TimothyVang · TimothyVang · May 14, 2026 · May 14, 2026 · May 14, 2026 · May 14, 2026
diff --git a/.devcontainer/README.md b/.devcontainer/README.md
@@ -18,8 +18,9 @@ or build directly with `docker build -f .devcontainer/Dockerfile .`.
 
 Every component is MIT, Apache-2.0, or BSD — passes CLAUDE.md §3.8.
 
-The 17 skills under `.claude/skills/` and the 6 MCPs in `.mcp.json` come
-along for free (they're just files in the repo + `npx`/`uvx` commands the
+The 18 skills under `.claude/skills/` and the MCPs across `.mcp*.json`
+(1 in the safe-default `.mcp.json`, 6 in `.mcp.cloud.json` / `.mcp.dual.json`)
+come along for free (they're just files in the repo + `npx`/`uvx` commands the
 container can run).
 
 ## What's NOT inside (by design)
@@ -42,7 +43,7 @@ The image carries **no secrets**. `devcontainer.json` uses `${localEnv:VAR}` ref
 |---|---|---|
 | `ANTHROPIC_API_KEY` | host shell or `.env` | preferred cloud credential; container env only — never written to disk inside the image |
 | `OPENROUTER_API_KEY` | host shell or `.env` | optional host-side AI-agent fallback; never passed into microsandboxes |
-| `GITHUB_TOKEN` | host shell | passed to the `github` MCP via `.mcp.json` (already env-var-ref only) |
+| `GITHUB_TOKEN` | host shell | passed to the `github` MCP via `.mcp.cloud.json` / `.mcp.dual.json` (env-var-ref only) |
 | `LANGFUSE_*` | host shell or `.env` | pointed at `host.docker.internal:3000` |
 | `SGLANG_*` | hard-coded to `host.docker.internal:{30000,30001}` | overrides the `.env` defaults of `localhost:*` so the container reaches the host |
 
