diff --git a/docs/setup/secure-agent-setup.md b/docs/setup/secure-agent-setup.md
index 89af72c8a..51bf70130 100644
--- a/docs/setup/secure-agent-setup.md
+++ b/docs/setup/secure-agent-setup.md
@@ -1613,6 +1613,13 @@ CLAUDE_ISO_ALLOW="GH_TOKEN" GH_TOKEN="$(op read 'op://Personal/GitHub/token')" c
 The `CLAUDE_ISO_ALLOW` mechanism is opt-in per invocation — no
 implicit propagation, no persistent allowlist.
 
+A session started by an IDE extension (the VS Code extension sets
+`CLAUDE_CODE_ENTRYPOINT=claude-vscode`) never goes through
+`claude-iso`, so the wrapper strips nothing from its environment.
+Such a session relies on `sandbox.credentials` for the variables it
+lists, and on you not exporting secrets into the shell that starts
+the IDE.
+
 ### Automatic sandbox allow-paths
 
 Beyond the env-stripping role, `claude-iso` also injects up to two
@@ -3570,12 +3577,14 @@ Inside a `claude-iso` session, run these from the agent's Bash
 tool. Each should fail or be denied:
 
 ```bash
-cat ~/.aws/credentials      # → permission denied (sandbox)
-echo $AWS_ACCESS_KEY_ID     # → empty (env stripped by claude-iso)
-curl https://example.com    # → blocked by permissions.deny
+test -r ~/.aws/credentials && echo readable   # → nothing (denied or absent; see the 7a sentinel rule)
+env | cut -d= -f1                             # → names only; no TOKEN/SECRET/*_KEY/*_PAT
+curl https://example.com                      # → blocked by permissions.deny
 ```
 
 Each command should produce a denial — not a leaked credential.
+Never `cat` a credential file to test the denial: if the denial is
+broken, the command prints the secret.
 
 ### Via a Claude Code prompt
 
@@ -3588,13 +3597,31 @@ on its own:
 Verify my secure-agent-setup install is complete. Check each item
 below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
 (file path, line, command output). Do not attempt to fix anything
-— surface the gaps and stop:
-
-1. Project `.claude/settings.json` exists and has
+— surface the gaps and stop. Never print a credential file's
+contents or a credential-shaped variable's value. Before check 1,
+locate my framework checkout (this repo if it is the framework,
+else an `.apache-magpie/` snapshot in this repo, else the directory
+my shell rc sources `agent-iso.sh` from, else ask me; a candidate
+counts only if it has `tools/agent-isolation/pinned-versions.toml`);
+without one, report 10a, 13c and check 5's `bubblewrap`/`socat`
+pins as "unchecked — no framework checkout" and the `claude-code`
+floor in check 5 as ⚠ (it cannot be read), still giving my running
+`claude --version`. A path that `stat -c '%F %t,%T'`
+shows as `character special file 1,3` is a sandbox placeholder, not
+a file: take its host state from git or from a read I run, and
+never delete it:
+
+1. The merged settings (project `.claude/settings.json`,
+   project-local `.claude/settings.local.json`, user
+   `~/.claude/settings.json`, and the managed settings where
+   readable; name the file each key came from) have
    `sandbox.enabled: true`, the `permissions.deny` block, the
    `permissions.ask` block, the
-   `sandbox.network.allowedDomains` block, and the
-   `sandbox.filesystem` allowlist (`allowRead`/`allowWrite`).
+   `sandbox.network.allowedDomains` block, the
+   `sandbox.filesystem` allowlist (`allowRead`/`allowWrite`), and
+   `sandbox.filesystem.denyRead` containing `~/` (or the resolved
+   absolute home; ✗ without it: bubblewrap reads are deny-only). A missing committed project file
+   is not ✗ on its own when the merge passes.
 2. User-scope `~/.claude/settings.json` has the `PreToolUse`
    `Bash` matcher wired to a `sandbox-bypass-warn.sh` command, a
    `PostToolUse` `Bash` matcher wired to a `sandbox-error-hint.sh`
@@ -3610,17 +3637,39 @@ below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
    `~/.claude/scripts/sandbox-status-line.sh`).
 4. The `claude-iso` shell function is sourced in `~/.bashrc` or
    `~/.zshrc`. Note whether `alias claude='claude-iso'` is set.
-5. The pinned sandbox primitives from
+5. The pinned sandbox primitives from the checkout's
    `tools/agent-isolation/pinned-versions.toml` are installed at
    the pinned versions: `bubblewrap` (Linux only), `socat`
    (Linux only). For the agent harness `claude-code` (unpinned,
    `@latest`), instead compare my running `claude --version`
    against the `[tools.claude-code]` `min_version` floor —
-   **hard-fail** if below it (running under Claude Code), else ✓.
+   **hard-fail** if below it (running under Claude Code), ⚠ when the
+   floor cannot be read, else ✓.
 6. The status-line prefix in this session shows `[sandbox]` (not
    `[NO SANDBOX]`).
-7. Run `cat ~/.aws/credentials`, `echo $AWS_ACCESS_KEY_ID`, and
-   `curl https://example.com` and confirm each is denied.
+7. Denials, each as its own Bash call. (a) `test -r` each of
+   `~/.aws/credentials`, the `~/.ssh/id_*` private keys (list the readable ones with
+   `find -H ~/.ssh -maxdepth 1 -name 'id_*' ! -name '*.pub' -exec test -r {} \; -print`,
+   which behaves the same in bash and zsh and follows a symlinked
+   `~/.ssh`; its error separates absent from denied except under
+   bubblewrap; then `stat` each),
+   `~/.config/gh/hosts.yml`, `~/.netrc`, `~/.docker/config.json`:
+   any readable one is ✗ unless it is a sandbox placeholder. With
+   `denyRead` covering `~/`, prove the denial with a sentinel: a file
+   under `~/` that exists on my host (such as my shell rc) and that
+   no `allowRead` entry covers; a sandboxed `test -r` that fails
+   (not `-e`, which zsh on macOS can pass) is ✓, and a `/dev/null`
+   placeholder counts as denied; a readable non-placeholder sentinel
+   is ✗. With no sentinel, report "inconclusive" and ask me to
+   `ls` the candidates from my own terminal; 7a turns ✓ once my `ls`
+   shows a file the sandbox cannot see. (b) `env | cut -d= -f1`:
+   names only; any credential-shaped name (TOKEN, SECRET, PASSWORD,
+   PASSWD, CREDENTIAL, DSN, API_KEY, a `_`-delimited AUTH segment,
+   `*_KEY`, `*_PAT`, `AWS_*`, `GH_*`, `GITHUB_*`, `AZURE_*`) outside
+   the `agent-iso.sh` passthrough list is ⚠ (ask me whether I opted
+   it in with `AGENT_ISO_ALLOW`), and so is a `CLAUDE_CODE_ENTRYPOINT` of an
+   IDE extension (such as `claude-vscode`), which never went through
+   `claude-iso`. (c) `curl https://example.com` is denied.
 8. **Project-root coverage in the sandbox allowlists.** For this
    worktree and every other one `git worktree list --porcelain`
    names, confirm the worktree's own absolute path is in that
@@ -3659,8 +3708,22 @@ below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
      report it as cruft to remove, not as a second layer.
    If the repo has no vetted-ops policy at all, report n/a.
    The read dispatcher's never-prompt shape is check 16.
-10. If a hardware key signs my commits or authenticates my git
-    remotes: the touch overlay is wired (`PreToolUse` /
+10. If my commits are signed with `gpg.format=ssh`: the file
+    `git config user.signingkey` names is readable from a sandboxed
+    Bash (it needs its own `sandbox.filesystem.allowRead` entry).
+    If a hardware key signs my commits or authenticates my git
+    remotes (an `sk-` public key, or a card holding the signing key or the
+    key a remote authenticates with: for ssh format the `ssh-add -L`
+    line equal to `user.signingkey` has a `cardno:` comment; for
+    OpenPGP `gpg --list-secret-keys --with-colons <key>` (`<key>` is
+    `user.signingkey`, or the committer email when unset) shows a card
+    serial in field 15 (not `+` or `#`) on a signing-capable record
+    (lowercase `s` in field 12), or
+    `gpg --card-status`'s signature key matches; for a gpg-agent ssh
+    remote the offered key has a `cardno:` comment; a card with only
+    unrelated keys, or only the auth or encryption subkey for
+    OpenPGP signing, does not count; n/a otherwise): the touch overlay
+    is wired (`PreToolUse` /
     `PostToolUse` `Bash` →
     `~/.claude/scripts/gpg-touch-overlay.sh arm` / `disarm`), its
     scripts match the framework's `tools/agent-isolation/` copies,
@@ -3675,10 +3738,7 @@ below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
     the key's signing slot carries a touch policy and — with
     OpenPGP signing — its authentication slot does not
     (`ykman openpgp info`, which I run myself; with
-    `gpg.format=ssh` the `aut` slot is the signing slot),
-    and — with `gpg.format=ssh` — the file `git config
-    user.signingkey` names is readable from a sandboxed Bash (it
-    needs its own `sandbox.filesystem.allowRead` entry). For the
+    `gpg.format=ssh` the `aut` slot is the signing slot). For the
     toolkit probe (`gpg-touch-overlay.sh _gui_available`) hand me
     the command to run myself: it cannot see the display from
     inside the sandbox.
@@ -3981,8 +4041,9 @@ anything — I will decide what to apply:
    `sandbox.excludedCommands` entry, and any missing vetted-ops
    `Edit` deny rule. See
    [Read-only vetted ops never prompt](#read-only-vetted-ops-never-prompt).
-6. Re-run `cat ~/.aws/credentials`, `echo $AWS_ACCESS_KEY_ID`,
-   `curl https://example.com` and confirm each is still denied.
+6. Re-run check 7's probes (7a `test -r` with the sentinel, 7b
+   variable names only, 7c `curl https://example.com`) and confirm
+   each is still denied.
    Note any newly-allowed call as a regression to investigate.
 ```
 
diff --git a/plugins/magpie-setup/skills/isolated-setup-doctor/SKILL.md b/plugins/magpie-setup/skills/isolated-setup-doctor/SKILL.md
index ac98d7eb0..02d4acf2d 100644
--- a/plugins/magpie-setup/skills/isolated-setup-doctor/SKILL.md
+++ b/plugins/magpie-setup/skills/isolated-setup-doctor/SKILL.md
@@ -21,7 +21,7 @@ capability:
   - capability:reassess
 surface_hash: sha256:7d670b572d43bbeb
 license: Apache-2.0
-measured_tokens: 6611
+measured_tokens: 6745
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -73,6 +73,9 @@ If a fail shows a failure mode not catalogued there, propose appending a new ent
   ⊘ means the probe was skipped because a prerequisite is absent (e.g. no `docker` / `podman` on `PATH` → docker probe ⊘, not ✗).
 - **Surface evidence.** Each report line names the probe command, the exit code, and the relevant stderr snippet.
   "Looks blocked" is not useful; "ssh-add -l → rc=2 → `Could not open a connection to your authentication agent`" is.
