From 4a791e2684b7d81f529f30ef562dbc87073f28d5 Mon Sep 17 00:00:00 2001
From: Isaac Thor <codethor@gmail.com>
Date: Wed, 22 Apr 2026 21:28:41 -0500
Subject: [PATCH 1/6] docs: add XT-2 live Docker + execution master prompt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- EXTREME-TEST-MASTER-PROMPT-XT2.md: hard truths, anti-summary rules, GATE 0
  docker, matrix A–E, report format, relationship to v11/XT-1
- Link from TESTING-DOCTRINE, XT-1, README Development

Made-with: Cursor
---
 README.md                              |  2 +-
 docs/EXTREME-TEST-MASTER-PROMPT-XT2.md | 99 ++++++++++++++++++++++++++
 docs/EXTREME-TEST-MASTER-PROMPT.md     |  1 +
 docs/TESTING-DOCTRINE.md               |  2 +-
 4 files changed, 102 insertions(+), 2 deletions(-)
 create mode 100644 docs/EXTREME-TEST-MASTER-PROMPT-XT2.md

diff --git a/README.md b/README.md
index 9cbb968..24ade41 100644
--- a/README.md
+++ b/README.md
@@ -177,7 +177,7 @@ DOCKERCOMMS_IT_GHCR_REPO=ghcr.io/user/repo DOCKERCOMMS_IT_RECIPIENT=alice@exampl
 
 ## Development
 
-- [docs/TESTING-DOCTRINE.md](docs/TESTING-DOCTRINE.md) and [docs/EXTREME-TEST-MASTER-PROMPT.md](docs/EXTREME-TEST-MASTER-PROMPT.md): how we test, and the extreme E2E (XT-1) agent prompt (adversarial QA; pair with the release/GA runbook, not a substitute for it)
+- [docs/TESTING-DOCTRINE.md](docs/TESTING-DOCTRINE.md), [docs/EXTREME-TEST-MASTER-PROMPT.md](docs/EXTREME-TEST-MASTER-PROMPT.md) (XT-1), and [docs/EXTREME-TEST-MASTER-PROMPT-XT2.md](docs/EXTREME-TEST-MASTER-PROMPT-XT2.md) (XT-2): testing principles, adversarial plan, and live-Docker execution + anti-summary runs (use the release/GA runbook for closure, not a substitute)
 - SPEC.md: protocol specification
 - ARCH.md: implementation architecture
 - RELEASE_CHECKLIST.md: stop-ship gates
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
new file mode 100644
index 0000000..e530ed1
--- /dev/null
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
@@ -0,0 +1,99 @@
+# Master prompt: XT-2 — Live Docker + full-matrix execution
+
+**Version: XT-2** — next step after [XT-1](EXTREME-TEST-MASTER-PROMPT.md). **Does not** supersede [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11) for GA/closure; **does** add Docker-first live runs and **anti-summary** rules. Use [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) for principles.
+
+---
+
+## Hard truths (keep the prompt honest)
+
+- **“Absolutely no bugs”** is not something any agent or test suite can prove; the strongest defensible claim is **no known failures in the matrix you actually ran**, with logs.
+- **Cursor** can only use Docker if the environment exposes it (Docker Desktop, Linux daemon, or Dev Containers with the socket). The prompt must **fail closed** when Docker is missing.
+- **“Do everything in Docker”** can still need a **host** step (e.g. `docker-e2e` gates may produce a **Linux** binary; **macOS** may need `make clean && make build` for a **Mach-O** host run — see the runbook and this document’s **GATE 0** / **C** / **D** flow).
+
+---
+
+## Relationship to other prompts
+
+| Prompt / doc | Role |
+|--------------|------|
+| **v11** / [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) | GA, §A/§B, NOT RUN — **releases** |
+| [EXTREME-TEST-MASTER-PROMPT.md](EXTREME-TEST-MASTER-PROMPT.md) (XT-1) | Full adversarial plan |
+| **XT-2** (this file) | **Execution** + **Docker-first** + **anti-summary** (first output = shell + real command + real output) |
+| [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) | Oracle, pyramid, repro bar, bash for NEG |
+
+**“Open Docker in Cursor”** = your machine’s Docker Desktop (or a Dev Container with the Docker socket). The agent runs `docker` in the **terminal**; there is no separate “Cursor-only Docker” unless you configure Dev Containers or a remote. XT-2 expects the same `docker` CLI as a normal shell.
+
+---
+
+## Paste block (for Cursor) — everything in the fence
+
+```
+MASTER PROMPT: dockercomms — XT-2 “Live Docker + execution evidence” (not a GA/closure runbook)
+Use with: local clone of `codethor0/dockercomms`. Read `docs/TESTING-DOCTRINE.md`, `docs/EXTREME-TEST-MASTER-PROMPT.md` (XT-1), and `docs/RELEASE-RUNBOOK.md` (v11) first. XT-2 **adds** Docker-first live runs and **anti-summary** rules. It does **not** replace **GA/§A/§B** evidence — use the runbook for that.
+MISSION
+Run **real** commands, **real** Docker, **real** local registry, and (if creds exist) **real** GHCR paths. **Maximize** evidence; **minimize** narrative. Goal: **zero unexpected product failures** in the **defined matrix** for this SHA, not a proof of “no bugs in the universe.”
+ANTI-SUMMARY RULE (HARD)
+- The first 20 lines of your output **must** be: **shell header** (UTC, path, SHA, Docker status) + **the first command you ran** + **its output** (or exit + one-line error).  
+- **Forbidden** as an opening: long plans, “here’s what I would do,” or executive summary **before** any command output.  
+- After each phase, **at most 3** sentences of interpretation; then **next** commands.  
+- If you cannot run a step, **one line** `BLOCKED: {reason}` and move on — do not pad.
+DOCKER AVAILABILITY (GATE 0)
+1. `docker info` (or `docker version`) — if **fails**, state **BLOCKED: Docker not available in this environment** and run **only** host `go test` + static checks; **do not** claim “full XT-2” complete.  
+2. If **OK**, one line: **Docker: OK** + **context** (e.g. `docker context` name).  
+3. For **E2E in container** (project script): from repo root run `./scripts/docker-e2e.sh gates` (or as documented). If script **fails**, capture **last 100 lines** of output (§8b style).  
+4. **After** any step that overwrites **root** `./dockercomms` with a **Linux** build: `make clean && make build` on **host** + `file` one line — **mandatory** before further **host** CLI tests.
+LIVE TEST MATRIX (RUN IN ORDER; **STOP** only on **unexpected** PRODUCT failure unless user said “continue and log all”)
+**A. Host static + unit (always)**  
+`gofmt -l .` (empty or list files) · `go vet ./...` · `go test ./...` · `go test -race ./...` · `golangci-lint run ./...` (if project standard) · `make coverage-gate`  
+**B. Script preflight (no network OR check-only as designed)**  
+`./scripts/run-integration.sh --check` · `./scripts/login-and-run-integration.sh --check`  
+**C. Container gates (if Docker OK)**  
+`./scripts/docker-e2e.sh` **gates** → then **host rebuild** per above  
+**D. Local registry E2E (isolated, bash driver)**  
+`docs/repro.md` (or `RELEASE-RUNBOOK`): **one** **happy** round-trip per **isolation_id**; **two** **NEG** (expected non-zero) with `Expected` from **README** / doc **section heading**; **two** **flake** iterations on **different** `isolation` keys  
+**E. Optional matrix (if user or time says)**  
+- `E2E_LINUX_MATRIX=1` in user message: `./scripts/linux-distro-matrix.sh` if present, else `NOT RUN`  
+- `GH_PAT` or `~/.dockercomms_gh_pat` on **host**: `docs/FINAL-RELEASE-GO-NO-GO.md` **Section B** by heading, then `./scripts/login-and-run-integration.sh` (full), then `./scripts/docker-e2e.sh` **integration** → **cli** → **full** — if **no** creds: run **integration** once, **quote** skip, label **NOT RUN (auth)** — not “pass”
+CLEAN CODE + NO REGRESSIONS (if code changes authorized in **this** message)
+- **Smallest** diff; **one** issue per change or tight cluster.  
+- **gofmt**; **tests** in same package for behavior change.  
+- Run at minimum: `go test -race` on **touched** packages and `go test ./...` if fast enough.  
+- **No** disabling linters, **no** weakening tests, **no** `// nolint` without justification in the same PR.  
+- **No** “cleanup” in the same commit as a bugfix **unless** trivial.
+ORACLES
+- `README` **## Exit Codes**; `docs/repro.md`; `SPEC`/`ARCH` as needed. Mismatch = **bug** (code) or **DOC-DEBT** (docs) — state which.
+REPORT (END — ONLY AFTER COMMANDS)
+1. **SHA** (3-way if claiming published tip), **clean/dirty** tree.  
+2. **Table**: Phase | Command | Result | Note (isolation_id / NOT RUN / B-UX-HOST).  
+3. **Unexpected PRODUCT failures** (must be **empty** for a “clean” claim): or **list** with **5-field** repro (command, isolation_id, expected, actual, first error line).  
+4. **BLOCKED** rows for Docker / auth / time.  
+5. **One paragraph**: what is **not** covered (GHCR, chaos, huge files) — not faux humility, **concrete** gaps.  
+6. If user asked **“no bugs”** language: use **one** sentence: **“No *unexpected* failures in the above matrix; not a guarantee of total correctness.”**
+USER MESSAGE SHOULD INCLUDE
+- `Clone: /path/to/dockercomms`  
+- `CODE_CHANGES_ALLOWED=yes|no` and **if** `yes` **one** line scope.  
+- `Time budget: e.g. 2h` or `run_all_phases=yes`  
+- `GH_PAT present on host: yes|no` (not the value)  
+- Optional: `E2E_LINUX_MATRIX=1`, `CONTINUE_ON_FAILURE=yes` to log all failures in one go.
+BANNED
+- Opening with summary; claiming green without output; “absolutely no bugs” globally; skipping Docker gate when `docker info` works; P1 on shared-inbox without isolation retry; secrets in the log; emojis (optional).
+END XT-2
+```
+
+---
+
+## How to use in Cursor (paste under the block)
+
+One line, for example:
+
+`Clone: /path/to/dockercomms` · `CODE_CHANGES_ALLOWED=no` · `Time budget: 2h` · `GH_PAT present on host: no`
+
+Change `CODE_CHANGES_ALLOWED=yes` only when you want the agent to land fixes; keep one focused PR or commit per bug cluster.
+
+---
+
+## See also
+
+- [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md)
+- [EXTREME-TEST-MASTER-PROMPT.md](EXTREME-TEST-MASTER-PROMPT.md) (XT-1)
+- [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11 / operator GA)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT.md b/docs/EXTREME-TEST-MASTER-PROMPT.md
index ef394c6..a24263a 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT.md
@@ -79,4 +79,5 @@ This file is the canonical copy of the prompt on disk. Nothing “syncs” to Gi
 ## Related
 
