📚 docs: decisions: Record author and reviewer sessions

.agents/skills/verify-nicely/SKILL.md

@@ -17,13 +17,27 @@ Copy this checklist and tick each step:
 - [ ] 5. Evidence: the transcripts outlive the cleanup, and the report quotes them
 ```
 
+On Linux, a run also needs `dbus-run-session` and `gnome-keyring-daemon`.
+Launch fails with the missing program's name; it never uses the caller's D-Bus session.
+The run starts and unlocks its own keyring in one private session, shared by every later step.
+Cleanup stops that keyring and its bus before removing scratch files.
+The session also stops when its owned state or runtime marker disappears, and expires after six hours.
+Start a new run after expiry; the wrapper never falls back to the user's session.
+The Linux integration test follows this real start, auth and cleanup path.
+It skips with the missing program's name when either prerequisite is absent.
+[The lifecycle test](../../../cmd/ncly/keyring_lifecycle_linux_test.go) requires a normal private stop to record exit 0 without a shell diagnostic.
+It also checks daemon termination and private runtime removal.
+The macOS keychain path is unchanged.
+
 ## Launch
 
 ```bash
 run="$(just verify)"
 ```
 
-`just verify` runs `scripts/verify.sh start`. It builds `ncly` from the checkout as it is, uncommitted changes included, into `$run/build/`. It makes a scratch home in `$run/scratch/home/`, with its own XDG folders, and installs the Go fixture `hello` there as an external extension, in `.local/share/nicely/extensions/`, with its manifest, catalogs, and skill beside it. It writes the wrapper `$run/scratch/bin/ncly`, which sets `HOME`, the XDG folders, and a `PATH` without any folder that holds an `ncly-<domain>` file, and unsets `NCLY_CONFIG`, which would point the config elsewhere, so every later command reaches only the scratch folder. On macOS, the auth feature points `HOME` back at the real home, as [auth](features/auth.md) says. Its last line on stdout is the run folder, under `${XDG_CACHE_HOME:-$HOME/.cache}/nicely/verify/`. Done when that folder holds `scratch/bin/ncly`.
+`just verify` runs `scripts/verify.sh start`. It builds `ncly` from the checkout as it is, uncommitted changes included, into `$run/build/`. It makes a scratch home in `$run/scratch/home/`, with its own XDG folders, and installs the Go fixture `hello` there as an external extension, in `.local/share/nicely/extensions/`, with its manifest, catalogs, and skill beside it. It writes the wrapper `$run/scratch/bin/ncly`, which sets `HOME`, the XDG folders, and a `PATH` without any folder that holds an `ncly-<domain>` file, and unsets `NCLY_CONFIG`, which would point the config elsewhere, so every later command reaches only the scratch folder. On Linux, the wrapper replaces the caller's bus address and runtime directory with the private session of this run.
+A missing or stopped private session fails the call, with no fallback.
+On macOS, the auth feature points `HOME` back at the real home, as [auth](features/auth.md) says. Its last line on stdout is the run folder, under `${XDG_CACHE_HOME:-$HOME/.cache}/nicely/verify/`. Done when that folder holds `scratch/bin/ncly`.
 
 ## Doctor
 
@@ -49,13 +63,17 @@ just verify cleanup "$run"
 ```
 
 `cleanup` makes scratch and build files writable, including Go's module cache, before removal.
+On Linux, it first stops the private keyring and D-Bus session, after any fake-key cleanup.
+Its evidence records that stop. A stop failure keeps scratch files and fails cleanup.
+If the private session already ended, cleanup discards its private keyring with the scratch folder.
 It keeps `$run/evidence/` and refuses a folder that `start` did not create.
 When the run prepared `auth`, cleanup first removes its fake key and checks that the keychain reports `AUTH_MISSING`.
 Both calls remain in `$run/evidence/cleanup.txt`.
 Its stderr says `logged the fake key of verifynicely out of the keychain` only after removal.
 Otherwise, stderr says `found no fake key`.
 When the key may remain, cleanup keeps scratch and exits 1.
-Run cleanup again once the keychain answers.
+On macOS, run cleanup again once the login keychain answers.
+On Linux, rerun cleanup to discard the stopped private keyring and its scratch files.
 Run cleanup after a failed drive too.
 Done when cleanup lists the evidence files and both `$run/scratch` and `$run/build` are gone.
 

.agents/skills/verify-nicely/features/README.md

@@ -35,7 +35,7 @@ Each feature file starts with an H1 title and one paragraph about what the user
 ## Features
 
 - `shared-domains.md` covers named roots, shared discovery, help, describe, completion, skills, config ownership, doctor, and grants
-- `hello.md` covers the Go fixture installed as an external extension: discovery, help, answers, errors, reports, describe, its skill, and doctor
+- `hello.md` covers the installed external Go fixture extension: discovery, help, answers, errors, reports, describe, its skill, doctor, and bounded handler cleanup of private staging
 - `auth.md` covers `ncly auth` against the real keychain, with a test service and a fake key: status and its grants, login, logout, grant, revoke, the masked field and the confirmations in a terminal, doctor, and the cleanup of the fake key
 - `terminal.md` covers `ncly` on a real terminal inside tmux, whose server does not answer: the version and the root help answer at once
 - `agent.md` covers `just install` in the scratch home and the installed `agent` extension, with a counted stub Codex: discovery, help, its skill, the Codex check of doctor, the dry run of `ncly agent run`, its depth limit, and one recorded run with its saved answer