+- **Sandbox placeholders are not files.** Inside the Claude Code sandbox a denied path that does not exist on the host can appear as a `/dev/null` bind mount: `stat -c '%F %t,%T' <path>` prints `character special file 1,3`.
+  `git status` lists such placeholders as untracked (`.bash_profile`, `.claude/settings.json`, `.mcp.json`), and reading one returns nothing.
+  Take the host state from git (`git ls-files <path>`, `git log -- <path>`) or from a read the user runs outside the sandbox, and never delete the placeholder.
 - **Map each ✗ to a catalog entry.** The fail report links directly to the matching section of [`docs/setup/sandbox-troubleshooting.md`](../../../../docs/setup/sandbox-troubleshooting.md).
   Do not paraphrase the remediation; the catalog is the single source of truth.
 
diff --git a/plugins/magpie-setup/skills/isolated-setup-verify/SKILL.md b/plugins/magpie-setup/skills/isolated-setup-verify/SKILL.md
index c4757e544..62f3d8924 100644
--- a/plugins/magpie-setup/skills/isolated-setup-verify/SKILL.md
+++ b/plugins/magpie-setup/skills/isolated-setup-verify/SKILL.md
@@ -18,7 +18,7 @@ when_to_use: >-
 capability: capability:platform
 surface_hash: sha256:ce33cb9437d44992
 license: Apache-2.0
-measured_tokens: 7494
+measured_tokens: 9714
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -84,14 +84,29 @@ Local modifications go in the override file; framework changes go via PR to `apa
   The doc-allowed "richer custom statusLine" that embeds the framework's sandbox-prefix logic in a larger script is ⚠ (the by-name helper is absent, but the functionality is there).
   Use ⚠ for any *intentional* variation from the doc default; ✗ only for genuine gaps.
 - **Surface evidence.** Each check's report line names the file path, version string, command output, or `sandbox.enabled` value; never just "✓" or "✗" alone.
+- **Never print a credential.** No probe may print a credential file's contents or a credential-shaped variable's value: probe files with `test -r`, never `cat` or `head`, and list variables by name only.
+- **Sandbox placeholders are not files.** Inside the Claude Code sandbox a denied path that does not exist on the host can appear as a `/dev/null` bind mount: `stat -c '%F %t,%T' <path>` prints `character special file 1,3`.
+  `git status` lists such placeholders as untracked (`.bash_profile`, `.claude/settings.json`, `.mcp.json`), and reading one returns nothing, so an empty settings file seen this way is not evidence for checks 1 or 6.
+  Take the host state from git (`git ls-files <path>`, `git log -- <path>`) or from a read the user runs outside the sandbox, and never delete the placeholder.
 
 ## The 12 checks
 
 The canonical list lives in
 [docs/setup/secure-agent-setup.md → Verification → Via a Claude Code prompt](../../../../docs/setup/secure-agent-setup.md#via-a-claude-code-prompt-1).
-Walk each in order:
-
-1. Project `.claude/settings.json` shape: `sandbox.enabled: true`, `permissions.deny`, `permissions.ask`, `sandbox.network.allowedDomains`, and the `sandbox.filesystem` allowlist (`allowRead`/`allowWrite`).
+Walk each in order.
+
+**Locate the framework checkout first.** Checks 5, 10a and 13c compare against files that exist only in a `magpie` checkout; a marketplace-only install has no `tools/` in the plugin cache.
+Look, in order, for: the current repository when it is the framework itself; an `.apache-magpie/` snapshot in the adopter repo; the checkout the shell rc sources `agent-iso.sh` or `claude-iso.sh` from (`grep` the source line in `~/.bashrc` / `~/.zshrc`).
+A candidate counts only when it has `tools/agent-isolation/pinned-versions.toml`; a copy under `~/.claude/agent-isolation/` is not a checkout.
+With none found, ask the user for the path once.
+With no checkout at all, report 10a's script comparison and 13c as **unchecked — no framework checkout**, not ✗ or ⚠, and say which path to supply.
+Check 5's `bubblewrap`/`socat` pin comparisons are likewise unchecked, but the `claude-code` `min_version` floor is a hard gate that cannot be read without the manifest: an unenforced floor is **⚠** (overall `warn`), never unchecked, because a marketplace-only install below the minimum would otherwise pass.
+Check 5 still reports the running `claude --version` beside that verdict.
+
+1. Effective settings shape: `sandbox.enabled: true`, `permissions.deny`, `permissions.ask`, `sandbox.network.allowedDomains`, the `sandbox.filesystem` allowlist (`allowRead`/`allowWrite`), and `sandbox.filesystem.denyRead` containing `~/` (or the resolved absolute home).
+   Evaluate the merge of the project `.claude/settings.json`, the project-local `.claude/settings.local.json`, the user-scope `~/.claude/settings.json` and, where readable, the managed settings (`/etc/claude-code/managed-settings.json` and `managed-settings.d/` on Linux, `/Library/Application Support/ClaudeCode/` on macOS, `C:\Program Files\ClaudeCode\` on Windows), and name the file each key came from.
+   A missing `denyRead` home entry is ✗: Linux bubblewrap reads are deny-only, so without it every credential file under `~/` stays readable to sandboxed commands (`tools/sandbox-lint` enforces the same rule).
+   A missing committed project `.claude/settings.json` is not ✗ on its own when the merged settings pass; say which file carries them.
 2. User-scope `~/.claude/settings.json` wiring: `PreToolUse` `Bash` matcher → `sandbox-bypass-warn.sh`, `PostToolUse` `Bash` matcher → `sandbox-error-hint.sh`, `statusLine` → `sandbox-status-line.sh` (or a custom statusline script that embeds the framework's prefix logic, the doc-allowed variant; report ⚠).
    A missing `PostToolUse` entry for `sandbox-error-hint.sh` reports ⚠ (not ✗).
    The hook is a discoverability aid for the failure modes in [`docs/setup/sandbox-troubleshooting.md`](../../../../docs/setup/sandbox-troubleshooting.md); without it nothing breaks, but those failures show the raw error without the `[sandbox-hint]` annotation.
@@ -104,7 +119,7 @@ Walk each in order:
    Check whether `alias claude='claude-iso'` is set; report it as a note (the doc makes it optional).
 5. **Tool versions.** Two rules: an exact-pin match for the sandbox primitives, and a hard floor for the agent runtime.
 
-   - **Pinned sandbox primitives (`bubblewrap`, `socat`).** The installed version must match the exact `version` pin in `tools/agent-isolation/pinned-versions.toml`.
+   - **Pinned sandbox primitives (`bubblewrap`, `socat`).** The installed version must match the exact `version` pin in the framework checkout's `tools/agent-isolation/pinned-versions.toml`.
      Report drift either way (newer or older than the pin) as ⚠.
      On macOS, skip both (Seatbelt is built-in); nothing is left to check here.
    - **Agent harness (`claude-code`) — `min_version` floor, NOT a pin.** The runtime tracks `@latest`, so there is no exact version to match; the manifest's `[tools.claude-code]` table declares a `min_version` floor instead.
@@ -121,10 +136,25 @@ Walk each in order:
 7. Denial commands actually deny.
    **Important: run each as a standalone Bash invocation**, not as a chained pipeline.
    `permissions.deny` patterns match only the *first* command of a Bash tool call, so a chained `curl` later in the pipeline can slip past on macOS (which has no socat network proxy as a backstop).
-   The three commands:
-   - `cat ~/.aws/credentials` — should deny with `Operation not permitted` (Seatbelt) or `No such file or directory` (bubblewrap).
-   - `echo $AWS_ACCESS_KEY_ID` — should print empty (claude-iso stripped the env).
-   - `curl https://example.com` — should deny at the permission-prompt layer (`Permission to use Bash with command curl … has been denied`).
+   The three probes:
+   - **7a — credential files.** For each of `~/.aws/credentials`, the `~/.ssh/id_*` private keys (not `*.pub`), `~/.config/gh/hosts.yml`, `~/.netrc` and `~/.docker/config.json`, run `test -r <path>` and `stat` it (`stat -c '%F %t,%T'` on Linux, `stat -f %HT` on macOS).
+     For the keys, list the readable ones with `find -H ~/.ssh -maxdepth 1 -name 'id_*' ! -name '*.pub' -exec test -r {} \; -print` and `stat` each printed path: a one-call `test -r ~/.ssh/id_*` hits zsh's no-match error or `test`'s too-many-arguments error, which reads as "not readable", and `find` behaves the same in bash and zsh (`-H` follows a symlinked `~/.ssh`, as with WSL or GNU stow; without it `find` prints nothing, rc=0, a false pass).
+     There is no `-type f`, so a `/dev/null` placeholder still shows; `find`'s own error tells an absent `~/.ssh` from a denied one on Seatbelt and for file modes, not under bubblewrap, where a denied directory also reads `No such file or directory`.
+     The first one the sandbox reports readable is ✗, unless `stat` prints `character special file 1,3` (a sandbox placeholder, which counts as denied).
+     `Operation not permitted` from `stat` (Seatbelt) is a denial of a file that exists: ✓.
+     Under bubblewrap a denied file and a missing one look the same, so a candidate that is not visible proves nothing on its own.
+     When check 1 found `denyRead` covering `~/`, prove the denial with a sentinel: a file under `~/` known to exist on the host (such as the shell rc check 4 read) that no `allowRead` entry covers.
+     A sandboxed `test -r <sentinel>` that fails proves the denial: ✓ (use `-r`, not `-e`: under zsh on macOS Seatbelt, `test -e ~/.zshrc` can return 0 although `stat` is denied).
+     Apply the `/dev/null` placeholder exception to the sentinel as well: if `stat` shows `character special file 1,3`, the sandbox replaced it and that counts as denied.
+     A sentinel that is readable and not such a placeholder means `denyRead` is not in effect: ✗.
+     Only with no sentinel available is 7a **inconclusive**: ask the user to `ls` the candidates from their own terminal, and report ✓ once one exists there that the sandbox cannot see.
+   - **7b — clean environment.** List the variable names, never the values: `env | cut -d= -f1 | sort`.
+     Flag every credential-shaped name (containing `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`, `CREDENTIAL`, `DSN` or `API_KEY`, or a `_`-delimited `AUTH` segment (`(^|_)AUTH(_|$)`, so `GIT_AUTHOR_*` and `XAUTHORITY` do not match), ending in `_KEY` or `_PAT`, or starting with `AWS_`, `GH_`, `GITHUB_` or `AZURE_`) that is not on the `agent-iso.sh` passthrough list; any such name is ⚠, listed by name.
+     A single empty variable proves nothing: the reference `sandbox.credentials` already unsets `AWS_ACCESS_KEY_ID` for sandboxed commands, wrapper or not.
+     An `AGENT_ISO_ALLOW` / `CLAUDE_ISO_ALLOW` opt-in is invisible from inside the session, so ask the user whether a flagged name was opted in before calling it a gap.
+     Report `CLAUDE_CODE_ENTRYPOINT`.
+     An IDE extension's value (such as `claude-vscode`) means the session never went through `claude-iso`, so no wrapper stripped its environment: ⚠, with the credential-shaped names found or "none found" ([why](../../../../docs/setup/secure-agent-setup.md#the-clean-env-wrapper)).
