diff --git a/PLAN.md b/PLAN.md
new file mode 100644
index 0000000..e31d422
--- /dev/null
+++ b/PLAN.md
@@ -0,0 +1,229 @@
+# LLM Auditor Run Plan — circom zkbugs
+
+Covers both `circom_auditor_claude` and `circom_auditor_codex` across all 70
+runnable circom bugs in `config.toml`, using `--zkbugs-mode both` (direct +
+original entrypoints). Bugs are split into 6 shards to stay under API rate
+limits.
+
+**Why 70 and not 72?** `config.toml` tracks 72 circom bugs total: 70 in
+`[circom].bugs` (runnable — these are analyzed here) and 2 in
+`[circom].unreproducible_bugs` (not present in the dataset at all:
+`ProcessMessages` and `Potentially_Easy_to_Misuse_Interface`).
+
+---
+
+## Prerequisites
+
+Verify each item before starting.
+
+```bash
+# 1. Verify the zkbugs dataset is present next to this repo
+ls ../zkbugs/dataset/circom   # expected: org directories (0xbok, iden3, ...)
+
+# 2. (Optional) Download original codebases for original-mode runs
+bash ../zkbugs/scripts/download_sources.sh
+
+# 3. Claude Code CLI
+claude --version
+echo $CLAUDE_PLUGIN_DIR         # must be set
+ls $CLAUDE_PLUGIN_DIR/skills/circom-auditor/SKILL.md   # must exist
+
+# 4. OpenAI Codex CLI
+codex --version
+echo $OPENAI_API_KEY            # must be set
+# CODEX_PLUGIN_DIR defaults to CLAUDE_PLUGIN_DIR if unset (same skill dir works)
+
+# 5. Optional: increase include-closure cap for large circuits (default 5000)
+# export CIRCOM_AUDITOR_MAX_LINES=8000
+```
+
+---
+
+## Step 1 — Split bugs into shards
+
+Run once. Produces `shards/shard_{1..6}.txt`, each with ~11 bugs.
+
+```bash
+python scripts/split_bugs.py --shards 6 --output-dir shards/
+```
+
+---
+
+## Step 2 — Run each shard
+
+Run shards **sequentially** to respect rate limits (each shard takes ~2-3 h).
+Adjacent shards (1+4, 2+5, 3+6) can run concurrently in separate terminals —
+they have no shared state.
+
+Each command runs both tools on both modes (direct + original) and writes
+results under `output/shard_N/`.
+
+```bash
+# Shard 1
+uv run python -m zkhydra.main zkbugs \
+  --dataset ../zkbugs/dataset/circom \
+  --tools circom_auditor_claude,circom_auditor_codex \
+  --bugs-file shards/shard_1.txt \
+  --zkbugs-mode both \
+  --output output/shard_1
+
+# Shard 2
+uv run python -m zkhydra.main zkbugs \
+  --dataset ../zkbugs/dataset/circom \
+  --tools circom_auditor_claude,circom_auditor_codex \
+  --bugs-file shards/shard_2.txt \
+  --zkbugs-mode both \
+  --output output/shard_2
+
+# Shard 3
+uv run python -m zkhydra.main zkbugs \
+  --dataset ../zkbugs/dataset/circom \
+  --tools circom_auditor_claude,circom_auditor_codex \
+  --bugs-file shards/shard_3.txt \
+  --zkbugs-mode both \
+  --output output/shard_3
+
+# Shard 4
+uv run python -m zkhydra.main zkbugs \
+  --dataset ../zkbugs/dataset/circom \
+  --tools circom_auditor_claude,circom_auditor_codex \
+  --bugs-file shards/shard_4.txt \
+  --zkbugs-mode both \
+  --output output/shard_4
+
+# Shard 5
+uv run python -m zkhydra.main zkbugs \
+  --dataset ../zkbugs/dataset/circom \
+  --tools circom_auditor_claude,circom_auditor_codex \
+  --bugs-file shards/shard_5.txt \
+  --zkbugs-mode both \
+  --output output/shard_5
+
+# Shard 6
+uv run python -m zkhydra.main zkbugs \
+  --dataset ../zkbugs/dataset/circom \
+  --tools circom_auditor_claude,circom_auditor_codex \
+  --bugs-file shards/shard_6.txt \
+  --zkbugs-mode both \
+  --output output/shard_6
+```
+
+**Resuming a failed shard**: re-run the same command. Bugs that already have
+`results.json` are not re-executed (pass `--vanilla` to just re-parse existing
+raw output without re-running tools).
+
+---
+
+## Step 3 — Merge shards into one combined run
+
+Stitches the six shard output dirs into a single `output/llm_combined/` that
+mirrors a normal `--zkbugs-mode both` run structure (`direct/` + `original/`).
+
+```bash
+python scripts/merge_shards.py \
+  output/shard_1 output/shard_2 output/shard_3 \
+  output/shard_4 output/shard_5 output/shard_6 \
+  --output output/llm_combined
+```
+
+Expected layout after merge:
+
+```
+output/llm_combined/
+  summary.json
+  direct/
+    summary.json
+    <bug_name>/
+      ground_truth.json
+      circom_auditor_claude/  raw.txt  parsed.json  results.json  evaluation.json
+      circom_auditor_codex/   ...
+  original/
+    summary.json
+    <bug_name>/   # only bugs with a distinct Original Entrypoint
+      ...
+```
+
+---
+
+## Step 4 — Triage Undecided verdicts
+
+Claude automatically resolves verdicts that were marked Undecided by the
+auto-evaluator (e.g. class match but different line number). Rewrites
+`evaluation.json` in place; preserves the original at `evaluation.original.json`.
+
+Run for both modes:
+
+```bash
+python scripts/triage_zkbugs_run.py output/llm_combined/direct \
+  --dataset ../zkbugs/dataset/circom \
+  --auto --update-evaluation --jobs 4
+
+# Only if output/llm_combined/original/ exists and is non-empty:
+python scripts/triage_zkbugs_run.py output/llm_combined/original \
+  --dataset ../zkbugs/dataset/circom \
+  --auto --update-evaluation --jobs 4
+```
+
+Review the triage summary:
+
+```bash
+cat output/llm_combined/direct/triage_summary.json
+```
+
+---
+
+## Step 5 — Merge into the remote zkbugs run
+
+Copies the two LLM tool result dirs into the existing multi-tool remote run.
+Run all four commands (two tools × two modes):
+
+```bash
+# direct mode
+python scripts/merge_tool_run.py \
+  --source output/llm_combined/direct \
+  --target output/zkbugs-remote/direct \
+  --tool circom_auditor_claude
+
+python scripts/merge_tool_run.py \
+  --source output/llm_combined/direct \
+  --target output/zkbugs-remote/direct \
+  --tool circom_auditor_codex
+
+# original mode (skip if output/llm_combined/original/ is empty)
+python scripts/merge_tool_run.py \
+  --source output/llm_combined/original \
+  --target output/zkbugs-remote/original \
+  --tool circom_auditor_claude
+
+python scripts/merge_tool_run.py \
+  --source output/llm_combined/original \
+  --target output/zkbugs-remote/original \
+  --tool circom_auditor_codex
+```
+
+---
+
+## Step 6 — Generate summary tables
+
+```bash
+# Summary table + bug-tool matrix for the combined LLM run:
+python scripts/process_zkbugs_results.py output/llm_combined/direct
+
+# Full remote run (all tools):
+python scripts/process_zkbugs_results.py output/zkbugs-remote/direct
+
+# Optional: LaTeX/PDF report:
+python scripts/process_zkbugs_results.py output/zkbugs-remote/direct \
+  --latex output/zkbugs-remote/report.pdf
+```
+
+---
+
+## Summary of output directories
+
+| Path | Contents |
+|------|----------|
+| `shards/shard_N.txt` | Bug selectors for shard N |
+| `output/shard_N/` | Raw shard run (direct/ + original/) |
+| `output/llm_combined/` | Merged LLM run (all 70 bugs) |
+| `output/zkbugs-remote/` | Full multi-tool run (all tools including LLM) |
diff --git a/README.md b/README.md
index adda005..24b691f 100644
--- a/README.md
