## Why
Every PR since #906 has run red on the same 5 checks (correctness
ubuntu+windows, go-gate-shadow, security, summary) — #906 and #907 both
merged with identical red sets. A permanently-red backstop is worse than
none: a real regression is invisible in the noise. This PR fixes every
class and makes green the expected state again.
## What (three commits)
**Wave 1 — the four red check classes** (each verified by running the CI
job's own command):
- **correctness/bats (138 CI-only failures, ~6 env mismatches)**: pawl
verdict-edge fail-closed fires without a trusted `ao` on PATH →
`PAWL_EDGE_FAIL_OPEN=1` on the bats step (the 3 fail-closed regression
suites opt back out); gtimeout probe crashing setup() on Linux; gawk \\"
bracket-expression warning corrupting jq assertions; ripgrep missing on
runners; teardown/skip-path exit codes; taxonomy fixture missing the
now-required observations field.
- **go-gate-shadow (8 full-gate failures → 0)**: #906 landed without a
heal/regen pass — pre/post-mortem pointer skills missing
`hexagonal_role`; codex twins/hashes drift; shrink-only grandfather
lists; evolve SKILL.md referencing 3 deleted scripts;
@covered-by/allowlist conflicts; 3 go.lint findings.
- **security (BLOCKED_HIGH → PASS)**: 3 false positives suppressed
per-finding with justification (gosec G122 on the dev-time arch checker;
2 semgrep mis-traces).
- **correctness/windows**: tests set HOME but Go os.UserHomeDir() reads
USERPROFILE on Windows → cross-platform setHome helper.
**Wave 2 — 18 residual bats failures across 13 files**, each first
proven identical on pristine origin/main (differential run) before
fixing. Content drift (README golden-path literal, discovery references,
bootstrap↔install-bd wiring, pawl-review reachability via council, rpi
helper-rung tokens), validator regressions (validate-codex-rpi-contract
resolver routing, em-loop labels, goal-design fixture), and stale tests
updated only where provably behind a deliberate change (catalog
schema_version pin 1→2, SHA-pinned action regex, retired perf scenario,
drained dangler pin 2→0, tagged-ao test build).
**Commit 3**: the `ao skills unlink` train that landed on main mid-work
re-reddened security with the same semgrep value-struct FP — suppressed
like its skills_link sibling.
## Verification (rebased onto current main tip)
- `ao gate check --full`: **92/93 pass, 0 fail** (1 expected AP7 skip)
- `security-gate.sh --mode quick`: **PASS**
- `go vet` clean; **11,878 Go tests green** (149 packages)
- All 13 wave-2 bats suites **0 not-ok**; CI-sim (no-ao PATH) bats clean
on wave-1 suites
- Windows fix verified via GOOS=windows build+vet (needs the
windows-latest job for final confirmation)
**Acceptance: this PR's own validate.yml run going green.**
Bead: age-htrqp
---------
Co-authored-by: boshu <241868352+boshu2@users.noreply.github.com>
Installers now prove their claims before printing success: the installed
skill directory count, the manifest count `ao doctor` reads, and the
recorded metadata skill_count must all agree, the config-enable entry
must be present, and a sentinel skill must be readable. On any mismatch
the installer exits nonzero naming the delta instead of declaring
victory over a broken state.
Root cause of the audit's "install metadata says 66 skills but manifest
says 62": install-codex-plugin.sh counted on-disk SKILL.md directories
(66) and wrote that into install metadata, while `ao doctor`
(ReadCodexManifestSkillCount) reads the manifest's package_count and
falls back to len(skills[]) = 62 (implementation rows only) when
package_count is absent/stale. The two numbers came from independent
sources with nothing reconciling them. The new self-test computes the
count doctor will use (package_count, else len(skills[])) and refuses to
report success unless disk == manifest == metadata — closing the gap at
the true source rather than papering over it.
- install-codex-plugin.sh: manifest_doctor_count() mirrors doctor;
selftest_codex_plugin() enforces the three-way count identity + config
+ sentinel; success line -> "Verify it worked: restart Codex, /plan".
- install-opencode.sh: AGENTOPS_BUNDLE_ROOT local-source mode (offline);
self-test on linked-vs-source count + plugin link + sentinel.
- install.sh: AGENTOPS_BUNDLE_ROOT local-source mode; orchestrator
self-test tail; fix empty-array expansion under set -u on bash 3.2
(reachable now that local-source mode runs this path offline).
- install-agy.sh: self-test on plugin registration + sentinel skill.
- tests/scripts/installer-selftest.bats: offline coverage incl. the
seeded 66-vs-62 stale-manifest fixture that must fail, and a legacy
no-package_count-but-consistent manifest that must pass (doctor parity).
.ps1 parity (install-codex.ps1/install-ao.ps1) deferred: same latent
divergence exists but no pwsh on the dev host to verify; shipping
untested Windows installer code would undercut the first-run-trust goal.
Swarm: 8 tasks across 2 waves, TDD on all Go changes.
HIGH fixes:
- rpi serve --run-id now matches 12-hex IDs (was misclassifying as goals)
- cherry-pick-wave.sh: pattern validation + prefix-scoped rm fallback
- -o flag contract: rename local --output to --output-dir/--output-file
on defrag, memory, context_assemble (stops shadowing root format flag)
MEDIUM fixes:
- defrag --json now emits JSON (was printing text unconditionally)
- Remove dead promote-anti-patterns from doctor suggestions
- Pin install scripts to tagged releases instead of mutable main
- Add ao doctor + skill-lint CI jobs to validate.yml
- Add learning coherence quality gate script
Process:
- Drain 7 unconsumed next-work.jsonl entries (0% → 100% resolution)
- 192 lines of new tests (TDD: test-first across all Go changes)
Bo