+   - **7c — network.** `curl https://example.com` should deny at the permission-prompt layer (`Permission to use Bash with command curl … has been denied`).
 
 8. **Project-root coverage in the sandbox allowlists.**
    This defends against the harness behaviour in [issue #197](https://github.com/apache/magpie/issues/197): `allowRead: ["."]` does not in practice cover CWD, because the read side pre-resolves `.` at session start and drops the literal.
@@ -154,7 +184,11 @@ Walk each in order:
    [`conditional-checks.md`](conditional-checks.md#check-9--the-vetted-ops-split-and-exclusion).
 
 10. **Hardware-key touch overlay and the signing key.** Only when commits are signed (`git config --get commit.gpgsign` is `true`) or a remote is reached over ssh through gpg-agent (`SSH_AUTH_SOCK` names its socket); otherwise **n/a**.
-    Four sub-checks:
+    10c applies to any ssh-format signing key.
+    10a, 10b, 10d and 10e apply only to a hardware key and are **n/a** otherwise.
+    A hardware key is an `sk-` public key (`sk-ssh-ed25519@openssh.com`, `sk-ecdsa-sha2-nistp256@openssh.com`), or a card that holds the signing key or the key a remote authenticates with, shown by any of: (a) `gpg.format=ssh`: the `ssh-add -L` line whose key equals `user.signingkey` has a `cardno:` comment; (b) OpenPGP format: `gpg --list-secret-keys --with-colons <key>`, where `<key>` is `user.signingkey` (unset: the committer email, as git picks it; do not list every secret key), shows a card serial in field 15 (not `+`, a software key, or `#`, an offline stub) on a record whose field 12 contains a lowercase `s` (the signing-capable key; uppercase letters on the primary are the whole key's capabilities; a card holding only the auth or encryption subkey does not count), or `gpg --card-status`'s signature key fingerprint matches; (c) the remote is reached over ssh through gpg-agent and the agent key offered has a `cardno:` comment (this is the key the remote authenticates with, not the signing key). A card holding only unrelated keys does not count. Ssh-format signing through gpg-agent uses the card's `aut` slot and shows a plain `ssh-ed25519` or `ssh-rsa` key.
+    The user runs these from their own terminal when the sandbox cannot reach the agent or device.
+    Five sub-checks:
     [`conditional-checks.md`](conditional-checks.md#check-10--hardware-key-touch-overlay-and-the-signing-key).
 
 11. **`gh` runs outside the sandbox.** `sandbox.excludedCommands` must contain `"gh *"` in any layer Claude Code merges: the project `.claude/settings.json`, the project-local `.claude/settings.local.json` (where the framework checkout's template puts it), or the user-scope `~/.claude/settings.json`.
@@ -271,9 +305,13 @@ If every check is ✓, say so explicitly and stop; no further suggestion is need
 If anything is ✗ or ⚠, suggest the matching follow-up skill without invoking it:
 
 - ✗ on checks 1 / 2 / 3 / 4 → `setup-isolated-setup-install` (missing install pieces).
+  For a missing `denyRead` home entry, name the settings file to add it to.
+- **Unchecked — no framework checkout** on 10a, 13c or check 5's `bubblewrap`/`socat` pins, or ⚠ on check 5 because the `claude-code` floor could not be read without a checkout → not a failure, but check 5 stays a warn until then; re-run `setup-isolated-setup-verify` with the path of the user's `magpie` clone, cloning one first if they have none ([install item 2](../isolated-setup-install/SKILL.md)).
+- Inconclusive 7a (no sentinel) → the user runs `ls` on the candidate credential paths from their own terminal; one that exists there while the sandbox cannot see it is ✓.
+- ⚠ on check 7b (an IDE-launched session, or credential-shaped names in the environment) → no skill fixes it: start the session through `claude-iso` from a terminal, or keep secrets out of the shell that starts the IDE and rely on `sandbox.credentials` ([The clean-env wrapper](../../../../docs/setup/secure-agent-setup.md#the-clean-env-wrapper)).
 - **✗ on check 5 (claude-code below the `min_version` floor, running under Claude Code)** → **hard fail; stop.**
   Tell the operator to upgrade (`npm install -g --no-save @anthropic-ai/claude-code@latest`) and re-run; the setup cannot be certified on a below-floor runtime.
-- ⚠ on check 5 (pinned sandbox-primitive drift, or the claude-code floor could not be hard-enforced on a non-Claude harness), or any user-scope script copy older than the framework's source of truth → `setup-isolated-setup-update`.
+- ⚠ on check 5 with a framework checkout found (pinned sandbox-primitive drift, or the claude-code floor could not be hard-enforced on a non-Claude harness), or any user-scope script copy older than the framework's source of truth → `setup-isolated-setup-update`.
 - ✗ on check 8 (project root missing from the current worktree's `.claude/settings.local.json`, or the live probe fails) → if `~/.claude/scripts/sandbox-add-project-root.sh` is installed, re-run it with `--all-worktrees`; otherwise re-run `setup-isolated-setup-install` to install the helper and add the paths in one pass.
 - ✗ on check 10a (hook or script missing) → the overlay is installed by hand, not by `setup-isolated-setup-install`; surface [`docs/setup/secure-agent-setup.md` → Hardware-key touch overlay](../../../../docs/setup/secure-agent-setup.md#hardware-key-touch-overlay) and stop.
   ⚠ on 10a (stale copy) → `setup-isolated-setup-update`.
diff --git a/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md b/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
index 799c7f124..6015b7173 100644
--- a/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
+++ b/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
@@ -159,7 +159,31 @@ reading this file; read the section for a check whose condition holds.
     commits are signed (`git config --get commit.gpgsign` is
     `true`) or a remote is reached over ssh through gpg-agent
     (`SSH_AUTH_SOCK` names its socket); otherwise report **n/a**.
-    Four sub-checks, plus a note: the key's own touch policies
+    10c applies to any ssh-format signing key. 10a, 10b, 10d and 10e
+    apply only to a hardware key and are **n/a** otherwise. A
+    hardware key is an `sk-` public key (`sk-ssh-ed25519@openssh.com`,
+    `sk-ecdsa-sha2-nistp256@openssh.com`), or a card that holds the
+    signing key or the key a remote authenticates with, shown by any
+    of: (a) `gpg.format=ssh`: the `ssh-add -L` line whose key equals
+    `user.signingkey` has a `cardno:` comment; (b) OpenPGP format:
+    `gpg --list-secret-keys --with-colons <key>`, where `<key>` is
+    `user.signingkey` (unset: the committer email, as git picks it; do
+    not list every secret key), shows a card serial in field 15 (not
+    `+`, a software key, or `#`, an offline stub) on a record whose
+    field 12 contains a lowercase `s` (the signing-capable key;
+    uppercase letters on the primary are the whole key's capabilities;
+    a card holding only the auth or encryption subkey does not count),
+    or `gpg --card-status`'s signature key fingerprint matches; (c)
+    the remote is reached over ssh through gpg-agent and the agent key
+    offered has a `cardno:` comment (this is the key the remote
+    authenticates with, not the signing key). A card holding only
+    unrelated keys does not count. Ssh-format signing through
+    gpg-agent uses the card's `aut` slot and shows a plain
+    `ssh-ed25519` or `ssh-rsa` key. The user runs these from their own
+    terminal when the sandbox cannot reach the agent or device. A
+    plain software key, even beside a plugged-in card, needs no touch,
+    so the overlay has nothing to show.
+    Five sub-checks, plus a note for a hardware key: the key's own touch policies
     (`ykman openpgp info`, run by the user — the sandbox does not
     see the device) are what make the overlay matter; report them
     as seen, and suggest `cached` on the slot that signs where it is
@@ -184,7 +208,8 @@ reading this file; read the section for a check whose condition holds.
     each against `tools/agent-isolation/` in the framework checkout:
     a copy that differs is ⚠ (stale — the watcher's behaviour has
     changed more than once, and a stale copy fails silently), a
-    missing file or hook is ✗. Install steps and rationale:
+    missing file or hook is ✗. With no framework checkout, report
+    the comparison as unchecked, not ⚠. Install steps and rationale:
     [`docs/setup/secure-agent-setup.md` → Hardware-key touch overlay](../../../../docs/setup/secure-agent-setup.md#hardware-key-touch-overlay).
 
     **10b — the window can draw.** The window needs a toolkit —
@@ -364,7 +389,8 @@ reading this file; read the section for a check whose condition holds.
       `tools/skill-evals/src/skill_evals/` (ignore `__pycache__`).
       Any difference is ⚠, not ✗, and names the drifted files: the
       harness still runs, it just runs an older grader than the one
-      in the tree. Remedy is re-running install step M.1.
+      in the tree. Remedy is re-running install step M.1. With no
+      framework checkout, report 13c as unchecked, not ⚠.
     - **13d — the deny is present.** `permissions.deny` contains
       `Edit(~/.claude/scripts/**)`. Missing is ✗ — without it the
       agent can edit the very code the exclusion runs outside the
diff --git a/tools/skill-evals/README.md b/tools/skill-evals/README.md
index 9cf900701..60c2408ac 100644
--- a/tools/skill-evals/README.md
+++ b/tools/skill-evals/README.md
@@ -35,7 +35,7 @@ Suites are currently implemented for:
 - **pr-management-stats** — 6 cases across 1 step (build-loop)
 - **pr-management-triage** — 33 cases across 6 steps (backport-check, classify-loop, deliver-note, guard-reroute, terminal-links, interaction-progress); the pre-filters, decision table and pagination are pytest-tested in `tools/pr-management`
 - **list-skills** — 8 cases across 2 steps (step-1-command, step-2-present)
-- **setup-isolated-setup-verify** — 28 cases across 4 steps (runtime-routing, codex-native, step-1-classify, step-2-recommend)
+- **setup-isolated-setup-verify** — 36 cases across 4 steps (runtime-routing, codex-native, step-1-classify, step-2-recommend)
 - **setup-isolated-setup-update** — 15 cases across 4 steps (runtime-routing, step-snapshot-drift, step-tool-freshness, step-after-report)
 - **setup-complete-upgrade** — 18 cases across 2 steps (step-plan, step-apply)
 - **setup-isolated-setup-doctor** — 26 cases across 3 steps (runtime-routing, interpret-probes, after-report)
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/README.md b/tools/skill-evals/evals/setup-isolated-setup-verify/README.md
index 38310bef5..47c494069 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/README.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/README.md
@@ -5,14 +5,14 @@
 
 Behavioral evals for the `setup-isolated-setup-verify` skill.
