diff --git a/plugins/docs-tools/skills/verify-procedure/SKILL.md b/plugins/docs-tools/skills/verify-procedure/SKILL.md
new file mode 100644
index 00000000..041c17bd
--- /dev/null
+++ b/plugins/docs-tools/skills/verify-procedure/SKILL.md
@@ -0,0 +1,143 @@
+---
+name: verify-procedure
+description: Execute, test, and verify AsciiDoc procedures on a live OpenShift or Kubernetes cluster. Runs every command and validates every YAML block against a real cluster. Use this skill whenever the user asks to verify a procedure, test documentation steps, run through a guided exercise, prove a procedure works, check if steps are correct on a live system, or do a dry run of a doc. Requires an active oc/kubectl connection. For static review without a live system, use docs-tools:technical-reviewer instead.
+allowed-tools: Bash, Read, Edit, Glob, Grep
+---
+
+# Procedure Verification Skill
+
+You execute documented OpenShift/Kubernetes procedures against a live cluster to prove they work end-to-end. **You** are the parser and judgment layer. The bash script `scripts/verify_proc.sh` is a thin executor — it only runs commands, validates YAML, and saves files.
+
+**This is not a review tool.** For reviewing documentation quality without a live system, use `docs-tools:technical-reviewer`.
+
+## Architecture: what you do vs. what the script does
+
+| You (Claude) | Script (`verify_proc.sh`) |
+|---|---|
+| Read and parse the `.adoc` file | `init` — create workdir, detect oc/kubectl |
+| Resolve `include::` directives by reading included files | `check-connection` — verify cluster login |
+| Handle `ifdef::`/`ifndef::` conditionals intelligently | `execute <label> <command>` — run a command |
+| Extract source blocks (understand nesting, listing blocks, callouts) | `validate-yaml <label> [file]` — YAML syntax + dry-run |
+| Classify each block: execute, validate, save-to-file, skip (example output), skip (placeholders) | `validate-json <label>` — JSON syntax check |
+| Strip prompt symbols from commands (`$`, `#`, `[root@host ~]#`) | `save-file <label> <path>` — write content to workdir |
+| Detect backslash-continued lines and join them | `cleanup` — delete resources + workdir |
+| Identify placeholders that need user substitution | `summary` — print pass/fail totals |
+| Number steps hierarchically (1, 1.a, 1.b, 2.a.i) | |
+| Flag suspicious patterns and undocumented assumptions | |
+| Resolve AsciiDoc attributes (`{product-version}`, etc.) | |
+
+## Profiles
+
+Optional `.profile.md` files in `assets/` configure verification runs with attributes, substitutions, prerequisites, scope, assertions, and cleanup. See `references/profile-format.md` for the full format.
+
+**Discovery order**: explicit `--profile <path>` → auto-discover by matching `procedure` frontmatter → no profile (default behavior). Report the profile in the output header if found; no profile is not an error.
+
+**Loading**: Read the profile and parse its YAML frontmatter and sections (`## Attributes`, `## Substitutions`, `## Prerequisites`, `## Scope`, `## Assertions`, `## Cleanup`). Store parsed data for use in subsequent steps.
+
+## Workflow
+
+### Step 0: Init and connectivity
+
+```bash
+export VERIFY_TIMEOUT=300  # if profile defines timeout
+bash scripts/verify_proc.sh init
+bash scripts/verify_proc.sh check-connection
+```
+
+If connection fails: stop and suggest `oc login` (or `docs-tools:technical-reviewer` for offline review), unless profile `mode` is `yaml-only` — then continue without a cluster.
+
+If the profile has prerequisite setup commands, execute them sequentially via `execute "prereq-N" "<command>"`. Stop if any fail.
+
+### Step 1: Parse the AsciiDoc file
+
+Read the `.adoc` file. Resolve `include::` directives (read included files, resolve relative paths). Resolve `ifdef::`/`ifndef::` using profile flags → document header → `_attributes.adoc` (warn if unresolvable). Do NOT silently skip content or mis-number steps.
+
+#### Extract and classify source blocks
+
+Identify `[source,TYPE]` blocks (`terminal`, `bash`, `shell`, `yaml`, `json`) within `----` delimiters. Strip callout annotations (`<1>`, `<2>`). Skip listing blocks without `[source]` (display-only).
+
+| Classification | Criteria | Action |
+|---|---|---|
+| **execute** | `[source,terminal/bash/shell]` with actual commands | Strip prompts (`$`, `#`, `[root@host ~]#`), join `\`-continued lines, send to `execute` |
+| **validate-yaml/json** | `[source,yaml]` or `[source,json]` | Pipe to `validate-yaml` or `validate-json` |
+| **save-to-file** | Step says "save/create a file" + filename | Pipe to `save-file` or `validate-yaml` with filename arg |
+| **skip-example** | Preceded by "Example/sample/expected output" | Skip, report `[SKIP]` |
+| **skip-placeholder** | Contains `<placeholder>`, `${VAR}`, `CHANGEME` without profile substitutions | Skip, report with explanation |
+
+Number steps hierarchically: `.` → 1,2,3 / `..` → 1.a,1.b / `...` → 1.a.i,1.a.ii.
+
+#### Resolve attributes and apply profile overrides
+
+Attribute priority: profile → document header → `_attributes.adoc` → cluster fallback (`oc version` for `{product-version}`).
+
+After classification, apply profile substitutions to resolve placeholders (reclassify `skip-placeholder` → appropriate type if all placeholders are covered). Then apply scope controls (`steps`, `skip`, `mode`) to filter the block list.
+
+### Step 2: Execute the procedure
+
+Process blocks sequentially. Use heredocs for content piping:
+
+```bash
+bash scripts/verify_proc.sh execute "1.a" "oc get pods -n openshift-operators"
+bash scripts/verify_proc.sh validate-yaml "1.a" ["filename.yaml"] <<'YAML'
+...