+++ b/README.md
@@ -237,6 +237,90 @@ uv run python -m zkhydra.main zkbugs \
 - **Picus** - Symbolic execution via Rosette
 - **EcneProject** - Julia-based circuit analysis
 - **zkFuzz** - Fuzzing-based bug detection
+- **circom_auditor_claude / circom_auditor_codex** - 17-agent parallel LLM audit via [zksecurity/zk-skills](https://github.com/zksecurity/zk-skills) — **native-only, not bundled in Docker**; ~3-10 min per circuit
+
+### circom-auditor — native-only
+
+> ⚠️ **`circom_auditor_claude` and `circom_auditor_codex` only run in native mode.** They are *not* installed in the zkhydra Docker image. If you try to invoke them inside `docker-compose run`, the tool plugin will exit with an error pointing back here.
+
+`circom_auditor_claude` invokes the [zksecurity/zk-skills](https://github.com/zksecurity/zk-skills) `circom-auditor` Claude Code skill. `circom_auditor_codex` invokes the same skill through Codex's native skill discovery (`.agents/skills`, user skills, admin skills, or installed plugins). The Codex wrapper prebuilds the delegated worker bundles and forbids local fallback: if Codex subagents are unavailable, the run fails instead of doing a single-agent audit. The skill spawns specialist sub-agents in parallel and produces a deduplicated, gate-validated security report.
+
+The reason for native-only: LLM CLIs may store subscription/OAuth credentials in the host OS keychain (macOS Keychain / libsecret on Linux / DPAPI on Windows). Those credentials cannot be mounted into a Linux container, so a containerised version would force everyone onto API-key billing. By keeping these tools native, you can use the host CLI auth already configured for Claude or Codex.
+
+#### One-time host setup
+
+```bash
+# 1. Install Claude Code CLI
+npm install -g @anthropic-ai/claude-code
+
+# 2. Authenticate — pick one
+claude login                       # subscription, opens browser, stores in OS keychain
+# OR
+export ANTHROPIC_API_KEY=sk-ant-... # API key, pay per token
+
+# 3. Install zk-skills (the repo doubles as a plugin dir thanks to its
+#    committed `skills/circom-auditor` symlink — no extra scaffolding needed)
+git clone https://github.com/zksecurity/zk-skills.git ~/zk-skills
+
+# 4. Tell zkhydra where the plugin dir is (add this to your shell rc)
+export CLAUDE_PLUGIN_DIR=~/zk-skills
+
+# Optional Codex variant
+npm install -g @openai/codex
+codex login                      # or export CODEX_API_KEY=...
+mkdir -p ~/.agents/skills
+ln -s ~/zk-skills/skills/circom-auditor ~/.agents/skills/circom-auditor
+```
+
+#### Run it
+
+From a checkout of zkhydra, **without Docker**:
+
+```bash
+uv run python -m zkhydra.main analyze \
+  --input examples/test_bug/circuits/circuit.circom \
+  --tools circom_auditor_claude \
+  --timeout 600
+```
+
+#### Mixed sweep — fast static tools in Docker, LLM auditor natively
+
+```bash
+# 1. Static tools in the container (fast, deterministic, no auth)
+docker-compose run --rm zkhydra uv run python -m zkhydra.main zkbugs \
+  --dataset zkbugs/dataset/circom \
+  --tools circomspect,circom_civer,picus,zkfuzz \
+  --bugs daira_hopwood_darkforest_v0_3_missing_bit_length_check \
+  --output output/static-only
+
+# 2. LLM auditor natively, against the same bug
+uv run python -m zkhydra.main zkbugs \
+  --dataset zkbugs/dataset/circom \
+  --tools circom_auditor_claude \
+  --bugs daira_hopwood_darkforest_v0_3_missing_bit_length_check \
+  --output output/llm-only
+
+# 3. Merge per-bug findings.json files manually if you want a unified view
+```
+
+#### Caveats
+
+- Each `circom_auditor_claude` / `circom_auditor_codex` run spawns up to 17 parallel specialist sub-agents and takes 3-10 minutes wall-clock on a small bundle (1-5 templates / a few hundred lines). On larger scopes the wall-clock grows non-linearly — the sub-agents each have to ingest the full bundle before producing findings.
+- **Use a per-bug timeout of `1800` (30 min), not 24h.** A bug that doesn't finish in 30 min is hung — fail it and move on. The skill is designed for the 2-5 templates a developer is actively touching, not monorepo-sized audits.
+- **Bundle-size guard:** the tool plugin refuses to launch on scratch dirs above 30 `.circom` files or 5 000 lines of source (override via `CIRCOM_AUDITOR_MAX_FILES` / `CIRCOM_AUDITOR_MAX_LINES` env vars). zkbugs reproducers from large monorepos like Panther transitively pull in ~200 files / ~50K lines via `-l` link flags; those will be skipped with a clear "bundle too large" failure rather than hanging the run.
+- Cost: subscription quota / account quota or per-token API spend, depending on the CLI auth you use. Pair with `--tools` and `--bugs` filtering to avoid running it on every bug in a large dataset sweep unless that's what you want.
+- The skill follows Circom `include` chains (so wrapper-only zkbugs reproducers see the actual buggy template body via the `-l` link flag → scratch-dir trick the tool plugin handles automatically).
+- Output is rich markdown — the tool plugin parses the `## Findings` and `## Leads` sections into zkhydra's standardized `Finding` schema.
+
+#### Eval-mode sandboxing (zkbugs honesty guarantees)
+
+When you point `circom_auditor_claude` or `circom_auditor_codex` at a zkbugs reproducer, the bug folder ships sidecar files that contain the literal answer key — `README.md` lists the vulnerability class, root cause, location, and proposed mitigation; `zkbugs_config.json` carries the same structured data. To prevent the LLM from "auditing" by reading the answer, the tool plugin runs every audit inside a fresh tmp dir and keeps the answer key out of it. Three layers of defence:
+
+1. **Filesystem isolation** — the scratch dir contains *only* `.circom` source: the wrapper, any sibling `.circom` files at the top level of the bug dir, and symlinks to the linked codebase's source subdirectories. Excluded by name: `README*`, `zkbugs_config.json`, `zkbugs_*.sh`, `input.json`, `direct_input.json`. Excluded by directory blocklist: `test`, `tests`, `doc`, `docs`, `client`, `examples`, `node_modules`, hidden dirs, and a few other common project-noise names that could leak per-bug hints.
+2. **CLI restrictions** — the Claude variant blocks web/search tools and skips the user/project/local Claude settings stack; the Codex variant prebuilds delegated bundles, runs `codex exec` in read-only sandbox mode from the scratch directory, and refuses local fallback.
+3. **Plain-text instruction** — both variants inject an explicit "sandboxed eval mode: no web, no external context, audit constraint logic only" note that every sub-agent reads.
+
+Layer 1 is the load-bearing one; 2 and 3 are belt-and-suspenders. Net effect: when you run an LLM auditor on `dataset/circom/.../daira_hopwood_..._missing_bit_length_check`, the CLI sees a tmp dir with `circuit.circom` and a `circuits/` symlink — nothing that names the bug, no reference to the audit report, no exploit witness.
 