@@ -113,7 +114,7 @@ openssl rand -base64 32 | gpg --symmetric --output ~/.verdict/key.gpg
 chmod 600 ~/.verdict/key.gpg
 ```
 
-After this, `verdict doctor` (when the CLI lands per `BUILD_PLAN.md` W6) will report green on whatever the host can actually provide.
+After this, `verdict doctor` will report green on whatever the host can actually provide.
 
 ## Rebuilding
 

diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 // VERDICT dev container — opens any host with Docker into a reproducible
-// toolchain (uv/Python 3.11, Node 20, pnpm, Rust 1.88) plus the 6 MCPs
-// from .mcp.json and the 19 skills under .claude/skills/. See README.md
+// toolchain (uv/Python 3.11, Node 20, pnpm, Rust 1.88) plus the MCPs across
+// .mcp*.json and the 18 skills under .claude/skills/. See README.md
 // in this folder for what is NOT in here (Microsandbox, SGLang) and why.
 {
     "name": "VERDICT dev",

diff --git a/CLAUDE.md b/CLAUDE.md
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -6,7 +6,7 @@ New-contributor setup guide. If you've already done the SANS Find Evil! 2026 tea
 **Default branch:** `main`
 **License:** MIT
 **Deadline gate:** 2026-06-15 22:45 CDT (team-internal target: 2026-06-14 EOD = ~28 h buffer)
-**Recommended platform:** SANS **SIFT Workstation VM** (canonical — all forensic tools, Microsandbox, SGLang, evidence mounts work out-of-box) **or** any modern **Linux box** (Ubuntu 22.04+ / Debian 12+ / Fedora 39+ / Arch). **macOS host is acceptable** for schema/planner/MCP/unit-test work that doesn't shell out to forensic tools — but the moment your task touches `verdict/sandboxes/`, `verdict/tools/vol3/`, or anything that runs in Microsandbox, switch into the SIFT VM. **Windows host is not supported** for development; use WSL2 + Ubuntu or pull the SIFT VM (it runs under Hyper-V / VMware / VirtualBox).
+**Recommended platform:** SANS **SIFT Workstation VM** (canonical — all forensic tools, Microsandbox, SGLang, evidence mounts work out-of-box) **or** any modern **Linux box** (Ubuntu 22.04+ / Debian 12+ / Fedora 39+ / Arch). **macOS host is acceptable** for schema/planner/MCP/unit-test work that doesn't shell out to forensic tools — but the moment your task touches `src/verdict/sandboxes/`, `src/verdict/tools/`, or anything that runs in Microsandbox, switch into the SIFT VM. **Windows host is not supported** for development; use WSL2 + Ubuntu or pull the SIFT VM (it runs under Hyper-V / VMware / VirtualBox).
 
 Authority chain when docs disagree: Devpost rules → `DEVPOST_COMPLIANCE.md` → `ARCHITECTURE.md` → `BUILD_PLAN.md` → this file. Code + lockfiles win over docs (per `CLAUDE.md`); update the doc, don't roll back the code, unless the code is wrong.
 
@@ -16,7 +16,7 @@ Authority chain when docs disagree: Devpost rules → `DEVPOST_COMPLIANCE.md`
 >
 > The minimum sweep:
 >
-> - Did you add/rename/remove a file under `verdict/`? Grep `docs/` + `CLAUDE.md` + `README.md` for the old path; update every reference.
+> - Did you add/rename/remove a file under `src/verdict/`? Grep `docs/` + `CLAUDE.md` + `README.md` for the old path; update every reference.
 > - Did you add/change/remove a CLI command, flag, or env var? Update `CLAUDE.md` §10 and `README.md` "CLI surface".
 > - Did you add/change/remove a schema field, validator, enum member, or playbook rule? Update `docs/ARCHITECTURE.md` §4 and any `CLAUDE.md` §3.x rule that cites it.
 > - Did you add/remove a dependency, change a version pin, or vendor a skill/MCP? Update `CONTRIBUTING.md` §2 toolchain table + `docs/RELEASE.md` (deps) or `docs/SKILLS_FRAMEWORK.md` / `docs/MCP_FRAMEWORK.md` + license audit (vendored).
@@ -118,13 +118,13 @@ Idempotent. Installs uv + Python 3.11, Rust 1.88, Node 20 + pnpm, and Microsandb
 
 **Where to develop.** Three supported configurations, in order of preference:
 
-1. **Inside the SIFT VM** (canonical, recommended for everyone). All forensic tools, Microsandbox, SGLang, and the evidence mounts resolve here without setup. **Required** for any work touching the executor branches, the Microsandbox layer, evidence I/O, or anything under `verdict/sandboxes/`, `verdict/tools/vol3/`, or `services/mcp/src/tools/`. Pull the OVA from `downloads/README.md`; snapshot it as `clean-install` before installing anything.
+1. **Inside the SIFT VM** (canonical, recommended for everyone). All forensic tools, Microsandbox, SGLang, and the evidence mounts resolve here without setup. **Required** for any work touching the executor branches, the Microsandbox layer, evidence I/O, or anything under `src/verdict/sandboxes/` or `src/verdict/tools/`. Pull the OVA from `downloads/README.md`; snapshot it as `clean-install` before installing anything.