+YAML
+bash scripts/verify_proc.sh validate-json "2" <<'JSON'
+...
+JSON
+bash scripts/verify_proc.sh save-file "3.a" "config.conf" <<'CONTENT'
+...
+CONTENT
+```
+
+Skip blocks: just report `[SKIP]` in output.
+
+#### Assertions
+
+After each step, check profile assertions (`contains`, `not-contains`, `regex`, `exit-code`). All must pass — assertion failures override exit code 0. Report as `[ASSERT] <label> N/N passed` or `[FAIL] <label> reason`. Steps without assertions use exit code 0 = pass.
+
+### Step 3: Observations
+
+After all blocks are processed, run:
+```bash
+bash scripts/verify_proc.sh summary
+```
+
+Then add your own observations:
+- Steps that reference resources not created by earlier steps
+- Missing `wait` or polling between create and verify steps
+- Prerequisites that aren't documented
+- Namespace assumptions
+- Commands that would fail without prior `oc login` or specific permissions
+
+### Step 4: Cleanup
+
+Profile `cleanup` value controls behavior: `auto` (run immediately), `manual` (default — wait for user), `skip` (no cleanup). Run `bash scripts/verify_proc.sh cleanup`. If the profile has a `## Cleanup` section, preserve listed resources and execute additional cleanup commands afterward.
+
+## Assemblies and partial cluster state
+
+For assemblies: verify end-to-end (resolve all `include::` first). For single modules: verify but warn about possible parent assembly dependencies.
+
+When a step fails due to missing prerequisites: report clearly, continue with remaining steps, and list discovered prerequisites in observations.
+
+## What to flag
+
+Missing prerequisites, missing wait/polling between create and verify steps, undocumented permission requirements (`cluster-admin`), unresolvable placeholders, deprecated API versions, and `ifdef` assumptions.
+
+## Output format
+
+Present results as you go:
+
+```
+--- Procedure Verification: <filename> ---
+Profile: <name> (or "none") | CLI: oc | Mode: execute | Cleanup: auto
+
+[Step 1.a] YAML syntax: PASS | Saved to: /tmp/verify-proc-XXXXXX/file.yaml
+[Step 1.b] Executing: oc create -f file.yaml → PASS [ASSERT 1/1]
+[Step 2]   [SKIP] placeholder: <your-registry-url>
+
+--- Observations ---
+- <judgment calls>
+
+--- Summary ---
+Total: 7 | Passed: 7 | Failed: 0 | Assertions: 2/2 passed
+```
diff --git a/plugins/docs-tools/skills/verify-procedure/assets/.gitkeep b/plugins/docs-tools/skills/verify-procedure/assets/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/plugins/docs-tools/skills/verify-procedure/references/profile-format.md b/plugins/docs-tools/skills/verify-procedure/references/profile-format.md
new file mode 100644
index 00000000..a163c484
--- /dev/null
+++ b/plugins/docs-tools/skills/verify-procedure/references/profile-format.md
@@ -0,0 +1,258 @@
+# Verify-Procedure Profile Format
+
+A profile is a Markdown file that configures a verify-procedure run against a procedure in an external repository. Profiles live in `profiles/` under this skill directory, organized by target repo and topic.
+
+## File naming
+
+```
+<procedure-name>.profile.md
+```
+
+Examples:
+- `installing-ptp-operator.profile.md`
+- `installing-ptp-operator-sno.profile.md` (environment-specific variant)
+
+## Directory structure
+
+```
+profiles/
+├── openshift-docs/
+│   ├── networking/
+│   │   ├── installing-ptp-operator.profile.md
+│   │   └── installing-ptp-operator-sno.profile.md
+│   └── security/
+│       └── configuring-certificates.profile.md
+└── validated-patterns-docs/
+    └── getting-started.profile.md
+```
+
+The directory structure mirrors the target repo's topic layout. This is a convention for discoverability, not enforced.
+
+## Frontmatter
+
+```yaml
+---
+procedure: ~/openshift-docs/modules/networking/installing-ptp-operator.adoc
+description: Verify PTP operator installation on SNO cluster
+cluster: sno
+timeout: 300
+cleanup: auto
+---
+```
+
+| Field | Required | Default | Description |
+|---|---|---|---|
+| `procedure` | **Yes** | — | Absolute or `~`-relative path to the `.adoc` file in the external repo |
+| `description` | No | — | Human-readable label shown in output header |
+| `cluster` | No | — | Freeform tag for organizing profiles by environment |
+| `timeout` | No | `120` | Command timeout in seconds, passed as `VERIFY_TIMEOUT` env var |
+| `cleanup` | No | `manual` | `auto` runs cleanup after summary; `skip` disables it; `manual` (default) waits for user |
+
+## Sections
+
+All sections are optional. A profile with only frontmatter is valid.
+
+### Attributes
+
+Define AsciiDoc attribute values and ifdef/ifndef conditional resolution.
+
+```markdown
+## Attributes
+
+| Attribute | Value |
+|---|---|
+| `product-title` | `OpenShift Container Platform` |
+| `product-version` | `4.17` |
+| `op-system-base-full` | `Red Hat Enterprise Linux (RHEL)` |
+
+### Conditionals
+
+| Attribute | Defined? |
+|---|---|
+| `openshift-enterprise` | yes |
+| `openshift-origin` | no |
+| `openshift-dedicated` | no |
+```
+
+- Attribute values replace `{attribute-name}` references in source blocks before execution
+- Conditional flags determine which `ifdef::`/`ifndef::` branches to include
+- Profile attributes override values found in the document header or `_attributes.adoc`
+
+### Substitutions
+
+Map placeholders to real values. Blocks that would be skipped as `skip-placeholder` become executable when all their placeholders are covered.
