port, 2026-08-20; plan R28 of the hub's 2026-10-11 integration waves | 2 | 0 | 1 | **2** | **closed in v0.27.1 (2026-10-12)** — the trees ARE identifiable by content, so they are reapable without claiming another program's directory: `python3 test/residue.py --reap-own` (dry run by default, `--apply` to remove) claims only an `mkdtemp()`-named, non-symlink child of the temp root holding exactly one of the fixture's five end-state file sets and its directory set byte for byte, plus optionally its own manifest, unchanged for 24 h; root, age floor and the removal window hardened after the PR #45 reading (verification.md, v0.27.1). `test/reap_own_test.py` 6/6 in a sandbox temp root; a planted permissive reaper (any tree holding `sub/b.sh`) was refused: `near-misses were claimed as own: ['tmpextrab01', 'tmpextraf01']`. Real `$TMPDIR`, dry, 2026-10-12: `0 tree(s) match`; the `find` count is 0 — the 2592 trees are already gone, and both leaking suites (`agent-stack`, `seo-aeo-audit`) now use `residue.workspace()`. Nothing in the real `$TMPDIR` was deleted |
-| B-159 | **`seo-aeo-audit` still has the AG-06a/B-158 hole.** Its temp-tree check reads less than the whole repository and misses aliased calls, and `test/negatives.py:195` makes a bare `tempfile.mkdtemp(prefix="tp-negatives-snap-")` outside any residue ledger (read on its `origin/main`, 2026-10-12). Port agent-stack 0.27.1's whole-repository scan, any-receiver pattern and exact-shape exemptions there, and route that snapshot through the ledger. | agent-stack PR #45 blind reading, 2026-10-12 | 1 | 0 | 1 | **1** | **open** — another repository; referred, not edited |
-| B-160 | **make-skill's temp-tree check reads `test/` only.** make-skill 0.31.0 has the any-receiver pattern but walks `test/` alone, so a maker in a shipped script is invisible there exactly as AG-06a described here. Port agent-stack 0.27.1's whole-repository scan with exact-path, exact-count, exact-shape exemptions back to make-skill. | agent-stack PR #45 blind reading, 2026-10-12 | 1 | 0 | 1 | **1** | **open** — another repository; referred, not edited |
+| B-159 | **`seo-aeo-audit` still has the AG-06a/B-158 hole.** Its temp-tree check reads less than the whole repository and misses aliased calls, and `test/negatives.py:195` makes a bare `tempfile.mkdtemp(prefix="tp-negatives-snap-")` outside any residue ledger (read on its `origin/main`, 2026-10-12). Port agent-stack 0.27.1's whole-repository scan, any-receiver pattern and exact-shape exemptions there, and route that snapshot through the ledger. | agent-stack PR #45 blind reading, 2026-10-12 | 1 | 0 | 1 | **1** | **partial, open** — snapshot ledger fixed in SEO; whole-repository source guard still missing at reviewed cut. See [FW00 evidence](runs/2026-10-13-fw00-referrals.md). |
+| B-160 | **make-skill's temp-tree check reads `test/` only.** make-skill 0.31.0 has the any-receiver pattern but walks `test/` alone, so a maker in a shipped script is invisible there exactly as AG-06a described here. Port agent-stack 0.27.1's whole-repository scan with exact-path, exact-count, exact-shape exemptions back to make-skill. | agent-stack PR #45 blind reading, 2026-10-12 | 1 | 0 | 1 | **1** | **closed 2026-10-13, bounded source scope** — make-skill whole-repository guard accepted; [FW00 evidence](runs/2026-10-13-fw00-referrals.md) and verification ledger. Runtime/language limits retained. |
 | B-161 | **The owner validator accepted duplicate declarations and a disabled release ancestry check.** Eight real-validator plants passed on cb8f699; the same seam also hid an even-backslash Markdown pipe in AG-06b. | hub R30, 2026-10-13 | 2 | 0 | 1 | **2** | **closed, source/publication scope** — PR47/PR48 integrated, v0.27.2 published with44 exact payload files. [Release receipt](runs/2026-10-13-release-0.27.2.md#published-readback); family pin/install remains separate. [Packet](runs/2026-10-13-r30-owner-gates.md) |
 
