Make Cloud instructions current and harden environment setup

.agents/skills/prompt-perfector/references/repository-workflow.md

@@ -61,10 +61,21 @@ if ($LASTEXITCODE -ne 0) { throw 'Repository isolation verification failed.' }
 
 ### Codex Cloud checkout
 
-Codex Cloud does not have the Windows bootstrap. It may use its single disposable checkout as the primary Git worktree only when `CODEX_CLOUD=1`, the checkout is clean, and it is on a task-specific non-protected branch. Create a branch before verification if the supplied checkout is detached or protected.
+Use this mode when current host or task metadata establishes a disposable Cloud task checkout.
+`--cloud` selects that workflow; it alone does not satisfy the host-evidence guard. The CLI recognises
+`CODEX_CLOUD=1` or `CLAUDE_CODE_REMOTE=true` as workflow hints, not proof of platform isolation.
+Without either hint, pass `--cloud-host-attested` only after current task metadata establishes the
+disposable Cloud checkout. The legacy `CODEX_CLOUD=1` marker is neither required nor sufficient.
+Do not invent another host variable or install the legacy setup to satisfy this guard.
+
+The verifier binds the choice to the expected repository, branch and `HEAD`, and permits a primary
+checkout only when it is the sole registered worktree, clean, and on a task-specific non-protected
+branch. Create a branch before verification if the supplied checkout is detached or protected.
+Without host evidence or a supported metadata attestation, use the applicable local worktree workflow.
+The example below assumes current task metadata has established the disposable Cloud checkout;
+omit `--cloud-host-attested` when relying on one of the recognised host hints instead.
 
 ```bash
-test "${CODEX_CLOUD:-}" = "1" || { echo 'CODEX_CLOUD=1 is required.' >&2; exit 1; }
 test -z "$(git status --porcelain --untracked-files=all)" || { echo 'Cloud checkout is dirty.' >&2; exit 1; }
 branch="$(git branch --show-current)"
 case "$branch" in
@@ -76,14 +87,14 @@ esac
 repo="$(git rev-parse --show-toplevel)"
 head="$(git rev-parse HEAD)"
 node .agents/skills/prompt-perfector/scripts/verify-repository-isolation.mjs \
-  --cloud --expected-repo "$repo" --expected-branch "$branch" --expected-head "$head"
+  --cloud --cloud-host-attested --expected-repo "$repo" --expected-branch "$branch" --expected-head "$head"
 ```
 
 4. Proceed only when the verifier emits `SAFE_TO_EDIT=true` and `PRECHECK_RESULT=SAFE`.
 5. Re-run the verifier immediately before editing. If any condition is unproved or changes unexpectedly, stop and request direction.
-6. For a same-task dirty continuation, first run the verifier without `--allow-dirty`, inventory every changed path, and record the emitted `SAFE_STATUS_HASH`. Re-run with `--allow-dirty --expected-status-hash <hash>` plus the same expected repo, branch, and `HEAD` values. Include `--cloud` in Cloud.
+6. For a same-task dirty continuation, first run the verifier without `--allow-dirty`, inventory every changed path, and record the emitted `SAFE_STATUS_HASH`. Re-run with `--allow-dirty --expected-status-hash <hash>` plus the same expected repo, branch, and `HEAD` values. Include `--cloud` in Cloud and retain the same established host evidence or metadata-backed `--cloud-host-attested` flag.
 
-The verifier is read-only and establishes workflow isolation; it does not provide an OS-level sandbox or protection from unrelated processes. State that limit honestly.
+The verifier is read-only and establishes workflow isolation; it does not provide an OS-level sandbox or protection from unrelated processes. `--cloud` does not detect or prove platform isolation, provider authorization or readiness of the legacy bootstrap. State those limits honestly.
 
 ## Execution and verification
 

.agents/skills/prompt-perfector/scripts/verify-repository-isolation.mjs

@@ -23,11 +23,12 @@ function normalizePath(value) {
 }
 
 function parseArguments(argv) {
-  const options = { allowDirty: false, cloud: false, selfTest: false };
+  const options = { allowDirty: false, cloud: false, cloudHostAttested: false, selfTest: false };
   for (let index = 0; index < argv.length; index += 1) {
     const argument = argv[index];
     if (argument === "--allow-dirty") options.allowDirty = true;
     else if (argument === "--cloud") options.cloud = true;
+    else if (argument === "--cloud-host-attested") options.cloudHostAttested = true;
     else if (argument === "--self-test") options.selfTest = true;
     else if (["--expected-repo", "--expected-branch", "--expected-head", "--expected-status-hash"].includes(argument)) {
       const value = argv[index + 1];
@@ -65,16 +66,16 @@ export function evaluateRepositoryState(state, options = {}) {
   const currentIndex = state.worktrees.findIndex(
     (worktree) => normalizePath(String(worktree.worktree)) === currentPath,
   );
-  const cloudEnvironment = options.cloudEnvironment ?? false;
+  const cloudEnvironment = options.cloudEnvironment === true || options.cloudHostAttested === true;
 
