fix(skills): require real CI rollout evidence

CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes are documented here. The project follows Semantic
 Versioning.
 
+## [Unreleased]
+
+### Changed
+
+- CI and Drakkars skills now qualify changes only with naturally occurring
+  project jobs. They forbid synthetic, benchmark, soak, canary, manual rerun,
+  empty-commit and cancellation traffic created solely for rollout evidence.
+- Fleet audit guidance now verifies the contended 75-percent per-repository
+  envelope, uncontended full-fleet use, private-free runner routing, and both
+  queued and already-running repository correlation.
+- Explicit-only skills now use the native `agents/openai.yaml` invocation
+  policy as their canonical Codex control. The catalog no longer requires the
+  unsupported legacy `disable-model-invocation` SKILL frontmatter key; portable
+  adapters continue to derive invocation behavior from the typed registry.
+
 ## [0.1.1] - 2026-08-16
 
 First release of `github-device-sync` (GDS) as an open-source control plane

core/skills/catalog.go

@@ -75,9 +75,8 @@ type Interface struct {
 }
 
 type frontmatter struct {
-	Name                   string `json:"name"`
-	Description            string `json:"description"`
-	DisableModelInvocation *bool  `json:"disable-model-invocation,omitempty"`
+	Name        string `json:"name"`
+	Description string `json:"description"`
 }
 
 type openAIProjection struct {
@@ -314,22 +313,6 @@ func validateSkill(root string, budgets Budgets, definition *Definition) []domai
 			map[string]any{"path": skillPath, "expected": definition.Name, "observed": metadata.Name},
 		))
 	}
-	if definition.Invocation == "explicit-only" &&
-		(metadata.DisableModelInvocation == nil || !*metadata.DisableModelInvocation) {
-		findings = append(findings, simpleFinding(
-			"GDS_SKILL_PORTABLE_EXPLICIT_ONLY_MISSING",
-			"Explicit-only canonical skills must disable model invocation for compatible harnesses.",
-			map[string]any{"name": definition.Name, "path": skillPath},
-		))
-	}
-	if definition.Invocation != "explicit-only" && metadata.DisableModelInvocation != nil &&
-		*metadata.DisableModelInvocation {
-		findings = append(findings, simpleFinding(
-			"GDS_SKILL_PORTABLE_INVOCATION_DRIFT",
-			"Implicit-capable skill unexpectedly disables model invocation.",
-			map[string]any{"name": definition.Name, "path": skillPath},
-		))
-	}
 	if len(metadata.Description) > budgets.DescriptionChars {
 		findings = append(findings, simpleFinding(
 			"GDS_SKILL_DESCRIPTION_BUDGET_EXCEEDED", "Skill description exceeds the internal metadata budget.",

core/skills/catalog_test.go

@@ -45,7 +45,7 @@ func TestCurrentCanonicalCatalogValid(t *testing.T) {
 	}
 }
 
-func TestExplicitOnlySkillRequiresPortableInvocationGuard(t *testing.T) {
+func TestExplicitOnlySkillRequiresCodexInvocationPolicy(t *testing.T) {
 	root := t.TempDir()
 	skillRoot := filepath.Join(root, "skills", "canonical", "gds-fixture")
 	if err := os.MkdirAll(skillRoot, 0o755); err != nil {
@@ -79,21 +79,38 @@ fixture
 	if err := os.WriteFile(filepath.Join(skillRoot, "SKILL.md"), []byte(body), 0o644); err != nil {
 		t.Fatal(err)
 	}
+	if err := os.MkdirAll(filepath.Join(skillRoot, "agents"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	sidecar := `interface:
+  display_name: Fixture
+  short_description: Fixture validation skill
+  default_prompt: Use $gds-fixture for this fixture.
+policy:
+  allow_implicit_invocation: true
+`
+	if err := os.WriteFile(filepath.Join(skillRoot, "agents", "openai.yaml"), []byte(sidecar), 0o644); err != nil {
+		t.Fatal(err)
+	}
 	definition := Definition{
 		Name: "gds-fixture", Path: "skills/canonical/gds-fixture",
 		Invocation: "explicit-only", Mutation: "external",
+		Interface: Interface{
+			DisplayName: "Fixture", ShortDescription: "Fixture validation skill",
+			DefaultPrompt: "Use $gds-fixture for this fixture.",
+		},
 	}
 	findings := validateSkill(
 		root, Budgets{DescriptionChars: 600, SkillLines: 300}, &definition,
 	)
 	found := false
 	for _, finding := range findings {
-		if finding.Code == "GDS_SKILL_PORTABLE_EXPLICIT_ONLY_MISSING" {
+		if finding.Code == "GDS_SKILL_EXPLICIT_ONLY_PROJECTION_MISSING" {
 			found = true
 		}
 	}
 	if !found {
-		t.Fatalf("missing portable guard finding: %s", strings.TrimSpace(body))
+		t.Fatalf("missing Codex invocation-policy finding: %s", strings.TrimSpace(body))
 	}
 }
 

