chore(ci): promote staged validation hooks

.agents/commands/flext-law.md

@@ -1,9 +1,14 @@
 # FLEXT session router
 
-Read `.agents/skills/flext-context-routing/SKILL.md` first. It is the sole
-always-loaded FLEXT skill and selects the applicable entries from
-`surfaces.on_demand` in `.agents/provider.toml`.
+Compose these exact authorities in order:
 
-Load `.agents/skills/flext-law/SKILL.md` for FLEXT-law work and
-`.agents/skills/flext-inviolable-rules/SKILL.md` for governance. Do not eagerly
-load undeclared local surfaces.
+1. `~/.agents/skills/inviolable-rules/SKILL.md`
+2. `~/.agents/skills/make-check/SKILL.md`
+3. `.agents/skills/flext-context-routing/SKILL.md`
+4. `.agents/skills/flext-law/SKILL.md`
+5. `~/.agents/skills/verification-loop/SKILL.md` at each completion boundary
+
+The three global skills own generic execution governance. FLEXT owns the local
+`flext-law` domain delta. AI Hub may distribute these surfaces but may not
+redefine either owner. Fail closed when an exact path is missing; never resolve
+an identically named skill from another catalog or branch.

.agents/prompts/continuation-monopoly.md

@@ -12,7 +12,10 @@ Read, in order:
 2. `/home/marlonsc/.agents/UNIVERSAL_CORE.md`
 3. `/home/marlonsc/flext/AGENTS.md`
 4. `/home/marlonsc/flext/.agents/skills/flext-law/SKILL.md`
-5. `/home/marlonsc/flext/.agents/skills/flext-inviolable-rules/SKILL.md`
+5. `/home/marlonsc/.agents/skills/inviolable-rules/SKILL.md`
+6. `/home/marlonsc/.agents/skills/make-check/SKILL.md`
+7. `/home/marlonsc/.agents/skills/verification-loop/SKILL.md`
+<!-- Why: cutover to exact global generic skills after the local flext-inviolable-rules removal (mro-1o6t.1.1) -->
 
 ## Operating contract
 

.agents/provider.toml

@@ -2,16 +2,11 @@ source_project_id = "flext-sh/flext"
 marker_distribution = "flext-core"
 router_skill = "flext-context-routing"
 session_command = ".agents/commands/flext-law.md"
-codemod_provider = "sgconfig.yml"
+codemod_provider = "flext-infra/src/flext_infra/codemod/sgconfig.yml"
 marketplaces_key = "extraKnownMarketplaces"
 enabled_plugins_key = "enabledPlugins"
-required_surfaces = ["sgconfig.yml"]
+required_surfaces = ["flext-infra/src/flext_infra/codemod/sgconfig.yml"]
 
 [surfaces]
-always = [
-  ".agents/skills/flext-context-routing/SKILL.md",
-]
-on_demand = [
-  ".agents/skills/flext-law/SKILL.md",
-  ".agents/skills/flext-inviolable-rules/SKILL.md",
-]
+always = [".agents/skills/flext-context-routing/SKILL.md"]
+on_demand = [".agents/skills/flext-law/SKILL.md"]

.agents/skills/flext-context-routing/SKILL.md

@@ -1,25 +1,32 @@
 ---
 name: flext-context-routing
-description: Route FLEXT Python repository and workspace tasks after flext-core dependency detection. Use for FLEXT workspace detection, local skill selection, MRO facade work, governance, imports, or shared test fixtures.
+description: Route FLEXT repositories through global execution skills and the branch-matched local flext-law domain delta after flext-core dependency detection.
 ---
 
 # FLEXT Context Routing
 
-Read this skill first. It is the sole always-loaded local FLEXT surface and
-selects only the on-demand law needed for the current task.
+This is the sole always-loaded local FLEXT surface. It selects the exact
+branch-matched FLEXT law without duplicating universal execution governance.
 
-## Routing
+## Required composition
 
-- Load `flext-law` for FLEXT implementation, review, migration, refactoring,
-  validation, generated surfaces, or architecture work.
-- Load `flext-inviolable-rules` for governance, Beads coordination, shared
-  worktree safety, completion gates, evidence, handoff, commit, or closure.
-- Load both when FLEXT-law work also changes repository state.
+1. Read `~/.agents/skills/inviolable-rules/SKILL.md`.
+2. Before build, generation, docs, checks, tests, or diagnosis, read
+   `~/.agents/skills/make-check/SKILL.md`.
+3. For every FLEXT task, read the exact local
+   `.agents/skills/flext-law/SKILL.md`.
+4. At every completion boundary, read
+   `~/.agents/skills/verification-loop/SKILL.md`.
 
