Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@ROADMAP.md`:
- Line 219: Update the test count in the ROADMAP.md summary so the two
occurrences match: replace the outdated "**3,120**" entry with "**3,121**" (the
same value used in the header "**3,121** tests") to keep project metrics
consistent; locate the string "**3,120**" and change it to "**3,121**".

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@ROADMAP.md`:
- Line 11: Update the ROADMAP entry for Phase 3b to resolve the inconsistency
with issue `#400`: inspect the referenced issue (`#400`) and determine whether it
covers "Multi-layer agent discovery metadata" only or also the UI task "Move
'For Agents' section above the fold"; then either remove the Phase 3b bullet
that references "[`#400`] Move 'For Agents' section above the fold" if `#400` is
fully complete, or replace that bullet with a new distinct issue reference (or
clarify the text) that explicitly describes the pending website/layout task so
Phase 3b and v0.0.102 remain consistent with the CHANGELOG and release notes.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 105-106: The CI step named "Security lint (ruff S rules)" calls
the ruff CLI (`ruff check --select S vera/`) but Ruff isn't installed by the
workflow; either add Ruff to dev dependencies in pyproject.toml or ensure the
workflow installs it before this step (e.g., a separate `pip install ruff` or
include it in the `pip install -e ".[dev]"` target). Update the workflow so the
step that runs `ruff check --select S vera/` has the ruff binary available, and
keep the step name "Security lint (ruff S rules)" and command `ruff check
--select S vera/` unchanged.

In `@vera/codegen/api.py`:
- Around line 1967-1968: The urllib.request.urlopen calls in the Http effect are
missing explicit timeouts; update both occurrences (the one using "with
urllib.request.urlopen(url) as resp:" at ~1967 and the second similar call at
~1995) to pass timeout=_INFERENCE_TIMEOUT so they behave like other callers
using _INFERENCE_TIMEOUT (60s); ensure you add the timeout keyword to each
urlopen(...) invocation and keep using the existing _INFERENCE_TIMEOUT constant.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@vera/cli.py`:
- Around line 973-975: Remove the unreachable duplicate version dispatch in the
CLI command dispatch: delete the redundant "if command in (\"version\",
\"--version\", \"-V\"): sys.exit(cmd_version())" branch found near the dispatch
that precedes "elif command == 'parse'"; ensure you only remove that duplicate
block (leaving the earlier, correct version handling intact) so the command
variable is dispatched once.
- Around line 877-883: The help text is stale — update the USAGE string so the
new "version" command and its aliases ("--version", "-V") are listed and
discoverable; modify the USAGE constant (USAGE) to include a short line for
"version" and ensure the existing args handling block (the if not args or
args[0] in ("version", "--version", "-V") branch) still calls cmd_version() for
those tokens so the behavior and help text match.

In `@vera/codegen/api.py`:
- Around line 1992-1996: The POST implementation currently hardcodes the header
"Content-Type: application/json" (see the urllib.request.Request creation in
Http.post), which prevents sending non-JSON bodies; either make the Content-Type
header configurable by accepting headers or a content_type parameter in
Http.post and pass that through to urllib.request.Request, or—if the JSON-only
restriction is intentional to match runtime.mjs—add a clear comment and update
the Http effect specification and conformance test comments to document that
Http.post only supports application/json payloads. Ensure references to
Http.post and runtime.mjs are updated so future readers know this is a
deliberate constraint or how to change it.

In `@vera/tester.py`:
- Around line 246-253: Extract the duplicated comprehension that builds
unsupported_names into a single helper function (e.g.,
get_unsupported_type_names(param_types)) and call it from both sites instead of
repeating the comprehension; the helper should accept param_types, compute
sorted({ t.name if isinstance(t, PrimitiveType) else type(t).__name__ for pt in
param_types for t in (base_type(pt),) if t not in _Z3_SUPPORTED }), and return
the list used to form skip_reason and other messages, then update references
where unsupported_names is constructed (locations around the current block and
the other occurrence near lines 435-444) to call this helper and keep
summary.skipped increment and skip_reason construction unchanged.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@TESTING.md`:
- Around line 385-388: Update the TESTING.md entries to match the actual CI
invocations: change the lint line referencing `ruff check --select S` to target
the vera package directory (`vera/`) and change the dependency-audit line to
include the pip-audit flag `--ignore-vuln CVE-2026-4539` so the documented
commands mirror the workflows (update the rows describing `lint` and
`dependency-audit` accordingly).