skills/canonical/gds-bootstrap-device/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-bootstrap-device
 description: Use this skill only when the owner explicitly asks to install or verify GDS, its pinned bundle, and selected harness projections on a new macOS, Linux, server, or CI device. Build an exact reversible plan and keep secrets in approved stores. Do not use it to clone every estate repository or change global tools silently.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-change-portfolio/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-change-portfolio
 description: Use this skill only when the owner explicitly asks to apply one logical change across repositories selected by a GDS portfolio. Create independent repository subplans, canaries, bounded waves, and an aggregate journal. Do not use it for one repository or pretend the portfolio has one Git transaction.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-ci-performance-verify/SKILL.md

@@ -27,6 +27,8 @@ Verify performance with comparable evidence rather than isolated job duration.
 
 1. Define the user-visible interval, normally PR-ready to all required checks and deployment complete.
 2. Select before/after cohorts matched by repository, workflow, event, change size, cache state, platform, and priority.
+   Use only naturally occurring project runs; never create synthetic,
+   benchmark, soak, canary, rerun, or empty-commit traffic to fill a cohort.
 3. Decompose median, p90, and p95 latency into queue, provision, setup, execute, upload/deploy, and teardown stages.
 4. Compare throughput, utilization, success, retry, infrastructure-failure, flaky-failure, and missing-telemetry rates.
 5. Identify critical-path changes and resource contention; keep priority classes separate.
@@ -38,7 +40,8 @@ Return cohort definition, metric table, confidence limits or evidence limits, re
 
 ## Stop conditions
 
-Stop before rerunning work, changing configuration, or claiming causality from unmatched evidence.
+Stop before dispatching or rerunning work, changing configuration, or claiming
+causality from unmatched evidence.
 
 ## Verification
 

skills/canonical/gds-complete-work/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-complete-work
 description: "Use this skill only when the owner explicitly asks to finish the current work completely across every affected Git repository: implement, verify, integrate, publish, update dependency pins, and remove only proven-safe completed branches or worktrees. Do not use it for status, routine sync, or unfinished handoff."
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-drakkars-audit-fleet/SKILL.md

@@ -29,8 +29,14 @@ Explain fleet health and bottlenecks from correlated, time-bounded evidence.
 2. Establish the audit window and inventory expected pools, capacity, priority, and technologies.
 3. Correlate GitHub queue/start/end events with scheduler, provider, host, runner, and telemetry records using stable run, job, intent, and instance identifiers.
 4. Measure end-to-end latency, queue time, provisioning, setup, execution, teardown, utilization, failure, retry, and orphan rates by pool and priority.
+   Under contention, verify that one repository uses no more than 75 percent
+   of slot, measured CPU, and measured memory capacity; without a competing
+   repository, verify that it may use the full fleet.
 5. Check support for every detected toolchain and package manager; classify unsupported-tool failures separately from project defects.
-6. Check log completeness, redaction, retention, clock alignment, and missing correlation fields.
+6. Check log completeness, redaction, retention, clock alignment, and missing
+   correlation fields. Distinguish the bounded pre-reconciliation account-only
+   window from intent records that remain unbound after authoritative queued
+   and already-running reconciliation.
 7. Separate confirmed faults, saturation, waste, and `NOT_PROVEN` gaps.
 
 ## Safety

skills/canonical/gds-drakkars-audit-workflow/SKILL.md

@@ -27,8 +27,13 @@ Audit one project's CI/CD behavior without reducing verification scope or mutati
 
 1. Inventory workflows, triggers, required checks, reusable calls, matrices, environments, artifacts, caches, and deployment gates.
 2. Map project languages, package managers, generated assets, security obligations, builds, tests, and release paths to actual jobs.
-3. Verify public Linux jobs use GitHub-hosted resources and private Linux jobs use the declared private fleet; keep macOS and Windows hosted unless private capacity is explicitly declared.
-4. Build the dependency graph and critical path. Find accidental serialization, duplicated setup, oversized matrices, unsafe cache keys, and missing cancellation semantics.
+3. Verify public Linux jobs use GitHub-hosted resources and private Linux jobs
+   use the declared private fleet, including private repositories in free
+   organizations; keep macOS and Windows hosted unless private capacity is
+   explicitly declared.
+4. Build the dependency graph and critical path. Find accidental serialization,
+   duplicated setup and security placements, oversized matrices, unsafe cache
+   keys, and concurrency groups that can discard queued or running evidence.
 5. Verify least-privilege permissions, pinning, secret isolation, fork safety, timeouts, concurrency, retry ownership, logs, telemetry, and artifact retention.
 6. Report missing coverage separately from speed opportunities.
 

