docs(openspec): tighten runtime-rule specs per Copilot review

Address the remaining #49 review comments (items 1-4, 6-7):

- cli-check: the degrade --json scenario now allows the additive `skipped`
  array (not 'only { success, results }'); --dangerously-run-scripts is
  described as 'without server validation' rather than 'trusting local
  signatures' (which the reconciliation spec forbids as an auth mechanism).
- cli-rule-reconciliation: rename the requirement heading to 'Reconcile reports
  every runtime rule's check.ts' (RENAMED op) so the title matches the scoped
  body instead of the old 'every held rule file'.
- cli-runtime-rule-execution: clarify that match mode is read per capture rule
  (rules may mix modes); state that a broad path-only match carries line/column
  = 1 and empty text/captures.
- design: note the generator path lives in the internal taskless/taskless repo,
  not this one.

(Item 5 — the 'exactly as before' wording — is left as-is by decision.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: thecodedrift

openspec/changes/archive/2026-07-03-runtime-rule-execution/design.md

@@ -66,8 +66,9 @@ mode, and never parses rule intent beyond this metadata envelope and the ast-gre
 already understands. `.taskless/runtime-rule-tests/<name>/` holds `valid/`/`invalid/` fixtures
 and is not executed by `check`.
 
-This layout is confirmed against the generator
-(`workers/generator/src/actions/add-runtime-rule.ts`), which writes
+This layout is confirmed against the Taskless internal generator — in the sibling
+`taskless/taskless` repo, not this one — at `workers/generator/src/actions/add-runtime-rule.ts`,
+which writes
 `.taskless/runtime-rules/<slug>-<suffix>/` with `<capture-name>.yml` per capture rule and a
 `check.ts`, and hashes `check.ts` with the same `canonicalHash` envelope reconcile uses.
 

openspec/changes/archive/2026-07-03-runtime-rule-execution/specs/cli-check/spec.md

@@ -72,7 +72,7 @@ did not run.
 ### Requirement: Check accepts --dangerously-run-scripts to run runtime rules without server validation
 
 `taskless check` SHALL accept a `--dangerously-run-scripts` flag that runs **all** runtime
-rules by trusting their local signatures without server validation, regardless of auth state.
+rules without server validation, regardless of auth state.
 When the flag is set the CLI SHALL NOT reconcile — it SHALL skip the network entirely (matching
 how `--anonymous` forces the no-network path) and execute every present runtime rule. The CLI
 SHALL emit a prominent warning that runtime rule code is being executed unverified. The flag
@@ -163,7 +163,7 @@ non-zero code solely because reconciliation failed, and the warning SHALL be sup
 #### Scenario: Degrade warning is suppressed under --json
 
 - **WHEN** the CLI degrades and `--json` is set
-- **THEN** stdout SHALL contain only the existing `{ success, results }` JSON shape
+- **THEN** stdout SHALL contain the machine JSON shape (`{ success, results }` plus the additive optional `skipped` array for the skipped runtime rules)
 - **AND** SHALL NOT contain the human-readable degrade warning
 
 ## REMOVED Requirements

openspec/changes/archive/2026-07-03-runtime-rule-execution/specs/cli-rule-reconciliation/spec.md

@@ -1,6 +1,11 @@
+## RENAMED Requirements
+
+- FROM: `### Requirement: Reconcile reports every held rule file`
+- TO: `### Requirement: Reconcile reports every runtime rule's check.ts`
+
 ## MODIFIED Requirements
 
-### Requirement: Reconcile reports every held rule file
+### Requirement: Reconcile reports every runtime rule's check.ts
 
 Reconciliation SHALL be scoped to the **`check.ts` of runtime rules** — the only artifact that
 carries arbitrary code execution. Static ast-grep rules and runtime-rule capture `*.yml` are

openspec/changes/archive/2026-07-03-runtime-rule-execution/specs/cli-runtime-rule-execution/spec.md

@@ -5,8 +5,10 @@
 The CLI SHALL recognize a **runtime rule** as a directory under `.taskless/runtime-rules/<name>/`
 containing one or more ast-grep capture `*.yml` (one per capture rule) and a single `check.ts`,
 its capture rules declaring `metadata.taskless.kind: runtime`. The rule's check file SHALL be
-the `check.ts` in the rule directory. The CLI SHALL read `metadata.taskless.match` (`anchor` or
-`broad`) to select the ast-grep invocation mode. Rule files under `.taskless/rules/` SHALL
+the `check.ts` in the rule directory. The CLI SHALL read **each capture rule's**
+`metadata.taskless.match` (`anchor` or `broad`) to select that capture rule's ast-grep
+invocation mode; capture rules within one runtime rule MAY mix modes (each is independent).
+Rule files under `.taskless/rules/` SHALL
 continue to be treated as static ast-grep rules, not runtime rules.
 `.taskless/runtime-rule-tests/<name>/` holds `valid/` and `invalid/` verification fixtures and
 SHALL NOT be executed by `check`.
@@ -47,7 +49,9 @@ The CLI SHALL normalize every narrow match to
 `{ rule, ruleId, file, line, column, text, captures }`, where `file` is root-relative, `line`
 is 1-indexed, and `rule` is the capture rule's stable model-assigned `name`. The CLI SHALL map
 the hashed capture-rule `id` used by the scan back to that `name` so `match.rule` is the value
-the check branches on, never the hash.
+the check branches on, never the hash. A `broad` (path-only, `--files-with-matches`) match
+carries no location or captures: its `line` and `column` SHALL be `1`, and its `text` and
+`captures` SHALL be empty.
 
 #### Scenario: Hashed id maps to model name