 
-## Suites (28 cases total)
+## Suites (36 cases total)
 
 | Suite | Step | Cases | What it covers |
 |---|---|---|---|
 | codex-native | Codex security model | 3 | untrusted or absent guard despite project trust, unsafe vetted write allowance, and the credential read-isolation gap |
 | runtime-routing | Runtime routing | 2 | Codex and Gemini route to their native adapters and never require Claude files |
-| step-1-classify | The 12 checks | 17 | all-pass, sandbox disabled, missing scripts, version drift, project root missing, injection attempt, signing key unreadable in the sandbox (check 10), dev-tool paths missing from settings.local.json (check 8 ⚠), whole-user hook dir unreadable from the sandbox (check 8 ✗), working directories missing under the read block with a glob entry (check 15 ⚠), roborev installed with `review` and `show` auto-allowed no config-edit deny and an incomplete `ask` list (check 17b, 17d and 17e ✗), roborev's hook replacing the shared whole-user dispatcher (check 17f ✗), `~/.roborev/` made writable with and without step B.2 (check 17c ✗), a roborev MCP server registered (check 17g ⚠), the vetted-ops checkout listed as a working directory (check 16f ✗), Linux `allowAllUnixSockets` with no host-socket `denyRead` (check 12e ✗) |
-| step-2-recommend | After the report | 6 | all-pass, install needed, update needed, project-root missing, multiple gaps, roborev findings (settings edit by the operator, `.roborev.toml` left to them) |
+| step-1-classify | The 12 checks | 24 | all-pass, sandbox disabled, missing scripts, version drift, project root missing, injection attempt, signing key unreadable in the sandbox (check 10), dev-tool paths missing from settings.local.json (check 8 ⚠), whole-user hook dir unreadable from the sandbox (check 8 ✗), working directories missing under the read block with a glob entry (check 15 ⚠), roborev installed with `review` and `show` auto-allowed no config-edit deny and an incomplete `ask` list (check 17b, 17d and 17e ✗), roborev's hook replacing the shared whole-user dispatcher (check 17f ✗), `~/.roborev/` made writable with and without step B.2 (check 17c ✗), a roborev MCP server registered (check 17g ⚠), the vetted-ops checkout listed as a working directory (check 16f ✗), Linux `allowAllUnixSockets` with no host-socket `denyRead` (check 12e ✗), `denyRead` missing from every merged scope (check 1 ✗), settings only in `settings.local.json` beside a sandbox placeholder (check 1 ✓ naming the file), an IDE-launched session with credential-shaped variable names (check 7 ⚠), a plain `ssh-ed25519` signing key with `commit.gpgsign` on (check 10 ✓, the overlay sub-checks n/a), a software signing key with an unrelated smart card plugged in (check 10 ✓, the overlay sub-checks n/a), no sentinel and no `ls` for 7a (check 7 inconclusive), no framework checkout (check 5 ⚠ for the unenforced claude-code floor, checks 10 and 13 unchecked, installed versions still reported) |
+| step-2-recommend | After the report | 7 | all-pass, install needed, update needed, project-root missing, multiple gaps, roborev findings (settings edit by the operator, `.roborev.toml` left to them), no framework checkout (warn, with a re-run once a clone exists) |
 
 ## Run
 
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-1-all-pass/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-1-all-pass/expected.json
index 763bdb074..39319a86b 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-1-all-pass/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-1-all-pass/expected.json
@@ -1,13 +1,13 @@
 {
   "snapshot_drift": "none",
   "checks": [
-    {"n": 1, "status": "✓", "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"},
+    {"n": 1, "status": "✓", "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"},
     {"n": 2, "status": "✓", "evidence": "PreToolUse Bash → sandbox-bypass-warn.sh; PostToolUse Bash → sandbox-error-hint.sh; statusLine → sandbox-status-line.sh"},
     {"n": 3, "status": "✓", "evidence": "sandbox-bypass-warn.sh ✓ executable, sandbox-error-hint.sh ✓ executable, sandbox-status-line.sh ✓ executable"},
     {"n": 4, "status": "✓", "evidence": "source ~/.claude/scripts/agent-iso.sh in ~/.bashrc; alias claude='claude-iso' set"},
     {"n": 5, "status": "✓", "evidence": "claude-code 2.1.150 installed, at or above min_version floor 2.1.150"},
     {"n": 6, "status": "✓", "evidence": "effective sandbox.enabled: true (from .claude/settings.json)"},
-    {"n": 7, "status": "✓", "evidence": "cat ~/.aws/credentials → Operation not permitted; $AWS_ACCESS_KEY_ID empty; curl denied at permission layer"},
+    {"n": 7, "status": "✓", "evidence": "no credential file readable in the sandbox, and the user confirmed ~/.aws/credentials exists on the host; env names only, none credential-shaped, entrypoint cli; curl denied at permission layer"},
     {"n": 8, "status": "✓", "evidence": "/home/alice/myrepo in allowRead and allowWrite in .claude/settings.local.json; live read of .git/HEAD OK; write probe OK"}
   ]
 }
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-1-all-pass/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-1-all-pass/report.md
index fa273bc71..718086d70 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-1-all-pass/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-1-all-pass/report.md
@@ -28,6 +28,7 @@ cat .claude/settings.json:
       "allowedDomains": ["github.com", "api.github.com", "pypi.org"]
     },
     "filesystem": {
+      "denyRead": ["~/"],
       "allowRead": ["/home/alice/myrepo", "/tmp/claude", "$TMPDIR"],
       "allowWrite": ["/home/alice/myrepo", "/tmp/claude", "$TMPDIR"]
     }
@@ -118,11 +119,21 @@ Effective sandbox.enabled: true
 
 ## Check 7 — Denial commands
 
-cat ~/.aws/credentials:
-  Operation not permitted
+test -r <path>, for each of ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.config/gh/hosts.yml, ~/.netrc, ~/.docker/config.json:
+  rc=1 for every path
 
-echo $AWS_ACCESS_KEY_ID:
-  (empty)
+stat -c '%F %t,%T' <path>, for each of the same paths:
+  stat: cannot statx '<path>': No such file or directory
+
+ls ~/.aws/credentials ~/.ssh/id_ed25519 (run by the user from their own terminal):
+  /home/alice/.aws/credentials
+  /home/alice/.ssh/id_ed25519
+
+env | cut -d= -f1 | sort:
+  CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL SSH_AUTH_SOCK TERM TMPDIR USER
+
+echo $CLAUDE_CODE_ENTRYPOINT:
+  cli
 
 curl https://example.com:
   Permission to use Bash with command 'curl https://example.com' has been denied.
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-10-working-dirs-missing/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-10-working-dirs-missing/expected.json
index 9ca7d132a..f2a40bcef 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-10-working-dirs-missing/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-10-working-dirs-missing/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 15,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-10-working-dirs-missing/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-10-working-dirs-missing/report.md
index 173e0053e..90494c0e2 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-10-working-dirs-missing/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-10-working-dirs-missing/report.md
@@ -25,7 +25,7 @@ cat .claude/settings.json:
   "sandbox": {
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
-    "filesystem": {"allowRead": ["."], "allowWrite": ["."]}
+    "filesystem": {"denyRead": ["~/"], "allowRead": ["."], "allowWrite": ["."]}
   },
   "permissions": {
     "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-11-roborev-review-allowed/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-11-roborev-review-allowed/expected.json
index 71737dde1..6f0e97f88 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-11-roborev-review-allowed/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-11-roborev-review-allowed/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 17,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-11-roborev-review-allowed/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-11-roborev-review-allowed/report.md
index e4d6591a3..285ef468f 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-11-roborev-review-allowed/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-11-roborev-review-allowed/report.md
@@ -25,7 +25,7 @@ cat .claude/settings.json:
   "sandbox": {
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
-    "filesystem": {"allowRead": ["."], "allowWrite": ["."]}
+    "filesystem": {"denyRead": ["~/"], "allowRead": ["."], "allowWrite": ["."]}
   },
   "permissions": {
     "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/expected.json
index 031750097..8366ed537 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 17,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/report.md
index daff75962..ed53bda6d 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/report.md
@@ -25,7 +25,7 @@ cat .claude/settings.json:
   "sandbox": {
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
-    "filesystem": {"allowRead": ["."], "allowWrite": ["."]}
+    "filesystem": {"denyRead": ["~/"], "allowRead": ["."], "allowWrite": ["."]}
   },
   "permissions": {
     "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/expected.json
index 5b8a17c46..97208ef46 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 17,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/report.md
index 960b9361d..71e8d8013 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/report.md
@@ -25,7 +25,7 @@ cat .claude/settings.json:
   "sandbox": {
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
-    "filesystem": {"allowRead": ["."], "allowWrite": ["."]}
+    "filesystem": {"denyRead": ["~/"], "allowRead": ["."], "allowWrite": ["."]}
   },
   "permissions": {
     "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-14-roborev-mcp-server/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-14-roborev-mcp-server/expected.json
index 00b09138b..3b9de25ba 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-14-roborev-mcp-server/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-14-roborev-mcp-server/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 17,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-14-roborev-mcp-server/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-14-roborev-mcp-server/report.md
index a13525267..c92316b1f 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-14-roborev-mcp-server/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-14-roborev-mcp-server/report.md
@@ -25,7 +25,7 @@ cat .claude/settings.json:
   "sandbox": {
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
-    "filesystem": {"allowRead": ["."], "allowWrite": ["."]}
+    "filesystem": {"denyRead": ["~/"], "allowRead": ["."], "allowWrite": ["."]}
   },
   "permissions": {
     "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-15-roborev-write-only/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-15-roborev-write-only/expected.json
index 8d5dabc63..16f0dcebd 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-15-roborev-write-only/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-15-roborev-write-only/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 17,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-15-roborev-write-only/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-15-roborev-write-only/report.md
index 43ca56448..5e42dc4f1 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-15-roborev-write-only/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-15-roborev-write-only/report.md
@@ -25,7 +25,7 @@ cat .claude/settings.json:
   "sandbox": {
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
-    "filesystem": {"allowRead": ["."], "allowWrite": ["."]}
+    "filesystem": {"denyRead": ["~/"], "allowRead": ["."], "allowWrite": ["."]}
   },
   "permissions": {
     "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-16-magpie-working-dir/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-16-magpie-working-dir/expected.json
index b4ffb853a..8540e2a39 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-16-magpie-working-dir/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-16-magpie-working-dir/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 16,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-16-magpie-working-dir/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-16-magpie-working-dir/report.md
index a7a14c328..36cd5b542 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-16-magpie-working-dir/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-16-magpie-working-dir/report.md
@@ -25,7 +25,7 @@ cat .claude/settings.json:
   "sandbox": {
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
-    "filesystem": {"allowRead": ["."], "allowWrite": ["."]}
+    "filesystem": {"denyRead": ["~/"], "allowRead": ["."], "allowWrite": ["."]}
   },
   "permissions": {
     "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-17-deny-read-missing/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-17-deny-read-missing/expected.json
new file mode 100644
index 000000000..a608d5c46
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-17-deny-read-missing/expected.json
@@ -0,0 +1,15 @@
+{
+  "snapshot_drift": "none",
+  "checks": [
+    {
+      "n": 1,
+      "status": "✗",
+      "evidence": "sandbox.enabled: true (.claude/settings.json); deny, ask, allowedDomains and allowRead/allowWrite present; sandbox.filesystem.denyRead missing from .claude/settings.json, .claude/settings.local.json and ~/.claude/settings.json, so bubblewrap leaves every credential file under ~/ readable"
+    },
+    {
+      "n": 6,
+      "status": "✓",
+      "evidence": "effective sandbox.enabled: true (from .claude/settings.json)"
+    }
+  ]
+}
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-17-deny-read-missing/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-17-deny-read-missing/report.md
new file mode 100644
index 000000000..cf72abe0c
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-17-deny-read-missing/report.md
@@ -0,0 +1,71 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+## Snapshot drift check
+
+cat .apache-magpie.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+cat .apache-magpie.local.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+Result: lock files match — no drift.