 ## Usage Modes
 
@@ -366,6 +450,27 @@ docker-compose run --rm zkhydra uv run python -m zkhydra.main zkbugs \
   --timeout 120
 ```
 
+### circom-auditor (native only — single circuit)
+
+> See the **circom-auditor — native-only** section above for the one-time host setup. Briefly: install Claude Code and/or Codex, authenticate the CLI, clone zk-skills, and expose the skill through `CLAUDE_PLUGIN_DIR` or `.agents/skills`.
+
+```bash
+uv run python -m zkhydra.main analyze \
+  --input examples/test_bug/circuits/circuit.circom \
+  --tools circom_auditor_claude \
+  --timeout 600
+```
+
+### circom-auditor on a single zkbugs reproducer (native)
+
+```bash
+uv run python -m zkhydra.main zkbugs \
+  --dataset zkbugs/dataset/circom \
+  --tools circom_auditor_claude \
+  --bugs veridise_decoder_accepting_bogus_output_signal \
+  --timeout 600
+```
+
 ## Output Structure
 
 ```
diff --git a/config.toml b/config.toml
index dc527ac..daa4d37 100644
--- a/config.toml
+++ b/config.toml
@@ -28,7 +28,9 @@ tools = [
     "circomspect",
     "EcneProject",
     "Picus",
-    "zkFuzz"
+    "zkFuzz",
+    "circom_auditor_claude",
+    "circom_auditor_codex",
 ]
 
 # List of bugs to analyze
@@ -76,23 +78,67 @@ bugs = [
     "bugs/zkbugs/dataset/circom/succinctlabs/telepathy-circuits/veridise_zero_padding_for_sha256_in_ExpandMessageXMD_is_vulnerable_to_an_overflow",
     ## tangle-network
     "bugs/zkbugs/dataset/circom/tangle-network/protocol-solidity/veridise_incorrect_initialization_in_membership_circuits",
+    ## personaelabs (cont.)
+    "bugs/zkbugs/dataset/circom/personaelabs/spartan-ecdsa/yacademy_Knowledge_of_any_member_signature_allow_to_generate_proof_of_membership",
+    ## privacy-scaling-explorations
+    "bugs/zkbugs/dataset/circom/privacy-scaling-explorations/maci/hashcloak_data_are_not_fully_verified_during_state_update",
+    ## reclaimprotocol (cont.)
+    "bugs/zkbugs/dataset/circom/reclaimprotocol/circom-chacha20/zksecurity_Unsound_Addition_Gadget",
+    "bugs/zkbugs/dataset/circom/reclaimprotocol/circom-chacha20/zksecurity_Unsound_XOR_gadget",
     ## zkopru-network
+    "bugs/zkbugs/dataset/circom/zkopru-network/zkopru/leastauthority_Circuit_Does_Not_Check_the_ERC_20_Sum_Correctly_",
     "bugs/zkbugs/dataset/circom/zkopru-network/zkopru/leastauthority_previously_correct_ownership_proof_disabled_via_code_changes",
+    ## aptos-labs
+    "bugs/zkbugs/dataset/circom/aptos-labs/keyless-zk-proofs/koukyosyumei_unconstrained_base64_decoded_len",
+    ## Arianee
+    "bugs/zkbugs/dataset/circom/Arianee/arianee-sdk/veridise_creditnoteproofs_can_be_stolen",
+    "bugs/zkbugs/dataset/circom/Arianee/arianee-sdk/veridise_ownershipproofs_could_identify_issuers",
+    ## banyancomputer
+    "bugs/zkbugs/dataset/circom/banyancomputer/hot-proofs-blake3-circom/koukyosyumei_checkdepth_comparator_overflow",
+    ## inference-labs-inc
+    "bugs/zkbugs/dataset/circom/inference-labs-inc/subnet-2-circom/koukyosyumei_clamp_comparator_overflow",
+    "bugs/zkbugs/dataset/circom/inference-labs-inc/subnet-2-circom/koukyosyumei_subtract_unconstrained_multiplier",
+    ## Moonsong-Labs
+    "bugs/zkbugs/dataset/circom/Moonsong-Labs/zksync-social-login-circuit/openzeppelin_mismatched_base64url_decoding_may_break_completeness",
+    "bugs/zkbugs/dataset/circom/Moonsong-Labs/zksync-social-login-circuit/openzeppelin_non_determinism_of_some_inputs",
+    ## pantherfoundation
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_babyjubjub_suborder_constraints_not_applied_correctly",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_blacklist_states_not_representable_in_field",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_bypassing_internal_transfer_limits_via_swaps",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_data_escrow_encrypted_message_wrong_input",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_fortxreward_abstracted_away_in_reward_calc",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_kyt_signature_verification_fails_nonzero_hash",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_nullifier_verification_can_be_disabled",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_unsafe_num2bits_254_blacklist_leaf",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_zaccount_renewal_kyc_expiry_not_validated",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_zaccount_renewal_multiple_nullifiers_same_utxo",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_zone_id_inclusion_prover_bypass",
+    "bugs/zkbugs/dataset/circom/pantherfoundation/panther-core/veridise_zone_limits_bypass_zswapv1",
+    ## rarimo
+    "bugs/zkbugs/dataset/circom/rarimo/passport-zk-circuits/koukyosyumei_under_constrained_date_encoder",
+    ## Rate-Limiting-Nullifier
+    "bugs/zkbugs/dataset/circom/Rate-Limiting-Nullifier/circom-rln/veridise_spammers_may_slash_themselves",
+    ## sismo-core
+    "bugs/zkbugs/dataset/circom/sismo-core/hydra-s2-zkps/veridise_private_information_leakage",
+    ## siv-org
+    "bugs/zkbugs/dataset/circom/siv-org/verifiable-private-overrides/koukyosyumei_emitifinrange_lessthan_overflow",
+    "bugs/zkbugs/dataset/circom/siv-org/verifiable-private-overrides/koukyosyumei_extractstringfrompoint_shiftedfirstbyte_unconstrained",
+    ## worm-privacy
+    "bugs/zkbugs/dataset/circom/worm-privacy/proof-of-burn/koukyosyumei_spend_missing_range_check",
+    ## zkemail
+    "bugs/zkbugs/dataset/circom/zkemail/ether-email-auth/matterlabs_emailauth_fails_with_overlapping_invitation_code_regex",
+    "bugs/zkbugs/dataset/circom/zkemail/zk-email-verify/matterlabs_underconstrained_fpmul_circuit",
+    "bugs/zkbugs/dataset/circom/zkemail/zk-email-verify/zksecurity_sha256_templates_return_zero_on_arbitrary_inputs",
+    "bugs/zkbugs/dataset/circom/zkemail/zk-regex/matterlabs_email_spoofing_via_manipulated_from_header",
+    "bugs/zkbugs/dataset/circom/zkemail/zk-regex/matterlabs_fromaddrregex_allows_email_address_spoofing",
 ]
 
