refactor(reporting)!: decouple instances from shared pipelines

.agents/skills/benchmark-report/SKILL.md

@@ -12,11 +12,20 @@ Read the repository's `AGENTS.md` first. Project rules override this general ski
 Before writing report HTML, resolve the track through `scripts/report_template.py`. Inspect the maintained implementation and its pinned example. Reuse that implementation and its release checks; a different cohort or diagnostic evidence state calls for a data adapter or explicit mode. If no track fits, create the smallest reusable renderer with a synthetic runnable example and behavioral checks, then register it in `configs/report-templates.json`. Improve the owning template and this skill from demonstrated gaps, without embedding run-specific prose or copying old measurements. A report must carry the selected template identity and input hashes so its release check can detect a bypass.
 
 Derive bilingual counts, budgets and method labels from the selected inputs.
+Bind cohort-specific access and interface documentation in the participant registry;
+reuse engine-level adapter contracts instead of adding per-version renderer tables.
 Keep report-specific prose and its translations in explicitly bound content;
 do not choose a historical article from provider names or task-family guesses.
 Without a content binding, render the maintained data-derived explanation.
 Prove reuse through the public build and check entries with a different external
 task/method inventory, not only by searching for old numbers in source code.
+Exercise assembly and packaging with that external profile as well. Participant
+IDs, labels, interfaces and comparison roles come from the instance registry;
+a new cohort must not inherit a historical method's account or timing claims.
+Disclose declared literal, fact, body-region, record, resource and identity checks
+separately. A task instruction is not a full-text reference. Preserve frozen
+verdicts while exposing passes without verified page identity, blocked-page
+markers and unexpected resource URLs as diagnostics.
 
 An explicitly requested diagnostic report may be delivered separately from a certified benchmark release. Use the diagnostic build/check entry, label its evidence state and certification gaps on every page, preserve saved scores and outputs, and do not publish rankings or upgrade certification. It does not waive any certified-release reference or review gate. Presentation fixes add no provider calls. Update only the owning code, relevant instructions and demonstrated regression scenarios; do not mechanically modify every skill or copy report-specific conclusions into instructions.
 

.agents/skills/benchmark-report/references/audit-and-revision.md

@@ -98,3 +98,14 @@ message. Reproject retained full responses without new product calls when only
 this selection changed; missing historical envelopes require fresh calls across
 the full declared correction scope before claiming revised benchmark scores.
 Reruns of unchanged compiled acceptance-contract tasks freeze the existing executable dataset. They do not require recovering historical qualification raw files or repeating admission review. Source qualification is part of task authoring and reference/rule correction, not a prerequisite for every provider-version comparison. Preserve historical receipts without applying their evidence-file requirements to a new execution protocol.
+
+A published-snapshot score audit uses the maintained Web Fetch profile adapter,
+not a copied renderer. Bind the complete original export, full historical matrix,
+initial and corrected scores, per-input original/public/scored hashes, and every
+changed decision. Preserve collection facts and timing. Evaluate a suspected
+privacy effect with the historical scorer on the same public bytes; a redaction
+receipt by itself does not establish causation. Keep source-backed annotation
+corrections and executable regression provenance together. Reuse the native
+report's routes, interpretation schema, structured history and packer, and run its
+explicit snapshot audit browser gate before packaging. The catalog provides the
+runnable example and commands. Store instance evidence and prose outside Git.

.agents/skills/benchmark-report/references/report-and-release.md

@@ -2,9 +2,9 @@
 
 ## Template discovery and diagnostic models
 
-Run `make report-template TRACK=webfetch` (or `trajectory-replay` / `browser-use`) before authoring. The registry returns the maintained owner, current profile, version-pinned example, build and check commands. A reference report supplies presentation conventions, never evidence or the new publication target. Extend the owner instead of copying its HTML into a temporary renderer.
+Run `make report-template TRACK=webfetch` (or `trajectory-replay` / `browser-use`) before authoring. The registry returns the maintained owner, version-pinned example, build and check commands. A reference report supplies presentation conventions, never evidence or the new publication target. Extend the owner instead of copying its HTML into a temporary renderer.
 
-For explicitly requested live WebFetch diagnostics, use `make webfetch-diagnostic-report DIAGNOSTIC_PROFILE=evaluation/<instance>/current-report.json OUTPUT=/absolute/new-output`; `EVIDENCE=/absolute/source` optionally supplies an explicit input. The `webfetch_cohort_diagnostic/1` model contains cohorts, per-case Boolean first-call verdicts, declared summary counts, cause/source labels, review counts and hash-bound reference/output/source/log files. `tests/test_report_templates.py:diagnostic_example` is a runnable two-scenario fixture through the public builder; its test command is registered alongside the variant. The release checker recomputes totals and validates rendered verdicts, complete evidence bindings, dialogs and links. A diagnostic remains diagnostic; this path cannot substitute for a certified build.
+For explicitly requested live WebFetch diagnostics, use `make webfetch-diagnostic-report DIAGNOSTIC_PROFILE=/absolute/instance-profile.json OUTPUT=/absolute/new-output`; `EVIDENCE=/absolute/source` optionally supplies an explicit input. The `webfetch_cohort_diagnostic/1` model contains cohorts, per-case Boolean first-call verdicts, declared summary counts, cause/source labels, review counts and hash-bound reference/output/source/log files. `tests/test_report_templates.py:diagnostic_example` is a runnable two-scenario fixture through the public builder; its test command is registered alongside the variant. The release checker recomputes totals and validates rendered verdicts, complete evidence bindings, dialogs and links. A diagnostic remains diagnostic; this path cannot substitute for a certified build.
 
 For a new report type, first persist a reusable example and scenario-based positive/negative tests, register its owner and release gate, then generate the requested report. Later corrections update the owner and relevant rules when supported by evidence; do not clone a template per run or embed report-specific conclusions in instructions.
 

.github/workflows/ci.yml

@@ -45,8 +45,9 @@ jobs:
       - run: make setup-test
       - run: make ci
       - name: Exercise rendered reference capture
+        timeout-minutes: 5
         run: |
           uv sync --frozen --extra test --extra headless-eval
-          uv run --frozen --no-sync playwright install --with-deps chromium
+          uv run --frozen --no-sync playwright install chromium
           export BROWSER_EVAL_TEST_BROWSER_BINARY="$(uv run --frozen --no-sync python -c 'from playwright.sync_api import sync_playwright; p = sync_playwright().start(); print(p.chromium.executable_path); p.stop()')"
           uv run --frozen --no-sync python -m pytest tests/test_browser_observation_contracts.py -q