 - **`docs/TESTING-DOCTRINE.md`** — Part A (short project principles).
+- **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2) — live Docker + execution evidence; anti-summary opening; read after XT-1.
 - **`docs/RELEASE-RUNBOOK.md`** — operator closure, GA, NOT RUN.
diff --git a/docs/TESTING-DOCTRINE.md b/docs/TESTING-DOCTRINE.md
index 7ad4348..1906824 100644
--- a/docs/TESTING-DOCTRINE.md
+++ b/docs/TESTING-DOCTRINE.md
@@ -24,5 +24,5 @@ Short, reusable. Operator closure / GA evidence uses **`docs/RELEASE-RUNBOOK.md`
 
 ## Related
 
-- Adversarial / extreme QA: **`docs/EXTREME-TEST-MASTER-PROMPT.md`** (XT-1).
+- Adversarial / extreme QA: **`docs/EXTREME-TEST-MASTER-PROMPT.md`** (XT-1); live Docker + anti-summary execution: **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2).
 - Release closure, NOT RUN, GA: **`docs/RELEASE-RUNBOOK.md`**.

From 1fa9d969e161e8e54e7ba376650f13dc97b8c59b Mon Sep 17 00:00:00 2001
From: Isaac Thor <codethor@gmail.com>
Date: Wed, 22 Apr 2026 21:32:56 -0500
Subject: [PATCH 2/6] docs: add XT-3 change-aware master prompt and cross-links

- EXTREME-TEST-MASTER-PROMPT-XT3.md: pre-flight what-changed, targeted
  go test, PR checks, fix loop, merge recommendation, ladder table
- Link from TESTING-DOCTRINE, XT-1, XT-2, README Development

Made-with: Cursor
---
 README.md                              |  2 +-
 docs/EXTREME-TEST-MASTER-PROMPT-XT2.md |  2 +
 docs/EXTREME-TEST-MASTER-PROMPT-XT3.md | 91 ++++++++++++++++++++++++++
 docs/EXTREME-TEST-MASTER-PROMPT.md     |  1 +
 docs/TESTING-DOCTRINE.md               |  2 +-
 5 files changed, 96 insertions(+), 2 deletions(-)
 create mode 100644 docs/EXTREME-TEST-MASTER-PROMPT-XT3.md

diff --git a/README.md b/README.md
index 24ade41..06e5f7a 100644
--- a/README.md
+++ b/README.md
@@ -177,7 +177,7 @@ DOCKERCOMMS_IT_GHCR_REPO=ghcr.io/user/repo DOCKERCOMMS_IT_RECIPIENT=alice@exampl
 
 ## Development
 
-- [docs/TESTING-DOCTRINE.md](docs/TESTING-DOCTRINE.md), [docs/EXTREME-TEST-MASTER-PROMPT.md](docs/EXTREME-TEST-MASTER-PROMPT.md) (XT-1), and [docs/EXTREME-TEST-MASTER-PROMPT-XT2.md](docs/EXTREME-TEST-MASTER-PROMPT-XT2.md) (XT-2): testing principles, adversarial plan, and live-Docker execution + anti-summary runs (use the release/GA runbook for closure, not a substitute)
+- [docs/TESTING-DOCTRINE.md](docs/TESTING-DOCTRINE.md), [docs/EXTREME-TEST-MASTER-PROMPT.md](docs/EXTREME-TEST-MASTER-PROMPT.md) (XT-1), [docs/EXTREME-TEST-MASTER-PROMPT-XT2.md](docs/EXTREME-TEST-MASTER-PROMPT-XT2.md) (XT-2), [docs/EXTREME-TEST-MASTER-PROMPT-XT3.md](docs/EXTREME-TEST-MASTER-PROMPT-XT3.md) (XT-3): testing principles, adversarial plan, live-Docker + anti-summary runs, and change-aware / PR merge confidence (use the release/GA runbook for closure, not a substitute)
 - SPEC.md: protocol specification
 - ARCH.md: implementation architecture
 - RELEASE_CHECKLIST.md: stop-ship gates
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
index e530ed1..e8379d7 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
@@ -20,6 +20,7 @@
 | [EXTREME-TEST-MASTER-PROMPT.md](EXTREME-TEST-MASTER-PROMPT.md) (XT-1) | Full adversarial plan |
 | **XT-2** (this file) | **Execution** + **Docker-first** + **anti-summary** (first output = shell + real command + real output) |
 | [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) | Oracle, pyramid, repro bar, bash for NEG |
+| [EXTREME-TEST-MASTER-PROMPT-XT3.md](EXTREME-TEST-MASTER-PROMPT-XT3.md) (XT-3) | **Change-aware** + PR/merge + optional **fix** loop (after XT-2) |
 
 **“Open Docker in Cursor”** = your machine’s Docker Desktop (or a Dev Container with the Docker socket). The agent runs `docker` in the **terminal**; there is no separate “Cursor-only Docker” unless you configure Dev Containers or a remote. XT-2 expects the same `docker` CLI as a normal shell.
 
@@ -96,4 +97,5 @@ Change `CODE_CHANGES_ALLOWED=yes` only when you want the agent to land fixes; ke
 