+
+```markdown
+## Substitutions
+
+| Placeholder | Value | Notes |
+|---|---|---|
+| `<your-registry-url>` | `quay.io/kquinn-test` | |
+| `<project-name>` | `verify-test-ns` | Created in prerequisites |
+| `<your-token>` | `sha256~ABCdef123` | SA token from prereqs |
+| `CHANGEME` | `my-real-value` | |
+```
+
+Matching rules:
+- `<placeholder>` — matches the literal angle-bracket string
+- `${VAR}` and `$VAR` — both forms are matched
+- `CHANGEME`, `REPLACE` — matched as whole words only
+
+### Prerequisites
+
+Declare assumed cluster state and setup commands to run before the procedure.
+
+```markdown
+## Prerequisites
+
+### Assumed state
+
+- Operator `ptp-operator` is installed in namespace `openshift-ptp`
+- User has `cluster-admin` role
+- Cluster is SNO (single-node OpenShift)
+
+### Setup commands
+
+```bash
+oc create namespace verify-test-ns --dry-run=client -o yaml | oc apply -f -
+oc label namespace verify-test-ns test-run=verify --overwrite
+```
+```
+
+- "Assumed state" is informational — included in the output header and used to contextualize failures
+- "Setup commands" execute sequentially before Step 1. A failure aborts the run
+
+### Scope
+
+Control which steps to execute, skip, or treat differently.
+
+```markdown
+## Scope
+
+| Control | Value |
+|---|---|
+| `mode` | `execute` |
+| `steps` | `1-5` |
+| `skip` | `3.b, 4.a` |
+```
+
+| Control | Values | Default | Description |
+|---|---|---|---|
+| `mode` | `execute`, `dry-run-only`, `yaml-only` | `execute` | `dry-run-only` validates YAML and does `--dry-run=client` but skips `oc create/apply`. `yaml-only` only checks YAML/JSON syntax |
+| `steps` | Range (`1-5`), list (`1,3,5`), or `all` | `all` | Which top-level steps to include |
+| `skip` | Comma-separated step labels | — | Steps to skip (reported as `[SKIP]`) |
+
+Step labels use hierarchical numbering: `1`, `1.a`, `2.b.i`.
+
+### Assertions
+
+Define expected outcomes for specific steps.
+
+```markdown
+## Assertions
+
+| Step | Type | Expected |
+|---|---|---|
+| `1.b` | `contains` | `namespace/openshift-ptp created` |
+| `4` | `contains` | `Succeeded` |
+| `4` | `not-contains` | `Failed` |
+| `5.a` | `exit-code` | `0` |
+| `6` | `regex` | `ptp-operator\.v4\.\d+\.\d+` |
+```
+
+| Type | Description |
+|---|---|
+| `contains` | stdout includes the string (case-sensitive) |
+| `not-contains` | stdout does NOT include the string |
+| `regex` | stdout matches the regex pattern |
+| `exit-code` | command exited with this code (default is `0`) |
+
+- A step can have multiple assertions — all must pass
+- Assertion failures override exit-code pass/fail
+- Steps without assertions use exit code only (existing behavior)
+
+### Cleanup
+
+Override default cleanup behavior.
+
+```markdown
+## Cleanup
+
+### Preserve
+
+- `namespace/openshift-ptp`
+- `clusterrole/ptp-operator`
+
+### Additional
+
+```bash
+oc delete project verify-test-ns --ignore-not-found
+oc delete catalogsource custom-catalog -n openshift-marketplace --ignore-not-found
+```
+```
+
+- **Preserve**: resources to NOT delete during cleanup
+- **Additional**: extra cleanup commands run after standard tracked-resource deletion
+
+## Complete example
+
+```markdown
+---
+procedure: ~/openshift-docs/modules/networking/installing-ptp-operator.adoc
+description: Verify PTP operator installation on SNO cluster
+cluster: sno
+timeout: 300
+cleanup: auto
+---
+
+## Attributes
+
+| Attribute | Value |
+|---|---|
+| `product-version` | `4.17` |
+
+### Conditionals
+
+| Attribute | Defined? |
+|---|---|
+| `openshift-enterprise` | yes |
+
+## Substitutions
+
+| Placeholder | Value | Notes |
+|---|---|---|
+| `<channel>` | `stable` | |
+
+## Prerequisites
+
+### Assumed state
+
+- Cluster is reachable and user has cluster-admin
+
+### Setup commands
+
+```bash
+oc adm policy add-cluster-role-to-user cluster-admin $(oc whoami) 2>/dev/null || true
+```
+
+## Scope
+
+| Control | Value |
+|---|---|
+| `mode` | `execute` |
+| `steps` | `all` |
+
+## Assertions
+
+| Step | Type | Expected |
+|---|---|---|
+| `1.b` | `contains` | `created` |
+| `4` | `contains` | `Succeeded` |
+
+## Cleanup
+
+### Additional
+
+```bash
+oc delete project openshift-ptp --ignore-not-found
+```
diff --git a/plugins/docs-tools/skills/verify-procedure/scripts/verify_proc.sh b/plugins/docs-tools/skills/verify-procedure/scripts/verify_proc.sh
new file mode 100755
index 00000000..214a82c9
--- /dev/null
+++ b/plugins/docs-tools/skills/verify-procedure/scripts/verify_proc.sh
@@ -0,0 +1,397 @@
+#!/usr/bin/env bash
+# verify_proc.sh — Thin executor for procedure verification.
+#
+# Claude handles AsciiDoc parsing and intent classification.
