From a7ae2c1c8ef1d056e57972420dc48a750b4d1c05 Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Wed, 11 Nov 2026 11:23:30 -0800
Subject: [PATCH 01/14] Compare changed skills before and after with the native
 evals Action

Require protected-environment approval before paid same-repository runs; hold eval measurements fixed while switching only the target skill source and reuse the Action's verified same-job tooling.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/validation.test.mjs | 146 +++++++++++++++++++++++++-
 .github/workflows/evals.yml         |   3 +-
 .github/workflows/skill-evals.yml   | 152 ++++++++++++++++++++++++++++
 README.md                           |   4 +-
 docs/checks-and-evals.md            |  30 +++++-
 5 files changed, 329 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/skill-evals.yml

diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index ba64bdf..ea2e230 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -2,7 +2,8 @@ import test from "node:test";
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { parse } from "yaml";
@@ -361,7 +362,7 @@ test("schema validation skips absent local manifests without downloading or inst
   }
 });
 
-test("validation calls CI scripts, and paid eval activation is manual-only", () => {
+test("validation stays model-free and the smoke workflow remains manual-only", () => {
   const validate = readFileSync(resolve(root, ".github/workflows/validate.yml"), "utf8");
   assert.doesNotMatch(validate, /node -e|run: \|/);
   for (const script of ["validate-schema.sh", "check-local-catalog.mjs", "check-remote-pins.mjs"]) {
@@ -391,6 +392,147 @@ test("validation calls CI scripts, and paid eval activation is manual-only", ()
   });
 });
 
+  test("PR skill evals require approval and use two sequential native Action runs with fixed measurement inputs", () => {
+    const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-evals.yml"), "utf8"));
+    assert.deepEqual(Object.keys(workflow.on), ["pull_request"]);
+    assert.deepEqual(workflow.on.pull_request.paths, ["plugins/*/skills/**"]);
+    assert.equal(workflow.jobs.select.if, "github.event.pull_request.head.repo.full_name == github.repository");
+    assert.deepEqual(workflow.permissions, { contents: "read" });
+    assert.equal(workflow.jobs.select.permissions, undefined);
+    const job = workflow.jobs.evals;
+    assert.equal(job.environment, "evals");
+    assert.equal(job.strategy["fail-fast"], false);
+    assert.deepEqual(job.permissions, { contents: "read", "copilot-requests": "write" });
+    const actions = job.steps.filter((step) => step.uses?.startsWith("github/evals-action@"));
+    assert.equal(actions.length, 2);
+    assert.equal(actions[0].uses, actions[1].uses);
+    const { "report-id": beforeId, ...before } = actions[0].with;
+    const { "report-id": afterId, ...after } = actions[1].with;
+    assert.deepEqual(before, after);
+    assert.equal(before.command, "run");
+    assert.equal(before["eval-paths"], "${{ matrix.evalPath }}");
+    assert.equal(before["vally-version"], "0.19.0");
+    assert.equal(before.runs, 1);
+    assert.equal(before.workers, 1);
+    assert.equal(before["max-retries"], 0);
+    assert.equal(before["upload-transcripts"], false);
+    assert.notEqual(beforeId, afterId);
+    assert.equal(actions[1].if, "${{ !cancelled() && steps.after_source.outcome == 'success' }}");
+    assert.equal(job.steps.find((step) => step.id === "after_source").if,
+      "${{ !cancelled() && steps.before_source.outcome == 'success' }}");
+    for (const step of job.steps.filter((step) => step.uses?.startsWith("actions/checkout@"))) {
+      assert.equal(step.with["persist-credentials"], false);
+      assert.equal(step.with["fetch-depth"], 2);
+      assert.equal(step.with.ref, undefined, "HEAD must remain the merge SHA accepted by the Action");
+    }
+  });
+
+  test("PR selection and sequential source restores compare only eligible target skills and fail closed without approval", (t) => {
+    const directory = mkdtempSync(resolve(tmpdir(), "skill-eval-workflow-"));
+    t.after(() => rmSync(directory, { recursive: true, force: true }));
+    const repository = resolve(directory, "repository");
+    const runner = resolve(directory, "runner");
+    const hooks = resolve(directory, "hooks");
+    for (const path of [repository, runner, hooks]) mkdirSync(path);
+    const config = resolve(directory, "gitconfig");
+    writeFileSync(config, "");
+    const env = {
+      ...process.env, GIT_CONFIG_GLOBAL: config, GIT_CONFIG_NOSYSTEM: "1",
+      RUNNER_TEMP: runner, GITHUB_OUTPUT: resolve(directory, "outputs"),
+      GITHUB_STEP_SUMMARY: resolve(directory, "summary.md").replaceAll("\\", "/"),
+    };
+    const git = (...args) => {
+      const result = spawnSync("git", [
+        "-c", "user.name=Fixture", "-c", "user.email=fixture@example.test",
+        "-c", "commit.gpgsign=false", "-c", `core.hooksPath=${hooks}`, ...args,
+      ], { cwd: repository, env, encoding: "utf8", timeout: 10000 });
+      assert.ifError(result.error);
+      assert.equal(result.status, 0, result.stderr);
+      return result.stdout.trim();
+    };
+    const file = (path, content) => {
+      const destination = resolve(repository, path);
+      mkdirSync(resolve(destination, ".."), { recursive: true });
+      writeFileSync(destination, content);
+    };
+    const target = "plugins/example/skills/changed";
+    git("init", "--initial-branch=main");
+    file(`${target}/SKILL.md`, "base skill\n");
+    file(`${target}/old.md`, "base-only file\n");
+    file("plugins/example/skills/neighbor/SKILL.md", "base neighbor\n");
+    file("plugins/example/skills/deleted/SKILL.md", "deleted skill\n");
+    file("evals/example/skills/changed/eval.yaml", "fixed measurement\n");
+    git("add", "."); git("commit", "-m", "Base fixture");
+    git("checkout", "-b", "candidate");
+    file(`${target}/SKILL.md`, "head skill\n");
+    file(`${target}/new.md`, "head-only file\n");
+    rmSync(resolve(repository, `${target}/old.md`));
+    rmSync(resolve(repository, "plugins/example/skills/deleted/SKILL.md"));
+    file("plugins/example/skills/neighbor/SKILL.md", "head neighbor without an eval\n");
+    file("plugins/example/skills/added/SKILL.md", "new skill without a baseline\n");
+    git("add", "."); git("commit", "-m", "Candidate fixture");
+    env.HEAD_SHA = git("rev-parse", "HEAD");
+    git("checkout", "main");
+    file(`${target}/main.md`, "current-main-only file\n");
+    git("add", "."); git("commit", "-m", "Advance main fixture");
+    const base = git("rev-parse", "HEAD");
+    git("merge", "--no-ff", "candidate", "-m", "Merge fixture");
+    env.GITHUB_SHA = git("rev-parse", "HEAD");
+    const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-evals.yml"), "utf8"));
+    const selection = workflow.jobs.select.steps.find((step) => step.id === "select").run;
+    const code = selection.match(/<<'JS'\n([\s\S]*)\nJS/)[1];
+    const environment = resolve(runner, "evals-environment.json");
+    writeFileSync(environment, JSON.stringify({ protection_rules: [] }));
+    const denied = spawnSync(process.execPath, ["--input-type=module", "-e", code], {
+      cwd: repository, env, encoding: "utf8", timeout: 10000,
+    });
+    assert.ifError(denied.error);
+    assert.notEqual(denied.status, 0);
+    assert.match(denied.stderr, /required maintainer reviewers/);
+    assert.equal(existsSync(env.GITHUB_OUTPUT), false);
+    writeFileSync(environment, JSON.stringify({ protection_rules: [{ type: "required_reviewers", reviewers: [{ type: "Team" }] }] }));
+    const selected = spawnSync(process.execPath, ["--input-type=module", "-e", code], {
+      cwd: repository, env, encoding: "utf8", timeout: 10000,
+    });
+    assert.ifError(selected.error);
+    assert.equal(selected.status, 0, selected.stderr);
+    assert.match(selected.stdout, /No before\/after pair for example\/added/);
+    assert.match(selected.stdout, /No before\/after pair for example\/deleted/);
+    assert.match(selected.stdout, /No before\/after pair for example\/neighbor/);
+    const matrix = JSON.parse(readFileSync(env.GITHUB_OUTPUT, "utf8").split("\n")[0].slice("matrix=".length));
+    assert.equal(matrix.include.length, 1);
+    const item = matrix.include[0];
+    assert.equal(item.directory, target);
+    assert.equal(item.base, base);
+    assert.equal(item.head, env.HEAD_SHA);
+    assert.match(item.id, /^skill-[a-f0-9]{12}$/);
+    for (const [id, source, expected] of [
+      ["before_source", base, "base skill\n"], ["after_source", env.HEAD_SHA, "head skill\n"],
+    ]) {
+      const step = workflow.jobs.evals.steps.find((entry) => entry.id === id);
+      const restored = spawnSync("bash", ["-c", step.run], {
+        cwd: repository, env: { ...env, SOURCE_SHA: source, SKILL_DIR: target }, encoding: "utf8", timeout: 10000,
+      });
+      assert.ifError(restored.error);
+      assert.equal(restored.status, 0, restored.stderr);
+      assert.equal(git("rev-parse", "HEAD"), env.GITHUB_SHA);
+      assert.equal(readFileSync(resolve(repository, `${target}/SKILL.md`), "utf8"), expected);
+      assert.equal(existsSync(resolve(repository, `${target}/old.md`)), id === "before_source");
+      assert.equal(existsSync(resolve(repository, `${target}/new.md`)), id === "after_source");
+      assert.equal(existsSync(resolve(repository, `${target}/main.md`)), id === "before_source");
+      assert.equal(readFileSync(resolve(repository, "plugins/example/skills/neighbor/SKILL.md"), "utf8"), "head neighbor without an eval\n");
+      assert.equal(readFileSync(resolve(repository, "evals/example/skills/changed/eval.yaml"), "utf8"), "fixed measurement\n");
+      assert.ok(git("diff", "--name-only", "HEAD").split("\n").every((path) => path.startsWith(`${target}/`)));
+    }
+    file("evals/example/skills/changed/eval.yaml", "unexpected measurement change\n");
+    const drift = spawnSync("bash", ["-c", workflow.jobs.evals.steps.find((entry) => entry.id === "after_source").run], {
+      cwd: repository, env: { ...env, SOURCE_SHA: env.HEAD_SHA, SKILL_DIR: target }, encoding: "utf8", timeout: 10000,
+    });
+    assert.ifError(drift.error);
+    assert.notEqual(drift.status, 0);
+    assert.match(drift.stdout, /Measurement files changed outside the selected skill/);
+  });
+
 for (const [plugin, skillName, readInstruction] of [
   ["marketplace-maintainer", "update-remote-pins", "Read its `AGENTS.md` and `marketplace.json`, and this skill's [remote pin rules](references/remote-pins.md)."],
   ["plugin-authoring", "submit-plugin", "Read its `AGENTS.md` and `CONTRIBUTING.md`."],
diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index 732ff84..79a65f1 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -1,6 +1,7 @@
 name: Evals
 # Runs the smoke evals with real Copilot sessions, which cost AI credits.
-# Start by explicit manual dispatch only; pull requests never start paid runs.
+# This smoke workflow starts only by explicit manual dispatch.
+# Skill comparisons use the separate approval-gated skill-evals workflow.
 on:
   workflow_dispatch:
 permissions:
diff --git a/.github/workflows/skill-evals.yml b/.github/workflows/skill-evals.yml
new file mode 100644
index 0000000..ad238eb
--- /dev/null
+++ b/.github/workflows/skill-evals.yml
@@ -0,0 +1,152 @@
+name: Skill evals (before and after)
+# Paid runs require approval in the existing, protected evals environment.
+on:
+  pull_request:
+    paths:
+      - plugins/*/skills/**
+permissions:
+  contents: read
+jobs:
+  select:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.select.outputs.matrix }}
+      count: ${{ steps.select.outputs.count }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+      - name: Read approval protection without creating an environment
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api "repos/$GITHUB_REPOSITORY/environments/evals" > "$RUNNER_TEMP/evals-environment.json"
+      - name: Require approval protection and select changed skills
+        id: select
+        env:
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          node --input-type=module <<'JS'
+          import { execFileSync, spawnSync } from 'node:child_process';
+          import { createHash } from 'node:crypto';
+          import { appendFileSync, existsSync, readFileSync } from 'node:fs';
+          import { resolve } from 'node:path';
+          const environment = JSON.parse(readFileSync(resolve(process.env.RUNNER_TEMP, 'evals-environment.json'), 'utf8'));
+          if (!environment.protection_rules?.some(rule => rule.type === 'required_reviewers' && rule.reviewers?.length > 0)) {
+            throw new Error('Configure the evals environment with required maintainer reviewers before enabling paid PR evals.');
+          }
+          const git = (...args) => execFileSync('git', args, { encoding: 'utf8' }).trim();
+          const head = process.env.HEAD_SHA;
+          if (!/^[a-f0-9]{40}$/.test(head ?? '') || git('rev-parse', 'HEAD^2') !== head) {
+            throw new Error('Expected the PR merge commit and its exact head parent.');
+          }
+          const base = git('rev-parse', 'HEAD^1');
+          const changed = execFileSync('git', ['diff', '--no-renames', '--name-only', '-z', base, 'HEAD', '--', 'plugins'], { encoding: 'utf8' });
+          const keys = [...new Set(changed.split('\0').flatMap(file => {
+            const match = /^plugins\/([^/]+)\/skills\/([^/]+)\//.exec(file);
+            return match ? [`${match[1]}/${match[2]}`] : [];
+          }))].sort();
+          const include = [];
+          for (const key of keys) {
+            if (!/^[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/.test(key)) {
+              throw new Error('Unsupported plugin or skill path in PR changes.');
+            }
+            const [plugin, skill] = key.split('/');
+            const directory = `plugins/${plugin}/skills/${skill}`;
+            const evalPath = `evals/${plugin}/skills/${skill}/eval.yaml`;
+            const present = ref => {
+              const result = spawnSync('git', ['cat-file', '-e', `${ref}:${directory}/SKILL.md`], { stdio: 'ignore' });
+              if (result.error) throw result.error;
+              if (result.status !== 0 && result.status !== 128) throw new Error('Could not inspect the skill source tree.');
+              return result.status === 0;
+            };
+            if (!present(base) || !present(head) || !existsSync(evalPath)) {
+              console.log(`::warning::No before/after pair for ${key}: both skill versions and ${evalPath} are required. No eval was run for this skill.`);
+              continue;
+            }
+            include.push({ plugin, skill, directory, evalPath, base, head, id: `skill-${createHash('sha256').update(key).digest('hex').slice(0, 12)}` });
+          }
+          appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify({ include })}\ncount=${include.length}\n`);
+          JS
+
+  evals:
+    needs: select
+    if: needs.select.outputs.count != '0'
+    name: ${{ matrix.plugin }}/${{ matrix.skill }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    environment: evals
+    permissions:
+      contents: read
+      copilot-requests: write
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.select.outputs.matrix) }}
+    env:
+      VALLY_TELEMETRY_OPTOUT: '1'
+      SKILL_DIR: ${{ matrix.directory }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+      - name: Select the target skill from current main
+        id: before_source
+        env:
+          SOURCE_SHA: ${{ matrix.base }}
+        run: |
+          set -euo pipefail
+          git --literal-pathspecs restore --source="$SOURCE_SHA" --staged --worktree -- "$SKILL_DIR"
+          git --literal-pathspecs diff --exit-code "$SOURCE_SHA" -- "$SKILL_DIR"
+          if [[ -n "$(git diff --name-only HEAD | awk -v dir="$SKILL_DIR/" 'index($0,dir)!=1')$(git ls-files --others --exclude-standard)" ]]; then
+            echo "::error::Measurement files changed outside the selected skill."
+            exit 1
+          fi
+          echo "Before: $SKILL_DIR from $SOURCE_SHA; measurement revision $GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"
+      - name: Run before evals
+        uses: github/evals-action@6e4c077e92194c7e75663d8d782426841047e887 # v0.2.0
+        with:
+          command: run
+          eval-paths: ${{ matrix.evalPath }}
+          vally-version: '0.19.0'
+          copilot-token: ${{ github.token }}
+          runs: 1
+          workers: 1
+          max-retries: 0
+          upload-transcripts: false
+          report-id: ${{ matrix.id }}-before
+      - name: Select the target skill from the PR head
+        id: after_source
+        if: ${{ !cancelled() && steps.before_source.outcome == 'success' }}
+        env:
+          SOURCE_SHA: ${{ matrix.head }}
+        run: |
+          set -euo pipefail
+          git --literal-pathspecs restore --source="$SOURCE_SHA" --staged --worktree -- "$SKILL_DIR"
+          git --literal-pathspecs diff --exit-code "$SOURCE_SHA" -- "$SKILL_DIR"
+          if [[ -n "$(git diff --name-only HEAD | awk -v dir="$SKILL_DIR/" 'index($0,dir)!=1')$(git ls-files --others --exclude-standard)" ]]; then
+            echo "::error::Measurement files changed outside the selected skill."
+            exit 1
+          fi
+          echo "After: $SKILL_DIR from $SOURCE_SHA; measurement revision $GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"
+      - name: Run after evals even if the before verdict failed
+        if: ${{ !cancelled() && steps.after_source.outcome == 'success' }}
+        uses: github/evals-action@6e4c077e92194c7e75663d8d782426841047e887 # v0.2.0
+        with:
+          command: run
+          eval-paths: ${{ matrix.evalPath }}
+          vally-version: '0.19.0'
+          copilot-token: ${{ github.token }}
+          runs: 1
+          workers: 1
+          max-retries: 0
+          upload-transcripts: false
+          report-id: ${{ matrix.id }}-after
diff --git a/README.md b/README.md
index 3ca8f26..4a002ab 100644
--- a/README.md
+++ b/README.md
@@ -197,7 +197,9 @@ request.
 
 **Paid evals:** `npm run eval` runs real Copilot sessions and costs AI credits.
 [Evals](.github/workflows/evals.yml) runs only when manually started; pull
-requests never trigger paid evals.
+requests that change a plugin skill use the separate
+[before/after workflow](.github/workflows/skill-evals.yml), with maintainer approval
+required in the protected `evals` environment. Fork PRs do not run paid evals.
 
 See [Checks and evals](docs/checks-and-evals.md) for CI details, local test
 commands, and Bash and PowerShell eval setup.
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index a4d6988..0c76df2 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -124,5 +124,31 @@ npm run eval:compare -- --baseline evals/_shared/fixtures/pr-description/baselin
 
 [Evals](../.github/workflows/evals.yml) runs the smoke suite only when you
 explicitly start it with **Run workflow** in GitHub Actions
-(`workflow_dispatch`). Pull requests never start paid evals. Review the
-selected branch and its eval code before dispatching a run.
+(`workflow_dispatch`). Review the selected branch and its eval code before
+dispatching a run.
+
+[Skill evals](../.github/workflows/skill-evals.yml) compares each changed existing
+plugin skill with its version on current `main`. It uses the same PR merge
+revision's evals, graders, fixtures and shared marketplace context for both runs;
+only the selected skill comes from the exact base-parent or PR-head commit.
+Both Action invocations run sequentially in one job, reusing the Action's verified
+Vally installation. They use one trial per case and no trial retries. A failed
+before verdict does not prevent the after run; failures remain visible, without
+a new regression-only gate or statistical claim.
+
+A maintainer must first configure the `evals` environment with required
+reviewers and review the PR's workflow, eval code and billing effects before
+approval. The read-only selection job refuses missing or unprotected
+environments, rather than automatically creating an unprotected environment.
+Same-repository PRs are trusted code with model-billing permission, not an
+OS/network sandbox; fork PRs are excluded and `pull_request_target` is not used.
+The organization's Copilot billing policy must also permit workflow-token usage.
+The workflow changes none of these repository or organization settings.
+
+New or deleted skills and skills without their corresponding
+`evals/<plugin>/skills/<skill>/eval.yaml` cannot form a before/after pair. They are
+reported as not run, not counted as passing, and do not make evals mandatory for
+every catalog skill. Each Action invocation retains its structured report;
+raw transcript uploads and PR-comment permissions are disabled. The Action
+manages its own runtime dependencies, so parity with the locally pinned Copilot
+CLI is not assumed.

From 8b9a7be247bc8eaa6aabf0201654a224bd97cbca Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 00:06:52 -0800
Subject: [PATCH 02/14] Scope comparison artifacts to the workflow run attempt

Avoid upload collisions and importing prior-attempt verdicts when a maintainer reruns the same workflow.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/validation.test.mjs | 5 +++++
 .github/workflows/skill-evals.yml   | 8 ++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index e2a751a..04d93c3 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -427,6 +427,11 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     assert.equal(comment.concurrency["cancel-in-progress"], false);
     assert.match(comment.if, /!cancelled\(\)/);
     assert.ok(comment.steps.some((step) => step.run?.includes("skill-eval-comment.mjs post")));
+    assert.equal(comment.steps.find((step) => step.uses?.startsWith("actions/download-artifact@")).with.pattern,
+      "skill-comparison-${{ github.run_attempt }}-*");
+    for (const step of [...workflow.jobs.select.steps, ...job.steps].filter((step) => step.uses?.startsWith("actions/upload-artifact@"))) {
+      assert.match(step.with.name, /github\.run_attempt/, "reruns must not collide with or import earlier-attempt artifacts");
+    }
     assert.equal(job.permissions["pull-requests"], undefined);
     for (const step of job.steps.filter((step) => step.uses?.startsWith("actions/checkout@"))) {
       assert.equal(step.with["persist-credentials"], false);
diff --git a/.github/workflows/skill-evals.yml b/.github/workflows/skill-evals.yml
index 9bb4234..fa9e213 100644
--- a/.github/workflows/skill-evals.yml
+++ b/.github/workflows/skill-evals.yml
@@ -88,7 +88,7 @@ jobs:
       - name: Retain comparison selection
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: skill-comparison-selection
+          name: skill-comparison-${{ github.run_attempt }}-selection
           path: ${{ runner.temp }}/selection.json
           if-no-files-found: error
           retention-days: 7
@@ -120,7 +120,7 @@ jobs:
       - name: Read comparison selection
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
-          name: skill-comparison-selection
+          name: skill-comparison-${{ github.run_attempt }}-selection
           path: ${{ runner.temp }}/skill-selection
       - name: Select the target skill from current main
         id: before_source
@@ -200,7 +200,7 @@ jobs:
         if: ${{ !cancelled() }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: skill-comparison-${{ matrix.id }}
+          name: skill-comparison-${{ github.run_attempt }}-${{ matrix.id }}
           path: ${{ runner.temp }}/skill-comparison/*.json
           if-no-files-found: error
           retention-days: 7
@@ -227,7 +227,7 @@ jobs:
       - name: Read this run's comparison evidence only
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
-          pattern: skill-comparison-*
+          pattern: skill-comparison-${{ github.run_attempt }}-*
           merge-multiple: true
           path: ${{ runner.temp }}/skill-comparison
       - name: Update the PR comparison comment without model access

From d03c07a3f53ef8ae46a5336d80ec9ab02d69ed3c Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 08:45:39 -0800
Subject: [PATCH 03/14] Keep incomplete comparisons unknown and reject unsafe
 workflow retries

Require matching complete grader evidence for transitions, redact parse failures, cancel stale PR runs, and reject partial retries before either paid arm. Run the publisher from the trusted base and document the still-open billing trust decision without changing triggers.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/skill-eval-comment.mjs      | 37 +++++++++++++++------
 .github/scripts/skill-eval-comment.test.mjs | 23 +++++++++++++
 .github/scripts/validation.test.mjs         | 19 +++++++++++
 .github/workflows/skill-evals.yml           | 29 +++++++++++++++-
 docs/checks-and-evals.md                    | 23 +++++++++++++
 5 files changed, 120 insertions(+), 11 deletions(-)

diff --git a/.github/scripts/skill-eval-comment.mjs b/.github/scripts/skill-eval-comment.mjs
index 9b0fb2c..dc8bc4f 100644
--- a/.github/scripts/skill-eval-comment.mjs
+++ b/.github/scripts/skill-eval-comment.mjs
@@ -13,7 +13,10 @@ const text = (value) => stripVTControlCharacters(String(value ?? ""))
   .replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
   .replaceAll("|", "&#124;").replaceAll("`", "&#96;").replaceAll("[", "&#91;").replaceAll("]", "&#93;")
   .replaceAll("@", "&#64;").slice(0, 200);
-const json = (path) => JSON.parse(readFileSync(path, "utf8"));
+const json = (path) => {
+  const contents = readFileSync(path, "utf8");
+  try { return JSON.parse(contents); } catch { throw new Error("Malformed comparison JSON input."); }
+};
 const writeJson = (path, value) => {
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, `${JSON.stringify(value)}\n`, { mode: 0o600 });
@@ -116,7 +119,9 @@ export function collectArm(report, logs) {
   const matches = [];
   for (const log of logs) {
     if (!log.trimStart().startsWith("{")) continue; // The Action also retains its plain version check.
-    const records = log.split(/\r?\n/).filter((line) => line.trim()).map((line) => JSON.parse(line));
+    let records;
+    try { records = log.split(/\r?\n/).filter((line) => line.trim()).map((line) => JSON.parse(line)); }
+    catch { throw new Error("Malformed native JSONL evidence."); }
     if (records[0]?.runId === report.nativeRunId) matches.push(records);
   }
   if (matches.length !== 1) throw new Error("Expected exactly one native JSONL log for this Action run.");
@@ -131,6 +136,12 @@ const findRow = (arm, row) => arm?.rows.find((item) =>
   item.eval === row.eval && item.stimulus === row.stimulus && item.model === row.model);
 const failures = (row) => new Set(row?.checks.filter((check) => !check.passed).map((check) => check.id) ?? []);
 const difference = (a, b) => [...a].filter((id) => !b.has(id)).length;
+function comparable(pair, before, after) {
+  return pair.before?.state === "complete" && pair.after?.state === "complete" &&
+    before?.state === "graded" && after?.state === "graded" &&
+    before.checks.length === after.checks.length &&
+    before.checks.every((check) => after.checks.some((other) => other.id === check.id));
+}
 function counts(arm, row) {
   if (arm?.state === "error") return "⚠️ Error";
   if (arm?.state === "not-run") return "⏭️ Not run";
@@ -139,9 +150,9 @@ function counts(arm, row) {
   if (row.state === "not-run") return "⏭️ Not run";
   return `${row.checks.filter((check) => check.passed).length}/${row.checks.length}`;
 }
-function transition(before, after) {
+function transition(pair, before, after) {
   const old = failures(before), current = failures(after);
-  if (before?.state !== "graded" || after?.state !== "graded") return "";
+  if (!comparable(pair, before, after)) return "";
   const added = difference(current, old), resolved = difference(old, current);
   if (added && resolved) return `🔄 `;
   if (added) return "📉 ";
@@ -155,7 +166,7 @@ export function renderComparison(selection, pairs, evidenceUrl) {
   let added = 0, resolved = 0;
   for (const pair of pairs) for (const after of pair.after?.rows ?? []) {
     const before = findRow(pair.before, after);
-    if (before?.state === "graded" && after.state === "graded") {
+    if (comparable(pair, before, after)) {
       added += difference(failures(after), failures(before));
       resolved += difference(failures(before), failures(after));
     }
@@ -168,7 +179,8 @@ export function renderComparison(selection, pairs, evidenceUrl) {
     "**Cells: Before → After.** A scenario is one case; graders are its individual checks.", "",
   ];
   if (pairs.some((pair) => ["before", "after"].some((arm) => pair[arm]?.state !== "complete" ||
-    pair[arm]?.rows.some((row) => row.state !== "graded")))) {
+    pair[arm]?.rows.some((row) => row.state !== "graded")) ||
+    (pair.after?.rows ?? []).some((after) => !comparable(pair, findRow(pair.before, after), after)))) {
     lines.push("**⚠️ Incomplete/error evidence:** affected cells are not passing results. Check the linked workflow.", "");
   }
   const rowIdentities = (pair) => [...new Map([...(pair.before?.rows ?? []), ...(pair.after?.rows ?? [])]
@@ -187,7 +199,9 @@ export function renderComparison(selection, pairs, evidenceUrl) {
       const cells = models.map((model) => {
         const identity = { ...row, model };
         const before = findRow(pair.before, identity), after = findRow(pair.after, identity);
-        return `${transition(before, after)}${counts(pair.before, before)} → ${counts(pair.after, after)}`;
+        const unknown = before?.state === "graded" && after?.state === "graded" && !comparable(pair, before, after)
+          ? " (comparison unknown)" : "";
+        return `${transition(pair, before, after)}${counts(pair.before, before)} → ${counts(pair.after, after)}${unknown}`;
       });
       const short = row.stimulus.startsWith(`${row.eval}-`) ? row.stimulus.slice(row.eval.length + 1) : row.stimulus;
       lines.push(`| ${row.eval} : ${short} | ${cells.join(" | ")} |`);
@@ -211,7 +225,7 @@ export function renderComparison(selection, pairs, evidenceUrl) {
         for (const { arm, row, check } of rows) {
           const other = findRow(pair[arm === "before" ? "after" : "before"], row);
           const otherFailed = failures(other).has(check.id);
-          const change = other?.state !== "graded" ? "comparison unknown" :
+          const change = !comparable(pair, arm === "before" ? row : other, arm === "after" ? row : other) ? "comparison unknown" :
             arm === "after" ? otherFailed ? "already present" : "new" : otherFailed ? "persists After" : "resolved After";
           output.push(`| ${arm === "after" ? "After" : "Before"} (${change}) | ${check.name} | ${row.model} | ${check.reason} | [Native run](${evidenceUrl}) |`);
         }
@@ -244,12 +258,15 @@ export function renderComparison(selection, pairs, evidenceUrl) {
       let added = 0, resolved = 0;
       for (const after of pair.after?.rows.filter((row) => row.model === model) ?? []) {
         const before = findRow(pair.before, after);
-        if (before?.state === "graded" && after.state === "graded") {
+        if (comparable(pair, before, after)) {
           added += difference(failures(after), failures(before));
           resolved += difference(failures(before), failures(after));
         }
       }
-      return added && resolved ? `🔄 ${values} (${added} new, ${resolved} resolved grader failures)` : values;
+      const unknown = (pair.after?.rows.filter((row) => row.model === model) ?? [])
+        .some((after) => !comparable(pair, findRow(pair.before, after), after));
+      return unknown ? `${values} (comparison unknown)` :
+        added && resolved ? `🔄 ${values} (${added} new, ${resolved} resolved grader failures)` : values;
     });
     lines.push(`| ${text(skill.key)} | ${cells.join(" | ")} |`);
   }
diff --git a/.github/scripts/skill-eval-comment.test.mjs b/.github/scripts/skill-eval-comment.test.mjs
index 248309b..11727e0 100644
--- a/.github/scripts/skill-eval-comment.test.mjs
+++ b/.github/scripts/skill-eval-comment.test.mjs
@@ -81,6 +81,29 @@ test("equal aggregate counts expose changed failure identities and missing arms
   assert.doesNotMatch(missing, /📈 1\/2/);
 });
 
+test("partial arms and absent matching graders cannot create resolved or new failure claims", () => {
+  for (const change of ["partial", "missing-check"]) {
+    const sample = pair();
+    if (change === "partial") sample.after.state = "error";
+    else sample.after.rows[0].checks.pop();
+    const rendered = renderComparison(selection, [sample], "https://example.test");
+    assert.match(rendered, /0 resolved · 📉 0 new failures/);
+    assert.match(rendered, /Before \(comparison unknown\) \| routing/);
+    assert.match(rendered, /comparison unknown/);
+    assert.doesNotMatch(rendered, /resolved After|After \(new\)|📈 1\/2/);
+    if (change === "partial") assert.match(rendered, /1\/2 → ⚠️ Error/);
+    else assert.match(rendered, /1\/2 → 1\/1 \(comparison unknown\)/);
+  }
+});
+
+test("malformed native output never leaks parser excerpts", () => {
+  assert.throws(() => collectArm(report, [`${JSON.stringify(trial())}\nSECRET_RAW_INVALID_JSON`]), (error) => {
+    assert.equal(error.message, "Malformed native JSONL evidence.");
+    assert.doesNotMatch(error.message, /SECRET/);
+    return true;
+  });
+});
+
 test("catalog inventory enumerates local and exact pinned remote skill folders without executing them", (t) => {
   const root = mkdtempSync(join(tmpdir(), "comparison-inventory-"));
   t.after(() => rmSync(root, { recursive: true, force: true }));
diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index 04d93c3..5cbc8a4 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -398,6 +398,9 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     assert.deepEqual(workflow.on.pull_request.paths, ["plugins/*/skills/**"]);
     assert.equal(workflow.jobs.select.if, "github.event.pull_request.head.repo.full_name == github.repository");
     assert.deepEqual(workflow.permissions, { contents: "read" });
+    assert.deepEqual(workflow.concurrency, {
+      group: "skill-evals-${{ github.event.pull_request.number }}", "cancel-in-progress": true,
+    });
     assert.deepEqual(workflow.jobs.select.permissions, { contents: "read", actions: "read" });
     const job = workflow.jobs.evals;
     assert.equal(job.environment, "evals");
@@ -433,6 +436,22 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
       assert.match(step.with.name, /github\.run_attempt/, "reruns must not collide with or import earlier-attempt artifacts");
     }
     assert.equal(job.permissions["pull-requests"], undefined);
+    assert.equal(comment.steps.find((step) => step.uses?.startsWith("actions/checkout@")).with.ref,
+      "${{ github.event.pull_request.base.sha }}");
+    assert.match(comment.steps.find((step) => step.name?.includes("trusted base")).run,
+      /Merge the reviewed publisher into the base branch/);
+    for (const guarded of [job, comment]) {
+      assert.equal(guarded.steps[0].env.SELECTED_ATTEMPT, "${{ needs.select.outputs.attempt }}");
+      for (const attempt of ["1", "2"]) {
+        const checked = spawnSync("bash", ["-c", guarded.steps[0].run], {
+          encoding: "utf8", timeout: 10000,
+          env: { ...process.env, SELECTED_ATTEMPT: "1", GITHUB_RUN_ATTEMPT: attempt },
+        });
+        assert.ifError(checked.error);
+        assert.equal(checked.status, attempt === "1" ? 0 : 1);
+        if (attempt === "2") assert.match(checked.stdout, /Re-run all jobs/);
+      }
+    }
     for (const step of job.steps.filter((step) => step.uses?.startsWith("actions/checkout@"))) {
       assert.equal(step.with["persist-credentials"], false);
       assert.equal(step.with["fetch-depth"], 2);
diff --git a/.github/workflows/skill-evals.yml b/.github/workflows/skill-evals.yml
index fa9e213..e0808a8 100644
--- a/.github/workflows/skill-evals.yml
+++ b/.github/workflows/skill-evals.yml
@@ -6,6 +6,9 @@ on:
       - plugins/*/skills/**
 permissions:
   contents: read
+concurrency:
+  group: skill-evals-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 jobs:
   select:
     if: github.event.pull_request.head.repo.full_name == github.repository
@@ -17,6 +20,7 @@ jobs:
     outputs:
       matrix: ${{ steps.select.outputs.matrix }}
       count: ${{ steps.select.outputs.count }}
+      attempt: ${{ steps.select.outputs.attempt }}
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
@@ -83,7 +87,7 @@ jobs:
             run: process.env.GITHUB_RUN_ID, attempt: process.env.GITHUB_RUN_ATTEMPT,
           };
           writeFileSync(resolve(process.env.RUNNER_TEMP, 'selection.json'), JSON.stringify(selection));
-          appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify({ include })}\ncount=${include.length}\n`);
+          appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify({ include })}\ncount=${include.length}\nattempt=${process.env.GITHUB_RUN_ATTEMPT}\n`);
           JS
       - name: Retain comparison selection
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
@@ -110,6 +114,14 @@ jobs:
       VALLY_TELEMETRY_OPTOUT: '1'
       SKILL_DIR: ${{ matrix.directory }}
     steps:
+      - name: Reject partial retries before either paid arm
+        env:
+          SELECTED_ATTEMPT: ${{ needs.select.outputs.attempt }}
+        run: |
+          if [[ "$SELECTED_ATTEMPT" != "$GITHUB_RUN_ATTEMPT" ]]; then
+            echo "::error::Partial job retries are unsupported. Use Re-run all jobs so selection and both arms share one attempt."
+            exit 1
+          fi
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 2
@@ -218,12 +230,27 @@ jobs:
       actions: read
       pull-requests: write
     steps:
+      - name: Reject stale selection on comment-only retries
+        env:
+          SELECTED_ATTEMPT: ${{ needs.select.outputs.attempt }}
+        run: |
+          if [[ "$SELECTED_ATTEMPT" != "$GITHUB_RUN_ATTEMPT" ]]; then
+            echo "::error::Partial job retries are unsupported. Use Re-run all jobs so selection and both arms share one attempt."
+            exit 1
+          fi
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
+          ref: ${{ github.event.pull_request.base.sha }}
           persist-credentials: false
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 24
+      - name: Require the publisher on the trusted base revision
+        run: |
+          test -f .github/scripts/skill-eval-comment.mjs || {
+            echo "::error::Merge the reviewed publisher into the base branch before enabling comparison comments."
+            exit 1
+          }
       - name: Read this run's comparison evidence only
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index dd6bdd6..d729f0a 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -178,6 +178,9 @@ graders fail. New, resolved and persistent failures are distinguished, including
 equal totals with changed failure identities. Errors, skipped cases and missing
 arms never become passing counts. These single-trial observations do not prove
 causation.
+Transition labels require two complete arms and the same individual checks.
+A missing counterpart is unknown, not a resolved failure. Partial failed-check
+evidence stays visible without claiming an improvement or regression.
 
 The small presentation helper reads the pinned Action's local native JSONL logs
 and uploads only case/model identities, verdicts and safe check explanations.
@@ -194,3 +197,23 @@ serialized publishing and run/attempt ordering prevent older runs replacing
 newer comments. No custom Run button, new trigger or branch-protection change is
 introduced. The layout supports multiple observed models without selecting or
 paying for additional models automatically.
+
+The publisher checks out the exact base SHA, never the PR's helper. Its reviewed
+helper must already exist on that trusted revision; otherwise publication fails
+closed. Workflow-level per-PR concurrency cancels stale runs before more work is
+scheduled. Cancellation cannot undo already billed model requests.
+
+**Partial job reruns are unsupported.** Use **Re-run all jobs** so selection and
+both paid arms share an attempt and approval. A retry reusing a successful
+selection from a previous attempt is rejected before either paid arm, rather
+than spending credits and then failing to collect its artifacts. This also
+applies to comment-only retries.
+
+**Approval boundary:** required environment reviewers protect jobs that reference
+that environment, not every job an authorized workflow editor could add.
+`copilot-requests: write` is a workflow-token permission, not an environment
+secret. These declarations are not an immutable organization-wide billing
+policy. A trusted publishing checkout also does not make the surrounding
+PR-editable workflow immutable. Do not treat this workflow as a security boundary
+against untrusted workflow editors; the trusted-entrypoint/billing design remains
+under review before enabling it.

From 2c47a1983bbfa6b348de80f738ba4ea8b53211b3 Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 09:30:10 -0800
Subject: [PATCH 04/14] Publish PR comparison data from a trusted workflow_run
 workflow

Remove write permissions from PR publication code; validate the authenticated producer workflow, run, attempt, PR and merge revisions, and treat bounded artifact JSON as untrusted display data. Preserve the existing native paid entrypoint and document its separate approval-boundary gap.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/skill-eval-comment.mjs      | 153 ++++++++++++++++----
 .github/scripts/skill-eval-comment.test.mjs |  84 +++++++++--
 .github/scripts/validation.test.mjs         |  25 ++--
 .github/workflows/skill-eval-comment.yml    |  38 +++++
 .github/workflows/skill-evals.yml           |  46 ------
 README.md                                   |   3 +
 docs/checks-and-evals.md                    |  64 +++++---
 7 files changed, 302 insertions(+), 111 deletions(-)
 create mode 100644 .github/workflows/skill-eval-comment.yml

diff --git a/.github/scripts/skill-eval-comment.mjs b/.github/scripts/skill-eval-comment.mjs
index dc8bc4f..2dcefd8 100644
--- a/.github/scripts/skill-eval-comment.mjs
+++ b/.github/scripts/skill-eval-comment.mjs
@@ -1,12 +1,16 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { stripVTControlCharacters } from "node:util";
 
 const marker = "<!-- marketplace-skill-comparison:";
 const safeName = /^[a-z0-9][a-z0-9._-]*$/;
 const sha = /^[a-f0-9]{40}$/;
+const sourceWorkflow = ".github/workflows/skill-evals.yml";
+const skillKey = (value) => typeof value === "string" && value.split("/").length === 2 &&
+  value.split("/").every((part) => safeName.test(part));
+const positive = (value) => Number.isSafeInteger(value) && value > 0;
 const text = (value) => stripVTControlCharacters(String(value ?? ""))
   // eslint-disable-next-line no-control-regex
   .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/gu, " ")
@@ -278,28 +282,136 @@ export function renderComparison(selection, pairs, evidenceUrl) {
   return lines.join("\n");
 }
 
-export async function postComparison(selection, body, api = github, env = process.env) {
-  if (!/^[\w.-]+\/[\w.-]+$/.test(env.GITHUB_REPOSITORY ?? "") || !/^\d+$/.test(env.PR_NUMBER ?? "")) throw new Error("Invalid PR context.");
-  const endpoint = `repos/${env.GITHUB_REPOSITORY}`;
-  const pr = await api(`${endpoint}/pulls/${env.PR_NUMBER}`);
-  if (pr.state !== "open" || pr.head.sha !== selection.head || pr.head.repo.full_name !== env.GITHUB_REPOSITORY) {
+export async function publisherContext(event, api = github, env = process.env) {
+  const repository = env.GITHUB_REPOSITORY;
+  const source = event?.workflow_run;
+  if (env.GITHUB_EVENT_NAME !== "workflow_run" || !/^[\w.-]+\/[\w.-]+$/.test(repository ?? "") ||
+      !positive(source?.id) || !positive(source?.run_attempt)) throw new Error("Expected a workflow_run publisher context.");
+  const endpoint = `repos/${repository}`;
+  const run = await api(`${endpoint}/actions/runs/${source.id}/attempts/${source.run_attempt}`);
+  if (run.id !== source.id || run.run_attempt !== source.run_attempt || run.repository?.full_name !== repository ||
+      run.head_repository?.full_name !== repository || run.event !== "pull_request" || run.status !== "completed" ||
+      !sha.test(run.head_sha) || !positive(run.run_number) || !positive(run.workflow_id)) {
+    throw new Error("Untrusted or incomplete source workflow run.");
+  }
+  const workflow = await api(`${endpoint}/actions/workflows/${run.workflow_id}`);
+  if (workflow.path !== sourceWorkflow) throw new Error("Unexpected source workflow path.");
+  if (!Array.isArray(run.pull_requests) || run.pull_requests.length !== 1 ||
+      !positive(run.pull_requests[0].number) || !sha.test(run.pull_requests[0].head?.sha) ||
+      source.pull_requests?.[0]?.number !== run.pull_requests[0].number) {
+    throw new Error("Cannot establish the source run's PR association.");
+  }
+  return {
+    repository, run: String(run.id), attempt: String(run.run_attempt), runNumber: run.run_number,
+    pullNumber: run.pull_requests[0].number, head: run.pull_requests[0].head.sha, runHead: run.head_sha,
+  };
+}
+
+function artifact(root, name) {
+  const file = resolve(root, name);
+  const rel = relative(realpathSync(root), realpathSync(file));
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel) ||
+      !lstatSync(file).isFile() || statSync(file).size > 1024 * 1024) {
+    throw new Error("Expected a bounded regular comparison artifact inside the download directory.");
+  }
+  return json(file);
+}
+
+export async function validateSelection(selection, context, api = github) {
+  if (!selection || !sha.test(selection.base) || !sha.test(selection.head) || !sha.test(selection.merge) ||
+      selection.repository !== context.repository || selection.run !== context.run || selection.attempt !== context.attempt ||
+      selection.head !== context.head || ![selection.head, selection.merge].includes(context.runHead) ||
+      !Array.isArray(selection.include) || !Array.isArray(selection.changed) || !Array.isArray(selection.skills) ||
+      !selection.changed.every(skillKey) || new Set(selection.changed).size !== selection.changed.length ||
+      !selection.skills.every((skill) => skillKey(skill?.key) && typeof skill.hasEval === "boolean") ||
+      new Set(selection.skills.map((skill) => skill.key)).size !== selection.skills.length) {
+    throw new Error("Comparison selection does not match the authenticated source run.");
+  }
+  const ids = new Set(), keys = new Set();
+  for (const entry of selection.include) {
+    const key = `${entry?.plugin}/${entry?.skill}`;
+    if (!skillKey(key) || !/^skill-[a-f0-9]{12}$/.test(entry.id ?? "") || ids.has(entry.id) || keys.has(key) ||
+        !selection.changed.includes(key) || entry.directory !== `plugins/${key.replace("/", "/skills/")}` ||
+        entry.evalPath !== `evals/${key.replace("/", "/skills/")}/eval.yaml` ||
+        entry.base !== selection.base || entry.head !== selection.head) throw new Error("Invalid comparison selection entry.");
+    ids.add(entry.id); keys.add(key);
+  }
+  const commit = await api(`repos/${context.repository}/git/commits/${selection.merge}`);
+  if (commit.sha !== selection.merge || commit.parents?.length !== 2 ||
+      commit.parents[0].sha !== selection.base || commit.parents[1].sha !== selection.head) {
+    throw new Error("Comparison merge parents do not match the selected source revisions.");
+  }
+}
+
+function safeArm(data) {
+  if (!data || !["complete", "error", "not-run"].includes(data.state) || !Array.isArray(data.rows)) {
+    throw new Error("Invalid comparison arm.");
+  }
+  const identities = new Set();
+  const rows = data.rows.map((row) => {
+    if (!row || !["graded", "error", "not-run"].includes(row.state) || typeof row.passed !== "boolean" ||
+        row.state !== "graded" && row.passed || !Array.isArray(row.checks) ||
+        ![row.eval, row.stimulus, row.model].every((label) => typeof label === "string" && label.length > 0 && label.length <= 200)) {
+      throw new Error("Invalid comparison case.");
+    }
+    const key = JSON.stringify([row.eval, row.stimulus, row.model]);
+    if (identities.has(key)) throw new Error("Duplicate comparison case.");
+    identities.add(key);
+    const checkIds = new Set();
+    const checks = row.checks.map((check) => {
+      if (!/^\d+:[a-z0-9._-]+$/.test(check?.id ?? "") || checkIds.has(check.id) ||
+          typeof check.passed !== "boolean" || typeof check.name !== "string") throw new Error("Invalid comparison check.");
+      checkIds.add(check.id);
+      return { id: check.id, name: text(check.name), passed: check.passed,
+        reason: check.passed ? "" : failedReason(check.id.split(":")[1]) };
+    });
+    if (row.state === "graded" && !checks.length) throw new Error("Missing comparison checks.");
+    return { eval: text(row.eval), stimulus: text(row.stimulus), model: text(row.model), state: row.state, passed: row.passed, checks };
+  });
+  return { state: data.state, rows };
+}
+
+export async function loadComparison(root, context, api = github) {
+  const selection = artifact(root, "selection.json");
+  await validateSelection(selection, context, api);
+  const pairs = selection.include.map((entry) => {
+    const pair = { key: `${entry.plugin}/${entry.skill}` };
+    for (const arm of ["before", "after"]) {
+      const file = `${entry.id}-${arm}.json`;
+      if (!existsSync(resolve(root, file))) { pair[arm] = { state: "error", rows: [] }; continue; }
+      const saved = artifact(root, file);
+      if (saved.key !== pair.key || saved.id !== entry.id || saved.arm !== arm ||
+          saved.repository !== context.repository || saved.run !== context.run ||
+          saved.attempt !== context.attempt || saved.merge !== selection.merge) throw new Error("Mixed comparison artifacts.");
+      pair[arm] = safeArm(saved.data);
+    }
+    return pair;
+  });
+  return { selection, pairs };
+}
+
+export async function postComparison(selection, body, api = github, context) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(context?.repository ?? "") || !positive(context.pullNumber)) throw new Error("Invalid PR context.");
+  const endpoint = `repos/${context.repository}`;
+  const pr = await api(`${endpoint}/pulls/${context.pullNumber}`);
+  if (pr.state !== "open" || pr.head.sha !== selection.head || pr.head.repo.full_name !== context.repository) {
     throw new Error("PR closed, head changed, or fork context; no comment published.");
   }
-  const key = `${marker}${env.GITHUB_WORKFLOW_REF} -->`;
+  const key = `${marker}${context.repository}/${sourceWorkflow} -->`;
   const comments = [];
   for (let page = 1; ; page++) {
-    const batch = await api(`${endpoint}/issues/${env.PR_NUMBER}/comments?per_page=100&page=${page}`);
+    const batch = await api(`${endpoint}/issues/${context.pullNumber}/comments?per_page=100&page=${page}`);
     comments.push(...batch);
     if (batch.length < 100) break;
   }
   const existing = comments.find((comment) => comment.user?.login === "github-actions[bot]" && comment.body.startsWith(key));
-  const order = [Number(env.GITHUB_RUN_NUMBER), Number(env.GITHUB_RUN_ATTEMPT)];
+  const order = [context.runNumber, Number(context.attempt)];
   if (!order.every((n) => Number.isSafeInteger(n) && n > 0)) throw new Error("Invalid workflow run order.");
   const previous = existing?.body.match(/<!-- run:(\d+):(\d+) -->/);
   if (previous && (Number(previous[1]) > order[0] || Number(previous[1]) === order[0] && Number(previous[2]) > order[1])) return "stale";
   const content = `${key}\n<!-- run:${order.join(":")} -->\n${body}`;
   if (content.length > 60000) throw new Error("Comparison exceeds the comment limit; no misleading truncated report published.");
-  return api(existing ? `${endpoint}/issues/comments/${existing.id}` : `${endpoint}/issues/${env.PR_NUMBER}/comments`,
+  return api(existing ? `${endpoint}/issues/comments/${existing.id}` : `${endpoint}/issues/${context.pullNumber}/comments`,
     existing ? "PATCH" : "POST", { body: content });
 }
 