   if (!path.isAbsolute(state.root)) reasons.push("repository_path_not_absolute");
   if (!state.branch) reasons.push("detached_head");
   else if (protectedBranch(state.branch)) reasons.push("protected_branch");
   if (currentIndex < 0) reasons.push("unregistered_worktree");
   else if (currentIndex === 0 && !options.cloud) reasons.push("primary_worktree");
+  else if (currentIndex === 0 && options.cloud && !cloudEnvironment) reasons.push("cloud_environment_required");
   else if (currentIndex === 0 && options.cloud && state.worktrees.length !== 1)
     reasons.push("cloud_primary_requires_single_worktree");
-  if (options.cloud && !cloudEnvironment) reasons.push("cloud_environment_required");
   if (state.operations.length) reasons.push("git_operation_in_progress");
   if (options.expectedRepo && normalizePath(options.expectedRepo) !== currentPath) reasons.push("repository_drift");
   if (options.expectedBranch && options.expectedBranch !== state.branch) reasons.push("branch_drift");
@@ -198,12 +199,54 @@ function runSelfTest() {
     ["safe secondary worktree", base, expected, true, ""],
     ["safe Cloud primary", cloudBase, cloudExpected, true, ""],
     [
-      "Cloud flag without environment",
+      "attested Cloud primary without host marker",
+      cloudBase,
+      { ...cloudExpected, cloudEnvironment: false, cloudHostAttested: true },
+      true,
+      "",
+    ],
+    [
+      "Cloud primary missing host evidence and attestation",
+      cloudBase,
+      { ...expected, expectedRepo: cloudBase.root, cloud: true },
+      false,
+      "cloud_environment_required",
+    ],
+    [
+      "Cloud attestation without explicit mode",
+      cloudBase,
+      { ...cloudExpected, cloud: false, cloudEnvironment: false, cloudHostAttested: true },
+      false,
+      "primary_worktree",
+    ],
+    [
+      "Cloud primary without host signal",
       cloudBase,
       { ...cloudExpected, cloudEnvironment: false },
       false,
       "cloud_environment_required",
     ],
+    ["Cloud primary without explicit mode", cloudBase, { ...cloudExpected, cloud: false }, false, "primary_worktree"],
+    ...["expectedRepo", "expectedBranch", "expectedHead"].map((key) => [
+      `Cloud missing ${key}`,
+      cloudBase,
+      { ...cloudExpected, [key]: undefined },
+      false,
+      "expected_state_required",
+    ]),
+    ["Cloud repository drift", cloudBase, { ...cloudExpected, expectedRepo: "/other" }, false, "repository_drift"],
+    ["Cloud branch drift", cloudBase, { ...cloudExpected, expectedBranch: "codex/other" }, false, "branch_drift"],
+    ["Cloud HEAD drift", cloudBase, { ...cloudExpected, expectedHead: "b".repeat(40) }, false, "head_drift"],
+    ["Cloud protected branch", { ...cloudBase, branch: "main" }, cloudExpected, false, "protected_branch"],
+    ["Cloud detached HEAD", { ...cloudBase, branch: "" }, cloudExpected, false, "detached_head"],
+    ["Cloud dirty default", { ...cloudBase, status: dirtyStatus }, cloudExpected, false, "dirty_worktree"],
+    [
+      "Cloud dirty content drift",
+      { ...cloudBase, status: dirtyStatus, statusHash: changedContentHash },
+      { ...cloudExpected, allowDirty: true, expectedStatusHash: dirtyHash },
+      false,
+      "status_drift",
+    ],
     [
       "Cloud primary with sibling worktree",
       { ...cloudBase, worktrees: [{ worktree: cloudBase.root }, { worktree: "/workspace/other" }] },
@@ -246,6 +289,9 @@ function runSelfTest() {
     if (result.reason !== expectedReason)
       throw new Error(`${name}: expected reason=${expectedReason}, got ${result.reason}`);
   }
+  if (!parseArguments(["--cloud-host-attested"]).cloudHostAttested) {
+    throw new Error("explicit host attestation argument was not recognised");
+  }
   console.log(`prompt-perfector isolation self-test passed: ${cases.length}/${cases.length}`);
 }
 
@@ -267,8 +313,9 @@ function main() {
     const options = parseArguments(process.argv.slice(2));
     if (options.selfTest) runSelfTest();
     else {
-      options.cloudEnvironment = process.env.CODEX_CLOUD === "1";
       const state = inspectRepository(process.cwd());
+      // Host markers are workflow hints, not proof of platform isolation.
+      options.cloudEnvironment = process.env.CODEX_CLOUD === "1" || process.env.CLAUDE_CODE_REMOTE === "true";
       const result = evaluateRepositoryState(state, options);
       emit(result, state, options);
       if (!result.safe) process.exitCode = 1;