+# This script only does what requires a shell: execute commands,
+# validate YAML against a live cluster, save files, and clean up.
+#
+# Usage:
+#   verify_proc.sh init                          → create workdir, detect CLI tool
+#   verify_proc.sh execute <label> <command>     → run a shell command in workdir
+#   verify_proc.sh validate-yaml <label> [file]  → validate YAML from stdin (syntax + dry-run)
+#   verify_proc.sh validate-json <label>         → validate JSON from stdin
+#   verify_proc.sh save-file <label> <path>      → save stdin content to workdir/<path>
+#   verify_proc.sh check-connection              → verify cluster connectivity
+#   verify_proc.sh cleanup                       → delete tracked resources + workdir
+#   verify_proc.sh summary                       → print pass/fail summary
+#
+# All output is structured for Claude to parse:
+#   [PASS]    <label> <message>
+#   [FAIL]    <label> <message>
+#   [SKIP]    <label> <message>
+#   [INFO]    <message>
+#   [WORKDIR] <path>
+#   [CLI]     <tool>
+#
+# Session isolation: init creates a unique session ID. All temp files
+# include this ID so concurrent runs don't interfere.
+
+set -o pipefail
+
+TIMEOUT="${VERIFY_TIMEOUT:-120}"
+
+# Session file stores the workdir path; its name is the session anchor.
+# init writes it; all other commands read it.
+SESSION_FILE="/tmp/verify-proc-session"
+
+# --- Helpers ---
+
+detect_cli() {
+  if command -v oc &>/dev/null; then
+    echo "oc"
+  elif command -v kubectl &>/dev/null; then
+    echo "kubectl"
+  else
+    echo ""
+  fi
+}
+
+# Derive all temp file paths from the workdir path (set during init).
+# This ensures concurrent sessions use separate files.
+session_paths() {
+  local workdir="$1"
+  local sid="${workdir##*-}"  # extract suffix from /tmp/verify-proc-XXXXXX
+  TRACKED_FILE="/tmp/verify-proc-tracked-${sid}"
+  COUNTER_FILE="/tmp/verify-proc-counters-${sid}"
+  STDERR_FILE="/tmp/verify-proc-stderr-${sid}"
+}
+
+load_session() {
+  if [[ ! -f "$SESSION_FILE" ]]; then
+    echo "[FAIL] session No active session — run init first"
+    exit 1
+  fi
+  WORKDIR=$(cat "$SESSION_FILE")
+  if [[ -z "$WORKDIR" || ! -d "$WORKDIR" ]]; then
+    echo "[FAIL] session Working directory missing — run init first"
+    exit 1
+  fi
+  session_paths "$WORKDIR"
+}
+
+read_counter() {
+  local name="$1"
+  local file="$2"
+  if [[ -f "$file" ]]; then
+    grep "^${name}=" "$file" 2>/dev/null | head -1 | cut -d= -f2 | grep -E '^[0-9]+$' || echo 0
+  else
+    echo 0
+  fi
+}
+
+save_counters() {
+  local pass_count="$1"
+  local fail_count="$2"
+  printf 'PASS_COUNT=%d\nFAIL_COUNT=%d\n' "$pass_count" "$fail_count" > "$COUNTER_FILE"
+}
+
+pass() {
+  local label="$1"; shift
+  echo "[PASS] $label $*"
+  local p f
+  p=$(read_counter PASS_COUNT "$COUNTER_FILE")
+  f=$(read_counter FAIL_COUNT "$COUNTER_FILE")
+  save_counters $((p + 1)) "$f"
+}
+
+fail() {
+  local label="$1"; shift
+  echo "[FAIL] $label $*"
+  local p f
+  p=$(read_counter PASS_COUNT "$COUNTER_FILE")
+  f=$(read_counter FAIL_COUNT "$COUNTER_FILE")
+  save_counters "$p" $((f + 1))
+}
+
+# --- Commands ---
+
+cmd_init() {
+  WORKDIR=$(mktemp -d /tmp/verify-proc-XXXXXX)
+  echo "$WORKDIR" > "$SESSION_FILE"
+  session_paths "$WORKDIR"
+  : > "$TRACKED_FILE"
+  save_counters 0 0
+  echo "[WORKDIR] $WORKDIR"
+
+  local cli
+  cli=$(detect_cli)
+  if [[ -n "$cli" ]]; then
+    echo "[CLI] $cli"
+  else
+    echo "[INFO] No oc or kubectl found"
+  fi
+}
+
+cmd_check_connection() {
+  local cli
+  cli=$(detect_cli)
+  if [[ -z "$cli" ]]; then
+    echo "[FAIL] connection No oc or kubectl found"
+    return 1
+  fi
+
+  local out
+  if out=$($cli whoami 2>&1); then
+    echo "[PASS] connection Logged in as: $out"
+    echo "[INFO] Cluster: $($cli cluster-info 2>/dev/null | head -1 || $cli whoami --show-server 2>/dev/null)"
+  else
+    echo "[FAIL] connection Not logged in: $out"
+    return 1
+  fi
+}
+
+cmd_execute() {
+  local label="$1"
+  local command="$2"
+  load_session
+
+  echo "[INFO] Executing: ${command:0:200}"
+
+  local stdout stderr exit_code
+  stdout=$(cd "$WORKDIR" && timeout "$TIMEOUT" bash -c "$command" 2>"$STDERR_FILE" <<< "" )
+  exit_code=$?
