fix(skills): align maintainer workflows with canonical policy

.agents/skills/nemoclaw-maintainer-cross-issue-sweep/SKILL.md

@@ -109,7 +109,7 @@ See `templates/report.md` for the format.
 
 ## Composition with other skills
 
-The pr-comparator (`nemoclaw-maintainer-pr-comparator`) calls this skill as a sub-step when comparing competing PRs. Adjacent-fix counts feed Tier 3 tiebreakers; contradicting hits factor into Tier 2 quality scoring.
+This skill is a separate, optional follow-up to `nemoclaw-maintainer-pr-comparator`. The comparator does not call it or include its findings in the deterministic score. Run the sweep explicitly when a maintainer wants adjacent-fix or contradiction evidence alongside the comparator verdict, and report that evidence separately.
 
 ## What this skill does NOT do (deferred)
 

.agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md

@@ -11,7 +11,7 @@ user_invocable: true
 
 Use the release scripts for normal release operations. Do not run raw `git tag`, `git push`, `gh api`, or version-bump commands by hand for the normal release flow.
 
-The release is one annotated semver tag on an already-merged `origin/main` commit. The GitHub workflow moves `latest`; release admins promote `lkg` manually after validation. After the tag is cut, finish version-label housekeeping for remaining open issues/PRs and draft release notes for the maintainer to post.
+The release is one annotated semver tag on an already-merged `origin/main` commit. The GitHub workflow moves `latest`; release admins promote `lkg` manually after validation. After the tag is cut, record remaining open issues/PRs as carry-forward work without automatically relabeling them, then draft release notes for the maintainer to post.
 
 ## Hard Rules
 
@@ -33,7 +33,7 @@ Release Progress:
 - [ ] Step 2: Show plan and exact confirmation phrase
 - [ ] Step 3: Cut the semver tag from the confirmed plan
 - [ ] Step 4: Wait for workflow-managed latest
-- [ ] Step 5: Housekeep remaining open issues/PRs
+- [ ] Step 5: Record remaining open issues/PRs
 - [ ] Step 6: Generate release-note data and draft Markdown
 - [ ] Step 7: Hand off announcement steps
 ```
@@ -108,25 +108,22 @@ The script waits until `vX.Y.Z^{}` and `latest^{}` both peel to the planned comm
 
 If it fails, report the failed workflow/status. Do not manually move `latest`.
 
-### Step 5: Housekeep Remaining Open Issues/PRs
+### Step 5: Record Remaining Open Issues/PRs
 
-Move any remaining open issues or PRs labeled with the released version to the next patch label:
-
-```bash
-node --experimental-strip-types --no-warnings .agents/skills/nemoclaw-maintainer-day/scripts/bump-stragglers.ts <released-version> <next-version>
-```
-
-Then verify the released version has no open stragglers:
+List remaining open issues and PRs carrying the released version:
 