@@ -332,23 +444,10 @@ async function main() {
       data: collectArm(report, logs),
     });
   } else if (command === "post") {
-    const selection = json(resolve(path, "selection.json"));
-    validateIdentity(selection, process.env);
-    const pairs = selection.include.map((entry) => {
-      const pair = { key: `${entry.plugin}/${entry.skill}` };
-      for (const arm of ["before", "after"]) {
-        const file = resolve(path, `${entry.id}-${arm}.json`);
-        if (!existsSync(file)) { pair[arm] = { state: "error", rows: [] }; continue; }
-        const saved = json(file);
-        if (saved.key !== pair.key || saved.id !== entry.id || saved.arm !== arm ||
-          saved.repository !== selection.repository || saved.run !== selection.run ||
-          saved.attempt !== selection.attempt || saved.merge !== selection.merge) throw new Error("Mixed comparison artifacts.");
-        pair[arm] = saved.data;
-      }
-      return pair;
-    });
+    const context = await publisherContext(json(process.env.GITHUB_EVENT_PATH));
+    const { selection, pairs } = await loadComparison(resolve(path), context);
     const evidence = `${process.env.GITHUB_SERVER_URL}/${selection.repository}/actions/runs/${selection.run}`;
-    console.log(JSON.stringify(await postComparison(selection, renderComparison(selection, pairs, evidence))));
+    console.log(JSON.stringify(await postComparison(selection, renderComparison(selection, pairs, evidence), github, context)));
   } else throw new Error("Expected collect or post.");
 }
 
diff --git a/.github/scripts/skill-eval-comment.test.mjs b/.github/scripts/skill-eval-comment.test.mjs
index 11727e0..34bf43d 100644
--- a/.github/scripts/skill-eval-comment.test.mjs
+++ b/.github/scripts/skill-eval-comment.test.mjs
@@ -5,7 +5,7 @@ import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { collectArm, inventorySkills, postComparison, projectTrials, renderComparison } from "./skill-eval-comment.mjs";
+import { collectArm, inventorySkills, loadComparison, postComparison, projectTrials, publisherContext, renderComparison, validateSelection } from "./skill-eval-comment.mjs";
 
 const trial = (extra = {}) => ({
   type: "trial-result", runId: "native", evalName: "draft", stimulus: "draft-positive", model: "model-a", variant: "main",
@@ -128,10 +128,7 @@ test("catalog inventory enumerates local and exact pinned remote skill folders w
 });
 
 test("comment publishing checks current PR head, bot ownership, run order and updates only one comment", async () => {
-  const env = {
-    GITHUB_REPOSITORY: "example/repo", PR_NUMBER: "2", GITHUB_WORKFLOW_REF: "example/repo/.github/workflows/skill-evals.yml@refs/pull/2/merge",
-    GITHUB_RUN_NUMBER: "5", GITHUB_RUN_ATTEMPT: "1",
-  };
+  const context = { repository: "example/repo", pullNumber: 2, runNumber: 5, attempt: "1" };
   const calls = [];
   let head = selection.head, comments = [];
   const api = async (endpoint, method = "GET", body) => {
@@ -140,17 +137,86 @@ test("comment publishing checks current PR head, bot ownership, run order and up
     if (method === "GET") return comments;
     return { id: 8 };
   };
-  await postComparison(selection, "Report", api, env);
+  await postComparison(selection, "Report", api, context);
   assert.equal(calls.at(-1).method, "POST");
   comments = [{ id: 8, user: { login: "github-actions[bot]" }, body: calls.at(-1).body.body }];
   calls.length = 0;
-  await postComparison(selection, "Updated", api, env);
+  await postComparison(selection, "Updated", api, context);
   assert.equal(calls.at(-1).method, "PATCH");
   assert.match(calls.at(-1).endpoint, /issues\/comments\/8$/);
   comments[0].body = comments[0].body.replace("run:5:1", "run:6:1");
-  assert.equal(await postComparison(selection, "Older", api, env), "stale");
+  assert.equal(await postComparison(selection, "Older", api, context), "stale");
   head = "c".repeat(40);
-  await assert.rejects(postComparison(selection, "Wrong head", api, env), /head changed/);
+  await assert.rejects(postComparison(selection, "Wrong head", api, context), /head changed/);
+});
+
+function sourceFixture() {
+  const context = { repository: "example/repo", run: "11", attempt: "2", runNumber: 5,
+    pullNumber: 2, head: selection.head, runHead: "c".repeat(40) };
+  const selected = {
+    ...selection, repository: context.repository, run: context.run, attempt: context.attempt, merge: context.runHead,
+    include: [{ id: "skill-aaaaaaaaaaaa", plugin: "local", skill: "draft", directory: "plugins/local/skills/draft",
+      evalPath: "evals/local/skills/draft/eval.yaml", base: selection.base, head: selection.head }],
+  };
+  const source = { id: 11, run_attempt: 2, pull_requests: [{ number: 2 }] };
+  const run = { ...source, repository: { full_name: context.repository }, head_repository: { full_name: context.repository },
+    event: "pull_request", status: "completed", conclusion: "failure", head_sha: context.runHead,
+    run_number: 5, workflow_id: 7, pull_requests: [{ number: 2, head: { sha: selection.head } }] };
+  const api = async (endpoint) => {
+    if (endpoint.endsWith("/actions/runs/11/attempts/2")) return run;
+    if (endpoint.endsWith("/actions/workflows/7")) return { path: ".github/workflows/skill-evals.yml" };
+    if (endpoint.endsWith(`/git/commits/${selected.merge}`)) return {
+      sha: selected.merge, parents: [{ sha: selected.base }, { sha: selected.head }],
+    };
+    throw new Error("Unexpected test API request.");
+  };
+  return { context, selected, source, run, api };
+}
+
+test("publisher authenticates workflow, source attempt and PR independently from its own run", async () => {
+  const { context, source, run, api } = sourceFixture();
+  const env = { GITHUB_EVENT_NAME: "workflow_run", GITHUB_REPOSITORY: context.repository,
+    GITHUB_RUN_ID: "999", GITHUB_RUN_ATTEMPT: "7", GITHUB_SHA: "d".repeat(40) };
+  assert.deepEqual(await publisherContext({ workflow_run: source }, api, env), context);
+  await assert.rejects(publisherContext({ workflow_run: source }, api, { ...env, GITHUB_EVENT_NAME: "pull_request" }), /workflow_run/);
+  for (const change of [
+    { event: "workflow_dispatch" }, { head_repository: { full_name: "fork/repo" } },
+    { repository: { full_name: "other/repo" } }, { pull_requests: [] }, { run_attempt: 1 },
+  ]) {
+    await assert.rejects(publisherContext({ workflow_run: source }, async (endpoint) =>
+      endpoint.includes("/actions/runs/") ? { ...run, ...change } : api(endpoint), env));
+  }
+  await assert.rejects(publisherContext({ workflow_run: source }, async (endpoint) =>
+    endpoint.includes("/actions/workflows/") ? { path: ".github/workflows/spoofed.yml" } : api(endpoint), env), /workflow path/);
+});
+
+test("untrusted artifacts are bounded data, source-bound and re-sanitized before rendering", async (t) => {
+  const root = mkdtempSync(join(tmpdir(), "comparison-publisher-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const { selected, context, api } = sourceFixture();
+  writeFileSync(join(root, "selection.json"), JSON.stringify(selected));
+  const arm = {
+    id: selected.include[0].id, key: "local/draft", arm: "before", repository: context.repository,
+    run: context.run, attempt: context.attempt, merge: selected.merge,
+    data: pair().before,
+  };
+  arm.data.rows[0].model = "@everyone | <script>bad</script>";
+  arm.data.rows[0].checks[1].reason = "SECRET_UNTRUSTED_EVIDENCE";
+  writeFileSync(join(root, `${arm.id}-before.json`), JSON.stringify(arm));
+  const loaded = await loadComparison(root, context, api);
+  const rendered = renderComparison(loaded.selection, loaded.pairs, "https://example.test");
+  assert.doesNotMatch(rendered, /<script>|@everyone|SECRET_UNTRUSTED_EVIDENCE/);
+  assert.match(rendered, /Required activation/);
+  assert.match(rendered, /⚠️ Error/);
+  await assert.rejects(validateSelection({ ...selected, attempt: "1" }, context, api), /authenticated source/);
+  await assert.rejects(validateSelection({ ...selected, include: [{ ...selected.include[0], id: "../../outside" }] }, context, api), /selection entry/);
+  await assert.rejects(validateSelection(selected, context, async () => ({
+    sha: selected.merge, parents: [{ sha: selected.head }, { sha: selected.base }],
+  })), /merge parents/);
+  writeFileSync(join(root, `${arm.id}-before.json`), JSON.stringify({ ...arm, attempt: "1" }));
+  await assert.rejects(loadComparison(root, context, api), /Mixed comparison artifacts/);
+  writeFileSync(join(root, "selection.json"), " ".repeat(1024 * 1024 + 1));
+  await assert.rejects(loadComparison(root, context, api), /bounded regular/);
 });
 
 test("collect CLI binds native Action diagnostics to this selection without publishing raw evidence", (t) => {
diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index 5cbc8a4..b8702a7 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -424,23 +424,30 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     assert.equal(actions[1].if, "${{ !cancelled() && steps.after_source.outcome == 'success' }}");
     assert.equal(job.steps.find((step) => step.id === "after_source").if,
       "${{ !cancelled() && steps.before_source.outcome == 'success' }}");
-    const comment = workflow.jobs.comment;
+    assert.equal(workflow.jobs.comment, undefined, "PR-controlled jobs must not publish with write permission");
+    for (const step of Object.values(workflow.jobs)) assert.equal(step.permissions?.["pull-requests"], undefined);
+    const publisher = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
+    assert.deepEqual(publisher.on, { workflow_run: { workflows: ["Skill evals (before and after)"], types: ["completed"] } });
+    assert.deepEqual(publisher.permissions, {});
+    const comment = publisher.jobs.publish;
     assert.deepEqual(comment.permissions, { contents: "read", actions: "read", "pull-requests": "write" });
-    assert.deepEqual(comment.needs, ["select", "evals"]);
+    assert.equal(comment.permissions["copilot-requests"], undefined);
     assert.equal(comment.concurrency["cancel-in-progress"], false);
-    assert.match(comment.if, /!cancelled\(\)/);
+    assert.match(comment.if, /workflow_run\.event == 'pull_request'/);
     assert.ok(comment.steps.some((step) => step.run?.includes("skill-eval-comment.mjs post")));
-    assert.equal(comment.steps.find((step) => step.uses?.startsWith("actions/download-artifact@")).with.pattern,
-      "skill-comparison-${{ github.run_attempt }}-*");
+    const download = comment.steps.find((step) => step.uses?.startsWith("actions/download-artifact@")).with;
+    assert.equal(download.pattern, "skill-comparison-${{ github.event.workflow_run.run_attempt }}-*");
+    assert.equal(download["run-id"], "${{ github.event.workflow_run.id }}");
+    assert.equal(download.path, "${{ runner.temp }}/skill-comparison");
+    assert.equal(download["github-token"], "${{ github.token }}");
     for (const step of [...workflow.jobs.select.steps, ...job.steps].filter((step) => step.uses?.startsWith("actions/upload-artifact@"))) {
       assert.match(step.with.name, /github\.run_attempt/, "reruns must not collide with or import earlier-attempt artifacts");
     }
     assert.equal(job.permissions["pull-requests"], undefined);
     assert.equal(comment.steps.find((step) => step.uses?.startsWith("actions/checkout@")).with.ref,
-      "${{ github.event.pull_request.base.sha }}");
-    assert.match(comment.steps.find((step) => step.name?.includes("trusted base")).run,
-      /Merge the reviewed publisher into the base branch/);
-    for (const guarded of [job, comment]) {
+      "${{ github.sha }}", "workflow_run's default-branch SHA, never the PR head, supplies executable publishing code");
+    assert.doesNotMatch(comment.steps.map((step) => step.run ?? "").join("\n"), /npm |evals-action|git fetch|gh pr checkout/);
+    for (const guarded of [job]) {
       assert.equal(guarded.steps[0].env.SELECTED_ATTEMPT, "${{ needs.select.outputs.attempt }}");
       for (const attempt of ["1", "2"]) {
         const checked = spawnSync("bash", ["-c", guarded.steps[0].run], {
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
new file mode 100644
index 0000000..8998c90
--- /dev/null
+++ b/.github/workflows/skill-eval-comment.yml
@@ -0,0 +1,38 @@
+name: Publish skill eval comparison
+on:
+  workflow_run:
+    workflows: ["Skill evals (before and after)"]
+    types: [completed]
+permissions: {}
+jobs:
+  publish:
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.head_repository.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    concurrency:
+      group: skill-eval-comment-${{ github.event.workflow_run.pull_requests[0].number }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+      - name: Download only the triggering run and attempt into temporary data storage
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          pattern: skill-comparison-${{ github.event.workflow_run.run_attempt }}-*
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+          merge-multiple: true
+          path: ${{ runner.temp }}/skill-comparison
+      - name: Validate source provenance and publish with trusted code
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node .github/scripts/skill-eval-comment.mjs post "$RUNNER_TEMP/skill-comparison"
diff --git a/.github/workflows/skill-evals.yml b/.github/workflows/skill-evals.yml
index e0808a8..7373e6c 100644
--- a/.github/workflows/skill-evals.yml
+++ b/.github/workflows/skill-evals.yml
@@ -216,49 +216,3 @@ jobs:
           path: ${{ runner.temp }}/skill-comparison/*.json
           if-no-files-found: error
           retention-days: 7
-
-  comment:
-    needs: [select, evals]
-    if: ${{ !cancelled() && needs.select.result == 'success' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: skill-eval-comment-${{ github.event.pull_request.number }}
-      cancel-in-progress: false
-    permissions:
-      contents: read
-      actions: read
-      pull-requests: write
-    steps:
-      - name: Reject stale selection on comment-only retries
-        env:
-          SELECTED_ATTEMPT: ${{ needs.select.outputs.attempt }}
-        run: |
-          if [[ "$SELECTED_ATTEMPT" != "$GITHUB_RUN_ATTEMPT" ]]; then
-            echo "::error::Partial job retries are unsupported. Use Re-run all jobs so selection and both arms share one attempt."
-            exit 1
-          fi
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: 24
-      - name: Require the publisher on the trusted base revision
-        run: |
-          test -f .github/scripts/skill-eval-comment.mjs || {
-            echo "::error::Merge the reviewed publisher into the base branch before enabling comparison comments."
-            exit 1
-          }
-      - name: Read this run's comparison evidence only
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
-        with:
-          pattern: skill-comparison-${{ github.run_attempt }}-*
-          merge-multiple: true
-          path: ${{ runner.temp }}/skill-comparison
-      - name: Update the PR comparison comment without model access
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: node .github/scripts/skill-eval-comment.mjs post "$RUNNER_TEMP/skill-comparison"
diff --git a/README.md b/README.md
index 8179784..22f1f28 100644
--- a/README.md
+++ b/README.md
@@ -203,6 +203,9 @@ required in the protected `evals` environment. Fork PRs do not run paid evals.
 The workflow updates one PR comment with per-case grader counts, failure
 details, and an all-skills coverage table. Unmeasured skills are marked not run;
 the comment does not imply a full-marketplace or multi-model run.
+Publication uses a separate [trusted `workflow_run` workflow](.github/workflows/skill-eval-comment.yml),
+not PR-controlled code with comment-write access. The paid-execution approval
+boundary remains a separate [documented integration gap](docs/checks-and-evals.md#pr-comparison-comment).
 
 See [Checks and evals](docs/checks-and-evals.md) for CI details, local test
 commands, and Bash and PowerShell eval setup.
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index d729f0a..ba3eb09 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -190,30 +190,54 @@ failed, not a generated diagnosis; the evidence link leads to this workflow's
 native summaries and derived artifacts. Structured/derived artifacts use seven-day
 retention, subject to repository policy.
 
-The comment job has `actions: read` and `pull-requests: write`, but no model-billing
-permission. Paid jobs have no comment-write permission. Publishing checks the
-live PR head, refuses forks/closed PRs, and updates only its own bot comment;
-serialized publishing and run/attempt ordering prevent older runs replacing
-newer comments. No custom Run button, new trigger or branch-protection change is
-introduced. The layout supports multiple observed models without selecting or
-paying for additional models automatically.
-
-The publisher checks out the exact base SHA, never the PR's helper. Its reviewed
-helper must already exist on that trusted revision; otherwise publication fails
-closed. Workflow-level per-PR concurrency cancels stale runs before more work is
-scheduled. Cancellation cannot undo already billed model requests.
-
-**Partial job reruns are unsupported.** Use **Re-run all jobs** so selection and
+Publication follows GitHub's standard
+[unprivileged PR / trusted `workflow_run` pattern](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/).
+The PR's selection/collection code has no comment-write permission. The separate
+[publisher](../.github/workflows/skill-eval-comment.yml) runs its workflow and
+helper from its exact default-branch `GITHUB_SHA`, with `contents: read`,
+`actions: read`, and `pull-requests: write`, but no model-billing permission.
+It never checks out the PR, installs PR dependencies, runs its grader/setup code,
+or executes downloaded artifacts. This workflow and helper must first be merged
+into the default branch before automatic publication can run.
+
+Artifacts are untrusted data, not trusted because `workflow_run` downloaded
+them. Downloads select the triggering run and its producing attempt, into
+temporary storage outside the executable checkout. The trusted helper verifies
+the source workflow path, repository, completed PR event, run/attempt, PR
+association, current PR head, and merge parents against GitHub's API. It reads
+only bounded regular JSON files at expected names, validates case/check shapes,
+escapes labels, and derives failure explanations instead of trusting arbitrary
+artifact messages. Mixed, malformed, oversized, or ambiguous data fails closed.
+These checks do not make results supplied by PR-controlled code an independent
+attestation of that code's correctness.
+
+Publishing updates only its own bot comment. Per-PR serialization and the
+**source** run/attempt order prevent older results replacing newer comments;
+the publisher's own run number is not used as measurement provenance.
+Workflow-level per-PR concurrency cancels stale producing runs, but cannot undo
+already billed model requests. No custom Run button, GitHub App, billing setting,
+or branch-protection change is introduced.
+
+**Partial producing-job reruns are unsupported.** Use **Re-run all jobs** so selection and
 both paid arms share an attempt and approval. A retry reusing a successful
 selection from a previous attempt is rejected before either paid arm, rather
-than spending credits and then failing to collect its artifacts. This also
-applies to comment-only retries.
+than spending credits and then failing to collect its artifacts. Retrying the
+separate publication workflow reuses the original source run/attempt and never
+repeats paid evals.
 
 **Approval boundary:** required environment reviewers protect jobs that reference
 that environment, not every job an authorized workflow editor could add.
 `copilot-requests: write` is a workflow-token permission, not an environment
 secret. These declarations are not an immutable organization-wide billing
-policy. A trusted publishing checkout also does not make the surrounding
-PR-editable workflow immutable. Do not treat this workflow as a security boundary
-against untrusted workflow editors; the trusted-entrypoint/billing design remains
-under review before enabling it.
+policy. The publication split fixes comment-write privilege separation, not the
+paid job's independent approval boundary.
+
+**Remaining paid-entrypoint gap:** the pinned native Action supports
+`pull_request`, `push`, and `workflow_dispatch`, but rejects `workflow_run`
+([source](https://github.com/github/evals-action/blob/6e4c077e92194c7e75663d8d782426841047e887/src/policy.ts#L9-L27)).
+Paid execution therefore still uses the existing PR-event route and must not be
+treated as secure against untrusted workflow editors. Moving that job behind a
+trusted `workflow_run` approval gate needs supported Action functionality or the
+existing native Vally CLI directly. Do not spoof a PR event or imply that moving
+the publisher has also solved billing authorization. No authentication or
+organization policy was changed by this publication implementation.

From 4430df5552a5b5eb41017ca68d7f3a5eecf692f3 Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 10:52:29 -0800
Subject: [PATCH 05/14] Move paid skill comparisons behind the trusted native
 Vally entrypoint

Keep the PR notifier read-only and use default-branch workflow_run code for selection, environment-approved native CLI execution, and separate fresh-runner publication. Pin Vally 0.21 outside the candidate checkout without spoofing GitHub events. Bind selected revisions and producing attempts, preserve partial grading failures and escape labels once. Track supported Action migration in github/evals-action#26; owner billing policy and approved candidate credential exposure remain explicit.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/skill-eval-comment.mjs      | 114 +++++----
 .github/scripts/skill-eval-comment.test.mjs | 103 +++++----
 .github/scripts/validation.test.mjs         | 133 ++++++++---
 .github/workflows/skill-eval-comment.yml    | 243 +++++++++++++++++++-
 .github/workflows/skill-evals.yml           | 206 +----------------
 README.md                                   |   8 +-
 docs/checks-and-evals.md                    |  97 ++++----
 7 files changed, 532 insertions(+), 372 deletions(-)

diff --git a/.github/scripts/skill-eval-comment.mjs b/.github/scripts/skill-eval-comment.mjs
index 2dcefd8..325e62d 100644
--- a/.github/scripts/skill-eval-comment.mjs
+++ b/.github/scripts/skill-eval-comment.mjs
@@ -11,12 +11,13 @@ const sourceWorkflow = ".github/workflows/skill-evals.yml";
 const skillKey = (value) => typeof value === "string" && value.split("/").length === 2 &&
   value.split("/").every((part) => safeName.test(part));
 const positive = (value) => Number.isSafeInteger(value) && value > 0;
-const text = (value) => stripVTControlCharacters(String(value ?? ""))
+const label = (value) => stripVTControlCharacters(String(value ?? ""))
   // eslint-disable-next-line no-control-regex
-  .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/gu, " ")
+  .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/gu, " ").slice(0, 200);
+const text = (value) => label(value)
   .replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
   .replaceAll("|", "&#124;").replaceAll("`", "&#96;").replaceAll("[", "&#91;").replaceAll("]", "&#93;")
-  .replaceAll("@", "&#64;").slice(0, 200);
+  .replaceAll("@", "&#64;");
 const json = (path) => {
   const contents = readFileSync(path, "utf8");
   try { return JSON.parse(contents); } catch { throw new Error("Malformed comparison JSON input."); }
@@ -100,39 +101,39 @@ export function projectTrials(records, expectedRunId) {
     if (state === "graded" && (typeof grade.passed !== "boolean" || !Array.isArray(grade.details) || !grade.details.length)) {
       throw new Error("Native individual grader evidence is missing.");
     }
-    const checks = state !== "graded" ? [] : grade.details.map((check, index) => {
-      if (typeof check.passed !== "boolean") throw new Error("Invalid native grader verdict.");
+    const checks = (grade?.details ?? []).flatMap((check, index) => {
+      if (check.status === "error") return [];
+      if (typeof check.passed !== "boolean") {
+        if (state !== "graded") return [];
+        throw new Error("Invalid native grader verdict.");
+      }
       const type = check.graderType ?? check.kind ?? "check";
-      return {
+      return [{
         id: `${index}:${type}`,
-        name: text(check.configuredName ?? check.name ?? type),
+        name: label(check.configuredName ?? check.name ?? type),
         passed: check.passed,
         // Never publish trajectories, raw grader output or exception strings.
         reason: check.passed ? "" : failedReason(type),
-      };
+      }];
     });
-    return { eval: text(row.evalName), stimulus: text(row.stimulus), model: text(model), state, passed: state === "graded" && grade.passed, checks };
+    return { eval: label(row.evalName), stimulus: label(row.stimulus), model: label(model), state, passed: state === "graded" && grade.passed, checks };
   });
 }
 
-export function collectArm(report, logs) {
-  if (!report || report.schemaVersion !== 2 || report.command !== "run") {
-    return { state: "error", code: "missing-action-report", rows: [] };
-  }
-  if (!report.nativeRunId) return { state: report.outcome === "not-run" ? "not-run" : "error", code: report.code, rows: [] };
-  const matches = [];
-  for (const log of logs) {
-    if (!log.trimStart().startsWith("{")) continue; // The Action also retains its plain version check.
-    let records;
-    try { records = log.split(/\r?\n/).filter((line) => line.trim()).map((line) => JSON.parse(line)); }
-    catch { throw new Error("Malformed native JSONL evidence."); }
-    if (records[0]?.runId === report.nativeRunId) matches.push(records);
+export function collectNative(contents, runId, exitCode) {
+  let records;
+  try { records = contents.split(/\r?\n/).filter((line) => line.trim()).map((line) => JSON.parse(line)); }
+  catch { throw new Error("Malformed native JSONL evidence."); }
+  if (!records.length) return { state: "error", rows: [] };
+  const rows = projectTrials(records, runId);
+  const summary = records.at(-1);
+  if (typeof summary.hadExecutionErrors !== "boolean" || typeof summary.passed !== "boolean") {
+    throw new Error("Invalid native completion verdict.");
   }
-  if (matches.length !== 1) throw new Error("Expected exactly one native JSONL log for this Action run.");
   return {
-    state: report.completeness === "complete" && !["error", "cancelled"].includes(report.outcome) ? "complete" : "error",
-    code: report.code,
-    rows: projectTrials(matches[0], report.nativeRunId),
+    state: [0, 1].includes(exitCode) && !summary.hadExecutionErrors && (!summary.passed || exitCode === 0) &&
+      !rows.some((row) => row.state === "error") ? rows.length ? "complete" : "not-run" : "error",
+    rows,
   };
 }
 
@@ -320,7 +321,10 @@ function artifact(root, name) {
 export async function validateSelection(selection, context, api = github) {
   if (!selection || !sha.test(selection.base) || !sha.test(selection.head) || !sha.test(selection.merge) ||
       selection.repository !== context.repository || selection.run !== context.run || selection.attempt !== context.attempt ||
-      selection.head !== context.head || ![selection.head, selection.merge].includes(context.runHead) ||
+      selection.head !== context.head ||
+      selection.sourceRun !== context.sourceRun || selection.sourceAttempt !== context.sourceAttempt ||
+      selection.trusted !== context.trusted ||
+      selection.base !== context.base || selection.merge !== context.merge ||
       !Array.isArray(selection.include) || !Array.isArray(selection.changed) || !Array.isArray(selection.skills) ||
       !selection.changed.every(skillKey) || new Set(selection.changed).size !== selection.changed.length ||
       !selection.skills.every((skill) => skillKey(skill?.key) && typeof skill.hasEval === "boolean") ||
@@ -343,6 +347,20 @@ export async function validateSelection(selection, context, api = github) {
   }
 }
 
+export async function comparisonContext(event, api = github, env = process.env, producingAttempt = env.GITHUB_RUN_ATTEMPT) {
+  const source = await publisherContext(event, api, env);
+  if (!sha.test(env.GITHUB_SHA ?? "") || !/^[1-9]\d*$/.test(env.GITHUB_RUN_ID ?? "") ||
+      !/^[1-9]\d*$/.test(env.GITHUB_RUN_ATTEMPT ?? "") || !/^[1-9]\d*$/.test(env.GITHUB_RUN_NUMBER ?? "") ||
+      !/^[1-9]\d*$/.test(producingAttempt ?? "") || Number(producingAttempt) > Number(env.GITHUB_RUN_ATTEMPT)) {
+    throw new Error("Invalid trusted comparison workflow identity.");
+  }
+  return {
+    ...source, sourceRun: source.run, sourceAttempt: source.attempt,
+    run: env.GITHUB_RUN_ID, attempt: producingAttempt,
+    runNumber: Number(env.GITHUB_RUN_NUMBER), trusted: env.GITHUB_SHA,
+  };
+}
+
 function safeArm(data) {
   if (!data || !["complete", "error", "not-run"].includes(data.state) || !Array.isArray(data.rows)) {
     throw new Error("Invalid comparison arm.");
@@ -416,39 +434,49 @@ export async function postComparison(selection, body, api = github, context) {
 }
 
 function validateIdentity(selection, env) {
-  if (!sha.test(selection.base) || !sha.test(selection.head) || selection.merge !== env.GITHUB_SHA ||
+  if (!sha.test(selection.base) || !sha.test(selection.head) || selection.trusted !== env.GITHUB_SHA ||
       selection.repository !== env.GITHUB_REPOSITORY || selection.run !== env.GITHUB_RUN_ID ||
       selection.attempt !== env.GITHUB_RUN_ATTEMPT) throw new Error("Comparison artifact context changed.");
 }
 
 async function main() {
   const [command, path] = process.argv.slice(2);
-  if (command === "collect") {
+  if (command === "context") {
+    const context = await comparisonContext(json(process.env.GITHUB_EVENT_PATH));
+    const pr = await github(`repos/${context.repository}/pulls/${context.pullNumber}`);
+    if (pr.state !== "open" || pr.head?.sha !== context.head || pr.head?.repo?.full_name !== context.repository ||
+        !sha.test(pr.base?.sha ?? "") || !sha.test(pr.merge_commit_sha ?? "")) {
+      throw new Error("Source PR closed, changed, forked or lacks a verifiable merge revision.");
+    }
+    const selected = { ...context, base: pr.base.sha, merge: pr.merge_commit_sha };
+    writeJson(path, selected);
+    for (const [key, value] of Object.entries({ context: JSON.stringify(selected), merge: selected.merge })) {
+      writeFileSync(process.env.GITHUB_OUTPUT, `${key}=${value}\n`, { flag: "a" });
+    }
+  } else if (command === "native") {
     const selection = json(resolve(process.env.SELECTION_FILE));
     validateIdentity(selection, process.env);
     const entry = selection.include.find((item) => item.id === process.env.COMPARISON_ID);
     if (!entry || !["before", "after"].includes(process.env.ARM)) throw new Error("Unknown comparison arm.");
-    const report = process.env.ACTION_REPORT && existsSync(process.env.ACTION_REPORT) ? json(process.env.ACTION_REPORT) : undefined;
-    if (report && (report.reportId !== `${entry.id}-${process.env.ARM}` ||
-      report.revision !== selection.merge || String(report.workflowRunId) !== selection.run ||
-      String(report.workflowRunAttempt) !== selection.attempt || report.repository !== selection.repository)) throw new Error("Action report identity changed.");
-    const logs = process.env.NATIVE_DIRECTORY && existsSync(process.env.NATIVE_DIRECTORY)
-      ? readdirSync(process.env.NATIVE_DIRECTORY).filter((file) => file.endsWith(".stdout.log")).map((file) => {
-        const source = resolve(process.env.NATIVE_DIRECTORY, file);
-        if (statSync(source).size > 64 * 1024 * 1024) throw new Error("Native log exceeds supported size.");
-        return readFileSync(source, "utf8");
-      }) : [];
+    const native = resolve(process.env.NATIVE_FILE);
+    if (statSync(native).size > 64 * 1024 * 1024) throw new Error("Native log exceeds supported size.");
+    const data = collectNative(readFileSync(native, "utf8"), process.env.NATIVE_RUN_ID, Number(process.env.NATIVE_EXIT));
     writeJson(resolve(path, `${entry.id}-${process.env.ARM}.json`), {
       id: entry.id, key: `${entry.plugin}/${entry.skill}`, arm: process.env.ARM,
-      repository: selection.repository, run: selection.run, attempt: selection.attempt, merge: selection.merge,
-      data: collectArm(report, logs),
+      repository: selection.repository, run: selection.run, attempt: selection.attempt, merge: selection.merge, data,
     });
+    if (data.state === "error") throw new Error("Native execution/grading evidence is incomplete or erroneous; inspect the approved run locally.");
   } else if (command === "post") {
-    const context = await publisherContext(json(process.env.GITHUB_EVENT_PATH));
+    const authenticated = await comparisonContext(json(process.env.GITHUB_EVENT_PATH), github, process.env,
+      process.env.PRODUCING_ATTEMPT ?? process.env.GITHUB_RUN_ATTEMPT);
+    const context = JSON.parse(process.env.SELECTED_CONTEXT);
+    for (const [key, value] of Object.entries(authenticated)) {
+      if (context[key] !== value) throw new Error("Selected context differs from the authenticated workflow.");
+    }
     const { selection, pairs } = await loadComparison(resolve(path), context);
-    const evidence = `${process.env.GITHUB_SERVER_URL}/${selection.repository}/actions/runs/${selection.run}`;
+    const evidence = `${process.env.GITHUB_SERVER_URL}/${selection.repository}/actions/runs/${selection.run}/attempts/${selection.attempt}`;
     console.log(JSON.stringify(await postComparison(selection, renderComparison(selection, pairs, evidence), github, context)));
-  } else throw new Error("Expected collect or post.");
+  } else throw new Error("Expected context, native or post.");
 }
 
 if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
diff --git a/.github/scripts/skill-eval-comment.test.mjs b/.github/scripts/skill-eval-comment.test.mjs
index 34bf43d..1eff92e 100644
--- a/.github/scripts/skill-eval-comment.test.mjs
+++ b/.github/scripts/skill-eval-comment.test.mjs
@@ -5,7 +5,7 @@ import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { collectArm, inventorySkills, loadComparison, postComparison, projectTrials, publisherContext, renderComparison, validateSelection } from "./skill-eval-comment.mjs";
+import { collectNative, comparisonContext, inventorySkills, loadComparison, postComparison, projectTrials, publisherContext, renderComparison, validateSelection } from "./skill-eval-comment.mjs";
 
 const trial = (extra = {}) => ({
   type: "trial-result", runId: "native", evalName: "draft", stimulus: "draft-positive", model: "model-a", variant: "main",
@@ -14,8 +14,7 @@ const trial = (extra = {}) => ({
     { graderType: "skill-invocation", name: "routing", passed: false, evidence: "SECRET_RAW_GRADER_OUTPUT" },
   ] }, trajectory: { output: "SECRET_RAW_ANSWER", events: [] }, ...extra,
 });
-const footer = { type: "run-summary", runId: "native", hadExecutionErrors: false };
-const report = { schemaVersion: 2, command: "run", nativeRunId: "native", outcome: "failed", completeness: "complete", code: "native-failed" };
+const footer = { type: "run-summary", runId: "native", hadExecutionErrors: false, passed: false };
 const selection = {
   base: "a".repeat(40), head: "b".repeat(40), changed: ["local/draft"],
   skills: [{ key: "local/draft", hasEval: true }, { key: "local/neighbor", hasEval: true }, { key: "remote/run", hasEval: false }],
@@ -29,7 +28,7 @@ const pair = () => ({
 });
 
 test("native grader projection preserves counts and errors, rejects mixed/repeated trials, and omits raw output", () => {
-  const data = collectArm(report, ["0.21.0\n", `${JSON.stringify(trial())}\n${JSON.stringify(footer)}\n`]);
+  const data = collectNative(`${JSON.stringify(trial())}\n${JSON.stringify(footer)}\n`, "native", 1);
   assert.equal(data.state, "complete");
   assert.equal(data.rows[0].checks.filter((check) => check.passed).length, 1);
   assert.match(data.rows[0].checks[1].reason, /activation/);
@@ -37,16 +36,36 @@ test("native grader projection preserves counts and errors, rejects mixed/repeat
   assert.throws(() => projectTrials([trial(), trial(), footer], "native"), /one trial/);
   assert.throws(() => projectTrials([trial({ runId: "other" }), footer], "native"), /identity/);
   assert.throws(() => projectTrials([trial(), { ...footer, runId: "other" }], "native"), /completion/);
-  assert.throws(() => collectArm(report, []), /exactly one/);
-  assert.equal(collectArm(undefined, []).state, "error");
-  assert.equal(collectArm({ ...report, outcome: "error", completeness: "partial" },
-    [`${JSON.stringify(trial())}\n${JSON.stringify(footer)}`]).state, "error");
+  assert.equal(collectNative("", "native", 1).state, "error");
+  assert.equal(collectNative(`${JSON.stringify(trial())}\n${JSON.stringify(footer)}`, "native", 2).state, "error");
   const errored = projectTrials([trial({ gradeResult: { passed: false, details: [{ status: "error" }] } }), footer], "native");
   assert.equal(errored[0].state, "error");
   assert.equal(errored[0].passed, false);
   assert.equal(projectTrials([trial({ status: "skipped" }), footer], "native")[0].state, "not-run");
 });
 
+test("native CLI outcomes preserve behavioral failures and completed checks beside grading errors", () => {
+  const contents = (...rows) => rows.map((row) => JSON.stringify(row)).join("\n");
+  assert.equal(collectNative(contents(trial(), footer), "native", 1).state, "complete");
+  assert.equal(collectNative(contents(trial(), footer), "native", 2).state, "error");
+  assert.equal(collectNative(contents(trial(), { ...footer, passed: true }), "native", 1).state, "error");
+  assert.equal(collectNative(contents(footer), "native", 0).state, "not-run");
+  const errored = trial({ gradeResult: { passed: false, details: [
+    { graderType: "skill-invocation", name: "routing", passed: false },
+    { graderType: "program", status: "error", passed: false },
+  ] } });
+  const data = collectNative(contents(errored, { ...footer, hadExecutionErrors: true }), "native", 1);
+  assert.equal(data.state, "error");
+  assert.equal(data.rows[0].state, "error");
+  assert.equal(data.rows[0].checks.length, 1);
+  assert.equal(data.rows[0].checks[0].id, "0:skill-invocation");
+  const rendered = renderComparison(selection, [{ ...pair(), after: data }], "https://example.test");
+  assert.match(rendered, /After failures in changed skills \(1 grader\/model results\)/);
+  assert.match(rendered, /After \(comparison unknown\) \| routing/);
+  assert.match(rendered, /⚠️ Error/);
+  assert.throws(() => collectNative(contents(trial(), footer), "other", 0), /completion/);
+});
+
 test("approved hierarchy shows grader versus scenario denominators, failed-check reasons and honest coverage", () => {
   const sample = pair();
   const rendered = renderComparison(selection, [sample], "https://github.com/example/repo/actions/runs/1");
@@ -97,7 +116,7 @@ test("partial arms and absent matching graders cannot create resolved or new fai
 });
 
 test("malformed native output never leaks parser excerpts", () => {
-  assert.throws(() => collectArm(report, [`${JSON.stringify(trial())}\nSECRET_RAW_INVALID_JSON`]), (error) => {
+  assert.throws(() => collectNative(`${JSON.stringify(trial())}\nSECRET_RAW_INVALID_JSON`, "native", 1), (error) => {
     assert.equal(error.message, "Malformed native JSONL evidence.");
     assert.doesNotMatch(error.message, /SECRET/);
     return true;
@@ -151,10 +170,13 @@ test("comment publishing checks current PR head, bot ownership, run order and up
 });
 
 function sourceFixture() {
-  const context = { repository: "example/repo", run: "11", attempt: "2", runNumber: 5,
-    pullNumber: 2, head: selection.head, runHead: "c".repeat(40) };
+  const context = { repository: "example/repo", run: "999", attempt: "7", runNumber: 9,
+    pullNumber: 2, head: selection.head, runHead: "c".repeat(40),
+    sourceRun: "11", sourceAttempt: "2", trusted: "d".repeat(40),
+    base: selection.base, merge: "c".repeat(40) };
   const selected = {
     ...selection, repository: context.repository, run: context.run, attempt: context.attempt, merge: context.runHead,
+    sourceRun: context.sourceRun, sourceAttempt: context.sourceAttempt, trusted: context.trusted,
     include: [{ id: "skill-aaaaaaaaaaaa", plugin: "local", skill: "draft", directory: "plugins/local/skills/draft",
       evalPath: "evals/local/skills/draft/eval.yaml", base: selection.base, head: selection.head }],
   };
@@ -176,8 +198,16 @@ function sourceFixture() {
 test("publisher authenticates workflow, source attempt and PR independently from its own run", async () => {
   const { context, source, run, api } = sourceFixture();
   const env = { GITHUB_EVENT_NAME: "workflow_run", GITHUB_REPOSITORY: context.repository,
-    GITHUB_RUN_ID: "999", GITHUB_RUN_ATTEMPT: "7", GITHUB_SHA: "d".repeat(40) };
-  assert.deepEqual(await publisherContext({ workflow_run: source }, api, env), context);
+    GITHUB_RUN_ID: "999", GITHUB_RUN_ATTEMPT: "7", GITHUB_RUN_NUMBER: "9", GITHUB_SHA: "d".repeat(40) };
+  const { sourceRun, sourceAttempt, trusted, base, merge, ...sourceContext } = context;
+  assert.deepEqual(await publisherContext({ workflow_run: source }, api, env), {
+    ...sourceContext, run: "11", attempt: "2", runNumber: 5,
+  });
+  const { base: selectedBase, merge: selectedMerge, ...authenticated } = context;
+  assert.deepEqual(await comparisonContext({ workflow_run: source }, api, env), authenticated);
+  assert.equal((await comparisonContext({ workflow_run: source }, api, env, "2")).attempt, "2");
+  await assert.rejects(comparisonContext({ workflow_run: source }, api, env, "8"), /trusted comparison/);
+  await assert.rejects(comparisonContext({ workflow_run: source }, api, { ...env, GITHUB_RUN_NUMBER: "" }), /trusted comparison/);
   await assert.rejects(publisherContext({ workflow_run: source }, api, { ...env, GITHUB_EVENT_NAME: "pull_request" }), /workflow_run/);
   for (const change of [
     { event: "workflow_dispatch" }, { head_repository: { full_name: "fork/repo" } },
@@ -201,11 +231,15 @@ test("untrusted artifacts are bounded data, source-bound and re-sanitized before
     data: pair().before,
   };
   arm.data.rows[0].model = "@everyone | <script>bad</script>";
+  arm.data.rows[0].eval = "A&B";
+  arm.data.rows[0].checks[1].name = "A&B";
   arm.data.rows[0].checks[1].reason = "SECRET_UNTRUSTED_EVIDENCE";
   writeFileSync(join(root, `${arm.id}-before.json`), JSON.stringify(arm));
   const loaded = await loadComparison(root, context, api);
   const rendered = renderComparison(loaded.selection, loaded.pairs, "https://example.test");
-  assert.doesNotMatch(rendered, /<script>|@everyone|SECRET_UNTRUSTED_EVIDENCE/);
+  assert.doesNotMatch(rendered, /<script>|@everyone|SECRET_UNTRUSTED_EVIDENCE/i);
+  assert.match(rendered, /A&amp;B/);
+  assert.doesNotMatch(rendered, /A&amp;amp;B/);
   assert.match(rendered, /Required activation/);
   assert.match(rendered, /⚠️ Error/);
   await assert.rejects(validateSelection({ ...selected, attempt: "1" }, context, api), /authenticated source/);
@@ -219,36 +253,27 @@ test("untrusted artifacts are bounded data, source-bound and re-sanitized before
   await assert.rejects(loadComparison(root, context, api), /bounded regular/);
 });
 
-test("collect CLI binds native Action diagnostics to this selection without publishing raw evidence", (t) => {
-  const root = mkdtempSync(join(tmpdir(), "comparison-collect-"));
+test("native CLI projection binds its run and trusted workflow without an Action report", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "comparison-native-"));
   t.after(() => rmSync(root, { recursive: true, force: true }));
-  const context = {
-    repository: "example/repo", run: "1", attempt: "1", merge: "c".repeat(40),
-    base: selection.base, head: selection.head, include: [{ id: "skill-id", plugin: "local", skill: "draft" }],
-  };
-  writeFileSync(join(root, "selection.json"), JSON.stringify(context));
-  const action = {
-    ...report, reportId: "skill-id-before", revision: context.merge, repository: context.repository,
-    workflowRunId: 1, workflowRunAttempt: 1,
-  };
-  writeFileSync(join(root, "report.json"), JSON.stringify(action));
-  writeFileSync(join(root, "native.stdout.log"), `${JSON.stringify(trial())}\n${JSON.stringify(footer)}\n`);
-  const options = {
-    encoding: "utf8", timeout: 10000,
-    env: { ...process.env, GITHUB_REPOSITORY: context.repository, GITHUB_RUN_ID: "1", GITHUB_RUN_ATTEMPT: "1",
-      GITHUB_SHA: context.merge, COMPARISON_ID: "skill-id", ARM: "before", SELECTION_FILE: join(root, "selection.json"),
-      ACTION_REPORT: join(root, "report.json"), NATIVE_DIRECTORY: root },
+  const { selected } = sourceFixture();
+  writeFileSync(join(root, "selection.json"), JSON.stringify(selected));
+  writeFileSync(join(root, "native.jsonl"), [trial(), footer].map((row) => JSON.stringify(row)).join("\n"));
+  const env = {
+    ...process.env, GITHUB_REPOSITORY: selected.repository, GITHUB_RUN_ID: selected.run,
+    GITHUB_RUN_ATTEMPT: selected.attempt, GITHUB_SHA: selected.trusted,
+    COMPARISON_ID: selected.include[0].id, ARM: "before", SELECTION_FILE: join(root, "selection.json"),
+    NATIVE_FILE: join(root, "native.jsonl"), NATIVE_RUN_ID: "native", NATIVE_EXIT: "1",
   };
-  const args = [fileURLToPath(new URL("./skill-eval-comment.mjs", import.meta.url)), "collect", join(root, "derived")];
-  const result = spawnSync(process.execPath, args, options);
+  const args = [fileURLToPath(new URL("./skill-eval-comment.mjs", import.meta.url)), "native", root];
+  const result = spawnSync(process.execPath, args, { env, encoding: "utf8", timeout: 10000 });
   assert.ifError(result.error);
   assert.equal(result.status, 0, result.stderr);
-  const saved = readFileSync(join(root, "derived/skill-id-before.json"), "utf8");
-  assert.equal(JSON.parse(saved).data.rows[0].checks.length, 2);
+  const saved = readFileSync(join(root, `${selected.include[0].id}-before.json`), "utf8");
+  assert.equal(JSON.parse(saved).data.state, "complete");
   assert.doesNotMatch(saved, /SECRET/);
-  writeFileSync(join(root, "report.json"), JSON.stringify({ ...action, reportId: "wrong-report" }));
-  const mixed = spawnSync(process.execPath, args, options);
+  const mixed = spawnSync(process.execPath, args, { env: { ...env, NATIVE_RUN_ID: "wrong" }, encoding: "utf8", timeout: 10000 });
   assert.ifError(mixed.error);
   assert.notEqual(mixed.status, 0);
-  assert.match(mixed.stderr, /identity changed/);
+  assert.match(mixed.stderr, /completion/);
 });
diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index b8702a7..29a470c 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -392,55 +392,58 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
   });
 });
 
