Close final Cory direct-claim evidence gaps

hermes-agent/leoclean-skills/gcp/teleo-kb-bridge/SKILL.md

@@ -110,7 +110,9 @@ proof language below. These are behavioral examples, not feature changes.
   rows exist. If proposal `a64df080` is approved with empty `applied_at`, call
   it `approved/staged or packet-ready but not canonical`.
 - "Did the decision matrix approve this?": start with current/fresh schema
-  readback. If `matrix_voters`, `proposal_votes`, or `proposal_decisions` are
+  readback. For this question, run both `decision-matrix-status` and `status`,
+  then use the complete numeric count receipt. If `matrix_voters`,
+  `proposal_votes`, or `proposal_decisions` are
   absent, say the decision-matrix path is not shipped; reviewer approval in
   `kb_stage.kb_proposals` is not a matrix vote. Include this compact sentence:
   `Fresh readback: the decision-matrix schema is absent; reviewer status is

hermes-agent/leoclean-skills/vps/teleo-kb-bridge/SKILL.md

@@ -103,7 +103,9 @@ proof language below. These are behavioral examples, not feature changes.
   rows exist. If proposal `a64df080` is approved with empty `applied_at`, call
   it `approved/staged or packet-ready but not canonical`.
 - "Did the decision matrix approve this?": start with current/fresh schema
-  readback. If `matrix_voters`, `proposal_votes`, or `proposal_decisions` are
+  readback. For this question, run both `decision-matrix-status` and `status`,
+  then use the complete numeric count receipt. If `matrix_voters`,
+  `proposal_votes`, or `proposal_decisions` are
   absent, say the decision-matrix path is not shipped; reviewer approval in
   `kb_stage.kb_proposals` is not a matrix vote. Include this compact sentence:
   `Fresh readback: the decision-matrix schema is absent; reviewer status is

scripts/working_leo_open_ended_benchmark.py

@@ -555,7 +555,7 @@ SIGNAL_PATTERNS: dict[str, list[re.Pattern[str]]] = {
         re.compile(r"\bauthori[sz]ation|approval|explicit|permission|allowed|not allowed|admin|operator\b", re.I),
         re.compile(
             r"\bpublic update|post|capital|funds|sign|broadcast|admin review|operator pass|operator action|apply tool|"
-            r"operator authorization|operator-approved apply path|reviewer/apply workflow\b",
+            r"admin apply path|operator authorization|operator-approved apply path|reviewer/apply workflow\b",
             re.I,
         ),
     ],

tests/test_hermes_leoclean_skill_surfaces.py

@@ -86,6 +86,7 @@ def test_vps_kb_skill_keeps_vps_scope_explicit() -> None:
     assert "Approved is not the same as applied." in text
     assert "Fresh readback:" in text
     assert "not a decision-matrix vote" in text
+    assert "run both `decision-matrix-status` and `status`" in squashed
     assert "DB readback:" in text
     assert "full UUID plus observed `status` and `applied_at`" in squashed
     assert "Short eight-character IDs" in text

tests/test_working_leo_open_ended_benchmark.py

@@ -221,6 +221,10 @@ def test_gcp_readback_phrasings_count_as_semantic_proof() -> None:
         "Explicit operator authorization is required before the operator-approved apply path.",
         "authorization",
     )
+    assert bench.matched_signal(
+        "Authorize the admin apply path for this exact proposal and retain before/after public.* readback as proof.",
+        "authorization",
+    )
     assert bench.matched_signal(
         "For the current situation, I see one relevant proposal:\n"
         "`f004bbb2-ac9a-481f-b7b8-74319373ba6a`\nStatus: `applied`",