skills/canonical/gds-drakkars-onboard-project/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-drakkars-onboard-project
-description: Use this skill only when the owner explicitly asks to connect one repository to Drakkars and the reusable CI system. Inventory its technologies, classify visibility, add the correct runner policy and complete checks, canary them, and record estate evidence. Do not use it for multi-repository migration or interrupting existing runs.
-disable-model-invocation: true
+description: Use this skill only when the owner explicitly asks to connect one repository to Drakkars and the reusable CI system. Inventory its technologies, classify visibility, add the correct runner policy and complete checks, prove them on the repository's real jobs, and record estate evidence. Do not use it for multi-repository migration or interrupting existing runs.
 ---
 
 # Contract
@@ -31,20 +30,27 @@ Onboard one project with complete CI coverage and no unsupported-tool surprises.
 3. Select public reusable workflow capabilities and keep private repository/priority/runner mappings in the estate overlay.
 4. Add deterministic setup, validation, logs, telemetry, timeouts, fork safety, and artifacts for failures.
 5. Validate workflow syntax and policy locally.
-6. Roll out one non-destructive canary while existing labels and jobs remain available.
-7. Promote only after required checks and telemetry are complete; journal the exact commits and runtime evidence.
+6. Let the repository's ordinary PR or push create the acceptance jobs. Do not
+   dispatch synthetic, benchmark, soak, canary, rerun, or empty-commit traffic
+   solely to qualify the path.
+7. Promote only after those real required checks and their telemetry are
+   complete; journal the exact commits and runtime evidence.
 
 ## Stop conditions
 
-Stop on missing credentials, unknown visibility, unsupported required technology, or a canary regression. Never terminate an existing run to make room.
+Stop on missing credentials, unknown visibility, unsupported required
+technology, or a regression in real project jobs. Never cancel, supersede,
+manually rerun, or terminate an existing run to make room.
 
 ## Output
 
-Return inventory, runner mapping, coverage map, canary result, evidence locations, rollback path, and remaining gaps.
+Return inventory, runner mapping, coverage map, real-job result, evidence
+locations, rollback path, and remaining gaps.
 
 ## Verification
 
-Prove technology coverage, visibility-to-runner mapping, green canary, unchanged active jobs, and rollback evidence.
+Prove technology coverage, visibility-to-runner mapping, green real project
+jobs, unchanged active jobs, and rollback evidence.
 
 ## References
 

skills/canonical/gds-drakkars-optimize-workflow/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-drakkars-optimize-workflow
 description: Use this skill only when the owner explicitly asks to change a project's GitHub Actions for lower end-to-end latency while preserving or increasing coverage, stability, logs, and telemetry. Implement within one repository, verify locally, and prepare measured rollout evidence. Do not use it for fleet infrastructure changes or job cancellation.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-drakkars-rollout-consumer/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-drakkars-rollout-consumer
-description: Use this skill only for an explicitly approved rollout of a fleet label, public workflow version, or runner behavior to selected consumers. Use phased coexistence, canaries, drain evidence, rollback checkpoints, and exact commit pins. Do not use it when active jobs would be cancelled or old capacity removed early.
-disable-model-invocation: true
+description: Use this skill only for an explicitly approved rollout of a fleet label, public workflow version, or runner behavior to selected consumers. Use phased coexistence, evidence from real consumer jobs, drain evidence, rollback checkpoints, and exact commit pins. Do not use it when active jobs would be cancelled or old capacity removed early.
 ---
 
 # Contract
@@ -29,23 +28,28 @@ Change consumers without losing work or creating an unserviceable label window.
 1. Resolve every affected Git and provider boundary and capture current exact state.
 2. Verify the public product commit with hosted checks, then pin it in the private estate.
 3. Create new capacity disabled; validate identity, image, labels, limits, and compatibility.
-4. Enable the new path and run representative canaries before changing consumers.
+4. Enable the new path without removing the old one. Qualify it only through
+   ordinary real jobs created by the selected consumers; never create
+   synthetic, benchmark, soak, canary, rerun, or empty-commit traffic.
 5. Move consumers in bounded waves while old and new paths coexist.
 6. Observe queue, failures, retries, provisioning, teardown, and end-to-end latency after each wave.
 7. Disable the old path only when its queued and running intent count is zero. Remove it only after a further verified drain window.
 8. Record immutable evidence and preserve a tested rollback checkpoint.
 