---

Duplicate comments:
In `@vera/cli.py`:
- Around line 879-885: The USAGE help text is missing the new version aliases;
update the USAGE string constant so it lists the new commands "version",
"--version", and "-V" (matching the handler in the args check that calls
cmd_version()), and ensure any help printing that uses USAGE (e.g., the
early-exit branch that prints USAGE before calling cmd_version() and the other
print site) will now show these aliases to users.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pyproject.toml`:
- Line 37: The ruff dependency is too loosely constrained ("ruff>=0.9"), which
allows breaking 0.x minor updates into CI; change the spec to include an upper
bound such as ">=0.9,<0.10" (or equivalent caret/compatible range) so the
package is pinned to the 0.9.x series and prevents automatic upgrades to 0.10+;
update the dependency string "ruff>=0.9" accordingly in pyproject.toml.

In `@SECURITY.md`:
- Around line 33-38: The SBOM statement is inaccurate: update SECURITY.md to
reflect that the "CycloneDX SBOM" step (generated via `cyclonedx-py environment`
in the sbom job) is gated to the main branch in `.github/workflows/ci.yml`
(`refs/heads/main`) and therefore does not run on every push/PR; change the
wording to state SBOMs are generated and uploaded for CI runs on the main branch
(or specify exact branch/trigger conditions) and keep the rest of the list
unchanged so it matches the actual `sbom` job behavior.

In `@SKILL.md`:
- Around line 1755-1758: The documentation table row stating "CLI only accepts
`Int` arguments" is outdated; remove or update that row to reflect the current
type-aware CLI argument support introduced in version 0.0.102 and align the text
with the existing command examples in this file that show non-Int usage. Replace
the incorrect limitation text with a brief note that CLI supports typed
arguments since 0.0.102 (or remove the row), ensure the examples and
changelog/version mention are consistent, and keep the `vera test` limitation
about Z3-generated types as-is if still accurate.

In `@tests/test_cli.py`:
- Around line 2695-2748: Add dispatch-level tests that exercise the actual CLI
entrypoint instead of the helper functions cmd_check/cmd_verify so parsing
regressions for the --quiet flag are caught; create new tests that invoke the
program entry (e.g., call main() or the top-level CLI runner used by tests) or
run the real subprocess command "vera check --quiet" and "vera verify --quiet"
and assert the same outcomes as the existing TestCmdQuiet tests (rc/exit code
and that stdout is empty while stderr still emits on failures), mirroring the
assertions in test_check_quiet_suppresses_ok,
test_check_quiet_still_prints_errors, and test_verify_quiet_suppresses_ok but at
the dispatch/main level. Ensure you reference the same temp file setup as in the
current tests and contrast with cmd_check/cmd_verify to validate argument
wiring.

---

Outside diff comments:
In `@HISTORY.md`:
- Line 3: Update the subtitle string "How the Vera compiler was built, from
initial commit to v0.0.102, across 30 development days." to end with v0.0.103 so
it matches the document entries (there is a v0.0.103 entry and the "By the
numbers" table extends through v0.0.103); locate and change the subtitle text in
HISTORY.md to "How the Vera compiler was built, from initial commit to v0.0.103,
across 30 development days." so the header accurately reflects the content.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@HISTORY.md`:
- Around line 217-218: The Stage 9 heading/subtitle in HISTORY.md no longer
matches the entries because v0.0.103 (29 Mar) was added; update the Stage 9
heading or subtitle to reflect the expanded date range (e.g., change “(28
March)” / “One day” to “(28–29 March)” or similar) so the stage label
encompasses both v0.0.102 and v0.0.103; adjust any adjacent parenthetical
timeline text to remain consistent with the new range and ensure the stage
description still reads correctly.

