Promote develop to main: fidelity verification system, agent write-safety, and doc reconciliation

.editorconfig

@@ -63,6 +63,12 @@ end_of_line = lf
 [spec/{validate,audit}.py]
 end_of_line = lf
 
+# The agent-safety kit's Python is shebang-executable tooling run by path (the PreToolUse hook and its
+# installer), so pin LF for the same reason as the entry points above - a CRLF shebang breaks direct
+# execution on a Unix host.
+[host-setup/agent-safety/*.py]
+end_of_line = lf
+
 # uv regenerates uv.lock with LF on every platform, so pin it or an EOL check (editorconfig-checker/CI)
 # reds on every `uv lock`/`uv sync` until the file is manually reconverted - same rationale as the
 # shebang/Dockerfile pins (a tool owns the ending). A Python repo on the CRLF default carries this; a repo

.gitattributes

@@ -15,9 +15,12 @@ catalog/snippets/husky/pre-commit text eol=lf
 
 # Vanilla `.py` follows the CRLF default - Python's universal newlines accept CRLF, and it is
 # commonly edited on Windows. Pin LF only for a `.py` executed directly via its shebang, by path -
-# here the CI validation entry point; do not re-add a blanket `*.py text eol=lf`.
+# here the CI validation entry point, the fleet-audit runner, and the agent-safety hook and its
+# installer. Do not re-add a blanket `*.py text eol=lf`.
 spec/validate.py text eol=lf
 spec/audit.py text eol=lf
+host-setup/agent-safety/gh-write-guard.py text eol=lf
+host-setup/agent-safety/install.py text eol=lf
 
 # uv regenerates uv.lock with LF on every platform; pin it so git enforces LF on checkout/renormalize and a
 # CRLF-default repo does not fight the tool on every `uv lock`/`uv sync`. A repo with no lockfile is unaffected.

.github/copilot-instructions.md

@@ -4,7 +4,7 @@ Repository conventions for GitHub Copilot (and any other AI agent reading this f
 
 The **canonical guide is [AGENTS.md](../AGENTS.md)** at the repo root - read it first, including the [PR Review Etiquette](../AGENTS.md#pr-review-etiquette) review-loop contract this file's runbook implements. This file is intentionally narrow: commit/PR-title conventions (summarized inline so VS Code's commit-message and PR-title generators have them) plus the GitHub Copilot Review Runbook.
 
-For code-style rules, see [`CODESTYLE.md`](../CODESTYLE.md) at the repo root - one guide with a General section plus per-language sections (.NET, Python).
+For code-style rules, see [`CODESTYLE.md`](../CODESTYLE.md) at the repo root - one guide with a General section plus a section per language the repo uses.
 
 Do not duplicate language-specific rules here. **Project-specific conventions and API/behavioral contracts also belong in [AGENTS.md](../AGENTS.md), not here** - this file is intentionally limited to the inline commit/PR-title summary and the GitHub Copilot Review Runbook. Non-Copilot agents (Claude Code, Codex, Cursor, ...) are not directed to this file and don't read it by default, so any rule a reviewer must honor has to live in `AGENTS.md` to be provider-independent.
 
@@ -85,6 +85,9 @@ Known non-working request paths (don't rely on them - use the `requestReviews` m
 
 - `POST /requested_reviewers` with `reviewers=[Copilot]` can return 200 but no-op.
 - `copilot-pull-request-reviewer` as a requested reviewer slug returns 422.
+- `requestReviews` with the reviewer's bot node id in **`userIds`** fails with `Could not resolve to User node` - the Copilot reviewer is a **Bot**, so its node id goes in **`botIds`** (as in the mutation above), never `userIds`.
+- `suggestedActors(capabilities: [CAN_BE_ASSIGNED])` lists `copilot-swe-agent` (the coding agent), not `copilot-pull-request-reviewer` - do not source the reviewer's bot node id there. Read it from an existing review per step 1 above.
+- There is no `removePullRequestFromReviewRequest` mutation, and removing the reviewer to force a fresh pass is unnecessary anyway - `requestReviews` with `union: true` re-fires the review on the current head.
 
 ### Verify Review Covered Current Head
 
@@ -119,6 +122,8 @@ If a review did not run on the current head, retry:
 
 ### Reply and Thread Resolution Workflow
 
+Every id below is captured from a live query into a variable and passed from there - never hand-typed, guessed, or pasted as a `PRRT_...` literal. A node id resolves globally, so a fabricated or stale id does not fail, it writes to a real thread on an unrelated repository. This runbook implements [AGENTS.md "Repository Boundaries and Write Safety"](../AGENTS.md#repository-boundaries-and-write-safety): write only to this repo, capture every id from a live query, and never suppress a mutation's output.
+
 List unresolved threads. Use `first: 100` with cursor-based pagination; if `hasNextPage` is true, re-run with `after: "<endCursor>"` to retrieve the next page:
 
 ```sh
@@ -142,20 +147,38 @@ gh api graphql -f query='
 '
 ```
 
