Re-vendor the Carried Skills Tree and the Stale Verbatim Rule Sections

.github/skills/audit-a-repo/SKILL.md

@@ -18,10 +18,10 @@ The audit is the fleet's measurement procedure, and the two failure shapes it gu
 
 ## Measuring
 
-- **Resolve the repo's types from `registry/repos.json`** and classify a `classificationPending` entry from the tree (`AUDIT.md` section 2). The applicability gate is `WORKFLOW.md` section 1: a check governing an absent construct is N/A, excluded from the verdict, and never a defect (`AUDIT.md` section 3).
+- **Resolve the repo's types from `registry/repos.json`** and classify a `classificationPending` entry from the tree (`AUDIT.md` section 2). The applicability gate is `WORKFLOW.md` section 1, extended to `AUDIT.md`'s own checks: an item or check governing an absent construct is N/A, excluded from the verdict, and never a defect (`AUDIT.md` section 3).
 - **Know what the runner does and does not prove.** `spec/audit.py` mechanizes the deterministic subset only: settings, rulesets, secret names, file and section presence, verbatim hashing, interface wiring, Dependabot coverage, branch facts. It evaluates no check under a type in `spec/project-types.json`, so every per-type check is judged by hand, and a clean run is no evidence for them (`AUDIT.md` section 4). Silence from a tool that was never looking reads exactly like a pass.
 - **Judge letter and intent per check** and keep the vocabulary: letter miss with intent satisfied is a drift finding, both missing is a defect, and operational is binary over the applicable set (`AUDIT.md` sections 4 and 7). Do not invent a parallel scheme.
-- **Assert the Actions implement `WORKFLOW.md`** by outcome, not by matching catalog snippets byte for byte: the 5A static audit with a `file:line` citation per applicable guarantee, then the 5B trace scenarios (`AUDIT.md` section 5). The `workflow-ci-contract` skill summarizes that contract.
+- **Assert the Actions implement `WORKFLOW.md`** by outcome, not by matching catalog snippets byte for byte: the 5A static audit, each applicable guarantee cited in the form 5A sets out, then the 5B trace scenarios (`AUDIT.md` section 5). Read a workflow the repo only calls at the SHA it pins, for both. The `workflow-ci-contract` skill summarizes that contract.
 - **Check live settings, rulesets, and secrets from a hub checkout at `main`** with `AUDIT.md` section 6. Run `repo-config/configure.sh check` with the target repository and model for settings and rulesets, and `spec/audit.py [RepoName]` for secrets, rather than constructing a local comparison. The hub payloads are the only repository-configuration source.
 
 ## Reporting

.github/skills/comment-and-doc-style/SKILL.md

@@ -65,15 +65,15 @@ boundary before repository mounts begin. Each Docker command has a timeout and v
 Lint containers disable networking and mount the checkout read-only. Persist approval only when
 the executor constrains that whole shape. Never allow an unconstrained `docker run` prefix.
 PSScriptAnalyzer downloads its pinned module in a separate container that has network access and
-no repository mount. `GOVERNANCE.md` "Running the Linters Locally (Known-Working Invocations)"
-owns the exact invocation and full authorization model.
+no repository mount. `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working
+Invocations)" section owns the exact invocation and full authorization model.
 
 Agent-specific authorization stays in provider-labeled bullets so one agent's configuration does
 not read as a shared requirement:
 
-- **Codex:** rules cannot safely cover changing worktree paths and digests. Smart Approvals can
-  prompt per task. No-prompt operation is supported only inside an external sandbox because it
-  removes command-wide protection.
+- **Codex:** execution rules match exact argument prefixes, so they cannot safely cover changing
+  worktree paths and digests. Smart Approvals can prompt per task. No-prompt operation is
+  supported only inside an external sandbox because it removes command-wide protection.
 
