Add Homeboy Codebox canary verification

README.md

@@ -60,6 +60,8 @@ wp-coding-agents works in two modes with the same setup:
 
 Installs without Homeboy still use Data Machine workspaces, flows, jobs, and bridge dispatch. Installs without Kimaki use the selected bridge or terminal runtime; Kimaki-specific routing only applies when Kimaki is selected.
 
+Homeboy setup verification normally proves Homeboy is installed, linked, and advertised through `datamachine_code_homeboy_available`. To prove the full Codebox fleet-cooking path, run the explicit opt-in `scripts/verify-homeboy-codebox-canary.sh` helper from the verification skill. It can call a model, so it requires provider secret environment variable names and validates only read-only status/log/artifact evidence.
+
 ## Quick Start
 
 ### Local (macOS / Linux Desktop)

lib/homeboy.sh

@@ -364,4 +364,5 @@ print_homeboy_verification_commands() {
   echo "  homeboy extension show wordpress"
   echo "  homeboy project show <project-id>"
   echo "  homeboy project components list <project-id>"
+  echo "  ./scripts/verify-homeboy-codebox-canary.sh --workspace <repo-or-worktree> --secret-env <ENV_NAME> --agents-api <path> --agent-runtime <path> --agent-runtime-tools <path> --provider-plugin-path <path>  # opt-in model-backed Codebox canary; add --run to execute"
 }

lib/wp-codebox.sh

@@ -32,8 +32,8 @@ _wp_codebox_latest_tag() {
 _wp_codebox_header_version() {
   local main_file="$1"
   [ -f "$main_file" ] || return 1
-  grep -m1 -E '^\s*\*?\s*Version:' "$main_file" \
-    | sed -E 's/.*Version:\s*([0-9][0-9.]*).*/\1/'
+  grep -m1 -E '^[[:space:]]*\*?[[:space:]]*Version:' "$main_file" \
+    | sed -E 's/.*Version:[[:space:]]*([0-9][0-9.]*).*/\1/'
 }
 
 update_wp_codebox_plugin_subtree() {