 ```bash
 gh issue list --repo NVIDIA/NemoClaw --state open --label <released-version> --limit 100
 gh pr list --repo NVIDIA/NemoClaw --state open --label <released-version> --limit 100
 ```
 
+Open PRs remain active carry-forward work with their existing label by default. Do not replace the label merely because the tag was cut. Open issues use the label only for tracking or "needs PR" coordination and may keep or lose it through an explicit maintainer decision.
+
+Remove the released-version label only when the maintainer decides an item is deferred, superseded, closed, or leaving the daily release flow. Activation under a newer daily label is a separate decision; do not bulk-swap labels.
+
 Summarize:
 
-- shipped/closed items that remain associated with `<released-version>`;
-- open issues/PRs bumped to `<next-version>`;
+- open issues/PRs retained as carry-forward work;
 - any items that need manual maintainer attention.
 
 ### Step 6: Generate Release-Note Data and Draft Markdown
@@ -174,4 +171,4 @@ Return:
 - `latest` workflow fails or times out: report the workflow/status; do not move `latest` manually.
 - `latest` workflow rejects a rollback: keep `latest` unchanged, inspect the plan target commit, and regenerate the plan for the current `origin/main` tip if appropriate.
 - `lkg` changed: stop and escalate to a release admin.
-- Housekeeping finds open items that should still ship in the released version: stop and ask the maintainer whether to leave the label or bump them.
+- Carry-forward review finds an item that should leave the daily release flow: ask the maintainer before removing its label.

.agents/skills/nemoclaw-maintainer-day/MERGE-GATE.md

@@ -1,3 +1,6 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
 # Merge Gate Workflow
 
 Run the last maintainer check before approval. Never merge automatically.
@@ -6,11 +9,12 @@ Run the last maintainer check before approval. Never merge automatically.
 
 For the full priority list see [PR-REVIEW-PRIORITIES.md](PR-REVIEW-PRIORITIES.md). A PR is approval-ready only when **all** hard gates pass:
 
-1. **CI green** — all required checks in `statusCheckRollup`.
-2. **No conflicts** — `mergeStateStatus` clean.
-3. **No major CodeRabbit** — ignore style nits; block on correctness/security bugs.
-4. **PR Review Advisor: merge_as_is** — `check-gates.ts` checks this automatically. The gate passes only when the latest advisor comment has `recommendation: merge_as_is`. All other recommendation values — including `blocked`, `needs_rework`, `merge_after_fixes`, `superseded`, `info_only`, and any unknown value — fail the gate. The referenced Actions run is validated (name, event, head SHA, run attempt, timestamp) before the recommendation is trusted. Correctness, security, acceptance, and test-depth findings block until addressed or explicitly judged false-positive by a maintainer.
-5. **Risky code tested** — see [RISKY-AREAS.md](RISKY-AREAS.md). Confirm tests exist (added or pre-existing).
+1. **Contributor compliance** — the PR body contains the contributor's `Signed-off-by:` declaration and every PR commit appears as `Verified` in GitHub. Reject noncompliant PRs; maintainers do not repair contributor history.
+2. **CI green** — all required checks in `statusCheckRollup`.
+3. **No conflicts** — `mergeStateStatus` clean.
+4. **No major CodeRabbit** — ignore style nits; block on correctness/security bugs.
+5. **PR Review Advisor: merge_as_is** — `check-gates.ts` checks this automatically. The gate passes only when the latest advisor comment has `recommendation: merge_as_is`. All other recommendation values — including `blocked`, `needs_rework`, `merge_after_fixes`, `superseded`, `info_only`, and any unknown value — fail the gate. The referenced Actions run is validated (name, event, head SHA, run attempt, timestamp) before the recommendation is trusted. Correctness, security, acceptance, and test-depth findings block until addressed or explicitly judged false-positive by a maintainer.
+6. **Risky code tested** — see [RISKY-AREAS.md](RISKY-AREAS.md). Confirm tests exist (added or pre-existing).
 
 ## Step 1: Run the Gate Checker
 
@@ -25,6 +29,7 @@ This checks all gates programmatically and returns structured JSON with `allPass
 The script handles the deterministic checks. You handle judgment calls:
 
 - **Missing required checks:** The script verifies that `checks`, `commit-lint`, and `dco-check` are present in the status rollup. If any are missing, **workflows have not been triggered** — this happens on fork PRs from first-time contributors that need "Approve and run" clicked in the Actions tab. Go to the PR's Checks tab, approve the workflows, wait for all checks to complete, then re-run the gate checker. **Never approve a PR with missing checks.**
+- **Contributor compliance failed:** Reject the PR and ask the contributor to provide the PR-body DCO declaration or replace unverified commits with a clean verified history. Do not approve, merge, amend, sign, or force-push on the contributor's behalf.
 - **Conflicts (DIRTY):** Do NOT approve — GitHub invalidates approvals when new commits are pushed. Salvage first (rebase), wait for CI, then re-run the gate checker. Follow [SALVAGE-PR.md](SALVAGE-PR.md).
 - **CI failing but narrow:** Follow the salvage workflow in [SALVAGE-PR.md](SALVAGE-PR.md).
 - **CI pending:** Wait and re-check. Do not approve while checks are still running.

.agents/skills/nemoclaw-maintainer-day/PR-REVIEW-PRIORITIES.md

@@ -1,15 +1,19 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
 # PR Review Priorities
 
 Ordered list of what NemoClaw maintainers look for in a pull request. Higher items block approval; lower items inform queue ranking.
 
 ## Hard gates (all must pass to approve)
 
-1. **Security correctness** — no sandbox escape, SSRF, credential exposure, policy bypass, or installer trust violation. PRs touching risky areas (see [RISKY-AREAS.md](RISKY-AREAS.md)) get a deep security pass before anything else.
-2. **CI green** — all required checks in `statusCheckRollup` must pass.
-3. **No merge conflicts** — `mergeStateStatus` must be clean.
-4. **No unresolved major/critical CodeRabbit findings** — correctness and safety findings block; style nits do not. Use judgment on borderline cases.
-5. **No unresolved actionable PR Review Advisor findings** — correctness, security, acceptance-coverage, and test-depth findings block unless explicitly judged false-positive. Ask the user before acting on ambiguous or design-changing advice.
-6. **Tests for touched risky code** — risky areas must have test coverage, either added in the PR or pre-existing. No exceptions.
+1. **Contributor compliance** — the PR body has the contributor's DCO declaration and every commit appears as `Verified` in GitHub. Maintainers reject noncompliant PRs and do not repair contributor history.
+2. **Security correctness** — no sandbox escape, SSRF, credential exposure, policy bypass, or installer trust violation. PRs touching risky areas (see [RISKY-AREAS.md](RISKY-AREAS.md)) get a deep security pass before anything else.
+3. **CI green** — all required checks in `statusCheckRollup` must pass.
+4. **No merge conflicts** — `mergeStateStatus` must be clean.
+5. **No unresolved major/critical CodeRabbit findings** — correctness and safety findings block; style nits do not. Use judgment on borderline cases.
+6. **No unresolved actionable PR Review Advisor findings** — correctness, security, acceptance-coverage, and test-depth findings block unless explicitly judged false-positive. Ask the user before acting on ambiguous or design-changing advice.
+7. **Tests for touched risky code** — risky areas must have test coverage, either added in the PR or pre-existing. No exceptions.
 
 ## Quality expectations (block if violated, but fixable via salvage)
 
@@ -30,10 +34,10 @@ The team follows a daily ship cycle. All maintainer skills operate within this r
 
 1. **Morning** (`/nemoclaw-maintainer-morning`) — triage the backlog, pick items for the day, label them with the target version (e.g., `v0.0.8`).
 2. **During the day** (`/nemoclaw-maintainer-day`) — land PRs using the maintainer loop. Version labels make progress visible on dashboards.
-3. **Evening** (`/nemoclaw-maintainer-evening`) — check what shipped, bump open items to the next version (`v0.0.9`), generate a QA-focused summary, cut the tag, and prepare release notes for posting.
+3. **Evening** (`/nemoclaw-maintainer-evening`) — check what shipped, record open labeled PRs as carry-forward work, generate a QA-focused summary, cut the tag, and prepare release notes for posting.
 4. **Overnight** — QA team (different timezone) tests the tag. Any issues they file enter the next morning's triage like any other issue.
 
-Version labels are living markers: they always mean "ship in this version." If an item doesn't make the cut, the label moves to the next patch version.
+Version labels activate release work; they are not readiness claims. Open labeled PRs keep their existing label as carry-forward work until a maintainer explicitly removes it.
 
 ## Explicitly not priorities