-# List of unreproducible bugs
+# List of unreproducible bugs (not present in the dataset)
 unreproducible_bugs = [
-    ## personaelabs
-    "bugs/zkbugs/dataset/circom/personaelabs/spartan-ecdsa/yacademy_Knowledge_of_any_member_signature_allow_to_generate_proof_of_membership",
     ## privacy-scaling-explorations
-    "bugs/zkbugs/dataset/circom/privacy-scaling-explorations/maci/hashcloak_data_are_not_fully_verified_during_state_update",
     "bugs/zkbugs/dataset/circom/privacy-scaling-explorations/maci/ProcessMessages_circuit_to_prevent_message_censorship_by_the_coordinator",
     # reclaimprotocol
     "bugs/zkbugs/dataset/circom/reclaimprotocol/circom-chacha20/zksecurity_Potentially_Easy_to_Misuse_Interface",
-    "bugs/zkbugs/dataset/circom/reclaimprotocol/circom-chacha20/zksecurity_Unsound_Addition_Gadget",
-    "bugs/zkbugs/dataset/circom/reclaimprotocol/circom-chacha20/zksecurity_Unsound_XOR_gadget",
-    # zkopru-network
-    "bugs/zkbugs/dataset/circom/zkopru-network/zkopru/leastauthority_Circuit_Does_Not_Check_the_ERC_20_Sum_Correctly_",
 ]
 
 [pil]
diff --git a/scripts/merge_shards.py b/scripts/merge_shards.py
new file mode 100644
index 0000000..37a463a
--- /dev/null
+++ b/scripts/merge_shards.py
@@ -0,0 +1,230 @@
+#!/usr/bin/env python3
+"""Merge N partial shard run dirs into one combined run directory.
+
+Each shard ran on a non-overlapping subset of the bugs. This script
+stitches the individual shard outputs into a single directory that looks
+like a full zkhydra zkbugs run.
+
+For --zkbugs-mode both runs (which produce direct/ and original/ subdirs)
+each sub-run is merged independently. For flat runs (direct or original
+mode only, bug dirs at the top level) the bug dirs are merged directly.
+
+Usage:
+    python scripts/merge_shards.py \\
+        output/shard_1 output/shard_2 output/shard_3 \\
+        --output output/llm_combined
+
+    # Then triage undecideds and merge into the remote run:
+    python scripts/triage_zkbugs_run.py output/llm_combined/direct \\
+        --auto --update-evaluation --jobs 4
+    python scripts/merge_tool_run.py \\
+        --source output/llm_combined/direct \\
+        --target output/zkbugs-remote/direct \\
+        --tool circom_auditor_claude
+    python scripts/merge_tool_run.py \\
+        --source output/llm_combined/direct \\
+        --target output/zkbugs-remote/direct \\
+        --tool circom_auditor_codex
+"""
+
+import argparse
+import json
+import logging
+import shutil
+import sys
+from pathlib import Path
+
+
+def _is_bug_dir(d: Path) -> bool:
+    """True if this directory looks like a processed bug output dir."""
+    if not d.is_dir():
+        return False
+    return (d / "ground_truth.json").exists() or any(
+        c.is_dir() for c in d.iterdir()
+    )
+
+
+def _merge_summary_list(summaries: list[dict], mode: str) -> dict:
+    """Combine multiple shard summary.json files into one aggregate."""
+    all_bugs: list[dict] = []
+    total = processed = errors = skipped = 0
+
+    for s in summaries:
+        all_bugs.extend(s.get("bugs", []))
+        total += s.get("total", 0)
+        processed += s.get("processed", 0)
+        errors += s.get("errors", 0)
+        skipped += s.get("skipped", 0)
+
+    base = dict(summaries[0])
+    base["bugs"] = all_bugs
+    base["total"] = total
+    base["processed"] = processed
+    base["errors"] = errors
+    base["skipped"] = skipped
+    base["mode"] = mode
+    # evaluation_counts will be stale after merging; remove so it's not misleading
+    base.pop("evaluation_counts", None)
+    return base
+
+
+def _merge_dir(
+    shards: list[Path],
+    src_subdir: str | None,
+    dest: Path,
+    overwrite: bool,
+) -> tuple[int, int]:
+    """Copy bug dirs from each shard's src_subdir into dest.
+
+    Returns (copied, skipped_dup) counts.
+    """
+    dest.mkdir(parents=True, exist_ok=True)
+    summaries: list[dict] = []
+    copied = skipped_dup = 0
+
+    for shard in shards:
+        shard_root = shard / src_subdir if src_subdir else shard
+
+        if not shard_root.is_dir():
+            logging.info("Shard %s has no %s, skipping", shard.name, src_subdir or ".")
+            continue
+
+        summary_path = shard_root / "summary.json"
+        if summary_path.is_file():
+            try:
+                summaries.append(
+                    json.loads(summary_path.read_text(encoding="utf-8"))
+                )
+            except (json.JSONDecodeError, OSError) as exc:
+                logging.warning("Cannot read %s: %s", summary_path, exc)
+
+        for bug_dir in sorted(shard_root.iterdir()):
+            if not _is_bug_dir(bug_dir):
+                continue
+            dest_bug = dest / bug_dir.name
+            if dest_bug.exists():
+                if overwrite:
+                    shutil.rmtree(dest_bug)
+                    logging.warning(
+                        "Overwriting duplicate bug in %s: %s",
+                        src_subdir or ".",
+                        bug_dir.name,
+                    )
+                else:
+                    logging.warning(
+                        "Duplicate bug %s in %s — skipped (use --overwrite to replace)",
+                        bug_dir.name,
+                        src_subdir or ".",
+                    )
+                    skipped_dup += 1
+                    continue
+            shutil.copytree(bug_dir, dest_bug)
+            copied += 1
+
+    if summaries:
+        mode = src_subdir or "direct"
+        merged = _merge_summary_list(summaries, mode)
+        (dest / "summary.json").write_text(
+            json.dumps(merged, indent=2, ensure_ascii=False), encoding="utf-8"
+        )
+
+    return copied, skipped_dup
+
+
+def main() -> int:
+    logging.basicConfig(
+        level=logging.INFO,
+        format="%(asctime)s [%(levelname)s] %(message)s",
+        datefmt="%H:%M:%S",
+    )
+    p = argparse.ArgumentParser(description=__doc__)
+    p.add_argument(
+        "shards",
+        nargs="+",
+        type=Path,
+        help="Shard run dirs to merge (e.g. output/shard_1 output/shard_2)",
+    )
+    p.add_argument(
+        "--output", "-o",
+        type=Path,
+        required=True,
+        help="Target combined run directory",
+    )
+    p.add_argument(
+        "--overwrite",
+        action="store_true",
+        help="Replace duplicate bug dirs (default: skip and warn)",
+    )
+    args = p.parse_args()
+
+    for s in args.shards:
+        if not s.is_dir():
+            logging.error("Shard not found: %s", s)
+            return 1
+
+    args.output.mkdir(parents=True, exist_ok=True)
+
+    # Detect run structure: if any shard has a direct/ subdir it's a both-mode run.
+    is_both_mode = any((s / "direct").is_dir() for s in args.shards)
+
+    if is_both_mode:
+        logging.info("Detected both-mode structure (direct/ + optional original/)")
+
+        direct_dest = args.output / "direct"
+        copied, dups = _merge_dir(args.shards, "direct", direct_dest, args.overwrite)
+        logging.info("direct/  copied=%d skipped_dup=%d", copied, dups)
+
+        has_original = any((s / "original").is_dir() for s in args.shards)
+        original_dest = args.output / "original"
+        if has_original:
+            copied, dups = _merge_dir(
+                args.shards, "original", original_dest, args.overwrite
+            )
+            logging.info("original/ copied=%d skipped_dup=%d", copied, dups)
+
+        combined = {
+            "mode": "both",
+            "merged_from": [str(s) for s in args.shards],
+            "output_root": str(args.output),
+            "modes": {
+                "direct": {
+                    "ran": True,
+                    "output_dir": str(direct_dest),
+                },
+                "original": {
+                    "ran": has_original,
+                    "output_dir": str(original_dest) if has_original else None,
+                },
+            },
+        }
+        (args.output / "summary.json").write_text(
+            json.dumps(combined, indent=2, ensure_ascii=False), encoding="utf-8"
+        )
+    else:
+        logging.info("Detected flat structure (bug dirs at top level)")
+        copied, dups = _merge_dir(args.shards, None, args.output, args.overwrite)
+        logging.info("copied=%d skipped_dup=%d", copied, dups)
+
+    logging.info("Merge complete → %s", args.output)
+
+    print(f"\nNext steps:")
+    run_dir = args.output / "direct" if is_both_mode else args.output
+    print(f"  1. Triage undecided verdicts:")
+    print(
+        f"     python scripts/triage_zkbugs_run.py {run_dir}"
+        f" --auto --update-evaluation --jobs 4"
+    )
+    print(f"  2. Merge into the remote run:")
+    for tool in ("circom_auditor_claude", "circom_auditor_codex"):
+        print(
+            f"     python scripts/merge_tool_run.py"
+            f" --source {run_dir}"
+            f" --target output/zkbugs-remote/direct"
+            f" --tool {tool}"
+        )
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/process_zkbugs_results.py b/scripts/process_zkbugs_results.py
index 87d9cfd..cf57ead 100755
--- a/scripts/process_zkbugs_results.py
+++ b/scripts/process_zkbugs_results.py
@@ -18,6 +18,21 @@
 from typing import Dict, List, Tuple
 