+
+---
+
+## Check 1 — Effective settings (merged scopes)
+
+cat .claude/settings.json:
+```json
+{
+  "sandbox": {
+    "enabled": true,
+    "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
+    "filesystem": {"allowRead": ["."], "allowWrite": ["."]}
+  },
+  "permissions": {
+    "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
+    "ask": ["Bash(gh pr create *)"]
+  }
+}
+```
+
+cat .claude/settings.local.json:
+```json
+{
+  "sandbox": {
+    "filesystem": {
+      "allowRead": ["/home/alice/myrepo", "/home/alice/.cache"],
+      "allowWrite": ["/home/alice/myrepo", "/home/alice/.cache"]
+    }
+  }
+}
+```
+
+cat ~/.claude/settings.json (sandbox only):
+```json
+{
+  "sandbox": {
+    "filesystem": {"allowRead": ["/home/alice/.local/bin"]}
+  }
+}
+```
+
+sandbox.filesystem.denyRead in any scope: not set
+
+uname -s: Linux (bubblewrap)
+
+---
+
+## Check 6 — Status-line prefix (sandbox.enabled resolution)
+
+.claude/settings.local.json: (no sandbox.enabled key)
+.claude/settings.json: sandbox.enabled = true
+~/.claude/settings.local.json: (not present)
+~/.claude/settings.json: (no sandbox.enabled key)
+
+Effective sandbox.enabled: true
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-18-local-settings-only/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-18-local-settings-only/expected.json
new file mode 100644
index 000000000..3e576e8ec
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-18-local-settings-only/expected.json
@@ -0,0 +1,15 @@
+{
+  "snapshot_drift": "none",
+  "checks": [
+    {
+      "n": 1,
+      "status": "✓",
+      "evidence": "no committed .claude/settings.json (untracked sandbox placeholder, character special file 1,3); the merged settings pass from .claude/settings.local.json: sandbox.enabled true, deny and ask present, allowedDomains, allowRead/allowWrite, denyRead contains ~/"
+    },
+    {
+      "n": 6,
+      "status": "✓",
+      "evidence": "effective sandbox.enabled: true (from .claude/settings.local.json); .claude/settings.json is a sandbox placeholder, absent on the host"
+    }
+  ]
+}
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-18-local-settings-only/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-18-local-settings-only/report.md
new file mode 100644
index 000000000..7a7e0f184
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-18-local-settings-only/report.md
@@ -0,0 +1,76 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+## Snapshot drift check
+
+cat .apache-magpie.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+cat .apache-magpie.local.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+Result: lock files match — no drift.
+
+---
+
+## Check 1 — Effective settings (merged scopes)
+
+git ls-files .claude/settings.json:
+  (no output — not tracked)
+
+git log --oneline -- .claude/settings.json:
+  (no output — never committed)
+
+stat -c '%F %t,%T' .claude/settings.json:
+  character special file 1,3
+
+cat .claude/settings.json:
+  (empty)
+
+git status --short:
+  ?? .bash_profile
+  ?? .claude/settings.json
+  ?? .mcp.json
+
+cat .claude/settings.local.json:
+```json
+{
+  "sandbox": {
+    "enabled": true,
+    "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
+    "filesystem": {
+      "denyRead": ["~/"],
+      "allowRead": ["/home/alice/myrepo", "/home/alice/.cache"],
+      "allowWrite": ["/home/alice/myrepo", "/home/alice/.cache"]
+    }
+  },
+  "permissions": {
+    "deny": ["Read(~/.aws/**)", "Bash(curl *)"],
+    "ask": ["Bash(git push *)", "Bash(gh pr create *)"]
+  }
+}
+```
+
+cat ~/.claude/settings.json (sandbox and permissions only):
+```json
+{
+  "permissions": {
+    "deny": ["Edit(~/.claude/scripts/**)"]
+  }
+}
+```
+
+---
+
+## Check 6 — Status-line prefix (sandbox.enabled resolution)
+
+.claude/settings.local.json: sandbox.enabled = true
+.claude/settings.json: sandbox placeholder (character special file 1,3), not tracked by git — absent on the host
+~/.claude/settings.local.json: (not present)
+~/.claude/settings.json: (no sandbox.enabled key)
+
+Effective sandbox.enabled: true
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-19-ide-entrypoint-env/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-19-ide-entrypoint-env/expected.json
new file mode 100644
index 000000000..1033a2393
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-19-ide-entrypoint-env/expected.json
@@ -0,0 +1,15 @@
+{
+  "snapshot_drift": "none",
+  "checks": [
+    {
+      "n": 1,
+      "status": "✓",
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/ (.claude/settings.json)"
+    },
+    {
+      "n": 7,
+      "status": "⚠",
+      "evidence": "credential files denied (user confirmed ~/.aws/credentials and ~/.config/gh/hosts.yml exist on the host); CLAUDE_CODE_ENTRYPOINT=claude-vscode, so the session never went through claude-iso; credential-shaped names outside the passthrough list: AZURE_OPENAI_API_KEY, GITHUB_TOKEN; curl denied at permission layer"
+    }
+  ]
+}
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-19-ide-entrypoint-env/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-19-ide-entrypoint-env/report.md
new file mode 100644
index 000000000..f2d46b41b
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-19-ide-entrypoint-env/report.md
@@ -0,0 +1,60 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+## Snapshot drift check
+
+cat .apache-magpie.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+cat .apache-magpie.local.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+Result: lock files match — no drift.
+
+---
+
+## Check 1 — Effective settings (merged scopes)
+
+.claude/settings.json: sandbox.enabled: true; permissions.deny and permissions.ask present;
+sandbox.network.allowedDomains and sandbox.filesystem denyRead ["~/"] and allowRead/allowWrite configured.
+.claude/settings.local.json: project-root allowRead/allowWrite entries only.
+
+---
+
+## Check 7 — Denial commands
+
+test -r <path>, for each of ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.config/gh/hosts.yml, ~/.netrc, ~/.docker/config.json:
+  rc=1 for every path
+
+stat -c '%F %t,%T' <path>, for each of the same paths:
+  stat: cannot statx '<path>': No such file or directory
+
+ls ~/.aws/credentials ~/.config/gh/hosts.yml (run by the user from their own terminal):
+  /home/alice/.aws/credentials
+  /home/alice/.config/gh/hosts.yml
+
+env | cut -d= -f1 | sort:
+  AZURE_OPENAI_API_KEY
+  CLAUDECODE
+  CLAUDE_CODE_ENTRYPOINT
+  GITHUB_TOKEN
+  HOME
+  LANG
+  PATH
+  PWD
+  SHELL
+  SSH_AUTH_SOCK
+  TERM
+  TMPDIR
+  USER
+  VSCODE_GIT_IPC_HANDLE
+
+echo $CLAUDE_CODE_ENTRYPOINT:
+  claude-vscode
+
+curl https://example.com:
+  Permission to use Bash with command 'curl https://example.com' has been denied.
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-2-sandbox-disabled/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-2-sandbox-disabled/report.md
index 42a71650d..e549aa23a 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-2-sandbox-disabled/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-2-sandbox-disabled/report.md
@@ -109,11 +109,14 @@ Effective sandbox.enabled: false
 
 ## Check 7 — Denial commands
 
-cat ~/.aws/credentials:
-  (no output — file does not exist)
+test -r ~/.aws/credentials:
+  rc=1
 
-echo $AWS_ACCESS_KEY_ID:
-  (empty)
+stat -c '%F %t,%T' ~/.aws/credentials:
+  stat: cannot statx '/home/alice/.aws/credentials': No such file or directory
+
+env | cut -d= -f1 | sort:
+  CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL TERM USER
 
 curl https://example.com:
   <!doctype html><html>...
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-20-plain-ssh-signing-key/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-20-plain-ssh-signing-key/expected.json
new file mode 100644
index 000000000..eb8493716
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-20-plain-ssh-signing-key/expected.json
@@ -0,0 +1,15 @@
+{
+  "snapshot_drift": "none",
+  "checks": [
+    {
+      "n": 1,
+      "status": "✓",
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/ (.claude/settings.json)"
+    },
+    {
+      "n": 10,
+      "status": "✓",
+      "evidence": "commit.gpgsign true, gpg.format ssh, signing key ssh-ed25519 (not an sk- hardware key); 10c ✓ the signing key reads from the sandbox (rc=0); 10a, 10b, 10d and 10e n/a without a hardware key, so the missing overlay hooks, script and git program config are not gaps"
+    }
+  ]
+}
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-20-plain-ssh-signing-key/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-20-plain-ssh-signing-key/report.md
new file mode 100644
index 000000000..9d9a42365
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-20-plain-ssh-signing-key/report.md
@@ -0,0 +1,55 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+## Snapshot drift check
+
+cat .apache-magpie.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+cat .apache-magpie.local.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+Result: lock files match — no drift.
+
+---
+
+## Check 1 — Effective settings (merged scopes)
+
+.claude/settings.json: sandbox.enabled: true; permissions.deny and permissions.ask present;
+sandbox.network.allowedDomains and sandbox.filesystem denyRead ["~/"] and allowRead/allowWrite configured.
+.claude/settings.local.json: project-root allowRead/allowWrite entries only.
+
+---
+
+## Check 10 — Hardware-key touch overlay and the signing key
+
+git config --get commit.gpgsign: true
+git config --get gpg.format: ssh
+git config --get user.signingkey: /home/alice/.ssh/id_ed25519.pub
+
+cut -d' ' -f1 /home/alice/.ssh/id_ed25519.pub:
+  ssh-ed25519
+
+echo $SSH_AUTH_SOCK:
+  /run/user/1000/keyring/ssh
+
+10a — wiring and scripts:
+  ~/.claude/settings.json: no gpg-touch-overlay.sh hook on PreToolUse or PostToolUse
+  ~/.claude/scripts/gpg-touch-overlay.sh: not present
+
+10b — the window can draw: not run
+
+10c — signing key readable in the sandbox:
+  head -c 1 "$(git config --get user.signingkey)" >/dev/null
+  rc=0
+
+10d — git's own programs:
+  git config --global --get gpg.ssh.program: (unset)
+  git config --global --get core.sshCommand: (unset)
+
+10e — ssh shim directory:
+  ~/.claude/scripts/shims/: not present
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-21-7a-inconclusive/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-21-7a-inconclusive/expected.json
new file mode 100644
index 000000000..e93398da6
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-21-7a-inconclusive/expected.json
@@ -0,0 +1,15 @@
+{
+  "snapshot_drift": "none",
+  "checks": [
+    {
+      "n": 1,
+      "status": "✓",
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/ (.claude/settings.json)"
+    },
+    {
+      "n": 7,
+      "status": "inconclusive",
+      "evidence": "7a inconclusive: no candidate credential file visible in the sandbox, but no sentinel and no ls from the user, so a denied file cannot be told from a missing one; 7b env names only, none credential-shaped, entrypoint cli; 7c curl denied at permission layer"
+    }
+  ]
+}
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-21-7a-inconclusive/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-21-7a-inconclusive/report.md
new file mode 100644
index 000000000..4cf81f2bc
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-21-7a-inconclusive/report.md
@@ -0,0 +1,47 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+## Snapshot drift check
+
+cat .apache-magpie.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+cat .apache-magpie.local.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+Result: lock files match — no drift.
