## Summary Two Verification Discipline gaps, both surfaced by the same incident transcript (an agent reading a pre-existing `~/repos/HomeAutomation-Config` checkout, then failing to fetch its content via `raw.githubusercontent.com` because the repo is private): - **#784**: no rule said a checkout already sitting on disk, one this session did not clone or install itself, is untrusted. It may belong to another concurrent session, sit on a stale fetch or unexpected branch, or hold unreviewed uncommitted edits. Added a `GOVERNANCE.md` "Verification Discipline" bullet distinguishing this from the existing local-clone-staleness rule, plus a mirrored summary bullet in the `agent-conduct` skill's "Before Claiming Done". - **#777**: `raw.githubusercontent.com` 404s identically for a private repository and a genuinely missing file, so that response cannot answer whether content exists. Added a bullet documenting `gh api repos/<owner>/<repo>/contents/<path>?ref=<ref>` as the correct route when a repo's visibility is not confirmed public, naming the `2>&1`-into-`base64 -d` decode corruption from the issue's own transcript and calling out verifying the ref before trusting a 404. Both are doc-only changes to the hub's own canonical text. `scripts/build_dist.py` regenerated the two generated skill distributions (`.claude-plugin/fleet-skills/`, `.github/skills/`) from the single edited source at `.agents/skills/agent-conduct/SKILL.md`. ## Verification Ran the full local gate set from `OPERATIONS.md` "Local Verification" (ruff, mypy, the `scripts/tests` + `spec/audit.py --selftest` + `gh-write-guard.py --selftest` + `test_install.py` unittest run, `build_dist.py --check`, `repo_gate.py`, `prose_lint.py`'s full check list, `spec/validate.py`, `docker_lint.py`) — all passed. Fixes #784 Fixes #777 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Documentation** * Updated verification guidance to require fresh repository data or live API reads rather than relying on existing local checkouts. * Added branch-specific checks before reporting content as unavailable. * Clarified handling of file retrieval errors, including API-based verification when repository visibility is uncertain. * Synchronized these updates across the relevant guidance and refreshed the associated source digest. * Improved the reliability and accuracy of repository content verification.

Commits

Commits on Aug 27, 2026

Distrust Found Checkouts and Private-Repo Raw Fetches (#1036)