 
+# All tools evaluated by zkhydra zkbugs sweeps. Order matters: it sets the
+# column order in every printed table, the LaTeX report, and the bug-tool
+# matrix. Add a tool here to surface it everywhere.
+TOOLS = [
+    "circomspect",
+    "circom_civer",
+    "picus",
+    "ecneproject",
+    "zkfuzz",
+    "conscs",
+    "circom_auditor_claude",
+    "circom_auditor_codex",
+]
+
+
 def load_json(file_path: Path) -> dict:
     """Load JSON file safely."""
     try:
@@ -116,7 +131,7 @@ def collect_results(
     bug_dirs = sorted([d for d in results_dir.iterdir() if d.is_dir()])
 
     # Tools to check
-    tools = ["circomspect", "circom_civer", "picus", "ecneproject", "zkfuzz", "conscs"]
+    tools = TOOLS
 
     for bug_dir in bug_dirs:
         bug_name = bug_dir.name
@@ -155,7 +170,7 @@ def print_tool_summary_table(tool_stats: Dict[str, Dict[str, int]], tool_times:
 
     # Define columns and tools
     columns = ["TP", "FN", "Undecided", "Timeout", "Failure"]
-    tools = ["circomspect", "circom_civer", "picus", "ecneproject", "zkfuzz", "conscs"]
+    tools = TOOLS
 
     # Calculate column widths
     tool_width = max(len(tool) for tool in tools + ["TOTAL"])
@@ -222,7 +237,7 @@ def print_bug_tool_matrix(
         bug_tool_matrix: Dictionary mapping bug names to tool statuses (with asterisks)
         full_path: If True, print full bug names without truncation
     """
-    tools = ["circomspect", "circom_civer", "picus", "ecneproject", "zkfuzz", "conscs"]
+    tools = TOOLS
 
     # Calculate column widths
     bug_width = max(len(bug) for bug in bug_tool_matrix.keys())
@@ -271,7 +286,7 @@ def print_execution_time_stats(
     print("EXECUTION TIME STATISTICS")
     print("=" * 100)
 
-    tools = ["circomspect", "circom_civer", "picus", "ecneproject", "zkfuzz", "conscs"]
+    tools = TOOLS
 
     # Calculate column widths
     tool_width = max(len(tool) for tool in tools)
@@ -326,8 +341,8 @@ def print_statistics(
     print("STATISTICS")
     print("=" * 80)
     print(f"Total bugs processed: {bug_count}")
-    print(f"Total tools evaluated: 5")
-    print(f"Total possible evaluations: {bug_count * 5}")
+    print(f"Total tools evaluated: {len(TOOLS)}")
+    print(f"Total possible evaluations: {bug_count * len(TOOLS)}")
 
     # Count actual evaluations (excluding N/A and Unknown)
     actual_evals = sum(sum(counts.values()) for counts in tool_stats.values())
@@ -354,8 +369,8 @@ def print_statistics(
         print(f"  Failures:        {total_failure:3d} ({total_failure/evaluated*100:5.1f}%)")
 
     # Bug-level detection statistics
-    tools = ["circomspect", "circom_civer", "picus", "ecneproject", "zkfuzz", "conscs"]
-    tools_without_ecne = ["circomspect", "circom_civer", "picus", "zkfuzz"]
+    tools = TOOLS
+    tools_without_ecne = [t for t in TOOLS if t != "ecneproject"]
 
     # Count bugs where at least one tool detected the vulnerability
     bugs_detected_all = 0
@@ -400,7 +415,7 @@ def generate_latex_report(
     output_pdf: Path,
 ):
     """Generate LaTeX report with four tables."""
-    tools = ["circomspect", "circom_civer", "picus", "ecneproject", "zkfuzz", "conscs"]
+    tools = TOOLS
     columns = ["TP", "FN", "Timeout", "Failure"]
 
     # Create bug ID mapping
@@ -505,6 +520,16 @@ def generate_latex_report(
                 f"{latex_tool_name} & 0 & --- & --- & --- & --- & {nr_timeout} " + r"\\" + "\n"
             )
 
+    # Build dynamic LaTeX bits driven by `tools` so adding a tool here is a
+    # one-line change to TOOLS rather than four hand-edited table headers.
+    matrix_col_spec = "l|" + "c" * len(tools)
+    time_col_spec = "l|" + "r" * len(tools)
+    tool_headers = " & ".join(
+        rf"\textbf{{{t.replace('_', r'\_')}}}" for t in tools
+    )
+    matrix_header_row = rf"\textbf{{Bug ID}} & {tool_headers} \\"
+    matrix_continued_cols = len(tools) + 1
+
     latex_content += r"""\bottomrule
 \end{tabular}
 \end{table}
@@ -515,19 +540,19 @@ def generate_latex_report(
 
 \begin{landscape}
 \footnotesize
-\begin{longtable}{l|ccccc}
+""" + rf"""\begin{{longtable}}{{{matrix_col_spec}}}
 \toprule
-\textbf{Bug ID} & \textbf{circomspect} & \textbf{circom\_civer} & \textbf{picus} & \textbf{ecneproject} & \textbf{zkfuzz} \\
+{matrix_header_row}
 \midrule
 \endfirsthead
 
 \toprule
-\textbf{Bug ID} & \textbf{circomspect} & \textbf{circom\_civer} & \textbf{picus} & \textbf{ecneproject} & \textbf{zkfuzz} \\
+{matrix_header_row}
 \midrule
 \endhead
 