 ## Open, and why

docs/evidence/runs/2026-10-13-fw00-referrals-checks/payload-parity.json

@@ -0,0 +1,53 @@
+{
+  "base": "6b71918a4d9b23a1f10af54b7d574a48e401ef26",
+  "command": "npm pack --dry-run --json --ignore-scripts",
+  "exit_code": 0,
+  "files": 44,
+  "all_payload_bytes_equal_base": true,
+  "paths": [
+    "CHANGELOG.md",
+    "LICENSE",
+    "README.md",
+    "SECURITY.md",
+    "bin/agent-stack.js",
+    "package.json",
+    "plugins/agent-stack/.claude-plugin/plugin.json",
+    "plugins/agent-stack/skills/agent-evals/references/multi-agent.md",
+    "plugins/agent-stack/skills/agent-evals/references/otel-genai.md",
+    "plugins/agent-stack/skills/agent-evals/references/statistics.md",
+    "plugins/agent-stack/skills/agent-evals/SKILL.md",
+    "plugins/agent-stack/skills/agent-harness/references/audit.md",
+    "plugins/agent-stack/skills/agent-harness/references/context-lifecycle.md",
+    "plugins/agent-stack/skills/agent-harness/references/instruction-budget.md",
+    "plugins/agent-stack/skills/agent-harness/references/layers.md",
+    "plugins/agent-stack/skills/agent-harness/references/pi-sdk.md",
+    "plugins/agent-stack/skills/agent-harness/references/pi.md",
+    "plugins/agent-stack/skills/agent-harness/references/system-prompt.md",
+    "plugins/agent-stack/skills/agent-harness/references/techniques.md",
+    "plugins/agent-stack/skills/agent-harness/references/tools.md",
+    "plugins/agent-stack/skills/agent-harness/references/workbench-contracts.md",
+    "plugins/agent-stack/skills/agent-harness/scripts/audit_agent.py",
+    "plugins/agent-stack/skills/agent-harness/scripts/instruction_budget.py",
+    "plugins/agent-stack/skills/agent-harness/SKILL.md",
+    "plugins/agent-stack/skills/agent-interop/references/a2a.md",
+    "plugins/agent-stack/skills/agent-interop/references/gateway.md",
+    "plugins/agent-stack/skills/agent-interop/references/mcp-scale.md",
+    "plugins/agent-stack/skills/agent-interop/references/mcp-ship.md",
+    "plugins/agent-stack/skills/agent-interop/references/mcp.md",
+    "plugins/agent-stack/skills/agent-interop/references/registry.md",
+    "plugins/agent-stack/skills/agent-interop/SKILL.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/context-engineering.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/governance.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/graph-engineering.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/kv-cache.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/llm-proxy-billing.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/memory-architecture.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/memory-landscape.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/memory-lifecycle.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/patterns.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/pipeline.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/provider-lifecycle.md",
+    "plugins/agent-stack/skills/agent-orchestrator/references/runtime.md",
+    "plugins/agent-stack/skills/agent-orchestrator/SKILL.md"
+  ]
+}

docs/evidence/runs/2026-10-13-fw00-referrals-checks/structural.log

@@ -0,0 +1,3 @@
+  unlooked: front matter vs a strict reader — no sshlg-skills umbrella above this checkout
+OK: agent-stack structurally valid (17 checks = 13 named + 4 per-skill, 4 skill(s), v0.28.2)
+residue: this run left nothing — 0 temp tree(s) created, 0 removed

docs/evidence/runs/2026-10-13-fw00-referrals.md

@@ -0,0 +1,38 @@
+# FW00 referral reconciliation — 2026-10-13
+
+Source base: `6b71918a4d9b23a1f10af54b7d574a48e401ef26`.
+The [independent four-row review](https://github.com/ssheleg/sshlg-skills/blob/3d4e897/docs/evidence/completion-1013/fw00-owner-closure-review.md) binds each owner file and its checks.
+This change reconciles two existing referral dispositions; it changes no package file.
+
+## B-160 — bounded source guard resolved
+
+[make-skill accepted source](https://github.com/ssheleg/make-skill/blob/c6b047057559f8dd2fe12dec59e4a4bee374fac2/test/validate.py)
+walks repository Python sources and refuses aliased temporary-tree makers, with
+exact-path/count/shape exceptions. Its [owner receipt](https://github.com/ssheleg/make-skill/blob/c6b047057559f8dd2fe12dec59e4a4bee374fac2/docs/evidence/runs/2026-10-13-fw01-temp-guard.md)
+records eight regression groups (seven fixture groups and one public-entry
+planted/removal pair), seven independent boundary controls and the
+full owner gate. That closes the requested source-lint port. The validator is
+repository-only; package publication does not itself execute it. Documented scan
+exclusions, non-Python languages, computed calls and runtime allocation remain
+outside this bounded proof.
+
+## B-159 — partial, retained open
+
+[SEO accepted snapshot correction](https://github.com/ssheleg/seo-aeo-audit/blob/5e9f6af67f9f01f70250465d63b0bb5f04983229/docs/evidence/runs/2026-10-13-fw01-snapshot.md)
+records the ledger-backed negative snapshot. The four-row review ran the public
+validator on that accepted source and on an owned out-of-test aliased-maker plant:
+both exited 0. Thus the second half of the referral is not resolved by the release.
+Next: SEO owns the whole-repository scanner, exact exemptions and independent
+outside-test/alias/exemption-drift controls; reconcile this row after acceptance.
+
+## Validation and delivery
+
+Focused owner structural validation, unchanged payload comparison and independent
+diff review are required before normal PR integration; results are appended below.
+No native/model, installed-state or whole-family completion claim follows.
+
+Focused validation: `python3 -B test/validate.py` exited 0 (17 checks; isolated
+checkout cannot inspect the umbrella). The original output is retained in
+`2026-10-13-fw00-referrals-checks/structural.log`. Payload comparison in
+`2026-10-13-fw00-referrals-checks/payload-parity.json` confirms all 44 npm dry-run
+payload files unchanged from accepted base. This is not a repeated full owner run.

docs/evidence/verification.md

@@ -10,6 +10,13 @@ This file exists because its absence read as zero exposure. `sshlg-skills` board
 
 ---
 
+## FW00 referral reconciliation — 2026-10-13
+
+[B-160 source evidence](runs/2026-10-13-fw00-referrals.md#b-160--bounded-source-guard-resolved)
+closes the specific make-skill whole-repository source-lint referral. B-159 remains
+open for SEO's missing whole-repository scanner; only its snapshot-ledger half is
+accepted. Original requirements and historical observations stay on the board.
+
 ## Release — v0.28.2 (2026-10-13)
 
 The [publication receipt](runs/2026-10-13-release-0.28.2.md#published-readback)