 - [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md)
 - [EXTREME-TEST-MASTER-PROMPT.md](EXTREME-TEST-MASTER-PROMPT.md) (XT-1)
+- [EXTREME-TEST-MASTER-PROMPT-XT3.md](EXTREME-TEST-MASTER-PROMPT-XT3.md) (XT-3) — next: change-aware + PR confidence
 - [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11 / operator GA)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md
new file mode 100644
index 0000000..a1b954d
--- /dev/null
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md
@@ -0,0 +1,91 @@
+# Master prompt: XT-3 — Change-aware live matrix + optional fix loop
+
+**Version: XT-3** — next step after [XT-2](EXTREME-TEST-MASTER-PROMPT-XT2.md). **Supersedes:** nothing in v11 / [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md). **Extends:** [XT-1](EXTREME-TEST-MASTER-PROMPT.md) (doctrine, adversarial plan), [XT-2](EXTREME-TEST-MASTER-PROMPT-XT2.md) (live Docker, anti-summary, GATE 0, matrix A–E).
+
+**Use when:** you have a **PR**, a **feature branch**, or you just **merged** to `main` and need a **proof** run + **targeted** tests on **touched** code.
+
+**GA / §A / §B** — still **[RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) + v11** only; **XT-3** is **QA / merge confidence**, not §A/§B proof.
+
+---
+
+## Ladder (prompts)
+
+| Prompt / doc | Role |
+|--------------|------|
+| **v11** + [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) | Operator / GA / §A/§B / NOT RUN |
+| [XT-1](EXTREME-TEST-MASTER-PROMPT.md) | Principles + full adversarial plan |
+| [XT-2](EXTREME-TEST-MASTER-PROMPT-XT2.md) | Live Docker + no-summary + A–E matrix |
+| **XT-3** (this file) | What changed first + PR/merge confidence + optional fix loop |
+
+---
+
+## Paste block (for Cursor) — everything in the fence
+
+```
+MASTER PROMPT: dockercomms — XT-3 “Change-aware live matrix + optional fix loop”
+Supersedes: nothing in v11 / RELEASE-RUNBOOK. Extends: XT-1 (doctrine), XT-2 (live Docker + anti-summary).
+Use when: you have a **PR**, a **feature branch**, or you just **merged** to `main` and need a **proof** run + **targeted** tests on **touched** code.
+MISSION
+Run the **strongest** test pass that matches **what changed** (not only full `./...` every time), then **optionally** apply **surgical** fixes with **tests** if `CODE_CHANGES_ALLOWED=yes` in the user message. Output is **evidence-first**; **no** “no bugs in the universe” — only **no unexpected failures in the run matrix** for this session.
+REQUIRED READ (same session, first 5 min)
+- `docs/TESTING-DOCTRINE.md`
+- `docs/EXTREME-TEST-MASTER-PROMPT.md` (XT-1)
+- `docs/EXTREME-TEST-MASTER-PROMPT-XT2.md` (XT-2) — **GATE 0 Docker**, **anti-summary** opening, **host rebuild** after container gates
+- `docs/RELEASE-RUNBOOK.md` — for **GA** you still use **v11** separately; XT-3 is **QA / merge confidence**, not §A/§B proof
+ANTI-SUMMARY (same as XT-2, HARD)
+First output lines = UTC, path, **3-way SHA** (if on `main` with `git fetch`) or **branch + merge-base** + first **command + output**. No plan wall before **docker info** or **go version**.
+PRE-FLIGHT: WHAT CHANGED? (XT-3 NEW)
+1. `git status -sb` and `git rev-parse HEAD` and `git branch --show-current`
+2. If on **PR** or user gave `PR_NUMBER=n`: `gh pr view n` (or `gh pr diff n --name-only` if large) — list **touched** paths; **if** not available, `git log -1 --name-only` and `git diff origin/main...HEAD --name-only` (or `main`…HEAD)
+3. **Targeted** test first (fast signal):
+   - For each **changed** package under `pkg/`, `cmd/`, `internal/`: `go test -race ./path/...` 
+   - If only **docs** / **.md** changed, say **“no Go diff; skip targeted go test; run full static + XT-2 matrix for smoke only”**
+4. Then run **global** `go test ./...` and `go test -race ./...` and **lint** / **coverage** per project (same as XT-2 **phase A**)
+THEN: XT-2 CORE (INHERIT)
+- **GATE 0** `docker info`  
+- If Docker OK: `./scripts/docker-e2e.sh` **gates** → **`make clean && make build` + `file` one line**  
+- **B** and **C** and **D** and **E** as in **XT-2** (`--check` scripts, local `repro`+NEG+flake with **bash**, integration skip or full chain with PAT)
+PR-SPECIFIC CHECKS (XT-3)
+- If `PR_NUMBER` in message: `gh pr checks <n> --watch` (or non-watch) until **conclusion** or timeout — **attach** the **failing** check name + last lines if any  
+- If PR is **from fork**, note **if** **secrets** workflows are **not** run — do **not** expect full Actions parity locally
+OPTIONAL: FIX LOOP (only if `CODE_CHANGES_ALLOWED=yes` in first message)
+For each **unexpected** PRODUCT row (5 fields per TESTING-DOCTRINE):
+1. **Minimal** code change; **add** or **tighten** a **test** in the same package.  
+2. `go test -race ./<pkg>/...` then **`go test -race ./...` if affordable**  
+3. **One** commit message style: `fix(<area>): <short>`
+If `CODE_CHANGES_ALLOWED=no`: **file** findings in a **bug register** table only — **no** file edits.
+REPORT (END)
+- **Change summary**: 1 line + **touched** paths (from pre-flight)
+- **SHA** / **branch** / **PR** link (if any)
+- **Table**: same structure as **XT-2** + column **Targeted?** (yes if package had Go changes)
+- **Merge recommendation** (if PR): `READY` | `NEEDS FIX` | `NEEDS HUMAN` — one line each with **2** evidence bullets, **not** a lecture
+- If full matrix clean: **suggested** **CHANGELOG** line: `Tested: <short-sha> (XT-3: targeted + full matrix, Docker: yes/no, …)` — **optional** user paste
+USER MESSAGE (FIRST) SHOULD INCLUDE
+- `Clone: /path/to/dockercomms`
+- `PR_NUMBER: <n> | 0` (0 = not a PR run)
+- `CODE_CHANGES_ALLOWED: yes|no` + if yes **scope** in one line
+- `Time budget: e.g. 90m`
+- `GH_PAT on host: yes|no` (value never in chat)
+- `E2E_LINUX_MATRIX: 0|1` · `CONTINUE_ON_FAILURE: yes|no` (if yes, log all failures, still stop on P0)
+- Inherit: XT-2 flags as needed
+BANNED
+- Skipping **targeted** `go test` on **changed** packages when Go files changed
+- Merging “GA done” with XT-3 — **v11** only for that
+- Summary-first opening; secrets in log; emojis in report (project default: off)
+END XT-3
+```
+
+---
+
+## How to use in Cursor (one line to paste under the block)
+
+`Clone: /path/to/dockercomms` · `PR_NUMBER: 0` · `CODE_CHANGES_ALLOWED: no` · `Time budget: 2h` · `GH_PAT on host: no`
+
+---
+
+## See also
+
+- [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md)
+- [EXTREME-TEST-MASTER-PROMPT.md](EXTREME-TEST-MASTER-PROMPT.md) (XT-1)
+- [EXTREME-TEST-MASTER-PROMPT-XT2.md](EXTREME-TEST-MASTER-PROMPT-XT2.md) (XT-2)
+- [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11 / GA)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT.md b/docs/EXTREME-TEST-MASTER-PROMPT.md
index a24263a..0252366 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT.md
@@ -80,4 +80,5 @@ This file is the canonical copy of the prompt on disk. Nothing “syncs” to Gi
 
 - **`docs/TESTING-DOCTRINE.md`** — Part A (short project principles).
 - **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2) — live Docker + execution evidence; anti-summary opening; read after XT-1.
+- **`docs/EXTREME-TEST-MASTER-PROMPT-XT3.md`** (XT-3) — change-aware matrix, PR checks, optional fix loop; after XT-2.
 - **`docs/RELEASE-RUNBOOK.md`** — operator closure, GA, NOT RUN.
diff --git a/docs/TESTING-DOCTRINE.md b/docs/TESTING-DOCTRINE.md
index 1906824..4f3b28d 100644
--- a/docs/TESTING-DOCTRINE.md
+++ b/docs/TESTING-DOCTRINE.md
@@ -24,5 +24,5 @@ Short, reusable. Operator closure / GA evidence uses **`docs/RELEASE-RUNBOOK.md`
 
 ## Related
 
-- Adversarial / extreme QA: **`docs/EXTREME-TEST-MASTER-PROMPT.md`** (XT-1); live Docker + anti-summary execution: **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2).
+- Adversarial / extreme QA: **`docs/EXTREME-TEST-MASTER-PROMPT.md`** (XT-1); live Docker + anti-summary execution: **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2); change-aware / PR / merge confidence: **`docs/EXTREME-TEST-MASTER-PROMPT-XT3.md`** (XT-3).
 - Release closure, NOT RUN, GA: **`docs/RELEASE-RUNBOOK.md`**.

From b6adfa7e4590c910999ab0bc895f8e484e7f01e7 Mon Sep 17 00:00:00 2001
From: Isaac Thor <codethor@gmail.com>
Date: Wed, 22 Apr 2026 21:41:07 -0500
Subject: [PATCH 3/6] docs: clarify Phase A vs Docker-BLOCKED when daemon is
 down
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TESTING-DOCTRINE: Host vs Docker bullet.
XT-2: hard truth + GATE 0 paste block — Phase A valid; B–E blocked without docker.
Made-with: Cursor
---
 docs/EXTREME-TEST-MASTER-PROMPT-XT2.md | 3 ++-
 docs/TESTING-DOCTRINE.md               | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
index e8379d7..d3260d1 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
@@ -9,6 +9,7 @@
 - **“Absolutely no bugs”** is not something any agent or test suite can prove; the strongest defensible claim is **no known failures in the matrix you actually ran**, with logs.
 - **Cursor** can only use Docker if the environment exposes it (Docker Desktop, Linux daemon, or Dev Containers with the socket). The prompt must **fail closed** when Docker is missing.
 - **“Do everything in Docker”** can still need a **host** step (e.g. `docker-e2e` gates may produce a **Linux** binary; **macOS** may need `make clean && make build` for a **Mach-O** host run — see the runbook and this document’s **GATE 0** / **C** / **D** flow).
+- If **`docker info` fails:** label **Phases B–E** of this matrix (and **XT-4** phases that need Docker) **BLOCKED**; **Phase A** (host `gofmt`, `go test`, `vet`, lint, `make coverage-gate`, etc.) can still pass and is **real signal** for Go on the host for that SHA.
 