 \midrule
-\multicolumn{6}{r}{\textit{Continued on next page}} \\
+\multicolumn{{{matrix_continued_cols}}}{{r}}{{\textit{{Continued on next page}}}} \\
 \endfoot
 
 \bottomrule
@@ -594,19 +619,19 @@ def generate_latex_report(
 
 \begin{landscape}
 \footnotesize
-\begin{longtable}{l|rrrrr}
+""" + rf"""\begin{{longtable}}{{{time_col_spec}}}
 \toprule
-\textbf{Bug ID} & \textbf{circomspect} & \textbf{circom\_civer} & \textbf{picus} & \textbf{ecneproject} & \textbf{zkfuzz} \\
+{matrix_header_row}
 \midrule
 \endfirsthead
 
 \toprule
-\textbf{Bug ID} & \textbf{circomspect} & \textbf{circom\_civer} & \textbf{picus} & \textbf{ecneproject} & \textbf{zkfuzz} \\
+{matrix_header_row}
 \midrule
 \endhead
 
 \midrule
-\multicolumn{6}{r}{\textit{Continued on next page}} \\
+\multicolumn{{{matrix_continued_cols}}}{{r}}{{\textit{{Continued on next page}}}} \\
 \endfoot
 
 \bottomrule
diff --git a/scripts/split_bugs.py b/scripts/split_bugs.py
new file mode 100644
index 0000000..6c9f022
--- /dev/null
+++ b/scripts/split_bugs.py
@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+"""Split the configured bug list into N shards for rate-limited LLM tools.
+
+Each shard is written as a --bugs-file compatible text file (one bug selector
+per line). Bugs are distributed via round-robin so each shard is nearly the
+same size and the last shard is never more than N-1 entries smaller than
+the first.
+
+Usage:
+    # Split config.toml [circom].bugs into 4 shards:
+    python scripts/split_bugs.py --shards 4 --output-dir shards/
+
+    # Split an existing bugs file:
+    python scripts/split_bugs.py --bugs-file all_bugs.txt --shards 3 --output-dir shards/
+
+After splitting, the script prints ready-to-run commands for each shard and
+the merge command to combine them afterwards.
+"""
+
+import argparse
+import sys
+import tomllib
+from pathlib import Path
+
+
+def read_bugs_from_config(config_path: Path) -> list[str]:
+    """Read [circom].bugs from config.toml."""
+    with open(config_path, "rb") as f:
+        data = tomllib.load(f)
+    return data.get("circom", {}).get("bugs", [])
+
+
+def read_bugs_from_file(bugs_file: Path) -> list[str]:
+    """Read one bug selector per line, ignoring blank lines and comments."""
+    lines = []
+    for raw in bugs_file.read_text(encoding="utf-8").splitlines():
+        line = raw.strip()
+        if line and not line.startswith("#"):
+            lines.append(line)
+    return lines
+
+
+def split_round_robin(bugs: list[str], n: int) -> list[list[str]]:
+    """Distribute bugs across n shards by round-robin for even sizing."""
+    shards: list[list[str]] = [[] for _ in range(n)]
+    for i, bug in enumerate(bugs):
+        shards[i % n].append(bug)
+    return shards
+
+
+def main() -> int:
+    p = argparse.ArgumentParser(description=__doc__)
+    p.add_argument(
+        "--shards", "-n", type=int, required=True,
+        help="Number of shards to create",
+    )
+    p.add_argument(
+        "--output-dir", "-o", type=Path, required=True,
+        help="Directory where shard_1.txt ... shard_N.txt are written",
+    )
+
+    source = p.add_mutually_exclusive_group()
+    source.add_argument(
+        "--config", type=Path, default=None,
+        help="Path to config.toml (default: config.toml in cwd)",
+    )
+    source.add_argument(
+        "--bugs-file", type=Path, default=None,
+        help="Existing --bugs-file to split (one selector per line)",
+    )
+
+    args = p.parse_args()
+
+    if args.shards < 1:
+        print("Error: --shards must be >= 1", file=sys.stderr)
+        return 1
+
+    if args.bugs_file:
+        if not args.bugs_file.is_file():
+            print(f"Error: --bugs-file not found: {args.bugs_file}", file=sys.stderr)
+            return 1
+        bugs = read_bugs_from_file(args.bugs_file)
+    else:
+        config_path = args.config or Path("config.toml")
+        if not config_path.is_file():
+            print(f"Error: config not found: {config_path}", file=sys.stderr)
+            return 1
+        bugs = read_bugs_from_config(config_path)
+
+    if not bugs:
+        print("Error: no bugs found in source", file=sys.stderr)
+        return 1
+
+    effective_shards = min(args.shards, len(bugs))
+    if effective_shards < args.shards:
+        print(
+            f"Warning: only {len(bugs)} bug(s) — reducing to {effective_shards} shard(s)",
+            file=sys.stderr,
+        )
+
+    print(f"Found {len(bugs)} bug(s), splitting into {effective_shards} shard(s)")
+
+    shards = split_round_robin(bugs, effective_shards)
+
+    args.output_dir.mkdir(parents=True, exist_ok=True)
+    shard_paths: list[Path] = []
+    for i, shard in enumerate(shards, 1):
+        shard_path = args.output_dir / f"shard_{i}.txt"
+        shard_path.write_text("\n".join(shard) + "\n", encoding="utf-8")
+        shard_paths.append(shard_path)
+        print(f"  shard_{i}.txt: {len(shard)} bug(s)")
+
+    print("\nReady-to-run commands (run each separately to respect rate limits):")
+    for i, path in enumerate(shard_paths, 1):
+        print(f"\n  # Shard {i}/{effective_shards}:")
+        print(
+            f"  uv run python -m zkhydra.main zkbugs"
+            f" --dataset bugs/zkbugs/dataset/circom"
+            f" --tools circom_auditor_claude,circom_auditor_codex"
+            f" --bugs-file {path}"
+            f" --zkbugs-mode both"
+            f" --output output/shard_{i}"
+        )
+
+    shard_dirs = " ".join(f"output/shard_{i}" for i in range(1, effective_shards + 1))
+    print(f"\n  # After all shards complete — merge into one combined run:")
+    print(
+        f"  python scripts/merge_shards.py {shard_dirs}"
+        f" --output output/llm_combined"
+    )
+    print(
+        f"\n  # Triage undecided verdicts:"
+    )
+    print(
+        f"  python scripts/triage_zkbugs_run.py output/llm_combined/direct"
+        f" --auto --update-evaluation --jobs 4"
+    )
+    print(
+        f"\n  # Merge into the remote run:"
+    )
+    print(
+        f"  python scripts/merge_tool_run.py --source output/llm_combined/direct"
+        f" --target output/zkbugs-remote/direct --tool circom_auditor_claude"
+    )
+    print(
+        f"  python scripts/merge_tool_run.py --source output/llm_combined/direct"
+        f" --target output/zkbugs-remote/direct --tool circom_auditor_codex"
+    )
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/zkhydra/core.py b/zkhydra/core.py
index f36ba17..b03673e 100644
--- a/zkhydra/core.py
+++ b/zkhydra/core.py
@@ -102,6 +102,8 @@ def to_dict(self) -> dict:
         "picus",
         "ecneproject",
         "zkfuzz",
+        "circom_auditor_claude",
+        "circom_auditor_codex",
     ],
     "pil": ["pilspector"],
     "cairo": ["sierra-analyzer"],
@@ -326,7 +328,12 @@ def load_bug_selectors(
 def _bug_matches_selectors(
     bug_dir: Path, dataset_dir: Path, selectors: list[str]
 ) -> bool:
-    """True if any selector is a substring of the bug name or relative path."""
+    """True if any selector overlaps with the bug name or dataset-relative path.
+
+    Supports both short selectors (e.g. "0xbok", "veridise_decoder") and full
+    config-file paths (e.g. "bugs/zkbugs/dataset/circom/org/repo/bug") by
+    checking in both directions.
+    """
     if not selectors:
         return True
     name = bug_dir.name
@@ -334,7 +341,10 @@ def _bug_matches_selectors(
         rel = str(bug_dir.resolve().relative_to(dataset_dir.resolve()))
     except ValueError:
         rel = str(bug_dir)
-    return any(sel in name or sel in rel for sel in selectors)
+    return any(
+        sel in name or sel in rel or name in sel or rel in sel
+        for sel in selectors
+    )
 