 ## Markdown formatting
 
@@ -230,7 +230,7 @@ hub-hosted tool the reader runs, are in `references/carried-doc-references.md`.
 - **Rules**: no vague titles (`update stuff`, `wip`). Dependabot's default `Bump X from Y to Z`
   titles are fine as-is. No `Co-Authored-By:` lines unless the developer explicitly asks. No
   release-bump magnitude in the title ("minor", "patch", "release v0.2.0"), Nerdbank.GitVersioning
-  computes the next version from `version.json` and git history, a dependency version in a
+  computes the next version from `version.json` and git history. A dependency version in a
   dependency-bump title is fine and expected. US English spelling, and title case with lowercase
   short bind words (a, an, the, and, but, or, of, in, on, at, to, by, for, from), a hyphenated
   compound capitalizes both parts unless the second is a short preposition (*Built-in*,
@@ -241,7 +241,7 @@ Add Structured Logging Extensions to Library
 Pin softprops/action-gh-release to Commit SHA
 Drop net8.0 Multi-Targeting from Console Project
 Bump xunit.v3 from 3.2.2 to 3.3.0
-Clarify devcontainer Setup Steps in README
+Clarify Devcontainer Setup Steps in README
 ```
 
 ## Quantitative claims

.github/skills/dotnet-codestyle/SKILL.md

@@ -49,9 +49,17 @@ All builds must complete without warnings, enforced three ways:
   surfaced as a warning fails the build and must be fixed or deliberately suppressed at the
   narrowest scope that fits (see Analyzer suppressions below), never left to accumulate.
 - **CI lint backstop.** CI runs the clean-compile checks on every PR as the authoritative gate.
-  A working local hook is strongly suggested, not optional: wire Husky.Net from the canonical
-  `catalog/snippets/husky/` config. See GOVERNANCE.md "Running the Linters Locally" for what the
-  hook must cover and what its absence means.
+  Husky.Net is wired from the canonical `catalog/snippets/husky/` config in the hub, hub-local
+  and not carried into every fleet repo. Its hook needs a .NET tool manifest declaring
+  Husky.Net, which the snippet does not ship. A repo keeping no such manifest takes the other
+  canonical shape, `catalog/snippets/pre-commit/`, and so does a repo that simply prefers the
+  `pre-commit` framework. Each shape carries whichever language checks its own repo keeps. A repo may also wire an equivalent hook of its own at `.husky/pre-commit`,
+  enabled with `core.hooksPath` and sourcing nothing, since the husky snippet's own hook sources
+  a file only `dotnet husky install` generates. That path and `.pre-commit-config.yaml` are the
+  two the audit reads.
+  GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section
+  carries the obligation itself, what the hook must cover, its audit treatment, and the
+  per-clone enablement steps.
 
 **A new port is not a license to silence diagnostics.** Brownfield or just-ported status never
 justifies relaxing analyzer severities or muting newly surfaced warnings. Fix them. (The only
@@ -79,7 +87,7 @@ in place.
 ### Build tasks
 
 Run these from VS Code's task runner (Terminal -> Run Task) or an agent's task-running tool. The
-three clean-compile tasks are carried verbatim, and a repo adds its own convenience tasks (tool
+three clean-compile tasks are carried unchanged, and a repo adds its own convenience tasks (tool
 updates, dependency upgrades, benchmarks) on top:
 
 - `.NET Build`: build with diagnostic verbosity *(clean-compile)*
@@ -95,8 +103,12 @@ updates, dependency upgrades, benchmarks) on top:
   `dotnet format style --verify-no-changes --severity=info --verbosity=detailed`.
 - **`dotnet-outdated-tool`** checks for dependency updates, and Nerdbank.GitVersioning owns
   version management.
-- CI is the authoritative lint backstop. A local pre-commit hook is strongly suggested: wire
-  Husky.Net from `catalog/snippets/husky/` for local enforcement, including the shared doc gates.
+- CI is the authoritative lint backstop. A repo already keeping a .NET tool manifest declaring
