## Why (quorum remediation)
#767 (via an autonomous resolver, **merged without quorum**) broadened
the ag-eatf safe-paths false-positive filter to strip **any**
backtick-wrapped `../path`. Side effect: a backtick-wrapped
`../../../../etc/passwd` in a SKILL.md would be treated as a safe
doc-reference and **bypass the safe-paths gate**.
Cross-model quorum on the as-merged change: **Codex = REVISE**
("unacceptable bypass… constrain to repo-internal + approved extensions,
else revert"). (agy/Gemini was unreachable this round — timeouts.)
Tightening a gate back toward its documented intent is the safe
direction, so this lands the constrained version.
## Fix
Backtick strip now requires a **known repo-file extension**:
`md|markdown|mdx|txt|rst|json|yaml|toml|sh|go|py|ts|rs`. Legit
inline-code refs (``../../schemas/x.json``, ``../scripts/y.sh``) stay
exempt; an extension-less traversal (``../../../../etc/passwd``) no
longer matches → still **BLOCKS**.
## Evidence
`bats tests/scripts/skill-eval.bats` → 14/14 (2 new:
backtick-`/etc/passwd` blocks; backtick-`.json` ref passes; the
bare-traversal-blocks test still green).
Closes-scenario: ag-eatf#constrain-backtick-exemption
Bounded-context: BC2-Validation
Evidence: scripts/skill-eval.sh
## What
Wave 1 of **ag-okfu** — adds an explicit `Use when:` discovery trigger
clause to the 8 **judgment-tier** skills: `council`, `design`,
`post-mortem`, `pre-mortem`, `red-team`, `review`, `validate`, `vibe`.
`scan_descriptions.py` flagged 73/81 skills with no trigger marker — a
silent skill-selection risk since runtime discovery is pure LLM
reasoning over the `description` field. The judgment tier ships first
because mis-selection there (e.g. grabbing `review` when you needed
`validate`) is the most costly.
## Why this slice
The bead says *"wave by metadata.tier."* This is one coherent wave = one
PR with a single rollback semantic. Remaining tiers (execution 22,
knowledge 8, meta 8, session 6, background 5, product 5, contribute 4,
cross-vendor 3, library 3, orchestration 1) ship as follow-on waves.
## Evidence
- Corpus missing-trigger count: **73 → 65** (the 8 judgment skills now
pass).
- `python3 skills/skill-builder/scripts/scan_descriptions.py skills
--strict` — all 8 judgment skills report `has_trigger=True`.
- `bash scripts/generate-registry.sh --check` → `OK: registry.json is up
to date` (regenerated, descriptions embedded).
- `markdownlint` clean on all 8 changed SKILL.md files.
## Notes
- Does **not** close ag-okfu — the `--strict` gate stays red until all
tiers are done. Advances the bead; unblocks nothing yet (ag-cx7d ratchet
waits on full corpus clean).
Bounded-context: BC1-Corpus
Evidence: skill-domain-map golden gate
## What
`scripts/skill-eval.sh` treated ms's `safe-paths` rule as blocking on
**every** `../`. That rule is a blunt regex, and `../` relative markdown
doc-links are the repo-wide SKILL.md convention (47+ skills, e.g.
`[x](../other/SKILL.md)`, `../../docs/...md`). SKILL.md is
documentation, not executed code, so those are false positives — they
redded `skill-eval` → `summary` on **every skills-touching PR** (blocked
#776; gated #759/#764/#767 in this session's drain).
## Fix
Added a file-level filter: `safe-paths` stays **blocking only when a
`../` survives stripping (1) markdown inline-link targets `](...)` and
(2) relative doc-path tokens (`*.md/.markdown/.mdx/.txt/.rst`)** — i.e.
a real, non-doc `../`. Otherwise the findings downgrade to advisory
annotations (announced, not silenced).
Net effect: **purely removes false positives; real protection is
preserved.** A genuine traversal (e.g. `../../../../etc/passwd` in a
description) still blocks — verified. No regression to the other
blocking rules.
## Evidence
- `bats tests/scripts/skill-eval.bats` → 12/12 pass (10 prior + 2 new
ag-eatf cases: doc-links downgrade→PASS; real non-doc `../`→BLOCK).
- Manual: `agent-native` and `domain` skills (previously red on
safe-paths) now PASS; a mixed real-threat fixture BLOCKs.
Closes-scenario: ag-eatf#safe-paths-doclink-filter
Bounded-context: BC2-Validation
Evidence: scripts/skill-eval.sh
Bo