.agents/skills/rag-cloud-sdd/SKILL.md

@@ -5,14 +5,24 @@ description: Execute one RAG Cloud phase with fresh agents, adaptive effort, imm
 
 # RAG Cloud SDD
 
-Read the generated package and root `AGENTS.md`.
+Read `AGENTS.md`, canonical Cloud policy and generated package. Keep execution provider-free;
+legacy setup applies only when explicitly selected.
 
-1. Require `TARGET_PHASE` before inspection. Run either `node scripts/rag-phase-launch-check.mjs --target "$TARGET_PHASE" --effort high` or `node scripts/rag-phase-launch-check.mjs --target "$TARGET_PHASE" --effort xhigh`.
-2. Prove controller routing with the route-evidence schema. Hash this skill, helpers and phase skills. Dispatch the manifest-routed read-only probe; bind its ID and direct dispatch record. Stop on unverified route, runtime or capability.
-3. Scan the plan, receipts, relevant code, and worktrees for conflicts. Preserve unrelated or quarantined work.
-4. Record `TASK_BASE`; generate the brief; dispatch a fresh implementer; require proof, self-review and defined completion status.
-5. Commit only owned implementation. Build the full `TASK_BASE..TASK_HEAD` package. Dispatch one distinct fresh reviewer for separate specification and quality verdicts.
-6. Return Critical/Important findings to the implementer and repeat full-range review. Carry Minor findings in the ledger. Serialize writers.
-7. Dispatch a distinct phase reviewer over `PHASE_START..PHASE_END`. Bind every agent ID to authoritative route metadata. Atomically commit the accepted receipt/evidence, validate, push only when authorized, and stop.
+1. Require `TARGET_PHASE` before substantive inspection. Confirm selected effort in ordinary language; no prompt token or
+   resubmission. Run `scripts/rag-phase-launch-check.mjs` with target/effort; declared inputs
+   aren't runtime proof.
+2. Require authoritative route evidence. Hash controller/helpers/phase skills; bind the manifest-routed fresh read-only
+   probe's source/receipt inspection and dispatch metadata. Stop on unverified routes/capabilities.
+3. Check plan, receipts, relevant code and worktree conflicts; preserve unrelated/quarantined work.
+4. Record `TASK_BASE`; generate the brief; dispatch one fresh implementer; require decisive proof,
+   self-review and completion status.
+5. Commit only authorised task files. Review the entire `TASK_BASE..TASK_HEAD` range with a distinct
+   reviewer returning separate specification and quality verdicts.
+6. Return Critical/Important findings to the implementer; re-review the full range. Record Minor findings
+   in the ledger. Serialize writers.
+7. Require distinct phase review across `PHASE_START..PHASE_END`. Bind every agent ID to authoritative
+   route metadata and atomically commit accepted receipts/evidence. Validate; push only when authorised; stop.
 
-P17 adds a fresh Sol/xhigh whole-programme review and a separately authorized add-only atomic `PROGRAMME.json` commit. Local connected work uses L00–L10 and never rewrites Cloud receipts. Repository authority always overrides branch-finishing defaults.
+P17 requires fresh independent Sol/xhigh whole-programme review and its separately authorised add-only
+atomic `PROGRAMME.json` commit. Repository authority overrides branch-finishing defaults.
+Local L00–L10 keep separate approvals and never rewrite accepted Cloud receipts.

.claude/agents/rag-retrieval-reviewer.md

@@ -27,20 +27,49 @@ Follow `AGENTS.md` review throttling and `docs/codex-review-protocol.md` before
 
 ## Review Checklist
 
-### 1. Local-eval trap — diagnose config before touching code
+### 1. Diagnose the actual environment and harness
 
