harden-issueslisted

# Harden issues Attack acceptance criteria before anyone builds to them. An issue whose criteria are wrong when written passes every gate — the implementer builds to the bad spec and both gates grade against that same bad spec. This pass is the early fix. Provenance and the incident record live in this directory's `decisions.md`; read it when changing this skill, not when running it. Two entry points, same pass: - **From an upstream issue-drafting pass, if the project has one** — runs on the drafted slices before the user quiz; the pass's questions join that quiz. - **Standalone, pre-batch** — runs over any set of `ready-for-agent` or `needs-harden` issue files before a `/run-issues` batch; questions come back as one numbered list. `needs-harden` is what a run sets when it finds criteria that are wrong or stale, so those issues return here rather than resting. ## Write authority — the one rule that matters The pass may edit an issue file **only where it can cite verification**: a file:line in current code, a query against real data, or a measured value. The same bar the run gates use. Everything else — and **every open fork** — becomes a numbered question for the human. The pass never settles a fork by choice. Any road-shaped statement it writes ("the rule is X", "the cause is Y") is a hypothesis unless its premise was tested. Untested → write it as a hypothesis with an explicit premise-check clause for the implementer, testing the premise itself, not a narrow q