AP-3 Tested as installed

A product's agent surface MUST be exercised from its published artefact, loaded the way an installing consumer loads it, and not only from the source checkout.

Field	Value
Keyword	MUST
Level	profile
Checked	by judgement
Findings	F407, F306
Harness facts	H8, H13; O2 (observed)
Threat	construct: defects are known only where a consumer reported them
Status	active

Rationale: roadkeep's published plugin shipped a skill whose frontmatter the loader dropped in silence (O2), an MCP server from which no tool reached the client, and its own CLAUDE.md in the payload; Shio published four skills its own settings never loaded, so "every breakage in them arrived as somebody else's report" [shio@d1853cbea] (F407, R3/S2). Inside its own checkout a session reaches the producer's files by other routes, the repository's .mcp.json (H8), docs and a repo-local skill, so it does not see what a consumer sees. The remedies load the artefact as published: roadkeep runs claude plugin validate --strict in CI at a pinned version (H13), and Shio enables its own published plugin in its committed settings (F306, R3/S3). Discoverability is the same question: Shio named the gap that "the reader with the repository mounted is not the reader who installs (SH605)" [shio@7820e57a7], so a test of whether an agent finds the surface counts only when it runs without the source on disk.