diff --git a/.agents/skills/python-codestyle/SKILL.md b/.agents/skills/python-codestyle/SKILL.md
index d48241ba..210a67b7 100644
--- a/.agents/skills/python-codestyle/SKILL.md
+++ b/.agents/skills/python-codestyle/SKILL.md
@@ -92,15 +92,16 @@ repo's type checker: `uv run pyright`, or `uv run mypy src` where mypy is the CI
 where the repo runs both (see Type checking above). Run it, plus `uv run pytest`, before
 committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest`
 equivalents, per Two Profiles above, and has no such command to run before committing beyond
-those. These are documented commands, and a VS Code tasks mirror carried per the fleet baseline
-(every command-executing task `type: process`, the aggregators dependsOn-only, no `&&` shell
-chaining, so it runs the same on any task shell) is in the hub `vscode-tasks-python.json` snippet.
-CI runs the same clean-compile commands as the authoritative backstop. The Python mechanism for a
-local hook is the `pre-commit` framework, wired from the canonical `catalog/snippets/pre-commit/`
-directory, hub-local and not carried into every fleet repo. That directory's own README names the
-second file to copy alongside the config. GOVERNANCE.md's hub-only "Running the Linters Locally
-(Known-Working Invocations)" section carries the obligation itself, what the hook must cover, its
-audit treatment, and the per-clone enablement steps.
+those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries the
+VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is
+`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror
+runs the same on any task shell. CI runs the same clean-compile commands as the authoritative
+backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the
+canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet
+repo. That directory's own README names the second file to copy alongside the config.
+GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section carries
+the obligation itself, what the hook must cover, its audit treatment, and the per-clone enablement
+steps.
 
 A restricted executor gives each task a cache directory under a writable temporary root. Point
 `UV_CACHE_DIR`, `RUFF_CACHE_DIR`, `MYPY_CACHE_DIR`, and `COVERAGE_FILE` into that directory before
diff --git a/.agents/skills/workflow-ci-contract/SKILL.md b/.agents/skills/workflow-ci-contract/SKILL.md
index b5b4973d..9eaf908f 100644
--- a/.agents/skills/workflow-ci-contract/SKILL.md
+++ b/.agents/skills/workflow-ci-contract/SKILL.md
@@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer
 
 ## After Any Workflow Edit
 
-Workflow-only changes are not smoke-built, so run actionlint locally (via the hub-hosted `scripts/docker_lint.py` wrapper, run from the repository being checked as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, actionlint invoking `shellcheck` on `run:` blocks, which the wrapper's image provides, and documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section) before pushing, and remember a workflow change is only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run.
+Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run.
diff --git a/.claude-plugin/fleet-skills/.source-digest b/.claude-plugin/fleet-skills/.source-digest
index b2cf00c4..008f19b6 100644
--- a/.claude-plugin/fleet-skills/.source-digest
+++ b/.claude-plugin/fleet-skills/.source-digest
@@ -1 +1 @@
-2a5718c1f6bca556
+fe834763b58313f7
diff --git a/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md b/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md
index d48241ba..210a67b7 100644
--- a/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md
+++ b/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md
@@ -92,15 +92,16 @@ repo's type checker: `uv run pyright`, or `uv run mypy src` where mypy is the CI
 where the repo runs both (see Type checking above). Run it, plus `uv run pytest`, before
 committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest`
 equivalents, per Two Profiles above, and has no such command to run before committing beyond
-those. These are documented commands, and a VS Code tasks mirror carried per the fleet baseline
-(every command-executing task `type: process`, the aggregators dependsOn-only, no `&&` shell
-chaining, so it runs the same on any task shell) is in the hub `vscode-tasks-python.json` snippet.
-CI runs the same clean-compile commands as the authoritative backstop. The Python mechanism for a
-local hook is the `pre-commit` framework, wired from the canonical `catalog/snippets/pre-commit/`
-directory, hub-local and not carried into every fleet repo. That directory's own README names the
-second file to copy alongside the config. GOVERNANCE.md's hub-only "Running the Linters Locally
-(Known-Working Invocations)" section carries the obligation itself, what the hook must cover, its
-audit treatment, and the per-clone enablement steps.
+those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries the
+VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is
+`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror
+runs the same on any task shell. CI runs the same clean-compile commands as the authoritative
+backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the
+canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet
+repo. That directory's own README names the second file to copy alongside the config.
+GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section carries
+the obligation itself, what the hook must cover, its audit treatment, and the per-clone enablement
+steps.
 