 
 def discover_zkbugs(
diff --git a/zkhydra/tools/circom_auditor_base.py b/zkhydra/tools/circom_auditor_base.py
new file mode 100644
index 0000000..a2a8f66
--- /dev/null
+++ b/zkhydra/tools/circom_auditor_base.py
@@ -0,0 +1,783 @@
+"""
+Shared sandbox-building and markdown-report-parsing logic for LLM-based
+Circom auditors (Claude and Codex variants).
+
+Both CircomAuditorClaude and CircomAuditorCodex inherit from CircomAuditorBase.
+The base class owns:
+  - Include-closure sandbox builder (_prepare_scratch_dir and helpers)
+  - Markdown report parser (_helper_parse_output and helpers)
+  - Uniform Finding converter (_helper_generate_uniform_results)
+  - zkbugs ground-truth evaluator (evaluate_zkbugs_ground_truth)
+
+Each subclass implements only _internal_execute, choosing how to invoke
+its respective LLM CLI from the prepared scratch directory, and __init__,
+which checks that the required binary and credentials are present.
+"""
+
+import logging
+import os
+import re
+import shutil
+import tempfile
+from abc import abstractmethod
+from collections import deque
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+from zkhydra.tools.base import (
+    AbstractTool,
+    AnalysisStatus,
+    Finding,
+    Input,
+    StandardizedBugCategory,
+    ToolOutput,
+)
+
+# Map common bug-class slugs (kebab-case fragments from finding titles or
+# dedup keys) to the standardized zkhydra category. Matched on the most
+# reliable substring in the finding title.
+BUG_CLASS_TO_STANDARD: List[Tuple[str, StandardizedBugCategory]] = [
+    (
+        "comparator-input-not-range-checked",
+        StandardizedBugCategory.UNDER_CONSTRAINED,
+    ),
+    ("missing-range-check", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("range-check", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("range checked", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("range checks", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("packbytes", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("num2bits", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("aliasing", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("assigned-but-unconstrained", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("assigned but unconstrained", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("unconstrained", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("under-constrained", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("under constrained", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("witness-only", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("decoder", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("one-sided", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("div-by-zero", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("division-by-zero", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("ec-edge-case", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("equal-x", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("intent-binding", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("replay", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("conditional-gate-collapse", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("selector", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("selector-not-boolean", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("limb-out-of-range", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("non-canonical", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("merkle", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("nullifier", StandardizedBugCategory.UNDER_CONSTRAINED),
+    ("over-constrained", StandardizedBugCategory.OVER_CONSTRAINED),
+    ("over constrained", StandardizedBugCategory.OVER_CONSTRAINED),
+    ("completeness", StandardizedBugCategory.OVER_CONSTRAINED),
+    ("regex-overlap", StandardizedBugCategory.COMPUTATIONAL_ISSUE),
+    ("base64", StandardizedBugCategory.COMPUTATIONAL_ISSUE),
+    ("hash-construction", StandardizedBugCategory.COMPUTATIONAL_ISSUE),
+    ("non-determinism", StandardizedBugCategory.COMPUTATIONAL_ISSUE),
+    ("non-deterministic", StandardizedBugCategory.COMPUTATIONAL_ISSUE),
+    ("computational", StandardizedBugCategory.COMPUTATIONAL_ISSUE),
+    ("privacy", StandardizedBugCategory.COMPUTATIONAL_ISSUE),
+    ("information-leak", StandardizedBugCategory.COMPUTATIONAL_ISSUE),
+    ("information leak", StandardizedBugCategory.COMPUTATIONAL_ISSUE),
+    ("shadowing", StandardizedBugCategory.WARNING),
+    ("bitwise-complement", StandardizedBugCategory.WARNING),
+    ("assertion-vs-constraint", StandardizedBugCategory.WARNING),
+    ("assert-vs-constraint", StandardizedBugCategory.WARNING),
+    ("slash-vs-backslash", StandardizedBugCategory.WARNING),
+]
+
+
+@dataclass
+class _ScopeInfo:
+    """Description of the include closure materialised in the scratch dir."""
+
+    wrapper_name: str
+    file_count: int
+    total_lines: int
+    cap_lines: int
+    unresolved: List[str] = field(default_factory=list)
+    skipped_no_root: List[str] = field(default_factory=list)
+
+    @property
+    def truncated(self) -> bool:
+        return any("truncated at budget" in u for u in self.unresolved)
+
+    def summary_line(self) -> str:
+        truncated = " (truncated at budget)" if self.truncated else ""
+        return (
+            f"include closure rooted at `{self.wrapper_name}` — "
+            f"{self.file_count} file(s) / {self.total_lines} lines"
+            f"{truncated}"
+        )
+
+    def manifest_markdown(self) -> str:
+        lines = [
+            "# Audit scope",
+            "",
+            f"**Wrapper / entrypoint:** `{self.wrapper_name}`",
+            f"**Files in scope:** {self.file_count} `.circom` (transitive include closure of the wrapper)",
+            f"**Total source lines:** {self.total_lines:,} (cap: {self.cap_lines:,})",
+            "",
+            "Audit only what's reachable from the wrapper's `include` graph "
+            "as materialised in this directory. Do **not** speculate about "
+            "code that isn't here — assume out-of-scope templates are "
+            "outside the soundness boundary you're being asked to verify.",
+        ]
+        if self.truncated:
+            lines += [
+                "",
+                "## Warning: Closure was truncated at the line budget",
+                "",
+                "The wrapper's full transitive closure exceeded the configured "
+                f"line cap ({self.cap_lines:,}). The bundle in this directory "
+                "is the **breadth-first prefix** that fit; deeper / later-in-BFS "
+                "deps were dropped.",
+            ]
+        if self.unresolved:
+            shown = [
+                u for u in self.unresolved if "truncated at budget" not in u
+            ]
+            if shown:
+                lines += [
+                    "",
+                    "## Unresolved includes",
+                    "",
+                    "These `include` specs could not be resolved against any link root:",
+                    "",
+                ] + [f"- `{u}`" for u in shown[:32]]
+        return "\n".join(lines) + "\n"
+
+
+@dataclass
+class CircomAuditorIssue:
+    """One finding parsed out of the skill's markdown report."""
+
+    title: str
+    confidence: int
+    template: Optional[str]
+    file: Optional[str]
+    line: Optional[int]
+    line_end: Optional[int]
+    signal: Optional[str]
+    description: str
+    severity: str  # "finding" or "lead"
+    agents: Optional[int] = (
+        None  # the [agents: N] convergence count, when present
+    )
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "title": self.title,