 ## Stop conditions
 
-Stop on active old-path jobs, missing telemetry, canary regression, configuration mismatch, or rollback uncertainty.
+Stop on active old-path jobs, missing telemetry, a regression in real consumer
+jobs, configuration mismatch, or rollback uncertainty.
 
 ## Output
 
-Return phase, exact identities, canary evidence, drain proof, rollback path, and next safe action.
+Return phase, exact identities, real-job evidence, drain proof, rollback path,
+and next safe action.
 
 ## Verification
 
-Prove exact identities, green canaries, no lost jobs, zero-active drain, immutable evidence, and rollback.
+Prove exact identities, green real consumer jobs, no lost jobs, zero-active
+drain, immutable evidence, and rollback.
 
 ## References
 

skills/canonical/gds-handoff-work/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-handoff-work
 description: Use this skill only when the owner wants to preserve unfinished work for another device or session. Plan an exact checkpoint commit, push the task branch, and create or update a draft pull request when policy requires it. Do not use it to merge, complete, synchronize main, or clean branches and worktrees.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-maintain-agent-system/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-maintain-agent-system
 description: "Use this skill only when the owner explicitly asks to update the GDS agent operating system itself: current source facts, capability profiles, canonical AGENTS templates, skills, schemas, generators, hooks, or policies. Validate, release immutably, and prepare canary rollout. Do not use it for ordinary repository feature work."
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-manage-fork/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-manage-fork
 description: Use this skill only when the owner explicitly asks to create, inspect, synchronize, rehome, detach, freeze, archive, or otherwise change a fork lifecycle. Preserve fork-specific commits and upstream identity; force is never the default. Do not use it for ordinary source repositories or generic branch synchronization.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-manage-harness/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-manage-harness
 description: Use this skill only when the owner explicitly asks to add, update, verify, migrate, or retire an agent harness adapter in GDS. Research current official behavior, update one capability profile and generated projections, and prove runtime discovery. Do not use it to change a user's global harness configuration silently.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-manage-module/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-manage-module
 description: Use this skill only when the owner explicitly asks to add, replace, reclassify, or remove a module relationship for a project. Validate independent Git boundaries, typed relationships, .gitmodules or package metadata, visibility, and pin policy. Do not use it for ordinary code changes inside an existing module.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-manage-repository/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-manage-repository
 description: Use this skill only when the owner explicitly asks to create, onboard, rename, transfer, archive, rehome, or otherwise change the lifecycle of a Git repository under GDS. Preserve stable identity and plan every provider and local mutation. Do not use it for source-code work or repository deletion hidden as removal.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-materialize-workspace/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-materialize-workspace
 description: Use this skill only when the owner explicitly asks to clone or materialize a selected repository set on a device. Resolve selectors, local roots, clone modes, submodules, and resource limits before applying. Do not use it to clone the whole estate by default or synchronize existing checkouts.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-migrate-schema/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-migrate-schema
 description: Use this skill only when the owner explicitly asks to migrate GDS manifests, state, policies, plans, or projections between schema versions. Rehearse a reversible migration on fixtures and canaries before approved apply. Do not use it for ordinary data edits or cosmetic format changes.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-onboard-repository/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-onboard-repository
 description: Use this skill only when the owner explicitly asks to add a brand-new repository to the GDS estate end to end. Walk the full onboarding sequence from provider creation through anchor, selector classification, device materialization, and projection regeneration. Do not use it for lifecycle changes to an existing repository; use gds-manage-repository instead.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-reconcile-provider-change/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-reconcile-provider-change
 description: Use this skill only when the owner explicitly asks to reconcile the estate after a provider-side change to a repository, such as an owner-login case drift, a rename, a transfer, or an archive. Re-snapshot observed inventory, fix provider strings and anchors, re-resolve selectors, and regenerate projections. Do not use it to classify drift without fixing it; use gds-triage-estate-drift for read-only triage.
-disable-model-invocation: true
 ---
 
 # Contract

skills/canonical/gds-recover-operation/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: gds-recover-operation
 description: Use this skill only when the owner explicitly asks to inspect and resume, abort, or compensate an interrupted GDS operation or stale lock. Reconstruct state from the durable journal and current evidence before any action. Do not use it to conceal partial completion or perform a generic rollback.
-disable-model-invocation: true
 ---
 
 # Contract