+  stderr=$(cat "$STDERR_FILE" 2>/dev/null)
+  rm -f "$STDERR_FILE"
+
+  if [[ $exit_code -eq 124 ]]; then
+    fail "$label" "Command timed out after ${TIMEOUT}s"
+    return 1
+  fi
+
+  if [[ $exit_code -eq 0 ]]; then
+    pass "$label" "executed successfully"
+    # Track created K8s resources from stdout
+    while IFS= read -r line; do
+      if [[ "$line" =~ ^([a-z]+/[^ ]+)\ created$ ]]; then
+        echo "resource:${BASH_REMATCH[1]}" >> "$TRACKED_FILE"
+      fi
+    done <<< "$stdout"
+    # Track oc/kubectl apply/create -f commands
+    if [[ "$command" =~ (oc|kubectl)[[:space:]]+(create|apply)[[:space:]]+-f[[:space:]]+([^[:space:]]+) ]]; then
+      local file="${BASH_REMATCH[3]}"
+      local filepath
+      if [[ "$file" = /* ]]; then
+        filepath="$file"
+      else
+        filepath="$WORKDIR/$file"
+      fi
+      if [[ -f "$filepath" ]]; then
+        echo "file:$(detect_cli):$filepath" >> "$TRACKED_FILE"
+      fi
+    fi
+    if [[ -n "$stdout" ]]; then
+      echo "[OUTPUT] $stdout"
+    fi
+  else
+    fail "$label" "${stderr:-exit code $exit_code}"
+    if [[ -n "$stdout" ]]; then
+      echo "[OUTPUT] $stdout"
+    fi
+  fi
+}
+
+cmd_validate_yaml() {
+  local label="$1"
+  local save_as="$2"
+  local content
+  content=$(cat)
+  load_session
+
+  # Syntax check with python (more portable than ruby for YAML)
+  if ! printf '%s' "$content" | python3 -c "
+import sys, yaml
+try:
+    list(yaml.safe_load_all(sys.stdin))
+except yaml.YAMLError as e:
+    print(str(e), file=sys.stderr)
+    sys.exit(1)
+" 2>"$STDERR_FILE"; then
+    local err
+    err=$(cat "$STDERR_FILE")
+    rm -f "$STDERR_FILE"
+    fail "$label" "YAML syntax error: $err"
+    return 1
+  fi
+  rm -f "$STDERR_FILE"
+
+  pass "$label" "YAML syntax valid"
+
+  # Save to workdir if requested
+  if [[ -n "$save_as" && -n "$WORKDIR" ]]; then
+    # Block absolute paths
+    if [[ "$save_as" = /* ]]; then
+      echo "[INFO] Path $save_as — validated but not written to filesystem"
+    else
+      local dest="$WORKDIR/$save_as"
+      mkdir -p "$(dirname "$dest")"
+      printf '%s\n' "$content" > "$dest"
+      echo "[INFO] Saved to $dest"
+    fi
+  fi
+
+  # K8s dry-run if it looks like a resource
+  if printf '%s' "$content" | grep -q "apiVersion:"; then
+    local cli
+    cli=$(detect_cli)
+    if [[ -z "$cli" ]]; then
+      echo "[SKIP] $label No CLI tool — dry-run skipped"
+      return 0
+    fi
+
+    local tmpfile
+    tmpfile=$(mktemp /tmp/verify-yaml-XXXXXX.yaml)
+    printf '%s\n' "$content" > "$tmpfile"
+
+    local dr_stderr
+    if dr_stderr=$($cli apply -f "$tmpfile" --dry-run=client 2>&1 >/dev/null); then
+      pass "${label}-dryrun" "Resource dry-run passed"
+    elif printf '%s' "$dr_stderr" | grep -qE "Unable to connect|no such host|connection refused"; then
+      echo "[SKIP] ${label}-dryrun No cluster connection"
+    else
+      fail "${label}-dryrun" "Resource validation: $(printf '%s' "$dr_stderr" | head -1)"
+    fi
+    rm -f "$tmpfile"
+  fi
+}
+
+cmd_validate_json() {
+  local label="$1"
+  local content
+  content=$(cat)
+  load_session
+
+  if printf '%s' "$content" | python3 -c "import sys,json; json.load(sys.stdin)" 2>"$STDERR_FILE"; then
+    rm -f "$STDERR_FILE"
+    pass "$label" "JSON syntax valid"
+  else
+    local err
+    err=$(cat "$STDERR_FILE")
+    rm -f "$STDERR_FILE"
+    fail "$label" "JSON syntax error: $err"
+  fi
+}
+
+cmd_save_file() {
+  local label="$1"
+  local path="$2"
+  local content
+  content=$(cat)
+  load_session
+
+  if [[ "$path" = /* ]]; then
+    echo "[INFO] Path $path — content recorded but not written to filesystem"
+    pass "$label" "Content recorded (absolute path)"
+    return 0
+  fi
+
+  local dest="$WORKDIR/$path"
+  mkdir -p "$(dirname "$dest")"
+  printf '%s\n' "$content" > "$dest"
+  pass "$label" "Saved to $dest"
+}
+
+cmd_cleanup() {
+  if [[ ! -f "$SESSION_FILE" ]]; then
+    echo "[INFO] No active session to clean up"
+    return 0
+  fi
+
+  WORKDIR=$(cat "$SESSION_FILE")
+  session_paths "$WORKDIR"
+
+  if [[ -f "$TRACKED_FILE" ]]; then
+    local cli
+    cli=$(detect_cli)
+
+    # Process tracked resources in reverse order
+    tac "$TRACKED_FILE" | while IFS= read -r entry; do
+      case "$entry" in
+        file:*:*)
+          local tool file
+          tool=$(echo "$entry" | cut -d: -f2)
+          file=$(echo "$entry" | cut -d: -f3-)
+          echo "[INFO] Deleting resources from: $file"
+          if $tool delete -f "$file" --ignore-not-found 2>/dev/null; then
+            echo "[CLEANED] $file"
+          else
+            echo "[WARN] Failed to clean: $file"
+          fi
+          ;;
+        resource:*)
+          local resource="${entry#resource:}"
+          local tool="${cli:-oc}"
+          echo "[INFO] Deleting: $resource"
+          if $tool delete "$resource" --ignore-not-found 2>/dev/null; then
+            echo "[CLEANED] $resource"
+          else
+            echo "[WARN] Failed to clean: $resource"
+          fi
+          ;;
+      esac
+    done
+  else
+    echo "[INFO] No tracked resources to clean up"
+  fi
+
+  # Clean up workdir and all session temp files
+  if [[ -n "$WORKDIR" && -d "$WORKDIR" ]]; then