-  test("PR skill evals require approval and use two sequential native Action runs with fixed measurement inputs", () => {
+  test("PR skill requests stay read-only and trusted paid jobs use sequential pinned native CLI arms", () => {
     const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-evals.yml"), "utf8"));
     assert.deepEqual(Object.keys(workflow.on), ["pull_request"]);
     assert.deepEqual(workflow.on.pull_request.paths, ["plugins/*/skills/**"]);
-    assert.equal(workflow.jobs.select.if, "github.event.pull_request.head.repo.full_name == github.repository");
+    assert.equal(workflow.jobs.request.if, "github.event.pull_request.head.repo.full_name == github.repository");
     assert.deepEqual(workflow.permissions, { contents: "read" });
     assert.deepEqual(workflow.concurrency, {
       group: "skill-evals-${{ github.event.pull_request.number }}", "cancel-in-progress": true,
     });
-    assert.deepEqual(workflow.jobs.select.permissions, { contents: "read", actions: "read" });
-    const job = workflow.jobs.evals;
+    assert.deepEqual(Object.keys(workflow.jobs), ["request"]);
+    assert.doesNotMatch(JSON.stringify(workflow), /copilot-requests|pull-requests|evals-action/);
+    assert.equal(workflow.jobs.request.environment, undefined);
+    const publisher = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
+    assert.deepEqual(publisher.on, { workflow_run: { workflows: ["Skill evals (before and after)"], types: ["completed"] } });
+    assert.deepEqual(publisher.permissions, {});
+    assert.deepEqual(publisher.jobs.select.permissions, { contents: "read", actions: "read" });
+    assert.match(publisher.jobs.select.if, /conclusion != 'cancelled'/);
+    assert.match(publisher.jobs.select.if, /head_repository\.full_name == github\.repository/);
+    const job = publisher.jobs.evals;
     assert.equal(job.environment, "evals");
     assert.equal(job.strategy["fail-fast"], false);
     assert.deepEqual(job.permissions, { contents: "read", "copilot-requests": "write" });
-    const actions = job.steps.filter((step) => step.uses?.startsWith("github/evals-action@"));
-    assert.equal(actions.length, 2);
-    assert.equal(actions[0].uses, actions[1].uses);
-    const { "report-id": beforeId, ...before } = actions[0].with;
-    const { "report-id": afterId, ...after } = actions[1].with;
-    assert.deepEqual(before, after);
-    assert.equal(before.command, "run");
-    assert.equal(before["eval-paths"], "${{ matrix.evalPath }}");
-    assert.equal(before["vally-version"], "0.21.0");
-    assert.equal(before["working-directory"], ".");
-    assert.equal(before.runs, 1);
-    assert.equal(before.workers, 1);
-    assert.equal(before["max-retries"], 0);
-    assert.equal(before["upload-transcripts"], false);
-    assert.notEqual(beforeId, afterId);
-    assert.equal(actions[1].if, "${{ !cancelled() && steps.after_source.outcome == 'success' }}");
+    const before = job.steps.find((step) => step.id === "before");
+    const after = job.steps.find((step) => step.id === "after");
+    assert.equal(before.run, after.run, "both arms use the same native invocation");
+    assert.equal(before["working-directory"], "candidate");
+    assert.equal(after["working-directory"], "candidate");
+    assert.match(before.run, /env -i .*COPILOT_GITHUB_TOKEN/);
+    assert.match(before.run, /node "\$VALLY_ENTRY" eval/);
+    assert.match(before.run, /--output=jsonl/);
+    assert.match(before.run, /--runs 1 --workers 1 --max-retries 0 --require-pass/);
+    assert.doesNotMatch(before.run, /--model|evals-action|GITHUB_EVENT_NAME=|GITHUB_SHA=/);
+    assert.notEqual(before.env.NATIVE_RUN_ID, after.env.NATIVE_RUN_ID);
+    const install = job.steps.find((step) => step.run?.includes("npm install")).run;
+    assert.match(install, /--prefix "\$RUNNER_TEMP\/skill-eval-tools".*@microsoft\/vally-cli@0\.21\.0/);
+    assert.match(job.env.VALLY_ENTRY, /runner\.temp.*skill-eval-tools/);
+    assert.equal(after.if, "${{ !cancelled() && steps.after_source.outcome == 'success' }}");
     assert.equal(job.steps.find((step) => step.id === "after_source").if,
       "${{ !cancelled() && steps.before_source.outcome == 'success' }}");
     assert.equal(workflow.jobs.comment, undefined, "PR-controlled jobs must not publish with write permission");
     for (const step of Object.values(workflow.jobs)) assert.equal(step.permissions?.["pull-requests"], undefined);
-    const publisher = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
-    assert.deepEqual(publisher.on, { workflow_run: { workflows: ["Skill evals (before and after)"], types: ["completed"] } });
-    assert.deepEqual(publisher.permissions, {});
     const comment = publisher.jobs.publish;
     assert.deepEqual(comment.permissions, { contents: "read", actions: "read", "pull-requests": "write" });
     assert.equal(comment.permissions["copilot-requests"], undefined);
-    assert.equal(comment.concurrency["cancel-in-progress"], false);
-    assert.match(comment.if, /workflow_run\.event == 'pull_request'/);
+    assert.match(comment.if, /!cancelled\(\)/);
     assert.ok(comment.steps.some((step) => step.run?.includes("skill-eval-comment.mjs post")));
     const download = comment.steps.find((step) => step.uses?.startsWith("actions/download-artifact@")).with;
-    assert.equal(download.pattern, "skill-comparison-${{ github.event.workflow_run.run_attempt }}-*");
-    assert.equal(download["run-id"], "${{ github.event.workflow_run.id }}");
+    assert.equal(download.pattern, "skill-comparison-${{ needs.select.outputs.attempt }}-*");
+    assert.equal(comment.steps.at(-1).env.PRODUCING_ATTEMPT, "${{ needs.select.outputs.attempt }}");
+    assert.equal(download["run-id"], undefined, "publication reads this trusted paid run, not request-run artifacts");
     assert.equal(download.path, "${{ runner.temp }}/skill-comparison");
-    assert.equal(download["github-token"], "${{ github.token }}");
-    for (const step of [...workflow.jobs.select.steps, ...job.steps].filter((step) => step.uses?.startsWith("actions/upload-artifact@"))) {
+    for (const step of [...publisher.jobs.select.steps, ...job.steps].filter((step) => step.uses?.startsWith("actions/upload-artifact@"))) {
       assert.match(step.with.name, /github\.run_attempt/, "reruns must not collide with or import earlier-attempt artifacts");
     }
     assert.equal(job.permissions["pull-requests"], undefined);
@@ -461,9 +464,63 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     }
     for (const step of job.steps.filter((step) => step.uses?.startsWith("actions/checkout@"))) {
       assert.equal(step.with["persist-credentials"], false);
-      assert.equal(step.with["fetch-depth"], 2);
-      assert.equal(step.with.ref, undefined, "HEAD must remain the merge SHA accepted by the Action");
+      if (step.with.path === "candidate") {
+        assert.equal(step.with["fetch-depth"], 2);
+        assert.equal(step.with.ref, "${{ fromJSON(needs.select.outputs.context).merge }}");
+      } else assert.equal(step.with.ref, "${{ github.sha }}");
+    }
+  });
+
+  test("native arm commands isolate credentials, retain raw output privately and still execute After following failed Before", (t) => {
+    const directory = mkdtempSync(resolve(tmpdir(), "skill-native-command-"));
+    t.after(() => rmSync(directory, { recursive: true, force: true }));
+    const runner = resolve(directory, "runner");
+    mkdirSync(resolve(runner, "skill-native"), { recursive: true });
+    const entry = resolve(directory, "synthetic-vally.mjs");
+    writeFileSync(entry, `
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+const value = (flag) => process.argv[process.argv.indexOf(flag) + 1];
+const before = value('--run-id').endsWith('-before');
+const output = value('--output-dir');
+mkdirSync(output, { recursive: true });
+writeFileSync(join(output, 'observed.json'), JSON.stringify({
+  args: process.argv.slice(2), credential: process.env.COPILOT_GITHUB_TOKEN,
+  leaked: ['GH_TOKEN', 'GITHUB_TOKEN', 'ACTIONS_RUNTIME_TOKEN', 'NODE_OPTIONS'].some((key) => key in process.env),
+}));
+console.log(JSON.stringify({ type: 'trial-result', runId: value('--run-id'), raw: 'SYNTHETIC_PRIVATE_OUTPUT' }));
+console.log(JSON.stringify({ type: 'run-summary', runId: value('--run-id'), passed: !before, hadExecutionErrors: false }));
+process.exitCode = before ? 1 : 0;
+`);
+    const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
+    for (const arm of ["before", "after"]) {
+      const step = workflow.jobs.evals.steps.find((item) => item.id === arm);
+      const result = spawnSync("bash", ["-c", step.run], {
+        cwd: directory, encoding: "utf8", timeout: 10000,
+        env: {
+          ...process.env, RUNNER_TEMP: runner.replaceAll("\\", "/"),
+          GITHUB_OUTPUT: resolve(directory, "outputs").replaceAll("\\", "/"),
+          VALLY_ENTRY: entry.replaceAll("\\", "/"), ARM: arm,
+          EVAL_PATH: "evals/example/skills/changed/eval.yaml", NATIVE_RUN_ID: `fixture-${arm}`,
+          COPILOT_GITHUB_TOKEN: "synthetic-selected", GH_TOKEN: "synthetic-unselected",
+          GITHUB_TOKEN: "synthetic-reporting", ACTIONS_RUNTIME_TOKEN: "synthetic-actions",
+          NODE_OPTIONS: "--not-a-real-node-option",
+        },
+      });
+      assert.ifError(result.error);
+      assert.equal(result.status, arm === "before" ? 1 : 0, result.stderr);
+      assert.equal(result.stdout, "", "raw native output must not enter the Actions log");
+      const observed = JSON.parse(readFileSync(resolve(runner, `skill-native/${arm}-artifacts/observed.json`), "utf8"));
+      assert.equal(observed.credential, "synthetic-selected");
+      assert.equal(observed.leaked, false);
+      assert.equal(observed.args[0], "eval");
+      assert.ok(observed.args.includes("--require-pass"));
+      assert.ok(observed.args.includes("--output=jsonl"));
+      const records = readFileSync(resolve(runner, `skill-native/${arm}.jsonl`), "utf8").trim().split("\n").map((line) => JSON.parse(line));
+      assert.equal(records.at(-1).runId, `fixture-${arm}`);
+      assert.equal(records.at(-1).passed, arm === "after");
     }
+    assert.equal(readFileSync(resolve(directory, "outputs"), "utf8"), "exit=1\nexit=0\n");
   });
 
   test("PR selection and sequential source restores compare only eligible target skills and fail closed without approval", (t) => {
@@ -502,7 +559,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     file("plugins/example/skills/deleted/SKILL.md", "deleted skill\n");
     file("evals/example/skills/changed/eval.yaml", "fixed measurement\n");
     file("marketplace.json", JSON.stringify({ plugins: [{ name: "example", source: "./plugins/example" }] }));
-    file(".github/scripts/skill-eval-comment.mjs", readFileSync(resolve(root, ".github/scripts/skill-eval-comment.mjs"), "utf8"));
+    file(".github/scripts/skill-eval-comment.mjs", "throw new Error('Untrusted selector executed');");
     git("add", "."); git("commit", "-m", "Base fixture");
     git("checkout", "-b", "candidate");
     file(`${target}/SKILL.md`, "head skill\n");
@@ -518,8 +575,14 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     git("add", "."); git("commit", "-m", "Advance main fixture");
     const base = git("rev-parse", "HEAD");
     git("merge", "--no-ff", "candidate", "-m", "Merge fixture");
-    env.GITHUB_SHA = git("rev-parse", "HEAD");
-    const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-evals.yml"), "utf8"));
+    const merge = git("rev-parse", "HEAD");
+    env.GITHUB_SHA = "d".repeat(40);
+    env.TRUSTED_HELPER = resolve(root, ".github/scripts/skill-eval-comment.mjs");
+    writeFileSync(resolve(runner, "comparison-context.json"), JSON.stringify({
+      base, head: env.HEAD_SHA, merge, trusted: env.GITHUB_SHA,
+      repository: "fixture/repo", run: "2", attempt: "1", sourceRun: "1", sourceAttempt: "1",
+    }));
+    const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
     const selection = workflow.jobs.select.steps.find((step) => step.id === "select").run;
     const code = selection.match(/<<'JS'\n([\s\S]*)\nJS/)[1];
     const environment = resolve(runner, "evals-environment.json");
@@ -556,7 +619,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
       });
       assert.ifError(restored.error);
       assert.equal(restored.status, 0, restored.stderr);
-      assert.equal(git("rev-parse", "HEAD"), env.GITHUB_SHA);
+      assert.equal(git("rev-parse", "HEAD"), merge);
       assert.equal(readFileSync(resolve(repository, `${target}/SKILL.md`), "utf8"), expected);
       assert.equal(existsSync(resolve(repository, `${target}/old.md`)), id === "before_source");
       assert.equal(existsSync(resolve(repository, `${target}/new.md`)), id === "after_source");
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
index 8998c90..8f6d460 100644
--- a/.github/workflows/skill-eval-comment.yml
+++ b/.github/workflows/skill-eval-comment.yml
@@ -1,17 +1,241 @@
-name: Publish skill eval comparison
+name: Run and publish skill eval comparison
 on:
   workflow_run:
     workflows: ["Skill evals (before and after)"]
     types: [completed]
 permissions: {}
+concurrency:
+  group: skill-eval-run-${{ github.event.workflow_run.pull_requests[0].number }}
+  cancel-in-progress: true
 jobs:
+  select:
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion != 'cancelled' && github.event.workflow_run.head_repository.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      matrix: ${{ steps.select.outputs.matrix }}
+      count: ${{ steps.select.outputs.count }}
+      attempt: ${{ steps.select.outputs.attempt }}
+      context: ${{ steps.context.outputs.context }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ github.sha }}
+          path: trusted
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+      - name: Authenticate the source request and select the current PR merge revision
+        id: context
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node trusted/.github/scripts/skill-eval-comment.mjs context "$RUNNER_TEMP/comparison-context.json"
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ steps.context.outputs.merge }}
+          path: candidate
+          fetch-depth: 2
+          persist-credentials: false
+      - name: Read approval protection without creating an environment
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api "repos/$GITHUB_REPOSITORY/environments/evals" > "$RUNNER_TEMP/evals-environment.json"
+      - name: Require approval protection and select changed skills with trusted code
+        id: select
+        working-directory: candidate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TRUSTED_HELPER: ${{ github.workspace }}/trusted/.github/scripts/skill-eval-comment.mjs
+        run: |
+          node --input-type=module <<'JS'
+          import { execFileSync, spawnSync } from 'node:child_process';
+          import { createHash } from 'node:crypto';
+          import { appendFileSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
+          import { resolve } from 'node:path';
+          import { pathToFileURL } from 'node:url';
+          const { inventorySkills } = await import(pathToFileURL(process.env.TRUSTED_HELPER));
+          const context = JSON.parse(readFileSync(resolve(process.env.RUNNER_TEMP, 'comparison-context.json'), 'utf8'));
+          const environment = JSON.parse(readFileSync(resolve(process.env.RUNNER_TEMP, 'evals-environment.json'), 'utf8'));
+          if (!environment.protection_rules?.some(rule => rule.type === 'required_reviewers' && rule.reviewers?.length > 0)) {
+            throw new Error('Configure the evals environment with required maintainer reviewers before enabling paid PR evals.');
+          }
+          const git = (...args) => execFileSync('git', args, { encoding: 'utf8' }).trim();
+          if (git('rev-parse', 'HEAD') !== context.merge || git('rev-parse', 'HEAD^1') !== context.base ||
+              git('rev-parse', 'HEAD^2') !== context.head) throw new Error('Expected the verified PR merge and its exact parents.');
+          const changed = execFileSync('git', ['diff', '--no-renames', '--name-only', '-z', context.base, 'HEAD', '--', 'plugins'], { encoding: 'utf8' });
+          const keys = [...new Set(changed.split('\0').flatMap(file => {
+            const match = /^plugins\/([^/]+)\/skills\/([^/]+)\//.exec(file);
+            return match ? [`${match[1]}/${match[2]}`] : [];
+          }))].sort();
+          const include = [];
+          for (const key of keys) {
+            if (!/^[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/.test(key)) throw new Error('Unsupported plugin or skill path in PR changes.');
+            const [plugin, skill] = key.split('/');
+            const directory = `plugins/${plugin}/skills/${skill}`;
+            const evalPath = `evals/${plugin}/skills/${skill}/eval.yaml`;
+            const present = ref => {
+              const result = spawnSync('git', ['cat-file', '-e', `${ref}:${directory}/SKILL.md`], { stdio: 'ignore' });
+              if (result.error) throw result.error;
+              if (result.status !== 0 && result.status !== 128) throw new Error('Could not inspect the skill source tree.');
+              return result.status === 0;
+            };
+            if (!present(context.base) || !present(context.head) || !existsSync(evalPath)) {
+              console.log(`::warning::No before/after pair for ${key}: both skill versions and ${evalPath} are required. No eval was run for this skill.`);
+              continue;
+            }
+            include.push({ plugin, skill, directory, evalPath, base: context.base, head: context.head, id: `skill-${createHash('sha256').update(key).digest('hex').slice(0, 12)}` });
+          }
+          const selection = { ...context, include, changed: keys, skills: inventorySkills(process.cwd()) };
+          writeFileSync(resolve(process.env.RUNNER_TEMP, 'selection.json'), JSON.stringify(selection));
+          appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify({ include })}\ncount=${include.length}\nattempt=${context.attempt}\n`);
+          JS
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: skill-comparison-${{ github.run_attempt }}-selection
+          path: ${{ runner.temp }}/selection.json
+          if-no-files-found: error
+          retention-days: 7
+
+  evals:
+    needs: select
+    if: needs.select.outputs.count != '0'
+    name: ${{ matrix.plugin }}/${{ matrix.skill }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    environment: evals
+    permissions:
+      contents: read
+      copilot-requests: write
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.select.outputs.matrix) }}
+    env:
+      SKILL_DIR: ${{ matrix.directory }}
+      VALLY_ENTRY: ${{ runner.temp }}/skill-eval-tools/node_modules/@microsoft/vally-cli/dist/index.js
+    steps:
+      - name: Reject partial paid retries
+        env:
+          SELECTED_ATTEMPT: ${{ needs.select.outputs.attempt }}
+        run: |
+          if [[ "$SELECTED_ATTEMPT" != "$GITHUB_RUN_ATTEMPT" ]]; then
+            echo "::error::Partial paid job retries are unsupported. Use Re-run all jobs."
+            exit 1
+          fi
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ github.sha }}
+          path: trusted
+          persist-credentials: false
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ fromJSON(needs.select.outputs.context).merge }}
+          path: candidate
+          fetch-depth: 2
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+      - name: Install the pinned native CLI outside the candidate checkout
+        run: |
+          npm install --prefix "$RUNNER_TEMP/skill-eval-tools" --no-audit --no-fund @microsoft/vally-cli@0.21.0
+          mkdir -p "$RUNNER_TEMP/skill-native" "$RUNNER_TEMP/skill-eval-home"
+          node "$VALLY_ENTRY" --version
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          name: skill-comparison-${{ github.run_attempt }}-selection
+          path: ${{ runner.temp }}/skill-selection
+      - name: Select the target skill from the base parent
+        id: before_source
+        working-directory: candidate
+        env:
+          SOURCE_SHA: ${{ matrix.base }}
+        run: &restore_source |
+          set -euo pipefail
+          git --literal-pathspecs restore --source="$SOURCE_SHA" --staged --worktree -- "$SKILL_DIR"
+          git --literal-pathspecs diff --exit-code "$SOURCE_SHA" -- "$SKILL_DIR"
+          if [[ -n "$(git diff --name-only HEAD | awk -v dir="$SKILL_DIR/" 'index($0,dir)!=1')$(git ls-files --others --exclude-standard)" ]]; then
+            echo "::error::Measurement files changed outside the selected skill."
+            exit 1
+          fi
+      - name: Run native Before
+        id: before
+        continue-on-error: true
+        working-directory: candidate
+        env:
+          COPILOT_GITHUB_TOKEN: ${{ github.token }}
+          ARM: before
+          EVAL_PATH: ${{ matrix.evalPath }}
+          NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-before
+        run: &native_run |
+          set +e
+          env -i PATH="$PATH" HOME="$RUNNER_TEMP/skill-eval-home" TMPDIR="$RUNNER_TEMP" VALLY_TELEMETRY_OPTOUT=1 COPILOT_GITHUB_TOKEN="$COPILOT_GITHUB_TOKEN" \
+            node "$VALLY_ENTRY" eval --eval-spec "$EVAL_PATH" --work-dir "$PWD" --output=jsonl --output-dir "$RUNNER_TEMP/skill-native/$ARM-artifacts" \
+            --run-id "$NATIVE_RUN_ID" --runs 1 --workers 1 --max-retries 0 --require-pass > "$RUNNER_TEMP/skill-native/$ARM.jsonl" 2> "$RUNNER_TEMP/skill-native/$ARM.stderr"
+          code=$?
+          echo "exit=$code" >> "$GITHUB_OUTPUT"
+          exit "$code"
+      - name: Retain only Before verdicts with trusted code
+        if: ${{ !cancelled() && steps.before_source.outcome == 'success' }}
+        working-directory: candidate
+        env:
+          ARM: before
+          COMPARISON_ID: ${{ matrix.id }}
+          SELECTION_FILE: ${{ runner.temp }}/skill-selection/selection.json
+          NATIVE_FILE: ${{ runner.temp }}/skill-native/before.jsonl
+          NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-before
+          NATIVE_EXIT: ${{ steps.before.outputs.exit }}
+        run: node "$GITHUB_WORKSPACE/trusted/.github/scripts/skill-eval-comment.mjs" native "$RUNNER_TEMP/skill-comparison"
+      - name: Select the target skill from the PR head
+        id: after_source
+        if: ${{ !cancelled() && steps.before_source.outcome == 'success' }}
+        working-directory: candidate
+        env:
+          SOURCE_SHA: ${{ matrix.head }}
+        run: *restore_source
+      - name: Run native After even when Before fails
+        id: after
+        if: ${{ !cancelled() && steps.after_source.outcome == 'success' }}
+        continue-on-error: true
+        working-directory: candidate
+        env:
+          COPILOT_GITHUB_TOKEN: ${{ github.token }}
+          ARM: after
+          EVAL_PATH: ${{ matrix.evalPath }}
+          NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-after
+        run: *native_run
+      - name: Retain only After verdicts with trusted code
+        if: ${{ !cancelled() && steps.after_source.outcome == 'success' }}
+        working-directory: candidate
+        env:
+          ARM: after
+          COMPARISON_ID: ${{ matrix.id }}
+          SELECTION_FILE: ${{ runner.temp }}/skill-selection/selection.json
+          NATIVE_FILE: ${{ runner.temp }}/skill-native/after.jsonl
+          NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-after
+          NATIVE_EXIT: ${{ steps.after.outputs.exit }}
+        run: node "$GITHUB_WORKSPACE/trusted/.github/scripts/skill-eval-comment.mjs" native "$RUNNER_TEMP/skill-comparison"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: ${{ !cancelled() }}
+        with:
+          name: skill-comparison-${{ github.run_attempt }}-${{ matrix.id }}
+          path: ${{ runner.temp }}/skill-comparison/*.json
+          if-no-files-found: error
+          retention-days: 7
+      - name: Keep failed native outcomes visible
+        if: ${{ !cancelled() && (steps.before.outcome != 'success' || steps.after.outcome != 'success') }}
+        run: |
+          echo "::error::At least one native arm did not pass; see the comparison's grader/error details."
+          exit 1
+
   publish:
-    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.head_repository.full_name == github.repository
+    needs: [select, evals]
+    if: ${{ !cancelled() && needs.select.result == 'success' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    concurrency:
-      group: skill-eval-comment-${{ github.event.workflow_run.pull_requests[0].number }}
-      cancel-in-progress: false
     permissions:
       contents: read
       actions: read
@@ -24,15 +248,14 @@ jobs:
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 24
-      - name: Download only the triggering run and attempt into temporary data storage
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
-          pattern: skill-comparison-${{ github.event.workflow_run.run_attempt }}-*
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ github.token }}
+          pattern: skill-comparison-${{ needs.select.outputs.attempt }}-*
           merge-multiple: true
           path: ${{ runner.temp }}/skill-comparison
       - name: Validate source provenance and publish with trusted code
         env:
           GH_TOKEN: ${{ github.token }}
+          PRODUCING_ATTEMPT: ${{ needs.select.outputs.attempt }}
+          SELECTED_CONTEXT: ${{ needs.select.outputs.context }}
         run: node .github/scripts/skill-eval-comment.mjs post "$RUNNER_TEMP/skill-comparison"
diff --git a/.github/workflows/skill-evals.yml b/.github/workflows/skill-evals.yml
index 7373e6c..1355e67 100644
--- a/.github/workflows/skill-evals.yml
+++ b/.github/workflows/skill-evals.yml
@@ -1,5 +1,4 @@
 name: Skill evals (before and after)
-# Paid runs require approval in the existing, protected evals environment.
 on:
   pull_request:
     paths:
@@ -10,209 +9,10 @@ concurrency:
   group: skill-evals-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 jobs:
-  select:
+  request:
     if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    permissions:
-      contents: read
-      actions: read
-    outputs:
-      matrix: ${{ steps.select.outputs.matrix }}
-      count: ${{ steps.select.outputs.count }}
-      attempt: ${{ steps.select.outputs.attempt }}
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-        with:
-          fetch-depth: 2
-          persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: 24
-      - name: Read approval protection without creating an environment
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh api "repos/$GITHUB_REPOSITORY/environments/evals" > "$RUNNER_TEMP/evals-environment.json"
-      - name: Require approval protection and select changed skills
-        id: select
-        env:
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          node --input-type=module <<'JS'
-          import { execFileSync, spawnSync } from 'node:child_process';
-          import { createHash } from 'node:crypto';
-          import { appendFileSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
-          import { resolve } from 'node:path';
-          import { inventorySkills } from './.github/scripts/skill-eval-comment.mjs';
-          const environment = JSON.parse(readFileSync(resolve(process.env.RUNNER_TEMP, 'evals-environment.json'), 'utf8'));
-          if (!environment.protection_rules?.some(rule => rule.type === 'required_reviewers' && rule.reviewers?.length > 0)) {
-            throw new Error('Configure the evals environment with required maintainer reviewers before enabling paid PR evals.');
-          }
-          const git = (...args) => execFileSync('git', args, { encoding: 'utf8' }).trim();
-          const head = process.env.HEAD_SHA;
-          if (!/^[a-f0-9]{40}$/.test(head ?? '') || git('rev-parse', 'HEAD^2') !== head) {
-            throw new Error('Expected the PR merge commit and its exact head parent.');
-          }
-          const base = git('rev-parse', 'HEAD^1');
-          const changed = execFileSync('git', ['diff', '--no-renames', '--name-only', '-z', base, 'HEAD', '--', 'plugins'], { encoding: 'utf8' });
-          const keys = [...new Set(changed.split('\0').flatMap(file => {
-            const match = /^plugins\/([^/]+)\/skills\/([^/]+)\//.exec(file);
-            return match ? [`${match[1]}/${match[2]}`] : [];
-          }))].sort();
-          const include = [];
-          for (const key of keys) {
-            if (!/^[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/.test(key)) {
-              throw new Error('Unsupported plugin or skill path in PR changes.');
-            }
-            const [plugin, skill] = key.split('/');
-            const directory = `plugins/${plugin}/skills/${skill}`;
-            const evalPath = `evals/${plugin}/skills/${skill}/eval.yaml`;
-            const present = ref => {
-              const result = spawnSync('git', ['cat-file', '-e', `${ref}:${directory}/SKILL.md`], { stdio: 'ignore' });
-              if (result.error) throw result.error;
-              if (result.status !== 0 && result.status !== 128) throw new Error('Could not inspect the skill source tree.');
-              return result.status === 0;
-            };
-            if (!present(base) || !present(head) || !existsSync(evalPath)) {
-              console.log(`::warning::No before/after pair for ${key}: both skill versions and ${evalPath} are required. No eval was run for this skill.`);
-              continue;
-            }
-            include.push({ plugin, skill, directory, evalPath, base, head, id: `skill-${createHash('sha256').update(key).digest('hex').slice(0, 12)}` });
-          }
-          const selection = {
-            include, changed: keys, skills: inventorySkills(process.cwd()),
-            base, head, merge: process.env.GITHUB_SHA,
-            repository: process.env.GITHUB_REPOSITORY,
-            run: process.env.GITHUB_RUN_ID, attempt: process.env.GITHUB_RUN_ATTEMPT,
-          };
-          writeFileSync(resolve(process.env.RUNNER_TEMP, 'selection.json'), JSON.stringify(selection));
-          appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify({ include })}\ncount=${include.length}\nattempt=${process.env.GITHUB_RUN_ATTEMPT}\n`);
-          JS
-      - name: Retain comparison selection
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: skill-comparison-${{ github.run_attempt }}-selection
-          path: ${{ runner.temp }}/selection.json
-          if-no-files-found: error
-          retention-days: 7
-
-  evals:
-    needs: select
-    if: needs.select.outputs.count != '0'
-    name: ${{ matrix.plugin }}/${{ matrix.skill }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    environment: evals
-    permissions:
-      contents: read
-      copilot-requests: write
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJSON(needs.select.outputs.matrix) }}
-    env:
-      VALLY_TELEMETRY_OPTOUT: '1'
-      SKILL_DIR: ${{ matrix.directory }}
-    steps:
-      - name: Reject partial retries before either paid arm
-        env:
-          SELECTED_ATTEMPT: ${{ needs.select.outputs.attempt }}
-        run: |
-          if [[ "$SELECTED_ATTEMPT" != "$GITHUB_RUN_ATTEMPT" ]]; then
-            echo "::error::Partial job retries are unsupported. Use Re-run all jobs so selection and both arms share one attempt."
-            exit 1
-          fi
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-        with:
-          fetch-depth: 2
-          persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: 24
-      - name: Read comparison selection
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
-        with:
-          name: skill-comparison-${{ github.run_attempt }}-selection
-          path: ${{ runner.temp }}/skill-selection
-      - name: Select the target skill from current main
-        id: before_source
-        env:
-          SOURCE_SHA: ${{ matrix.base }}
-        run: |
-          set -euo pipefail
-          git --literal-pathspecs restore --source="$SOURCE_SHA" --staged --worktree -- "$SKILL_DIR"
-          git --literal-pathspecs diff --exit-code "$SOURCE_SHA" -- "$SKILL_DIR"
-          if [[ -n "$(git diff --name-only HEAD | awk -v dir="$SKILL_DIR/" 'index($0,dir)!=1')$(git ls-files --others --exclude-standard)" ]]; then
-            echo "::error::Measurement files changed outside the selected skill."
-            exit 1
-          fi
-          echo "Before: $SKILL_DIR from $SOURCE_SHA; measurement revision $GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"
-      - name: Run before evals
-        id: before
-        uses: github/evals-action@6e4c077e92194c7e75663d8d782426841047e887 # v0.2.0
-        with:
-          command: run
-          working-directory: .
-          eval-paths: ${{ matrix.evalPath }}
-          vally-version: '0.21.0'
-          copilot-token: ${{ github.token }}
-          runs: 1
-          workers: 1
-          max-retries: 0
-          upload-transcripts: false
-          report-id: ${{ matrix.id }}-before
-      - name: Keep only before grader verdicts
-        if: ${{ !cancelled() && steps.before_source.outcome == 'success' }}
-        env:
-          ARM: before
-          COMPARISON_ID: ${{ matrix.id }}
-          SELECTION_FILE: ${{ runner.temp }}/skill-selection/selection.json
-          ACTION_REPORT: ${{ steps.before.outputs.result-path }}
-          NATIVE_DIRECTORY: ${{ steps.before.outputs.native-diagnostics-path }}
-        run: node .github/scripts/skill-eval-comment.mjs collect "$RUNNER_TEMP/skill-comparison"
-      - name: Select the target skill from the PR head
-        id: after_source
-        if: ${{ !cancelled() && steps.before_source.outcome == 'success' }}
-        env:
-          SOURCE_SHA: ${{ matrix.head }}
-        run: |
-          set -euo pipefail
-          git --literal-pathspecs restore --source="$SOURCE_SHA" --staged --worktree -- "$SKILL_DIR"
-          git --literal-pathspecs diff --exit-code "$SOURCE_SHA" -- "$SKILL_DIR"
-          if [[ -n "$(git diff --name-only HEAD | awk -v dir="$SKILL_DIR/" 'index($0,dir)!=1')$(git ls-files --others --exclude-standard)" ]]; then
-            echo "::error::Measurement files changed outside the selected skill."
-            exit 1
-          fi
-          echo "After: $SKILL_DIR from $SOURCE_SHA; measurement revision $GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"
-      - name: Run after evals even if the before verdict failed
-        id: after
-        if: ${{ !cancelled() && steps.after_source.outcome == 'success' }}
-        uses: github/evals-action@6e4c077e92194c7e75663d8d782426841047e887 # v0.2.0
-        with:
-          command: run
-          working-directory: .
-          eval-paths: ${{ matrix.evalPath }}
-          vally-version: '0.21.0'
-          copilot-token: ${{ github.token }}
-          runs: 1
-          workers: 1
-          max-retries: 0
-          upload-transcripts: false
-          report-id: ${{ matrix.id }}-after
-      - name: Keep only after grader verdicts
-        if: ${{ !cancelled() && steps.after_source.outcome == 'success' }}
-        env:
-          ARM: after
-          COMPARISON_ID: ${{ matrix.id }}
-          SELECTION_FILE: ${{ runner.temp }}/skill-selection/selection.json
-          ACTION_REPORT: ${{ steps.after.outputs.result-path }}
-          NATIVE_DIRECTORY: ${{ steps.after.outputs.native-diagnostics-path }}
-        run: node .github/scripts/skill-eval-comment.mjs collect "$RUNNER_TEMP/skill-comparison"
-      - name: Retain minimal comparison evidence
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: skill-comparison-${{ github.run_attempt }}-${{ matrix.id }}
-          path: ${{ runner.temp }}/skill-comparison/*.json
-          if-no-files-found: error
-          retention-days: 7
+      - name: Request comparison in the trusted workflow
+        run: echo "The default-branch workflow_run evaluates eligible skills after protected-environment approval."
diff --git a/README.md b/README.md
index 22f1f28..260f14c 100644
--- a/README.md
+++ b/README.md
@@ -203,9 +203,11 @@ required in the protected `evals` environment. Fork PRs do not run paid evals.
 The workflow updates one PR comment with per-case grader counts, failure
 details, and an all-skills coverage table. Unmeasured skills are marked not run;
 the comment does not imply a full-marketplace or multi-model run.
-Publication uses a separate [trusted `workflow_run` workflow](.github/workflows/skill-eval-comment.yml),
-not PR-controlled code with comment-write access. The paid-execution approval
-boundary remains a separate [documented integration gap](docs/checks-and-evals.md#pr-comparison-comment).
+Paid execution and publication use a separate
+[trusted `workflow_run` workflow](.github/workflows/skill-eval-comment.yml):
+native Vally behind approval, then a different job with comment-write access.
+The [trust limits and temporary Action workaround](docs/checks-and-evals.md#pr-comparison-comment)
+explain the separate credential/code boundaries.
 
 See [Checks and evals](docs/checks-and-evals.md) for CI details, local test
 commands, and Bash and PowerShell eval setup.
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index ba3eb09..37a29eb 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -128,26 +128,38 @@ explicitly start it with **Run workflow** in GitHub Actions
 (`workflow_dispatch`). Review the selected branch and its eval code before
 dispatching a run.
 
-[Skill evals](../.github/workflows/skill-evals.yml) compares each changed existing
-plugin skill with its version on current `main`. It uses the same PR merge
-revision's evals, graders, fixtures and shared marketplace context for both runs;
-only the selected skill comes from the exact base-parent or PR-head commit.
-Both Action invocations run sequentially in one job, reusing the Action's verified
-Vally installation. They use one trial per case and no trial retries. A failed
-before verdict does not prevent the after run; failures remain visible, without
-a new regression-only gate or statistical claim.
+[Skill evals](../.github/workflows/skill-evals.yml) is a read-only PR notification
+for plugin skill changes. A
+[trusted default-branch `workflow_run`](../.github/workflows/skill-eval-comment.yml)
+authenticates that source request and the still-current same-repository PR head,
+then selects the current PR merge revision and verifies its exact base/head
+parents. That selected revision, not the notifier's checkout or the trusted
+workflow's own SHA, supplies both arms' evals, graders, fixtures and shared
+marketplace context. Only the target skill switches between its exact base/head
+sources. The selected revisions are recorded before paid-job approval.
+
+Both native Vally CLI invocations run sequentially with the saved model, one
+trial/worker and zero retries. A failed Before verdict does not prevent After;
+failures stay visible without adding a regression-only gate or statistical claim.
 
 The workflow uses Vally 0.21, so native project Docker defaults are honored
 when configured. It does not configure or bypass the Copilot Evals plugin's
-separate Run entrypoint. The Action manages its runtime dependencies; parity
-with the locally pinned Copilot CLI is not assumed.
+separate Run entrypoint. The workflow installs CLI `0.21.0` outside the candidate
+checkout and uses Node 24, rather than accidentally running the older local
+development dependency. It honors the candidate project's native backend
+configuration, including the Docker defaults when present. It does not impose
+Docker on projects without those defaults. Container bootstrap, Plugin Run and
+host-runtime parity are separate limitations, not proved by these workflow edits.
 
 A maintainer must first configure the `evals` environment with required
 reviewers and review the PR's workflow, eval code and billing effects before
 approval. The read-only selection job refuses missing or unprotected
 environments, rather than automatically creating an unprotected environment.
-Same-repository PRs are trusted code with model-billing permission, not an
-OS/network sandbox; fork PRs are excluded and `pull_request_target` is not used.
+The paid job intentionally executes candidate eval/setup/grader code with its
+model credential after approval. Its Vally process has a fresh home and a narrow
+environment rather than inherited reporting/Actions credentials. That is process
+hygiene, not isolation from other same-user processes or a network/kernel sandbox.
+Fork PRs are excluded; `pull_request_target` is not used.
 The organization's Copilot billing policy must also permit workflow-token usage.
 The workflow changes none of these repository or organization settings.
 
@@ -182,29 +194,32 @@ Transition labels require two complete arms and the same individual checks.
 A missing counterpart is unknown, not a resolved failure. Partial failed-check
 evidence stays visible without claiming an improvement or regression.
 
-The small presentation helper reads the pinned Action's local native JSONL logs
+The small presentation helper reads the CLI's local native JSONL results
 and uploads only case/model identities, verdicts and safe check explanations.
 Raw trajectories, outputs, grader evidence, exceptions and transcripts are not
 uploaded or copied into comments. Failure reasons describe the check that
 failed, not a generated diagnosis; the evidence link leads to this workflow's
-native summaries and derived artifacts. Structured/derived artifacts use seven-day
+attempt and derived artifacts. Structured/derived artifacts use seven-day
 retention, subject to repository policy.
 
 Publication follows GitHub's standard
 [unprivileged PR / trusted `workflow_run` pattern](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/).
-The PR's selection/collection code has no comment-write permission. The separate
-[publisher](../.github/workflows/skill-eval-comment.yml) runs its workflow and
-helper from its exact default-branch `GITHUB_SHA`, with `contents: read`,
-`actions: read`, and `pull-requests: write`, but no model-billing permission.
-It never checks out the PR, installs PR dependencies, runs its grader/setup code,
-or executes downloaded artifacts. This workflow and helper must first be merged
-into the default branch before automatic publication can run.
+The PR workflow grants no model-billing or comment-write permission. Trusted
+selection reads candidate files without executing them. The protected paid job
+has `contents: read` and `copilot-requests: write`, but no PR-write permission.
+A fresh publisher job uses `contents: read`, `actions: read` and
+`pull-requests: write`, but no model-billing permission. Its workflow/helper come
+from the exact trusted default-branch `GITHUB_SHA`; that job never checks out the
+PR, installs its dependencies, runs graders, or executes artifacts. Both workflow
+files and the helper must be on the default branch before this automatic path
+can run. Model-free checks do not prove live paid execution or publication.
 
 Artifacts are untrusted data, not trusted because `workflow_run` downloaded
-them. Downloads select the triggering run and its producing attempt, into
+them. Downloads select this trusted eval run's actual producing attempt, into
 temporary storage outside the executable checkout. The trusted helper verifies
-the source workflow path, repository, completed PR event, run/attempt, PR
-association, current PR head, and merge parents against GitHub's API. It reads
+the notifier's source workflow/repository/completed PR event/association against
+GitHub's API, separately binds the paid run/attempt/trusted SHA, and checks the
+current PR head and selected merge parents. It reads
 only bounded regular JSON files at expected names, validates case/check shapes,
 escapes labels, and derives failure explanations instead of trusting arbitrary
 artifact messages. Mixed, malformed, oversized, or ambiguous data fails closed.
@@ -212,32 +227,36 @@ These checks do not make results supplied by PR-controlled code an independent
 attestation of that code's correctness.
 
 Publishing updates only its own bot comment. Per-PR serialization and the
-**source** run/attempt order prevent older results replacing newer comments;
-the publisher's own run number is not used as measurement provenance.
-Workflow-level per-PR concurrency cancels stale producing runs, but cannot undo
+**paid producing run/attempt** order prevent older results replacing newer
+comments. The notifier run is separately retained, not confused with the run
+that measured results. Per-PR workflow concurrency cancels stale runs, but cannot undo
 already billed model requests. No custom Run button, GitHub App, billing setting,
 or branch-protection change is introduced.
 
-**Partial producing-job reruns are unsupported.** Use **Re-run all jobs** so selection and
+**Partial paid-job reruns are unsupported.** Use **Re-run all jobs** so selection and
 both paid arms share an attempt and approval. A retry reusing a successful
 selection from a previous attempt is rejected before either paid arm, rather
 than spending credits and then failing to collect its artifacts. Retrying the
-separate publication workflow reuses the original source run/attempt and never
-repeats paid evals.
+publisher job alone reuses `needs.select.outputs.attempt`, the original selection
+and paid evidence, without repeating models. The evidence link includes that
+producing attempt; no GitHub event variables are overwritten.
 
 **Approval boundary:** required environment reviewers protect jobs that reference
 that environment, not every job an authorized workflow editor could add.
 `copilot-requests: write` is a workflow-token permission, not an environment
 secret. These declarations are not an immutable organization-wide billing
-policy. The publication split fixes comment-write privilege separation, not the
-paid job's independent approval boundary.
+policy. This template's paid entrypoint and approval declaration now come from
+the trusted default branch, not the PR. Owner-controlled Actions/Copilot policy
+still determines who can author other workflows and obtain billing permissions;
+this template cannot impose an organization-wide permission ceiling. No such
+settings or authentication policy is changed here.
 
-**Remaining paid-entrypoint gap:** the pinned native Action supports
+**Temporary native CLI entrypoint:** the pinned Evals Action supports
 `pull_request`, `push`, and `workflow_dispatch`, but rejects `workflow_run`
 ([source](https://github.com/github/evals-action/blob/6e4c077e92194c7e75663d8d782426841047e887/src/policy.ts#L9-L27)).
-Paid execution therefore still uses the existing PR-event route and must not be
-treated as secure against untrusted workflow editors. Moving that job behind a
-trusted `workflow_run` approval gate needs supported Action functionality or the
-existing native Vally CLI directly. Do not spoof a PR event or imply that moving
-the publisher has also solved billing authorization. No authentication or
-organization policy was changed by this publication implementation.
+We use the existing Vally CLI directly in the trusted paid job rather than
+spoofing a PR event or disabling checkout guards.
+[github/evals-action#26](https://github.com/github/evals-action/issues/26) tracks
+supported `workflow_run` source-PR/attempt and separate evaluated-revision
+handling. Once supported, replace only the native invocation/projection adapter
+with the Action, retaining approval, provenance and privilege separation.

From 6c1c553b5012c3c7807ca07f90e1a311a80de5d2 Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 11:19:24 -0800
Subject: [PATCH 06/14] Fix trusted workflow contexts and isolate comparison
 arm state

Grant selection PR-read access, initialize the native CLI path in a step rather than unavailable job runner context, and give Before and After separate fresh homes and temporary directories. Model-free command execution checks both state boundaries without running models.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/validation.test.mjs      | 17 ++++++++++++++---
 .github/workflows/skill-eval-comment.yml | 11 ++++++++---
 docs/checks-and-evals.md                 |  3 ++-
 3 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index 29a470c..aae8780 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -407,7 +407,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     const publisher = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
     assert.deepEqual(publisher.on, { workflow_run: { workflows: ["Skill evals (before and after)"], types: ["completed"] } });
     assert.deepEqual(publisher.permissions, {});
-    assert.deepEqual(publisher.jobs.select.permissions, { contents: "read", actions: "read" });
+    assert.deepEqual(publisher.jobs.select.permissions, { contents: "read", actions: "read", "pull-requests": "read" });
     assert.match(publisher.jobs.select.if, /conclusion != 'cancelled'/);
     assert.match(publisher.jobs.select.if, /head_repository\.full_name == github\.repository/);
     const job = publisher.jobs.evals;
@@ -427,7 +427,10 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     assert.notEqual(before.env.NATIVE_RUN_ID, after.env.NATIVE_RUN_ID);
     const install = job.steps.find((step) => step.run?.includes("npm install")).run;
     assert.match(install, /--prefix "\$RUNNER_TEMP\/skill-eval-tools".*@microsoft\/vally-cli@0\.21\.0/);
-    assert.match(job.env.VALLY_ENTRY, /runner\.temp.*skill-eval-tools/);
+    assert.equal(job.env.VALLY_ENTRY, undefined);
+    assert.doesNotMatch(JSON.stringify(job.env), /runner\./, "runner context is unavailable in job-level env");
+    assert.match(install, /VALLY_ENTRY="\$RUNNER_TEMP\/skill-eval-tools\/node_modules\/@microsoft\/vally-cli\/dist\/index\.js"/);
+    assert.match(install, /echo "VALLY_ENTRY=\$VALLY_ENTRY" >> "\$GITHUB_ENV"/);
     assert.equal(after.if, "${{ !cancelled() && steps.after_source.outcome == 'success' }}");
     assert.equal(job.steps.find((step) => step.id === "after_source").if,
       "${{ !cancelled() && steps.before_source.outcome == 'success' }}");
@@ -478,7 +481,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     mkdirSync(resolve(runner, "skill-native"), { recursive: true });
     const entry = resolve(directory, "synthetic-vally.mjs");
     writeFileSync(entry, `
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 const value = (flag) => process.argv[process.argv.indexOf(flag) + 1];
 const before = value('--run-id').endsWith('-before');
@@ -487,12 +490,16 @@ mkdirSync(output, { recursive: true });
 writeFileSync(join(output, 'observed.json'), JSON.stringify({
   args: process.argv.slice(2), credential: process.env.COPILOT_GITHUB_TOKEN,
   leaked: ['GH_TOKEN', 'GITHUB_TOKEN', 'ACTIONS_RUNTIME_TOKEN', 'NODE_OPTIONS'].some((key) => key in process.env),
+  home: process.env.HOME, temporary: process.env.TMPDIR,
+  inherited: [process.env.HOME, process.env.TMPDIR].some((path) => existsSync(join(path, 'before-state'))),
 }));
+if (before) for (const path of [process.env.HOME, process.env.TMPDIR]) writeFileSync(join(path, 'before-state'), 'synthetic');
 console.log(JSON.stringify({ type: 'trial-result', runId: value('--run-id'), raw: 'SYNTHETIC_PRIVATE_OUTPUT' }));
 console.log(JSON.stringify({ type: 'run-summary', runId: value('--run-id'), passed: !before, hadExecutionErrors: false }));
 process.exitCode = before ? 1 : 0;
 `);
     const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
+    const observedArms = [];
     for (const arm of ["before", "after"]) {
       const step = workflow.jobs.evals.steps.find((item) => item.id === arm);
       const result = spawnSync("bash", ["-c", step.run], {
@@ -513,6 +520,8 @@ process.exitCode = before ? 1 : 0;
       const observed = JSON.parse(readFileSync(resolve(runner, `skill-native/${arm}-artifacts/observed.json`), "utf8"));
       assert.equal(observed.credential, "synthetic-selected");
       assert.equal(observed.leaked, false);
+      assert.equal(observed.inherited, false, "each arm must start without Before's user or temporary state");
+      observedArms.push(observed);
       assert.equal(observed.args[0], "eval");
       assert.ok(observed.args.includes("--require-pass"));
       assert.ok(observed.args.includes("--output=jsonl"));
@@ -520,6 +529,8 @@ process.exitCode = before ? 1 : 0;
       assert.equal(records.at(-1).runId, `fixture-${arm}`);
       assert.equal(records.at(-1).passed, arm === "after");
     }
+    assert.notEqual(observedArms[0].home, observedArms[1].home);
+    assert.notEqual(observedArms[0].temporary, observedArms[1].temporary);
     assert.equal(readFileSync(resolve(directory, "outputs"), "utf8"), "exit=1\nexit=0\n");
   });
 
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
index 8f6d460..70fdddc 100644
--- a/.github/workflows/skill-eval-comment.yml
+++ b/.github/workflows/skill-eval-comment.yml
@@ -15,6 +15,7 @@ jobs:
     permissions:
       contents: read
       actions: read
+      pull-requests: read
     outputs:
       matrix: ${{ steps.select.outputs.matrix }}
       count: ${{ steps.select.outputs.count }}
@@ -115,7 +116,6 @@ jobs:
       matrix: ${{ fromJSON(needs.select.outputs.matrix) }}
     env:
       SKILL_DIR: ${{ matrix.directory }}
-      VALLY_ENTRY: ${{ runner.temp }}/skill-eval-tools/node_modules/@microsoft/vally-cli/dist/index.js
     steps:
       - name: Reject partial paid retries
         env:
@@ -142,7 +142,9 @@ jobs:
       - name: Install the pinned native CLI outside the candidate checkout
         run: |
           npm install --prefix "$RUNNER_TEMP/skill-eval-tools" --no-audit --no-fund @microsoft/vally-cli@0.21.0
-          mkdir -p "$RUNNER_TEMP/skill-native" "$RUNNER_TEMP/skill-eval-home"
+          VALLY_ENTRY="$RUNNER_TEMP/skill-eval-tools/node_modules/@microsoft/vally-cli/dist/index.js"
+          echo "VALLY_ENTRY=$VALLY_ENTRY" >> "$GITHUB_ENV"
+          mkdir -p "$RUNNER_TEMP/skill-native"
           node "$VALLY_ENTRY" --version
       - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
@@ -171,8 +173,11 @@ jobs:
           EVAL_PATH: ${{ matrix.evalPath }}
           NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-before
         run: &native_run |
+          set -e
+          arm_home="$(mktemp -d "$RUNNER_TEMP/skill-home-$ARM-XXXXXX")"
+          arm_tmp="$(mktemp -d "$RUNNER_TEMP/skill-tmp-$ARM-XXXXXX")"
           set +e
-          env -i PATH="$PATH" HOME="$RUNNER_TEMP/skill-eval-home" TMPDIR="$RUNNER_TEMP" VALLY_TELEMETRY_OPTOUT=1 COPILOT_GITHUB_TOKEN="$COPILOT_GITHUB_TOKEN" \
+          env -i PATH="$PATH" HOME="$arm_home" TMPDIR="$arm_tmp" VALLY_TELEMETRY_OPTOUT=1 COPILOT_GITHUB_TOKEN="$COPILOT_GITHUB_TOKEN" \
             node "$VALLY_ENTRY" eval --eval-spec "$EVAL_PATH" --work-dir "$PWD" --output=jsonl --output-dir "$RUNNER_TEMP/skill-native/$ARM-artifacts" \
             --run-id "$NATIVE_RUN_ID" --runs 1 --workers 1 --max-retries 0 --require-pass > "$RUNNER_TEMP/skill-native/$ARM.jsonl" 2> "$RUNNER_TEMP/skill-native/$ARM.stderr"
           code=$?
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index 37a29eb..89b8569 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -156,7 +156,8 @@ reviewers and review the PR's workflow, eval code and billing effects before
 approval. The read-only selection job refuses missing or unprotected
 environments, rather than automatically creating an unprotected environment.
 The paid job intentionally executes candidate eval/setup/grader code with its
-model credential after approval. Its Vally process has a fresh home and a narrow
+model credential after approval. Each arm's Vally process has a separate fresh
+home and temporary directory, plus a narrow
 environment rather than inherited reporting/Actions credentials. That is process
 hygiene, not isolation from other same-user processes or a network/kernel sandbox.
 Fork PRs are excluded; `pull_request_target` is not used.