-## Workspace Rules
+Fail closed if a required file is absent. Never resolve `flext-law` by an
+unqualified catalog name, from `main`, or from another checkout.
 
-- Preserve facade direction `c -> t -> p -> m -> u`.
-- Reverse imports are declaration-only and must remain under `TYPE_CHECKING`.
-- `flext-tests` owns generic fixtures; do not create package-local duplicates.
-- Do not load a local skill that is absent from `surfaces.on_demand` in
-  `.agents/provider.toml`.
+## Detection and scope
+
+- Activate when the workspace provider marker or dependency graph contains
+  `flext-core`.
+- In workspace mode, use the active workspace root and its checked-out law.
+- In standalone mode, use the FLEXT root law pinned to the same branch or
+  release; never fall back to `main`.
+- Load only local surfaces declared in `.agents/provider.toml`. Global skills
+  remain owned by `~/.agents` and are not copied into the local provider.

.agents/skills/flext-law/SKILL.md

@@ -1,102 +1,64 @@
 ---
 name: flext-law
-description: Apply the mandatory FLEXT engineering law for every implementation, review, migration, refactor, validation, or instruction-surface change.
+description: Apply the FLEXT-only architecture, workspace, generation, import, and fleet delta over canonical global execution governance.
 ---
 
 # FLEXT Law
 
-## Authority and scope
+## Composition
 
-1. Read root `AGENTS.md` before touching FLEXT files.
-2. Treat the live Bead, validated configuration, public contract, and current
-   worktree as authority. Archives, backups, prior plans, and `0.20.0-dev` are
-   evidence only unless current project law explicitly adopts them.
-3. Claim the owning Bead before mutation. Preserve concurrent work and fix
-   forward only: never reset, restore, clean, stash, rebase, or normalize
-   shared work.
-4. Change one canonical owner, update its consumers in the same cycle, and
-   remove superseded paths. Do not add shims, aliases, fallbacks, suppression,
-   or old-plus-new coexistence.
+This repository is the sole owner of the skill named `flext-law`. AI Hub
+projects it but does not author it. Generic conduct, lane safety, evidence,
+Make-command selection, and completion gates remain owned by:
 
-## Engineering law
+- `~/.agents/skills/inviolable-rules/SKILL.md`
+- `~/.agents/skills/make-check/SKILL.md`
+- `~/.agents/skills/verification-loop/SKILL.md`
 
-- Follow Python 3.13, Clean Architecture, MRO composition, dependency
-  direction, typed public contracts, Pydantic v2, SSOT, YAGNI, DRY, SOLID, and
-  dependency injection as defined by root `AGENTS.md`.
-- Declarations are data; behavior belongs in focused utilities, services,
-  facades, bases, or CLI layers.
-- Generated files and deployed projections are outputs, never source owners.
-  Change their canonical generator/configuration and regenerate through the
-  root Make surface.
-- Lint, type, and tooling exception lists (ruff `per-file-ignores`, mypy
-  `disabled-error-codes`, and equivalents) are code-generated from the
-  flext-infra codegen SSOT (`flext-infra/config/tooling.yaml`), never
-  hand-added to a consumer `pyproject.toml`. A required exception that the
-  SSOT lacks is a change to that SSOT plus a regenerate, not a local edit.
-- Never silence a lint, type error, or gate to make it pass: no `noqa`,
-  `type: ignore`, per-file-ignore, or config carve-out added by an agent on
-  its own authority. Fix the flagged code at its canonical owner. If a
-  finding is a genuine false positive, stop and get explicit operator
-  approval before adding any suppression, then encode it in the codegen SSOT.
-- Tests validate public behavior. Use existing fixture topology and imports;
-  do not create parallel test or configuration paths.
-- **P0 — Tests validate config/settings changes by construction.** Tests
-  validate config/settings CONTRACTS, never frozen values: any expected value
-  that config owns (versions, verbs, paths, URLs, profiles, defaults) is read
-  from the same SSOT production reads (codegen.yaml/tooling.yaml/models) or
-  proven via generator round-trip. A test that breaks on a legitimate
-  config/settings change is a test defect; fix the test, never freeze the
-  configuration. Golden files pin STRUCTURE only and are regenerated via the
-  canonical make verb. This rule applies to all test tiers, markdown examples,
-  and docstring snippets validated by the pytest plugin (operator law
-  2026-07-24, cosmos-main-hr9e).
+Read those skills and root `AGENTS.md`; this file adds only FLEXT domain law.
 
