HIGH-1: submodule URL ssh → https + shallow (DNS spoofing surface, both repos) HIGH-3: docs/DNA-MIGRATION.md — two-format coexistence policy (4-seg legacy task-class vs 5-seg agent-shell marketplace) HIGH-5: agent_shell_dna doc — explicit consumer = marketplace, planned ledger integration; module-doc clarification MEDIUM: Haiku model id pinned to claude-haiku-4-5-20251001 across pricing.rs::from_slug + ::name + escalate.rs tests + select_posterior fixture + kei-registries submodule (pushed c39e528→7aaa6a7)
Closes audit HIGH-1 (SSoT drift between KSK and marketplace). _blocks/registries/ now tracks the single canonical kei-registries repo; marketplace consumes the same submodule.