 A restricted executor gives each task a cache directory under a writable temporary root. Point
 `UV_CACHE_DIR`, `RUFF_CACHE_DIR`, `MYPY_CACHE_DIR`, and `COVERAGE_FILE` into that directory before
diff --git a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md
index b5b4973d..9eaf908f 100644
--- a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md
+++ b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md
@@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer
 
 ## After Any Workflow Edit
 
-Workflow-only changes are not smoke-built, so run actionlint locally (via the hub-hosted `scripts/docker_lint.py` wrapper, run from the repository being checked as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, actionlint invoking `shellcheck` on `run:` blocks, which the wrapper's image provides, and documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section) before pushing, and remember a workflow change is only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run.
+Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run.
diff --git a/.github/skills/python-codestyle/SKILL.md b/.github/skills/python-codestyle/SKILL.md
index d48241ba..210a67b7 100644
--- a/.github/skills/python-codestyle/SKILL.md
+++ b/.github/skills/python-codestyle/SKILL.md
@@ -92,15 +92,16 @@ repo's type checker: `uv run pyright`, or `uv run mypy src` where mypy is the CI
 where the repo runs both (see Type checking above). Run it, plus `uv run pytest`, before
 committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest`
 equivalents, per Two Profiles above, and has no such command to run before committing beyond
-those. These are documented commands, and a VS Code tasks mirror carried per the fleet baseline
-(every command-executing task `type: process`, the aggregators dependsOn-only, no `&&` shell
-chaining, so it runs the same on any task shell) is in the hub `vscode-tasks-python.json` snippet.
-CI runs the same clean-compile commands as the authoritative backstop. The Python mechanism for a
-local hook is the `pre-commit` framework, wired from the canonical `catalog/snippets/pre-commit/`
-directory, hub-local and not carried into every fleet repo. That directory's own README names the
-second file to copy alongside the config. GOVERNANCE.md's hub-only "Running the Linters Locally
-(Known-Working Invocations)" section carries the obligation itself, what the hook must cover, its
-audit treatment, and the per-clone enablement steps.
+those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries the
+VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is
+`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror
+runs the same on any task shell. CI runs the same clean-compile commands as the authoritative
+backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the
+canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet
+repo. That directory's own README names the second file to copy alongside the config.
+GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section carries
+the obligation itself, what the hook must cover, its audit treatment, and the per-clone enablement
+steps.
 
 A restricted executor gives each task a cache directory under a writable temporary root. Point
 `UV_CACHE_DIR`, `RUFF_CACHE_DIR`, `MYPY_CACHE_DIR`, and `COVERAGE_FILE` into that directory before
diff --git a/.github/skills/workflow-ci-contract/SKILL.md b/.github/skills/workflow-ci-contract/SKILL.md
index b5b4973d..9eaf908f 100644
--- a/.github/skills/workflow-ci-contract/SKILL.md
+++ b/.github/skills/workflow-ci-contract/SKILL.md
@@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer
 
 ## After Any Workflow Edit
 
-Workflow-only changes are not smoke-built, so run actionlint locally (via the hub-hosted `scripts/docker_lint.py` wrapper, run from the repository being checked as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, actionlint invoking `shellcheck` on `run:` blocks, which the wrapper's image provides, and documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section) before pushing, and remember a workflow change is only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run.
+Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run.
diff --git a/reports/canonical-review.json b/reports/canonical-review.json
index fd052ed2..cb008295 100644
--- a/reports/canonical-review.json
+++ b/reports/canonical-review.json
@@ -163,11 +163,11 @@
     },
     {
       "unit": ".agents/skills/python-codestyle/SKILL.md > Local development loop",
-      "digest": "sha256:3c48ebba48fbcbdfd018881ae77fcc89396b0989999ba4c339444c86d8e378b5",
+      "digest": "sha256:6f1081d1c1cf0f719f9c154c0b5652a26c7c1f6d2478adc3717becb248a61458",
       "reviewer": "agent-skill",
-      "findings": 3,
-      "hubCommit": "a76dda7d67033f43c260d21e3ae6a291e1869c0a",
-      "stamp": "2026-09-01T06:46:39Z"
+      "findings": 1,
+      "hubCommit": "5664a954bf0c11acb6bab9014b0463697d18da4b",
+      "stamp": "2026-09-01T23:19:53Z"
     },
     {
       "unit": ".agents/skills/repo-worktree/SKILL.md > Creating a Worktree",
@@ -211,11 +211,11 @@
     },
     {
       "unit": ".agents/skills/workflow-ci-contract/SKILL.md > After Any Workflow Edit",
-      "digest": "sha256:c7078ad8a7867aaad6ee740e3208aad3d8b45a7c22f76c4b6a91fcb5bf11fa36",
+      "digest": "sha256:7dc31b8f1e7e25effd4b85078f9099b89cf3663452ed0400cf255df019fbef0e",
       "reviewer": "agent-skill",
-      "findings": 0,
-      "hubCommit": "6b3271c03c1a0dcdb71fd2ad0447ba2b4a1cd04c",
-      "stamp": "2026-09-01T15:41:23Z"
+      "findings": 1,
+      "hubCommit": "f858a194ce29fa5702e2ce1c6ff8d1f3b221b2ee",
+      "stamp": "2026-09-01T23:24:57Z"
     },
     {
       "unit": ".agents/skills/workflow-ci-contract/SKILL.md > How the Contract Is Read",