+    rm -rf "$WORKDIR"
+    echo "[CLEANED] Removed working directory: $WORKDIR"
+  fi
+  rm -f "$SESSION_FILE" "$TRACKED_FILE" "$COUNTER_FILE" "$STDERR_FILE"
+}
+
+cmd_summary() {
+  if [[ ! -f "$SESSION_FILE" ]]; then
+    echo "[INFO] No active session"
+    return 0
+  fi
+  WORKDIR=$(cat "$SESSION_FILE")
+  session_paths "$WORKDIR"
+
+  local pass_count fail_count total
+  pass_count=$(read_counter PASS_COUNT "$COUNTER_FILE")
+  fail_count=$(read_counter FAIL_COUNT "$COUNTER_FILE")
+  total=$((pass_count + fail_count))
+
+  echo "============================================================"
+  echo "FINAL SUMMARY"
+  echo "============================================================"
+  echo "Total executable steps: $total"
+  echo "Passed: $pass_count"
+  echo "Failed: $fail_count"
+  echo "============================================================"
+  if [[ $fail_count -eq 0 ]]; then
+    echo "All steps PASSED"
+  else
+    echo "Some steps FAILED"
+  fi
+  echo "============================================================"
+}
+
+# --- Main dispatch ---
+
+case "${1:-}" in
+  init)             cmd_init ;;
+  check-connection) cmd_check_connection ;;
+  execute)          cmd_execute "$2" "$3" ;;
+  validate-yaml)    cmd_validate_yaml "$2" "${3:-}" ;;
+  validate-json)    cmd_validate_json "$2" ;;
+  save-file)        cmd_save_file "$2" "$3" ;;
+  cleanup)          cmd_cleanup ;;
+  summary)          cmd_summary ;;
+  *)
+    echo "Usage: verify_proc.sh {init|check-connection|execute|validate-yaml|validate-json|save-file|cleanup|summary}"
+    echo ""
+    echo "Commands:"
+    echo "  init                          Create workdir and detect CLI tool"
+    echo "  check-connection              Verify cluster connectivity"
+    echo "  execute <label> <command>     Run a shell command in workdir"
+    echo "  validate-yaml <label> [file]  Validate YAML from stdin (+ dry-run)"
+    echo "  validate-json <label>         Validate JSON from stdin"
+    echo "  save-file <label> <path>      Save stdin to workdir/<path>"
+    echo "  cleanup                       Delete tracked resources + workdir"
+    echo "  summary                       Print pass/fail summary"
+    exit 1
+    ;;
+esac
diff --git a/specs/2026-03-25-verify-procedure-profiles.md b/specs/2026-03-25-verify-procedure-profiles.md
new file mode 100644
index 00000000..049f6f72
--- /dev/null
+++ b/specs/2026-03-25-verify-procedure-profiles.md
@@ -0,0 +1,366 @@
+# Verify-Procedure Profiles
+
+**Date:** 2026-03-25
+**Status:** Draft
+**Scope:** verify-procedure skill, new profiles directory
+
+## Problem
+
+The verify-procedure skill executes AsciiDoc procedures against a live cluster, but every run requires interactive guidance from the user:
+
+1. **Placeholders block execution.** Procedures contain `<your-registry-url>`, `${PROJECT_NAME}`, `CHANGEME` patterns. The skill skips these blocks entirely — often the most important steps in the procedure.
+
+2. **Conditional branches are guessed.** `ifdef::openshift-enterprise[]` blocks require Claude to guess which branch to take. Wrong guesses silently test the wrong content.
+
+3. **Prerequisites are discovered at runtime.** A procedure assumes a namespace exists or an operator is installed. Claude discovers this when step 3 fails, not before step 1.
+
+4. **No repeatability.** Running the same procedure next week requires re-explaining the same context. There is no way to share a "known-good run configuration" with a colleague or store it for CI.
+
+5. **No assertions beyond exit codes.** A command that exits 0 passes, even if its output shows `0/0 pods running` or `Pending` instead of `Succeeded`.
+
+6. **Profiles cannot live in the target repo.** Users verify procedures in external repositories like `openshift-docs` where they can only commit AsciiDoc source. Run configuration must live elsewhere.
+
+## Decision
+
+Add **profiles** — Markdown files stored in this repo (`redhat-docs-agent-tools`) that configure verify-procedure runs against procedures in external repositories. A profile maps to a specific procedure and provides substitutions, attributes, prerequisites, scope controls, assertions, and cleanup behavior.
+
+The term "profile" is used instead of "spec" to avoid confusion with design specs in the `specs/` directory.
+
+Profiles are additive: a procedure without a profile runs exactly as it does today. Profiles only add context — they never remove existing skill behavior.
+
+## Design
+
+### Profile storage
+
+Profiles live in this repo under the verify-procedure skill directory:
+
+```
+plugins/docs-tools/skills/verify-procedure/
+├── profiles/
+│   ├── openshift-docs/                          # one directory per target repo
+│   │   ├── networking/
+│   │   │   ├── installing-ptp-operator.profile.md
+│   │   │   └── installing-ptp-operator-sno.profile.md
+│   │   └── security/
+│   │       └── configuring-certificates.profile.md
+│   └── validated-patterns-docs/
+│       └── getting-started.profile.md
+├── scripts/
+│   └── verify_proc.sh
+└── SKILL.md
+```
+
+The directory structure under `profiles/` mirrors the topic structure of the target repo for discoverability. This is a convention, not enforced.