From 943b65faee3a82f8d696b9177004325b1cf027ab Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 11:49:21 -0800
Subject: [PATCH 07/14] Bind comparison coverage to trusted selection and
 complete native counts

Require exact pre-execution selection job output when ingesting paid-job artifacts so coverage lists cannot be silently rewritten. Match native summary group/run/total/skip counts to recorded cases before marking an arm complete, retaining known failures when evidence is partial. Focused model-free checks and read-only projection of the retained 19-case evidence pass; no models or policy changes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/skill-eval-comment.mjs      | 28 ++++++++++++++++++---
 .github/scripts/skill-eval-comment.test.mjs | 28 +++++++++++++++++----
 .github/scripts/validation.test.mjs         |  1 +
 .github/workflows/skill-eval-comment.yml    |  3 +++
 docs/checks-and-evals.md                    |  6 +++++
 5 files changed, 57 insertions(+), 9 deletions(-)

diff --git a/.github/scripts/skill-eval-comment.mjs b/.github/scripts/skill-eval-comment.mjs
index 325e62d..7b459a9 100644
--- a/.github/scripts/skill-eval-comment.mjs
+++ b/.github/scripts/skill-eval-comment.mjs
@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { stripVTControlCharacters } from "node:util";
+import { isDeepStrictEqual, stripVTControlCharacters } from "node:util";
 
 const marker = "<!-- marketplace-skill-comparison:";
 const safeName = /^[a-z0-9][a-z0-9._-]*$/;
@@ -130,8 +130,27 @@ export function collectNative(contents, runId, exitCode) {
   if (typeof summary.hadExecutionErrors !== "boolean" || typeof summary.passed !== "boolean") {
     throw new Error("Invalid native completion verdict.");
   }
+  const key = (item) => JSON.stringify([item.evalFilePath, item.variant, item.model]);
+  const observed = new Map();
+  for (const trial of records.slice(0, -1)) {
+    const bucket = observed.get(key(trial)) ?? { run: 0, skipped: 0 };
+    if (trial.status === "skipped") bucket.skipped++;
+    else bucket.run++;
+    observed.set(key(trial), bucket);
+  }
+  const seen = new Set();
+  const complete = Array.isArray(summary.evals) && summary.evals.every((group) => {
+    if (!group || ![group.evalFilePath, group.variant, group.model].every((value) => typeof value === "string")) return false;
+    const identity = key(group), bucket = observed.get(identity) ?? { run: 0, skipped: 0 };
+    if (seen.has(identity)) return false;
+    seen.add(identity);
+    return typeof group.passed === "boolean" && !group.hadExecutionErrors && !group.hadGradingErrors &&
+      [group.stimuliRun, group.stimuliTotal, group.stimuliSkipped ?? 0].every((value) => Number.isSafeInteger(value) && value >= 0) &&
+      group.stimuliRun === bucket.run && group.stimuliTotal === bucket.run + bucket.skipped &&
+      (group.stimuliSkipped ?? 0) === bucket.skipped;
+  }) && [...observed.keys()].every((identity) => seen.has(identity));
   return {
-    state: [0, 1].includes(exitCode) && !summary.hadExecutionErrors && (!summary.passed || exitCode === 0) &&
+    state: complete && [0, 1].includes(exitCode) && !summary.hadExecutionErrors && (!summary.passed || exitCode === 0) &&
       !rows.some((row) => row.state === "error") ? rows.length ? "complete" : "not-run" : "error",
     rows,
   };
@@ -389,8 +408,9 @@ function safeArm(data) {
   return { state: data.state, rows };
 }
 
-export async function loadComparison(root, context, api = github) {
+export async function loadComparison(root, context, api = github, expectedSelection) {
   const selection = artifact(root, "selection.json");
+  if (!isDeepStrictEqual(selection, expectedSelection)) throw new Error("Artifact coverage differs from trusted selection.");
   await validateSelection(selection, context, api);
   const pairs = selection.include.map((entry) => {
     const pair = { key: `${entry.plugin}/${entry.skill}` };
@@ -473,7 +493,7 @@ async function main() {
     for (const [key, value] of Object.entries(authenticated)) {
       if (context[key] !== value) throw new Error("Selected context differs from the authenticated workflow.");
     }
-    const { selection, pairs } = await loadComparison(resolve(path), context);
+    const { selection, pairs } = await loadComparison(resolve(path), context, github, JSON.parse(process.env.SELECTED_SELECTION));
     const evidence = `${process.env.GITHUB_SERVER_URL}/${selection.repository}/actions/runs/${selection.run}/attempts/${selection.attempt}`;
     console.log(JSON.stringify(await postComparison(selection, renderComparison(selection, pairs, evidence), github, context)));
   } else throw new Error("Expected context, native or post.");
diff --git a/.github/scripts/skill-eval-comment.test.mjs b/.github/scripts/skill-eval-comment.test.mjs
index 1eff92e..7efd5d7 100644
--- a/.github/scripts/skill-eval-comment.test.mjs
+++ b/.github/scripts/skill-eval-comment.test.mjs
@@ -9,12 +9,17 @@ import { collectNative, comparisonContext, inventorySkills, loadComparison, post
 
 const trial = (extra = {}) => ({
   type: "trial-result", runId: "native", evalName: "draft", stimulus: "draft-positive", model: "model-a", variant: "main",
+  evalFilePath: "evals/local/skills/draft/eval.yaml",
   status: "success", gradeResult: { passed: false, details: [
     { graderType: "completed", name: "completed", passed: true },
     { graderType: "skill-invocation", name: "routing", passed: false, evidence: "SECRET_RAW_GRADER_OUTPUT" },
   ] }, trajectory: { output: "SECRET_RAW_ANSWER", events: [] }, ...extra,
 });
-const footer = { type: "run-summary", runId: "native", hadExecutionErrors: false, passed: false };
+const footer = {
+  type: "run-summary", runId: "native", hadExecutionErrors: false, passed: false,
+  evals: [{ evalFilePath: "evals/local/skills/draft/eval.yaml", variant: "main", model: "model-a",
+    passed: false, stimuliRun: 1, stimuliTotal: 1 }],
+};
 const selection = {
   base: "a".repeat(40), head: "b".repeat(40), changed: ["local/draft"],
   skills: [{ key: "local/draft", hasEval: true }, { key: "local/neighbor", hasEval: true }, { key: "remote/run", hasEval: false }],
@@ -49,7 +54,18 @@ test("native CLI outcomes preserve behavioral failures and completed checks besi
   assert.equal(collectNative(contents(trial(), footer), "native", 1).state, "complete");
   assert.equal(collectNative(contents(trial(), footer), "native", 2).state, "error");
   assert.equal(collectNative(contents(trial(), { ...footer, passed: true }), "native", 1).state, "error");
-  assert.equal(collectNative(contents(footer), "native", 0).state, "not-run");
+  assert.equal(collectNative(contents({ ...footer, evals: [] }), "native", 0).state, "not-run");
+  assert.equal(collectNative(contents(footer), "native", 0).state, "error", "missing recorded cases cannot be complete");
+  for (const group of [
+    { ...footer.evals[0], stimuliTotal: 2 },
+    { ...footer.evals[0], stimuliRun: 2 },
+    { ...footer.evals[0], model: "wrong-model" },
+    { ...footer.evals[0], hadGradingErrors: true },
+  ]) {
+    const partial = collectNative(contents(trial(), { ...footer, evals: [group] }), "native", 1);
+    assert.equal(partial.state, "error");
+    assert.equal(partial.rows[0].checks[1].passed, false, "known failures remain visible in incomplete evidence");
+  }
   const errored = trial({ gradeResult: { passed: false, details: [
     { graderType: "skill-invocation", name: "routing", passed: false },
     { graderType: "program", status: "error", passed: false },
@@ -235,7 +251,7 @@ test("untrusted artifacts are bounded data, source-bound and re-sanitized before
   arm.data.rows[0].checks[1].name = "A&B";
   arm.data.rows[0].checks[1].reason = "SECRET_UNTRUSTED_EVIDENCE";
   writeFileSync(join(root, `${arm.id}-before.json`), JSON.stringify(arm));
-  const loaded = await loadComparison(root, context, api);
+  const loaded = await loadComparison(root, context, api, selected);
   const rendered = renderComparison(loaded.selection, loaded.pairs, "https://example.test");
   assert.doesNotMatch(rendered, /<script>|@everyone|SECRET_UNTRUSTED_EVIDENCE/i);
   assert.match(rendered, /A&amp;B/);
@@ -248,9 +264,11 @@ test("untrusted artifacts are bounded data, source-bound and re-sanitized before
     sha: selected.merge, parents: [{ sha: selected.head }, { sha: selected.base }],
   })), /merge parents/);
   writeFileSync(join(root, `${arm.id}-before.json`), JSON.stringify({ ...arm, attempt: "1" }));
-  await assert.rejects(loadComparison(root, context, api), /Mixed comparison artifacts/);
+  await assert.rejects(loadComparison(root, context, api, selected), /Mixed comparison artifacts/);
+  writeFileSync(join(root, "selection.json"), JSON.stringify({ ...selected, include: [] }));
+  await assert.rejects(loadComparison(root, context, api, selected), /coverage differs/);
   writeFileSync(join(root, "selection.json"), " ".repeat(1024 * 1024 + 1));
-  await assert.rejects(loadComparison(root, context, api), /bounded regular/);
+  await assert.rejects(loadComparison(root, context, api, selected), /bounded regular/);
 });
 
 test("native CLI projection binds its run and trusted workflow without an Action report", (t) => {
diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index aae8780..14713f3 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -444,6 +444,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     const download = comment.steps.find((step) => step.uses?.startsWith("actions/download-artifact@")).with;
     assert.equal(download.pattern, "skill-comparison-${{ needs.select.outputs.attempt }}-*");
     assert.equal(comment.steps.at(-1).env.PRODUCING_ATTEMPT, "${{ needs.select.outputs.attempt }}");
+    assert.equal(comment.steps.at(-1).env.SELECTED_SELECTION, "${{ needs.select.outputs.selection }}");
     assert.equal(download["run-id"], undefined, "publication reads this trusted paid run, not request-run artifacts");
     assert.equal(download.path, "${{ runner.temp }}/skill-comparison");
     for (const step of [...publisher.jobs.select.steps, ...job.steps].filter((step) => step.uses?.startsWith("actions/upload-artifact@"))) {
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
index 70fdddc..c93d45b 100644
--- a/.github/workflows/skill-eval-comment.yml
+++ b/.github/workflows/skill-eval-comment.yml
@@ -21,6 +21,7 @@ jobs:
       count: ${{ steps.select.outputs.count }}
       attempt: ${{ steps.select.outputs.attempt }}
       context: ${{ steps.context.outputs.context }}
+      selection: ${{ steps.select.outputs.selection }}
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
@@ -93,6 +94,7 @@ jobs:
           const selection = { ...context, include, changed: keys, skills: inventorySkills(process.cwd()) };
           writeFileSync(resolve(process.env.RUNNER_TEMP, 'selection.json'), JSON.stringify(selection));
           appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify({ include })}\ncount=${include.length}\nattempt=${context.attempt}\n`);
+          appendFileSync(process.env.GITHUB_OUTPUT, `selection=${JSON.stringify(selection)}\n`);
           JS
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
@@ -263,4 +265,5 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           PRODUCING_ATTEMPT: ${{ needs.select.outputs.attempt }}
           SELECTED_CONTEXT: ${{ needs.select.outputs.context }}
+          SELECTED_SELECTION: ${{ needs.select.outputs.selection }}
         run: node .github/scripts/skill-eval-comment.mjs post "$RUNNER_TEMP/skill-comparison"
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index 89b8569..af945f5 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -192,6 +192,9 @@ equal totals with changed failure identities. Errors, skipped cases and missing
 arms never become passing counts. These single-trial observations do not prove
 causation.
 Transition labels require two complete arms and the same individual checks.
+A complete native arm also requires every declared summary group/count to match
+its recorded case/model rows. Missing cases, mismatched totals and grading errors
+keep the arm incomplete while preserving any known failed-check details.
 A missing counterpart is unknown, not a resolved failure. Partial failed-check
 evidence stays visible without claiming an improvement or regression.
 
@@ -221,6 +224,9 @@ temporary storage outside the executable checkout. The trusted helper verifies
 the notifier's source workflow/repository/completed PR event/association against
 GitHub's API, separately binds the paid run/attempt/trusted SHA, and checks the
 current PR head and selected merge parents. It reads
+the selection's coverage only when it exactly matches the trusted pre-execution
+job output, so a paid-job artifact cannot silently change the selected skill or
+inventory lists. It reads
 only bounded regular JSON files at expected names, validates case/check shapes,
 escapes labels, and derives failure explanations instead of trusting arbitrary
 artifact messages. Mixed, malformed, oversized, or ambiguous data fails closed.

From df46f6c1cfdb59993e5e0c1118c1b3df0be2ca27 Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 11:57:33 -0800
Subject: [PATCH 08/14] Allowlist paid comparison artifact filenames

Upload only the selected skill before/after verdict JSON files, not additional files candidate processes could place in the shared temporary directory. Trusted selection remains a separate read-only-job artifact. Add a focused upload-path regression; candidate execution exposure remains explicit.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/validation.test.mjs      | 5 +++++
 .github/workflows/skill-eval-comment.yml | 4 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index 14713f3..faf04bf 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -450,6 +450,11 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     for (const step of [...publisher.jobs.select.steps, ...job.steps].filter((step) => step.uses?.startsWith("actions/upload-artifact@"))) {
       assert.match(step.with.name, /github\.run_attempt/, "reruns must not collide with or import earlier-attempt artifacts");
     }
+    const evidence = job.steps.find((step) => step.uses?.startsWith("actions/upload-artifact@"));
+    assert.deepEqual(evidence.with.path.trim().split("\n"), [
+      "${{ runner.temp }}/skill-comparison/${{ matrix.id }}-before.json",
+      "${{ runner.temp }}/skill-comparison/${{ matrix.id }}-after.json",
+    ], "paid jobs may upload only the exact expected verdict files, not extra candidate-created JSON");
     assert.equal(job.permissions["pull-requests"], undefined);
     assert.equal(comment.steps.find((step) => step.uses?.startsWith("actions/checkout@")).with.ref,
       "${{ github.sha }}", "workflow_run's default-branch SHA, never the PR head, supplies executable publishing code");
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
index c93d45b..1763c4e 100644
--- a/.github/workflows/skill-eval-comment.yml
+++ b/.github/workflows/skill-eval-comment.yml
@@ -229,7 +229,9 @@ jobs:
         if: ${{ !cancelled() }}
         with:
           name: skill-comparison-${{ github.run_attempt }}-${{ matrix.id }}
-          path: ${{ runner.temp }}/skill-comparison/*.json
+          path: |
+            ${{ runner.temp }}/skill-comparison/${{ matrix.id }}-before.json
+            ${{ runner.temp }}/skill-comparison/${{ matrix.id }}-after.json
           if-no-files-found: error
           retention-days: 7
       - name: Keep failed native outcomes visible

From a519c9b16ccb5d9d9bf96c759c85301b87b7179b Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 12:43:40 -0800
Subject: [PATCH 09/14] Recheck PR eligibility before each paid arm and handle
 quoted source paths

Reuse a trusted current-PR check after environment approval and before Before/After, using immutable selected context and minimum PR-read permission. Exclude the selected skill with a literal Git pathspec instead of parsing displayed filenames. Regressions cover closed/moved/fork PRs and non-ASCII source files while retaining outside-skill drift rejection.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/skill-eval-comment.mjs      | 21 +++++++++++++++------
 .github/scripts/skill-eval-comment.test.mjs | 13 ++++++++++++-
 .github/scripts/validation.test.mjs         | 20 ++++++++++++++++----
 .github/workflows/skill-eval-comment.yml    | 21 +++++++++++++++++----
 docs/checks-and-evals.md                    |  3 +++
 5 files changed, 63 insertions(+), 15 deletions(-)

diff --git a/.github/scripts/skill-eval-comment.mjs b/.github/scripts/skill-eval-comment.mjs
index cf33686..47552e8 100644
--- a/.github/scripts/skill-eval-comment.mjs
+++ b/.github/scripts/skill-eval-comment.mjs
@@ -428,13 +428,18 @@ export async function loadComparison(root, context, api = github, expectedSelect
   return { selection, pairs };
 }
 
+export async function assertCurrentPullRequest(context, api = github) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(context?.repository ?? "") || !positive(context.pullNumber) ||
+      !sha.test(context.head ?? "")) throw new Error("Invalid PR context.");
+  const pr = await api(`repos/${context.repository}/pulls/${context.pullNumber}`);
+  if (pr.state !== "open" || pr.head?.sha !== context.head || pr.head?.repo?.full_name !== context.repository) {
+    throw new Error("PR closed, head changed, or fork context; no paid run or comment allowed.");
+  }
+}
+
 export async function postComparison(selection, body, api = github, context) {
-  if (!/^[\w.-]+\/[\w.-]+$/.test(context?.repository ?? "") || !positive(context.pullNumber)) throw new Error("Invalid PR context.");
+  await assertCurrentPullRequest({ ...context, head: selection.head }, api);
   const endpoint = `repos/${context.repository}`;
-  const pr = await api(`${endpoint}/pulls/${context.pullNumber}`);
-  if (pr.state !== "open" || pr.head.sha !== selection.head || pr.head.repo.full_name !== context.repository) {
-    throw new Error("PR closed, head changed, or fork context; no comment published.");
-  }
   const key = `${marker}${context.repository}/${sourceWorkflow} -->`;
   const comments = [];
   for (let page = 1; ; page++) {
@@ -482,6 +487,10 @@ async function main() {
     for (const [key, value] of Object.entries({ context: JSON.stringify(selected), merge: selected.merge })) {
       writeFileSync(process.env.GITHUB_OUTPUT, `${key}=${value}\n`, { flag: "a" });
     }
+  } else if (command === "verify") {
+    const context = JSON.parse(process.env.SELECTED_CONTEXT);
+    validateIdentity(context, process.env);
+    await assertCurrentPullRequest(context);
   } else if (command === "native") {
     const selection = json(resolve(process.env.SELECTION_FILE));
     validateIdentity(selection, process.env);
@@ -505,7 +514,7 @@ async function main() {
     const { selection, pairs } = await loadComparison(resolve(path), context, github, JSON.parse(process.env.SELECTED_SELECTION));
     const evidence = `${process.env.GITHUB_SERVER_URL}/${selection.repository}/actions/runs/${selection.run}/attempts/${selection.attempt}`;
     console.log(JSON.stringify(await postComparison(selection, renderComparison(selection, pairs, evidence), github, context)));
-  } else throw new Error("Expected context, native or post.");
+  } else throw new Error("Expected context, verify, native or post.");
 }
 
 if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
diff --git a/.github/scripts/skill-eval-comment.test.mjs b/.github/scripts/skill-eval-comment.test.mjs
index e4c75b8..8baa39c 100644
--- a/.github/scripts/skill-eval-comment.test.mjs
+++ b/.github/scripts/skill-eval-comment.test.mjs
@@ -5,7 +5,7 @@ import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { collectNative, comparisonContext, inventorySkills, loadComparison, postComparison, projectTrials, publisherContext, renderComparison, selectionContext, validateSelection } from "./skill-eval-comment.mjs";
+import { assertCurrentPullRequest, collectNative, comparisonContext, inventorySkills, loadComparison, postComparison, projectTrials, publisherContext, renderComparison, selectionContext, validateSelection } from "./skill-eval-comment.mjs";
 
 const trial = (extra = {}) => ({
   type: "trial-result", runId: "native", evalName: "draft", stimulus: "draft-positive", model: "model-a", variant: "main",
@@ -185,6 +185,17 @@ test("comment publishing checks current PR head, bot ownership, run order and up
   await assert.rejects(postComparison(selection, "Wrong head", api, context), /head changed/);
 });
 
+test("the pre-arm PR check rejects closure, changed heads and fork context after approval", async () => {
+  const context = { repository: "example/repo", pullNumber: 2, head: selection.head };
+  const pr = { state: "open", head: { sha: selection.head, repo: { full_name: context.repository } } };
+  await assertCurrentPullRequest(context, async () => pr);
+  for (const changed of [
+    { ...pr, state: "closed" },
+    { ...pr, head: { ...pr.head, sha: "c".repeat(40) } },
+    { ...pr, head: { ...pr.head, repo: { full_name: "fork/repo" } } },
+  ]) await assert.rejects(assertCurrentPullRequest(context, async () => changed), /no paid run or comment/);
+});
+
 function sourceFixture() {
   const context = { repository: "example/repo", run: "999", attempt: "7", runNumber: 9,
     pullNumber: 2, head: selection.head, runHead: "c".repeat(40),
diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index bc6b613..2c26a51 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -414,7 +414,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     const job = publisher.jobs.evals;
     assert.equal(job.environment, "evals");
     assert.equal(job.strategy["fail-fast"], false);
-    assert.deepEqual(job.permissions, { contents: "read", "copilot-requests": "write" });
+    assert.deepEqual(job.permissions, { contents: "read", "copilot-requests": "write", "pull-requests": "read" });
     const before = job.steps.find((step) => step.id === "before");
     const after = job.steps.find((step) => step.id === "after");
     assert.equal(before.run, after.run, "both arms use the same native invocation");
@@ -434,7 +434,15 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     assert.doesNotMatch(JSON.stringify(job.env), /runner\./, "runner context is unavailable in job-level env");
     assert.match(install, /VALLY_ENTRY="\$RUNNER_TEMP\/skill-eval-tools\/node_modules\/@microsoft\/vally-cli\/dist\/index\.js"/);
     assert.match(install, /echo "VALLY_ENTRY=\$VALLY_ENTRY" >> "\$GITHUB_ENV"/);
-    assert.equal(after.if, "${{ !cancelled() && steps.after_source.outcome == 'success' }}");
+    for (const arm of ["before", "after"]) {
+      const current = job.steps.find((step) => step.id === `${arm}_current`);
+      assert.match(current.run, /trusted\/\.github\/scripts\/skill-eval-comment\.mjs" verify$/);
+      assert.equal(current.env.SELECTED_CONTEXT, "${{ needs.select.outputs.context }}");
+      assert.equal(current.env.GH_TOKEN, "${{ github.token }}");
+      const native = job.steps.find((step) => step.id === arm);
+      assert.equal(native.if, `\${{ !cancelled() && steps.${arm}_current.outcome == 'success' }}`);
+      assert.equal(job.steps.indexOf(current) + 1, job.steps.indexOf(native), "recheck immediately before either paid arm");
+    }
     assert.equal(job.steps.find((step) => step.id === "after_source").if,
       "${{ !cancelled() && steps.before_source.outcome == 'success' }}");
     assert.equal(workflow.jobs.comment, undefined, "PR-controlled jobs must not publish with write permission");
@@ -458,7 +466,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
       "${{ runner.temp }}/skill-comparison/${{ matrix.id }}-before.json",
       "${{ runner.temp }}/skill-comparison/${{ matrix.id }}-after.json",
     ], "paid jobs may upload only the exact expected verdict files, not extra candidate-created JSON");
-    assert.equal(job.permissions["pull-requests"], undefined);
+    assert.equal(job.permissions["pull-requests"], "read");
     assert.equal(comment.steps.find((step) => step.uses?.startsWith("actions/checkout@")).with.ref,
       "${{ github.sha }}", "workflow_run's default-branch SHA, never the PR head, supplies executable publishing code");
     assert.doesNotMatch(comment.steps.map((step) => step.run ?? "").join("\n"), /npm |evals-action|git fetch|gh pr checkout/);
@@ -612,6 +620,7 @@ process.exitCode = before ? 1 : 0;
     git("init", "--initial-branch=main");
     file(`${target}/SKILL.md`, "base skill\n");
     file(`${target}/old.md`, "base-only file\n");
+    file(`${target}/r\u00e9sum\u00e9.md`, "base non-ASCII path\n");
     file("plugins/example/skills/neighbor/SKILL.md", "base neighbor\n");
     file("plugins/example/skills/deleted/SKILL.md", "deleted skill\n");
     file("evals/example/skills/changed/eval.yaml", "fixed measurement\n");
@@ -621,6 +630,7 @@ process.exitCode = before ? 1 : 0;
     git("checkout", "-b", "candidate");
     file(`${target}/SKILL.md`, "head skill\n");
     file(`${target}/new.md`, "head-only file\n");
+    file(`${target}/r\u00e9sum\u00e9.md`, "head non-ASCII path\n");
     rmSync(resolve(repository, `${target}/old.md`));
     rmSync(resolve(repository, "plugins/example/skills/deleted/SKILL.md"));
     file("plugins/example/skills/neighbor/SKILL.md", "head neighbor without an eval\n");
@@ -678,12 +688,14 @@ process.exitCode = before ? 1 : 0;
       assert.equal(restored.status, 0, restored.stderr);
       assert.equal(git("rev-parse", "HEAD"), merge);
       assert.equal(readFileSync(resolve(repository, `${target}/SKILL.md`), "utf8"), expected);
+      assert.equal(readFileSync(resolve(repository, `${target}/r\u00e9sum\u00e9.md`), "utf8"),
+        id === "before_source" ? "base non-ASCII path\n" : "head non-ASCII path\n");
       assert.equal(existsSync(resolve(repository, `${target}/old.md`)), id === "before_source");
       assert.equal(existsSync(resolve(repository, `${target}/new.md`)), id === "after_source");
       assert.equal(existsSync(resolve(repository, `${target}/main.md`)), id === "before_source");
       assert.equal(readFileSync(resolve(repository, "plugins/example/skills/neighbor/SKILL.md"), "utf8"), "head neighbor without an eval\n");
       assert.equal(readFileSync(resolve(repository, "evals/example/skills/changed/eval.yaml"), "utf8"), "fixed measurement\n");
-      assert.ok(git("diff", "--name-only", "HEAD").split("\n").every((path) => path.startsWith(`${target}/`)));
+      assert.ok(git("diff", "--name-only", "-z", "HEAD").split("\0").filter(Boolean).every((path) => path.startsWith(`${target}/`)));
     }
     file("evals/example/skills/changed/eval.yaml", "unexpected measurement change\n");
     const drift = spawnSync("bash", ["-c", workflow.jobs.evals.steps.find((entry) => entry.id === "after_source").run], {
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
index 77a807d..c83bebb 100644
--- a/.github/workflows/skill-eval-comment.yml
+++ b/.github/workflows/skill-eval-comment.yml
@@ -113,6 +113,7 @@ jobs:
     permissions:
       contents: read
       copilot-requests: write
+      pull-requests: read
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.select.outputs.matrix) }}
@@ -164,12 +165,19 @@ jobs:
           set -euo pipefail
           git --literal-pathspecs restore --source="$SOURCE_SHA" --staged --worktree -- "$SKILL_DIR"
           git --literal-pathspecs diff --exit-code "$SOURCE_SHA" -- "$SKILL_DIR"
-          if [[ -n "$(git diff --name-only HEAD | awk -v dir="$SKILL_DIR/" 'index($0,dir)!=1')$(git ls-files --others --exclude-standard)" ]]; then
+          if ! git diff --quiet HEAD -- . ":(exclude,literal)$SKILL_DIR" || [[ -n "$(git ls-files --others --exclude-standard)" ]]; then
             echo "::error::Measurement files changed outside the selected skill."
             exit 1
           fi
+      - name: Recheck PR after approval and before Before
+        id: before_current
+        env: &current_pr_environment
+          GH_TOKEN: ${{ github.token }}
+          SELECTED_CONTEXT: ${{ needs.select.outputs.context }}
+        run: &verify_current_pr node "$GITHUB_WORKSPACE/trusted/.github/scripts/skill-eval-comment.mjs" verify
       - name: Run native Before
         id: before
+        if: ${{ !cancelled() && steps.before_current.outcome == 'success' }}
         continue-on-error: true
         working-directory: candidate
         env:
@@ -189,7 +197,7 @@ jobs:
           echo "exit=$code" >> "$GITHUB_OUTPUT"
           exit "$code"
       - name: Retain only Before verdicts with trusted code
-        if: ${{ !cancelled() && steps.before_source.outcome == 'success' }}
+        if: ${{ !cancelled() && steps.before_current.outcome == 'success' }}
         working-directory: candidate
         env:
           ARM: before
@@ -206,9 +214,14 @@ jobs:
         env:
           SOURCE_SHA: ${{ matrix.head }}
         run: *restore_source
+      - name: Recheck PR before After
+        id: after_current
+        if: ${{ !cancelled() && steps.after_source.outcome == 'success' }}
+        env: *current_pr_environment
+        run: *verify_current_pr
       - name: Run native After even when Before fails
         id: after
-        if: ${{ !cancelled() && steps.after_source.outcome == 'success' }}
+        if: ${{ !cancelled() && steps.after_current.outcome == 'success' }}
         continue-on-error: true
         working-directory: candidate
         env:
@@ -218,7 +231,7 @@ jobs:
           NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-after
         run: *native_run
       - name: Retain only After verdicts with trusted code
-        if: ${{ !cancelled() && steps.after_source.outcome == 'success' }}
+        if: ${{ !cancelled() && steps.after_current.outcome == 'success' }}
         working-directory: candidate
         env:
           ARM: after
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index 51fc3f5..e756154 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -340,6 +340,9 @@ parents. That selected revision, not the notifier's checkout or the trusted
 workflow's own SHA, supplies both arms' evals, graders, fixtures and shared
 marketplace context. Only the target skill switches between its exact base/head
 sources. The selected revisions are recorded before paid-job approval.
+After approval, trusted code rechecks that the PR is still open at the selected
+same-repository head immediately before each paid arm. A later closure or push
+can still race an already-started request; the check cannot undo billed work.
 
 Both native Vally CLI invocations run sequentially with the saved model, one
 trial/worker and zero retries. A failed Before verdict does not prevent After;

From 4f212e98877e2ddad0e9e0e77de3cf53c30f8e7d Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 13:10:24 -0800
Subject: [PATCH 10/14] Scope comparison cancellation to authenticated selected
 heads

Remove workflow-level privileged cancellation driven by unverified notifications. Only successfully selected paid jobs can cancel duplicates for the verified PR/head/skill; publisher jobs serialize by verified PR without cancellation. Document that a newer head does not immediately cancel an in-flight older arm, and that pre-arm checks stop only subsequent work. No custom cancellation controller or model runs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/validation.test.mjs      |  8 ++++++++
 .github/workflows/skill-eval-comment.yml | 11 +++++++----
 docs/checks-and-evals.md                 |  9 +++++++--
 3 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index 2c26a51..c07e54c 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -408,10 +408,15 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     const publisher = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
     assert.deepEqual(publisher.on, { workflow_run: { workflows: ["Skill evals (before and after)"], types: ["completed"] } });
     assert.deepEqual(publisher.permissions, {});
+    assert.equal(publisher.concurrency, undefined, "unverified source events must not cancel privileged work");
     assert.deepEqual(publisher.jobs.select.permissions, { contents: "read", actions: "read", "pull-requests": "read" });
     assert.match(publisher.jobs.select.if, /conclusion != 'cancelled'/);
     assert.match(publisher.jobs.select.if, /head_repository\.full_name == github\.repository/);
     const job = publisher.jobs.evals;
+    assert.match(job.if, /needs\.select\.result == 'success'/);
+    assert.equal(job.concurrency["cancel-in-progress"], true);
+    assert.equal(job.concurrency.group,
+      "skill-eval-run-${{ github.repository }}-${{ fromJSON(needs.select.outputs.context).pullNumber }}-${{ fromJSON(needs.select.outputs.context).head }}-${{ matrix.id }}");
     assert.equal(job.environment, "evals");
     assert.equal(job.strategy["fail-fast"], false);
     assert.deepEqual(job.permissions, { contents: "read", "copilot-requests": "write", "pull-requests": "read" });
@@ -448,6 +453,9 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     assert.equal(workflow.jobs.comment, undefined, "PR-controlled jobs must not publish with write permission");
     for (const step of Object.values(workflow.jobs)) assert.equal(step.permissions?.["pull-requests"], undefined);
     const comment = publisher.jobs.publish;
+    assert.equal(comment.concurrency["cancel-in-progress"], false);
+    assert.equal(comment.concurrency.group,
+      "skill-eval-comment-${{ github.repository }}-${{ fromJSON(needs.select.outputs.context).pullNumber }}");
     assert.deepEqual(comment.permissions, { contents: "read", actions: "read", "pull-requests": "write" });
     assert.equal(comment.permissions["copilot-requests"], undefined);
     assert.match(comment.if, /!cancelled\(\)/);
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
index c83bebb..2cbe109 100644
--- a/.github/workflows/skill-eval-comment.yml
+++ b/.github/workflows/skill-eval-comment.yml
@@ -4,9 +4,6 @@ on:
     workflows: ["Skill evals (before and after)"]
     types: [completed]
 permissions: {}
-concurrency:
-  group: skill-eval-run-${{ github.event.workflow_run.pull_requests[0].number }}
-  cancel-in-progress: true
 jobs:
   select:
     if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion != 'cancelled' && github.event.workflow_run.head_repository.full_name == github.repository
@@ -105,7 +102,7 @@ jobs:
 
   evals:
     needs: select
-    if: needs.select.outputs.count != '0'
+    if: needs.select.result == 'success' && needs.select.outputs.count != '0'
     name: ${{ matrix.plugin }}/${{ matrix.skill }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -117,6 +114,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.select.outputs.matrix) }}
+    concurrency:
+      group: skill-eval-run-${{ github.repository }}-${{ fromJSON(needs.select.outputs.context).pullNumber }}-${{ fromJSON(needs.select.outputs.context).head }}-${{ matrix.id }}
+      cancel-in-progress: true
     env:
       SKILL_DIR: ${{ matrix.directory }}
     steps:
@@ -261,6 +261,9 @@ jobs:
     if: ${{ !cancelled() && needs.select.result == 'success' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    concurrency:
+      group: skill-eval-comment-${{ github.repository }}-${{ fromJSON(needs.select.outputs.context).pullNumber }}
+      cancel-in-progress: false
     permissions:
       contents: read
       actions: read
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index e756154..47e6bb1 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -446,8 +446,13 @@ attestation of that code's correctness.
 Publishing updates only its own bot comment. Per-PR serialization and the
 **paid producing run/attempt** order prevent older results replacing newer
 comments. The notifier run is separately retained, not confused with the run
-that measured results. Per-PR workflow concurrency cancels stale runs, but cannot undo
-already billed model requests. No custom Run button, GitHub App, billing setting,
+that measured results. Paid-job concurrency starts only after authenticated
+selection and is scoped to the verified PR/head/skill, so a rejected or delayed
+old-head notification cannot cancel another head's approved comparison.
+Same-head duplicates can be cancelled; a newer PR head does not automatically
+cancel an already-running old-head arm. The pre-arm check prevents its next paid
+arm, but cannot undo already billed requests. Publisher jobs serialize by
+verified PR without cancelling each other. No custom Run button, GitHub App, billing setting,
 or branch-protection change is introduced.
 
 **Partial paid-job reruns are unsupported.** Use **Re-run all jobs** so selection and

From 01bf54775f8951460437365887238fd0b0b3541c Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 15:51:41 -0800
Subject: [PATCH 11/14] Delegate PR comparisons to reusable Evals Action

Keep repository selection, approval, token permissions and concurrency visible while moving paired native execution, bounded projections and publication to the pinned comparison subaction.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/select-skill-evals.mjs      | 108 ++++
 .github/scripts/select-skill-evals.test.mjs | 125 +++++
 .github/scripts/skill-eval-comment.mjs      | 522 --------------------
 .github/scripts/skill-eval-comment.test.mjs | 323 ------------
 .github/scripts/validation.test.mjs         | 330 +++----------
 .github/workflows/skill-eval-comment.yml    | 215 ++------
 README.md                                   |  11 +-
 docs/checks-and-evals.md                    | 237 ++++-----
 8 files changed, 417 insertions(+), 1454 deletions(-)
 create mode 100644 .github/scripts/select-skill-evals.mjs
 create mode 100644 .github/scripts/select-skill-evals.test.mjs
 delete mode 100644 .github/scripts/skill-eval-comment.mjs
 delete mode 100644 .github/scripts/skill-eval-comment.test.mjs