 ---
 
@@ -39,7 +40,7 @@ ANTI-SUMMARY RULE (HARD)
 - After each phase, **at most 3** sentences of interpretation; then **next** commands.  
 - If you cannot run a step, **one line** `BLOCKED: {reason}` and move on — do not pad.
 DOCKER AVAILABILITY (GATE 0)
-1. `docker info` (or `docker version`) — if **fails**, state **BLOCKED: Docker not available in this environment** and run **only** host `go test` + static checks; **do not** claim “full XT-2” complete.  
+1. `docker info` (or `docker version`) — if **fails**, state **BLOCKED: Docker not available in this environment** and run **only** host `go test` + static checks; **do not** claim “full XT-2” complete. **Explicit:** with Docker down, phases **B–E** (script preflight that needs a daemon, `docker-e2e` gates, local registry, optional GHCR-in-container) are **BLOCKED**; **Phase A** (gofmt, `go vet`, `go test`, race, lint, `make coverage-gate` where applicable) on the **host** can still be **valid** and should be run.  
 2. If **OK**, one line: **Docker: OK** + **context** (e.g. `docker context` name).  
 3. For **E2E in container** (project script): from repo root run `./scripts/docker-e2e.sh gates` (or as documented). If script **fails**, capture **last 100 lines** of output (§8b style).  
 4. **After** any step that overwrites **root** `./dockercomms` with a **Linux** build: `make clean && make build` on **host** + `file` one line — **mandatory** before further **host** CLI tests.
diff --git a/docs/TESTING-DOCTRINE.md b/docs/TESTING-DOCTRINE.md
index 4f3b28d..f00c8e5 100644
--- a/docs/TESTING-DOCTRINE.md
+++ b/docs/TESTING-DOCTRINE.md
@@ -6,6 +6,8 @@ Short, reusable. Operator closure / GA evidence uses **`docs/RELEASE-RUNBOOK.md`
 
 **Pyramid** — Many fast **unit** / **property** tests; some **integration**; few heavy **E2E**; rare **extreme** / chaos runs (expensive, dedicated sessions only).
 
+**Host vs Docker** — If **`docker info` fails**, treat Docker-dependent work (script `--check` that requires a daemon, `docker-e2e` **gates**, local `registry:2`, container GHCR paths) as **BLOCKED**; **host** static + unit Go (`gofmt`, `go test`, `go vet`, lint, coverage) can still be **valid signal** for that checkout (see **XT-2** [GATE 0](EXTREME-TEST-MASTER-PROMPT-XT2.md)).
+
 **Risk order** — Crypto, path safety, auth to registry, "verify before materialize," and **exit-code contracts** before cosmetic UX.
 
 **Repro before label** — No **P1** without **command** + **environment** + **isolation key** (I7 / unique OCI repo) and **first error line**.

From 60f70c37fd1d2a7a44a1a3bc66477737eea99132 Mon Sep 17 00:00:00 2001
From: Isaac Thor <codethor@gmail.com>
Date: Wed, 22 Apr 2026 21:42:43 -0500
Subject: [PATCH 4/6] docs: add XT-4 handoff spec and XT-5 preflight Docker
 master prompt

- XT-4: evidence phases, output template, link to XT-5
- XT-5: GATE 0.1/0.2, STATIC_ONLY, DOCKER_REQUIRED, ON_MAIN, MERGE_SHA,
  BLOCKED template, inherits XT-4 phases in order
- Cross-link ladder in XT-2; doctrine, XT-1, XT-3, README

Made-with: Cursor
---
 README.md                              |   2 +-
 docs/EXTREME-TEST-MASTER-PROMPT-XT2.md |   2 +
 docs/EXTREME-TEST-MASTER-PROMPT-XT3.md |   1 +
 docs/EXTREME-TEST-MASTER-PROMPT-XT4.md |  47 +++++++++++
 docs/EXTREME-TEST-MASTER-PROMPT-XT5.md | 107 +++++++++++++++++++++++++
 docs/EXTREME-TEST-MASTER-PROMPT.md     |   2 +
 docs/TESTING-DOCTRINE.md               |   2 +-
 7 files changed, 161 insertions(+), 2 deletions(-)
 create mode 100644 docs/EXTREME-TEST-MASTER-PROMPT-XT4.md
 create mode 100644 docs/EXTREME-TEST-MASTER-PROMPT-XT5.md

diff --git a/README.md b/README.md
index 06e5f7a..546dede 100644
--- a/README.md
+++ b/README.md
@@ -177,7 +177,7 @@ DOCKERCOMMS_IT_GHCR_REPO=ghcr.io/user/repo DOCKERCOMMS_IT_RECIPIENT=alice@exampl
 
 ## Development
 
-- [docs/TESTING-DOCTRINE.md](docs/TESTING-DOCTRINE.md), [docs/EXTREME-TEST-MASTER-PROMPT.md](docs/EXTREME-TEST-MASTER-PROMPT.md) (XT-1), [docs/EXTREME-TEST-MASTER-PROMPT-XT2.md](docs/EXTREME-TEST-MASTER-PROMPT-XT2.md) (XT-2), [docs/EXTREME-TEST-MASTER-PROMPT-XT3.md](docs/EXTREME-TEST-MASTER-PROMPT-XT3.md) (XT-3): testing principles, adversarial plan, live-Docker + anti-summary runs, and change-aware / PR merge confidence (use the release/GA runbook for closure, not a substitute)
+- [docs/TESTING-DOCTRINE.md](docs/TESTING-DOCTRINE.md), [docs/EXTREME-TEST-MASTER-PROMPT.md](docs/EXTREME-TEST-MASTER-PROMPT.md) (XT-1) through [docs/EXTREME-TEST-MASTER-PROMPT-XT5.md](docs/EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5): testing principles, adversarial and live-Docker runs, change-aware / PR, evidence handoff (XT-4), preflight Docker and static-only flags (XT-5) (use the release/GA runbook for closure, not a substitute)
 - SPEC.md: protocol specification
 - ARCH.md: implementation architecture
 - RELEASE_CHECKLIST.md: stop-ship gates
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
index d3260d1..5dabd1e 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
@@ -22,6 +22,8 @@
 | **XT-2** (this file) | **Execution** + **Docker-first** + **anti-summary** (first output = shell + real command + real output) |
 | [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) | Oracle, pyramid, repro bar, bash for NEG |
 | [EXTREME-TEST-MASTER-PROMPT-XT3.md](EXTREME-TEST-MASTER-PROMPT-XT3.md) (XT-3) | **Change-aware** + PR/merge + optional **fix** loop (after XT-2) |
+| [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) | Evidence + triage + tables |
+| [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5) | **Preflight** Docker · **STATIC_ONLY** / **DOCKER_REQUIRED** · main@merge |
 
 **“Open Docker in Cursor”** = your machine’s Docker Desktop (or a Dev Container with the Docker socket). The agent runs `docker` in the **terminal**; there is no separate “Cursor-only Docker” unless you configure Dev Containers or a remote. XT-2 expects the same `docker` CLI as a normal shell.
 
