docs(sdd): record Phase 1 verification evidence

openspec/changes/migrate-catalog-skills-phase1/apply-report.md

@@ -5,16 +5,16 @@
 - Strategy: `single-pr` with explicit user-approved `size-exception`.
 - Branch: `feat/migrate-catalog-skills-phase1`; base: `main`.
 - Scope: only the three MIT-backed Bobmatnyc entries `drizzle-orm`, `pydantic`, and `sqlalchemy`.
-- Sibling source: `agents-skills` commit `c2e79fbb72d146305f82a8e979270795557d24fd` (PR #18)
+- Sibling source: `agents-skills` merge commit `be4570aa6f23931f51692661d163ddd663b57488` (PR #18)
   contains the three migrated skill directories and `PROVENANCE.md`; CI checks out this committed
   revision into `agents-skills` for deterministic resolution.
 
 ## Completed
 
 - Added the three canonical sibling skill directories under `agents-skills/skills/`, including all
   source-declared reference files and explicit full-source companions for the long Pydantic and
-  SQLAlchemy documents. These directories are committed in `agents-skills` commit `70298da` (PR
-  #18); the provenance record pins the upstream immutable source and target file hashes.
+  SQLAlchemy documents. These directories are committed in the `agents-skills` PR #18 merge; the
+  provenance record pins the upstream immutable source and target file hashes.
 - Added `agents-skills/PROVENANCE.md` with immutable repository commit, source paths, Git blob/tree
   identities, attribution, MIT license evidence, materialized file inventory, and companion status.
 - Remapped only the three catalog definitions and their Drizzle/Pydantic/SQLAlchemy technology
@@ -28,6 +28,27 @@
 - Preserved the ignored full-catalog E2E early return because unrelated external entries remain
   broken.
 
+## QA Remediation Handoff (2026-08-14)
+
+- Added `tests/acceptance/phase1_catalog.sh`, a narrow black-box harness that launches an external
+  `agentsync` executable, copies only `drizzle-orm`, `pydantic`, and `sqlalchemy` into temporary
+  source fixtures, and asserts local installation, companions, registry keys, override precedence,
+  fail-closed missing-source behavior, and direct/suggestion project-root propagation.
+- Documented the explicit target as
+  `make acceptance-phase1 AGENTSYNC_BIN=target/release/agentsync AGENTSYNC_SOURCE_REPO=../agents-skills`.
+  The harness fails clearly when the release-like binary is absent and never calls Rust modules
+  directly. The full-catalog early return remains untouched.
+- Refreshed the eight stale materialized hashes in the merged `agents-skills` Phase 1 provenance
+  record and added `scripts/validate_provenance.py`, wired into `scripts/validate-skills.sh`, so
+  future materialized-byte drift is caught by a focused check. Run
+  `AGENTSYNC_SOURCE_REPO=../agents-skills tests/acceptance/test_phase1_provenance.sh` to invoke it.
+- TDD evidence: the missing-binary harness contract failed before the harness existed and passed
+  after implementation; provenance validation first failed on the eight stale hashes and passed
+  after the refresh.
+- No production source, catalog, registry manifest, full-catalog test, or unrelated untracked
+  sibling candidates were changed. QA remains `NOT TESTED`; `sdd-qa` must rerun against the
+  documented external target before any acceptance or archive decision.
+
 ## Verification
 
 - Target sibling validator: pinned `skills-ref validate` passed for all three migrated directories

openspec/changes/migrate-catalog-skills-phase1/state.yaml

@@ -10,4 +10,4 @@ completed:
   - verify
   - qa
 next: archive
-updated: 2026-08-13
+updated: 2026-08-14

openspec/changes/migrate-catalog-skills-phase1/tasks.md

@@ -47,3 +47,10 @@ Size exception: Approved by user for the coherent three-skill Phase 1 unit; bran
 - [x] 3.2 Preserve the known full-catalog early return, `#[ignore]`, and `RUN_E2E` gate in `tests/test_catalog_integration.rs`; distinguish subset results from full-catalog status.
 - [x] 3.3 Run both-repo validation against the committed sibling revision: target validator/companion audit plus AgentSync focused/unit tests and formatting checks.
 - [x] 3.4 Verify `src/skills/registry.v1.toml`, `src/skills/registry.lock.toml`, unrelated sibling skills, and installed-state semantics remain unchanged.
+
+## QA Remediation
+
+- [x] 4.1 Add a reproducible external-CLI acceptance harness with isolated sibling, override, and missing-source fixtures for the three migrated skills.
+- [x] 4.2 Exercise direct and suggestion installs through an explicit project root, assert companions and local registry keys, and preserve the full-catalog early return by keeping the harness Phase 1-only.
+- [x] 4.3 Refresh the eight stale materialized SHA-256 entries in `../agents-skills/PROVENANCE.md` and add focused provenance validation to the sibling validation wrapper.
+- [x] 4.4 Document the acceptance command and hand off results without changing production source or promoting QA to PASS.