-Reply on a thread, then resolve it:
+Reply on a thread, then resolve it. Capture the target thread's id into `$TID` from the listing query above - filter to the thread being answered by its `path`, and guard for an empty result so a mutation never runs on a guessed id. When a file carries more than one unresolved thread, `path` alone is ambiguous and `head -n 1` would pick the wrong one, so narrow by first-comment body - the query already fetches `comments(first: 1)` for this - by adding `and (.comments.nodes[0].body | contains("<SNIPPET>"))` to the `select`:
 
 ```sh
+TID=$(gh api graphql -f query='
+{
+  repository(owner: "<owner>", name: "<repo>") {
+    pullRequest(number: <N>) {
+      reviewThreads(first: 100) {
+        nodes { id isResolved path comments(first: 1) { nodes { body } } }
+      }
+    }
+  }
+}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
+  | select(.isResolved == false and .path == "<PATH>")
+  | .id' | head -n 1)
+[ -n "$TID" ] || { echo "no matching unresolved thread on <PATH> - do not guess an id" >&2; return 1 2>/dev/null || exit 1; }
+
+# Show the mutation's output. Never append an output-discard or force-success tail
+# (>/dev/null, 2>/dev/null, &>/dev/null, || true, || :, || echo) to a write.
 gh api graphql -f query='
 mutation($threadId: ID!, $body: String!) {
   addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $threadId, body: $body }) {
-    comment { id }
+    comment { id url }
   }
-}' -F threadId="PRRT_..." -F body="Fixed in <SHA>: <one-line summary>."
+}' -F threadId="$TID" -F body="Fixed in <SHA>: <one-line summary>."
 
+# Confirm isResolved: true in this response before treating the thread as closed - a write that
+# appears to fail may have taken on the server.
 gh api graphql -f query='
 mutation($threadId: ID!) {
   resolveReviewThread(input: { threadId: $threadId }) { thread { id isResolved } }
-}' -F threadId="PRRT_..."
+}' -F threadId="$TID"
 ```
 
 Issue-level Copilot comments (those in `issues/<N>/comments`) have no resolution action - GitHub provides no API or UI to resolve them. Reply if the finding warrants it; no resolution step is needed or possible.

.github/workflows/merge-bot-pull-request.yml

@@ -42,7 +42,7 @@ jobs:
       # Auto-merge every tier, semver-major included: the required checks are the gate, not the bump magnitude.
       - name: Merge pull request step
         run: |
-          set -euo pipefail
+          set -Eeuo pipefail
           case "${{ github.event.pull_request.base.ref }}" in
             develop) method=--squash ;;
             main) method=--merge ;;
@@ -84,7 +84,7 @@ jobs:
 
       - name: Merge pull request step
         run: |
-          set -euo pipefail
+          set -Eeuo pipefail
           case "${{ github.event.pull_request.base.ref }}" in
             develop) method=--squash ;;
             main) method=--merge ;;
@@ -126,7 +126,7 @@ jobs:
 
       - name: Merge pull request step
         run: |
-          set -euo pipefail
+          set -Eeuo pipefail
           case "${{ github.event.pull_request.base.ref }}" in
             develop) method=--squash ;;
             main) method=--merge ;;

.github/workflows/publish-release.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: Assert dispatch ref step
         run: |
-          set -euo pipefail
+          set -Eeuo pipefail
           if [ "${{ github.ref_name }}" != "main" ] && [ "${{ github.ref_name }}" != "develop" ]; then
             echo "::error::Dispatch publish-release from main (release) or develop (prerelease); got ${{ github.ref_name }}."
             exit 1

.github/workflows/test-pull-request.yml

@@ -28,7 +28,7 @@ jobs:
     steps:
       - name: Check workflow results step
         run: |
-          set -euo pipefail
+          set -Eeuo pipefail
           if [[ "${{ needs.validate.result }}" != "success" ]]; then
             echo "Job 'validate' did not succeed (${{ needs.validate.result }}); refusing to pass."
             exit 1

.github/workflows/validate-task.yml

@@ -43,7 +43,7 @@ jobs:
 
       - name: Validate registry and spec step
         run: |
-          set -euo pipefail
+          set -Eeuo pipefail
           for f in registry/*.json spec/*.json repo-config/*.json; do
             jq empty "$f"
           done

.markdownlint-cli2.jsonc

@@ -1,10 +1,9 @@
 {
     "config": {
-        // Prose paragraphs and data-heavy tables/URLs are intentionally long;
-        // reflowing at 80 cols hurts readability and churns diffs.
+        // Prose paragraphs and data-heavy tables/URLs are intentionally long.
+        // Reflowing at 80 cols hurts readability and churns diffs.
         "MD013": false,
-        // Inline HTML is used for reference-link section dividers.
-        "MD033": false,
+        // MD033 (inline HTML) stays enabled: HTML comments (reference-link dividers) pass it, and elements are flagged so native markdown wins.
         // Require fenced code blocks over the legacy 4-space-indented style.
         "MD046": { "style": "fenced" },
         // MD060 (table column style) is not enforced - allow both compact