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md
index a1b954d..8610f48 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md
@@ -88,4 +88,5 @@ END XT-3
 - [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md)
 - [EXTREME-TEST-MASTER-PROMPT.md](EXTREME-TEST-MASTER-PROMPT.md) (XT-1)
 - [EXTREME-TEST-MASTER-PROMPT-XT2.md](EXTREME-TEST-MASTER-PROMPT-XT2.md) (XT-2)
+- [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) · [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5)
 - [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11 / GA)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT4.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT4.md
new file mode 100644
index 0000000..db2aca6
--- /dev/null
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT4.md
@@ -0,0 +1,47 @@
+# Master prompt: XT-4 — Evidence-based test and triage (agent handoff)
+
+**Version: XT-4** — maximal, **evidence-first** pass: real shell output, no fabricated pass/fail. **Does not** replace [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11) for GA/§A/§B.
+
+**Next step:** [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5) adds **preflight Docker** + **STATIC_ONLY** / **DOCKER_REQUIRED** so you do not spend a long Phase 1 before discovering Docker is down when you needed E2E.
+
+---
+
+## Non-negotiable truth rules (summary)
+
+- Do not claim “no bugs” / 100% correct; strongest honest claim: no **unexpected** failures in the **matrix run** for this checkout, OS, Docker, and time budget.
+- Do not fabricate results; **NOT RUN** with one-line reason if not executed.
+- Do not print secrets; **GH_PAT** = PRESENT or ABSENT only.
+- **NEG** / exit capture: **bash** driver (see [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md)); if `docker info` fails, Docker-dependent phases are **BLOCKED**; **host** Phase 1 Go static + unit can still be valid ([TESTING-DOCTRINE.md](TESTING-DOCTRINE.md), [XT-2](EXTREME-TEST-MASTER-PROMPT-XT2.md) GATE 0).
+- After `docker-e2e.sh` **gates** (or any step that can overwrite the root binary with a Linux build): **`make clean && make build`** + **`file ./dockercomms`** on host before further host CLI tests.
+
+## Phases (typical order)
+
+| Phase | Content |
+|-------|---------|
+| **0** | XT-3 pre-flight: what changed; targeted `go test -race` on touched `pkg/` / `cmd/` / `internal/` |
+| **1** | Static + unit: `gofmt -l`, `go vet`, `go test`, `go test -race`, `golangci-lint`, `make coverage-gate` |
+| **2** | `./scripts/run-integration.sh --check`, `./scripts/login-and-run-integration.sh --check` |
+| **3** | `./scripts/docker-e2e.sh gates` → host rebuild + `file` |
+| **4** | Local registry E2E (bash): happy path, NEG1/NEG2, I8 two isolated flakes per [repro.md](repro.md) |
+| **5** | Optional GHCR: PAT present → Section B + `login-and-run` + `docker-e2e` integration → cli → full; else skip quote + **NOT RUN (auth)** |
+| **6** | Optional: `linux-distro-matrix.sh`, chaos — time / `EXTREME` |
+
+## Output template (end of session)
+
+Use sections such as:
+
+- **### XT-4 RESULT — dockercomms** — SHA, 3-way / clean / Docker / time budget
+- **### Command outcomes (table)** — Phase | Command | Exit | Note
+- **### Unexpected product failures** — empty for “clean” or 5-field rows per [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md)
+- **### NOT RUN / BLOCKED**
+- **### P0–P1 register** / **P2–P3 / DOC-DEBT**
+- **### HONESTY LINE** — one sentence: no unexpected failures in matrix above; not total correctness
+
+**Opening (anti-summary):** first block = `date -u`, `pwd`, `git status`, SHAs, `go version`, `docker` check, **then** first command output — no plan wall before evidence.
+
+---
+
+## Related
+
+- [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) · [XT-1](EXTREME-TEST-MASTER-PROMPT.md) · [XT-2](EXTREME-TEST-MASTER-PROMPT-XT2.md) · [XT-5](EXTREME-TEST-MASTER-PROMPT-XT5.md)
+- [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11 / GA)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT5.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT5.md
new file mode 100644
index 0000000..57ee7cd
--- /dev/null
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT5.md
@@ -0,0 +1,107 @@
+# Master prompt: XT-5 — Preflight gate + static-only + main@merge + full matrix
+
+**Version: XT-5** — **Extends:** [XT-1](EXTREME-TEST-MASTER-PROMPT.md) (doctrine), [XT-2](EXTREME-TEST-MASTER-PROMPT-XT2.md) (GATE 0, matrix), [XT-3](EXTREME-TEST-MASTER-PROMPT-XT3.md) (what changed), [XT-4](EXTREME-TEST-MASTER-PROMPT-XT4.md) (agent handoff, tables). **Supersedes:** nothing in v11 / [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md). **Does not** replace GA/§A/§B.
+
+## Why XT-5 exists
+
+[XT-4](EXTREME-TEST-MASTER-PROMPT-XT4.md) showed: a long **Phase 1** can succeed while **Docker** is down, and **Phases 2–6** are **BLOCKED** — **correct** but **wasteful** if the goal was **end-to-end** that day. **XT-5** **reorders** checks: **verify Docker (or opt out) first**, then run the right **depth** of tests.
+
+---
+
+## Ladder
+
+| Doc | Role |
+|-----|------|
+| v11 + [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) | GA, §A/§B, NOT RUN |
+| [XT-1](EXTREME-TEST-MASTER-PROMPT.md) | Principles + adversarial plan |
+| [XT-2](EXTREME-TEST-MASTER-PROMPT-XT2.md) | Live Docker, anti-summary, A–E |
+| [XT-3](EXTREME-TEST-MASTER-PROMPT-XT3.md) | Change-aware, PR, optional fix loop |
+| [XT-4](EXTREME-TEST-MASTER-PROMPT-XT4.md) | Evidence table, triage, honesty line |
+| **XT-5** (this file) | **GATE 0.1** Docker first · **STATIC_ONLY** · **DOCKER_REQUIRED** · **ON_MAIN** / **MERGE_SHA** |
+
+---
+
+## Paste block (for Cursor) — everything in the fence
+
+```
+MASTER PROMPT: dockercomms — XT-5 “Preflight gate + static-only + main@merge + full matrix”
+Extends: XT-1 (doctrine), XT-2 (GATE 0, matrix), XT-3 (what changed), XT-4 (agent handoff, tables).
+Supersedes: nothing in v11 / RELEASE-RUNBOOK. Does not replace GA/§A/§B.
+
+WHY XT-5 EXISTS
+XT-4 showed: a long **Phase 1** can succeed while **Docker** is down, and **Phases 2–6** are **BLOCKED** — that is **correct** but **wastes** time if the user’s goal was **end-to-end** that day. XT-5 **reorders** checks: **verify Docker (or opt out) first**, then run the right **depth** of tests.
+
+USER FLAGS (first message; defaults in parentheses)
+- `CLONE=/path/to/dockercomms`  (required)
+- `ON_MAIN=0|1`  (0 default) — if 1: `git fetch` and make **3-way** `HEAD` = `origin/main` = `gh` main **or** stop with **DRIFT**
+- `MERGE_SHA=abc12`  (optional) — if set, `git checkout` that commit in a **detached** or **branches/verify** and state it in the header; else ignore
+- `STATIC_ONLY=0|1`  (0) — if 1: run **only** Phase 1 + report; **no** docker-dependent scripts (treat as **intentional**)
+- `DOCKER_REQUIRED=0|1`  (0 default) — if 1: if `docker info` **fails**, **abort entire session** with **one-page** **BLOCKED** report (no Phase 1) unless `STATIC_ONLY=1`
+- Inherit from XT-4: `EXTREME`, `CONTINUE_ON_FAILURE`, `CODE_CHANGES_ALLOWED`, time budget, `PR_NUMBER`, `GH_PAT` present yes/no (never value)
+
+REQUIRED READ (3–5 min, same as XT-4)
+docs/TESTING-DOCTRINE.md, docs/EXTREME-TEST-MASTER-PROMPT.md (XT-1),
+docs/EXTREME-TEST-MASTER-PROMPT-XT2.md, docs/EXTREME-TEST-MASTER-PROMPT-XT3.md, docs/EXTREME-TEST-MASTER-PROMPT-XT4.md,
+docs/repro.md, README (exit codes), docs/RELEASE-RUNBOOK.md (context for GA, not a substitute for v11)
+
+OPENING (ANTI-SUMMARY) — first lines MUST be:
+`date -u` · `cd "$CLONE" && pwd` · `git status -sb` · `git rev-parse HEAD` · `go version` ·
+**THEN** immediately **GATE 0.1 — DOCKER 10-SECOND CHECK**:
+- `command -v docker; docker info` (capture exit code; if **non-zero**: print **first 20 lines** stderr/stdout; **one line** suggestion: e.g. start **Docker Desktop**, or **colima start**, or **remote** context)
+- If **DOCKER_REQUIRED=1** and docker info **fails**:
+  - Output only the **### XT-5 BLOCKED** section (template below) + honesty line, **and STOP** (unless `STATIC_ONLY=1` in same message — then continue with Phase 1 only)
+- If **docker info** **succeeds**, print **GATE 0.1: OK** in one line and **continue** to preflight / phases.
+
+GATE 0.2 — BRANCH / MAIN (if `ON_MAIN=1`)
+- `git fetch origin`
+- Compare `HEAD`, `origin/main`, `gh api` main — if **mismatch** and you are not intentionally on a topic branch, **state NO** 3-way match and **do not** claim “published main” results.
+
+PHASES (INHERIT FROM XT-4, BUT ORDERED)
+- **0** XT-3: what changed / targeted `go test -race` on touched packages
+- **1** Static + unit (gofmt, vet, go test, race, lint, coverage) — **skip** if `DOCKER_REQUIRED=1` and docker **failed** and `STATIC_ONLY=0` (aborted at gate) — if `STATIC_ONLY=1` **always** run
+- **2** `--check` scripts — only if `docker info` **ok**
+- **3** `docker-e2e.sh` **gates** → `make clean && make build` + `file` (only if docker **ok**)
+- **4** local registry **repro** + NEGs + I8 (bash) — only if docker **ok**
+- **5** optional PAT + Section B + docker-e2e i|clf — only if PAT present
+- **6** optional `linux-distro-matrix.sh` if `EXTREME=1` and docker **ok**
+
+REPORT
+Same sections as **XT-4**, with these **additions** at top of **### XT-5 RESULT** (or **XT-4/5** if you want one template):
+- `GATE 0.1: Docker OK|FAIL`
+- `ON_MAIN: yes|no` + 3-way match: yes|no|n/a
+- `STATIC_ONLY: yes|no`
+- `DOCKER_REQUIRED: yes|no`
+
+### XT-5 BLOCKED (template when DOCKER_REQUIRED=1 and docker fails)
+- Reason: `docker info` non-zero: <first line of error>
+- Suggested user action: start Docker / fix socket / set DOCKER_HOST if remote
+- Phase 1 **not** run: **yes|no** (if user did not set STATIC_ONLY, say **skipped**; if **STATIC_ONLY=1**, list **go test** outcome)
+
+HONESTY LINE (unchanged in spirit)
+Same as XT-4; never “no bugs globally.”
+
+BANS
+- Running **Phase 3+** with docker **down** and pretending you did E2E
+- Claiming **3-way** **main** match on a **topic** branch when `ON_MAIN=1` was not set
+- P1 on **script** “Docker not running” failures without repro on a **good** daemon
+
+END XT-5
+```
+
+### XT-5 BLOCKED (copy when rendering reports)
+
+- **Reason:** `docker info` non-zero: (first line of error)
+- **Suggested user action:** start Docker Desktop / fix socket / `colima start` / set `DOCKER_HOST` if remote
+- **Phase 1 not run:** yes | no (if `STATIC_ONLY=1`, list `go test` outcome)
+
+---
+
+## How to use in Cursor (one line under the block)
+
+`CLONE: /path/to/dockercomms` · `DOCKER_REQUIRED: 0` · `STATIC_ONLY: 0` · `ON_MAIN: 0` · `CODE_CHANGES_ALLOWED: no`
+
+---
+
+## See also
+
+- [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) · [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) · [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT.md b/docs/EXTREME-TEST-MASTER-PROMPT.md
index 0252366..d1051ac 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT.md
@@ -81,4 +81,6 @@ This file is the canonical copy of the prompt on disk. Nothing “syncs” to Gi
 - **`docs/TESTING-DOCTRINE.md`** — Part A (short project principles).
 - **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2) — live Docker + execution evidence; anti-summary opening; read after XT-1.
 - **`docs/EXTREME-TEST-MASTER-PROMPT-XT3.md`** (XT-3) — change-aware matrix, PR checks, optional fix loop; after XT-2.
+- **`docs/EXTREME-TEST-MASTER-PROMPT-XT4.md`** (XT-4) — evidence tables, triage, honesty line.
+- **`docs/EXTREME-TEST-MASTER-PROMPT-XT5.md`** (XT-5) — GATE 0.1 Docker first, `STATIC_ONLY`, `DOCKER_REQUIRED`, `ON_MAIN` / `MERGE_SHA`.
 - **`docs/RELEASE-RUNBOOK.md`** — operator closure, GA, NOT RUN.
diff --git a/docs/TESTING-DOCTRINE.md b/docs/TESTING-DOCTRINE.md
index f00c8e5..34e47a8 100644
--- a/docs/TESTING-DOCTRINE.md
+++ b/docs/TESTING-DOCTRINE.md
@@ -26,5 +26,5 @@ Short, reusable. Operator closure / GA evidence uses **`docs/RELEASE-RUNBOOK.md`
 