diff --git a/.github/scripts/select-skill-evals.mjs b/.github/scripts/select-skill-evals.mjs
new file mode 100644
index 0000000..5817d96
--- /dev/null
+++ b/.github/scripts/select-skill-evals.mjs
@@ -0,0 +1,108 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { appendFileSync, existsSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { githubApi } from "./check-remote-pins.mjs";
+
+const name = /^[a-z0-9][a-z0-9._-]*$/;
+const sha = /^[a-f0-9]{40}$/;
+const parse = (contents) => {
+  try { return JSON.parse(contents); } catch { throw new Error("Invalid skill selection JSON."); }
+};
+const json = (path) => parse(readFileSync(path, "utf8"));
+
+function pinnedTree(repo, commit) {
+  const response = githubApi(`repos/${repo}/git/trees/${commit}?recursive=1`, (command, args, options) =>
+    spawnSync(command, args, { ...options, timeout: 30000, maxBuffer: 8 * 1024 * 1024 }));
+  if (response.status !== 200) throw new Error(`Pinned skill inventory returned GitHub HTTP ${response.status}.`);
+  return parse(response.body);
+}
+
+export function inventorySkills(root, readTree = pinnedTree) {
+  const skills = [];
+  for (const plugin of json(resolve(root, "marketplace.json")).plugins) {
+    if (!name.test(plugin.name)) throw new Error("Unsupported catalog plugin name.");
+    let names;
+    if (typeof plugin.source === "string") {
+      if (plugin.source !== `./plugins/${plugin.name}`) throw new Error("Expected a self-contained local plugin path.");
+      const directory = resolve(root, plugin.source, "skills");
+      names = existsSync(directory) ? readdirSync(directory).filter((skill) =>
+        name.test(skill) && existsSync(resolve(directory, skill, "SKILL.md"))) : [];
+    } else {
+      const source = plugin.source;
+      if (source?.source !== "github" || !/^[\w.-]+\/[\w.-]+$/.test(source.repo) || !sha.test(source.sha)) {
+        throw new Error("Remote skill inventory requires a pinned GitHub source.");
+      }
+      const prefix = source.path ? `${source.path}/` : "";
+      if (prefix.split("/").includes("..")) throw new Error("Unsupported remote plugin path.");
+      const tree = readTree(source.repo, source.sha);
+      if (tree.truncated || !Array.isArray(tree.tree)) throw new Error("Incomplete pinned remote skill inventory.");
+      names = tree.tree.flatMap((entry) => {
+        if (entry.type !== "blob" || !entry.path.startsWith(`${prefix}skills/`)) return [];
+        const parts = entry.path.slice(`${prefix}skills/`.length).split("/");
+        return parts.length === 2 && parts[1] === "SKILL.md" && name.test(parts[0]) ? [parts[0]] : [];
+      });
+    }
+    for (const skill of names) skills.push({
+      key: `${plugin.name}/${skill}`,
+      hasEval: existsSync(resolve(root, "evals", plugin.name, "skills", skill, "eval.yaml")),
+    });
+  }
+  return skills.sort((a, b) => a.key.localeCompare(b.key));
+}
+
+export function selectSkillEvals(root, context, environment, readTree = pinnedTree) {
+  if (!environment.protection_rules?.some((rule) => rule.type === "required_reviewers" && rule.reviewers?.length)) {
+    throw new Error("Configure the evals environment with required maintainer reviewers before enabling paid PR evals.");
+  }
+  const git = (...args) => execFileSync("git", args, { cwd: root, encoding: "utf8" }).trim();
+  if (![context.base, context.head, context.merge].every((value) => sha.test(value ?? "")) ||
+      git("rev-parse", "HEAD") !== context.merge || git("rev-parse", "HEAD^1") !== context.base ||
+      git("rev-parse", "HEAD^2") !== context.head) {
+    throw new Error("Expected the verified PR merge and its exact parents.");
+  }
+  const changed = execFileSync("git", ["diff", "--no-renames", "--name-only", "-z", context.base, "HEAD", "--", "plugins"],
+    { cwd: root, encoding: "utf8" });
+  const keys = [...new Set(changed.split("\0").flatMap((file) => {
+    const match = /^plugins\/([^/]+)\/skills\/([^/]+)\//.exec(file);
+    return match ? [`${match[1]}/${match[2]}`] : [];
+  }))].sort();
+  const include = [];
+  for (const key of keys) {
+    if (key.split("/").length !== 2 || !key.split("/").every((part) => name.test(part))) {
+      throw new Error("Unsupported plugin or skill path in PR changes.");
+    }
+    const [plugin, skill] = key.split("/");
+    const directory = `plugins/${plugin}/skills/${skill}`;
+    const evalPath = `evals/${plugin}/skills/${skill}/eval.yaml`;
+    const present = (ref) => {
+      const result = spawnSync("git", ["cat-file", "-e", `${ref}:${directory}/SKILL.md`], { cwd: root, stdio: "ignore" });
+      if (result.error) throw result.error;
+      if (result.status !== 0 && result.status !== 128) throw new Error("Could not inspect the skill source tree.");
+      return result.status === 0;
+    };
+    if (present(context.base) && present(context.head) && existsSync(resolve(root, evalPath))) {
+      include.push({ key, id: `skill-${createHash("sha256").update(key).digest("hex").slice(0, 12)}`,
+        directory, evalPath, base: context.base, head: context.head });
+    }
+  }
+  return { ...context, include, changed: keys, skills: inventorySkills(root, readTree) };
+}
+
+if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
+  try {
+    const [contextFile, environmentFile, outputFile] = process.argv.slice(2);
+    if (!contextFile || !environmentFile || !outputFile) throw new Error("Expected context, environment and selection file paths.");
+    const selection = selectSkillEvals(process.cwd(), json(contextFile), json(environmentFile));
+    for (const key of selection.changed.filter((key) => !selection.include.some((entry) => entry.key === key))) {
+      console.log(`::warning::No before/after pair for ${key}: both skill versions and its repo eval are required. No eval was run.`);
+    }
+    writeFileSync(outputFile, `${JSON.stringify(selection)}\n`);
+    appendFileSync(process.env.GITHUB_OUTPUT,
+      `matrix=${JSON.stringify({ include: selection.include })}\ncount=${selection.include.length}\nattempt=${selection.attempt}\nselection=${JSON.stringify(selection)}\n`);
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}
diff --git a/.github/scripts/select-skill-evals.test.mjs b/.github/scripts/select-skill-evals.test.mjs
new file mode 100644
index 0000000..c979cfe
--- /dev/null
+++ b/.github/scripts/select-skill-evals.test.mjs
@@ -0,0 +1,125 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { copyFileSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { parse } from "yaml";
+import { inventorySkills, selectSkillEvals } from "./select-skill-evals.mjs";
+
+test("marketplace inventory reads local skills and exact pinned remote trees without installing plugins", (t) => {
+  const root = mkdtempSync(join(tmpdir(), "skill-inventory-"));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  mkdirSync(join(root, "plugins/local/skills/draft"), { recursive: true });
+  writeFileSync(join(root, "plugins/local/skills/draft/SKILL.md"), "synthetic");
+  mkdirSync(join(root, "evals/local/skills/draft"), { recursive: true });
+  writeFileSync(join(root, "evals/local/skills/draft/eval.yaml"), "synthetic");
+  writeFileSync(join(root, "marketplace.json"), JSON.stringify({ plugins: [
+    { name: "local", source: "./plugins/local" },
+    { name: "remote", source: { source: "github", repo: "example/plugin", sha: "c".repeat(40), path: "package" } },
+  ] }));
+  const readTree = (repo, commit) => {
+    assert.equal(repo, "example/plugin");
+    assert.equal(commit, "c".repeat(40));
+    return { truncated: false, tree: [
+      { type: "blob", path: "package/skills/run/SKILL.md" },
+      { type: "blob", path: "other/skills/unrelated/SKILL.md" },
+    ] };
+  };
+  assert.deepEqual(inventorySkills(root, readTree), [
+    { key: "local/draft", hasEval: true }, { key: "remote/run", hasEval: false },
+  ]);
+  assert.throws(() => inventorySkills(root, () => ({ truncated: true, tree: [] })), /Incomplete/);
+  rmSync(join(root, "plugins"), { recursive: true });
+  writeFileSync(join(root, "marketplace.json"), JSON.stringify({ plugins: [
+    { name: "remote", source: { source: "github", repo: "example/plugin", sha: "c".repeat(40), path: "package" } },
+  ] }));
+  assert.deepEqual(inventorySkills(root, readTree), [{ key: "remote/run", hasEval: false }]);
+});
+
+test("selection requires approval protection and existing paired skills with repo evals at the verified merge", (t) => {
+  const directory = mkdtempSync(join(tmpdir(), "skill selection-"));
+  t.after(() => rmSync(directory, { recursive: true, force: true }));
+  const root = resolve(directory, "repository"), hooks = resolve(directory, "hooks");
+  mkdirSync(root);
+  mkdirSync(hooks);
+  const config = resolve(directory, "gitconfig");
+  writeFileSync(config, "");
+  const env = { ...process.env, GIT_CONFIG_GLOBAL: config, GIT_CONFIG_NOSYSTEM: "1" };
+  const git = (...args) => {
+    const result = spawnSync("git", [
+      "-c", "user.name=Fixture", "-c", "user.email=fixture@example.test",
+      "-c", "commit.gpgsign=false", "-c", `core.hooksPath=${hooks}`, ...args,
+    ], { cwd: root, env, encoding: "utf8", timeout: 10000 });
+    assert.ifError(result.error);
+    assert.equal(result.status, 0, result.stderr);
+    return result.stdout.trim();
+  };
+  const file = (path, content) => {
+    mkdirSync(resolve(root, path, ".."), { recursive: true });
+    writeFileSync(resolve(root, path), content);
+  };
+  const target = "plugins/example/skills/changed";
+  git("init", "--initial-branch=main");
+  file(`${target}/SKILL.md`, "base");
+  file(`${target}/r\u00e9sum\u00e9.md`, "base non-ASCII path");
+  file("plugins/example/skills/neighbor/SKILL.md", "base neighbor");
+  file("plugins/example/skills/deleted/SKILL.md", "deleted");
+  file("evals/example/skills/changed/eval.yaml", "fixed measurement");
+  file("marketplace.json", JSON.stringify({ plugins: [{ name: "example", source: "./plugins/example" }] }));
+  file(".github/scripts/select-skill-evals.mjs", "throw new Error('Candidate selector must not run');");
+  git("add", "."); git("commit", "-m", "Base fixture");
+  git("checkout", "-b", "candidate");
+  file(`${target}/SKILL.md`, "head");
+  file(`${target}/r\u00e9sum\u00e9.md`, "head non-ASCII path");
+  file("plugins/example/skills/neighbor/SKILL.md", "head neighbor");
+  file("plugins/example/skills/added/SKILL.md", "added");
+  rmSync(resolve(root, "plugins/example/skills/deleted"), { recursive: true });
+  git("add", "."); git("commit", "-m", "Candidate fixture");
+  const head = git("rev-parse", "HEAD");
+  git("checkout", "main");
+  file(`${target}/main.md`, "current-main-only file");
+  git("add", "."); git("commit", "-m", "Advance main fixture");
+  const base = git("rev-parse", "HEAD");
+  git("merge", "--no-ff", "candidate", "-m", "Merge fixture");
+  const context = {
+    base, head, merge: git("rev-parse", "HEAD"), trusted: "d".repeat(40),
+    repository: "fixture/repo", run: "2", attempt: "1", sourceRun: "1", sourceAttempt: "1",
+    sourceWorkflow: ".github/workflows/skill-evals.yml",
+  };
+  const protection = { protection_rules: [{ type: "required_reviewers", reviewers: [{ type: "Team" }] }] };
+  assert.throws(() => selectSkillEvals(root, context, {}), /required maintainer reviewers/);
+  assert.throws(() => selectSkillEvals(root, { ...context, head: "f".repeat(40) }, protection), /exact parents/);
+  const selection = selectSkillEvals(root, context, protection);
+  assert.deepEqual(selection.changed, ["example/added", "example/changed", "example/deleted", "example/neighbor"]);
+  assert.equal(selection.include.length, 1);
+  assert.deepEqual(selection.include[0], {
+    key: "example/changed", id: selection.include[0].id, directory: target,
+    evalPath: "evals/example/skills/changed/eval.yaml", base, head,
+  });
+  assert.match(selection.include[0].id, /^skill-[a-f0-9]{12}$/);
+  assert.equal(readFileSync(resolve(root, `${target}/SKILL.md`), "utf8"), "head", "selection must not switch source files");
+  const contextFile = resolve(directory, "context.json"), environmentFile = resolve(directory, "evals-environment.json");
+  const selectionFile = resolve(directory, "selection.json"), outputFile = resolve(directory, "outputs");
+  writeFileSync(contextFile, JSON.stringify(context));
+  writeFileSync(environmentFile, JSON.stringify(protection));
+  const trusted = resolve(directory, "trusted/.github/scripts");
+  mkdirSync(trusted, { recursive: true });
+  for (const script of ["select-skill-evals.mjs", "check-remote-pins.mjs"]) {
+    copyFileSync(new URL(`./${script}`, import.meta.url), resolve(trusted, script));
+  }
+  const workflow = parse(readFileSync(new URL("../workflows/skill-eval-comment.yml", import.meta.url), "utf8"));
+  const command = workflow.jobs.select.steps.find((step) => step.id === "select").run;
+  const result = spawnSync("bash", ["-c", command], {
+    cwd: root, encoding: "utf8", timeout: 10000,
+    env: { ...env, GITHUB_OUTPUT: outputFile, CONTEXT_FILE: contextFile,
+      GITHUB_WORKSPACE: directory.replaceAll("\\", "/"), RUNNER_TEMP: directory.replaceAll("\\", "/") },
+  });
+  assert.ifError(result.error);
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /No before\/after pair for example\/added/);
+  assert.match(result.stdout, /No before\/after pair for example\/deleted/);
+  assert.match(result.stdout, /No before\/after pair for example\/neighbor/);
+  assert.deepEqual(JSON.parse(readFileSync(selectionFile, "utf8")), selection);
+  assert.match(readFileSync(outputFile, "utf8"), /\ncount=1\nattempt=1\n/);
+});
diff --git a/.github/scripts/skill-eval-comment.mjs b/.github/scripts/skill-eval-comment.mjs
deleted file mode 100644
index 47552e8..0000000
--- a/.github/scripts/skill-eval-comment.mjs
+++ /dev/null
@@ -1,522 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-import { isDeepStrictEqual, stripVTControlCharacters } from "node:util";
-
-const marker = "<!-- marketplace-skill-comparison:";
-const safeName = /^[a-z0-9][a-z0-9._-]*$/;
-const sha = /^[a-f0-9]{40}$/;
-const sourceWorkflow = ".github/workflows/skill-evals.yml";
-const skillKey = (value) => typeof value === "string" && value.split("/").length === 2 &&
-  value.split("/").every((part) => safeName.test(part));
-const positive = (value) => Number.isSafeInteger(value) && value > 0;
-const label = (value) => stripVTControlCharacters(String(value ?? ""))
-  // eslint-disable-next-line no-control-regex
-  .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/gu, " ").slice(0, 200);
-const text = (value) => label(value)
-  .replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
-  .replaceAll("|", "&#124;").replaceAll("`", "&#96;").replaceAll("[", "&#91;").replaceAll("]", "&#93;")
-  .replaceAll("@", "&#64;");
-const json = (path) => {
-  const contents = readFileSync(path, "utf8");
-  try { return JSON.parse(contents); } catch { throw new Error("Malformed comparison JSON input."); }
-};
-const writeJson = (path, value) => {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value)}\n`, { mode: 0o600 });
-};
-const github = (endpoint, method = "GET", body) => JSON.parse(execFileSync("gh", [
-  "api", endpoint, "--method", method, ...(body ? ["--input", "-"] : []),
-], { encoding: "utf8", input: body && JSON.stringify(body), timeout: 30000, maxBuffer: 8 * 1024 * 1024 }));
-
-export function inventorySkills(root, readTree = (repo, commit) => github(`repos/${repo}/git/trees/${commit}?recursive=1`)) {
-  const skills = [];
-  for (const plugin of json(resolve(root, "marketplace.json")).plugins) {
-    if (!safeName.test(plugin.name)) throw new Error("Unsupported catalog plugin name.");
-    let names;
-    if (typeof plugin.source === "string") {
-      if (plugin.source !== `./plugins/${plugin.name}`) throw new Error("Expected a self-contained local plugin path.");
-      const directory = resolve(root, plugin.source, "skills");
-      names = existsSync(directory) ? readdirSync(directory).filter((name) =>
-        safeName.test(name) && existsSync(resolve(directory, name, "SKILL.md"))) : [];
-    } else {
-      const source = plugin.source;
-      if (source?.source !== "github" || !/^[\w.-]+\/[\w.-]+$/.test(source.repo) || !sha.test(source.sha)) {
-        throw new Error("Remote skill inventory requires a pinned GitHub source.");
-      }
-      const prefix = source.path ? `${source.path}/` : "";
-      if (prefix.split("/").some((part) => part === "..")) throw new Error("Unsupported remote plugin path.");
-      const tree = readTree(source.repo, source.sha);
-      if (tree.truncated || !Array.isArray(tree.tree)) throw new Error("Incomplete pinned remote skill inventory.");
-      names = tree.tree.flatMap((entry) => {
-        if (entry.type !== "blob" || !entry.path.startsWith(`${prefix}skills/`)) return [];
-        const parts = entry.path.slice(`${prefix}skills/`.length).split("/");
-        return parts.length === 2 && parts[1] === "SKILL.md" && safeName.test(parts[0]) ? [parts[0]] : [];
-      });
-    }
-    for (const name of names) {
-      skills.push({
-        key: `${plugin.name}/${name}`,
-        hasEval: existsSync(resolve(root, "evals", plugin.name, "skills", name, "eval.yaml")),
-      });
-    }
-  }
-  return skills.sort((a, b) => a.key.localeCompare(b.key));
-}
-
-function failedReason(type) {
-  return ({
-    "skill-invocation": "Required activation was missing or a disallowed skill activated.",
-    "program": "The configured output/workspace contract was not satisfied.",
-    "diff-empty": "The workspace changed when it should have stayed unchanged.",
-    "output-matches": "The answer did not match the configured output check.",
-    "file-matches": "A file did not match its configured check.",
-    "tool-calls": "Required tool use was missing or a disallowed tool was used.",
-    "completed": "The session did not meet its completion checks.",
-  })[type] ?? "The configured check failed.";
-}
-
-export function projectTrials(records, expectedRunId) {
-  const summary = records.at(-1);
-  if (summary?.type !== "run-summary" || summary.runId !== expectedRunId ||
-      records.filter((row) => row.type === "run-summary").length !== 1) {
-    throw new Error("Native completion evidence is missing or mixed.");
-  }
-  const identities = new Set();
-  return records.slice(0, -1).map((row) => {
-    if (row.type !== "trial-result" || row.runId !== expectedRunId ||
-        !row.evalName || !row.stimulus || !row.model || !["success", "error", "skipped"].includes(row.status)) {
-      throw new Error("Invalid native trial identity.");
-    }
-    const model = row.variant && row.variant !== "main" ? `${row.model} / ${row.variant}` : row.model;
-    const id = JSON.stringify([row.evalName, row.stimulus, model]);
-    if (identities.has(id)) throw new Error("Expected one trial per case/model, without retries.");
-    identities.add(id);
-    const grade = row.gradeResult;
-    const error = (check) => check?.status === "error" || (check?.details ?? []).some(error);
-    const state = row.status === "skipped" ? "not-run" :
-      row.status !== "success" || !grade || error(grade) ||
-      (row.trajectory?.events ?? []).some((event) => event.type === "error") ? "error" : "graded";
-    if (state === "graded" && (typeof grade.passed !== "boolean" || !Array.isArray(grade.details) || !grade.details.length)) {
-      throw new Error("Native individual grader evidence is missing.");
-    }
-    const checks = (grade?.details ?? []).flatMap((check, index) => {
-      if (check.status === "error") return [];
-      if (typeof check.passed !== "boolean") {
-        if (state !== "graded") return [];
-        throw new Error("Invalid native grader verdict.");
-      }
-      const type = check.graderType ?? check.kind ?? "check";
-      return [{
-        id: `${index}:${type}`,
-        name: label(check.configuredName ?? check.name ?? type),
-        passed: check.passed,
-        // Never publish trajectories, raw grader output or exception strings.
-        reason: check.passed ? "" : failedReason(type),
-      }];
-    });
-    return { eval: label(row.evalName), stimulus: label(row.stimulus), model: label(model), state, passed: state === "graded" && grade.passed, checks };
-  });
-}
-
-export function collectNative(contents, runId, exitCode) {
-  let records;
-  try { records = contents.split(/\r?\n/).filter((line) => line.trim()).map((line) => JSON.parse(line)); }
-  catch { throw new Error("Malformed native JSONL evidence."); }
-  if (!records.length) return { state: "error", rows: [] };
-  const rows = projectTrials(records, runId);
-  const summary = records.at(-1);
-  if (typeof summary.hadExecutionErrors !== "boolean" || typeof summary.passed !== "boolean") {
-    throw new Error("Invalid native completion verdict.");
-  }
-  const key = (item) => JSON.stringify([item.evalFilePath, item.variant, item.model]);
-  const observed = new Map();
-  for (const trial of records.slice(0, -1)) {
-    const bucket = observed.get(key(trial)) ?? { run: 0, skipped: 0 };
-    if (trial.status === "skipped") bucket.skipped++;
-    else bucket.run++;
-    observed.set(key(trial), bucket);
-  }
-  const seen = new Set();
-  const complete = Array.isArray(summary.evals) && summary.evals.every((group) => {
-    if (!group || ![group.evalFilePath, group.variant, group.model].every((value) => typeof value === "string")) return false;
-    const identity = key(group), bucket = observed.get(identity) ?? { run: 0, skipped: 0 };
-    if (seen.has(identity)) return false;
-    seen.add(identity);
-    return typeof group.passed === "boolean" && !group.hadExecutionErrors && !group.hadGradingErrors &&
-      [group.stimuliRun, group.stimuliTotal, group.stimuliSkipped ?? 0].every((value) => Number.isSafeInteger(value) && value >= 0) &&
-      group.stimuliRun === bucket.run && group.stimuliTotal === bucket.run + bucket.skipped &&
-      (group.stimuliSkipped ?? 0) === bucket.skipped;
-  }) && [...observed.keys()].every((identity) => seen.has(identity));
-  return {
-    state: complete && [0, 1].includes(exitCode) && !summary.hadExecutionErrors && (!summary.passed || exitCode === 0) &&
-      !rows.some((row) => row.state === "error") ? rows.length ? "complete" : "not-run" : "error",
-    rows,
-  };
-}
-
-const findRow = (arm, row) => arm?.rows.find((item) =>
-  item.eval === row.eval && item.stimulus === row.stimulus && item.model === row.model);
-const failures = (row) => new Set(row?.checks.filter((check) => !check.passed).map((check) => check.id) ?? []);
-const difference = (a, b) => [...a].filter((id) => !b.has(id)).length;
-function comparable(pair, before, after) {
-  return pair.before?.state === "complete" && pair.after?.state === "complete" &&
-    before?.state === "graded" && after?.state === "graded" &&
-    before.checks.length === after.checks.length &&
-    before.checks.every((check) => after.checks.some((other) => other.id === check.id));
-}
-function counts(arm, row) {
-  if (arm?.state === "error") return "⚠️ Error";
-  if (arm?.state === "not-run") return "⏭️ Not run";
-  if (!row) return "❔ Unknown";
-  if (row.state === "error") return "⚠️ Error";
-  if (row.state === "not-run") return "⏭️ Not run";
-  return `${row.checks.filter((check) => check.passed).length}/${row.checks.length}`;
-}
-function transition(pair, before, after) {
-  const old = failures(before), current = failures(after);
-  if (!comparable(pair, before, after)) return "";
-  const added = difference(current, old), resolved = difference(old, current);
-  if (added && resolved) return `🔄 `;
-  if (added) return "📉 ";
-  if (resolved) return "📈 ";
-  return current.size ? "❌ " : "✅ ";
-}
-
-export function renderComparison(selection, pairs, evidenceUrl) {
-  const models = [...new Set(pairs.flatMap((pair) => [...(pair.before?.rows ?? []), ...(pair.after?.rows ?? [])].map((row) => row.model)))].sort();
-  if (!models.length) models.push("Model not observed");
-  let added = 0, resolved = 0;
-  for (const pair of pairs) for (const after of pair.after?.rows ?? []) {
-    const before = findRow(pair.before, after);
-    if (comparable(pair, before, after)) {
-      added += difference(failures(after), failures(before));
-      resolved += difference(failures(before), failures(after));
-    }
-  }
-  const lines = [
-    "# 🧪 Skill eval comparison", "",
-    `**Changed skills:** 📈 ${resolved} resolved · 📉 ${added} new failures (grader/model results).`,
-    `**Sources:** Before \`${selection.base}\` → After \`${selection.head}\` · [Evidence](${evidenceUrl})`,
-    "**Trials:** One per scenario/model/arm, zero retries. Differences do not prove causation.", "",
-    "**Cells: Before → After.** A scenario is one case; graders are its individual checks.", "",
-  ];
-  if (pairs.some((pair) => ["before", "after"].some((arm) => pair[arm]?.state !== "complete" ||
-    pair[arm]?.rows.some((row) => row.state !== "graded")) ||
-    (pair.after?.rows ?? []).some((after) => !comparable(pair, findRow(pair.before, after), after)))) {
-    lines.push("**⚠️ Incomplete/error evidence:** affected cells are not passing results. Check the linked workflow.", "");
-  }
-  const rowIdentities = (pair) => [...new Map([...(pair.before?.rows ?? []), ...(pair.after?.rows ?? [])]
-    .map((row) => [JSON.stringify([row.eval, row.stimulus]), row])).values()];
-  for (const skill of selection.changed) {
-    const pair = pairs.find((item) => item.key === skill);
-    lines.push(`## Changed skill: ${text(skill)}`, "");
-    if (!pair) {
-      lines.push("⏭️ Not run — an existing skill in both revisions and its repo eval are required.", "");
-      continue;
-    }
-    lines.push(`| Eval : scenario (passing / total graders) | ${models.join(" | ")} |`,
-      `| --- | ${models.map(() => "---").join(" | ")} |`);
-    const rows = rowIdentities(pair);
-    for (const row of rows) {
-      const cells = models.map((model) => {
-        const identity = { ...row, model };
-        const before = findRow(pair.before, identity), after = findRow(pair.after, identity);
-        const unknown = before?.state === "graded" && after?.state === "graded" && !comparable(pair, before, after)
-          ? " (comparison unknown)" : "";
-        return `${transition(pair, before, after)}${counts(pair.before, before)} → ${counts(pair.after, after)}${unknown}`;
-      });
-      const short = row.stimulus.startsWith(`${row.eval}-`) ? row.stimulus.slice(row.eval.length + 1) : row.stimulus;
-      lines.push(`| ${row.eval} : ${short} | ${cells.join(" | ")} |`);
-    }
-    if (!rows.length) lines.push(`| Evidence unavailable | ${models.map(() =>
-      `${counts(pair.before)} → ${counts(pair.after)}`).join(" | ")} |`);
-    lines.push("");
-  }
-  const detailLines = (arms) => {
-    const output = [];
-    for (const pair of pairs) {
-      const entries = arms.flatMap((arm) => (pair[arm]?.rows ?? []).flatMap((row) =>
-        row.checks.filter((check) => !check.passed).map((check) => ({ arm, row, check }))));
-      if (!entries.length) continue;
-      output.push(`### Skill: ${text(pair.key)}`, "");
-      for (const identity of rowIdentities(pair)) {
-        const rows = entries.filter(({ row }) => row.eval === identity.eval && row.stimulus === identity.stimulus);
-        if (!rows.length) continue;
-        output.push(`**Eval : scenario:** ${identity.eval} : ${identity.stimulus}`, "",
-          "| Change | Failed grader | Model | Why it failed | Evidence |", "| --- | --- | --- | --- | --- |");
-        for (const { arm, row, check } of rows) {
-          const other = findRow(pair[arm === "before" ? "after" : "before"], row);
-          const otherFailed = failures(other).has(check.id);
-          const change = !comparable(pair, arm === "before" ? row : other, arm === "after" ? row : other) ? "comparison unknown" :
-            arm === "after" ? otherFailed ? "already present" : "new" : otherFailed ? "persists After" : "resolved After";
-          output.push(`| ${arm === "after" ? "After" : "Before"} (${change}) | ${check.name} | ${row.model} | ${check.reason} | [Native run](${evidenceUrl}) |`);
-        }
-        output.push("");
-      }
-    }
-    return output.length ? output : ["No recorded failed graders. Missing/error results are not passes.", ""];
-  };
-  const failureCount = (arm) => pairs.reduce((sum, pair) => sum + (pair[arm]?.rows ?? [])
-    .reduce((total, row) => total + failures(row).size, 0), 0);
-  lines.push(`## ❌ After failures in changed skills (${failureCount("after")} grader/model results)`, "", ...detailLines(["after"]),
-    "<details>", `<summary>🕰️ Before failures in changed skills: ${failureCount("before")} grader/model results</summary>`, "", ...detailLines(["before"]), "</details>", "");
-  const evaluated = selection.skills.filter((skill) => pairs.some((pair) => pair.key === skill.key &&
-    ((pair.before?.rows.length ?? 0) + (pair.after?.rows.length ?? 0) > 0))).length;
-  lines.push("<details>", `<summary>🌐 All marketplace skills: ${evaluated} with results · ${selection.skills.length - evaluated} not evaluated</summary>`, "",
-    "**Cells: passing scenarios / total recorded scenarios, Before → After.** Native scoring determines scenario passes; errors and missing results never pass.",
-    "Only selected changed skills were evaluated. This run does not measure unchanged-skill regressions.", "",
-    `| Skill (passing / total scenarios) | ${models.join(" | ")} |`, `| --- | ${models.map(() => "---").join(" | ")} |`);
-  for (const skill of selection.skills) {
-    const pair = pairs.find((item) => item.key === skill.key);
-    const cells = models.map((model) => {
-      if (!pair) return skill.hasEval ? "⏭️ Not run — unchanged/unpaired skill" : "⏭️ Not evaluated — no repo eval";
-      const values = ["before", "after"].map((arm) => {
-        const data = pair[arm], rows = data?.rows.filter((row) => row.model === model) ?? [];
-        if (data?.state !== "complete") return data?.state === "not-run" ? "⏭️ Not run" : "⚠️ Error / incomplete";
-        if (!rows.length) return "❔ Unknown";
-        if (rows.some((row) => row.state !== "graded")) return "⚠️ Partial / not run";
-        return `${rows.filter((row) => row.passed).length}/${rows.length}`;
-      }).join(" → ");
-      let added = 0, resolved = 0;
-      for (const after of pair.after?.rows.filter((row) => row.model === model) ?? []) {
-        const before = findRow(pair.before, after);
-        if (comparable(pair, before, after)) {
-          added += difference(failures(after), failures(before));
-          resolved += difference(failures(before), failures(after));
-        }
-      }
-      const unknown = (pair.after?.rows.filter((row) => row.model === model) ?? [])
-        .some((after) => !comparable(pair, findRow(pair.before, after), after));
-      return unknown ? `${values} (comparison unknown)` :
-        added && resolved ? `🔄 ${values} (${added} new, ${resolved} resolved grader failures)` : values;
-    });
-    lines.push(`| ${text(skill.key)} | ${cells.join(" | ")} |`);
-  }
-  lines.push("", "<details>", `<summary>🔎 Marketplace failure details: ${failureCount("after")} After · ${failureCount("before")} Before (grader/model results)</summary>`, "",
-    ...detailLines(["before", "after"]), "</details>", "", "</details>", "",
-    "✅ Both pass · 📈 Failures resolved · 📉 New failures · 🔄 Both new and resolved · ❌ Existing failure.",
-    "⚠️ Error · ⏭️ Not run · ❔ Unknown never count as passing. Failure reasons describe checks, not raw model/grader output.", "",
-    "*Each changed skill is measured separately; evals, graders, fixtures and other skill sources stay at the merge revision.*");
-  return lines.join("\n");
-}
-
-export async function publisherContext(event, api = github, env = process.env) {
-  const repository = env.GITHUB_REPOSITORY;
-  const source = event?.workflow_run;
-  if (env.GITHUB_EVENT_NAME !== "workflow_run" || !/^[\w.-]+\/[\w.-]+$/.test(repository ?? "") ||
-      !positive(source?.id) || !positive(source?.run_attempt)) throw new Error("Expected a workflow_run publisher context.");
-  const endpoint = `repos/${repository}`;
-  const run = await api(`${endpoint}/actions/runs/${source.id}/attempts/${source.run_attempt}`);
-  if (run.id !== source.id || run.run_attempt !== source.run_attempt || run.repository?.full_name !== repository ||
-      run.head_repository?.full_name !== repository || run.event !== "pull_request" || run.status !== "completed" ||
-      !sha.test(run.head_sha) || !positive(run.run_number) || !positive(run.workflow_id)) {
-    throw new Error("Untrusted or incomplete source workflow run.");
-  }
-  const workflow = await api(`${endpoint}/actions/workflows/${run.workflow_id}`);
-  if (workflow.path !== sourceWorkflow) throw new Error("Unexpected source workflow path.");
-  if (!Array.isArray(run.pull_requests) || run.pull_requests.length !== 1 ||
-      !positive(run.pull_requests[0].number) || !sha.test(run.pull_requests[0].head?.sha) ||
-      source.pull_requests?.[0]?.number !== run.pull_requests[0].number) {
-    throw new Error("Cannot establish the source run's PR association.");
-  }
-  return {
-    repository, run: String(run.id), attempt: String(run.run_attempt), runNumber: run.run_number,
-    pullNumber: run.pull_requests[0].number, head: run.pull_requests[0].head.sha, runHead: run.head_sha,
-  };
-}
-
-function artifact(root, name) {
-  const file = resolve(root, name);
-  const rel = relative(realpathSync(root), realpathSync(file));
-  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel) ||
-      !lstatSync(file).isFile() || statSync(file).size > 1024 * 1024) {
-    throw new Error("Expected a bounded regular comparison artifact inside the download directory.");
-  }
-  return json(file);
-}
-
-export async function validateSelection(selection, context, api = github) {
-  if (!selection || !sha.test(selection.base) || !sha.test(selection.head) || !sha.test(selection.merge) ||
-      selection.repository !== context.repository || selection.run !== context.run || selection.attempt !== context.attempt ||
-      selection.head !== context.head ||
-      selection.sourceRun !== context.sourceRun || selection.sourceAttempt !== context.sourceAttempt ||
-      selection.trusted !== context.trusted ||
-      selection.base !== context.base || selection.merge !== context.merge ||
-      !Array.isArray(selection.include) || !Array.isArray(selection.changed) || !Array.isArray(selection.skills) ||
-      !selection.changed.every(skillKey) || new Set(selection.changed).size !== selection.changed.length ||
-      !selection.skills.every((skill) => skillKey(skill?.key) && typeof skill.hasEval === "boolean") ||
-      new Set(selection.skills.map((skill) => skill.key)).size !== selection.skills.length) {
-    throw new Error("Comparison selection does not match the authenticated source run.");
-  }
-  const ids = new Set(), keys = new Set();
-  for (const entry of selection.include) {
-    const key = `${entry?.plugin}/${entry?.skill}`;
-    if (!skillKey(key) || !/^skill-[a-f0-9]{12}$/.test(entry.id ?? "") || ids.has(entry.id) || keys.has(key) ||
-        !selection.changed.includes(key) || entry.directory !== `plugins/${key.replace("/", "/skills/")}` ||
-        entry.evalPath !== `evals/${key.replace("/", "/skills/")}/eval.yaml` ||
-        entry.base !== selection.base || entry.head !== selection.head) throw new Error("Invalid comparison selection entry.");
-    ids.add(entry.id); keys.add(key);
-  }
-  const commit = await api(`repos/${context.repository}/git/commits/${selection.merge}`);
-  if (commit.sha !== selection.merge || commit.parents?.length !== 2 ||
-      commit.parents[0].sha !== selection.base || commit.parents[1].sha !== selection.head) {
-    throw new Error("Comparison merge parents do not match the selected source revisions.");
-  }
-}
-
-export async function comparisonContext(event, api = github, env = process.env, producingAttempt = env.GITHUB_RUN_ATTEMPT) {
-  const source = await publisherContext(event, api, env);
-  if (!sha.test(env.GITHUB_SHA ?? "") || !/^[1-9]\d*$/.test(env.GITHUB_RUN_ID ?? "") ||
-      !/^[1-9]\d*$/.test(env.GITHUB_RUN_ATTEMPT ?? "") || !/^[1-9]\d*$/.test(env.GITHUB_RUN_NUMBER ?? "") ||
-      !/^[1-9]\d*$/.test(producingAttempt ?? "") || Number(producingAttempt) > Number(env.GITHUB_RUN_ATTEMPT)) {
-    throw new Error("Invalid trusted comparison workflow identity.");
-  }
-  return {
-    ...source, sourceRun: source.run, sourceAttempt: source.attempt,
-    run: env.GITHUB_RUN_ID, attempt: producingAttempt,
-    runNumber: Number(env.GITHUB_RUN_NUMBER), trusted: env.GITHUB_SHA,
-  };
-}
-
-function safeArm(data) {
-  if (!data || !["complete", "error", "not-run"].includes(data.state) || !Array.isArray(data.rows)) {
-    throw new Error("Invalid comparison arm.");
-  }
-  const identities = new Set();
-  const rows = data.rows.map((row) => {
-    if (!row || !["graded", "error", "not-run"].includes(row.state) || typeof row.passed !== "boolean" ||
-        row.state !== "graded" && row.passed || !Array.isArray(row.checks) ||
-        ![row.eval, row.stimulus, row.model].every((label) => typeof label === "string" && label.length > 0 && label.length <= 200)) {
-      throw new Error("Invalid comparison case.");
-    }
-    const key = JSON.stringify([row.eval, row.stimulus, row.model]);
-    if (identities.has(key)) throw new Error("Duplicate comparison case.");
-    identities.add(key);
-    const checkIds = new Set();
-    const checks = row.checks.map((check) => {
-      if (!/^\d+:[a-z0-9._-]+$/.test(check?.id ?? "") || checkIds.has(check.id) ||
-          typeof check.passed !== "boolean" || typeof check.name !== "string") throw new Error("Invalid comparison check.");
-      checkIds.add(check.id);
-      return { id: check.id, name: text(check.name), passed: check.passed,
-        reason: check.passed ? "" : failedReason(check.id.split(":")[1]) };
-    });
-    if (row.state === "graded" && !checks.length) throw new Error("Missing comparison checks.");
-    return { eval: text(row.eval), stimulus: text(row.stimulus), model: text(row.model), state: row.state, passed: row.passed, checks };
-  });
-  return { state: data.state, rows };
-}
-
-export async function loadComparison(root, context, api = github, expectedSelection) {
-  const selection = artifact(root, "selection.json");
-  if (!isDeepStrictEqual(selection, expectedSelection)) throw new Error("Artifact coverage differs from trusted selection.");
-  await validateSelection(selection, context, api);
-  const pairs = selection.include.map((entry) => {
-    const pair = { key: `${entry.plugin}/${entry.skill}` };
-    for (const arm of ["before", "after"]) {
-      const file = `${entry.id}-${arm}.json`;
-      if (!existsSync(resolve(root, file))) { pair[arm] = { state: "error", rows: [] }; continue; }
-      const saved = artifact(root, file);
-      if (saved.key !== pair.key || saved.id !== entry.id || saved.arm !== arm ||
-          saved.repository !== context.repository || saved.run !== context.run ||
-          saved.attempt !== context.attempt || saved.merge !== selection.merge) throw new Error("Mixed comparison artifacts.");
-      pair[arm] = safeArm(saved.data);
-    }
-    return pair;
-  });
-  return { selection, pairs };
-}
-
-export async function assertCurrentPullRequest(context, api = github) {
-  if (!/^[\w.-]+\/[\w.-]+$/.test(context?.repository ?? "") || !positive(context.pullNumber) ||
-      !sha.test(context.head ?? "")) throw new Error("Invalid PR context.");
-  const pr = await api(`repos/${context.repository}/pulls/${context.pullNumber}`);
-  if (pr.state !== "open" || pr.head?.sha !== context.head || pr.head?.repo?.full_name !== context.repository) {
-    throw new Error("PR closed, head changed, or fork context; no paid run or comment allowed.");
-  }
-}
-
-export async function postComparison(selection, body, api = github, context) {
-  await assertCurrentPullRequest({ ...context, head: selection.head }, api);
-  const endpoint = `repos/${context.repository}`;
-  const key = `${marker}${context.repository}/${sourceWorkflow} -->`;
-  const comments = [];
-  for (let page = 1; ; page++) {
-    const batch = await api(`${endpoint}/issues/${context.pullNumber}/comments?per_page=100&page=${page}`);
-    comments.push(...batch);
-    if (batch.length < 100) break;
-  }
-  const existing = comments.find((comment) => comment.user?.login === "github-actions[bot]" && comment.body.startsWith(key));
-  const order = [context.runNumber, Number(context.attempt)];
-  if (!order.every((n) => Number.isSafeInteger(n) && n > 0)) throw new Error("Invalid workflow run order.");
-  const previous = existing?.body.match(/<!-- run:(\d+):(\d+) -->/);
-  if (previous && (Number(previous[1]) > order[0] || Number(previous[1]) === order[0] && Number(previous[2]) > order[1])) return "stale";
-  const content = `${key}\n<!-- run:${order.join(":")} -->\n${body}`;
-  if (content.length > 60000) throw new Error("Comparison exceeds the comment limit; no misleading truncated report published.");
-  return api(existing ? `${endpoint}/issues/comments/${existing.id}` : `${endpoint}/issues/${context.pullNumber}/comments`,
-    existing ? "PATCH" : "POST", { body: content });
-}
-
-function validateIdentity(selection, env) {
-  if (!sha.test(selection.base) || !sha.test(selection.head) || selection.trusted !== env.GITHUB_SHA ||
-      selection.repository !== env.GITHUB_REPOSITORY || selection.run !== env.GITHUB_RUN_ID ||
-      selection.attempt !== env.GITHUB_RUN_ATTEMPT) throw new Error("Comparison artifact context changed.");
-}
-
-export async function selectionContext(context, pr, api = github) {
-  if (pr.state !== "open" || pr.head?.sha !== context.head || pr.head?.repo?.full_name !== context.repository ||
-      !sha.test(pr.merge_commit_sha ?? "")) {
-    throw new Error("Source PR closed, changed, forked or lacks a verifiable merge revision.");
-  }
-  const commit = await api(`repos/${context.repository}/git/commits/${pr.merge_commit_sha}`);
-  if (commit.sha !== pr.merge_commit_sha || commit.parents?.length !== 2 ||
-      !sha.test(commit.parents[0].sha) || commit.parents[1].sha !== context.head) {
-    throw new Error("Current PR merge does not have the expected base and head parents.");
-  }
-  return { ...context, base: commit.parents[0].sha, merge: commit.sha };
-}
-
-async function main() {
-  const [command, path] = process.argv.slice(2);
-  if (command === "context") {
-    const context = await comparisonContext(json(process.env.GITHUB_EVENT_PATH));
-    const pr = await github(`repos/${context.repository}/pulls/${context.pullNumber}`);
-    const selected = await selectionContext(context, pr);
-    writeJson(path, selected);
-    for (const [key, value] of Object.entries({ context: JSON.stringify(selected), merge: selected.merge })) {
-      writeFileSync(process.env.GITHUB_OUTPUT, `${key}=${value}\n`, { flag: "a" });
-    }
-  } else if (command === "verify") {
-    const context = JSON.parse(process.env.SELECTED_CONTEXT);
-    validateIdentity(context, process.env);
-    await assertCurrentPullRequest(context);
-  } else if (command === "native") {
-    const selection = json(resolve(process.env.SELECTION_FILE));
-    validateIdentity(selection, process.env);
-    const entry = selection.include.find((item) => item.id === process.env.COMPARISON_ID);
-    if (!entry || !["before", "after"].includes(process.env.ARM)) throw new Error("Unknown comparison arm.");
-    const native = resolve(process.env.NATIVE_FILE);
-    if (statSync(native).size > 64 * 1024 * 1024) throw new Error("Native log exceeds supported size.");
-    const data = collectNative(readFileSync(native, "utf8"), process.env.NATIVE_RUN_ID, Number(process.env.NATIVE_EXIT));
-    writeJson(resolve(path, `${entry.id}-${process.env.ARM}.json`), {
-      id: entry.id, key: `${entry.plugin}/${entry.skill}`, arm: process.env.ARM,
-      repository: selection.repository, run: selection.run, attempt: selection.attempt, merge: selection.merge, data,
-    });
-    if (data.state === "error") throw new Error("Native execution/grading evidence is incomplete or erroneous; inspect the approved run locally.");
-  } else if (command === "post") {
-    const authenticated = await comparisonContext(json(process.env.GITHUB_EVENT_PATH), github, process.env,
-      process.env.PRODUCING_ATTEMPT ?? process.env.GITHUB_RUN_ATTEMPT);
-    const context = JSON.parse(process.env.SELECTED_CONTEXT);
-    for (const [key, value] of Object.entries(authenticated)) {
-      if (context[key] !== value) throw new Error("Selected context differs from the authenticated workflow.");
-    }
-    const { selection, pairs } = await loadComparison(resolve(path), context, github, JSON.parse(process.env.SELECTED_SELECTION));
-    const evidence = `${process.env.GITHUB_SERVER_URL}/${selection.repository}/actions/runs/${selection.run}/attempts/${selection.attempt}`;
-    console.log(JSON.stringify(await postComparison(selection, renderComparison(selection, pairs, evidence), github, context)));
-  } else throw new Error("Expected context, verify, native or post.");
-}
-
-if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
-  try { await main(); } catch (error) { console.error(error.message); process.exitCode = 1; }
-}
diff --git a/.github/scripts/skill-eval-comment.test.mjs b/.github/scripts/skill-eval-comment.test.mjs
deleted file mode 100644
index 8baa39c..0000000
--- a/.github/scripts/skill-eval-comment.test.mjs
+++ /dev/null
@@ -1,323 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { assertCurrentPullRequest, collectNative, comparisonContext, inventorySkills, loadComparison, postComparison, projectTrials, publisherContext, renderComparison, selectionContext, validateSelection } from "./skill-eval-comment.mjs";
-
-const trial = (extra = {}) => ({
-  type: "trial-result", runId: "native", evalName: "draft", stimulus: "draft-positive", model: "model-a", variant: "main",
-  evalFilePath: "evals/local/skills/draft/eval.yaml",
-  status: "success", gradeResult: { passed: false, details: [
-    { graderType: "completed", name: "completed", passed: true },
-    { graderType: "skill-invocation", name: "routing", passed: false, evidence: "SECRET_RAW_GRADER_OUTPUT" },
-  ] }, trajectory: { output: "SECRET_RAW_ANSWER", events: [] }, ...extra,
-});
-const footer = {
-  type: "run-summary", runId: "native", hadExecutionErrors: false, passed: false,
-  evals: [{ evalFilePath: "evals/local/skills/draft/eval.yaml", variant: "main", model: "model-a",
-    passed: false, stimuliRun: 1, stimuliTotal: 1 }],
-};
-const selection = {
-  base: "a".repeat(40), head: "b".repeat(40), changed: ["local/draft"],
-  skills: [{ key: "local/draft", hasEval: true }, { key: "local/neighbor", hasEval: true }, { key: "remote/run", hasEval: false }],
-};
-const pair = () => ({
-  key: "local/draft",
-  before: { state: "complete", rows: projectTrials([trial(), footer], "native") },
-  after: { state: "complete", rows: projectTrials([trial({ gradeResult: { passed: true, details: [
-    { graderType: "completed", name: "completed", passed: true }, { graderType: "skill-invocation", name: "routing", passed: true },
-  ] } }), footer], "native") },
-});
-
-test("native grader projection preserves counts and errors, rejects mixed/repeated trials, and omits raw output", () => {
-  const data = collectNative(`${JSON.stringify(trial())}\n${JSON.stringify(footer)}\n`, "native", 1);
-  assert.equal(data.state, "complete");
-  assert.equal(data.rows[0].checks.filter((check) => check.passed).length, 1);
-  assert.match(data.rows[0].checks[1].reason, /activation/);
-  assert.doesNotMatch(JSON.stringify(data), /SECRET/);
-  assert.throws(() => projectTrials([trial(), trial(), footer], "native"), /one trial/);
-  assert.throws(() => projectTrials([trial({ runId: "other" }), footer], "native"), /identity/);
-  assert.throws(() => projectTrials([trial(), { ...footer, runId: "other" }], "native"), /completion/);
-  assert.equal(collectNative("", "native", 1).state, "error");
-  assert.equal(collectNative(`${JSON.stringify(trial())}\n${JSON.stringify(footer)}`, "native", 2).state, "error");
-  const errored = projectTrials([trial({ gradeResult: { passed: false, details: [{ status: "error" }] } }), footer], "native");
-  assert.equal(errored[0].state, "error");
-  assert.equal(errored[0].passed, false);
-  assert.equal(projectTrials([trial({ status: "skipped" }), footer], "native")[0].state, "not-run");
-});
-
-test("native CLI outcomes preserve behavioral failures and completed checks beside grading errors", () => {
-  const contents = (...rows) => rows.map((row) => JSON.stringify(row)).join("\n");
-  assert.equal(collectNative(contents(trial(), footer), "native", 1).state, "complete");
-  assert.equal(collectNative(contents(trial(), footer), "native", 2).state, "error");
-  assert.equal(collectNative(contents(trial(), { ...footer, passed: true }), "native", 1).state, "error");
-  assert.equal(collectNative(contents({ ...footer, evals: [] }), "native", 0).state, "not-run");
-  assert.equal(collectNative(contents(footer), "native", 0).state, "error", "missing recorded cases cannot be complete");
-  for (const group of [
-    { ...footer.evals[0], stimuliTotal: 2 },
-    { ...footer.evals[0], stimuliRun: 2 },
-    { ...footer.evals[0], model: "wrong-model" },
-    { ...footer.evals[0], hadGradingErrors: true },
-  ]) {
-    const partial = collectNative(contents(trial(), { ...footer, evals: [group] }), "native", 1);
-    assert.equal(partial.state, "error");
-    assert.equal(partial.rows[0].checks[1].passed, false, "known failures remain visible in incomplete evidence");
-  }
-  const errored = trial({ gradeResult: { passed: false, details: [
-    { graderType: "skill-invocation", name: "routing", passed: false },
-    { graderType: "program", status: "error", passed: false },
-  ] } });
-  const data = collectNative(contents(errored, { ...footer, hadExecutionErrors: true }), "native", 1);
-  assert.equal(data.state, "error");
-  assert.equal(data.rows[0].state, "error");
-  assert.equal(data.rows[0].checks.length, 1);
-  assert.equal(data.rows[0].checks[0].id, "0:skill-invocation");
-  const rendered = renderComparison(selection, [{ ...pair(), after: data }], "https://example.test");
-  assert.match(rendered, /After failures in changed skills \(1 grader\/model results\)/);
-  assert.match(rendered, /After \(comparison unknown\) \| routing/);
-  assert.match(rendered, /⚠️ Error/);
-  assert.throws(() => collectNative(contents(trial(), footer), "other", 0), /completion/);
-});
-
-test("approved hierarchy shows grader versus scenario denominators, failed-check reasons and honest coverage", () => {
-  const sample = pair();
-  const rendered = renderComparison(selection, [sample], "https://github.com/example/repo/actions/runs/1");
-  assert.match(rendered, /## Changed skill: local\/draft/);
-  assert.match(rendered, /draft : positive \| 📈 1\/2 → 2\/2/);
-  assert.match(rendered, /passing \/ total graders/);
-  assert.match(rendered, /local\/draft \| 0\/1 → 1\/1/);
-  assert.match(rendered, /passing scenarios \/ total recorded scenarios/);
-  assert.match(rendered, /Before \(resolved After\) \| routing/);
-  assert.match(rendered, /Required activation/);
-  assert.match(rendered, /local\/neighbor \| ⏭️ Not run/);
-  assert.match(rendered, /remote\/run \| ⏭️ Not evaluated — no repo eval/);
-  assert.match(rendered, /does not measure unchanged-skill regressions/);
-  assert.ok(rendered.indexOf("Before failures") < rendered.indexOf("All marketplace skills"));
-  assert.ok(rendered.indexOf("All marketplace skills") < rendered.indexOf("Marketplace failure details"));
-  assert.equal((rendered.match(/<details>/g) ?? []).length, 3);
-  assert.doesNotMatch(rendered, /SECRET/);
-});
-
-test("equal aggregate counts expose changed failure identities and missing arms never become passes", () => {
-  const sample = pair();
-  sample.after.rows[0].passed = false;
-  sample.after.rows[0].checks[0].passed = false;
-  const rendered = renderComparison(selection, [sample], "https://example.test");
-  assert.match(rendered, /🔄 0\/1 → 0\/1 \(1 new, 1 resolved/);
-  assert.match(rendered, /After \(new\) \| completed/);
-  assert.match(rendered, /Before \(resolved After\) \| routing/);
-  sample.after = { state: "error", rows: [] };
-  const missing = renderComparison(selection, [sample], "https://example.test");
-  assert.match(missing, /Incomplete\/error evidence/);
-  assert.match(missing, /1\/2 → ⚠️ Error/);
-  assert.doesNotMatch(missing, /📈 1\/2/);
-});
-
-test("partial arms and absent matching graders cannot create resolved or new failure claims", () => {
-  for (const change of ["partial", "missing-check"]) {
-    const sample = pair();
-    if (change === "partial") sample.after.state = "error";
-    else sample.after.rows[0].checks.pop();
-    const rendered = renderComparison(selection, [sample], "https://example.test");
-    assert.match(rendered, /0 resolved · 📉 0 new failures/);
-    assert.match(rendered, /Before \(comparison unknown\) \| routing/);
-    assert.match(rendered, /comparison unknown/);
-    assert.doesNotMatch(rendered, /resolved After|After \(new\)|📈 1\/2/);
-    if (change === "partial") assert.match(rendered, /1\/2 → ⚠️ Error/);
-    else assert.match(rendered, /1\/2 → 1\/1 \(comparison unknown\)/);
-  }
-});
-
-test("malformed native output never leaks parser excerpts", () => {
-  assert.throws(() => collectNative(`${JSON.stringify(trial())}\nSECRET_RAW_INVALID_JSON`, "native", 1), (error) => {
-    assert.equal(error.message, "Malformed native JSONL evidence.");
-    assert.doesNotMatch(error.message, /SECRET/);
-    return true;
-  });
-});
-
-test("catalog inventory enumerates local and exact pinned remote skill folders without executing them", (t) => {
-  const root = mkdtempSync(join(tmpdir(), "comparison-inventory-"));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  mkdirSync(join(root, "plugins/local/skills/draft"), { recursive: true });
-  writeFileSync(join(root, "plugins/local/skills/draft/SKILL.md"), "not executed");
-  mkdirSync(join(root, "evals/local/skills/draft"), { recursive: true });
-  writeFileSync(join(root, "evals/local/skills/draft/eval.yaml"), "not executed");
-  writeFileSync(join(root, "marketplace.json"), JSON.stringify({ plugins: [
-    { name: "local", source: "./plugins/local" },
-    { name: "remote", source: { source: "github", repo: "example/plugin", sha: "c".repeat(40), path: "package" } },
-  ] }));
-  const readTree = (repo, commit) => {
-    assert.equal(repo, "example/plugin"); assert.equal(commit, "c".repeat(40));
-    return { truncated: false, tree: [
-      { type: "blob", path: "package/skills/run/SKILL.md" }, { type: "blob", path: "other/skills/unrelated/SKILL.md" },
-    ] };
-  };
-  assert.deepEqual(inventorySkills(root, readTree), [
-    { key: "local/draft", hasEval: true }, { key: "remote/run", hasEval: false },
-  ]);
-  assert.throws(() => inventorySkills(root, () => ({ truncated: true, tree: [] })), /Incomplete/);
-});
-
-test("comment publishing checks current PR head, bot ownership, run order and updates only one comment", async () => {
-  const context = { repository: "example/repo", pullNumber: 2, runNumber: 5, attempt: "1" };
-  const calls = [];
-  let head = selection.head, comments = [];
-  const api = async (endpoint, method = "GET", body) => {
-    calls.push({ endpoint, method, body });
-    if (endpoint.endsWith("/pulls/2")) return { state: "open", head: { sha: head, repo: { full_name: "example/repo" } } };
-    if (method === "GET") return comments;
-    return { id: 8 };
-  };
-  await postComparison(selection, "Report", api, context);
-  assert.equal(calls.at(-1).method, "POST");
-  comments = [{ id: 8, user: { login: "github-actions[bot]" }, body: calls.at(-1).body.body }];
-  calls.length = 0;
-  await postComparison(selection, "Updated", api, context);
-  assert.equal(calls.at(-1).method, "PATCH");
-  assert.match(calls.at(-1).endpoint, /issues\/comments\/8$/);
-  comments[0].body = comments[0].body.replace("run:5:1", "run:6:1");
-  assert.equal(await postComparison(selection, "Older", api, context), "stale");
-  head = "c".repeat(40);
-  await assert.rejects(postComparison(selection, "Wrong head", api, context), /head changed/);
-});
-
-test("the pre-arm PR check rejects closure, changed heads and fork context after approval", async () => {
-  const context = { repository: "example/repo", pullNumber: 2, head: selection.head };
-  const pr = { state: "open", head: { sha: selection.head, repo: { full_name: context.repository } } };
-  await assertCurrentPullRequest(context, async () => pr);
-  for (const changed of [
-    { ...pr, state: "closed" },
-    { ...pr, head: { ...pr.head, sha: "c".repeat(40) } },
-    { ...pr, head: { ...pr.head, repo: { full_name: "fork/repo" } } },
-  ]) await assert.rejects(assertCurrentPullRequest(context, async () => changed), /no paid run or comment/);
-});
-
-function sourceFixture() {
-  const context = { repository: "example/repo", run: "999", attempt: "7", runNumber: 9,
-    pullNumber: 2, head: selection.head, runHead: "c".repeat(40),
-    sourceRun: "11", sourceAttempt: "2", trusted: "d".repeat(40),
-    base: selection.base, merge: "c".repeat(40) };
-  const selected = {
-    ...selection, repository: context.repository, run: context.run, attempt: context.attempt, merge: context.runHead,
-    sourceRun: context.sourceRun, sourceAttempt: context.sourceAttempt, trusted: context.trusted,
-    include: [{ id: "skill-aaaaaaaaaaaa", plugin: "local", skill: "draft", directory: "plugins/local/skills/draft",
-      evalPath: "evals/local/skills/draft/eval.yaml", base: selection.base, head: selection.head }],
-  };
-  const source = { id: 11, run_attempt: 2, pull_requests: [{ number: 2 }] };
-  const run = { ...source, repository: { full_name: context.repository }, head_repository: { full_name: context.repository },
-    event: "pull_request", status: "completed", conclusion: "failure", head_sha: context.runHead,
-    run_number: 5, workflow_id: 7, pull_requests: [{ number: 2, head: { sha: selection.head } }] };
-  const api = async (endpoint) => {
-    if (endpoint.endsWith("/actions/runs/11/attempts/2")) return run;
-    if (endpoint.endsWith("/actions/workflows/7")) return { path: ".github/workflows/skill-evals.yml" };
-    if (endpoint.endsWith(`/git/commits/${selected.merge}`)) return {
-      sha: selected.merge, parents: [{ sha: selected.base }, { sha: selected.head }],
-    };
-    throw new Error("Unexpected test API request.");
-  };
-  return { context, selected, source, run, api };
-}
-
-test("publisher authenticates workflow, source attempt and PR independently from its own run", async () => {
-  const { context, source, run, api } = sourceFixture();
-  const env = { GITHUB_EVENT_NAME: "workflow_run", GITHUB_REPOSITORY: context.repository,
-    GITHUB_RUN_ID: "999", GITHUB_RUN_ATTEMPT: "7", GITHUB_RUN_NUMBER: "9", GITHUB_SHA: "d".repeat(40) };
-  const { sourceRun, sourceAttempt, trusted, base, merge, ...sourceContext } = context;
-  assert.deepEqual(await publisherContext({ workflow_run: source }, api, env), {
-    ...sourceContext, run: "11", attempt: "2", runNumber: 5,
-  });
-  const { base: selectedBase, merge: selectedMerge, ...authenticated } = context;
-  assert.deepEqual(await comparisonContext({ workflow_run: source }, api, env), authenticated);
-  assert.equal((await comparisonContext({ workflow_run: source }, api, env, "2")).attempt, "2");
-  await assert.rejects(comparisonContext({ workflow_run: source }, api, env, "8"), /trusted comparison/);
-  await assert.rejects(comparisonContext({ workflow_run: source }, api, { ...env, GITHUB_RUN_NUMBER: "" }), /trusted comparison/);
-  await assert.rejects(publisherContext({ workflow_run: source }, api, { ...env, GITHUB_EVENT_NAME: "pull_request" }), /workflow_run/);
-  for (const change of [
-    { event: "workflow_dispatch" }, { head_repository: { full_name: "fork/repo" } },
-    { repository: { full_name: "other/repo" } }, { pull_requests: [] }, { run_attempt: 1 },
-  ]) {
-    await assert.rejects(publisherContext({ workflow_run: source }, async (endpoint) =>
-      endpoint.includes("/actions/runs/") ? { ...run, ...change } : api(endpoint), env));
-  }
-  await assert.rejects(publisherContext({ workflow_run: source }, async (endpoint) =>
-    endpoint.includes("/actions/workflows/") ? { path: ".github/workflows/spoofed.yml" } : api(endpoint), env), /workflow path/);
-});
-
-test("selection derives its baseline from verified merge parents, not stale PR base metadata", async () => {
-  const { context, selected, api } = sourceFixture();
-  const pr = { state: "open", base: { sha: "e".repeat(40) }, head: {
-    sha: selected.head, repo: { full_name: context.repository },
-  }, merge_commit_sha: selected.merge };
-  const resolved = await selectionContext(context, pr, api);
-  assert.equal(resolved.base, selected.base);
-  assert.notEqual(resolved.base, pr.base.sha);
-  assert.equal(resolved.merge, selected.merge);
-  await assert.rejects(selectionContext(context, { ...pr, state: "closed" }, api), /Source PR/);
-  await assert.rejects(selectionContext(context, pr, async () => ({
-    sha: selected.merge, parents: [{ sha: selected.base }, { sha: "f".repeat(40) }],
-  })), /expected base and head/);
-});
-
-test("untrusted artifacts are bounded data, source-bound and re-sanitized before rendering", async (t) => {
-  const root = mkdtempSync(join(tmpdir(), "comparison-publisher-"));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const { selected, context, api } = sourceFixture();
-  writeFileSync(join(root, "selection.json"), JSON.stringify(selected));
-  const arm = {
-    id: selected.include[0].id, key: "local/draft", arm: "before", repository: context.repository,
-    run: context.run, attempt: context.attempt, merge: selected.merge,
-    data: pair().before,
-  };
-  arm.data.rows[0].model = "@everyone | <script>bad</script>";
-  arm.data.rows[0].eval = "A&B";
-  arm.data.rows[0].checks[1].name = "A&B";
-  arm.data.rows[0].checks[1].reason = "SECRET_UNTRUSTED_EVIDENCE";
-  writeFileSync(join(root, `${arm.id}-before.json`), JSON.stringify(arm));
-  const loaded = await loadComparison(root, context, api, selected);
-  const rendered = renderComparison(loaded.selection, loaded.pairs, "https://example.test");
-  assert.doesNotMatch(rendered, /<script>|@everyone|SECRET_UNTRUSTED_EVIDENCE/i);
-  assert.match(rendered, /A&amp;B/);
-  assert.doesNotMatch(rendered, /A&amp;amp;B/);
-  assert.match(rendered, /Required activation/);
-  assert.match(rendered, /⚠️ Error/);
-  await assert.rejects(validateSelection({ ...selected, attempt: "1" }, context, api), /authenticated source/);
-  await assert.rejects(validateSelection({ ...selected, include: [{ ...selected.include[0], id: "../../outside" }] }, context, api), /selection entry/);
-  await assert.rejects(validateSelection(selected, context, async () => ({
-    sha: selected.merge, parents: [{ sha: selected.head }, { sha: selected.base }],
-  })), /merge parents/);
-  writeFileSync(join(root, `${arm.id}-before.json`), JSON.stringify({ ...arm, attempt: "1" }));
-  await assert.rejects(loadComparison(root, context, api, selected), /Mixed comparison artifacts/);
-  writeFileSync(join(root, "selection.json"), JSON.stringify({ ...selected, include: [] }));
-  await assert.rejects(loadComparison(root, context, api, selected), /coverage differs/);
-  writeFileSync(join(root, "selection.json"), " ".repeat(1024 * 1024 + 1));
-  await assert.rejects(loadComparison(root, context, api, selected), /bounded regular/);
-});
-
-test("native CLI projection binds its run and trusted workflow without an Action report", (t) => {
-  const root = mkdtempSync(join(tmpdir(), "comparison-native-"));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const { selected } = sourceFixture();
-  writeFileSync(join(root, "selection.json"), JSON.stringify(selected));
-  writeFileSync(join(root, "native.jsonl"), [trial(), footer].map((row) => JSON.stringify(row)).join("\n"));
-  const env = {
-    ...process.env, GITHUB_REPOSITORY: selected.repository, GITHUB_RUN_ID: selected.run,
-    GITHUB_RUN_ATTEMPT: selected.attempt, GITHUB_SHA: selected.trusted,
-    COMPARISON_ID: selected.include[0].id, ARM: "before", SELECTION_FILE: join(root, "selection.json"),
-    NATIVE_FILE: join(root, "native.jsonl"), NATIVE_RUN_ID: "native", NATIVE_EXIT: "1",
-  };
-  const args = [fileURLToPath(new URL("./skill-eval-comment.mjs", import.meta.url)), "native", root];
-  const result = spawnSync(process.execPath, args, { env, encoding: "utf8", timeout: 10000 });
-  assert.ifError(result.error);
-  assert.equal(result.status, 0, result.stderr);
-  const saved = readFileSync(join(root, `${selected.include[0].id}-before.json`), "utf8");
-  assert.equal(JSON.parse(saved).data.state, "complete");
-  assert.doesNotMatch(saved, /SECRET/);
-  const mixed = spawnSync(process.execPath, args, { env: { ...env, NATIVE_RUN_ID: "wrong" }, encoding: "utf8", timeout: 10000 });
-  assert.ifError(mixed.error);
-  assert.notEqual(mixed.status, 0);
-  assert.match(mixed.stderr, /completion/);
-});
diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index c07e54c..d967099 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -393,7 +393,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
   });
 });
 