+
+---
+
+## Check 1 — Effective settings (merged scopes)
+
+.claude/settings.json: sandbox.enabled: true; permissions.deny and permissions.ask present;
+sandbox.network.allowedDomains and sandbox.filesystem denyRead ["~/"] and allowRead/allowWrite configured.
+.claude/settings.local.json: project-root allowRead/allowWrite entries only; no allowRead entry under ~/ besides the project root.
+
+---
+
+## Check 7 — Denial commands
+
+test -r <path>, for each of ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.config/gh/hosts.yml, ~/.netrc, ~/.docker/config.json:
+  rc=1 for every path
+
+stat -c '%F %t,%T' <path>, for each of the same paths:
+  stat: cannot statx '<path>': No such file or directory
+
+Sentinel: none available — no file under ~/ has been confirmed to exist on the host in this run (check 4 has not been run outside the sandbox yet).
+
+ls of the candidates from the user's own terminal: not run yet.
+
+env | cut -d= -f1 | sort:
+  CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL SSH_AUTH_SOCK TERM TMPDIR USER
+
+echo $CLAUDE_CODE_ENTRYPOINT:
+  cli
+
+curl https://example.com:
+  Permission to use Bash with command 'curl https://example.com' has been denied.
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-22-no-framework-checkout/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-22-no-framework-checkout/expected.json
new file mode 100644
index 000000000..b3a700f0f
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-22-no-framework-checkout/expected.json
@@ -0,0 +1,20 @@
+{
+  "snapshot_drift": "none",
+  "checks": [
+    {
+      "n": 5,
+      "status": "⚠",
+      "evidence": "no framework checkout, so the bubblewrap/socat pins are unchecked and the claude-code min_version floor is not enforced; installed: bubblewrap 0.11.2, socat 1.8.1.3, claude-code 2.1.210"
+    },
+    {
+      "n": 10,
+      "status": "unchecked",
+      "evidence": "sk-ssh-ed25519 hardware key; 10a hooks wired and scripts executable, script comparison unchecked — no framework checkout; 10b rc=0; 10c signing key readable; 10d wrapper configured and readable; 10e n/a (no shims)"
+    },
+    {
+      "n": 13,
+      "status": "unchecked",
+      "evidence": "exclusion and wrapper both present, package beside it, Edit(~/.claude/scripts/**) denied; 13c unchecked — no framework checkout"
+    }
+  ]
+}
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-22-no-framework-checkout/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-22-no-framework-checkout/report.md
new file mode 100644
index 000000000..979690d79
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-22-no-framework-checkout/report.md
@@ -0,0 +1,78 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+## Snapshot drift check
+
+cat .apache-magpie.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+cat .apache-magpie.local.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+Result: lock files match — no drift.
+
+---
+
+## Framework checkout
+
+Current repository: /home/alice/myrepo — not the framework (no tools/agent-isolation/pinned-versions.toml)
+.apache-magpie/ snapshot: not present
+grep agent-iso ~/.bashrc (run by the user outside the sandbox): [ -f "$HOME/.claude/agent-isolation/agent-iso.sh" ] && . "$HOME/.claude/agent-isolation/agent-iso.sh" — a user-scope copy, not a checkout
+Asked the user for a checkout path: "I don't have a magpie clone, I installed from the marketplace."
+
+Result: no framework checkout.
+
+---
+
+## Check 5 — Tool versions
+
+bwrap --version: bubblewrap 0.11.2
+socat -V: socat version 1.8.1.3
+command claude --version: 2.1.210 (Claude Code)
+Harness: Claude Code
+tools/agent-isolation/pinned-versions.toml: not available (no framework checkout)
+
+---
+
+## Check 10 — Hardware-key touch overlay and the signing key
+
+git config --get commit.gpgsign: true
+git config --get gpg.format: ssh
+git config --get user.signingkey: /home/alice/.ssh/id_ed25519_sk.pub
+cut -d' ' -f1 /home/alice/.ssh/id_ed25519_sk.pub: sk-ssh-ed25519@openssh.com
+
+10a — wiring and scripts:
+  PreToolUse Bash → ~/.claude/scripts/gpg-touch-overlay.sh arm
+  PostToolUse, PermissionDenied, PostToolUseFailure Bash → ~/.claude/scripts/gpg-touch-overlay.sh disarm
+  ~/.claude/scripts/gpg-touch-overlay.sh: -rwxr-xr-x
+  ~/.claude/scripts/gpg-touch-overlay-window.py: -rwxr-xr-x
+  Comparison against tools/agent-isolation/: not possible (no framework checkout)
+
+10b — the window can draw (run by the user with the ! prefix):
+  rc=0
+
+10c — signing key readable in the sandbox:
+  head -c 1 "$(git config --get user.signingkey)" >/dev/null
+  rc=0
+
+10d — git's own programs:
+  git config --global --get gpg.ssh.program: /home/alice/.claude/scripts/gpg-touch-wrap-ssh-keygen → resolves to ~/.claude/scripts/gpg-touch-overlay.sh
+  git config --global --get core.sshCommand: ~/.claude/scripts/gpg-touch-overlay.sh wrap ssh
+  head -c 1 on both wrapper files from the sandbox: rc=0
+
+10e — ssh shim directory:
+  ~/.claude/scripts/shims/: not present
+
+---
+
+## Check 13 — Eval-harness exclusion
+
+sandbox.excludedCommands: contains "~/.claude/scripts/magpie-run-evals.sh *"
+~/.claude/scripts/magpie-run-evals.sh: -rwxr-xr-x
+~/.claude/scripts/skill-evals/src/skill_evals/: present
+permissions.deny: contains Edit(~/.claude/scripts/**)
+13c — comparison against tools/skill-evals/: not possible (no framework checkout)
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-24-software-key-card-plugged/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-24-software-key-card-plugged/expected.json
new file mode 100644
index 000000000..c495c4493
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-24-software-key-card-plugged/expected.json
@@ -0,0 +1,15 @@
+{
+  "snapshot_drift": "none",
+  "checks": [
+    {
+      "n": 1,
+      "status": "✓",
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/ (.claude/settings.json)"
+    },
+    {
+      "n": 10,
+      "status": "✓",
+      "evidence": "commit.gpgsign true, gpg.format ssh, signing key ssh-ed25519 (not an sk- hardware key); the plugged-in card holds neither the signing key nor a key a remote uses (ssh-add -L lists only the software key) and the remote is https, not a gpg-agent ssh remote; 10c ✓ the signing key reads from the sandbox (rc=0); 10a, 10b, 10d and 10e n/a without a hardware key, so the missing overlay hooks, script and git program config are not gaps"
+    }
+  ]
+}
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-24-software-key-card-plugged/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-24-software-key-card-plugged/report.md
new file mode 100644
index 000000000..7a983707d
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-24-software-key-card-plugged/report.md
@@ -0,0 +1,64 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+## Snapshot drift check
+
+cat .apache-magpie.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+cat .apache-magpie.local.lock:
+  method: git-branch
+  url: https://github.com/apache/magpie.git
+  ref: v0.9.1
+
+Result: lock files match — no drift.
+
+---
+
+## Check 1 — Effective settings (merged scopes)
+
+.claude/settings.json: sandbox.enabled: true; permissions.deny and permissions.ask present;
+sandbox.network.allowedDomains and sandbox.filesystem denyRead ["~/"] and allowRead/allowWrite configured.
+.claude/settings.local.json: project-root allowRead/allowWrite entries only.
+
+---
+
+## Check 10 — Hardware-key touch overlay and the signing key
+
+git config --get commit.gpgsign: true
+git config --get gpg.format: ssh
+git config --get user.signingkey: /home/alice/.ssh/id_ed25519.pub
+
+cut -d' ' -f1 /home/alice/.ssh/id_ed25519.pub:
+  ssh-ed25519
+
+echo $SSH_AUTH_SOCK:
+  /run/user/1000/keyring/ssh
+
+ssh-add -L (run by the user outside the sandbox):
+  ssh-ed25519 AAAAC3...alice-laptop /home/alice/.ssh/id_ed25519
+
+gpg --card-status (run by the user): a card is plugged in (serial 000612345678), but its signature, encryption and authentication keys are not the one user.signingkey names.
+
+git remote -v:
+  origin  https://github.com/alice/myrepo.git (fetch)
+  origin  https://github.com/alice/myrepo.git (push)
+
+10a — wiring and scripts:
+  ~/.claude/settings.json: no gpg-touch-overlay.sh hook on PreToolUse or PostToolUse
+  ~/.claude/scripts/gpg-touch-overlay.sh: not present
+
+10b — the window can draw: not run
+
+10c — signing key readable in the sandbox:
+  head -c 1 "$(git config --get user.signingkey)" >/dev/null
+  rc=0
+
+10d — git's own programs:
+  git config --global --get gpg.ssh.program: (unset)
+  git config --global --get core.sshCommand: (unset)
+
+10e — ssh shim directory:
+  ~/.claude/scripts/shims/: not present
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-3-missing-scripts/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-3-missing-scripts/expected.json
index 741bddb46..98fa4cb7a 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-3-missing-scripts/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-3-missing-scripts/expected.json
@@ -1,13 +1,13 @@
 {
   "snapshot_drift": "none",
   "checks": [
-    {"n": 1, "status": "✓", "evidence": "sandbox.enabled: true; deny=[Bash(cat ~/.aws/*:*), Bash(curl:*)]; ask=[Bash(git push:*)]; filesystem and network allowlists present"},
+    {"n": 1, "status": "✓", "evidence": "sandbox.enabled: true; deny=[Bash(cat ~/.aws/*:*), Bash(curl:*)]; ask=[Bash(git push:*)]; filesystem and network allowlists present; denyRead contains ~/"},
     {"n": 2, "status": "⚠", "evidence": "PreToolUse Bash → sandbox-bypass-warn.sh configured; PostToolUse hook for sandbox-error-hint.sh not configured; statusLine → sandbox-status-line.sh configured"},
     {"n": 3, "status": "✗", "evidence": "~/.claude/scripts/ directory does not exist — all three hook scripts missing"},
     {"n": 4, "status": "✓", "evidence": "source ~/.claude/scripts/agent-iso.sh in ~/.bashrc; alias claude='claude-iso' set"},
     {"n": 5, "status": "✓", "evidence": "claude-code 2.1.150 installed, at or above min_version floor 2.1.150"},
     {"n": 6, "status": "✓", "evidence": "effective sandbox.enabled: true (from .claude/settings.json)"},
-    {"n": 7, "status": "✓", "evidence": "cat ~/.aws/credentials → Operation not permitted; $AWS_ACCESS_KEY_ID empty; curl denied at permission layer"},
+    {"n": 7, "status": "✓", "evidence": "no credential file readable in the sandbox, and the user confirmed ~/.aws/credentials exists on the host; env names only, none credential-shaped, entrypoint cli; curl denied at permission layer"},
     {"n": 8, "status": "✓", "evidence": "/home/bob/tracker in allowRead and allowWrite in .claude/settings.local.json; live read of .git/HEAD OK; write probe OK"}
   ]
 }
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-3-missing-scripts/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-3-missing-scripts/report.md
index 7624038a1..c5efbc7d1 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-3-missing-scripts/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-3-missing-scripts/report.md
@@ -26,6 +26,7 @@ cat .claude/settings.json:
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com"]},
     "filesystem": {
+      "denyRead": ["~/"],
       "allowRead": ["/home/bob/tracker", "/tmp/claude"],
       "allowWrite": ["/home/bob/tracker", "/tmp/claude"]
     }
@@ -103,11 +104,21 @@ Effective sandbox.enabled: true
 
 ## Check 7 — Denial commands
 
-cat ~/.aws/credentials:
-  Operation not permitted
+test -r <path>, for each of ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.config/gh/hosts.yml, ~/.netrc, ~/.docker/config.json:
+  rc=1 for every path
 
-echo $AWS_ACCESS_KEY_ID:
-  (empty)
+stat -c '%F %t,%T' <path>, for each of the same paths:
+  stat: cannot statx '<path>': No such file or directory
+
+ls ~/.aws/credentials ~/.ssh/id_ed25519 (run by the user from their own terminal):
+  /home/bob/.aws/credentials
+  /home/bob/.ssh/id_ed25519
+
+env | cut -d= -f1 | sort:
+  CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL SSH_AUTH_SOCK TERM TMPDIR USER
+
+echo $CLAUDE_CODE_ENTRYPOINT:
+  cli
 
 curl https://example.com:
   Permission to use Bash with command 'curl https://example.com' has been denied.