 2. **A modern Linux box** (Ubuntu 22.04+ / Debian 12+ / Fedora 39+ / Arch). Acceptable for the full stack as long as you can install Microsandbox (Linux-only) and run the SIFT toolchain (`apt install sleuthkit volatility ...`). Faster I/O than the VM. Take a `pre-verdict` snapshot of your home before installing forensic tools — they leave state.
 3. **macOS host with the SIFT VM as a runtime target** (faster edit loop, smaller surface). Use VS Code Remote-SSH or `Develop on a Container` into the VM. Acceptable for schema, planner, MCP gateway, and unit-test work that doesn't shell out to forensic tools or Microsandbox. The moment your task touches a Microsandbox path or a forensic CLI, switch into the VM.
 
 **Windows host is not supported** for development. Either use WSL2 + Ubuntu (treat as configuration #2) or run the SIFT VM under Hyper-V / VMware / VirtualBox (configuration #1). Native Windows breaks Microsandbox (libkrun is Linux-only), pre-commit hooks (path/exec semantics), and several SIFT tools.
 
-If your work touches `services/mcp/src/tools/`, `services/agent_mcp/`, or anything under a Microsandbox path, you **must** run integration tests inside the SIFT VM (or your Linux box with Microsandbox installed) before opening a PR. macOS-only test runs do not satisfy the gate.
+If your work touches `src/verdict/tools/`, `src/verdict/sandboxes/`, or anything under a Microsandbox path, you **must** run integration tests inside the SIFT VM (or your Linux box with Microsandbox installed) before opening a PR. macOS-only test runs do not satisfy the gate.
 
 ---
 
@@ -173,8 +173,8 @@ test -f pnpm-lock.yaml && pnpm install --frozen-lockfile
 Sanity check:
 ```bash
 uv run pytest -q             # must pass on a clean clone — if it doesn't, that's a P0
-cargo test --workspace -q
-pnpm test
+test -f Cargo.toml && cargo test --workspace -q
+test -f pnpm-lock.yaml && pnpm test
 ```
 
 If the workspace files don't exist yet (we're early in Week 1), clone is enough — the scaffold lands per `BUILD_PLAN.md` Phase W1.A.
@@ -188,7 +188,7 @@ If the workspace files don't exist yet (we're early in Week 1), clone is enough
 This section is contributor-specific workflow on top of those rules.
 
 ### Branches
-Format: `<type>/<task-id>-<slug>` — e.g. `feat/W1-B-1-artifact-class-enum`. Branch from `main`, rebase before PR, squash on merge only if the branch was a single logical task. Otherwise preserve the TDD red→green commits — they're the audit trail.
+Format: `<type>/<task-id>-<slug>` — e.g. `feat/W1.B.1-artifact-class-enum`. Branch from `main`, rebase before PR, squash on merge only if the branch was a single logical task. Otherwise preserve the TDD red→green commits — they're the audit trail.
 
 ### Commit + push: use `/qc`
 
@@ -204,7 +204,7 @@ gh pr create \
   --draft \
   --title "feat(scope): summary [W1.B.1]" \
   --body "$(cat <<'EOF'
-**Task:** [docs/BUILD_PLAN.md W1.B.1](../blob/main/docs/BUILD_PLAN.md)
+**Task:** [docs/BUILD_PLAN.md W1.B.1](docs/BUILD_PLAN.md)
 **Mode(s):** all   <!-- cloud / airgap / dual / all -->
 **Test evidence:**
 \`\`\`
@@ -234,7 +234,7 @@ Concretely, when a verified fact lands:
 | Dependency added, removed, or version pinned | this `CONTRIBUTING.md` §2 + `docs/RELEASE.md` |
 | LangGraph node added / removed / renamed | `docs/ARCHITECTURE.md` §2 + `docs/BUILD_PLAN.md` task body |
 | Verifier strategy semantics changed | `docs/ARCHITECTURE.md` §1 + `CLAUDE.md` §8 |
-| Caveat list changed | `CLAUDE.md` §3.3 + `docs/TLDR.md` (if cited) + `verdict/prompts/examiner_caveats.md` |
+| Caveat list changed | `CLAUDE.md` §3.3 + `docs/TLDR.md` (if cited) + `src/verdict/planning/prompts/examiner_caveats.md` |
 | New skill or MCP vendored | `docs/SKILLS_FRAMEWORK.md` (skills) or `docs/MCP_FRAMEWORK.md` (MCPs) + audit log |
 | Audit-history correction (research contradicts a frozen `spec/` claim) | log in `docs/DOCS_ACCURACY_REPORT.md`. Do **not** edit `spec/`. |
 
@@ -260,7 +260,7 @@ claude         # interactive Claude Code session if you're on cloud/dual mode
 
 Air-gap operators: ask PUG for the bridged + Tesla-mode entry point.
 
-Expected output: structured Findings citing tool-call IDs, a quorum verdict, an HMAC-signed ledger entry, and a Langfuse trace (if Langfuse is up — see `ARCHITECTURE.md` §Observability).
+Expected output: structured Findings citing tool-call IDs, a quorum verdict, an HMAC-signed ledger entry, and a Langfuse trace (if Langfuse is up — see `ARCHITECTURE.md` §5).
 