-  test("PR skill requests stay read-only and trusted paid jobs use sequential pinned native CLI arms", () => {
+  test("PR comparisons keep repository approval and permissions around three pinned Action calls", () => {
     const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-evals.yml"), "utf8"));
     assert.deepEqual(Object.keys(workflow.on), ["pull_request"]);
     assert.deepEqual(workflow.on.pull_request.paths, ["plugins/*/skills/**"]);
@@ -412,6 +412,30 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     assert.deepEqual(publisher.jobs.select.permissions, { contents: "read", actions: "read", "pull-requests": "read" });
     assert.match(publisher.jobs.select.if, /conclusion != 'cancelled'/);
     assert.match(publisher.jobs.select.if, /head_repository\.full_name == github\.repository/);
+    const calls = Object.values(publisher.jobs).flatMap((job) => job.steps)
+      .filter((step) => step.uses?.startsWith("github/evals-action/"));
+    assert.deepEqual(calls.map((step) => step.with.command), ["context", "run", "report"]);
+    for (const step of calls) {
+      assert.equal(step.uses, "github/evals-action/comparison@47f26e5db0d56194ff542cf5c27fc1ab090538a0");
+      assert.equal(step.with["source-workflow"], ".github/workflows/skill-evals.yml");
+    }
+    const context = calls[0];
+    assert.equal(context.id, "context");
+    const select = publisher.jobs.select;
+    assert.equal(select.outputs.context, "${{ steps.context.outputs.context }}");
+    assert.equal(select.outputs.selection, "${{ steps.select.outputs.selection }}");
+    const trusted = select.steps.find((step) => step.with?.path === "trusted");
+    assert.equal(trusted.with.ref, "${{ github.sha }}");
+    assert.equal(trusted.with["persist-credentials"], false);
+    const candidate = select.steps.find((step) => step.with?.path === "candidate");
+    assert.equal(candidate.with.ref, "${{ steps.context.outputs.merge }}");
+    assert.equal(candidate.with["fetch-depth"], 2);
+    assert.equal(candidate.with["persist-credentials"], false);
+    const selection = select.steps.find((step) => step.id === "select");
+    assert.equal(selection["working-directory"], "candidate");
+    assert.equal(selection.env.CONTEXT_FILE, "${{ steps.context.outputs.context-path }}");
+    assert.match(selection.run, /node "\$GITHUB_WORKSPACE\/trusted\/\.github\/scripts\/select-skill-evals\.mjs"/);
+    assert.match(selection.run, /"\$CONTEXT_FILE" "\$RUNNER_TEMP\/evals-environment\.json" "\$RUNNER_TEMP\/selection\.json"/);
     const job = publisher.jobs.evals;
     assert.match(job.if, /needs\.select\.result == 'success'/);
     assert.equal(job.concurrency["cancel-in-progress"], true);
@@ -419,37 +443,21 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
       "skill-eval-run-${{ github.repository }}-${{ fromJSON(needs.select.outputs.context).pullNumber }}-${{ fromJSON(needs.select.outputs.context).head }}-${{ matrix.id }}");
     assert.equal(job.environment, "evals");
     assert.equal(job.strategy["fail-fast"], false);
-    assert.deepEqual(job.permissions, { contents: "read", "copilot-requests": "write", "pull-requests": "read" });
-    const before = job.steps.find((step) => step.id === "before");
-    const after = job.steps.find((step) => step.id === "after");
-    assert.equal(before.run, after.run, "both arms use the same native invocation");
-    assert.equal(before["working-directory"], "candidate");
-    assert.equal(after["working-directory"], "candidate");
-    assert.match(before.run, /env -i .*COPILOT_GITHUB_TOKEN/);
-    assert.match(before.run, /node "\$VALLY_ENTRY" eval/);
-    assert.match(before.run, /--output=jsonl/);
-    assert.match(before.run, /--runs 1 --workers 1 --max-retries 0 --require-pass/);
-    assert.doesNotMatch(before.run, /--model|evals-action|GITHUB_EVENT_NAME=|GITHUB_SHA=/);
-    assert.notEqual(before.env.NATIVE_RUN_ID, after.env.NATIVE_RUN_ID);
-    const install = job.steps.find((step) => step.run?.includes("npm ci")).run;
-    assert.match(install, /cp "\$GITHUB_WORKSPACE\/trusted\/package\.json" "\$GITHUB_WORKSPACE\/trusted\/package-lock\.json"/);
-    assert.match(install, /npm ci --prefix "\$RUNNER_TEMP\/skill-eval-tools" --ignore-scripts/);
-    assert.doesNotMatch(install, /candidate|npm install/);
-    assert.equal(job.env.VALLY_ENTRY, undefined);
-    assert.doesNotMatch(JSON.stringify(job.env), /runner\./, "runner context is unavailable in job-level env");
-    assert.match(install, /VALLY_ENTRY="\$RUNNER_TEMP\/skill-eval-tools\/node_modules\/@microsoft\/vally-cli\/dist\/index\.js"/);
-    assert.match(install, /echo "VALLY_ENTRY=\$VALLY_ENTRY" >> "\$GITHUB_ENV"/);
-    for (const arm of ["before", "after"]) {
-      const current = job.steps.find((step) => step.id === `${arm}_current`);
-      assert.match(current.run, /trusted\/\.github\/scripts\/skill-eval-comment\.mjs" verify$/);
-      assert.equal(current.env.SELECTED_CONTEXT, "${{ needs.select.outputs.context }}");
-      assert.equal(current.env.GH_TOKEN, "${{ github.token }}");
-      const native = job.steps.find((step) => step.id === arm);
-      assert.equal(native.if, `\${{ !cancelled() && steps.${arm}_current.outcome == 'success' }}`);
-      assert.equal(job.steps.indexOf(current) + 1, job.steps.indexOf(native), "recheck immediately before either paid arm");
+    assert.equal(job.name, "${{ matrix.key }}");
+    assert.equal(job.strategy.matrix, "${{ fromJSON(needs.select.outputs.matrix) }}");
+    assert.deepEqual(job.permissions, { contents: "read", actions: "read", "copilot-requests": "write", "pull-requests": "read" });
+    const run = calls[1];
+    assert.equal(run.id, "comparison");
+    assert.equal(run.with["working-directory"], "candidate");
+    assert.equal(run.with["vally-version"], "0.21.0");
+    assert.equal(run.with["comparison-id"], "${{ matrix.id }}");
+    assert.equal(run.with["copilot-token"], "${{ github.token }}");
+    assert.equal(run["continue-on-error"], undefined, "native failures must keep the paid job failed");
+    for (const step of [run, calls[2]]) {
+      assert.equal(step.with.context, "${{ needs.select.outputs.context }}");
+      assert.equal(step.with.selection, "${{ needs.select.outputs.selection }}");
+      assert.equal(step.with["producing-attempt"], "${{ needs.select.outputs.attempt }}");
     }
-    assert.equal(job.steps.find((step) => step.id === "after_source").if,
-      "${{ !cancelled() && steps.before_source.outcome == 'success' }}");
     assert.equal(workflow.jobs.comment, undefined, "PR-controlled jobs must not publish with write permission");
     for (const step of Object.values(workflow.jobs)) assert.equal(step.permissions?.["pull-requests"], undefined);
     const comment = publisher.jobs.publish;
@@ -458,12 +466,14 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
       "skill-eval-comment-${{ github.repository }}-${{ fromJSON(needs.select.outputs.context).pullNumber }}");
     assert.deepEqual(comment.permissions, { contents: "read", actions: "read", "pull-requests": "write" });
     assert.equal(comment.permissions["copilot-requests"], undefined);
+    assert.deepEqual(comment.needs, ["select", "evals"]);
     assert.match(comment.if, /!cancelled\(\)/);
-    assert.ok(comment.steps.some((step) => step.run?.includes("skill-eval-comment.mjs post")));
+    assert.match(comment.if, /needs\.select\.result == 'success'/);
+    assert.equal(calls[2].with["artifact-directory"], "${{ runner.temp }}/skill-comparison");
+    assert.equal(calls[2].with["copilot-token"], undefined);
+    assert.equal(context.with["copilot-token"], undefined);
     const download = comment.steps.find((step) => step.uses?.startsWith("actions/download-artifact@")).with;
     assert.equal(download.pattern, "skill-comparison-${{ needs.select.outputs.attempt }}-*");
-    assert.equal(comment.steps.at(-1).env.PRODUCING_ATTEMPT, "${{ needs.select.outputs.attempt }}");
-    assert.equal(comment.steps.at(-1).env.SELECTED_SELECTION, "${{ needs.select.outputs.selection }}");
     assert.equal(download["run-id"], undefined, "publication reads this trusted paid run, not request-run artifacts");
     assert.equal(download.path, "${{ runner.temp }}/skill-comparison");
     for (const step of [...publisher.jobs.select.steps, ...job.steps].filter((step) => step.uses?.startsWith("actions/upload-artifact@"))) {
@@ -471,247 +481,21 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     }
     const evidence = job.steps.find((step) => step.uses?.startsWith("actions/upload-artifact@"));
     assert.deepEqual(evidence.with.path.trim().split("\n"), [
-      "${{ runner.temp }}/skill-comparison/${{ matrix.id }}-before.json",
-      "${{ runner.temp }}/skill-comparison/${{ matrix.id }}-after.json",
+      "${{ steps.comparison.outputs.before-path }}",
+      "${{ steps.comparison.outputs.after-path }}",
     ], "paid jobs may upload only the exact expected verdict files, not extra candidate-created JSON");
+    assert.equal(evidence.if, "${{ !cancelled() }}");
+    assert.equal(evidence.with["if-no-files-found"], "error");
+    assert.equal(evidence.with["retention-days"], 7);
     assert.equal(job.permissions["pull-requests"], "read");
-    assert.equal(comment.steps.find((step) => step.uses?.startsWith("actions/checkout@")).with.ref,
-      "${{ github.sha }}", "workflow_run's default-branch SHA, never the PR head, supplies executable publishing code");
-    assert.doesNotMatch(comment.steps.map((step) => step.run ?? "").join("\n"), /npm |evals-action|git fetch|gh pr checkout/);
-    for (const guarded of [job]) {
-      assert.equal(guarded.steps[0].env.SELECTED_ATTEMPT, "${{ needs.select.outputs.attempt }}");
-      for (const attempt of ["1", "2"]) {
-        const checked = spawnSync("bash", ["-c", guarded.steps[0].run], {
-          encoding: "utf8", timeout: 10000,
-          env: { ...process.env, SELECTED_ATTEMPT: "1", GITHUB_RUN_ATTEMPT: attempt },
-        });
-        assert.ifError(checked.error);
-        assert.equal(checked.status, attempt === "1" ? 0 : 1);
-        if (attempt === "2") assert.match(checked.stdout, /Re-run all jobs/);
-      }
-    }
-    for (const step of job.steps.filter((step) => step.uses?.startsWith("actions/checkout@"))) {
-      assert.equal(step.with["persist-credentials"], false);
-      if (step.with.path === "candidate") {
-        assert.equal(step.with["fetch-depth"], 2);
-        assert.equal(step.with.ref, "${{ fromJSON(needs.select.outputs.context).merge }}");
-      } else assert.equal(step.with.ref, "${{ github.sha }}");
-    }
-  });
-
-  test("native bootstrap copies the trusted dependency lock, never candidate manifests", (t) => {
-    const directory = mkdtempSync(resolve(tmpdir(), "skill-native-bootstrap-"));
-    t.after(() => rmSync(directory, { recursive: true, force: true }));
-    for (const name of ["trusted", "candidate", "runner"]) mkdirSync(resolve(directory, name));
-    for (const name of ["trusted", "candidate"]) {
-      writeFileSync(resolve(directory, name, "package.json"), JSON.stringify({ name }));
-      writeFileSync(resolve(directory, name, "package-lock.json"), JSON.stringify({ name, lockfileVersion: 3 }));
-    }
-    const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
-    const step = workflow.jobs.evals.steps.find((item) => item.run?.includes("npm ci"));
-    const result = spawnSync("bash", ["-c", `
-npm() {
-  [[ "$1" == ci && "$2" == --prefix && "$*" == *--ignore-scripts* ]] || return 91
-  mkdir -p "$3/node_modules/@microsoft/vally-cli/dist"
-  printf 'console.log("synthetic 0.21.0")\\n' > "$3/node_modules/@microsoft/vally-cli/dist/index.js"
-}
-${step.run}
-`], {
-      cwd: resolve(directory, "candidate"), encoding: "utf8", timeout: 10000,
-      env: {
-        ...process.env, RUNNER_TEMP: resolve(directory, "runner").replaceAll("\\", "/"),
-        GITHUB_WORKSPACE: directory.replaceAll("\\", "/"), GITHUB_SHA: "d".repeat(40),
-        GITHUB_ENV: resolve(directory, "environment").replaceAll("\\", "/"),
-        GITHUB_STEP_SUMMARY: resolve(directory, "summary").replaceAll("\\", "/"),
-      },
-    });
-    assert.ifError(result.error);
-    assert.equal(result.status, 0, result.stderr);
-    for (const file of ["package.json", "package-lock.json"]) {
-      assert.equal(readFileSync(resolve(directory, "runner/skill-eval-tools", file), "utf8"),
-        readFileSync(resolve(directory, "trusted", file), "utf8"));
-    }
-    assert.match(readFileSync(resolve(directory, "environment"), "utf8"), /VALLY_ENTRY=.*skill-eval-tools/);
-    assert.match(readFileSync(resolve(directory, "summary"), "utf8"), new RegExp("d".repeat(40)));
-    assert.match(result.stdout, /synthetic 0.21.0/);
-  });
-
-  test("native arm commands isolate credentials, retain raw output privately and still execute After following failed Before", (t) => {
-    const directory = mkdtempSync(resolve(tmpdir(), "skill-native-command-"));
-    t.after(() => rmSync(directory, { recursive: true, force: true }));
-    const runner = resolve(directory, "runner");
-    mkdirSync(resolve(runner, "skill-native"), { recursive: true });
-    const entry = resolve(directory, "synthetic-vally.mjs");
-    writeFileSync(entry, `
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-const value = (flag) => process.argv[process.argv.indexOf(flag) + 1];
-const before = value('--run-id').endsWith('-before');
-const output = value('--output-dir');
-mkdirSync(output, { recursive: true });
-writeFileSync(join(output, 'observed.json'), JSON.stringify({
-  args: process.argv.slice(2), credential: process.env.COPILOT_GITHUB_TOKEN,
-  leaked: ['GH_TOKEN', 'GITHUB_TOKEN', 'ACTIONS_RUNTIME_TOKEN', 'NODE_OPTIONS'].some((key) => key in process.env),
-  home: process.env.HOME, temporary: process.env.TMPDIR,
-  inherited: [process.env.HOME, process.env.TMPDIR].some((path) => existsSync(join(path, 'before-state'))),
-}));
-if (before) for (const path of [process.env.HOME, process.env.TMPDIR]) writeFileSync(join(path, 'before-state'), 'synthetic');
-console.log(JSON.stringify({ type: 'trial-result', runId: value('--run-id'), raw: 'SYNTHETIC_PRIVATE_OUTPUT' }));
-console.log(JSON.stringify({ type: 'run-summary', runId: value('--run-id'), passed: !before, hadExecutionErrors: false }));
-process.exitCode = before ? 1 : 0;
-`);
-    const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
-    const observedArms = [];
-    for (const arm of ["before", "after"]) {
-      const step = workflow.jobs.evals.steps.find((item) => item.id === arm);
-      const result = spawnSync("bash", ["-c", step.run], {
-        cwd: directory, encoding: "utf8", timeout: 10000,
-        env: {
-          ...process.env, RUNNER_TEMP: runner.replaceAll("\\", "/"),
-          GITHUB_OUTPUT: resolve(directory, "outputs").replaceAll("\\", "/"),
-          VALLY_ENTRY: entry.replaceAll("\\", "/"), ARM: arm,
-          EVAL_PATH: "evals/example/skills/changed/eval.yaml", NATIVE_RUN_ID: `fixture-${arm}`,
-          COPILOT_GITHUB_TOKEN: "synthetic-selected", GH_TOKEN: "synthetic-unselected",
-          GITHUB_TOKEN: "synthetic-reporting", ACTIONS_RUNTIME_TOKEN: "synthetic-actions",
-          NODE_OPTIONS: "--not-a-real-node-option",
-        },
-      });
-      assert.ifError(result.error);
-      assert.equal(result.status, arm === "before" ? 1 : 0, result.stderr);
-      assert.equal(result.stdout, "", "raw native output must not enter the Actions log");
-      const observed = JSON.parse(readFileSync(resolve(runner, `skill-native/${arm}-artifacts/observed.json`), "utf8"));
-      assert.equal(observed.credential, "synthetic-selected");
-      assert.equal(observed.leaked, false);
-      assert.equal(observed.inherited, false, "each arm must start without Before's user or temporary state");
-      observedArms.push(observed);
-      assert.equal(observed.args[0], "eval");
-      assert.ok(observed.args.includes("--require-pass"));
-      assert.ok(observed.args.includes("--output=jsonl"));
-      const records = readFileSync(resolve(runner, `skill-native/${arm}.jsonl`), "utf8").trim().split("\n").map((line) => JSON.parse(line));
-      assert.equal(records.at(-1).runId, `fixture-${arm}`);
-      assert.equal(records.at(-1).passed, arm === "after");
-    }
-    assert.notEqual(observedArms[0].home, observedArms[1].home);
-    assert.notEqual(observedArms[0].temporary, observedArms[1].temporary);
-    assert.equal(readFileSync(resolve(directory, "outputs"), "utf8"), "exit=1\nexit=0\n");
-  });
-
-  test("PR selection and sequential source restores compare only eligible target skills and fail closed without approval", (t) => {
-    const directory = mkdtempSync(resolve(tmpdir(), "skill-eval-workflow-"));
-    t.after(() => rmSync(directory, { recursive: true, force: true }));
-    const repository = resolve(directory, "repository");
-    const runner = resolve(directory, "runner");
-    const hooks = resolve(directory, "hooks");
-    for (const path of [repository, runner, hooks]) mkdirSync(path);
-    const config = resolve(directory, "gitconfig");
-    writeFileSync(config, "");
-    const env = {
-      ...process.env, GIT_CONFIG_GLOBAL: config, GIT_CONFIG_NOSYSTEM: "1",
-      RUNNER_TEMP: runner, GITHUB_OUTPUT: resolve(directory, "outputs"),
-      GITHUB_STEP_SUMMARY: resolve(directory, "summary.md").replaceAll("\\", "/"),
-    };
-    const git = (...args) => {
-      const result = spawnSync("git", [
-        "-c", "user.name=Fixture", "-c", "user.email=fixture@example.test",
-        "-c", "commit.gpgsign=false", "-c", `core.hooksPath=${hooks}`, ...args,
-      ], { cwd: repository, env, encoding: "utf8", timeout: 10000 });
-      assert.ifError(result.error);
-      assert.equal(result.status, 0, result.stderr);
-      return result.stdout.trim();
-    };
-    const file = (path, content) => {
-      const destination = resolve(repository, path);
-      mkdirSync(resolve(destination, ".."), { recursive: true });
-      writeFileSync(destination, content);
-    };
-    const target = "plugins/example/skills/changed";
-    git("init", "--initial-branch=main");
-    file(`${target}/SKILL.md`, "base skill\n");
-    file(`${target}/old.md`, "base-only file\n");
-    file(`${target}/r\u00e9sum\u00e9.md`, "base non-ASCII path\n");
-    file("plugins/example/skills/neighbor/SKILL.md", "base neighbor\n");
-    file("plugins/example/skills/deleted/SKILL.md", "deleted skill\n");
-    file("evals/example/skills/changed/eval.yaml", "fixed measurement\n");
-    file("marketplace.json", JSON.stringify({ plugins: [{ name: "example", source: "./plugins/example" }] }));
-    file(".github/scripts/skill-eval-comment.mjs", "throw new Error('Untrusted selector executed');");
-    git("add", "."); git("commit", "-m", "Base fixture");
-    git("checkout", "-b", "candidate");
-    file(`${target}/SKILL.md`, "head skill\n");
-    file(`${target}/new.md`, "head-only file\n");
-    file(`${target}/r\u00e9sum\u00e9.md`, "head non-ASCII path\n");
-    rmSync(resolve(repository, `${target}/old.md`));
-    rmSync(resolve(repository, "plugins/example/skills/deleted/SKILL.md"));
-    file("plugins/example/skills/neighbor/SKILL.md", "head neighbor without an eval\n");
-    file("plugins/example/skills/added/SKILL.md", "new skill without a baseline\n");
-    git("add", "."); git("commit", "-m", "Candidate fixture");
-    env.HEAD_SHA = git("rev-parse", "HEAD");
-    git("checkout", "main");
-    file(`${target}/main.md`, "current-main-only file\n");
-    git("add", "."); git("commit", "-m", "Advance main fixture");
-    const base = git("rev-parse", "HEAD");
-    git("merge", "--no-ff", "candidate", "-m", "Merge fixture");
-    const merge = git("rev-parse", "HEAD");
-    env.GITHUB_SHA = "d".repeat(40);
-    env.TRUSTED_HELPER = resolve(root, ".github/scripts/skill-eval-comment.mjs");
-    writeFileSync(resolve(runner, "comparison-context.json"), JSON.stringify({
-      base, head: env.HEAD_SHA, merge, trusted: env.GITHUB_SHA,
-      repository: "fixture/repo", run: "2", attempt: "1", sourceRun: "1", sourceAttempt: "1",
-    }));
-    const workflow = parse(readFileSync(resolve(root, ".github/workflows/skill-eval-comment.yml"), "utf8"));
-    const selection = workflow.jobs.select.steps.find((step) => step.id === "select").run;
-    const code = selection.match(/<<'JS'\n([\s\S]*)\nJS/)[1];
-    const environment = resolve(runner, "evals-environment.json");
-    writeFileSync(environment, JSON.stringify({ protection_rules: [] }));
-    const denied = spawnSync(process.execPath, ["--input-type=module", "-e", code], {
-      cwd: repository, env, encoding: "utf8", timeout: 10000,
-    });
-    assert.ifError(denied.error);
-    assert.notEqual(denied.status, 0);
-    assert.match(denied.stderr, /required maintainer reviewers/);
-    assert.equal(existsSync(env.GITHUB_OUTPUT), false);
-    writeFileSync(environment, JSON.stringify({ protection_rules: [{ type: "required_reviewers", reviewers: [{ type: "Team" }] }] }));
-    const selected = spawnSync(process.execPath, ["--input-type=module", "-e", code], {
-      cwd: repository, env, encoding: "utf8", timeout: 10000,
-    });
-    assert.ifError(selected.error);
-    assert.equal(selected.status, 0, selected.stderr);
-    assert.match(selected.stdout, /No before\/after pair for example\/added/);
-    assert.match(selected.stdout, /No before\/after pair for example\/deleted/);
-    assert.match(selected.stdout, /No before\/after pair for example\/neighbor/);
-    const matrix = JSON.parse(readFileSync(env.GITHUB_OUTPUT, "utf8").split("\n")[0].slice("matrix=".length));
-    assert.equal(matrix.include.length, 1);
-    const item = matrix.include[0];
-    assert.equal(item.directory, target);
-    assert.equal(item.base, base);
-    assert.equal(item.head, env.HEAD_SHA);
-    assert.match(item.id, /^skill-[a-f0-9]{12}$/);
-    for (const [id, source, expected] of [
-      ["before_source", base, "base skill\n"], ["after_source", env.HEAD_SHA, "head skill\n"],
-    ]) {
-      const step = workflow.jobs.evals.steps.find((entry) => entry.id === id);
-      const restored = spawnSync("bash", ["-c", step.run], {
-        cwd: repository, env: { ...env, SOURCE_SHA: source, SKILL_DIR: target }, encoding: "utf8", timeout: 10000,
-      });
-      assert.ifError(restored.error);
-      assert.equal(restored.status, 0, restored.stderr);
-      assert.equal(git("rev-parse", "HEAD"), merge);
-      assert.equal(readFileSync(resolve(repository, `${target}/SKILL.md`), "utf8"), expected);
-      assert.equal(readFileSync(resolve(repository, `${target}/r\u00e9sum\u00e9.md`), "utf8"),
-        id === "before_source" ? "base non-ASCII path\n" : "head non-ASCII path\n");
-      assert.equal(existsSync(resolve(repository, `${target}/old.md`)), id === "before_source");
-      assert.equal(existsSync(resolve(repository, `${target}/new.md`)), id === "after_source");
-      assert.equal(existsSync(resolve(repository, `${target}/main.md`)), id === "before_source");
-      assert.equal(readFileSync(resolve(repository, "plugins/example/skills/neighbor/SKILL.md"), "utf8"), "head neighbor without an eval\n");
-      assert.equal(readFileSync(resolve(repository, "evals/example/skills/changed/eval.yaml"), "utf8"), "fixed measurement\n");
-      assert.ok(git("diff", "--name-only", "-z", "HEAD").split("\0").filter(Boolean).every((path) => path.startsWith(`${target}/`)));
-    }
-    file("evals/example/skills/changed/eval.yaml", "unexpected measurement change\n");
-    const drift = spawnSync("bash", ["-c", workflow.jobs.evals.steps.find((entry) => entry.id === "after_source").run], {
-      cwd: repository, env: { ...env, SOURCE_SHA: env.HEAD_SHA, SKILL_DIR: target }, encoding: "utf8", timeout: 10000,
-    });
-    assert.ifError(drift.error);
-    assert.notEqual(drift.status, 0);
-    assert.match(drift.stdout, /Measurement files changed outside the selected skill/);
+    assert.ok(comment.steps.every((step) => !step.run && !step.uses?.startsWith("actions/checkout@")),
+      "the fresh publisher executes only packaged Actions, never a candidate checkout or local script");
+    const checkout = job.steps.filter((step) => step.uses?.startsWith("actions/checkout@"));
+    assert.equal(checkout.length, 1);
+    assert.equal(checkout[0].with.path, "candidate");
+    assert.equal(checkout[0].with["persist-credentials"], false);
+    assert.equal(checkout[0].with["fetch-depth"], 2);
+    assert.equal(checkout[0].with.ref, "${{ fromJSON(needs.select.outputs.context).merge }}");
   });
 
 for (const [plugin, skillName, readInstruction] of [
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
index 2cbe109..ea8e405 100644
--- a/.github/workflows/skill-eval-comment.yml
+++ b/.github/workflows/skill-eval-comment.yml
@@ -30,9 +30,10 @@ jobs:
           node-version: 24
       - name: Authenticate the source request and select the current PR merge revision
         id: context
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: node trusted/.github/scripts/skill-eval-comment.mjs context "$RUNNER_TEMP/comparison-context.json"
+        uses: github/evals-action/comparison@47f26e5db0d56194ff542cf5c27fc1ab090538a0
+        with:
+          command: context
+          source-workflow: .github/workflows/skill-evals.yml
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ steps.context.outputs.merge }}
@@ -48,51 +49,10 @@ jobs:
         working-directory: candidate
         env:
           GH_TOKEN: ${{ github.token }}
-          TRUSTED_HELPER: ${{ github.workspace }}/trusted/.github/scripts/skill-eval-comment.mjs
+          CONTEXT_FILE: ${{ steps.context.outputs.context-path }}
         run: |
-          node --input-type=module <<'JS'
-          import { execFileSync, spawnSync } from 'node:child_process';
-          import { createHash } from 'node:crypto';
-          import { appendFileSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
-          import { resolve } from 'node:path';
-          import { pathToFileURL } from 'node:url';
-          const { inventorySkills } = await import(pathToFileURL(process.env.TRUSTED_HELPER));
-          const context = JSON.parse(readFileSync(resolve(process.env.RUNNER_TEMP, 'comparison-context.json'), 'utf8'));
-          const environment = JSON.parse(readFileSync(resolve(process.env.RUNNER_TEMP, 'evals-environment.json'), 'utf8'));
-          if (!environment.protection_rules?.some(rule => rule.type === 'required_reviewers' && rule.reviewers?.length > 0)) {
-            throw new Error('Configure the evals environment with required maintainer reviewers before enabling paid PR evals.');
-          }
-          const git = (...args) => execFileSync('git', args, { encoding: 'utf8' }).trim();
-          if (git('rev-parse', 'HEAD') !== context.merge || git('rev-parse', 'HEAD^1') !== context.base ||
-              git('rev-parse', 'HEAD^2') !== context.head) throw new Error('Expected the verified PR merge and its exact parents.');
-          const changed = execFileSync('git', ['diff', '--no-renames', '--name-only', '-z', context.base, 'HEAD', '--', 'plugins'], { encoding: 'utf8' });
-          const keys = [...new Set(changed.split('\0').flatMap(file => {
-            const match = /^plugins\/([^/]+)\/skills\/([^/]+)\//.exec(file);
-            return match ? [`${match[1]}/${match[2]}`] : [];
-          }))].sort();
-          const include = [];
-          for (const key of keys) {
-            if (!/^[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/.test(key)) throw new Error('Unsupported plugin or skill path in PR changes.');
-            const [plugin, skill] = key.split('/');
-            const directory = `plugins/${plugin}/skills/${skill}`;
-            const evalPath = `evals/${plugin}/skills/${skill}/eval.yaml`;
-            const present = ref => {
-              const result = spawnSync('git', ['cat-file', '-e', `${ref}:${directory}/SKILL.md`], { stdio: 'ignore' });
-              if (result.error) throw result.error;
-              if (result.status !== 0 && result.status !== 128) throw new Error('Could not inspect the skill source tree.');
-              return result.status === 0;
-            };
-            if (!present(context.base) || !present(context.head) || !existsSync(evalPath)) {
-              console.log(`::warning::No before/after pair for ${key}: both skill versions and ${evalPath} are required. No eval was run for this skill.`);
-              continue;
-            }
-            include.push({ plugin, skill, directory, evalPath, base: context.base, head: context.head, id: `skill-${createHash('sha256').update(key).digest('hex').slice(0, 12)}` });
-          }
-          const selection = { ...context, include, changed: keys, skills: inventorySkills(process.cwd()) };
-          writeFileSync(resolve(process.env.RUNNER_TEMP, 'selection.json'), JSON.stringify(selection));
-          appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify({ include })}\ncount=${include.length}\nattempt=${context.attempt}\n`);
-          appendFileSync(process.env.GITHUB_OUTPUT, `selection=${JSON.stringify(selection)}\n`);
-          JS
+          node "$GITHUB_WORKSPACE/trusted/.github/scripts/select-skill-evals.mjs" \
+            "$CONTEXT_FILE" "$RUNNER_TEMP/evals-environment.json" "$RUNNER_TEMP/selection.json"
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: skill-comparison-${{ github.run_attempt }}-selection
@@ -103,12 +63,13 @@ jobs:
   evals:
     needs: select
     if: needs.select.result == 'success' && needs.select.outputs.count != '0'
-    name: ${{ matrix.plugin }}/${{ matrix.skill }}
+    name: ${{ matrix.key }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     environment: evals
     permissions:
       contents: read
+      actions: read
       copilot-requests: write
       pull-requests: read
     strategy:
@@ -117,144 +78,35 @@ jobs:
     concurrency:
       group: skill-eval-run-${{ github.repository }}-${{ fromJSON(needs.select.outputs.context).pullNumber }}-${{ fromJSON(needs.select.outputs.context).head }}-${{ matrix.id }}
       cancel-in-progress: true
-    env:
-      SKILL_DIR: ${{ matrix.directory }}
     steps:
-      - name: Reject partial paid retries
-        env:
-          SELECTED_ATTEMPT: ${{ needs.select.outputs.attempt }}
-        run: |
-          if [[ "$SELECTED_ATTEMPT" != "$GITHUB_RUN_ATTEMPT" ]]; then
-            echo "::error::Partial paid job retries are unsupported. Use Re-run all jobs."
-            exit 1
-          fi
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-        with:
-          ref: ${{ github.sha }}
-          path: trusted
-          persist-credentials: false
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ fromJSON(needs.select.outputs.context).merge }}
           path: candidate
           fetch-depth: 2
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: 24
-      - name: Install locked native tools from the trusted revision, not candidate dependencies
-        run: |
-          mkdir -p "$RUNNER_TEMP/skill-eval-tools"
-          cp "$GITHUB_WORKSPACE/trusted/package.json" "$GITHUB_WORKSPACE/trusted/package-lock.json" "$RUNNER_TEMP/skill-eval-tools/"
-          npm ci --prefix "$RUNNER_TEMP/skill-eval-tools" --ignore-scripts --no-audit --no-fund
-          VALLY_ENTRY="$RUNNER_TEMP/skill-eval-tools/node_modules/@microsoft/vally-cli/dist/index.js"
-          echo "VALLY_ENTRY=$VALLY_ENTRY" >> "$GITHUB_ENV"
-          echo "Native tool dependency lock revision: $GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"
-          mkdir -p "$RUNNER_TEMP/skill-native"
-          node "$VALLY_ENTRY" --version
-      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+      - name: Compare selected skill with native Vally
+        id: comparison
+        uses: github/evals-action/comparison@47f26e5db0d56194ff542cf5c27fc1ab090538a0
         with:
-          name: skill-comparison-${{ github.run_attempt }}-selection
-          path: ${{ runner.temp }}/skill-selection
-      - name: Select the target skill from the base parent
-        id: before_source
-        working-directory: candidate
-        env:
-          SOURCE_SHA: ${{ matrix.base }}
-        run: &restore_source |
-          set -euo pipefail
-          git --literal-pathspecs restore --source="$SOURCE_SHA" --staged --worktree -- "$SKILL_DIR"
-          git --literal-pathspecs diff --exit-code "$SOURCE_SHA" -- "$SKILL_DIR"
-          if ! git diff --quiet HEAD -- . ":(exclude,literal)$SKILL_DIR" || [[ -n "$(git ls-files --others --exclude-standard)" ]]; then
-            echo "::error::Measurement files changed outside the selected skill."
-            exit 1
-          fi
-      - name: Recheck PR after approval and before Before
-        id: before_current
-        env: &current_pr_environment
-          GH_TOKEN: ${{ github.token }}
-          SELECTED_CONTEXT: ${{ needs.select.outputs.context }}
-        run: &verify_current_pr node "$GITHUB_WORKSPACE/trusted/.github/scripts/skill-eval-comment.mjs" verify
-      - name: Run native Before
-        id: before
-        if: ${{ !cancelled() && steps.before_current.outcome == 'success' }}
-        continue-on-error: true
-        working-directory: candidate
-        env:
-          COPILOT_GITHUB_TOKEN: ${{ github.token }}
-          ARM: before
-          EVAL_PATH: ${{ matrix.evalPath }}
-          NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-before
-        run: &native_run |
-          set -e
-          arm_home="$(mktemp -d "$RUNNER_TEMP/skill-home-$ARM-XXXXXX")"
-          arm_tmp="$(mktemp -d "$RUNNER_TEMP/skill-tmp-$ARM-XXXXXX")"
-          set +e
-          env -i PATH="$PATH" HOME="$arm_home" TMPDIR="$arm_tmp" VALLY_TELEMETRY_OPTOUT=1 COPILOT_GITHUB_TOKEN="$COPILOT_GITHUB_TOKEN" \
-            node "$VALLY_ENTRY" eval --eval-spec "$EVAL_PATH" --work-dir "$PWD" --output=jsonl --output-dir "$RUNNER_TEMP/skill-native/$ARM-artifacts" \
-            --run-id "$NATIVE_RUN_ID" --runs 1 --workers 1 --max-retries 0 --require-pass > "$RUNNER_TEMP/skill-native/$ARM.jsonl" 2> "$RUNNER_TEMP/skill-native/$ARM.stderr"
-          code=$?
-          echo "exit=$code" >> "$GITHUB_OUTPUT"
-          exit "$code"
-      - name: Retain only Before verdicts with trusted code
-        if: ${{ !cancelled() && steps.before_current.outcome == 'success' }}
-        working-directory: candidate
-        env:
-          ARM: before
-          COMPARISON_ID: ${{ matrix.id }}
-          SELECTION_FILE: ${{ runner.temp }}/skill-selection/selection.json
-          NATIVE_FILE: ${{ runner.temp }}/skill-native/before.jsonl
-          NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-before
-          NATIVE_EXIT: ${{ steps.before.outputs.exit }}
-        run: node "$GITHUB_WORKSPACE/trusted/.github/scripts/skill-eval-comment.mjs" native "$RUNNER_TEMP/skill-comparison"
-      - name: Select the target skill from the PR head
-        id: after_source
-        if: ${{ !cancelled() && steps.before_source.outcome == 'success' }}
-        working-directory: candidate
-        env:
-          SOURCE_SHA: ${{ matrix.head }}
-        run: *restore_source
-      - name: Recheck PR before After
-        id: after_current
-        if: ${{ !cancelled() && steps.after_source.outcome == 'success' }}
-        env: *current_pr_environment
-        run: *verify_current_pr
-      - name: Run native After even when Before fails
-        id: after
-        if: ${{ !cancelled() && steps.after_current.outcome == 'success' }}
-        continue-on-error: true
-        working-directory: candidate
-        env:
-          COPILOT_GITHUB_TOKEN: ${{ github.token }}
-          ARM: after
-          EVAL_PATH: ${{ matrix.evalPath }}
-          NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-after
-        run: *native_run
-      - name: Retain only After verdicts with trusted code
-        if: ${{ !cancelled() && steps.after_current.outcome == 'success' }}
-        working-directory: candidate
-        env:
-          ARM: after
-          COMPARISON_ID: ${{ matrix.id }}
-          SELECTION_FILE: ${{ runner.temp }}/skill-selection/selection.json
-          NATIVE_FILE: ${{ runner.temp }}/skill-native/after.jsonl
-          NATIVE_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}-after
-          NATIVE_EXIT: ${{ steps.after.outputs.exit }}
-        run: node "$GITHUB_WORKSPACE/trusted/.github/scripts/skill-eval-comment.mjs" native "$RUNNER_TEMP/skill-comparison"
+          command: run
+          source-workflow: .github/workflows/skill-evals.yml
+          context: ${{ needs.select.outputs.context }}
+          selection: ${{ needs.select.outputs.selection }}
+          producing-attempt: ${{ needs.select.outputs.attempt }}
+          comparison-id: ${{ matrix.id }}
+          working-directory: candidate
+          vally-version: '0.21.0'
+          copilot-token: ${{ github.token }}
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: ${{ !cancelled() }}
         with:
           name: skill-comparison-${{ github.run_attempt }}-${{ matrix.id }}
           path: |
-            ${{ runner.temp }}/skill-comparison/${{ matrix.id }}-before.json
-            ${{ runner.temp }}/skill-comparison/${{ matrix.id }}-after.json
+            ${{ steps.comparison.outputs.before-path }}
+            ${{ steps.comparison.outputs.after-path }}
           if-no-files-found: error
           retention-days: 7
-      - name: Keep failed native outcomes visible
-        if: ${{ !cancelled() && (steps.before.outcome != 'success' || steps.after.outcome != 'success') }}
-        run: |
-          echo "::error::At least one native arm did not pass; see the comparison's grader/error details."
-          exit 1
 
   publish:
     needs: [select, evals]
@@ -269,22 +121,17 @@ jobs:
       actions: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: 24
       - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
           pattern: skill-comparison-${{ needs.select.outputs.attempt }}-*
           merge-multiple: true
           path: ${{ runner.temp }}/skill-comparison
       - name: Validate source provenance and publish with trusted code
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PRODUCING_ATTEMPT: ${{ needs.select.outputs.attempt }}
-          SELECTED_CONTEXT: ${{ needs.select.outputs.context }}
-          SELECTED_SELECTION: ${{ needs.select.outputs.selection }}
-        run: node .github/scripts/skill-eval-comment.mjs post "$RUNNER_TEMP/skill-comparison"
+        uses: github/evals-action/comparison@47f26e5db0d56194ff542cf5c27fc1ab090538a0
+        with:
+          command: report
+          source-workflow: .github/workflows/skill-evals.yml
+          context: ${{ needs.select.outputs.context }}
+          selection: ${{ needs.select.outputs.selection }}
+          producing-attempt: ${{ needs.select.outputs.attempt }}
+          artifact-directory: ${{ runner.temp }}/skill-comparison
diff --git a/README.md b/README.md
index 909377b..9073ca5 100644
--- a/README.md
+++ b/README.md
@@ -210,9 +210,10 @@ details, and an all-skills coverage table. Unmeasured skills are marked not run;
 the comment does not imply a full-marketplace or multi-model run.
 Paid execution and publication use a separate
 [trusted `workflow_run` workflow](.github/workflows/skill-eval-comment.yml):
-native Vally behind approval, then a different job with comment-write access.
-The [trust limits and temporary Action workaround](docs/checks-and-evals.md#pr-comparison-comment)
-explain the separate credential/code boundaries.
+the pinned Evals Action comparison adapter runs native Vally behind approval,
+then a different job gets comment-write access. The
+[comparison Action integration and trust limits](docs/checks-and-evals.md#pr-comparison-comment)
+explain what stays in this repository and the upstream deployment dependency.
 
 Repository evals **default to Vally's native Docker backend** in
 [.vally.yaml](.vally.yaml), including `npm run eval` and the manually dispatched
@@ -225,8 +226,8 @@ default image locally.
 See [Native Docker evals and isolation limits](docs/checks-and-evals.md#native-docker-evals)
 before running. The pinned Evals plugin's Run entrypoint cannot read the new
 project backend default and currently rejects this configuration; use the native
-Vally CLI rather than assuming plugin Run is container-isolated. Paid CI remains
-manual-only.
+Vally CLI rather than assuming plugin Run is container-isolated. The smoke-suite
+workflow remains manual-only; PR comparisons require protected approval.
 
 **Standard models:** `npm run eval:models` uses the native
 [model experiment](evals/standard-models.experiment.yaml) to test every retained
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index 47e6bb1..83a8a36 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -332,153 +332,96 @@ explicitly start it with **Run workflow** in GitHub Actions
 dispatching a run.
 
 [Skill evals](../.github/workflows/skill-evals.yml) is a read-only PR notification
-for plugin skill changes. A
-[trusted default-branch `workflow_run`](../.github/workflows/skill-eval-comment.yml)
-authenticates that source request and the still-current same-repository PR head,
-then selects the current PR merge revision and verifies its exact base/head
-parents. That selected revision, not the notifier's checkout or the trusted
-workflow's own SHA, supplies both arms' evals, graders, fixtures and shared
-marketplace context. Only the target skill switches between its exact base/head
-sources. The selected revisions are recorded before paid-job approval.
-After approval, trusted code rechecks that the PR is still open at the selected
-same-repository head immediately before each paid arm. A later closure or push
-can still race an already-started request; the check cannot undo billed work.
-
-Both native Vally CLI invocations run sequentially with the saved model, one
-trial/worker and zero retries. A failed Before verdict does not prevent After;
-failures stay visible without adding a regression-only gate or statistical claim.
-
-The workflow uses Vally 0.21, so native project Docker defaults are honored
-when configured. It does not configure or bypass the Copilot Evals plugin's
-separate Run entrypoint. The workflow uses Node 24 and copies only the trusted
-default-branch revision's `package.json`/lockfile into a separate temporary tool
-directory, then uses `npm ci --ignore-scripts`. That locks native CLI `0.21.0`
-and its dependency graph without bootstrapping from candidate dependency files
-or running install hooks. The lock revision is recorded in the job summary.
-This pins dependency integrity, not a guarantee of harmless dependency behavior.
-It honors the candidate project's native backend
-configuration, including the Docker defaults when present. It does not impose
-Docker on projects without those defaults. Container bootstrap, Plugin Run and
-host-runtime parity are separate limitations, not proved by these workflow edits.
-
-A maintainer must first configure the `evals` environment with required
-reviewers and review the PR's workflow, eval code and billing effects before
-approval. The read-only selection job refuses missing or unprotected
-environments, rather than automatically creating an unprotected environment.
-The paid job intentionally executes candidate eval/setup/grader code with its
-model credential after approval. Each arm's Vally process has a separate fresh
-home and temporary directory, plus a narrow
-environment rather than inherited reporting/Actions credentials. That is process
-hygiene, not isolation from other same-user processes or a network/kernel sandbox.
-Fork PRs are excluded; `pull_request_target` is not used.
-The organization's Copilot billing policy must also permit workflow-token usage.
-The workflow changes none of these repository or organization settings.
-
-New or deleted skills and skills without their corresponding
-`evals/<plugin>/skills/<skill>/eval.yaml` cannot form a before/after pair. They are
-reported as not run, not counted as passing, and do not make evals mandatory for
-every catalog skill.
+for plugin skill changes. The
+[trusted default-branch workflow](../.github/workflows/skill-eval-comment.yml)
+uses the standard
+[unprivileged PR / trusted `workflow_run` pattern](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/).
+It calls the pinned Evals Action `comparison` subaction for authentication,
+paired native execution and publication. Repository-specific selection and
+approval policy stay here; the generic runner, projection and comment machinery
+do not.
 