-- **Degraded local output is usually not a code bug.** Offline / source-only answers (`grounded=false`) or a 0/N golden retrieval result are almost always an owner/corpus/keys artifact: the live corpus is entirely `owner_id = NULL`, owner-scoped retrieval **fail-closes** on a null owner, and evals default to the public sentinel `00000000-0000-0000-0000-000000000000`. Diagnose owner/corpus/keys first.
-- **Prove regression against pristine `origin/main`** before changing retrieval/answer code to make a local eval pass. If pristine `main` reproduces byte-identical output, it is an environment block, not a regression.
-- **Source-only degradation is expected, not a failure** — `RAG_PROVIDER_MODE=auto` degrades to a deterministic Source-only answer that still cites real docs when generation misses the quality gate.
+- Separate intended source-only/offline degradation from a regression using the current
+  `src/lib/env.ts`, provider route, eval harness, fixtures and applicable RAG behaviour docs.
+  Earlier sessions reported null-owner corpora and public-sentinel eval defaults; those are
+  dated observations, not current corpus facts. Do not query live rows or inspect keys to
+  validate them. Use permitted offline evidence and report any remaining capability gap.
+- Compare the affected behaviour with an appropriate unchanged baseline before attributing
+  a failure to this diff. Record the exact revision, inputs and environment. A failure that
+  reproduces on the baseline is pre-existing; it may still be a real bug requiring separate
+  work and must not automatically be dismissed as an environment problem.
+- Confirm the current conservative fallback contract in source and tests. A source-only
+  answer can be expected degradation, but fabricated grounding, lost citations or unsupported
+  claims remain defects even when provider generation is unavailable.
 
-### 2. Token budget & reasoning-effort starvation (gpt-5.5)
+### 2. Provider effort, token budgets and failure evidence
 
-- **Never raise strong reasoning effort to `high`.** On gpt-5.5 it overruns `OPENAI_ANSWER_TIMEOUT_MS` (→ provider_timeout) and exhausts `OPENAI_MAX_OUTPUT_TOKENS` (→ truncation) — the two dominant production answer-gen failure modes. `medium` is ample.
-- **Effort is only lowered, never raised.** `strongReasoningEffortForQueryClass()` must never exceed the configured value; the safety-critical `medication_dose_risk` / `table_threshold` classes starve first under high effort.
-- Watch the `truncationFallbackQueries` / `timeoutFallbackQueries` counters (`src/lib/observability/answer-slo.ts`) for the fallback signature.
+- Derive the application model IDs, configured effort, supported provider controls, deadlines
+  and output budgets from the current runtime owners and tests. Historical gpt-5.5 timeout
+  and truncation findings are useful failure examples, not a universal model/effort rule or
+  proof that `medium` fits every current route.
+- Preserve the query-class effort clamp: `strongReasoningEffortForQueryClass()` must not
+  exceed the configured value. Review safety-critical `medication_dose_risk` and
+  `table_threshold` cases for starvation, timeouts and truncation. A provider-effort change
+  needs the applicable evidence and approval; this review does not authorise it.
+- Inspect current SLO counter definitions and existing authorised evidence for timeout and
+  truncation signatures. Do not infer current performance from an old counter name or case
+  count, or run provider-backed experiments without approval. The application provider model
+  is separate from the user's main-chat selection.
 
-### 3. No re-index / retrieval change without a real golden miss
+### 3. Retrieval changes retain measured benefit and non-regression safeguards
 
-- A retrieval/ranking/selection/chunking/scoring change requires a **real golden miss proving a gain**; `eval:retrieval:quality` (36/36) must _improve_, not merely not-regress. Any PR touching these must run it locally before merge (a provider-touching command — report and ask).
+- Follow `AGENTS.md` RAG ranking protection and `docs/rag-behaviour/` before reviewing protected
+  changes. Derive the golden population and metric definitions from the current harness and
+  fixtures; the historical 36-case figure is not a universal current count.
+- Require evidence for the claimed retrieval benefit rather than changing ranking to satisfy
+  a misleading local eval. A retrieval/ranking/ordering behaviour change requires the root
+  policy's explicitly approved live eval-canary before/after pair: document/content recall
+  pinned at 1.0 and zero per-case reciprocal-rank regressions. A regression requires the
+  documented immediate revert and confirmation run. Static or offline proof cannot replace
+  that live gate; provider calls and paid canaries remain confirmation-required.
+- Preserve the protected scoring, imputation and comparator contracts. Never apply tuner
+  recommendations or refuted ranking approaches without the measured evidence and authority
+  required by the RAG safeguards.
 - Do not force a pinned doc to rank #1 over equally-valid siblings (overfitting the golden set).
 - **Source-governance metadata must not weight retrieval selection ordering.**

.claude/cloud-profile/CLAUDE.md

@@ -1,5 +1,16 @@
 # How to talk to Josh
 
+These are communication preferences, subject to the current system, developer and user
+instructions and applicable project safeguards. Preserve decisive evidence and material
+uncertainty even when a brief reply is preferred. They grant no tool, memory, provider,
+publication or production authority.
+
+Installed skills are optional guidance for their actual task. Check current callable tools and
+supported arguments; copied descriptions do not establish model, command, plugin or connector
+availability. A missing generic skill or setup command does not block suitable authorised work.
+Use the current project's task record and policy instead of importing a skill's assumed tracker,
+old workstation state or startup ceremony.
+
 Josh is a psychiatrist, not a software engineer. The goal is that he finishes reading and
 knows exactly where things stand and what to do — with no jargon and nothing to decode.