 ## Related
 
-- Adversarial / extreme QA: **`docs/EXTREME-TEST-MASTER-PROMPT.md`** (XT-1); live Docker + anti-summary execution: **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2); change-aware / PR / merge confidence: **`docs/EXTREME-TEST-MASTER-PROMPT-XT3.md`** (XT-3).
+- Adversarial / extreme QA: **`docs/EXTREME-TEST-MASTER-PROMPT.md`** (XT-1); live Docker + anti-summary: **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2); change-aware / PR: **`docs/EXTREME-TEST-MASTER-PROMPT-XT3.md`** (XT-3); evidence handoff + tables: **`docs/EXTREME-TEST-MASTER-PROMPT-XT4.md`** (XT-4); preflight Docker + **STATIC_ONLY** / **ON_MAIN**: **`docs/EXTREME-TEST-MASTER-PROMPT-XT5.md`** (XT-5).
 - Release closure, NOT RUN, GA: **`docs/RELEASE-RUNBOOK.md`**.

From 5a63148f8adfb0eaee71bac4511d24ae5b22ddcb Mon Sep 17 00:00:00 2001
From: Isaac Thor <codethor@gmail.com>
Date: Wed, 22 Apr 2026 21:42:57 -0500
Subject: [PATCH 5/6] docs: XT-2 see also links to XT-4 and XT-5

Made-with: Cursor
---
 docs/EXTREME-TEST-MASTER-PROMPT-XT2.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
index 5dabd1e..2148851 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
@@ -100,5 +100,6 @@ Change `CODE_CHANGES_ALLOWED=yes` only when you want the agent to land fixes; ke
 
 - [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md)
 - [EXTREME-TEST-MASTER-PROMPT.md](EXTREME-TEST-MASTER-PROMPT.md) (XT-1)
-- [EXTREME-TEST-MASTER-PROMPT-XT3.md](EXTREME-TEST-MASTER-PROMPT-XT3.md) (XT-3) — next: change-aware + PR confidence
+- [EXTREME-TEST-MASTER-PROMPT-XT3.md](EXTREME-TEST-MASTER-PROMPT-XT3.md) (XT-3) — change-aware + PR confidence
+- [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) · [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5)
 - [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11 / operator GA)

From 66e7d64934c660f9d256a4752d3c8e73b02f9e5d Mon Sep 17 00:00:00 2001
From: Isaac Thor <codethor@gmail.com>
Date: Wed, 22 Apr 2026 23:23:29 -0500
Subject: [PATCH 6/6] docs: add XT-6 CI parity + RC bundle master prompt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- New EXTREME-TEST-MASTER-PROMPT-XT6.md (CI mirror, CodeQL note, optional RC)
- Link XT-6 from doctrine, README, XT-1–XT-5, ladder table in XT-2

Made-with: Cursor
---
 README.md                              |   2 +-
 docs/EXTREME-TEST-MASTER-PROMPT-XT2.md |   3 +-
 docs/EXTREME-TEST-MASTER-PROMPT-XT3.md |   2 +-
 docs/EXTREME-TEST-MASTER-PROMPT-XT4.md |   4 +-
 docs/EXTREME-TEST-MASTER-PROMPT-XT5.md |   4 +-
 docs/EXTREME-TEST-MASTER-PROMPT-XT6.md | 111 +++++++++++++++++++++++++
 docs/EXTREME-TEST-MASTER-PROMPT.md     |   1 +
 docs/TESTING-DOCTRINE.md               |   2 +-
 8 files changed, 122 insertions(+), 7 deletions(-)
 create mode 100644 docs/EXTREME-TEST-MASTER-PROMPT-XT6.md

diff --git a/README.md b/README.md
index 546dede..d40c674 100644
--- a/README.md
+++ b/README.md
@@ -177,7 +177,7 @@ DOCKERCOMMS_IT_GHCR_REPO=ghcr.io/user/repo DOCKERCOMMS_IT_RECIPIENT=alice@exampl
 