 ### PR comparison comment
 
-The comment shows one visible table per changed skill. Rows are eval/case
-identities; columns are models actually observed in native results. Cells show
-Before → After **passing/total graders**. After failures stay visible; Before
-failures are collapsed. A separate collapsed marketplace table shows
-**passing/total recorded cases**, with nested failure details.
-
-The current workflow evaluates each eligible changed skill separately using its
-saved model, not a new model roster or all marketplace evals. Other skill
-sources stay fixed at the merge revision in each comparison. Unchanged skills
-and remote skills without repo evals remain explicitly not evaluated; loading
-their context does not measure regressions. Local `skills/<name>/SKILL.md`
-folders and equivalent folders in each remote plugin's exact pinned GitHub tree
-provide the inventory, without installing those plugins. Nonstandard remote
-skill layouts need an inventory adaptation.
-
-One scenario can pass under its native scoring rule even if some individual
-graders fail. New, resolved and persistent failures are distinguished, including
-equal totals with changed failure identities. Errors, skipped cases and missing
-arms never become passing counts. These single-trial observations do not prove
-causation.
-Transition labels require two complete arms and the same individual checks.
-A complete native arm also requires every declared summary group/count to match
-its recorded case/model rows. Missing cases, mismatched totals and grading errors
-keep the arm incomplete while preserving any known failed-check details.
-A missing counterpart is unknown, not a resolved failure. Partial failed-check
-evidence stays visible without claiming an improvement or regression.
-
-The small presentation helper reads the CLI's local native JSONL results
-and uploads only case/model identities, verdicts and safe check explanations.
-Raw trajectories, outputs, grader evidence, exceptions and transcripts are not
-uploaded or copied into comments. Failure reasons describe the check that
-failed, not a generated diagnosis; the evidence link leads to this workflow's
-attempt and derived artifacts. Structured/derived artifacts use seven-day
-retention, subject to repository policy.
-
-Publication follows GitHub's standard
-[unprivileged PR / trusted `workflow_run` pattern](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/).
-The PR workflow grants no model-billing or comment-write permission. Trusted
-selection reads candidate files without executing them. The protected paid job
-has `contents: read` and `copilot-requests: write`, but no PR-write permission.
-A fresh publisher job uses `contents: read`, `actions: read` and
-`pull-requests: write`, but no model-billing permission. Its workflow/helper come
-from the exact trusted default-branch `GITHUB_SHA`; that job never checks out the
-PR, installs its dependencies, runs graders, or executes artifacts. Both workflow
-files and the helper must be on the default branch before this automatic path
-can run. Model-free checks do not prove live paid execution or publication.
-
-Artifacts are untrusted data, not trusted because `workflow_run` downloaded
-them. Downloads select this trusted eval run's actual producing attempt, into
-temporary storage outside the executable checkout. The trusted helper verifies
-the notifier's source workflow/repository/completed PR event/association against
-GitHub's API, separately binds the paid run/attempt/trusted SHA, and checks the
-current PR head and selected merge parents. It reads
-the selection's coverage only when it exactly matches the trusted pre-execution
-job output, so a paid-job artifact cannot silently change the selected skill or
-inventory lists. It reads
-only bounded regular JSON files at expected names, validates case/check shapes,
-escapes labels, and derives failure explanations instead of trusting arbitrary
-artifact messages. Mixed, malformed, oversized, or ambiguous data fails closed.
-These checks do not make results supplied by PR-controlled code an independent
-attestation of that code's correctness.
-
-Publishing updates only its own bot comment. Per-PR serialization and the
-**paid producing run/attempt** order prevent older results replacing newer
-comments. The notifier run is separately retained, not confused with the run
-that measured results. Paid-job concurrency starts only after authenticated
-selection and is scoped to the verified PR/head/skill, so a rejected or delayed
-old-head notification cannot cancel another head's approved comparison.
-Same-head duplicates can be cancelled; a newer PR head does not automatically
-cancel an already-running old-head arm. The pre-arm check prevents its next paid
-arm, but cannot undo already billed requests. Publisher jobs serialize by
-verified PR without cancelling each other. No custom Run button, GitHub App, billing setting,
-or branch-protection change is introduced.
-
-**Partial paid-job reruns are unsupported.** Use **Re-run all jobs** so selection and
-both paid arms share an attempt and approval. A retry reusing a successful
-selection from a previous attempt is rejected before either paid arm, rather
-than spending credits and then failing to collect its artifacts. Retrying the
-publisher job alone reuses `needs.select.outputs.attempt`, the original selection
-and paid evidence, without repeating models. The evidence link includes that
-producing attempt; no GitHub event variables are overwritten.
-
-**Approval boundary:** required environment reviewers protect jobs that reference
-that environment, not every job an authorized workflow editor could add.
-`copilot-requests: write` is a workflow-token permission, not an environment
-secret. These declarations are not an immutable organization-wide billing
-policy. This template's paid entrypoint and approval declaration now come from
-the trusted default branch, not the PR. Owner-controlled Actions/Copilot policy
-still determines who can author other workflows and obtain billing permissions;
-this template cannot impose an organization-wide permission ceiling. No such
-settings or authentication policy is changed here.
-
-**Temporary native CLI entrypoint:** the pinned Evals Action supports
-`pull_request`, `push`, and `workflow_dispatch`, but rejects `workflow_run`
-([source](https://github.com/github/evals-action/blob/6e4c077e92194c7e75663d8d782426841047e887/src/policy.ts#L9-L27)).
-We use the existing Vally CLI directly in the trusted paid job rather than
-spoofing a PR event or disabling checkout guards.
-[github/evals-action#26](https://github.com/github/evals-action/issues/26) tracks
-supported `workflow_run` source-PR/attempt and separate evaluated-revision
-handling. Once supported, replace only the native invocation/projection adapter
-with the Action, retaining approval, provenance and privilege separation.
+All three calls use `github/evals-action/comparison` at
+`47f26e5db0d56194ff542cf5c27fc1ab090538a0`. The
+[pinned Action contract](https://github.com/github/evals-action/blob/47f26e5db0d56194ff542cf5c27fc1ab090538a0/comparison/README.md)
+owns source-workflow/run/attempt authentication, verified merge parents,
+source switching, native verdict projection, bounded artifact intake and the
+bot-owned comment. The existing root Action's event policy is unchanged.
+This pin is the accessible implementation from
+[github/evals-action#28](https://github.com/github/evals-action/pull/28), addressing
+[github/evals-action#26](https://github.com/github/evals-action/issues/26);
+it is an **unmerged upstream dependency**, not a released or live-qualified
+integration. Review that dependency before deployment. Both workflows and the
+trusted selector must reach the default branch before automatic activation.
+
+The [repository selector](../.github/scripts/select-skill-evals.mjs) verifies the
+merge checkout, required environment reviewers and changed skill paths without
+executing candidate scripts. Before uses the current merge's first parent, not
+possibly stale PR base metadata. Eligible pairs require both skill versions and
+`evals/<plugin>/skills/<skill>/eval.yaml`. New, deleted and unpaired skills are
+explicitly not run. Local skill folders and exact pinned remote GitHub trees
+supply the display inventory without installing plugins. Loading neighboring
+skill context does not evaluate those skills or enable full plugin hooks/MCP.
+Skills, evals, fixtures, graders, catalog, models and native configuration remain
+repository-owned. The model-free local saved-file report commands above are
+unchanged.
+
+The protected job runs native Vally **0.21.0** sequentially with the saved model,
+one trial/worker and zero retries. Only the target skill switches between
+base/head sources; measurements and neighbors stay at the selected merge.
+Before failure does not prevent After, and either failed/incomplete arm keeps
+the job failed. The Action's Node 24 runtime acquires native tools outside the
+candidate checkout with install scripts disabled and a job-private generated
+integrity lock. Both arms share one acquired dependency graph; recorded
+CLI/lock/dependency digests are in the job summary. Unlike the previous trusted
+committed-lock bootstrap, transitive resolution can differ **across jobs**.
+Candidate manifests are not bootstrap inputs. Native backend configuration,
+including this repository's Docker defaults, is honored; container bootstrap,
+the Copilot Evals plugin's separate Run entrypoint and runtime parity retain the
+[earlier documented limits](#native-docker-evals).
+
+Repository policy stays visible in the workflow: same-repository PRs only,
+read-only selection, the protected `evals` environment, job permissions,
+timeouts, retention and concurrency. Owners must configure required reviewers
+and permit CI-token billing. Missing/unprotected environments fail preflight.
+The paid job has read-only repository/PR/Actions access and
+`copilot-requests: write`, but no PR-write access. The fresh publisher has
+PR-write access but no billing permission and performs no checkout or candidate
+execution. Approval intentionally allows candidate eval/setup/grader code to
+execute with the model credential. Fresh HOME/TMP and a narrow environment are
+process hygiene, not credential, network or shared-kernel isolation.
+Environment reviewers protect this job, not arbitrary workflows authorized
+editors could add; a workflow-token permission is not an environment secret or
+an organization-wide billing ceiling. No settings/authentication policy changes
+or `pull_request_target` are introduced.
+
+Paid concurrency uses authenticated PR/head/skill outputs. Same-head duplicates
+can cancel; a newer head does not immediately cancel an old in-flight arm.
+The Action rechecks current PR/head after approval and before each paid arm,
+blocking the next stale arm and stale publication, not undoing requests already
+billed. Publishers serialize by verified PR without cancellation; producing
+run/attempt order prevents older comments overwriting newer results.
+**Partial paid retries are unsupported: use Re-run all jobs.** Publisher-only
+retries reuse the original selection producing attempt without repeating models.
+
+The approved comment retains per-changed-skill case/model tables showing
+Before → After **passing/total graders**, visible After failures, collapsed
+Before failures and collapsed marketplace **passing/total recorded cases**.
+Missing checks, grading errors and incomplete coverage remain unknown rather
+than resolved failures; known failures remain visible. These single-trial
+observations do not establish causation or full-cohort/multi-model coverage.
+The Action contract documents the complete evidence and rendering rules.
+
+Only selection metadata and the Action's exact Before/After JSON projection
+paths are uploaded, with seven-day retention subject to repository policy.
+Never upload its private `projection-directory` recursively: it also holds raw
+diagnostics. The publisher independently authenticates context and the exact
+trusted selection/producing attempt; artifacts remain untrusted data, not
+independent attestations of candidate code. Raw trajectories, model output,
+grader evidence, exceptions and transcripts are not posted or uploaded.
+Displayed eval/model/check names must themselves be suitable for publication.
+Model-free checks do not prove live `workflow_run`, token acceptance, protected
+approval, Docker execution or billing; those need separately authorized
+qualification.

From 18a2ec922795eb9d4b129d8b8e3536423c3b0672 Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 16:34:58 -0800
Subject: [PATCH 12/14] Use native Vally results UI and comparison commands

Remove the custom local reporting parser and its private result fixtures. Preserve behavioral grader regressions, keep direct native eval aliases, and document customization contracts and comparison judge cost.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/eval-report.mjs               | 546 -----------------
 .github/scripts/eval-report.test.mjs          | 563 ------------------
 .github/scripts/pr-description.test.mjs       | 130 ++++
 .github/scripts/select-skill-evals.test.mjs   |  49 +-
 .github/scripts/validation.test.mjs           |   6 +-
 README.md                                     |  15 +-
 docs/checks-and-evals.md                      |  60 +-
 .../pr-description/baseline-results.jsonl     |   3 -
 .../pr-description/candidate-results.jsonl    |   3 -
 package.json                                  |   4 +-
 10 files changed, 235 insertions(+), 1144 deletions(-)
 delete mode 100644 .github/scripts/eval-report.mjs
 delete mode 100644 .github/scripts/eval-report.test.mjs
 create mode 100644 .github/scripts/pr-description.test.mjs
 delete mode 100644 evals/_shared/fixtures/pr-description/baseline-results.jsonl
 delete mode 100644 evals/_shared/fixtures/pr-description/candidate-results.jsonl

diff --git a/.github/scripts/eval-report.mjs b/.github/scripts/eval-report.mjs
deleted file mode 100644
index 92ec880..0000000
--- a/.github/scripts/eval-report.mjs
+++ /dev/null
@@ -1,546 +0,0 @@
-import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
-import { relative, resolve, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-import { parseArgs, stripVTControlCharacters } from "node:util";
-import { loadProjectConfig } from "@microsoft/vally/config";
-
-const hasGraderError = (grade) => grade?.status === "error" || (grade?.details ?? []).some(hasGraderError);
-const stripTerminalControls = (text) => stripVTControlCharacters(String(text ?? ""))
-  // eslint-disable-next-line no-control-regex
-  .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]+/gu, " ")
-  .trim();
-const escapeCell = (text) => stripTerminalControls(text).replaceAll("|", "\\|").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-const finiteNonNegative = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
-const sanitizeIdentifier = (value, fallback = "check") => {
-  const cleaned = String(value ?? fallback).replace(/[^A-Za-z0-9._:-]+/g, "-").replace(/^-+|-+$/g, "");
-  return cleaned || fallback;
-};
-const sanitizeGraderId = (detail) => sanitizeIdentifier(
-  typeof detail === "string" ? detail : (detail?.configuredName ?? detail?.name ?? detail?.graderType ?? "check"),
-  "check",
-);
-
-export function extractTrialMetrics(record) {
-  const durationMs = finiteNonNegative(record?.durationMs) ?? finiteNonNegative(record?.trajectory?.metrics?.wallTimeMs);
-  const rawUsage = record?.trajectory?.metrics?.tokenUsage;
-  let tokenUsage;
-  if (rawUsage && typeof rawUsage === "object" && !Array.isArray(rawUsage)) {
-    const inputTokens = finiteNonNegative(rawUsage.inputTokens);
-    const outputTokens = finiteNonNegative(rawUsage.outputTokens);
-    const totalTokens = finiteNonNegative(rawUsage.totalTokens)
-      ?? (inputTokens !== undefined && outputTokens !== undefined ? inputTokens + outputTokens : undefined);
-    if (totalTokens !== undefined) {
-      tokenUsage = {
-        totalTokens,
-        ...(inputTokens !== undefined ? { inputTokens } : {}),
-        ...(outputTokens !== undefined ? { outputTokens } : {}),
-      };
-    }
-  }
-  return { durationMs, tokenUsage };
-}
-
-export function formatTokens(tokenUsage) {
-  if (!tokenUsage || typeof tokenUsage.totalTokens !== "number") return "—";
-  const total = tokenUsage.totalTokens.toLocaleString("en-US");
-  if (typeof tokenUsage.inputTokens === "number" && typeof tokenUsage.outputTokens === "number") {
-    return `${total} (in: ${tokenUsage.inputTokens.toLocaleString("en-US")}, out: ${tokenUsage.outputTokens.toLocaleString("en-US")})`;
-  }
-  return total;
-}
-
-export function formatDuration(durationMs) {
-  if (typeof durationMs !== "number" || !Number.isFinite(durationMs) || durationMs < 0) return "—";
-  if (durationMs < 1000) return `${Math.round(durationMs)}ms`;
-  return `${(durationMs / 1000).toFixed(1)}s`;
-}
-
-export function formatScore(score) {
-  if (typeof score !== "number" || !Number.isFinite(score)) return "Not scored";
-  return `${(score * 100).toFixed(1)}%`;
-}
-
-export function summarizeRun(records) {
-  if (!Array.isArray(records) || !records.length || records.at(-1)?.type !== "run-summary") {
-    throw new Error("The run has no completion summary.");
-  }
-  const runIds = new Set(records.map((record) => record?.runId));
-  if (runIds.size !== 1 || typeof records[0].runId !== "string") {
-    throw new Error("Missing or mixed run identities.");
-  }
-
-  const caseGroups = new Map();
-  const errors = [];
-  let passedCount = 0;
-  let failedCount = 0;
-  let errorCount = 0;
-  let scoredCount = 0;
-  let scoreSum = 0;
-  let totalDurationMs = 0;
-  let allTrialsHaveDuration = true;
-  let totalInputTokens = 0;
-  let totalOutputTokens = 0;
-  let totalTokens = 0;
-  let allTrialsHaveTokens = true;
-  let hasInOutTokens = true;
-  let trialCount = 0;
-
-  for (const record of records) {
-    if (record.type === "run-summary") {
-      if (typeof record.hadExecutionErrors !== "boolean") throw new Error("Invalid run summary.");
-      if (record.hadExecutionErrors) errors.push("execution-error");
-      continue;
-    }
-    if (record.type !== "trial-result" || typeof record.stimulus !== "string" || !record.stimulus.trim()) {
-      throw new Error("Unexpected trial identity.");
-    }
-    if (!["success", "error", "skipped"].includes(record.status)) {
-      throw new Error("Unknown trial status.");
-    }
-    trialCount++;
-
-    const grade = record.gradeResult;
-    const runtimeErrors = (record.trajectory?.events ?? []).filter((event) => event.type === "error");
-    const fatalCode = record.status === "skipped"
-      ? "skipped"
-      : record.status !== "success"
-        ? "execution-error"
-        : !grade || hasGraderError(grade)
-          ? "grader-error"
-          : runtimeErrors.length > 0
-            ? "runtime-error"
-            : undefined;
-    const fatal = fatalCode !== undefined;
-    if (!fatal && (typeof grade.passed !== "boolean" || !Number.isFinite(grade.score) || grade.score < 0 || grade.score > 1)) {
-      throw new Error(`Invalid grade: ${sanitizeIdentifier(record.stimulus, "trial")}`);
-    }
-    if (fatal) {
-      errorCount++;
-      errors.push(`${sanitizeIdentifier(record.stimulus, "trial")}: ${fatalCode}`);
-    } else if (grade.passed) {
-      passedCount++;
-      scoredCount++;
-      scoreSum += grade.score;
-    } else {
-      failedCount++;
-      scoredCount++;
-      scoreSum += grade.score;
-    }
-
-    const { durationMs, tokenUsage } = extractTrialMetrics(record);
-    if (durationMs !== undefined) {
-      totalDurationMs += durationMs;
-    } else {
-      allTrialsHaveDuration = false;
-    }
-    if (tokenUsage !== undefined) {
-      totalTokens += tokenUsage.totalTokens;
-      if (typeof tokenUsage.inputTokens === "number" && typeof tokenUsage.outputTokens === "number") {
-        totalInputTokens += tokenUsage.inputTokens;
-        totalOutputTokens += tokenUsage.outputTokens;
-      } else {
-        hasInOutTokens = false;
-      }
-    } else {
-      allTrialsHaveTokens = false;
-    }
-
-    const evalName = typeof record.evalName === "string" && record.evalName.trim() ? record.evalName.trim() : undefined;
-    const groupKey = `${evalName ?? ""}\0${record.stimulus}`;
-    let group = caseGroups.get(groupKey);
-    if (!group) {
-      group = {
-        evalName,
-        name: record.stimulus,
-        trials: 0,
-        passedCount: 0,
-        hasFatal: false,
-        allPassed: true,
-        allScored: true,
-        scoreSum: 0,
-        allHaveDuration: true,
-        durationSum: 0,
-        allHaveTokens: true,
-        allHaveInOutTokens: true,
-        totalTokensSum: 0,
-        inputTokensSum: 0,
-        outputTokensSum: 0,
-        failures: new Set(),
-      };
-      caseGroups.set(groupKey, group);
-    }
-
-    group.trials++;
-    if (fatal) {
-      group.hasFatal = true;
-      group.allPassed = false;
-      group.allScored = false;
-    } else {
-      if (grade.passed) {
-        group.passedCount++;
-      } else {
-        group.allPassed = false;
-      }
-      group.scoreSum += grade.score;
-    }
-
-    if (durationMs !== undefined) {
-      group.durationSum += durationMs;
-    } else {
-      group.allHaveDuration = false;
-    }
-
-    if (tokenUsage !== undefined) {
-      group.totalTokensSum += tokenUsage.totalTokens;
-      if (typeof tokenUsage.inputTokens === "number" && typeof tokenUsage.outputTokens === "number") {
-        group.inputTokensSum += tokenUsage.inputTokens;
-        group.outputTokensSum += tokenUsage.outputTokens;
-      } else {
-        group.allHaveInOutTokens = false;
-      }
-    } else {
-      group.allHaveTokens = false;
-      group.allHaveInOutTokens = false;
-    }
-
-    for (const detail of (grade?.details ?? [])) {
-      if (!detail.passed) {
-        group.failures.add(sanitizeGraderId(detail));
-      }
-    }
-  }
-
-  if (!trialCount) throw new Error("No cases were evaluated.");
-
-  const rows = [...caseGroups.values()].map((group) => {
-    const passed = !group.hasFatal && group.allPassed;
-    const status = group.hasFatal ? "ERROR / NOT EVALUATED" : passed ? "PASS" : "BEHAVIORAL FAILURE";
-    return {
-      evalName: group.evalName,
-      name: group.name,
-      trials: group.trials,
-      passedCount: group.passedCount,
-      status,
-      passed,
-      score: !group.hasFatal && group.allScored ? group.scoreSum / group.trials : undefined,
-      durationMs: group.allHaveDuration ? group.durationSum : undefined,
-      tokenUsage: group.allHaveTokens
-        ? {
-            totalTokens: group.totalTokensSum,
-            ...(group.allHaveInOutTokens
-              ? { inputTokens: group.inputTokensSum, outputTokens: group.outputTokensSum }
-              : {}),
-          }
-        : undefined,
-      failures: [...group.failures],
-    };
-  });
-
-  return {
-    runId: records[0].runId,
-    rows,
-    errors,
-    passedCount,
-    failedCount,
-    errorCount,
-    averageScore: scoredCount > 0 ? scoreSum / scoredCount : undefined,
-    totalDurationMs: allTrialsHaveDuration ? totalDurationMs : undefined,
-    tokenUsage: allTrialsHaveTokens
-      ? {
-          totalTokens,
-          ...(hasInOutTokens ? { inputTokens: totalInputTokens, outputTokens: totalOutputTokens } : {}),
-        }
-      : undefined,
-  };
-}
-
-function caseKey(row, useEvalPrefix) {
-  return useEvalPrefix && row.evalName ? `${row.evalName} / ${row.name}` : row.name;
-}
-
-export function classifyTransition(baselineRow, candidateRow) {
-  if (!baselineRow) return "Added";
-  if (!candidateRow) return "Removed";
-  if (baselineRow.status !== "PASS" && candidateRow.status === "PASS") return "Fixed";
-  if (baselineRow.status === "PASS" && candidateRow.status !== "PASS") return "Regressed";
-  if (baselineRow.status === "BEHAVIORAL FAILURE" && candidateRow.status === "ERROR / NOT EVALUATED") return "Regressed";
-  if (baselineRow.status === "ERROR / NOT EVALUATED" || candidateRow.status === "ERROR / NOT EVALUATED") return "Unchanged";
-  if (typeof baselineRow.score !== "number" || !Number.isFinite(baselineRow.score)
-    || typeof candidateRow.score !== "number" || !Number.isFinite(candidateRow.score)) {
-    return "Unchanged";
-  }
-  if (candidateRow.score > baselineRow.score) return "Improved score";
-  if (candidateRow.score < baselineRow.score) return "Regressed";
-  if (baselineRow.status === candidateRow.status && (baselineRow.trials ?? 1) === (candidateRow.trials ?? 1)) {
-    const baseTokens = baselineRow.tokenUsage?.totalTokens;
-    const candTokens = candidateRow.tokenUsage?.totalTokens;
-    if (typeof baseTokens === "number" && typeof candTokens === "number") {
-      if (candTokens < baseTokens) return "Reduced tokens at parity";
-      if (candTokens > baseTokens) return "Increased tokens at parity";
-    }
-  }
-  return "Unchanged";
-}
-
-export function compareSummaries(baseline, candidate) {
-  const useEvalPrefix = baseline.rows.every((row) => Boolean(row.evalName))
-    && candidate.rows.every((row) => Boolean(row.evalName));
-  const baselineMap = new Map(baseline.rows.map((row) => [caseKey(row, useEvalPrefix), row]));
-  const candidateMap = new Map(candidate.rows.map((row) => [caseKey(row, useEvalPrefix), row]));
-  const keys = [...new Set([...baselineMap.keys(), ...candidateMap.keys()])];
-
-  const cases = keys.map((key) => {
-    const baseRow = baselineMap.get(key);
-    const candRow = candidateMap.get(key);
-    const sameTrialCount = (baseRow?.trials ?? 1) === (candRow?.trials ?? 1);
-    const scoreDelta = typeof baseRow?.score === "number" && typeof candRow?.score === "number"
-      ? candRow.score - baseRow.score
-      : undefined;
-    const baseTokens = baseRow?.tokenUsage?.totalTokens;
-    const candTokens = candRow?.tokenUsage?.totalTokens;
-    const tokenDelta = sameTrialCount && typeof baseTokens === "number" && typeof candTokens === "number"
-      ? candTokens - baseTokens
-      : undefined;
-    const tokenDeltaPct = tokenDelta !== undefined && baseTokens > 0
-      ? (tokenDelta / baseTokens) * 100
-      : undefined;
-    const durationDeltaMs = sameTrialCount && typeof baseRow?.durationMs === "number" && typeof candRow?.durationMs === "number"
-      ? candRow.durationMs - baseRow.durationMs
-      : undefined;
-
-    return {
-      key,
-      baseline: baseRow,
-      candidate: candRow,
-      scoreDelta,
-      tokenDelta,
-      tokenDeltaPct,
-      durationDeltaMs,
-      transition: classifyTransition(baseRow, candRow),
-    };
-  });
-
-  const workloadsMatch =
-    baseline.rows.length === candidate.rows.length &&
-    cases.every((item) => item.baseline && item.candidate && item.baseline.trials === item.candidate.trials);
-  const baseTotalTokens = baseline.tokenUsage?.totalTokens;
-  const candTotalTokens = candidate.tokenUsage?.totalTokens;
-  const totalTokenDelta = workloadsMatch && typeof baseTotalTokens === "number" && typeof candTotalTokens === "number"
-    ? candTotalTokens - baseTotalTokens
-    : undefined;
-  const totalTokenDeltaPct = totalTokenDelta !== undefined && baseTotalTokens > 0
-    ? (totalTokenDelta / baseTotalTokens) * 100
-    : undefined;
-
-  return {
-    baseline,
-    candidate,
-    cases,
-    deltas: {
-      passed: candidate.passedCount - baseline.passedCount,
-      failed: (candidate.failedCount + candidate.errorCount) - (baseline.failedCount + baseline.errorCount),
-      averageScore: typeof baseline.averageScore === "number" && typeof candidate.averageScore === "number"
-        ? candidate.averageScore - baseline.averageScore
-        : undefined,
-      totalTokens: totalTokenDelta,
-      totalTokensPct: totalTokenDeltaPct,
-      totalDurationMs: workloadsMatch && typeof baseline.totalDurationMs === "number" && typeof candidate.totalDurationMs === "number"
-        ? candidate.totalDurationMs - baseline.totalDurationMs
-        : undefined,
-    },
-  };
-}
-
-function formatSignedInt(value) {
-  if (typeof value !== "number" || !Number.isFinite(value)) return "—";
-  if (value === 0) return "0";
-  return `${value > 0 ? "+" : ""}${value.toLocaleString("en-US")}`;
-}
-
-function formatScoreDelta(delta) {
-  if (typeof delta !== "number" || !Number.isFinite(delta)) return "—";
-  const points = delta * 100;
-  if (Math.abs(points) < 0.05) return "0.0%";
-  return `${points > 0 ? "+" : ""}${points.toFixed(1)}%`;
-}
-
-function formatTokenDelta(delta, pct) {
-  if (typeof delta !== "number" || !Number.isFinite(delta)) return "—";
-  if (delta === 0) return "0 (0.0%)";
-  const sign = delta > 0 ? "+" : "";
-  const pctText = typeof pct === "number" && Number.isFinite(pct)
-    ? ` (${pct > 0 ? "+" : ""}${pct.toFixed(1)}%)`
-    : "";
-  return `${sign}${delta.toLocaleString("en-US")}${pctText}`;
-}
-
-function formatDurationDelta(deltaMs) {
-  if (typeof deltaMs !== "number" || !Number.isFinite(deltaMs)) return "—";
-  if (deltaMs === 0) return "0.0s";
-  const sign = deltaMs > 0 ? "+" : "-";
-  return `${sign}${formatDuration(Math.abs(deltaMs))}`;
-}
-
-export function renderReport(summary, path, { baselineSummary, baselinePath } = {}) {
-  const lines = [
-    "## Behavioral eval report",
-    "",
-    `Saved run: \`${escapeCell(path)}\``,
-    "",
-    "| Passed | Failed | Avg Score | Total Tokens | Total Duration |",
-    "| --- | --- | --- | --- | --- |",
-    `| ${summary.passedCount} | ${summary.failedCount + summary.errorCount} | ${formatScore(summary.averageScore)} | ${formatTokens(summary.tokenUsage)} | ${formatDuration(summary.totalDurationMs)} |`,
-    "",
-    "| Case | Verdict | Score | Tokens | Duration |",
-    "| --- | --- | --- | --- | --- |",
-    ...summary.rows.map((row) =>
-      `| ${escapeCell(row.name)} | ${row.status} | ${formatScore(row.score)} | ${formatTokens(row.tokenUsage)} | ${formatDuration(row.durationMs)} |`),
-    "",
-  ];
-
-  const failureLines = summary.rows.flatMap((row) =>
-    row.failures.map((grader) => `- ${escapeCell(row.name)} / ${escapeCell(sanitizeGraderId(grader))}: check failed`));
-  const errorLines = summary.errors.map((error) => `- ERROR: ${escapeCell(error)}`);
-  if (failureLines.length || errorLines.length) {
-    lines.push(...failureLines, ...errorLines, "");
-  }
-
-  if (baselineSummary) {
-    const comparison = compareSummaries(baselineSummary, summary);
-    lines.push(
-      "## Baseline vs. Candidate Comparison",
-      "",
-      ...(baselinePath ? [`Baseline: \`${escapeCell(baselinePath)}\` | Candidate: \`${escapeCell(path)}\``, ""] : []),
-      "| Metric | Baseline | Candidate | Delta |",
-      "| --- | --- | --- | --- |",
-      `| Passed | ${baselineSummary.passedCount} | ${summary.passedCount} | ${formatSignedInt(comparison.deltas.passed)} |`,
-      `| Failed | ${baselineSummary.failedCount + baselineSummary.errorCount} | ${summary.failedCount + summary.errorCount} | ${formatSignedInt(comparison.deltas.failed)} |`,
-      `| Avg Score | ${formatScore(baselineSummary.averageScore)} | ${formatScore(summary.averageScore)} | ${formatScoreDelta(comparison.deltas.averageScore)} |`,
-      `| Total Tokens | ${formatTokens(baselineSummary.tokenUsage)} | ${formatTokens(summary.tokenUsage)} | ${formatTokenDelta(comparison.deltas.totalTokens, comparison.deltas.totalTokensPct)} |`,
-      `| Total Duration | ${formatDuration(baselineSummary.totalDurationMs)} | ${formatDuration(summary.totalDurationMs)} | ${formatDurationDelta(comparison.deltas.totalDurationMs)} |`,
-      "",
-      "| Case | Baseline | Candidate | Score Delta | Token Delta | Transition |",
-      "| --- | --- | --- | --- | --- | --- |",
-      ...comparison.cases.map((item) => {
-        const baseCell = item.baseline ? `${item.baseline.status} (${formatScore(item.baseline.score)})` : "—";
-        const candCell = item.candidate ? `${item.candidate.status} (${formatScore(item.candidate.score)})` : "—";
-        return `| ${escapeCell(item.key)} | ${baseCell} | ${candCell} | ${formatScoreDelta(item.scoreDelta)} | ${formatTokenDelta(item.tokenDelta, item.tokenDeltaPct)} | ${item.transition} |`;
-      }),
-      "",
-      "> **Note:** Single-run score, token, and duration deltas are observed signals for review rather than multi-trial statistical proof.",
-      "",
-    );
-  }
-
-  return lines.join("\n");
-}
-
-export async function resolveResultsPath(input, root = process.cwd()) {
-  if (!input) {
-    const config = await loadProjectConfig(root);
-    const base = resolve(config.dir || root, config.paths.results);
-    const display = relative(root, base).split(sep).join("/") || ".";
-    if (!existsSync(base)) {
-      throw new Error(`No saved eval runs under ${display}/. Run evals first, or pass --results <path>.`);
-    }
-    const runs = readdirSync(base, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory() && existsSync(resolve(base, entry.name, "results.jsonl")))
-      .map((entry) => entry.name)
-      .sort();
-    if (!runs.length) {
-      throw new Error(`No saved eval runs under ${display}/. Run evals first, or pass --results <path>.`);
-    }
-    return resolve(base, runs.at(-1), "results.jsonl");
-  }
-  const resolved = resolve(root, input);
-  if (!existsSync(resolved)) {
-    throw new Error(`${relative(root, resolved).split(sep).join("/")} doesn't exist.`);
-  }
-  if (statSync(resolved).isDirectory()) {
-    const file = resolve(resolved, "results.jsonl");
-    if (!existsSync(file)) {
-      throw new Error(`${relative(root, file).split(sep).join("/")} doesn't exist.`);
-    }
-    return file;
-  }
-  return resolved;
-}
-
-export async function loadResults(path, root = process.cwd()) {
-  const file = await resolveResultsPath(path, root);
-  const lines = readFileSync(file, "utf8").split(/\r?\n/).filter((line) => line.trim());
-  const records = lines.map((line) => JSON.parse(line));
-  const displayPath = relative(root, file).split(sep).join("/") || file;
-  return { file, displayPath, summary: summarizeRun(records) };
-}
-
-export const usage = `Usage: node .github/scripts/eval-report.mjs [options]
-
-Reads Vally results.jsonl files and prints a Markdown report with per-case and
-aggregate verdicts, scores, token usage (input, output, total), and duration.
-When --baseline is supplied, also prints a Baseline vs. Candidate comparison
-table highlighting fixed failures, regressions, and token deltas.
-
-Options:
-  --results, --candidate, --run-dir <path>
-                    Candidate results.jsonl file or run directory. Defaults to
-                    the newest run under .vally.yaml's paths.results (Vally's
-                    default is vally-results/ when not configured).
-  --baseline <path> Baseline results.jsonl file or run directory to compare
-                    against the candidate run.
-  -h, --help        Show this help message.
-
-Examples:
-  npm run eval:report
-  npm run eval:compare -- --baseline evals/_shared/fixtures/pr-description/baseline-results.jsonl --candidate evals/_shared/fixtures/pr-description/candidate-results.jsonl`;
-
-async function main(argv = process.argv.slice(2)) {
-  let parsed;
-  try {
-    parsed = parseArgs({
-      args: argv,
-      allowPositionals: true,
-      options: {
-        results: { type: "string" },
-        candidate: { type: "string" },
-        "run-dir": { type: "string" },
-        baseline: { type: "string" },
-        help: { type: "boolean", short: "h" },
-      },
-    });
-  } catch (error) {
-    throw new Error(`${error.message}. Run npm run eval:report -- --help for options.`);
-  }
-
-  const { values, positionals } = parsed;
-  if (values.help) {
-    console.log(usage);
-    return;
-  }
-  if (positionals.length > 2) {
-    throw new Error("Pass at most two positional paths ([results] or [baseline] [candidate]). Run npm run eval:report -- --help for options.");
-  }
-
-  const baselineInput = values.baseline ?? (positionals.length === 2 ? positionals[0] : undefined);
-  const candidateInput = values.candidate ?? values.results ?? values["run-dir"]
-    ?? (positionals.length === 2 ? positionals[1] : positionals[0]);
-  const candidate = await loadResults(candidateInput);
-  const baseline = baselineInput ? await loadResults(baselineInput) : undefined;
-  const markdown = renderReport(candidate.summary, candidate.displayPath, {
-    baselineSummary: baseline?.summary,
-    baselinePath: baseline?.displayPath,
-  });
-  console.log(markdown);
-  if (candidate.summary.errors.length || baseline?.summary.errors.length) {
-    process.exitCode = 1;
-  }
-}
-
-if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(resolve(process.argv[1]))) {
-  try {
-    await main();
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
-  }
-}
diff --git a/.github/scripts/eval-report.test.mjs b/.github/scripts/eval-report.test.mjs
deleted file mode 100644
index 303c157..0000000
--- a/.github/scripts/eval-report.test.mjs
+++ /dev/null
@@ -1,563 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { createDefaultGraderRegistry } from "@microsoft/vally";
-import { parse } from "yaml";
-import {
-  classifyTransition,
-  compareSummaries,
-  extractTrialMetrics,
-  formatDuration,
-  formatTokens,
-  loadResults,
-  renderReport,
-  summarizeRun,
-} from "./eval-report.mjs";
-
-const root = fileURLToPath(new URL("../../", import.meta.url));
-const hasPrDescription = existsSync(resolve(root, "plugins/pr-description"));
-const prDescriptionTest = hasPrDescription ? test : test.skip;
-
-const makeTrial = ({
-  runId = "run-1",
-  evalName = "pr-description",
-  stimulus = "case-1",
-  status = "success",
-  passed = true,
-  gradeScore = passed ? 1 : 0,
-  durationMs = 2400,
-  inputTokens = 1100,
-  outputTokens = 320,
-  totalTokens = inputTokens + outputTokens,
-  details = [],
-  events = [],
-} = {}) => ({
-  type: "trial-result",
-  runId,
-  evalName,
-  stimulus,
-  status,
-  durationMs,
-  gradeResult: { passed, score: gradeScore, details },
-  trajectory: {
-    output: "Done.",
-    events,
-    metrics: {
-      wallTimeMs: durationMs,
-      tokenUsage: {
-        inputTokens,
-        outputTokens,
-        totalTokens,
-      },
-    },
-  },
-});
-
-const makeFooter = (runId = "run-1", hadExecutionErrors = false) => ({
-  type: "run-summary",
-  runId,
-  passed: true,
-  hadExecutionErrors,
-  evals: [],
-});
-
-test("eval-report follows native project results configuration and retains explicit paths and defaults", async (t) => {
-  const directory = resolve(root, ".github/scripts", `.report-path-test-${randomUUID()}`);
-  mkdirSync(directory);
-  t.after(() => rmSync(directory, { recursive: true, force: true }));
-  const configured = resolve(directory, "evals/results/2026-01-01/results.jsonl");
-  const legacy = resolve(directory, "vally-results/2026-02-01/results.jsonl");
-  for (const [file, stimulus] of [[configured, "configured-results"], [legacy, "native-default"]]) {
-    mkdirSync(resolve(file, ".."), { recursive: true });
-    writeFileSync(file, `${JSON.stringify(makeTrial({ stimulus }))}\n${JSON.stringify(makeFooter())}\n`);
-  }
-  const configuration = resolve(directory, ".vally.yaml");
-  writeFileSync(configuration, "paths:\n  results: evals/results\n");
-  assert.equal((await loadResults(undefined, directory)).file, configured);
-  assert.equal((await loadResults("vally-results/2026-02-01", directory)).file, legacy);
-  const cli = spawnSync(process.execPath, [resolve(root, ".github/scripts/eval-report.mjs")], {
-    cwd: directory, encoding: "utf8", timeout: 10000,
-  });
-  assert.ifError(cli.error);
-  assert.equal(cli.status, 0, cli.stderr);
-  assert.match(cli.stdout, /configured-results/);
-  assert.doesNotMatch(cli.stdout, /native-default/);
-  writeFileSync(configuration, "{}\n");
-  assert.equal((await loadResults(undefined, directory)).file, legacy);
-  writeFileSync(configuration, "paths: [\n");
-  await assert.rejects(loadResults(undefined, directory), /parse|YAML|flow sequence/i);
-});
-
-test("extractTrialMetrics and summarizeRun extract per-trial and aggregate tokens and duration", () => {
-  const trial1 = makeTrial({ stimulus: "case-a", durationMs: 1500, inputTokens: 800, outputTokens: 200, totalTokens: 1000 });
-  const trial2 = makeTrial({ stimulus: "case-b", durationMs: 2500, inputTokens: 1200, outputTokens: 300, totalTokens: 1500, passed: false, gradeScore: 0.5 });
-
-  assert.deepEqual(extractTrialMetrics(trial1), {
-    durationMs: 1500,
-    tokenUsage: { inputTokens: 800, outputTokens: 200, totalTokens: 1000 },
-  });
-
-  const summary = summarizeRun([trial1, trial2, makeFooter()]);
-  assert.equal(summary.passedCount, 1);
-  assert.equal(summary.failedCount, 1);
-  assert.equal(summary.errorCount, 0);
-  assert.equal(summary.averageScore, 0.75);
-  assert.equal(summary.totalDurationMs, 4000);
-  assert.deepEqual(summary.tokenUsage, {
-    inputTokens: 2000,
-    outputTokens: 500,
-    totalTokens: 2500,
-  });
-  assert.equal(formatTokens(summary.tokenUsage), "2,500 (in: 2,000, out: 500)");
-  assert.equal(formatDuration(summary.totalDurationMs), "4.0s");
-  assert.equal(formatDuration(450), "450ms");
-
-  const markdown = renderReport(summary, "vally-results/run-1/results.jsonl");
-  assert.match(markdown, /\| Passed \| Failed \| Avg Score \| Total Tokens \| Total Duration \|/);
-  assert.match(markdown, /\| 1 \| 1 \| 75\.0% \| 2,500 \(in: 2,000, out: 500\) \| 4\.0s \|/);
-  assert.match(markdown, /\| case-a \| PASS \| 100\.0% \| 1,000 \(in: 800, out: 200\) \| 1\.5s \|/);
-  assert.match(markdown, /\| case-b \| BEHAVIORAL FAILURE \| 50\.0% \| 1,500 \(in: 1,200, out: 300\) \| 2\.5s \|/);
-});
-
-test("compareSummaries and renderReport surface fixed failures, regressions, and token diet reductions at parity", () => {
-  const baseline = summarizeRun([
-    makeTrial({
-      runId: "base",
-      stimulus: "pr-description-drafts-structured-pr-body",
-      passed: false,
-      gradeScore: 0.5,
-      durationMs: 6840,
-      inputTokens: 3420,
-      outputTokens: 980,
-      totalTokens: 4400,
-    }),
-    makeTrial({
-      runId: "base",
-      stimulus: "pr-description-ignores-bug-and-review-question",
-      passed: true,
-      gradeScore: 1,
-      durationMs: 4120,
-      inputTokens: 2150,
-      outputTokens: 410,
-      totalTokens: 2560,
-    }),
-    makeFooter("base"),
-  ]);
-
-  const candidate = summarizeRun([
-    makeTrial({
-      runId: "cand",
-      stimulus: "pr-description-drafts-structured-pr-body",
-      passed: true,
-      gradeScore: 1,
-      durationMs: 3910,
-      inputTokens: 1680,
-      outputTokens: 310,
-      totalTokens: 1990,
-    }),
-    makeTrial({
-      runId: "cand",
-      stimulus: "pr-description-ignores-bug-and-review-question",
-      passed: true,
-      gradeScore: 1,
-      durationMs: 2450,
-      inputTokens: 1120,
-      outputTokens: 190,
-      totalTokens: 1310,
-    }),
-    makeFooter("cand"),
-  ]);
-
-  const comparison = compareSummaries(baseline, candidate);
-  assert.equal(comparison.deltas.passed, 1);
-  assert.equal(comparison.deltas.failed, -1);
-  assert.equal(comparison.deltas.averageScore, 0.25);
-  assert.equal(comparison.deltas.totalTokens, -3660);
-  assert.equal(comparison.cases[0].transition, "Fixed");
-  assert.equal(comparison.cases[1].transition, "Reduced tokens at parity");
-
-  assert.equal(
-    classifyTransition(
-      { status: "PASS", score: 1, tokenUsage: { totalTokens: 1000 } },
-      { status: "BEHAVIORAL FAILURE", score: 0, tokenUsage: { totalTokens: 900 } },
-    ),
-    "Regressed",
-  );
-
-  const markdown = renderReport(candidate, "candidate/results.jsonl", {
-    baselineSummary: baseline,
-    baselinePath: "baseline/results.jsonl",
-  });
-  assert.match(markdown, /## Baseline vs\. Candidate Comparison/);
-  assert.match(markdown, /\| Total Tokens \| 6,960 \(in: 5,570, out: 1,390\) \| 3,300 \(in: 2,800, out: 500\) \| -3,660 \(-52\.6%\) \|/);
-  assert.match(markdown, /\| pr-description \/ pr-description-drafts-structured-pr-body \| BEHAVIORAL FAILURE \(50\.0%\) \| PASS \(100\.0%\) \| \+50\.0% \| -2,410 \(-54\.8%\) \| Fixed \|/);
-  assert.match(markdown, /\| pr-description \/ pr-description-ignores-bug-and-review-question \| PASS \(100\.0%\) \| PASS \(100\.0%\) \| 0\.0% \| -1,250 \(-48\.8%\) \| Reduced tokens at parity \|/);
-  assert.match(markdown, /Single-run score, token, and duration deltas are observed signals for review/);
-});
-
-prDescriptionTest("eval-report CLI compares the shared pr-description baseline and candidate fixtures without writing GITHUB_STEP_SUMMARY", async (t) => {
-  const tempDir = resolve(root, ".github/scripts", `.report-test-${randomUUID()}`);
-  mkdirSync(tempDir, { recursive: true });
-  t.after(() => rmSync(tempDir, { recursive: true, force: true }));
-  const summaryFile = resolve(tempDir, "step-summary.md");
-  writeFileSync(summaryFile, "");
-
-  const baselinePath = "evals/_shared/fixtures/pr-description/baseline-results.jsonl";
-  const candidatePath = "evals/_shared/fixtures/pr-description/candidate-results.jsonl";
-  const loadedBase = await loadResults(baselinePath, root);
-  const loadedCand = await loadResults(candidatePath, root);
-  assert.equal(loadedBase.summary.passedCount, 1);
-  assert.equal(loadedCand.summary.passedCount, 2);
-
-  const result = spawnSync(
-    process.execPath,
-    [
-      resolve(root, ".github/scripts/eval-report.mjs"),
-      "--baseline",
-      baselinePath,
-      "--candidate",
-      candidatePath,
-    ],
-    {
-      cwd: root,
-      encoding: "utf8",
-      timeout: 10000,
-      env: { ...process.env, GITHUB_STEP_SUMMARY: summaryFile },
-    },
-  );
-  assert.ifError(result.error);
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /## Baseline vs\. Candidate Comparison/);
-  assert.match(result.stdout, /Fixed/);
-  assert.match(result.stdout, /Reduced tokens at parity/);
-  assert.equal(readFileSync(summaryFile, "utf8"), "");
-});
-
-test("eval-report redacts raw grader evidence and error strings, requires complete metric coverage, aggregates multi-trial cases, and guards unscored transitions", () => {
-  const secretEvidence = "SECRET_TOKEN_EVIDENCE_12345";
-  const secretError = "RAW_EXECUTION_ERROR_67890";
-  const secretSkip = "RAW_SKIP_REASON_ABCDE";
-  const secretRuntime = "RAW_RUNTIME_EVENT_FGHIJ";
-
-  const leakedRecords = [
-    makeTrial({
-      runId: "leak-run",
-      stimulus: "failed-case",
-      passed: false,
-      gradeScore: 0.5,
-      details: [{ name: "pr-description-contract", passed: false, score: 0, evidence: secretEvidence }],
-    }),
-    {
-      ...makeTrial({ runId: "leak-run", stimulus: "error-case", status: "error" }),
-      error: secretError,
-    },
-    {
-      ...makeTrial({ runId: "leak-run", stimulus: "skip-case", status: "skipped" }),
-      skipReason: secretSkip,
-    },
-    makeTrial({
-      runId: "leak-run",
-      stimulus: "runtime-error-case",
-      events: [{ type: "error", data: { message: secretRuntime } }],
-    }),
-    makeFooter("leak-run", true),
-  ];
-
-  const leakedSummary = summarizeRun(leakedRecords);
-  const leakedReport = renderReport(leakedSummary, "vally-results/leak-run/results.jsonl");
-  for (const secret of [secretEvidence, secretError, secretSkip, secretRuntime]) {
-    assert.ok(!JSON.stringify(leakedSummary).includes(secret), `summary leaked ${secret}`);
-    assert.ok(!leakedReport.includes(secret), `report leaked ${secret}`);
-  }
-  assert.deepEqual(leakedSummary.rows[0].failures, ["pr-description-contract"]);
-  assert.deepEqual(leakedSummary.errors, [
-    "error-case: execution-error",
-    "skip-case: skipped",
-    "runtime-error-case: runtime-error",
-    "execution-error",
-  ]);
-
-  // Partial duration or token coverage must yield undefined run totals
-  const missingSecondMetrics = makeTrial({ runId: "partial-run", stimulus: "case-2" });
-  delete missingSecondMetrics.durationMs;
-  delete missingSecondMetrics.trajectory.metrics;
-  const partialSummary = summarizeRun([
-    makeTrial({ runId: "partial-run", stimulus: "case-1", durationMs: 1200, inputTokens: 500, outputTokens: 100, totalTokens: 600 }),
-    missingSecondMetrics,
-    makeFooter("partial-run"),
-  ]);
-  assert.equal(partialSummary.totalDurationMs, undefined);
-  assert.equal(partialSummary.tokenUsage, undefined);
-
-  // Multi-trial aggregation per case and mismatched trial count comparison
-  const multiBase = summarizeRun([
-    makeTrial({ runId: "m-base", stimulus: "repeat-case", passed: true, gradeScore: 1, durationMs: 1000, inputTokens: 400, outputTokens: 100, totalTokens: 500 }),
-    makeTrial({ runId: "m-base", stimulus: "repeat-case", passed: true, gradeScore: 1, durationMs: 1200, inputTokens: 500, outputTokens: 100, totalTokens: 600 }),
-    makeFooter("m-base"),
-  ]);
-  const multiCand = summarizeRun([
-    makeTrial({
-      runId: "m-cand",
-      stimulus: "repeat-case",
-      passed: false,
-      gradeScore: 0,
-      durationMs: 900,
-      inputTokens: 300,
-      outputTokens: 100,
-      totalTokens: 400,
-      details: [{ name: "contract-check", passed: false, evidence: "ignored" }],
-    }),
-    makeTrial({
-      runId: "m-cand",
-      stimulus: "repeat-case",
-      passed: true,
-      gradeScore: 1,
-      durationMs: 900,
-      inputTokens: 300,
-      outputTokens: 100,
-      totalTokens: 400,
-      details: [{ name: "contract-check", passed: false, evidence: "ignored" }],
-    }),
-    makeFooter("m-cand"),
-  ]);
-  assert.equal(multiBase.rows.length, 1);
-  assert.equal(multiBase.rows[0].trials, 2);
-  assert.equal(multiBase.rows[0].passedCount, 2);
-  assert.equal(multiBase.rows[0].status, "PASS");
-  assert.equal(multiBase.rows[0].score, 1);
-  assert.equal(multiBase.rows[0].durationMs, 2200);
-  assert.equal(multiBase.rows[0].tokenUsage.totalTokens, 1100);
-
-  assert.equal(multiCand.rows.length, 1);
-  assert.equal(multiCand.rows[0].trials, 2);
-  assert.equal(multiCand.rows[0].passedCount, 1);
-  assert.equal(multiCand.rows[0].status, "BEHAVIORAL FAILURE");
-  assert.equal(multiCand.rows[0].passed, false);
-  assert.equal(multiCand.rows[0].score, 0.5);
-  assert.deepEqual(multiCand.rows[0].failures, ["contract-check"]);
-
-  const multiComp = compareSummaries(multiBase, multiCand);
-  assert.equal(multiComp.cases[0].transition, "Regressed");
-  assert.equal(multiComp.cases[0].scoreDelta, -0.5);
-  assert.equal(multiComp.cases[0].tokenDelta, -300);
-
-  const singleTrialCand = summarizeRun([
-    makeTrial({ runId: "s-cand", stimulus: "repeat-case", passed: true, gradeScore: 1, durationMs: 900, inputTokens: 300, outputTokens: 100, totalTokens: 400 }),
-    makeFooter("s-cand"),
-  ]);
-  const mismatchedTrialsComp = compareSummaries(multiBase, singleTrialCand);
-  assert.equal(mismatchedTrialsComp.cases[0].tokenDelta, undefined);
-  assert.equal(mismatchedTrialsComp.cases[0].durationDeltaMs, undefined);
-  assert.equal(mismatchedTrialsComp.cases[0].transition, "Unchanged");
-  assert.equal(mismatchedTrialsComp.deltas.totalTokens, undefined);
-  assert.equal(mismatchedTrialsComp.deltas.totalTokensPct, undefined);
-  assert.equal(mismatchedTrialsComp.deltas.totalDurationMs, undefined);
-  const mismatchedTrialsReport = renderReport(singleTrialCand, "cand/results.jsonl", {
-    baselineSummary: multiBase,
-    baselinePath: "base/results.jsonl",
-  });
-  assert.match(mismatchedTrialsReport, /\| Total Tokens \| 1,100 \(in: 900, out: 200\) \| 400 \(in: 300, out: 100\) \| — \|/);
-  assert.match(mismatchedTrialsReport, /\| Total Duration \| 2\.2s \| 900ms \| — \|/);
-
-  const extraCaseBase = summarizeRun([
-    makeTrial({ runId: "e-base", stimulus: "repeat-case", passed: true, gradeScore: 1, durationMs: 900, inputTokens: 300, outputTokens: 100, totalTokens: 400 }),
-    makeTrial({ runId: "e-base", stimulus: "extra-case", passed: true, gradeScore: 1, durationMs: 900, inputTokens: 300, outputTokens: 100, totalTokens: 400 }),
-    makeFooter("e-base"),
-  ]);
-  const mismatchedCasesComp = compareSummaries(extraCaseBase, singleTrialCand);
-  assert.equal(mismatchedCasesComp.deltas.totalTokens, undefined);
-  assert.equal(mismatchedCasesComp.deltas.totalTokensPct, undefined);
-  assert.equal(mismatchedCasesComp.deltas.totalDurationMs, undefined);
-
-  // Unscored / errored transitions
-  assert.equal(
-    classifyTransition(
-      { status: "BEHAVIORAL FAILURE", score: 0.5, tokenUsage: { totalTokens: 2000 } },
-      { status: "ERROR / NOT EVALUATED", score: undefined, tokenUsage: { totalTokens: 500 } },
-    ),
-    "Regressed",
-  );
-  assert.equal(
-    classifyTransition(
-      { status: "ERROR / NOT EVALUATED", score: undefined, tokenUsage: { totalTokens: 2000 } },
-      { status: "ERROR / NOT EVALUATED", score: undefined, tokenUsage: { totalTokens: 500 } },
-    ),
-    "Unchanged",
-  );
-  assert.equal(
-    classifyTransition(
-      { status: "ERROR / NOT EVALUATED", score: undefined, tokenUsage: { totalTokens: 2000 } },
-      { status: "BEHAVIORAL FAILURE", score: 0.5, tokenUsage: { totalTokens: 500 } },
-    ),
-    "Unchanged",
-  );
-
-  // Strip terminal escape sequences (including OSC 52) from report fields and invalid-grade errors
-  const osc52Stimulus = "case-\u001b]52;c;ZWNobyBpw6g=\u0007\u001b[31mred\u001b[0m";
-  const escapedSummary = summarizeRun([
-    makeTrial({ runId: "osc-run", stimulus: osc52Stimulus, passed: true, gradeScore: 1 }),
-    makeFooter("osc-run"),
-  ]);
-  const escapedReport = renderReport(escapedSummary, "vally-results/\u001b]52;c;bad\u0007/results.jsonl");
-  assert.doesNotMatch(escapedReport, /\u001b|\u0007/);
-  assert.throws(
-    () => summarizeRun([
-      {
-        ...makeTrial({ runId: "bad-grade-osc", stimulus: osc52Stimulus }),
-        gradeResult: { status: "success", passed: true, score: 2 },
-      },
-      makeFooter("bad-grade-osc"),
-    ]),
-    (err) => err instanceof Error && /^Invalid grade: /.test(err.message) && !/[\u001b\u0007]/.test(err.message),
-  );
-});
-
-prDescriptionTest("pr-description eval stages the multi-skill marketplace cohort and enforces non-collision", async () => {
-  const evalDir = resolve(root, "evals/pr-description/skills/pr-description");
-  const spec = parse(readFileSync(resolve(evalDir, "eval.yaml"), "utf8"));
-  assert.equal(spec.scoring.threshold, 1);
-  const project = parse(readFileSync(resolve(root, ".vally.yaml"), "utf8"));
-  assert.equal(spec.agent_environment, "marketplace");
-  const skills = project.environments.marketplace.skills;
-  for (const configuredSkill of skills) {
-    assert.ok(existsSync(resolve(evalDir, configuredSkill)), `configured cohort skill path is missing: ${configuredSkill}`);
-  }
-  for (const expectedSkill of [
-    "../../../../plugins/pr-description/skills/pr-description",
-    "../../../../plugins/plugin-authoring/skills/add-plugin",
-    "../../../../plugins/plugin-authoring/skills/try-plugin-locally",
-    "../../../../plugins/plugin-authoring/skills/submit-plugin",
-    "../../../../plugins/marketplace-maintainer/skills/update-remote-pins",
-    "../../../../plugins/marketplace-maintainer/skills/release-plugins",
-  ].filter((skillPath) => existsSync(resolve(evalDir, skillPath)))) {
-    assert.ok(skills.includes(expectedSkill), `missing cohort skill: ${expectedSkill}`);
-  }
-
-  const grader = createDefaultGraderRegistry().get("skill-invocation");
-  const positive = spec.stimuli.find((item) => item.tags?.control === "positive");
-  const negative = spec.stimuli.find((item) => item.tags?.control === "negative");
-  const posConfig = positive.graders.find((item) => item.type === "skill-invocation").config;
-  const negConfig = negative.graders.find((item) => item.type === "skill-invocation").config;
-
-  const exactMatch = await grader.grade({
-    stimulus: positive,
-    config: posConfig,
-    trajectory: { output: "ok", events: [{ type: "skill_activation", data: { name: "pr-description" } }] },
-  });
-  assert.equal(exactMatch.passed, true);
-
-  const neighborCollision = await grader.grade({
-    stimulus: positive,
-    config: posConfig,
-    trajectory: {
-      output: "ok",
-      events: [
-        { type: "skill_activation", data: { name: "pr-description" } },
-        { type: "skill_activation", data: { name: "submit-plugin" } },
-      ],
-    },
-  });
-  assert.equal(neighborCollision.passed, false, "activating a neighbor skill alongside pr-description must fail");
-
-  const negativeTriggered = await grader.grade({
-    stimulus: negative,
-    config: negConfig,
-    trajectory: { output: "ok", events: [{ type: "skill_activation", data: { name: "pr-description" } }] },
-  });
-  assert.equal(negativeTriggered.passed, false, "activating pr-description on the negative case must fail");
-});
-
-prDescriptionTest("pr-description program grader enforces ordered headings, factual changes, and unshipped backlog exclusion", async (t) => {
-  const gradingDir = resolve(root, ".github/scripts", `.pr-grader-test-${randomUUID()}`);
-  mkdirSync(gradingDir, { recursive: true });
-  t.after(() => rmSync(gradingDir, { recursive: true, force: true }));
-  copyFileSync(resolve(root, "evals/pr-description/skills/pr-description/grader.mjs"), resolve(gradingDir, "grader.mjs"));
-  copyFileSync(resolve(root, "evals/_shared/graders/common.mjs"), resolve(gradingDir, "common.mjs"));
-  const { evaluate: evaluatePrDescription } = await import(pathToFileURL(resolve(gradingDir, "grader.mjs")));
-  const { score } = await import(pathToFileURL(resolve(gradingDir, "common.mjs")));
-
-  const validOutput = [
-    "## Summary",
-    "Validate `--timeout` as a positive integer in `src/cli.mjs` and add unit tests. Retry backoff (#42) remains open and out of scope.",
-    "",
-    "## Changes",
-    "- Added positive integer validation for `--timeout` in `src/cli.mjs`.",
-    "- Added unit tests for `--timeout 0` and `--timeout -5` in `test/cli.test.mjs`.",
-    "",
-    "## Verification",
-    "- `npm test` passed (14 tests).",
-    "",
-    "## Risks / Rollback",
-    "- Low risk; revert the commit if needed.",
-  ].join("\n");
-
-  assert.equal(score("pr-description-contract", evaluatePrDescription({ output: validOutput, events: [] })).passed, true);
-
-  for (const passingLine of [
-    "- `npm test` (14 tests): passed.",
-    "- `npm test` — 14 tests, all passing.",
-    "- Ran `npm test`; 14/14 tests passed.",
-    "- `npm test`: 14 tests passed, 0 failed, 0 errors.",
-    "- `npm test` passed (14 tests, no errors).",
-    "- `npm test`: 14 passed, # fail 0, 0 failures.",
-  ]) {
-    const equivalentOutput = validOutput.replace("- `npm test` passed (14 tests).", passingLine);
-    assert.equal(
-      score("pr-description-contract", evaluatePrDescription({ output: equivalentOutput, events: [] })).passed,
-      true,
-      `expected passing verification format: ${passingLine}`,
-    );
-  }
-
-  for (const negatedLine of [
-    "- `npm test` (14 tests).",
-    "- `npm test` did not pass (14 tests).",
-    "- `npm test` (14 tests): not passing.",
-    "- `npm test`: 14 tests; 12 passed, 2 failures.",
-  ]) {
-    const negatedOutput = validOutput.replace("- `npm test` passed (14 tests).", negatedLine);
-    const negatedResult = score("pr-description-contract", evaluatePrDescription({ output: negatedOutput, events: [] }));
-    assert.equal(negatedResult.passed, false, `expected negated verification to fail: ${negatedLine}`);
-    assert.match(negatedResult.evidence, /Recorded the supplied npm test verification result/);
-  }
-
-  for (const leakedChanges of [
-    "- Added unit tests for `--timeout 0` and `--timeout -5` in `test/cli.test.mjs`.\n- Implemented exponential retry backoff (#42).",
-    "- Rejects `--timeout` values that are not positive integers.\n- Adds exponential retry backoff (#42).",
-  ]) {
-    const leaksBacklogIntoChanges = validOutput.replace(
-      "- Added unit tests for `--timeout 0` and `--timeout -5` in `test/cli.test.mjs`.",
-      leakedChanges,
-    );
-    const leakedResult = score("pr-description-contract", evaluatePrDescription({ output: leaksBacklogIntoChanges, events: [] }));
-    assert.equal(leakedResult.passed, false);
-    assert.match(leakedResult.evidence, /Excluded unshipped retry backoff/);
-  }
-
-  const missingRisks = validOutput.split("## Risks / Rollback")[0];
-  assert.equal(score("pr-description-contract", evaluatePrDescription({ output: missingRisks, events: [] })).passed, false);
-
-  const failedTestsClaim = validOutput.replace(
-    "- `npm test` passed (14 tests).",
-    "- `npm test` failed (14 tests).",
-  );
-  const failedTestsResult = score("pr-description-contract", evaluatePrDescription({ output: failedTestsClaim, events: [] }));
-  assert.equal(failedTestsResult.passed, false);
-  assert.match(failedTestsResult.evidence, /Recorded the supplied npm test verification result/);
-
-  for (const prohibitedTool of ["bash", "functions.bash", "functions.powershell", "mcp:edit", "tools/write_file"]) {
-    const toolResult = score(
-      "pr-description-contract",
-      evaluatePrDescription({
-        output: validOutput,
-        events: [{ type: "tool_call", data: { toolCallId: "1", toolName: prohibitedTool, arguments: { command: "git status" } } }],
-      }),
-    );
-    assert.equal(toolResult.passed, false, `must reject prohibited tool ${prohibitedTool}`);
-    assert.match(toolResult.evidence, /Did not run shell commands or create a pull request/);
-  }
-});
diff --git a/.github/scripts/pr-description.test.mjs b/.github/scripts/pr-description.test.mjs
new file mode 100644
index 0000000..7cc96ce
--- /dev/null
+++ b/.github/scripts/pr-description.test.mjs
@@ -0,0 +1,130 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createDefaultGraderRegistry } from "@microsoft/vally";
+import { parse } from "yaml";
+
+const root = fileURLToPath(new URL("../../", import.meta.url));
+const prDescriptionTest = existsSync(resolve(root, "plugins/pr-description")) ? test : test.skip;
+
+prDescriptionTest("pr-description eval stages catalog-local skills and enforces non-collision", async () => {
+  const evalDir = resolve(root, "evals/pr-description/skills/pr-description");
+  const spec = parse(readFileSync(resolve(evalDir, "eval.yaml"), "utf8"));
+  assert.equal(spec.scoring.threshold, 1);
+  const project = parse(readFileSync(resolve(root, ".vally.yaml"), "utf8"));
+  assert.equal(spec.agent_environment, "marketplace");
+  const skills = project.environments.marketplace.skills;
+  for (const configuredSkill of skills) {
+    assert.ok(existsSync(resolve(evalDir, configuredSkill)), `configured cohort skill path is missing: ${configuredSkill}`);
+  }
+  const staged = new Set(skills.map((skill) => resolve(evalDir, skill)));
+  const catalog = JSON.parse(readFileSync(resolve(root, "marketplace.json"), "utf8"));
+  for (const plugin of catalog.plugins.filter((plugin) => typeof plugin.source === "string")) {
+    const directory = resolve(root, plugin.source, "skills");
+    if (!existsSync(directory)) continue;
+    for (const skill of readdirSync(directory)) {
+      const source = resolve(directory, skill);
+      if (existsSync(resolve(source, "SKILL.md"))) {
+        assert.ok(staged.has(source), `Add catalog skill ${plugin.name}/${skill} to the native marketplace environment.`);
+      }
+    }
+  }
+
+  const grader = createDefaultGraderRegistry().get("skill-invocation");
+  const positive = spec.stimuli.find((item) => item.tags?.control === "positive");
+  const negative = spec.stimuli.find((item) => item.tags?.control === "negative");
+  const posConfig = positive.graders.find((item) => item.type === "skill-invocation").config;
+  const negConfig = negative.graders.find((item) => item.type === "skill-invocation").config;
+  const activation = (name) => ({ type: "skill_activation", data: { name } });
+
+  const exactMatch = await grader.grade({
+    stimulus: positive, config: posConfig,
+    trajectory: { output: "ok", events: [activation("pr-description")] },
+  });
+  assert.equal(exactMatch.passed, true);
+
+  if (posConfig.disallowed?.length) {
+    const neighborCollision = await grader.grade({
+      stimulus: positive, config: posConfig,
+      trajectory: { output: "ok", events: [activation("pr-description"), activation(posConfig.disallowed[0])] },
+    });
+    assert.equal(neighborCollision.passed, false, "activating a configured neighbor must fail");
+  }
+
+  const negativeTriggered = await grader.grade({
+    stimulus: negative, config: negConfig,
+    trajectory: { output: "ok", events: [activation("pr-description")] },
+  });
+  assert.equal(negativeTriggered.passed, false, "activating pr-description on the negative case must fail");
+});
+
+prDescriptionTest("pr-description program grader enforces ordered headings, factual changes, and unshipped backlog exclusion", async (t) => {
+  const gradingDir = resolve(root, ".github/scripts", `.pr-grader-test-${randomUUID()}`);
+  mkdirSync(gradingDir, { recursive: true });
+  t.after(() => rmSync(gradingDir, { recursive: true, force: true }));
+  copyFileSync(resolve(root, "evals/pr-description/skills/pr-description/grader.mjs"), resolve(gradingDir, "grader.mjs"));
+  copyFileSync(resolve(root, "evals/_shared/graders/common.mjs"), resolve(gradingDir, "common.mjs"));
+  const { evaluate: evaluatePrDescription } = await import(pathToFileURL(resolve(gradingDir, "grader.mjs")));
+  const { score } = await import(pathToFileURL(resolve(gradingDir, "common.mjs")));
+  const validOutput = [
+    "## Summary",
+    "Validate `--timeout` as a positive integer in `src/cli.mjs` and add unit tests. Retry backoff (#42) remains open and out of scope.",
+    "",
+    "## Changes",
+    "- Added positive integer validation for `--timeout` in `src/cli.mjs`.",
+    "- Added unit tests for `--timeout 0` and `--timeout -5` in `test/cli.test.mjs`.",
+    "",
+    "## Verification",
+    "- `npm test` passed (14 tests).",
+    "",
+    "## Risks / Rollback",
+    "- Low risk; revert the commit if needed.",
+  ].join("\n");
+  assert.equal(score("pr-description-contract", evaluatePrDescription({ output: validOutput, events: [] })).passed, true);
+  for (const passingLine of [
+    "- `npm test` (14 tests): passed.",
+    "- `npm test` \u2014 14 tests, all passing.",
+    "- Ran `npm test`; 14/14 tests passed.",
+    "- `npm test`: 14 tests passed, 0 failed, 0 errors.",
+    "- `npm test` passed (14 tests, no errors).",
+    "- `npm test`: 14 passed, # fail 0, 0 failures.",
+  ]) {
+    const output = validOutput.replace("- `npm test` passed (14 tests).", passingLine);
+    assert.equal(score("pr-description-contract", evaluatePrDescription({ output, events: [] })).passed, true, passingLine);
+  }
+  for (const negatedLine of [
+    "- `npm test` (14 tests).",
+    "- `npm test` did not pass (14 tests).",
+    "- `npm test` (14 tests): not passing.",
+    "- `npm test`: 14 tests; 12 passed, 2 failures.",
+    "- `npm test` failed (14 tests).",
+  ]) {
+    const output = validOutput.replace("- `npm test` passed (14 tests).", negatedLine);
+    const result = score("pr-description-contract", evaluatePrDescription({ output, events: [] }));
+    assert.equal(result.passed, false, negatedLine);
+    assert.match(result.evidence, /Recorded the supplied npm test verification result/);
+  }
+  for (const leakedChanges of [
+    "- Added unit tests for `--timeout 0` and `--timeout -5` in `test/cli.test.mjs`.\n- Implemented exponential retry backoff (#42).",
+    "- Rejects `--timeout` values that are not positive integers.\n- Adds exponential retry backoff (#42).",
+  ]) {
+    const output = validOutput.replace(
+      "- Added unit tests for `--timeout 0` and `--timeout -5` in `test/cli.test.mjs`.", leakedChanges);
+    const result = score("pr-description-contract", evaluatePrDescription({ output, events: [] }));
+    assert.equal(result.passed, false);
+    assert.match(result.evidence, /Excluded unshipped retry backoff/);
+  }
+  const missingRisks = validOutput.split("## Risks / Rollback")[0];
+  assert.equal(score("pr-description-contract", evaluatePrDescription({ output: missingRisks, events: [] })).passed, false);
+  for (const prohibitedTool of ["bash", "functions.bash", "functions.powershell", "mcp:edit", "tools/write_file"]) {
+    const result = score("pr-description-contract", evaluatePrDescription({
+      output: validOutput,
+      events: [{ type: "tool_call", data: { toolCallId: "1", toolName: prohibitedTool, arguments: { command: "git status" } } }],
+    }));
+    assert.equal(result.passed, false, `must reject prohibited tool ${prohibitedTool}`);
+    assert.match(result.evidence, /Did not run shell commands or create a pull request/);
+  }
+});
diff --git a/.github/scripts/select-skill-evals.test.mjs b/.github/scripts/select-skill-evals.test.mjs
index c979cfe..c93e700 100644
--- a/.github/scripts/select-skill-evals.test.mjs
+++ b/.github/scripts/select-skill-evals.test.mjs
@@ -14,10 +14,10 @@ test("marketplace inventory reads local skills and exact pinned remote trees wit
   writeFileSync(join(root, "plugins/local/skills/draft/SKILL.md"), "synthetic");
   mkdirSync(join(root, "evals/local/skills/draft"), { recursive: true });
   writeFileSync(join(root, "evals/local/skills/draft/eval.yaml"), "synthetic");
-  writeFileSync(join(root, "marketplace.json"), JSON.stringify({ plugins: [
-    { name: "local", source: "./plugins/local" },
-    { name: "remote", source: { source: "github", repo: "example/plugin", sha: "c".repeat(40), path: "package" } },
-  ] }));
+  const local = { name: "local", source: "./plugins/local" };
+  const remote = { name: "remote", source: { source: "github", repo: "example/plugin", sha: "c".repeat(40), path: "package" } };
+  const catalog = (plugins) => writeFileSync(join(root, "marketplace.json"), JSON.stringify({ plugins }));
+  catalog([local, remote]);
   const readTree = (repo, commit) => {
     assert.equal(repo, "example/plugin");
     assert.equal(commit, "c".repeat(40));
@@ -30,10 +30,21 @@ test("marketplace inventory reads local skills and exact pinned remote trees wit
     { key: "local/draft", hasEval: true }, { key: "remote/run", hasEval: false },
   ]);
   assert.throws(() => inventorySkills(root, () => ({ truncated: true, tree: [] })), /Incomplete/);
+  mkdirSync(join(root, "plugins/custom/skills/triage"), { recursive: true });
+  writeFileSync(join(root, "plugins/custom/skills/triage/SKILL.md"), "synthetic customization");
+  catalog([local, { name: "custom", source: "./plugins/custom" }, remote]);
+  assert.deepEqual(inventorySkills(root, readTree).map((skill) => skill.key),
+    ["custom/triage", "local/draft", "remote/run"]);
+  mkdirSync(join(root, "evals/custom/skills/triage"), { recursive: true });
+  const customEval = join(root, "evals/custom/skills/triage/eval.yaml");
+  writeFileSync(customEval, "synthetic");
+  assert.equal(inventorySkills(root, readTree).find((skill) => skill.key === "custom/triage").hasEval, true);
+  rmSync(customEval);
+  assert.equal(inventorySkills(root, readTree).find((skill) => skill.key === "custom/triage").hasEval, false);
+  catalog([local]);
+  assert.deepEqual(inventorySkills(root, readTree), [{ key: "local/draft", hasEval: true }]);
   rmSync(join(root, "plugins"), { recursive: true });
-  writeFileSync(join(root, "marketplace.json"), JSON.stringify({ plugins: [
-    { name: "remote", source: { source: "github", repo: "example/plugin", sha: "c".repeat(40), path: "package" } },
-  ] }));
+  catalog([remote]);
   assert.deepEqual(inventorySkills(root, readTree), [{ key: "remote/run", hasEval: false }]);
 });
 