+
+### Profile format
+
+A profile is a Markdown file with YAML frontmatter and optional sections.
+
+#### Frontmatter
+
+```yaml
+---
+procedure: ~/openshift-docs/modules/networking/installing-ptp-operator.adoc
+description: Verify PTP operator installation on SNO cluster
+cluster: sno
+timeout: 300
+cleanup: auto
+---
+```
+
+| Field | Required | Default | Description |
+|---|---|---|---|
+| `procedure` | **Yes** | — | Absolute or `~`-relative path to the `.adoc` file in the external repo |
+| `description` | No | — | Human-readable label shown in output header |
+| `cluster` | No | — | Freeform tag for organizing profiles by environment |
+| `timeout` | No | `120` | Command timeout in seconds, passed as `VERIFY_TIMEOUT` env var |
+| `cleanup` | No | `manual` | `auto` runs cleanup after summary; `skip` disables it; `manual` (default) waits for user |
+
+The `procedure` field is what connects this profile to an external file. It must be an absolute path or use `~` expansion. Relative paths are relative to the profile file itself.
+
+#### Sections
+
+All sections are optional. A profile with only frontmatter is valid (it just points at the procedure and sets timeout/cleanup).
+
+**## Attributes** — AsciiDoc attribute values and ifdef/ifndef conditional flags:
+
+```markdown
+## Attributes
+
+| Attribute | Value |
+|---|---|
+| `product-title` | `OpenShift Container Platform` |
+| `product-version` | `4.17` |
+
+### Conditionals
+
+| Attribute | Defined? |
+|---|---|
+| `openshift-enterprise` | yes |
+| `openshift-origin` | no |
+```
+
+**## Substitutions** — placeholder-to-value mappings that turn skipped blocks into executable blocks:
+
+```markdown
+## Substitutions
+
+| Placeholder | Value | Notes |
+|---|---|---|
+| `<your-registry-url>` | `quay.io/kquinn-test` | |
+| `<project-name>` | `verify-test-ns` | Created in prerequisites |
+| `CHANGEME` | `my-real-value` | |
+```
+
+Matching rules:
+- `<placeholder>` — literal angle-bracket match
+- `${VAR}` and `$VAR` — both forms matched
+- `CHANGEME`, `REPLACE` — whole-word match only
+
+**## Prerequisites** — assumed state (informational) and setup commands (executed before step 1):
+
+```markdown
+## Prerequisites
+
+### Assumed state
+
+- User has `cluster-admin` role
+- Cluster is SNO (single-node OpenShift)
+
+### Setup commands
+
+```bash
+oc create namespace verify-test-ns --dry-run=client -o yaml | oc apply -f -
+```
+```
+
+Setup command failures abort the run.
+
+**## Scope** — controls which steps to execute:
+
+```markdown
+## Scope
+
+| Control | Value |
+|---|---|
+| `mode` | `execute` |
+| `steps` | `1-5` |
+| `skip` | `3.b, 4.a` |
+```
+
+| Control | Values | Default |
+|---|---|---|
+| `mode` | `execute`, `dry-run-only`, `yaml-only` | `execute` |
+| `steps` | Range (`1-5`), list (`1,3,5`), or `all` | `all` |
+| `skip` | Comma-separated step labels | — |
+
+- `dry-run-only`: validates YAML with `--dry-run=client` but skips `oc create/apply`
+- `yaml-only`: syntax checks only, no cluster connection required
+
+**## Assertions** — expected outcomes checked after step execution:
+
+```markdown
+## Assertions
+
+| Step | Type | Expected |
+|---|---|---|
+| `1.b` | `contains` | `created` |
+| `4` | `contains` | `Succeeded` |
+| `4` | `not-contains` | `Failed` |
+| `6` | `regex` | `ptp-operator\.v4\.\d+\.\d+` |
+```
+
+| Type | Description |
+|---|---|
+| `contains` | stdout includes the string (case-sensitive) |
+| `not-contains` | stdout does NOT include the string |
+| `regex` | stdout matches the regex pattern |
+| `exit-code` | command exited with this code (default is `0`) |
+
+A step can have multiple assertions. Assertion failures override exit-code pass/fail.
+
+**## Cleanup** — preserve list and additional teardown commands:
+
+```markdown
+## Cleanup
+
+### Preserve
+
+- `namespace/openshift-ptp`
+
+### Additional
+
+```bash
+oc delete project verify-test-ns --ignore-not-found
+```
+```
+
+### Profile discovery
+
+When the user invokes verify-procedure, profiles are found in this order:
+
+1. **Explicit path**: user passes a profile file path as a second argument
+2. **Profile directory search**: the skill searches `profiles/` for a profile whose `procedure` frontmatter matches the `.adoc` path the user provided
+3. **No profile**: run with default behavior (current behavior, unchanged)
+
+The skill reports which profile was loaded (or "none") in the output header.