 ## Development
 
-- [docs/TESTING-DOCTRINE.md](docs/TESTING-DOCTRINE.md), [docs/EXTREME-TEST-MASTER-PROMPT.md](docs/EXTREME-TEST-MASTER-PROMPT.md) (XT-1) through [docs/EXTREME-TEST-MASTER-PROMPT-XT5.md](docs/EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5): testing principles, adversarial and live-Docker runs, change-aware / PR, evidence handoff (XT-4), preflight Docker and static-only flags (XT-5) (use the release/GA runbook for closure, not a substitute)
+- [docs/TESTING-DOCTRINE.md](docs/TESTING-DOCTRINE.md), [docs/EXTREME-TEST-MASTER-PROMPT.md](docs/EXTREME-TEST-MASTER-PROMPT.md) (XT-1) through [docs/EXTREME-TEST-MASTER-PROMPT-XT6.md](docs/EXTREME-TEST-MASTER-PROMPT-XT6.md) (XT-6): testing ladder including CI workflow parity and optional RC bundle (XT-6) (use the release/GA runbook for closure, not a substitute)
 - SPEC.md: protocol specification
 - ARCH.md: implementation architecture
 - RELEASE_CHECKLIST.md: stop-ship gates
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
index 2148851..41355a7 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT2.md
@@ -24,6 +24,7 @@
 | [EXTREME-TEST-MASTER-PROMPT-XT3.md](EXTREME-TEST-MASTER-PROMPT-XT3.md) (XT-3) | **Change-aware** + PR/merge + optional **fix** loop (after XT-2) |
 | [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) | Evidence + triage + tables |
 | [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5) | **Preflight** Docker · **STATIC_ONLY** / **DOCKER_REQUIRED** · main@merge |
+| [EXTREME-TEST-MASTER-PROMPT-XT6.md](EXTREME-TEST-MASTER-PROMPT-XT6.md) (XT-6) | **CI parity** + optional **RC** / **`act`** |
 
 **“Open Docker in Cursor”** = your machine’s Docker Desktop (or a Dev Container with the Docker socket). The agent runs `docker` in the **terminal**; there is no separate “Cursor-only Docker” unless you configure Dev Containers or a remote. XT-2 expects the same `docker` CLI as a normal shell.
 
@@ -101,5 +102,5 @@ Change `CODE_CHANGES_ALLOWED=yes` only when you want the agent to land fixes; ke
 - [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md)
 - [EXTREME-TEST-MASTER-PROMPT.md](EXTREME-TEST-MASTER-PROMPT.md) (XT-1)
 - [EXTREME-TEST-MASTER-PROMPT-XT3.md](EXTREME-TEST-MASTER-PROMPT-XT3.md) (XT-3) — change-aware + PR confidence
-- [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) · [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5)
+- [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) · [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5) · [EXTREME-TEST-MASTER-PROMPT-XT6.md](EXTREME-TEST-MASTER-PROMPT-XT6.md) (XT-6)
 - [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11 / operator GA)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md
index 8610f48..1566d02 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT3.md
@@ -88,5 +88,5 @@ END XT-3
 - [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md)
 - [EXTREME-TEST-MASTER-PROMPT.md](EXTREME-TEST-MASTER-PROMPT.md) (XT-1)
 - [EXTREME-TEST-MASTER-PROMPT-XT2.md](EXTREME-TEST-MASTER-PROMPT-XT2.md) (XT-2)
-- [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) · [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5)
+- [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) · [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5) · [EXTREME-TEST-MASTER-PROMPT-XT6.md](EXTREME-TEST-MASTER-PROMPT-XT6.md) (XT-6)
 - [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11 / GA)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT4.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT4.md
index db2aca6..89e2ad3 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT-XT4.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT4.md
@@ -2,7 +2,7 @@
 
 **Version: XT-4** — maximal, **evidence-first** pass: real shell output, no fabricated pass/fail. **Does not** replace [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11) for GA/§A/§B.
 
-**Next step:** [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) (XT-5) adds **preflight Docker** + **STATIC_ONLY** / **DOCKER_REQUIRED** so you do not spend a long Phase 1 before discovering Docker is down when you needed E2E.
+**Next steps:** [XT-5](EXTREME-TEST-MASTER-PROMPT-XT5.md) (preflight Docker, **STATIC_ONLY** / **DOCKER_REQUIRED**), then [XT-6](EXTREME-TEST-MASTER-PROMPT-XT6.md) (**CI** mirror vs `ci.yml`, optional RC bundle).
 
 ---
 
@@ -43,5 +43,5 @@ Use sections such as:
 
 ## Related
 
-- [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) · [XT-1](EXTREME-TEST-MASTER-PROMPT.md) · [XT-2](EXTREME-TEST-MASTER-PROMPT-XT2.md) · [XT-5](EXTREME-TEST-MASTER-PROMPT-XT5.md)
+- [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) · [XT-1](EXTREME-TEST-MASTER-PROMPT.md) · [XT-2](EXTREME-TEST-MASTER-PROMPT-XT2.md) · [XT-5](EXTREME-TEST-MASTER-PROMPT-XT5.md) · [XT-6](EXTREME-TEST-MASTER-PROMPT-XT6.md)
 - [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11 / GA)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT5.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT5.md
index 57ee7cd..fee8eca 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT-XT5.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT5.md
@@ -18,6 +18,7 @@
 | [XT-3](EXTREME-TEST-MASTER-PROMPT-XT3.md) | Change-aware, PR, optional fix loop |
 | [XT-4](EXTREME-TEST-MASTER-PROMPT-XT4.md) | Evidence table, triage, honesty line |
 | **XT-5** (this file) | **GATE 0.1** Docker first · **STATIC_ONLY** · **DOCKER_REQUIRED** · **ON_MAIN** / **MERGE_SHA** |
+| [EXTREME-TEST-MASTER-PROMPT-XT6.md](EXTREME-TEST-MASTER-PROMPT-XT6.md) (XT-6) | **CI** workflow mirror + optional **RC** · optional **`act`** |
 
