chore: reconcile skills + scenario-traces + casus leak-guard

[humanintheloop25]

Wat

Voegt de uiteengelopen user-level en engine-repo kopieën van de regelrecht-skills samen tot één canonieke set, en borgt dat er geen trajectinformatie naar deze publieke repo lekt.

Waarom

De skills bestonden in twee kopieën (~/.claude/skills/ en .claude/skills/ hier) die uit elkaar waren gelopen. Per-bestand gereconcilieerd:

• stelselanalyse / dossier / audit-products: de engine-versies waren inhoudelijk vooruit (Step 0 drift-check, source-refs integriteitsscan, striktere private-repo-guard, "Bewijs-poort"). De scenario-traces-kruisverwijzingen die alléén user-level bestonden zijn erin geport.
• Onderweg bleek elk user-level bestand een stray </content>-artefact te bevatten; de engine-versies zijn schoon.

Wijzigingen

• ➕ regelrecht-scenario-traces als nieuwe, dossier-agnostische skill (9 bestanden).
• ✏️ scenario-traces-verwijzingen geport in stelselanalyse (SKILL.md, engine-tests.md), dossier (SKILL.md, routing.md), audit-products (testcase-scenarios.md).
• 🔒 script/check-skills-no-casus.sh + pre-commit hook skills-no-casus: blokkeert casus-specifieke inhoud (HHNK / Noorderkwartier / WS[0-9]{4} / corpus-repo-namen) in .claude/skills/. Fictieve test-BSN's (9999-reeks) bewust niet gevangen.

Verificatie

• script/check-skills-no-casus.sh → casus-vrij ✅

🤖 Generated with Claude Code

[claude]

Cross-law integrity gate + leak-guard — review

Security & correctness

🟠 Significant — check-skills-no-casus.sh: fixed /tmp path is a race condition

if grep -rEnI "$PATTERN" "$SKILLS" > /tmp/skills_casus_leak 2>/dev/null; then
    sed "s#${ROOT}/##" /tmp/skills_casus_leak >&2
    ...
    rm -f /tmp/skills_casus_leak

/tmp/skills_casus_leak is a shared path. Two concurrent jobs on the same GitHub-hosted runner pool can race: job B's grep overwrites job A's file mid-flight, causing either a garbled error message or a false-pass (rm between write and read). Use $(mktemp):

LEAKFILE=$(mktemp)
if grep -rEnI "$PATTERN" "$SKILLS" > "$LEAKFILE" 2>/dev/null; then
    ...
    rm -f "$LEAKFILE"
    exit 1
fi
rm -f "$LEAKFILE"

---

🟠 Significant — PLAIN_MARKERS in cross-law-integriteit.py contradicts law-generate/SKILL.md

law-generate/SKILL.md (new section, this PR) lists three forbidden plain-param markers:

"conceptueel", "forward naar", or "tijdelijk als directe parameter"

cross-law-integriteit.py explicitly excludes the middle one:

# Note: do NOT include generic words like "forward naar" — those legitimately
# describe leaf parameters that FEED a binding's parameters-mapping
PLAIN_MARKERS = ('conceptueel', 'tijdelijk als directe parameter')

A description containing "forward naar [andere regeling] output Y" without a source: block silently passes the CI gate but violates the skill's stated rule. The Python comment's rationale is reasonable — "forward naar" can appear in legitimate parameter descriptions — but the skill text doesn't reflect this distinction. One of the two must be updated: either remove "forward naar" from the SKILL.md's forbidden list, or add a note that it's deliberately excluded from the automated gate with the reason.

---

Minor

🟡 cross-law-integriteit.py — unclosed file handle and implicit encoding

doc = yaml.safe_load(open(path))

open() is never closed; on a large corpus this can exhaust file descriptors under concurrent processes. The broad except Exception: continue silently swallows encoding errors too — a law file with a platform-encoding mismatch is silently skipped rather than flagged. Use:

with open(path, encoding='utf-8') as f:
    doc = yaml.safe_load(f)

---

🟡 CI: pip install pyyaml unpinned

An uncontrolled pyyaml upgrade (including a future major release) could silently change YAML parsing behaviour or break the script. Pin to a tested range, e.g. pip install "pyyaml>=6.0,<7", or use a requirements-ci.txt file.

---

🟡 check-skills-no-casus.sh: comment says "Woordgrenzen" but pattern has no \b

# Casus-markers (uitbreidbaar). Woordgrenzen waar een losse term anders zou matchen.
PATTERN='HHNK|Hollands Noorderkwartier|Noorderkwartier|regelrecht-corpus-(HHNK|BES)|WS[0-9]{4}'

The comment implies word-boundary anchors, but the grep pattern has none. WS[0-9]{4} would match inside longer tokens (e.g. AWS1234). Either add \b anchors around the relevant terms or drop the misleading comment. Low practical risk in this directory, but the comment is incorrect.

---

Not flagged

The changes.outputs.ci guard on the new cross-law-integrity job is fine — corpus/regulation/** is in the ci filter, so corpus-only PRs will trigger the gate.

The doc comment added to coverage_score in models.rs is clear and accurate.

[github-actions]

Preview Deployment — harvester-admin

Your changes have been deployed to a preview environment:

URL: https://harvester-admin.pr785.rig.prd1.gn2.quattro.rijksapps.nl

This deployment will be automatically cleaned up when the PR is closed.

[github-actions]

Preview Deployment — harvester-worker

Your changes have been deployed to a preview environment:

URL: https://harvester-worker-pr785-regel-k4c.rig.prd1.gn2.quattro.rijksapps.nl

This deployment will be automatically cleaned up when the PR is closed.

[github-actions]

Preview Deployment — enrichworker

Your changes have been deployed to a preview environment:

URL: https://enrichworker-pr785-regel-k4c.rig.prd1.gn2.quattro.rijksapps.nl

This deployment will be automatically cleaned up when the PR is closed.