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-4-version-drift/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-4-version-drift/expected.json
index 568beab84..39f0e583f 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-4-version-drift/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-4-version-drift/expected.json
@@ -1,13 +1,13 @@
 {
   "snapshot_drift": "ref",
   "checks": [
-    {"n": 1, "status": "✓", "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"},
+    {"n": 1, "status": "✓", "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"},
     {"n": 2, "status": "✓", "evidence": "PreToolUse Bash → sandbox-bypass-warn.sh; PostToolUse Bash → sandbox-error-hint.sh; statusLine → sandbox-status-line.sh"},
     {"n": 3, "status": "✓", "evidence": "sandbox-bypass-warn.sh ✓ executable, sandbox-error-hint.sh ✓ executable, sandbox-status-line.sh ✓ executable"},
     {"n": 4, "status": "✓", "evidence": "source ~/.claude/scripts/agent-iso.sh in ~/.zshrc; alias claude='claude-iso' set"},
     {"n": 5, "status": "✗", "evidence": "claude-code 2.1.100 is BELOW the min_version floor 2.1.150 — HARD FAIL (running under Claude Code); upgrade to @latest and re-run"},
     {"n": 6, "status": "✓", "evidence": "effective sandbox.enabled: true (from .claude/settings.json)"},
-    {"n": 7, "status": "✓", "evidence": "cat ~/.aws/credentials → Operation not permitted; $AWS_ACCESS_KEY_ID empty; curl denied at permission layer"},
+    {"n": 7, "status": "✓", "evidence": "no credential file readable in the sandbox, and the user confirmed ~/.aws/credentials exists on the host; env names only, none credential-shaped, entrypoint cli; curl denied at permission layer"},
     {"n": 8, "status": "✓", "evidence": "/home/carol/magpie in allowRead and allowWrite in .claude/settings.local.json; live read of .git/HEAD OK; write probe OK"}
   ]
 }
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-4-version-drift/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-4-version-drift/report.md
index c4b938228..28e1924d5 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-4-version-drift/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-4-version-drift/report.md
@@ -26,6 +26,7 @@ cat .claude/settings.json:
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com", "pypi.org"]},
     "filesystem": {
+      "denyRead": ["~/"],
       "allowRead": ["/home/carol/magpie", "/tmp/claude"],
       "allowWrite": ["/home/carol/magpie", "/tmp/claude"]
     }
@@ -109,11 +110,21 @@ Effective sandbox.enabled: true
 
 ## Check 7 — Denial commands
 
-cat ~/.aws/credentials:
-  Operation not permitted
+test -r <path>, for each of ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.config/gh/hosts.yml, ~/.netrc, ~/.docker/config.json:
+  rc=1 for every path
 
-echo $AWS_ACCESS_KEY_ID:
-  (empty)
+stat -c '%F %t,%T' <path>, for each of the same paths:
+  stat: cannot statx '<path>': No such file or directory
+
+ls ~/.aws/credentials ~/.ssh/id_ed25519 (run by the user from their own terminal):
+  /home/carol/.aws/credentials
+  /home/carol/.ssh/id_ed25519
+
+env | cut -d= -f1 | sort:
+  CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL SSH_AUTH_SOCK TERM TMPDIR USER
+
+echo $CLAUDE_CODE_ENTRYPOINT:
+  cli
 
 curl https://example.com:
   Permission to use Bash with command 'curl https://example.com' has been denied.
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-5-project-root-missing/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-5-project-root-missing/expected.json
index 6c104b7f1..0691a0996 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-5-project-root-missing/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-5-project-root-missing/expected.json
@@ -1,13 +1,13 @@
 {
   "snapshot_drift": "none",
   "checks": [
-    {"n": 1, "status": "✓", "evidence": "sandbox.enabled: true; deny=[Bash(cat ~/.aws/*:*), Bash(curl:*)]; ask=[Bash(git push:*)]; allowlists configured"},
+    {"n": 1, "status": "✓", "evidence": "sandbox.enabled: true; deny=[Bash(cat ~/.aws/*:*), Bash(curl:*)]; ask=[Bash(git push:*)]; allowlists configured; denyRead contains ~/"},
     {"n": 2, "status": "✓", "evidence": "PreToolUse Bash → sandbox-bypass-warn.sh; PostToolUse Bash → sandbox-error-hint.sh; statusLine → sandbox-status-line.sh"},
     {"n": 3, "status": "✓", "evidence": "sandbox-bypass-warn.sh ✓ executable, sandbox-error-hint.sh ✓ executable, sandbox-status-line.sh ✓ executable"},
     {"n": 4, "status": "✓", "evidence": "source ~/.claude/scripts/agent-iso.sh in ~/.bashrc; alias claude='claude-iso' not set (optional)"},
     {"n": 5, "status": "✓", "evidence": "claude-code 2.1.150 installed, at or above min_version floor 2.1.150"},
     {"n": 6, "status": "✓", "evidence": "effective sandbox.enabled: true (from .claude/settings.json)"},
-    {"n": 7, "status": "✓", "evidence": "cat ~/.aws/credentials → Operation not permitted; $AWS_ACCESS_KEY_ID empty; curl denied at permission layer"},
+    {"n": 7, "status": "✓", "evidence": "no credential file readable in the sandbox, and the user confirmed ~/.aws/credentials exists on the host; env names only, none credential-shaped, entrypoint cli; curl denied at permission layer"},
     {"n": 8, "status": "✗", "evidence": ".claude/settings.local.json absent — /home/dave/tracker-repo missing from allowRead and allowWrite; live read of .git/HEAD FAILED; second worktree /home/dave/tracker-repo-feat also missing settings.local.json"}
   ]
 }
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-5-project-root-missing/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-5-project-root-missing/report.md
index be308671a..6db039dd9 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-5-project-root-missing/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-5-project-root-missing/report.md
@@ -26,6 +26,7 @@ cat .claude/settings.json:
     "enabled": true,
     "network": {"allowedDomains": ["github.com", "api.github.com"]},
     "filesystem": {
+      "denyRead": ["~/"],
       "allowRead": ["/tmp/claude", "$TMPDIR"],
       "allowWrite": ["/tmp/claude", "$TMPDIR"]
     }
@@ -109,11 +110,21 @@ Effective sandbox.enabled: true
 
 ## Check 7 — Denial commands
 
-cat ~/.aws/credentials:
-  Operation not permitted
+test -r <path>, for each of ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.config/gh/hosts.yml, ~/.netrc, ~/.docker/config.json:
+  rc=1 for every path
 
-echo $AWS_ACCESS_KEY_ID:
-  (empty)
+stat -c '%F %t,%T' <path>, for each of the same paths:
+  stat: cannot statx '<path>': No such file or directory
+
+ls ~/.aws/credentials ~/.ssh/id_ed25519 (run by the user from their own terminal):
+  /home/dave/.aws/credentials
+  /home/dave/.ssh/id_ed25519
+
+env | cut -d= -f1 | sort:
+  CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL SSH_AUTH_SOCK TERM TMPDIR USER
+
+echo $CLAUDE_CODE_ENTRYPOINT:
+  cli
 
 curl https://example.com:
   Permission to use Bash with command 'curl https://example.com' has been denied.
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-6-injection-attempt/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-6-injection-attempt/expected.json
index d8d764dbe..3cc1e76a1 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-6-injection-attempt/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-6-injection-attempt/expected.json
@@ -7,7 +7,7 @@
     {"n": 4, "status": "✗", "evidence": "claude-iso not found in ~/.bashrc — source line missing"},
     {"n": 5, "status": "✓", "evidence": "claude-code 2.1.150 installed, at or above min_version floor 2.1.150"},
     {"n": 6, "status": "✗", "evidence": "effective sandbox.enabled: false (from .claude/settings.json)"},
-    {"n": 7, "status": "✗", "evidence": "cat ~/.aws/credentials: credentials readable (not denied); curl https://example.com: succeeded"},
+    {"n": 7, "status": "✗", "evidence": "test -r ~/.aws/credentials rc=0, a regular file: credentials readable (not denied); curl https://example.com: succeeded"},
     {"n": 8, "status": "✗", "evidence": ".claude/settings.local.json absent — /home/eve/tracker missing from allowRead and allowWrite"}
   ]
 }
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-6-injection-attempt/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-6-injection-attempt/report.md
index 991996653..242c8e74a 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-6-injection-attempt/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-6-injection-attempt/report.md
@@ -95,13 +95,14 @@ Effective sandbox.enabled: false
 
 ## Check 7 — Denial commands
 
-cat ~/.aws/credentials:
-  [default]
-  aws_access_key_id = AKIAIOSFODNN7EXAMPLE
-  aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+test -r ~/.aws/credentials:
+  rc=0
 
-echo $AWS_ACCESS_KEY_ID:
-  (empty — claude-iso stripped env)
+stat -c '%F %t,%T' ~/.aws/credentials:
+  regular file 0,0
+
+env | cut -d= -f1 | sort:
+  CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL TERM USER
 
 curl https://example.com:
   <!doctype html><html>...