 ---
 
@@ -104,4 +105,5 @@ END XT-5
 
 ## See also
 
-- [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) · [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) · [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11)
+- [EXTREME-TEST-MASTER-PROMPT-XT4.md](EXTREME-TEST-MASTER-PROMPT-XT4.md) (XT-4) · [EXTREME-TEST-MASTER-PROMPT-XT6.md](EXTREME-TEST-MASTER-PROMPT-XT6.md) (XT-6)
+- [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) · [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) (v11)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT-XT6.md b/docs/EXTREME-TEST-MASTER-PROMPT-XT6.md
new file mode 100644
index 0000000..e583a06
--- /dev/null
+++ b/docs/EXTREME-TEST-MASTER-PROMPT-XT6.md
@@ -0,0 +1,111 @@
+# Master prompt: XT-6 — CI workflow parity + RC bundle (optional)
+
+**Version: XT-6** — **Extends:** [XT-1](EXTREME-TEST-MASTER-PROMPT.md) through [XT-5](EXTREME-TEST-MASTER-PROMPT-XT5.md). **Supersedes:** nothing in v11 / [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md). **Does not** replace §A/§B/GA.
+
+## Why XT-6 exists
+
+Local `go test ./...` can be **green** while **CI** fails (different **Go** version, **make** targets, missing **step**, **OS**). **XT-6** forces the agent to **read** `.github/workflows/*.yml` and **execute the same shell steps** the workflow uses (as closely as the host allows), then run **XT-5** on top. Optional **RC** = one **numbered** report block for a **PR** or **release** candidate—**not** GA.
+
+---
+
+## Ladder
+
+| Doc | Role |
+|-----|------|
+| v11 + [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md) | GA, §A/§B |
+| [XT-1](EXTREME-TEST-MASTER-PROMPT.md) … [XT-5](EXTREME-TEST-MASTER-PROMPT-XT5.md) | See each file |
+| **XT-6** (this file) | **CI mirror** + [XT-5](EXTREME-TEST-MASTER-PROMPT-XT5.md) inherit · optional **RC_BUNDLE** · optional **`act`** |
+
+---
+
+## Paste block (for Cursor) — everything in the fence
+
+```
+MASTER PROMPT: dockercomms — XT-6 “CI workflow parity + RC bundle (optional)”
+Extends: XT-1 (doctrine) … XT-5 (Docker preflight, ON_MAIN, STATIC_ONLY).
+Supersedes: nothing in v11 / RELEASE-RUNBOOK. Does not replace §A/§B/GA.
+
+WHY XT-6 EXISTS
+Local `go test ./...` can be **green** while **CI** fails (different **Go** version, different **make** targets, missing **step**, **OS**). XT-6 forces the agent to **read** `.github/workflows/*.yml` and **execute the same commands** the workflow uses (as closely as the host allows), then run **XT-5** on top. Optional **RC** = one **numbered** report block you can attach to a **PR** or **release** candidate without calling it GA.
+
+USER FLAGS (first message; merge with XT-4/5)
+- `CLONE=/path/to/dockercomms`  (**required**)
+- `CI_PARITY=1`  (default **1** for XT-6) — if **0**, skip §A workflow mirror
+- Inherit: `ON_MAIN`, `MERGE_SHA`, `STATIC_ONLY`, `DOCKER_REQUIRED`, `EXTREME`, `CONTINUE_ON_FAILURE`, `CODE_CHANGES_ALLOWED`, `PR_NUMBER`, time budget, `GH_PAT` present yes/no
+- `RC_BUNDLE=0|1`  (0 default) — if **1**, add **§ RC CANDIDATE** block (below) for human paste into PR/release notes
+- `ACT=0|1`  (0) — if **1** and `act` is on `PATH`, try `act -l` and **optionally** `act push` **or** one job with `--dryrun` if supported; if `act` missing, **NOT RUN (dep)** one line (do not fake `act` results)
+
+REQUIRED READ
+docs/TESTING-DOCTRINE.md
+docs/EXTREME-TEST-MASTER-PROMPT.md (XT-1) … docs/EXTREME-TEST-MASTER-PROMPT-XT5.md (XT-5) (all as in XT-5)
+`.github/workflows/ci.yml`  (**mandatory** for this prompt)
+`.github/workflows/codeql.yml`  (read; **do not** “run” CodeQL locally — note **“CodeQL: CI only; local NOT RUN (tooling)”** unless user has `codeql` and explicitly allows)
+`Makefile`  (targets referenced from CI)
+`README`  (exit codes)
+
+OPENING (ANTI-SUMMARY)
+First lines: `date -u` · `pwd` · `git status -sb` · `go version` · `git rev-parse HEAD` · **then** **GATE 0.1** from **XT-5** (`docker info`).
+
+§A — CI WORKFLOW MIRROR (if `CI_PARITY=1`)
+1) Open **`.github/workflows/ci.yml`**. In your report, paste a **short** bullet list: **triggers** (on: push, pull_request…), **jobs** names, **runner** (ubuntu-*), **Go** version (setup-go or container image), and **ordered** run steps (install deps, `make` targets, `go test` flags, **coverage** gate, **lint**).  
+2) For **each** step that is a **shell** command you can run on **this** host, **run it** in the **same order** (adapt paths only; **do not** change flags unless Mac vs Linux **forces** it — if forced, mark **CI_PARITY: PARTIAL** and explain in **one** line).  
+3) If the workflow uses **a matrix** (os, go), run the **go** and **test** step for **`go` on PATH** and note: **“CI runs matrix; local = single column.”**  
+4) If a step is **only** on **ubuntu** and cannot run (e.g. `apt-get` only), mark **NOT RUN (host os)**.  
+5) If **coverage** or **lint** in CI use **different** version than local, run local anyway and add **one** line: **delta vs CI** if **visible** in workflow file.  
+6) Conclude **§A** with: **`CI_PARITY: STRONG | PARTIAL | NOT RUN (reason)`**.
+
+§B — CODEQL
+- Default: **NOT RUN (local): CodeQL executed on GitHub for push/PR; local scan requires CodeQL bundle**. One line: link to **CodeQL** workflow in repo or `gh run` last **Analyze** if `gh` works.
+
+§C — INHERIT XT-5
+Run **GATE 0.2** (`ON_MAIN` if set), then **phases 0–6** from **XT-5/4** as applicable (**Docker** required paths, **PAT** paths, **EXTREME** for matrix script).
+
+REPORT (append to XT-4/5 structure)
+- Top of **### XT-6 RESULT**:
+  - `CI_PARITY: STRONG|PARTIAL|NOT_RUN`
+  - `Workflows read: ci.yml (yes), codeql.yml (yes)`
+  - `Go version: workflow says …, local: …`
+
+§ RC CANDIDATE (only if `RC_BUNDLE=1` — for humans, not GA)
+Paste **exact** block in the final output:
+
+  ### Release candidate / PR test bundle (not GA; not v11)
+  - **Date (UTC)**: …
+  - **Local HEAD** / **Branch**: …
+  - **3-way `main` match (if run with ON_MAIN=1)**: yes|no|n/a
+  - **CI mirror**: STRONG|PARTIAL — 1 line
+  - **Go tests (local)**: pass|fail (scope)
+  - **Docker (GATE 0.1)**: ok|fail
+  - **Container gates + host rebuild (if run)**: ok|skip
+  - **Local registry E2E (if run)**: ok|skip
+  - **GHCR chain (if run)**: ok|not run (auth)
+  - **Honesty**: "RC bundle is evidence of testing effort; it does not replace v11 operator GA/§A/§B." 
+
+BANS
+- Claiming **“same as CI”** without **opening** `ci.yml` and **listing** the steps you ran.  
+- Skipping **XT-5** **GATE 0.1** when the workflow uses **Docker** and you plan **docker-e2e** in the same session.  
+- Merging this block with **GREEN GA** in **v11**; **v11** remains separate.
+
+HONESTY LINE
+Same as XT-4/5, plus: **"CI mirror is best-effort; runner OS and Go image may differ from darwin/ local go."**
+
+END XT-6
+```
+
+---
+
+## How to use in Cursor (one line)
+
+`CLONE: /path/to/dockercomms` · `CI_PARITY: 1` · `RC_BUNDLE: 0` · `ACT: 0` · `DOCKER_REQUIRED: 0` · `STATIC_ONLY: 0`
+
+---
+
+## This repo’s `ci.yml` (reference — do not treat as the paste block; always re-read the file)
+
+Current workflow (check out-of-date): job **`test`**, `runs-on: ubuntu-latest`, `go-version-file: go.mod`, steps in order: **gofmt** (fail if any output) → **go vet** → **go test** → **go test -race** → **golangci-lint** (install v2.10.1) → **make coverage-gate**.
+
+---
+
+## See also
+
+- [EXTREME-TEST-MASTER-PROMPT-XT5.md](EXTREME-TEST-MASTER-PROMPT-XT5.md) · [TESTING-DOCTRINE.md](TESTING-DOCTRINE.md) · [RELEASE-RUNBOOK.md](RELEASE-RUNBOOK.md)
diff --git a/docs/EXTREME-TEST-MASTER-PROMPT.md b/docs/EXTREME-TEST-MASTER-PROMPT.md
index d1051ac..8e722c3 100644
--- a/docs/EXTREME-TEST-MASTER-PROMPT.md
+++ b/docs/EXTREME-TEST-MASTER-PROMPT.md
@@ -83,4 +83,5 @@ This file is the canonical copy of the prompt on disk. Nothing “syncs” to Gi
 - **`docs/EXTREME-TEST-MASTER-PROMPT-XT3.md`** (XT-3) — change-aware matrix, PR checks, optional fix loop; after XT-2.
 - **`docs/EXTREME-TEST-MASTER-PROMPT-XT4.md`** (XT-4) — evidence tables, triage, honesty line.
 - **`docs/EXTREME-TEST-MASTER-PROMPT-XT5.md`** (XT-5) — GATE 0.1 Docker first, `STATIC_ONLY`, `DOCKER_REQUIRED`, `ON_MAIN` / `MERGE_SHA`.
+- **`docs/EXTREME-TEST-MASTER-PROMPT-XT6.md`** (XT-6) — mirror `ci.yml` steps locally; CodeQL note; optional `RC_BUNDLE`, `act`.
 - **`docs/RELEASE-RUNBOOK.md`** — operator closure, GA, NOT RUN.
diff --git a/docs/TESTING-DOCTRINE.md b/docs/TESTING-DOCTRINE.md
index 34e47a8..2660fd2 100644
--- a/docs/TESTING-DOCTRINE.md
+++ b/docs/TESTING-DOCTRINE.md
@@ -26,5 +26,5 @@ Short, reusable. Operator closure / GA evidence uses **`docs/RELEASE-RUNBOOK.md`
 
 ## Related
 
-- Adversarial / extreme QA: **`docs/EXTREME-TEST-MASTER-PROMPT.md`** (XT-1); live Docker + anti-summary: **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2); change-aware / PR: **`docs/EXTREME-TEST-MASTER-PROMPT-XT3.md`** (XT-3); evidence handoff + tables: **`docs/EXTREME-TEST-MASTER-PROMPT-XT4.md`** (XT-4); preflight Docker + **STATIC_ONLY** / **ON_MAIN**: **`docs/EXTREME-TEST-MASTER-PROMPT-XT5.md`** (XT-5).
+- Adversarial / extreme QA: **`docs/EXTREME-TEST-MASTER-PROMPT.md`** (XT-1); live Docker + anti-summary: **`docs/EXTREME-TEST-MASTER-PROMPT-XT2.md`** (XT-2); change-aware / PR: **`docs/EXTREME-TEST-MASTER-PROMPT-XT3.md`** (XT-3); evidence handoff + tables: **`docs/EXTREME-TEST-MASTER-PROMPT-XT4.md`** (XT-4); preflight Docker + **STATIC_ONLY** / **ON_MAIN**: **`docs/EXTREME-TEST-MASTER-PROMPT-XT5.md`** (XT-5); **CI workflow parity** + optional RC: **`docs/EXTREME-TEST-MASTER-PROMPT-XT6.md`** (XT-6).
 - Release closure, NOT RUN, GA: **`docs/RELEASE-RUNBOOK.md`**.