 If the run fails before producing a Finding, you have a P0 environment problem. Post the trace ID + `verdict doctor` output in team chat before opening a code PR.
 
@@ -271,7 +271,7 @@ If the run fails before producing a Finding, you have a P0 environment problem.
 Authority order (escalate left-to-right):
 
 1. **NotebookLM Q&A:** https://notebooklm.google.com/notebook/f0957a60-6fb2-452b-93d4-ecd73ba47779?authuser=1 — chief location for "how does X work?"
-2. **`docs/` and the audit history in `archive/`** — most "why did we choose X?" questions are answered in `archive/03-audit-v4.5.md`.
+2. **`docs/` and the audit history in `docs/spec/`** — most "why did we choose X?" questions are answered in `docs/spec/03-audit-v4.5.md`.
 3. **Team chat** — PUG / Beaver / Haley / KP. Use the appropriate thread; don't DM PUG for things the team should see.
 4. **Devpost platform issues only:** https://help.devpost.com/
 

diff --git a/README.md b/README.md
@@ -41,7 +41,7 @@ Source code lives under `src/verdict/`. The outer `Verdict/` directory is the re
    │  1. Plans the investigation   │   "Where would evil hide?"
    │  2. Runs forensic tools       │   vol3, hayabusa, plaso, MFTECmd...
    │  3. Two models cross-check    │   Qwen3 vs GLM-4.5-Air
-   │  4. Quorum decides verdict    │   VERIFIED / CONTESTED / UNVERIFIABLE
+   │  4. Quorum decides verdict    │   VETTED_* / CONTESTED / UNVERIFIABLE
    │  5. HMAC-signs the audit log  │   Tamper-evident chain
    └───────────────────────────────┘
                  │
@@ -103,7 +103,7 @@ Roles: Tim (infra, ledger, ops), Beaver (orchestration, verifiers), Haley (infer
        │  ⓶ Hunt Evil masquerade (scvhost.exe parent=cmd.exe)
        │  ⓷ Amcache caveat acknowledged in rationale
        │  ⓸ Pivot in action (1 pivot, 0 replans)
-       │  ⓹ Disagreement → CONTESTED → replan → VERIFIED ★ (Devpost-required self-correction)
+       │  ⓹ Disagreement → CONTESTED → replan → VETTED_AIRGAP ★ (Devpost-required self-correction)
        │  ⓺ TSI tcpdump proof (key never enters VM)
        │  ⓻ Kill -9 + verdict resume
 3:00 ─┤ DUAL MODE (60s) — three-way verification → VETTED_DUAL
@@ -116,7 +116,7 @@ Roles: Tim (infra, ledger, ops), Beaver (orchestration, verifiers), Haley (infer
 ## Mapped to the 6 Devpost judging criteria
 
 1. **Autonomous Execution Quality** *(tiebreaker)* — Mode-aware verifier strategy. Plan-then-Execute with planner_critique CoVe + comprehension_gate + pivot vs replan + unverifiable_finalize. Self-correction via cross-engine quorum.
-2. **IR Accuracy** — Artifact-pair rule, Tier-1 caveats, MITRE sub-techniques, VETTED_CLOUD vs VERIFIED honesty, Hunt Evil masquerade, DKOM auto-detection. Five Inspect AI scorers per mode.
+2. **IR Accuracy** — Artifact-pair rule, Tier-1 caveats, MITRE sub-techniques, honest VETTED_CLOUD framing (same-model self-consistency ≠ true cross-family verification), Hunt Evil masquerade, DKOM auto-detection. Five Inspect AI scorers per mode.
 3. **Breadth and Depth of Analysis** — "Depth on fewer types beats shallow coverage of many" — Devpost rubric line we lean on directly. Windows-DFIR-depth-first; v2 extension points named (5th `net_executor` + `live_executor` branches).
 4. **Constraint Implementation** — Three-layer immutability (PreToolUse + DenyRule + microsandbox kernel mount). HMAC ledger. TSI. Mode lock at case_init. **Architectural, not prompt.**
 5. **Audit Trail Quality** — HMAC ledger ↔ Langfuse bidirectional. Three-tier ID hierarchy. Per-output-file SHA-256. Examination-environment metadata (NIST SP 800-86).
@@ -130,7 +130,7 @@ Roles: Tim (infra, ledger, ops), Beaver (orchestration, verifiers), Haley (infer
 
 ```
 RISK #1 — Microsandbox hits a blocker week 4+
-  Likelihood: MEDIUM (pre-1.0; latest 0.1.x).  Impact: HIGH (kills TSI hero shot).
+  Likelihood: MEDIUM (pre-1.0; pinned 0.4.x line).  Impact: HIGH (kills TSI hero shot).
   Mitigation: Test it HARD in week 2, not week 4.
 
 RISK #2 — Case 001 doesn't disagree by end of week 4
@@ -213,7 +213,7 @@ Follow [`CONTRIBUTING.md`](CONTRIBUTING.md) Step 0–7 for the full human-at-key
 ### CLI surface (one-liner)
 
 ```
-verdict {doctor, mode, init, resume, reverify, status, ls, show, export, validate, approve, gc, health}
+verdict {doctor, mode, init, run-tool, run-case, resume, reverify, status, ls, show, export, validate, approve, gc, package-check, health}
 ```
 
 `verdict reverify <case_id> --mode <cloud|airgap|dual>` re-runs verification under a new mode and writes a *parallel* verdict chain — the original ledger is never mutated. Full CLI reference in `CLAUDE.md` §10.2; flag spec in `docs/BUILD_PLAN.md` W3.C.2.