Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@eval/local/tasks/authoring-skill-smoke/environment/Dockerfile`:
- Around line 9-11: Replace the mutable `@latest` Claude Code install with one
exact reviewed version, preferably sourced from a shared environment or
build-time variable. Apply this change in
eval/local/tasks/authoring-skill-smoke/environment/Dockerfile lines 9-11,
eval/local/tasks/generic-skill-smoke/environment/Dockerfile lines 9-11,
eval/local/tasks/workflow-overlay-contract/environment/Dockerfile lines 11-13,
and eval/local/tasks/workflow-route-conformance/environment/Dockerfile lines
9-11, preserving the existing registry setup and cleanup.

In `@eval/local/tests/tasks/test_validation_scripts.py`:
- Around line 183-191: Update test_claude_eval_task_images_install_claude_code
to require at least one discovered Dockerfile, then validate each file for a
non-comment RUN instruction that executes npm install -g
`@anthropic-ai/claude-code` with any permitted version or arguments. Do not accept
package-name text appearing only in comments or unrelated Dockerfile content,
and preserve reporting of missing Dockerfile paths.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@eval/local/tasks/authoring-skill-smoke/environment/Dockerfile`:
- Around line 9-11: Remove the registry.npmmirror.com override before global npm
installs and use the official npm registry or an approved authenticated internal
proxy with provenance controls. Apply this to
eval/local/tasks/authoring-skill-smoke/environment/Dockerfile lines 9-11,
eval/local/tasks/generic-skill-smoke/environment/Dockerfile lines 9-11,
eval/local/tasks/workflow-overlay-contract/environment/Dockerfile lines 11-13,
eval/local/tasks/workflow-route-conformance/environment/Dockerfile lines 9-11,
and the corresponding Dockerfiles under
eval/local/tasks/comet-observability-env-template/* lines 7,
comet-noise-distractor/* lines 7, comet-persistence-threading/* lines 7, and
comet-cross-file-refactor/* lines 7; retain the global installs without an
unapproved public mirror.

In `@eval/local/tests/tasks/test_validation_scripts.py`:
- Around line 193-194: Update the validation logic that populates root_images to
determine the effective USER directive in the final Dockerfile stage, rather
than accepting any earlier non-root USER. Reject images whose final runtime user
is root or UID 0, including Dockerfiles that switch back to root after setting a
non-root user.

In `@eval/scaffold/python/validation/generic_rubric.py`:
- Around line 68-71: Update _path_exists to reject absolute paths and paths
containing parent traversal, then resolve test_dir and ensure every literal or
glob match resolves beneath it. Filter out matches whose resolved paths escape
the resolved task directory, including symlink targets, while preserving the
existing boolean result for valid in-directory matches.

---

Nitpick comments:
In `@eval/local/tests/scaffold/test_profiles.py`:
- Around line 902-924: Expand
test_generic_rubric_scores_structured_expected_artifact_paths to cover
structured artifact expectations using a singular path, multiple required paths,
and a wildcard path. Create the corresponding fixture files and assert each
variant passes through the artifact_presence rubric, while retaining the
existing literal paths coverage.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@eval/local/tests/tasks/test_tasks.py`:
- Line 471: Add focused regression coverage for the failure gate in
test_task_treatment: verify failed validation is tolerated for CONTROL
treatments, while failed validation still causes dynamic treatments to fail.
Reuse the existing treatment-classification fixtures and
_is_observational_baseline_run behavior, keeping the test scoped to this branch.

In `@test/domains/factory/factory-package.test.ts`:
- Around line 739-757: Strengthen the resolvedSkills.sourceSummaries assertion
in the factory package test to validate every mapped field: name, description,
query, platform, scope, origin, and references. Keep the existing expected entry
and add the corresponding values from the fixture or generated output so
regressions in any mapping field fail the test.