-## Automated adjustments and synchronization
+## Architecture and imports
 
-- Any automated adjustment — sync, codegen round-trip, auto-fix, or upstream
-  merge — is a code change and must pass the same gates as a manual change.
-- Before claiming an automated adjustment is done, run the affected root-Make
-  gates (`make check` and `make test` for the touched projects) and record the
-  exact command, exit code, and decisive output in the owning Bead.
-- Automated adjustments must be atomic within the lane: one coherent commit or
-  an explicit pathspec-bound set of commits, never open-ended `fixes` commits
-  that accumulate unrelated changes.
-- Before merging the lane into the original branch (e.g. `0.12.0-dev`), run a
-  pre-merge validation of the whole lane against the current target: `make
-  check` and `make test` for every affected project. Do not merge if any gate
-  is red; fix forward inside the lane and re-validate.
-- A merge from upstream/external into the lane must also be validated in the
-  lane context before it is considered absorbed.
+- Dependency direction is `flext-core <- consumers`. `flext-infra` owns build,
+  conform, codegen, and policy; it is never a runtime dependency.
+- Facades compose in strict order `c -> t -> p -> m -> u`, with operational
+  `r/e/x/h/d/s`. Reverse imports are `TYPE_CHECKING`-only.
+- Each package has one thin `api.py` MRO facade and one simple generated root
+  `__init__.py` with automatic lazy public exports. Custom import routers,
+  eager alternatives, compatibility aliases, and duplicate facades are
+  forbidden.
+- Service exposure follows the canonical short alias: `base.py` imports `s`
+  from `flext_core`, the package root lazily re-exports `s`, and consumers use
+  `from <namespace> import s`. Never rename it to `core_s` or substitute an
+  alternative service-base import.
+- Declaration layers are pure data. Behavior belongs in utilities, services,
+  bases, facades, or CLI layers. Owned data crosses boundaries through typed
+  Pydantic v2 models and project `t.*`/`p.*` contracts.
 
-## Green checkpoint protocol
+## Sources, generation, and commands
 
-- Work in short, complete checkpoints. After every state-changing stage, update
-  the Bead with current status, orientation, owned paths, remaining scope, and
-  exact evidence; Beads stays continuous execution truth, not an end-of-task
-  summary.
-- Resolve ordinary uncertainty promptly from current evidence. Do not accumulate
-  speculative hypotheses or validated local WIP while a checkpoint can be
-  completed and landed.
-- A green checkpoint requires every applicable canonical root-Make gate to pass,
-  including zero lint errors. A red, partial, or incompletely evidenced state is
-  never committed or pushed as a checkpoint.
-- Once a checkpoint is green and push authority exists, commit only explicit
-  owned paths and immediately fast-forward push the current worker branch. Do
-  not rebase, force-push, merge, or promote the main branch; reviewed promotion
-  remains orchestrator work.
-- While work is active, send the orchestrator a concise progress heartbeat at
-  least every five minutes without pausing execution. Include the current stage,
-  latest evidence, next action, and any changed risk or blocker.
-- At every critical decision point, stop before acting, record the pending
-  decision, options, and consequences in the Bead, and ask the operator one
-  precise confirmation question. Critical decisions include destructive or
-  irreversible actions, competing public-contract or architecture outcomes,
-  security or privacy choices, production/release/main promotion, authority
-  conflicts, and material scope or acceptance changes. Never infer critical
-  intent; evidence-resolve ordinary uncertainty without unnecessary interruption.
+- `config/*.yaml`, typed settings, schemas, and generator policy are the SSOT.
+  Change the owner, regenerate every projection, and remove the superseded
+  implementation in the same cutover.
+- Generated facets, root imports, managed `pyproject.toml` sections, Make
+  surfaces, CI, and documentation are never hand-edited at consumers. Their
+  canonical owner is `flext-infra` plus explicit `config/` overlays.
+- Run setup, conform, codegen, docs, checks, tests, WAZA, and publication only
+  through the active workspace root Make dispatcher. A missing or broken verb
+  is repaired generically in `flext-infra`, then reused by workspace and
+  standalone projects; it is never bypassed.
+- `flext-tests` owns reusable fixtures and behavior helpers. Packages consume
+  them through public facades rather than creating local copies.
 
-## Completion discipline
+## Fleet boundary
 
-Use `.agents/skills/flext-inviolable-rules/SKILL.md` for every task closure.
-No task succeeds while the affected environment is broken, a required gate is
-failing, or the work is left as unowned WIP.
+- First-party FLEXT members and standalone repositories consume the same
+  branch-matched law, Make control plane, and generated conventions.
+- Third-party forks and content-only repositories are not FLEXT members: do
+  not mutate, lint, generate, or manage them. Required interaction is declared
+  as typed metadata or a bounded `config/` overlay.
+- Workspace and standalone CI are generated once by `flext-infra conform`.
+  Exceptions are configuration overlays, never duplicate pipelines or custom
+  implementations.
+- Historical branches, archives, generated outputs, and other worktrees are
+  evidence only. The active branch-matched canonical sources define behavior.