+  Husky.Net wires its local pre-commit hook from `catalog/snippets/husky/` in the hub, hub-local
+  and not carried into every fleet repo. A repo keeping none, or one preferring the `pre-commit`
+  framework, takes `catalog/snippets/pre-commit/` instead. Either shape covers the shared doc
+  gates alongside the language checks. Each snippet's own README names the per-clone steps and
+  the second file to copy alongside it.
 - **Required VS Code extensions**: CSharpier, markdownlint, CSpell. Use the workspace settings
   without overrides.
 
@@ -198,7 +210,7 @@ The .NET mechanics, narrowest first:
 
 xUnit v3 (`xunit.v3`, not the legacy `xunit`) + AwesomeAssertions (`.Should()` API, never native
 asserts). Arrange-Act-Assert pattern, descriptive underscore names, `[Theory]`/`[InlineData]` for
-parameterized tests. See `references/testing.md` for the framework setup template.
+parameterized tests. A test project on `xunit.v3` 4.0.0 or later is MTP-based, and also carries a `global.json` runner declaration, a `Microsoft.Testing.Extensions.CodeCoverage` floor, and no `xunit.runner.visualstudio`. See `references/testing.md` for the framework setup template and that configuration.
 
 ## Project configuration
 

.github/skills/dotnet-codestyle/references/testing.md

@@ -23,3 +23,19 @@
 2. **Organization**: Arrange-Act-Assert pattern.
 3. **Naming**: descriptive names with underscores.
 4. **Theory tests**: use `[Theory]` with `[InlineData]`.
+
+## Microsoft.Testing.Platform and coverage
+
+A test project on `xunit.v3` 4.0.0 or later is MTP-based, and the .NET 10 SDK and later refuse to run one through the VSTest target, so such a project also carries:
+
+- a root **`global.json`** declaring `{"test": {"runner": "Microsoft.Testing.Platform"}}`, which is what selects the driver `dotnet test` runs the project through,
+- **`Microsoft.Testing.Extensions.CodeCoverage`** at **18.9.0 or later**, in place of `coverlet.collector`, whose VSTest data collector MTP ignores without failing,
+- no **`xunit.runner.visualstudio`**, the VSTest adapter MTP replaces.
+
+A project not yet MTP-based keeps the VSTest collector, and that lagging state is a migration owed rather than drift, until its own `xunit.v3` bump forces the move.
+
+**The version floor is load-bearing rather than cautionary.** Below 18.1.0 the extension is built against Microsoft.Testing.Platform 1.x, and an 18.0.x resolution, which is what a `>= 18.0.0` range picks, throws a `TypeLoadException` against the 2.x platform `xunit.v3` 4.0.0 carries, runs zero tests, and **still writes a well-formed Cobertura file reporting full coverage**, so only the non-zero exit says the run reported nothing. 18.9.0 is the first release on Microsoft.Testing.Platform 2.3.x, where every test project writes into the one shared `--results-directory` the invocation names rather than resolving that relative path per project.
+
+The CI invocation `WORKFLOW.md` D1.6 requires is `dotnet test --coverage --coverage-output-format cobertura --results-directory ./coverage`. Two further details of it are equally load-bearing, and neither failure reds the job on its own. `--coverage-output` stays unset, because pinning one filename gives every test project in the solution the same path and a solution with more than one then keeps only whichever ran last. Leaving it unset produces the default name `<guid>.cobertura.xml`, which `codecov-cli`'s own file finder does not match, so the report is renamed before the upload reads the directory, per `WORKFLOW.md` D1.6.
+
+**Diagnosing a local run.** `dotnet test` under the CI configuration reports zero tests on some machines where CI reports the full suite on the same SDK, which reads as a broken repository and is a broken driver. The target string the run prints separates the two: `net10.0` with no architecture means the driver resolved none, and `net10.0|<arch>` with no tests means the tests did not register, which is the case that points back at the three requirements above.