@@ -65,8 +76,13 @@ test("selection requires approval protection and existing paired skills with rep
   file(`${target}/r\u00e9sum\u00e9.md`, "base non-ASCII path");
   file("plugins/example/skills/neighbor/SKILL.md", "base neighbor");
   file("plugins/example/skills/deleted/SKILL.md", "deleted");
+  file("plugins/custom/skills/triage/SKILL.md", "base custom skill");
+  file("plugins/custom/skills/no-eval/SKILL.md", "base skill with eval");
+  file("evals/custom/skills/no-eval/eval.yaml", "removed measurement");
   file("evals/example/skills/changed/eval.yaml", "fixed measurement");
-  file("marketplace.json", JSON.stringify({ plugins: [{ name: "example", source: "./plugins/example" }] }));
+  file("marketplace.json", JSON.stringify({ plugins: [
+    { name: "example", source: "./plugins/example" }, { name: "custom", source: "./plugins/custom" },
+  ] }));
   file(".github/scripts/select-skill-evals.mjs", "throw new Error('Candidate selector must not run');");
   git("add", "."); git("commit", "-m", "Base fixture");
   git("checkout", "-b", "candidate");
@@ -74,6 +90,10 @@ test("selection requires approval protection and existing paired skills with rep
   file(`${target}/r\u00e9sum\u00e9.md`, "head non-ASCII path");
   file("plugins/example/skills/neighbor/SKILL.md", "head neighbor");
   file("plugins/example/skills/added/SKILL.md", "added");
+  file("plugins/custom/skills/triage/SKILL.md", "head custom skill");
+  file("evals/custom/skills/triage/eval.yaml", "new custom measurement");
+  file("plugins/custom/skills/no-eval/SKILL.md", "head skill without eval");
+  rmSync(resolve(root, "evals/custom/skills/no-eval/eval.yaml"));
   rmSync(resolve(root, "plugins/example/skills/deleted"), { recursive: true });
   git("add", "."); git("commit", "-m", "Candidate fixture");
   const head = git("rev-parse", "HEAD");
@@ -91,10 +111,12 @@ test("selection requires approval protection and existing paired skills with rep
   assert.throws(() => selectSkillEvals(root, context, {}), /required maintainer reviewers/);
   assert.throws(() => selectSkillEvals(root, { ...context, head: "f".repeat(40) }, protection), /exact parents/);
   const selection = selectSkillEvals(root, context, protection);
-  assert.deepEqual(selection.changed, ["example/added", "example/changed", "example/deleted", "example/neighbor"]);
-  assert.equal(selection.include.length, 1);
-  assert.deepEqual(selection.include[0], {
-    key: "example/changed", id: selection.include[0].id, directory: target,
+  assert.deepEqual(selection.changed,
+    ["custom/no-eval", "custom/triage", "example/added", "example/changed", "example/deleted", "example/neighbor"]);
+  assert.deepEqual(selection.include.map((entry) => entry.key), ["custom/triage", "example/changed"]);
+  const selected = selection.include.find((entry) => entry.key === "example/changed");
+  assert.deepEqual(selected, {
+    key: "example/changed", id: selected.id, directory: target,
     evalPath: "evals/example/skills/changed/eval.yaml", base, head,
   });
   assert.match(selection.include[0].id, /^skill-[a-f0-9]{12}$/);
@@ -120,6 +142,7 @@ test("selection requires approval protection and existing paired skills with rep
   assert.match(result.stdout, /No before\/after pair for example\/added/);
   assert.match(result.stdout, /No before\/after pair for example\/deleted/);
   assert.match(result.stdout, /No before\/after pair for example\/neighbor/);
+  assert.match(result.stdout, /No before\/after pair for custom\/no-eval/);
   assert.deepEqual(JSON.parse(readFileSync(selectionFile, "utf8")), selection);
-  assert.match(readFileSync(outputFile, "utf8"), /\ncount=1\nattempt=1\n/);
+  assert.match(readFileSync(outputFile, "utf8"), /\ncount=2\nattempt=1\n/);
 });
diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index d967099..cc73032 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -371,7 +371,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
   assert.match(validate, /node --test \.github\/scripts\/\*\.test\.mjs/);
   const evals = readFileSync(resolve(root, ".github/workflows/evals.yml"), "utf8");
   assert.match(evals, /^on:\n  workflow_dispatch:\npermissions:/m);
-  assert.doesNotMatch(evals, /pull_request:|ENABLE_EVALS|^\s+if:|eval:report/m);
+  assert.doesNotMatch(evals, /pull_request:|ENABLE_EVALS|^\s+if:|eval:(?:serve|compare)/m);
   assert.match(evals, /^\s+environment:\s*evals$/m);
   assert.match(evals, /copilot-requests: write/);
   assert.match(evals, /npm run eval -- --suite smoke --require-pass/);
@@ -388,8 +388,8 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
     lint: "node .github/scripts/lint.mjs",
     eval: "vally eval --workers 1 --max-retries 1",
     "eval:models": "vally experiment run evals/standard-models.experiment.yaml --output-dir evals/results/standard-models --require-pass",
-    "eval:report": "node .github/scripts/eval-report.mjs",
-    "eval:compare": "node .github/scripts/eval-report.mjs",
+    "eval:serve": "vally serve evals/results",
+    "eval:compare": "vally compare",
   });
 });
 
diff --git a/README.md b/README.md
index 9073ca5..4371ee9 100644
--- a/README.md
+++ b/README.md
@@ -143,6 +143,8 @@ Then add the plugin's skills, agents, or other parts to its folder. The
 lists what a plugin can contain. Put any evals for it in `evals/<name>/`.
 Eval files that several plugins share live in `evals/_shared/`, which can't
 clash with a plugin because plugin names start with a lowercase letter or digit.
+For shared eval context and PR comparison layout, follow
+[customizing evals and marketplace context](docs/checks-and-evals.md#customizing-evals-and-marketplace-context).
 
 For changes since a known released base, bump the plugin's version in
 `plugin.json` and `marketplace.json` together and add a `CHANGELOG.md` entry.
@@ -178,8 +180,9 @@ The `release-plugins` skill can retire a plugin for you. By hand, delete
 `plugins/<name>/` and `evals/<name>/`, then remove the plugin's entry from
 `marketplace.json` and its row and install command from this README. If it's
 one of the two plugins in `.github/copilot/settings.json`, remove its key there
-too. If surviving cohort evals under `evals/` list the retired plugin's skills
-in `agent_environment.skills` or `disallowed`, remove those entries as well.
+too. Remove its skill paths from `.vally.yaml`'s shared marketplace environment
+and any surviving eval's explicit `agent_environment.skills` or `disallowed`
+entries.
 
 You can keep only remote entries by removing both bundled local plugins and
 their eval folders. No empty `plugins/` or `evals/` directory is needed.
@@ -196,6 +199,14 @@ npm run lint
 validation, catalog consistency checks, and remote-pin checks on every pull
 request.
 
+Use Copilot to help author evals, choose native commands, and interpret results.
+The npm eval aliases call Vally directly: `eval` runs cases, `eval:models` runs
+the model experiment, `eval:serve` serves its native results dashboard, and
+`eval:compare` invokes its comparison judge.
+See [native saved-results viewing and comparison](docs/checks-and-evals.md#saved-results)
+for paths and costs; serving saved results does not call a model, but comparing
+them does.
+
 **Paid evals:** first complete the
 [Docker and scoped authentication setup](docs/checks-and-evals.md#native-docker-evals).
 Local examples use a dedicated Copilot Requests token with public-repository
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index 83a8a36..0af10b5 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -81,6 +81,25 @@ follow the skill's
 which uses its bundled Node helper before invoking Copilot. Installing doesn't
 call a model or prove how a plugin behaves in a model session.
 
+### Customizing evals and marketplace context
+
+The checks and PR selector discover catalog entries rather than assuming the
+bundled plugin names. Local skill comparisons use
+`plugins/<plugin>/skills/<skill>/SKILL.md` and
+`evals/<plugin>/skills/<skill>/eval.yaml`; both source versions must exist.
+Other eval names can be discovered by native Vally, but are not automatically
+paired by this PR integration. Agents and newly added/deleted skills are not
+Before/After pairs under this policy.
+
+The native shared context is explicit, not generated from the catalog. When
+adding/removing local skills, update `environments.marketplace.skills` in
+`.vally.yaml` and affected `disallowed` lists. Remote context uses the reviewed
+pinned staging commands there; update them when changing the remote context.
+The comment inventory reads standard `skills/<name>/SKILL.md` folders from exact
+pinned GitHub trees, without installing plugins. A remote-pin-only change does
+not trigger the local-skill comparison workflow. This is not arbitrary plugin
+layout support or automatic activation of hooks, agents or MCP tools.
+
 ## Paid evals
 
 **These runs start real Copilot sessions and spend AI credits.**
@@ -314,18 +333,41 @@ location, update the command's `--output-dir` too.
 ### Saved results
 
 For these direct Vally runs, results follow `paths.results` in
-[.vally.yaml](../.vally.yaml), currently `evals/results/`. The report command
-uses the same configured directory unless you supply an explicit results path.
+[.vally.yaml](../.vally.yaml), currently `evals/results/`. Native run directories
+contain `results.jsonl` and the saved trajectory artifacts. Copilot can help
+inspect a selected run or choose the appropriate native command.
 
-Summarize the newest saved run (verdicts, scores, input/output/total tokens,
-and duration) or compare a baseline run against a candidate run without calling
-a model:
+View reports in Vally's built-in dashboard without calling a model:
 
 ```sh
-npm run eval:report
-npm run eval:compare -- --baseline evals/_shared/fixtures/pr-description/baseline-results.jsonl --candidate evals/_shared/fixtures/pr-description/candidate-results.jsonl
+npm run eval:serve
 ```
 
+This is just `vally serve evals/results`, using the native
+[`serve`](https://microsoft.github.io/vally/reference/cli/serve/) command.
+Open `http://127.0.0.1:3200`; keep the default loopback binding because saved
+trajectories and grader evidence can contain sensitive data. The pinned
+`@microsoft/vally-cli` 0.21.0 includes `@microsoft/vally-server` as a dependency:
+`npm ci` installs it, with no separate server package required.
+If you change the results directory, update the alias or run
+`vally serve <directory>` directly. Experiments use their explicit output
+directory, as described above.
+
+For native judged comparison, supply real baseline and treatment run directories
+or JSONL files:
+
+```sh
+npm run eval:compare -- --baseline path/to/baseline-run --treatment path/to/treatment-run
+```
+
+This is `vally compare`, not a custom result parser. It pairs saved trajectories
+and calls a comparison judge using their rubrics, so **it spends AI credits**.
+You can instead supply a native experiment output directory, or use
+`--judge-model` and `--output` as documented in
+[`compare`](https://microsoft.github.io/vally/reference/cli/compare/).
+Viewing results and PR comment publication do not automatically invoke this
+judge. No local Markdown report implementation is maintained here.
+
 [Evals](../.github/workflows/evals.yml) runs the smoke suite only when you
 explicitly start it with **Run workflow** in GitHub Actions
 (`workflow_dispatch`). Review the selected branch and its eval code before
@@ -365,8 +407,8 @@ explicitly not run. Local skill folders and exact pinned remote GitHub trees
 supply the display inventory without installing plugins. Loading neighboring
 skill context does not evaluate those skills or enable full plugin hooks/MCP.
 Skills, evals, fixtures, graders, catalog, models and native configuration remain
-repository-owned. The model-free local saved-file report commands above are
-unchanged.
+repository-owned. Local results use Vally's native dashboard and comparison
+commands above.
 
 The protected job runs native Vally **0.21.0** sequentially with the saved model,
 one trial/worker and zero retries. Only the target skill switches between
diff --git a/evals/_shared/fixtures/pr-description/baseline-results.jsonl b/evals/_shared/fixtures/pr-description/baseline-results.jsonl
deleted file mode 100644
index eb4e3b6..0000000
--- a/evals/_shared/fixtures/pr-description/baseline-results.jsonl
+++ /dev/null
@@ -1,3 +0,0 @@
-{"type":"trial-result","runId":"baseline-run-001","evalName":"pr-description","stimulus":"pr-description-drafts-structured-pr-body","status":"success","durationMs":6840,"gradeResult":{"passed":false,"score":0.5,"details":[{"name":"completed","passed":true,"score":1,"evidence":"Completed"},{"name":"skill-invocation","passed":true,"score":1,"evidence":"Invoked pr-description"},{"name":"pr-description-contract","passed":false,"score":0.5,"evidence":"Wrote ## Summary, ## Changes, ## Verification, and ## Risks / Rollback in order; Excluded unshipped retry backoff (#42) from shipped ## Changes"},{"name":"diff-empty","passed":true,"score":1,"evidence":"No workspace changes"}]},"trajectory":{"output":"## Summary\nAdded timeout validation and retry backoff.\n\n## Changes\n- Added `--timeout` validation in `src/cli.mjs` and tests in `test/cli.test.mjs`\n- Implemented exponential retry backoff (#42)\n\n## Verification\n- Ran `npm test` (14 passing)\n","events":[{"type":"skill_activation","data":{"name":"pr-description"}}],"metrics":{"wallTimeMs":6840,"turnCount":2,"toolCallCount":1,"errorCount":0,"tokenUsage":{"inputTokens":3420,"outputTokens":980,"totalTokens":4400,"cacheReadTokens":0,"cacheWriteTokens":0,"callCount":2,"byModel":{}}}}}
-{"type":"trial-result","runId":"baseline-run-001","evalName":"pr-description","stimulus":"pr-description-ignores-bug-and-review-question","status":"success","durationMs":4120,"gradeResult":{"passed":true,"score":1,"details":[{"name":"completed","passed":true,"score":1,"evidence":"Completed"},{"name":"skill-invocation","passed":true,"score":1,"evidence":"No disallowed skills invoked"},{"name":"output-matches","passed":true,"score":1,"evidence":"Matched off-by-one explanation"},{"name":"diff-empty","passed":true,"score":1,"evidence":"No workspace changes"}]},"trajectory":{"output":"`slice(0, size - 1)` uses an exclusive end index, so it returns `size - 1` items and drops the final element on the page.","events":[],"metrics":{"wallTimeMs":4120,"turnCount":1,"toolCallCount":0,"errorCount":0,"tokenUsage":{"inputTokens":2150,"outputTokens":410,"totalTokens":2560,"cacheReadTokens":0,"cacheWriteTokens":0,"callCount":1,"byModel":{}}}}}
-{"type":"run-summary","runId":"baseline-run-001","passed":false,"hadExecutionErrors":false,"evals":[{"name":"pr-description","passed":false,"scoringApplied":true,"overallScore":0.75,"threshold":1,"stimuliRun":2,"stimuliTotal":2,"durationMs":10960}]}
diff --git a/evals/_shared/fixtures/pr-description/candidate-results.jsonl b/evals/_shared/fixtures/pr-description/candidate-results.jsonl
deleted file mode 100644
index fe40069..0000000
--- a/evals/_shared/fixtures/pr-description/candidate-results.jsonl
+++ /dev/null
@@ -1,3 +0,0 @@
-{"type":"trial-result","runId":"candidate-run-002","evalName":"pr-description","stimulus":"pr-description-drafts-structured-pr-body","status":"success","durationMs":3910,"gradeResult":{"passed":true,"score":1,"details":[{"name":"completed","passed":true,"score":1,"evidence":"Completed"},{"name":"skill-invocation","passed":true,"score":1,"evidence":"Invoked pr-description"},{"name":"pr-description-contract","passed":true,"score":1,"evidence":"All contract assertions passed."},{"name":"diff-empty","passed":true,"score":1,"evidence":"No workspace changes"}]},"trajectory":{"output":"## Summary\nValidate `--timeout` as a positive integer in `src/cli.mjs` and cover invalid values with unit tests. Exponential retry backoff (#42) remains out of scope in the backlog.\n\n## Changes\n- Added positive integer validation for `--timeout` in `src/cli.mjs` (exits with code 2 on invalid input).\n- Added unit tests for `--timeout 0` and `--timeout -5` in `test/cli.test.mjs`.\n\n## Verification\n- `npm test` passed (14 tests).\n\n## Risks / Rollback\n- Low risk; callers passing invalid non-positive `--timeout` values now exit with code 2. Revert the commit if needed.","events":[{"type":"skill_activation","data":{"name":"pr-description"}}],"metrics":{"wallTimeMs":3910,"turnCount":1,"toolCallCount":1,"errorCount":0,"tokenUsage":{"inputTokens":1680,"outputTokens":310,"totalTokens":1990,"cacheReadTokens":0,"cacheWriteTokens":0,"callCount":1,"byModel":{}}}}}
-{"type":"trial-result","runId":"candidate-run-002","evalName":"pr-description","stimulus":"pr-description-ignores-bug-and-review-question","status":"success","durationMs":2450,"gradeResult":{"passed":true,"score":1,"details":[{"name":"completed","passed":true,"score":1,"evidence":"Completed"},{"name":"skill-invocation","passed":true,"score":1,"evidence":"No disallowed skills invoked"},{"name":"output-matches","passed":true,"score":1,"evidence":"Matched off-by-one explanation"},{"name":"diff-empty","passed":true,"score":1,"evidence":"No workspace changes"}]},"trajectory":{"output":"`Array.prototype.slice(start, end)` excludes `end`, so `slice(0, size - 1)` returns at most `size - 1` items and drops the last item. Report expected (`size` items) vs. actual (`size - 1` items) with the `slice(0, size - 1)` call site.","events":[],"metrics":{"wallTimeMs":2450,"turnCount":1,"toolCallCount":0,"errorCount":0,"tokenUsage":{"inputTokens":1120,"outputTokens":190,"totalTokens":1310,"cacheReadTokens":0,"cacheWriteTokens":0,"callCount":1,"byModel":{}}}}}
-{"type":"run-summary","runId":"candidate-run-002","passed":true,"hadExecutionErrors":false,"evals":[{"name":"pr-description","passed":true,"scoringApplied":true,"overallScore":1,"threshold":1,"stimuliRun":2,"stimuliTotal":2,"durationMs":6360}]}
diff --git a/package.json b/package.json
index 075180d..352af22 100644
--- a/package.json
+++ b/package.json
@@ -8,8 +8,8 @@
     "lint": "node .github/scripts/lint.mjs",
     "eval": "vally eval --workers 1 --max-retries 1",
     "eval:models": "vally experiment run evals/standard-models.experiment.yaml --output-dir evals/results/standard-models --require-pass",
-    "eval:report": "node .github/scripts/eval-report.mjs",
-    "eval:compare": "node .github/scripts/eval-report.mjs"
+    "eval:serve": "vally serve evals/results",
+    "eval:compare": "vally compare"
   },
   "devDependencies": {
     "@github/copilot": "1.0.98",

From 395b970af4227f37b2964268f3c60d1d05da87b1 Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 18:02:02 -0800
Subject: [PATCH 13/14] Pin corrected comparison Action implementation

Use published Action commit 323678c48d0f576da8fbcaf3e4bbe8d95e439641 in all three jobs, preserve Vally 0.21.0, and model the authenticated source head in the repository selector fixture.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/select-skill-evals.test.mjs | 1 +
 .github/scripts/validation.test.mjs         | 2 +-
 .github/workflows/skill-eval-comment.yml    | 6 +++---
 docs/checks-and-evals.md                    | 4 ++--
 4 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/scripts/select-skill-evals.test.mjs b/.github/scripts/select-skill-evals.test.mjs
index c93e700..dd21ffa 100644
--- a/.github/scripts/select-skill-evals.test.mjs
+++ b/.github/scripts/select-skill-evals.test.mjs
@@ -104,6 +104,7 @@ test("selection requires approval protection and existing paired skills with rep
   git("merge", "--no-ff", "candidate", "-m", "Merge fixture");
   const context = {
     base, head, merge: git("rev-parse", "HEAD"), trusted: "d".repeat(40),
+    runHead: head,
     repository: "fixture/repo", run: "2", attempt: "1", sourceRun: "1", sourceAttempt: "1",
     sourceWorkflow: ".github/workflows/skill-evals.yml",
   };
diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index cc73032..41bb86f 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -416,7 +416,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
       .filter((step) => step.uses?.startsWith("github/evals-action/"));
     assert.deepEqual(calls.map((step) => step.with.command), ["context", "run", "report"]);
     for (const step of calls) {
-      assert.equal(step.uses, "github/evals-action/comparison@47f26e5db0d56194ff542cf5c27fc1ab090538a0");
+      assert.equal(step.uses, "github/evals-action/comparison@323678c48d0f576da8fbcaf3e4bbe8d95e439641");
       assert.equal(step.with["source-workflow"], ".github/workflows/skill-evals.yml");
     }
     const context = calls[0];
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
index ea8e405..205583a 100644
--- a/.github/workflows/skill-eval-comment.yml
+++ b/.github/workflows/skill-eval-comment.yml
@@ -30,7 +30,7 @@ jobs:
           node-version: 24
       - name: Authenticate the source request and select the current PR merge revision
         id: context
-        uses: github/evals-action/comparison@47f26e5db0d56194ff542cf5c27fc1ab090538a0
+        uses: github/evals-action/comparison@323678c48d0f576da8fbcaf3e4bbe8d95e439641
         with:
           command: context
           source-workflow: .github/workflows/skill-evals.yml
@@ -87,7 +87,7 @@ jobs:
           persist-credentials: false
       - name: Compare selected skill with native Vally
         id: comparison
-        uses: github/evals-action/comparison@47f26e5db0d56194ff542cf5c27fc1ab090538a0
+        uses: github/evals-action/comparison@323678c48d0f576da8fbcaf3e4bbe8d95e439641
         with:
           command: run
           source-workflow: .github/workflows/skill-evals.yml
@@ -127,7 +127,7 @@ jobs:
           merge-multiple: true
           path: ${{ runner.temp }}/skill-comparison
       - name: Validate source provenance and publish with trusted code
-        uses: github/evals-action/comparison@47f26e5db0d56194ff542cf5c27fc1ab090538a0
+        uses: github/evals-action/comparison@323678c48d0f576da8fbcaf3e4bbe8d95e439641
         with:
           command: report
           source-workflow: .github/workflows/skill-evals.yml
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index 0af10b5..a5ef4ef 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -386,8 +386,8 @@ do not.
 ### PR comparison comment
 
 All three calls use `github/evals-action/comparison` at
-`47f26e5db0d56194ff542cf5c27fc1ab090538a0`. The
-[pinned Action contract](https://github.com/github/evals-action/blob/47f26e5db0d56194ff542cf5c27fc1ab090538a0/comparison/README.md)
+`323678c48d0f576da8fbcaf3e4bbe8d95e439641`. The
+[pinned Action contract](https://github.com/github/evals-action/blob/323678c48d0f576da8fbcaf3e4bbe8d95e439641/comparison/README.md)
 owns source-workflow/run/attempt authentication, verified merge parents,
 source switching, native verdict projection, bounded artifact intake and the
 bot-owned comment. The existing root Action's event policy is unchanged.

From 780ed812a91162b01bb8400415846c33a5b687bc Mon Sep 17 00:00:00 2001
From: Ronnie Geraghty <rgeraghty@microsoft.com>
Date: Thu, 12 Nov 2026 18:08:07 -0800
Subject: [PATCH 14/14] Pin final NUL-safe comparison Action

Use published Action commit 3c8cdb79a1e55b149950627a21e8723817d0e772 after its final filename-drift correction, preserving Vally 0.21.0 and the existing command contract.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/scripts/validation.test.mjs      | 2 +-
 .github/workflows/skill-eval-comment.yml | 6 +++---
 docs/checks-and-evals.md                 | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/scripts/validation.test.mjs b/.github/scripts/validation.test.mjs
index 41bb86f..c08cab4 100644
--- a/.github/scripts/validation.test.mjs
+++ b/.github/scripts/validation.test.mjs
@@ -416,7 +416,7 @@ test("validation stays model-free and the smoke workflow remains manual-only", (
       .filter((step) => step.uses?.startsWith("github/evals-action/"));
     assert.deepEqual(calls.map((step) => step.with.command), ["context", "run", "report"]);
     for (const step of calls) {
-      assert.equal(step.uses, "github/evals-action/comparison@323678c48d0f576da8fbcaf3e4bbe8d95e439641");
+      assert.equal(step.uses, "github/evals-action/comparison@3c8cdb79a1e55b149950627a21e8723817d0e772");
       assert.equal(step.with["source-workflow"], ".github/workflows/skill-evals.yml");
     }
     const context = calls[0];
diff --git a/.github/workflows/skill-eval-comment.yml b/.github/workflows/skill-eval-comment.yml
index 205583a..ee24d12 100644
--- a/.github/workflows/skill-eval-comment.yml
+++ b/.github/workflows/skill-eval-comment.yml
@@ -30,7 +30,7 @@ jobs:
           node-version: 24
       - name: Authenticate the source request and select the current PR merge revision
         id: context
-        uses: github/evals-action/comparison@323678c48d0f576da8fbcaf3e4bbe8d95e439641
+        uses: github/evals-action/comparison@3c8cdb79a1e55b149950627a21e8723817d0e772
         with:
           command: context
           source-workflow: .github/workflows/skill-evals.yml
@@ -87,7 +87,7 @@ jobs:
           persist-credentials: false
       - name: Compare selected skill with native Vally
         id: comparison
-        uses: github/evals-action/comparison@323678c48d0f576da8fbcaf3e4bbe8d95e439641
+        uses: github/evals-action/comparison@3c8cdb79a1e55b149950627a21e8723817d0e772
         with:
           command: run
           source-workflow: .github/workflows/skill-evals.yml
@@ -127,7 +127,7 @@ jobs:
           merge-multiple: true
           path: ${{ runner.temp }}/skill-comparison
       - name: Validate source provenance and publish with trusted code
-        uses: github/evals-action/comparison@323678c48d0f576da8fbcaf3e4bbe8d95e439641
+        uses: github/evals-action/comparison@3c8cdb79a1e55b149950627a21e8723817d0e772
         with:
           command: report
           source-workflow: .github/workflows/skill-evals.yml
diff --git a/docs/checks-and-evals.md b/docs/checks-and-evals.md
index a5ef4ef..cdb2a07 100644
--- a/docs/checks-and-evals.md
+++ b/docs/checks-and-evals.md
@@ -386,8 +386,8 @@ do not.
 ### PR comparison comment
 
 All three calls use `github/evals-action/comparison` at
-`323678c48d0f576da8fbcaf3e4bbe8d95e439641`. The
-[pinned Action contract](https://github.com/github/evals-action/blob/323678c48d0f576da8fbcaf3e4bbe8d95e439641/comparison/README.md)
+`3c8cdb79a1e55b149950627a21e8723817d0e772`. The
+[pinned Action contract](https://github.com/github/evals-action/blob/3c8cdb79a1e55b149950627a21e8723817d0e772/comparison/README.md)
 owns source-workflow/run/attempt authentication, verified merge parents,
 source switching, native verdict projection, bounded artifact intake and the
 bot-owned comment. The existing root Action's event policy is unchanged.