Crabbox

• PR CI = default broad proof. First: focused local tests + targeted lint/typecheck/format. Checks pass + change builds: open ready PR; CI runs broad suites. Never hold PR for pre-PR suite runs.
• Box only for gaps in CI/local coverage: another OS/device, live providers/channels, long E2E, heavy benchmarks. Acquire only with command ready + immediate grant.
• Queued: stop task-owned request; run locally. Never wait on queue or chain Testbox → AWS → other providers.
• Fix real failures; never rerun/re-push merely for green. Read available CI failure classification before attributing failure to change.

Repository Contract

• Skill owns portable routing, leases, sync, commands, cleanup.
• Resolve <check-command>, runtime/container image, PR, bootstrap from trusted consumer instructions, package scripts, or hydration workflow.
• Never invent missing commands or copy another consumer's setup.
• Always report provider, id, run URL, command, result. Never call Testbox “AWS Crabbox” or local Docker remote proof.

Authorization and Isolation

• Routine configured use: creating/reusing/stopping task-owned leases, temporary state, clean checkouts/worktrees for proof or required Crabbox repair; no separate approval.
• Preserve user checkouts, branches, unrelated edits; dirty/missing/occupied checkouts: use task-owned ones.
• Preserve source-trust, credential, production-access, budget, publication boundaries.