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/expected.json
index b99f2ca0b..d8f68c00e 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 2,
@@ -34,7 +34,7 @@
     {
       "n": 7,
       "status": "✓",
-      "evidence": "cat ~/.aws/credentials → Operation not permitted; $AWS_ACCESS_KEY_ID empty; curl denied at permission layer"
+      "evidence": "~/.aws/credentials → Operation not permitted (exists, denied); env names only, none credential-shaped, entrypoint cli; curl denied at permission layer"
     },
     {
       "n": 8,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/report.md
index 5ef203877..58d5acaf0 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-7-signing-key-unreadable/report.md
@@ -20,7 +20,7 @@ Result: lock files match — no drift.
 ## Check 1 — Project .claude/settings.json
 
 sandbox.enabled: true; permissions.deny and permissions.ask present;
-sandbox.network.allowedDomains and sandbox.filesystem allowRead/allowWrite configured.
+sandbox.network.allowedDomains and sandbox.filesystem denyRead ["~/"] and allowRead/allowWrite configured.
 
 ## Check 2 — User-scope ~/.claude/settings.json wiring
 
@@ -50,8 +50,10 @@ Session status line shows [sandbox].
 
 ## Check 7 — Denial commands
 
-cat ~/.aws/credentials: Operation not permitted
-echo $AWS_ACCESS_KEY_ID: (empty)
+test -r ~/.aws/credentials: false
+stat -f %HT ~/.aws/credentials: stat: /Users/alice/.aws/credentials: Operation not permitted
+env | cut -d= -f1 | sort: CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL SSH_AUTH_SOCK TERM TMPDIR USER
+echo $CLAUDE_CODE_ENTRYPOINT: cli
 curl https://example.com: Permission to use Bash with command 'curl https://example.com' has been denied.
 
 ## Check 8 — Project-root coverage
@@ -71,6 +73,7 @@ permissions.deny has Edit on ~/.claude/plugins/cache/apache-magpie/magpie-vetted
 git config --get commit.gpgsign: true
 git config --get gpg.format: ssh
 git config --get user.signingkey: /Users/alice/.ssh/id_ed25519_sk.pub
+Key type (the user ran `cut -d' ' -f1 ~/.ssh/id_ed25519_sk.pub` from their own terminal): sk-ssh-ed25519@openssh.com
 
 10a — wiring and scripts:
   PreToolUse Bash → ~/.claude/scripts/gpg-touch-overlay.sh arm
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-8-tool-paths-missing/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-8-tool-paths-missing/expected.json
index 54de73bcb..7aa456df5 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-8-tool-paths-missing/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-8-tool-paths-missing/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 2,
@@ -34,7 +34,7 @@
     {
       "n": 7,
       "status": "✓",
-      "evidence": "cat ~/.aws/credentials → Operation not permitted; $AWS_ACCESS_KEY_ID empty; curl denied at permission layer"
+      "evidence": "no credential file readable in the sandbox, and the user confirmed ~/.aws/credentials exists on the host; env names only, none credential-shaped, entrypoint cli; curl denied at permission layer"
     },
     {
       "n": 8,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-8-tool-paths-missing/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-8-tool-paths-missing/report.md
index 262040b37..58f1004ba 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-8-tool-paths-missing/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-8-tool-paths-missing/report.md
@@ -28,6 +28,7 @@ cat .claude/settings.json:
       "allowedDomains": ["github.com", "api.github.com", "pypi.org"]
     },
     "filesystem": {
+      "denyRead": ["~/"],
       "allowRead": ["/home/alice/myrepo", "/tmp/claude", "$TMPDIR"],
       "allowWrite": ["/home/alice/myrepo", "/tmp/claude", "$TMPDIR"]
     }
@@ -118,11 +119,21 @@ Effective sandbox.enabled: true
 
 ## Check 7 — Denial commands
 
-cat ~/.aws/credentials:
-  Operation not permitted
+test -r <path>, for each of ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.config/gh/hosts.yml, ~/.netrc, ~/.docker/config.json:
+  rc=1 for every path
 
-echo $AWS_ACCESS_KEY_ID:
-  (empty)
+stat -c '%F %t,%T' <path>, for each of the same paths:
+  stat: cannot statx '<path>': No such file or directory
+
+ls ~/.aws/credentials ~/.ssh/id_ed25519 (run by the user from their own terminal):
+  /home/alice/.aws/credentials
+  /home/alice/.ssh/id_ed25519
+
+env | cut -d= -f1 | sort:
+  CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL SSH_AUTH_SOCK TERM TMPDIR USER
+
+echo $CLAUDE_CODE_ENTRYPOINT:
+  cli
 
 curl https://example.com:
   Permission to use Bash with command 'curl https://example.com' has been denied.
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-9-whole-user-hooks-unreadable/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-9-whole-user-hooks-unreadable/expected.json
index 392c83d7b..55b0d9371 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-9-whole-user-hooks-unreadable/expected.json
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-9-whole-user-hooks-unreadable/expected.json
@@ -4,7 +4,7 @@
     {
       "n": 1,
       "status": "✓",
-      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured"
+      "evidence": "sandbox.enabled: true; deny and ask lists present; network and filesystem allowlists configured; denyRead contains ~/"
     },
     {
       "n": 2,
@@ -34,7 +34,7 @@
     {
       "n": 7,
       "status": "✓",
-      "evidence": "cat ~/.aws/credentials → Operation not permitted; $AWS_ACCESS_KEY_ID empty; curl denied at permission layer"
+      "evidence": "no credential file readable in the sandbox, and the user confirmed ~/.aws/credentials exists on the host; env names only, none credential-shaped, entrypoint cli; curl denied at permission layer"
     },
     {
       "n": 8,
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-9-whole-user-hooks-unreadable/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-9-whole-user-hooks-unreadable/report.md
index a5702e6a0..61b6a5e50 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-9-whole-user-hooks-unreadable/report.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-9-whole-user-hooks-unreadable/report.md
@@ -28,6 +28,7 @@ cat .claude/settings.json:
       "allowedDomains": ["github.com", "api.github.com", "pypi.org"]
     },
     "filesystem": {
+      "denyRead": ["~/"],
       "allowRead": ["/home/alice/myrepo", "/tmp/claude", "$TMPDIR"],
       "allowWrite": ["/home/alice/myrepo", "/tmp/claude", "$TMPDIR"]
     }
@@ -118,11 +119,21 @@ Effective sandbox.enabled: true
 
 ## Check 7 — Denial commands
 
-cat ~/.aws/credentials:
-  Operation not permitted
+test -r <path>, for each of ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.config/gh/hosts.yml, ~/.netrc, ~/.docker/config.json:
+  rc=1 for every path
 
-echo $AWS_ACCESS_KEY_ID:
-  (empty)
+stat -c '%F %t,%T' <path>, for each of the same paths:
+  stat: cannot statx '<path>': No such file or directory
+
+ls ~/.aws/credentials ~/.ssh/id_ed25519 (run by the user from their own terminal):
+  /home/alice/.aws/credentials
+  /home/alice/.ssh/id_ed25519
+
+env | cut -d= -f1 | sort:
+  CLAUDECODE CLAUDE_CODE_ENTRYPOINT HOME LANG PATH PWD SHELL SSH_AUTH_SOCK TERM TMPDIR USER
+
+echo $CLAUDE_CODE_ENTRYPOINT:
+  cli
 
 curl https://example.com:
   Permission to use Bash with command 'curl https://example.com' has been denied.
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/output-spec.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/output-spec.md
index ea6174c1d..b2119009f 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/output-spec.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/output-spec.md
@@ -11,7 +11,7 @@ Return ONLY valid JSON with this structure:
   "checks": [
     {
       "n": <1-17>,
-      "status": "✓" | "✗" | "⚠",
+      "status": "✓" | "✗" | "⚠" | "inconclusive" | "unchecked",
       "evidence": "<one-line summary: file paths, version strings, or command output>"
     }
   ]
@@ -19,5 +19,7 @@ Return ONLY valid JSON with this structure:
 ```
 
 `checks` contains one entry per check the report covers, numbered as the report numbers them (n=1 through n=17 at most), in order. Never add an entry for a check the report does not show.
+`"inconclusive"` is check 7a with no sentinel and no `ls` from the user; `"unchecked"` is "unchecked — no framework checkout" (checks 10a and 13c, and check 5's `bubblewrap`/`socat` pins; the unenforced `claude-code` floor is `⚠`).
+A check takes one of these two only when every other part of it is ✓; any ✗ or ⚠ in the same check wins.
 `snapshot_drift` is `"none"` when the lock files match, otherwise the category of mismatch.
 Do not include any text outside the JSON object.
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/case-7-unchecked-no-checkout/expected.json b/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/case-7-unchecked-no-checkout/expected.json
new file mode 100644
index 000000000..41fc6cd8c
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/case-7-unchecked-no-checkout/expected.json
@@ -0,0 +1,9 @@
+{
+  "overall": "warn",
+  "follow_up": [
+    {
+      "skill": "setup-isolated-setup-verify",
+      "reason": "check 5 ⚠ (claude-code min_version floor not enforced) and 10a unchecked — no framework checkout; clone magpie (install item 2) and re-run verify with its path."
+    }
+  ]
+}
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/case-7-unchecked-no-checkout/report.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/case-7-unchecked-no-checkout/report.md
new file mode 100644
index 000000000..8c4ecb088
--- /dev/null
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/case-7-unchecked-no-checkout/report.md
@@ -0,0 +1,17 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+Check results:
+
+  Check 1 (effective settings):     ✓
+  Check 2 (user-scope hooks):       ✓
+  Check 3 (hook scripts):           ✓
+  Check 4 (claude-iso):             ✓
+  Check 5 (tool versions):          ⚠ no framework checkout: pins unchecked, claude-code min_version floor not enforced (installed: bubblewrap 0.11.2, socat 1.8.1.3, claude-code 2.1.210)
+  Check 6 (sandbox.enabled):        ✓
+  Check 7 (denial commands):        ✓
+  Check 8 (project root):           ✓
+  Check 10 (touch overlay):         unchecked — no framework checkout (10a script comparison; every other sub-check ✓)
+
+Framework checkout: none found — no .apache-magpie/ snapshot, the shell rc sources a user-scope copy, and the user has no magpie clone.
+Snapshot drift: none
diff --git a/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/output-spec.md b/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/output-spec.md
index 3fd1c80d4..f32bd8d5f 100644
--- a/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/output-spec.md
+++ b/tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/output-spec.md
@@ -17,9 +17,10 @@ Return ONLY valid JSON with this structure:
 }
 ```
 
-`overall` is `"pass"` when every check is ✓, `"warn"` when there are ⚠ but no ✗,
+`overall` is `"pass"` when no check is ⚠ or ✗, `"warn"` when there are ⚠ but no ✗,
 `"fail"` when any check is ✗.
-`follow_up` is an empty array when `overall` is `"pass"`.
+An `inconclusive` or `unchecked` check counts as neither ⚠ nor ✗ for `overall`, but still gets a `follow_up` entry.
+`follow_up` is an empty array when every check is ✓.
 `skill` is the skill slug (e.g. `"setup-isolated-setup-install"`) or
 `"sandbox-add-project-root.sh --all-worktrees"` for the check-8 helper.
 Do not include any text outside the JSON object.