In `@ROADMAP.md`:
- Line 11: Update the summary line for v0.0.103 in ROADMAP.md to correct the
conformance test count: either change "five new conformance tests" to "four new
conformance tests" or add the missing fifth issue number to the list
(`#393`–`#396`) so the text and the list match; edit the line that begins with
"**v0.0.103** —" to keep the version string and other items unchanged while
ensuring the conformance test count accurately reflects the listed issue IDs.

In `@scripts/build_site.py`:
- Around line 387-394: build_skill_md currently returns the SKILL.md file
verbatim (reading via ROOT / "SKILL.md") which can re-publish
raw.githubusercontent.com self-links; change build_skill_md to read the file,
run a normalization pass that replaces raw GitHub raw URLs pointing to SKILL.md
(e.g., patterns like raw.githubusercontent.com/.../SKILL.md) with the canonical
on-domain path (e.g., "/SKILL.md" or "https://veralang.dev/SKILL.md"), then
return the normalized text so docs/SKILL.md never contains raw-GitHub
self-links; update references in the function that reads ROOT / "SKILL.md"
(build_skill_md) to perform this string replacement before returning.

In `@SKILL.md`:
- Around line 1753-1761: The Known Limitations intro claims all entries are
tracked but the map_new()/set_new() row shows “—”; either create a tracking
issue for map_new()/set_new() and add its link to that Issue cell, or soften the
intro sentence to say “most are tracked as open issues” and change the Issue
cell to “not tracked” (or similar). Edit the SKILL.md Known Limitations section
accordingly, updating the table row for map_new() / set_new() and the opening
sentence, and ensure the row references the exact symbols map_new() and
set_new() so the change is clear.

In `@TESTING.md`:
- Line 76: The test count mismatch: open test_conformance.py to determine the
current number of parametrized tests, then reconcile the documentation by
updating the table row that references `test_conformance.py` and the “Running
the conformance suite” snippet so they show the same, correct value;
specifically edit the table entry for `test_conformance.py` and the snippet text
that currently says 325 to reflect the verified count from `test_conformance.py`
(or rerun the conformance run command to confirm the runtime count) so both
places match.
- Around line 402-413: The header stating "seven parallel jobs" is inconsistent
with the table that lists eight jobs; update the header to the correct count
(change "seven" to "eight") or collapse the duplicate "test" entries into a
single combined row so the number matches, and ensure the listed GitHub Actions
job names (test, test (coverage), typecheck, lint, security, dependency-audit,
sbom, browser-parity) reflect the actual matrix in ci.yml; make the minimal edit
to TESTING.md to keep the summary and table consistent.
- Line 11: Update the inconsistent conformance count so all in-file references
match: change the heading line containing "**Conformance programs** | 70
programs..." and the later "Conformance Suite" intro that currently says "65" so
they both state the same total (use 70 as indicated in the headline), and scan
the rest of TESTING.md for any other occurrences of "65" or the conformance
total and make them consistent; ensure any related descriptive text or totals
that depend on the number are updated accordingly.

In `@tests/test_cli.py`:
- Around line 2729-2748: Add a failure-path assertion to
test_verify_quiet_suppresses_ok: create a variant of the input that fails
verification, call cmd_verify(str(fail_file), quiet=True), assert the return
code is non-zero, assert captured.out is empty (quiet suppresses stdout) and
assert captured.err contains verification diagnostics (e.g., "Verification:" or
other error messages); update the same test function
(test_verify_quiet_suppresses_ok) to perform both the success case using the
existing file and a failure case using a deliberately-broken file, referencing
cmd_verify, captured.out and captured.err to locate the relevant assertions.