+
+### Invocation
+
+```bash
+# With explicit profile
+/verify-procedure ~/openshift-docs/modules/networking/installing-ptp-operator.adoc profiles/openshift-docs/networking/installing-ptp-operator.profile.md
+
+# With auto-discovery (skill searches profiles/ for matching procedure path)
+/verify-procedure ~/openshift-docs/modules/networking/installing-ptp-operator.adoc
+
+# Run a profile directly (procedure path comes from frontmatter)
+/verify-procedure --profile profiles/openshift-docs/networking/installing-ptp-operator.profile.md
+
+# No profile (current behavior)
+/verify-procedure ~/openshift-docs/modules/networking/installing-ptp-operator.adoc
+```
+
+## Changes by file
+
+### `plugins/docs-tools/skills/verify-procedure/SKILL.md`
+
+#### New section: Profiles (after Architecture, before Workflow)
+
+Add profile documentation covering:
+- What profiles are and where they live
+- Discovery order
+- How to invoke with a profile
+
+#### Step 0: Connectivity check
+
+- If a profile defines `timeout`, export `VERIFY_TIMEOUT` before calling `init`
+- If profile `mode` is `yaml-only`, skip the connection check (no cluster needed)
+
+#### New: Step 0.5 — Run prerequisite setup
+
+- If the profile has `## Prerequisites` → `### Setup commands`, execute each command via `verify_proc.sh execute "prereq-N" "<command>"`
+- Failures abort the run
+- "Assumed state" items appear in the output header
+
+#### Step 1: Parse the AsciiDoc file
+
+Attribute resolution priority changes to:
+1. **Profile attributes** (highest priority)
+2. Document header
+3. `_attributes.adoc`
+4. Cluster fallback (`oc version`)
+
+Conditional resolution:
+- Profile conditional flags take priority over document/attribute file
+
+Classification changes:
+- `skip-placeholder` classification now checks the profile's substitution map. If all placeholders in a block are covered, reclassify as `execute`/`validate-yaml`/`save-to-file`
+
+New sub-steps after classification:
+- **Apply substitutions**: replace placeholders with profile values, reclassify blocks
+- **Apply scope controls**: filter by `steps` range, remove `skip` labels, enforce `mode`
+
+#### Step 2: Execute the procedure
+
+New sub-step after each execution:
+- **Check assertions**: if the profile defines assertions for this step label, check them. Report `[ASSERT]` results. Assertion failures override exit-code pass/fail.
+
+#### Step 4: Cleanup
+
+Behavior determined by profile `cleanup` value:
+- `auto` — run immediately after summary
+- `manual` (default) — wait for user
+- `skip` — do not clean up
+
+Profile cleanup overrides:
+- **Preserve list**: resources not deleted during cleanup, reported as `[PRESERVED]`
+- **Additional commands**: extra teardown after standard cleanup
+
+#### Output format
+
+Updated header to include profile information:
+
+```
+--- Procedure Verification: <filename> ---
+Profile: installing-ptp-operator.profile.md (or "none")
+Workdir: /tmp/verify-proc-XXXXXX
+CLI: oc | Cluster: https://api.cluster.example.com:6443
+Mode: execute | Timeout: 300s | Cleanup: auto
+Assumed state: User has cluster-admin
+```
+
+Summary line updated:
+```
+Total: 7 | Passed: 7 | Failed: 0 | Assertions: 2/2 passed
+```
+
+### `plugins/docs-tools/skills/verify-procedure/scripts/verify_proc.sh`
+
+One change:
+
+```bash
+# Before
+TIMEOUT=120
+
+# After
+TIMEOUT="${VERIFY_TIMEOUT:-120}"
+```
+
+This allows the SKILL.md to pass `export VERIFY_TIMEOUT=300` before calling `init`, driven by the profile's `timeout` frontmatter value.
+
+### New directory: `plugins/docs-tools/skills/verify-procedure/profiles/`
+
+Created as an empty directory (with `.gitkeep`) to establish the convention. Profiles are added as users create them for specific procedures they want to verify repeatably.
+
+### New file: `plugins/docs-tools/skills/verify-procedure/profile-format.md`
+
+Reference document for profile authors. Documents all frontmatter fields, sections, matching rules, and includes a complete example. Not a skill — a plain reference file.
+
+## End-to-end flows
+
+### With profile (default mode)
+
+```
+1. User: /verify-procedure ~/openshift-docs/modules/networking/installing-ptp-operator.adoc
+2. Skill discovers matching profile in profiles/openshift-docs/networking/
+3. Parse profile: timeout=300, cleanup=auto, substitutions, assertions
+4. export VERIFY_TIMEOUT=300 && bash scripts/verify_proc.sh init
+5. bash scripts/verify_proc.sh check-connection
+6. Run prereq setup commands from profile
+7. Read .adoc file, resolve includes/ifdefs using profile conditionals
+8. Classify blocks, apply substitutions (skip-placeholder → execute)
+9. Apply scope controls (step range, skip list, mode)
+10. Execute blocks sequentially, check assertions after each step
+11. bash scripts/verify_proc.sh summary
+12. Auto-cleanup (profile says cleanup: auto)
+```
+
+### Without profile (current behavior, unchanged)
+
+```
+1. User: /verify-procedure ~/openshift-docs/modules/networking/some-procedure.adoc
+2. No matching profile found — proceed silently
+3. bash scripts/verify_proc.sh init
+4. bash scripts/verify_proc.sh check-connection
+5. Read .adoc file, resolve includes/ifdefs (Claude guesses)
+6. Classify blocks (placeholders skipped, attributes best-effort)
+7. Execute blocks sequentially (exit code = pass/fail)
+8. bash scripts/verify_proc.sh summary
+9. Cleanup when user asks
+```
+
+### yaml-only mode (offline validation)
+
+```
+1. User: /verify-procedure --profile profiles/openshift-docs/networking/installing-ptp-operator-sno.profile.md
+2. Profile has mode: yaml-only
+3. bash scripts/verify_proc.sh init (no check-connection)
+4. Read .adoc, classify blocks
+5. Validate YAML/JSON syntax only — no execution, no dry-runs
+6. Summary
+```
+
+## Migration
+
+No migration needed. This is purely additive — existing behavior is unchanged when no profile is present.