+            "confidence": self.confidence,
+            "template": self.template,
+            "file": self.file,
+            "line": self.line,
+            "line_end": self.line_end,
+            "signal": self.signal,
+            "description": self.description,
+            "severity": self.severity,
+            "agents": self.agents,
+        }
+
+
+@dataclass
+class CircomAuditorParsed:
+    """Structured parsed output from a circom-auditor run."""
+
+    status: str  # "success" | "timeout" | "error" | "no_findings"
+    issues: List[CircomAuditorIssue] = field(default_factory=list)
+    raw_report: str = ""
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "status": self.status,
+            "issues": [issue.to_dict() for issue in self.issues],
+            "statistics": {
+                "total_findings": sum(
+                    1 for i in self.issues if i.severity == "finding"
+                ),
+                "total_leads": sum(
+                    1 for i in self.issues if i.severity == "lead"
+                ),
+            },
+        }
+
+
+# Regex bank for extracting finding metadata from the report's per-finding
+# header line (per circom-auditor/references/report-formatting.md):
+#   `TemplateName (file.circom:LL-LL) · signal: <signalName>` · Confidence: 95
+_HEADER_RE = re.compile(
+    r"`(?P<template>[\w\d_]+)\s*"
+    r"(?:\((?P<file>[^:)]+)(?::(?P<line>\d+)(?:-(?P<line_end>\d+))?)?\))?"
+    r"(?:\s*·\s*signal:\s*(?P<signal>[^`]+?))?\s*`"
+    r"\s*·\s*Confidence:\s*(?P<conf>\d+)",
+    re.IGNORECASE,
+)
+_AGENTS_RE = re.compile(r"\[agents:\s*(\d+)\]", re.IGNORECASE)
+_LEAD_RE = re.compile(
+    r"^\s*-\s*\*\*(?P<title>.+?)\*\*\s*—\s*"
+    r"`(?P<template>[\w\d_]+)(?:\.(?P<signal>[^`]+))?`"
+    r"\s*—\s*Code smells:\s*(?P<smells>.+)$"
+)
+
+
+class CircomAuditorBase(AbstractTool):
+    """Abstract base for LLM-powered Circom auditors (Claude and Codex variants).
+
+    Provides the shared include-closure sandbox builder, markdown report parser,
+    uniform finding converter, and zkbugs evaluator. Subclasses supply only
+    _internal_execute (how to invoke the LLM CLI) and __init__ (credential checks).
+    """
+
+    # Only .circom files enter the sandbox.
+    _ALLOWED_SUFFIXES = (".circom",)
+
+    # Directories whose contents are never symlinked from a linked codebase root.
+    _BLOCKED_DIRNAMES = frozenset(
+        {
+            "test",
+            "tests",
+            "__tests__",
+            "node_modules",
+            "doc",
+            "docs",
+            "documentation",
+            "dist",
+            "build",
+            "out",
+            "target",
+            "examples",
+            "example",
+            "static",
+            "audit",
+            "audits",
+            "report",
+            "reports",
+            "client",
+            "frontend",
+            "eth",
+            "contracts",
+        }
+    )
+
+    # Matches `include "..."` in Circom source.
+    _INCLUDE_RE = re.compile(
+        r'^[ \t]*include[ \t]+"([^"]+)"\s*;?', re.MULTILINE
+    )
+    _LINE_COMMENT_RE = re.compile(r"//[^\n]*")
+    _BLOCK_COMMENT_RE = re.compile(r"/\*.*?\*/", re.DOTALL)
+
+    def __init__(self, name: str) -> None:
+        super().__init__(name)
+
+        # Both LLM tools are native-only: OAuth/API credentials live in the
+        # host OS keychain and cannot be mounted into a Docker container.
+        if os.path.exists("/.dockerenv"):
+            import sys
+
+            logging.error(
+                "%s is a native-only tool and cannot run inside the zkhydra "
+                "Docker container. Re-run zkhydra on the host "
+                "(`uv run python -m zkhydra.main ...`) after installing "
+                "the required CLI — see zkhydra/README.md.",
+                name,
+            )
+            sys.exit(1)
+
+        try:
+            self.max_lines = int(
+                os.environ.get("CIRCOM_AUDITOR_MAX_LINES", "5000")
+            )
+        except ValueError:
+            self.max_lines = 5000
+
+    @abstractmethod
+    def _internal_execute(self, input_paths: Input, timeout: int) -> ToolOutput:
+        """Invoke the LLM CLI from the prepared scratch directory."""
+
+    # ------------------------------------------------------------------ parsing
+
+    def _helper_parse_output(
+        self, tool_result_raw: Path
+    ) -> CircomAuditorParsed:
+        """Parse the markdown report into structured findings."""
+        with open(tool_result_raw, "r", encoding="utf-8") as f:
+            raw = f.read()
+
+        if "[Timed out]" in raw and "## Findings" not in raw:
+            return CircomAuditorParsed(status="timeout", raw_report=raw)
+
+        if "## Findings" not in raw:
+            return CircomAuditorParsed(status="error", raw_report=raw)
+
+        issues: List[CircomAuditorIssue] = []
+        issues.extend(self._parse_findings_section(raw))
+        issues.extend(self._parse_leads_section(raw))
+
+        status = "success" if issues else "no_findings"
+        return CircomAuditorParsed(status=status, issues=issues, raw_report=raw)
+
+    def _parse_findings_section(self, raw: str) -> List[CircomAuditorIssue]:
+        """Extract each `[NN] **K. Title**` block from the ## Findings section."""
+        start_marker = "## Findings"
+        end_markers = ["## Leads", "Findings List", "---\n\n>"]
+        start = raw.find(start_marker)
+        if start < 0:
+            return []
+        end = len(raw)
+        for marker in end_markers:
+            idx = raw.find(marker, start + len(start_marker))
+            if 0 <= idx < end:
+                end = idx
+        section = raw[start:end]
+
+        issues: List[CircomAuditorIssue] = []
+        finding_pattern = re.compile(
+            r"^\[(\d+)\]\s*\*\*\d+\.\s*(.+?)\*\*",
+            re.MULTILINE,
+        )
+        matches = list(finding_pattern.finditer(section))
+        for i, m in enumerate(matches):
+            confidence = int(m.group(1))
+            title = m.group(2).strip()
+            block_start = m.end()
+            block_end = (
+                matches[i + 1].start() if i + 1 < len(matches) else len(section)
+            )
+            block = section[block_start:block_end]
+
+            header = self._extract_header(block)
+            description = self._extract_description(block)
+            agents_match = _AGENTS_RE.search(block)
+            agents = int(agents_match.group(1)) if agents_match else None
+
+            issues.append(
+                CircomAuditorIssue(
+                    title=title,
+                    confidence=confidence,
+                    template=header.get("template"),
+                    file=header.get("file"),
+                    line=header.get("line"),
+                    line_end=header.get("line_end"),
+                    signal=header.get("signal"),
+                    description=description,
+                    severity="finding",
+                    agents=agents,
+                )
+            )
+        return issues
+
+    @staticmethod
+    def _extract_header(block: str) -> Dict[str, Any]:
+        """Pull `Template (file:line) · signal: X` · Confidence: N from a block."""
+        m = _HEADER_RE.search(block)
+        if not m:
+            return {}
+        return {
+            "template": (m.group("template") or None),
+            "file": (m.group("file") or "").strip() or None,
+            "line": int(m.group("line")) if m.group("line") else None,
+            "line_end": (
+                int(m.group("line_end")) if m.group("line_end") else None
+            ),
+            "signal": (m.group("signal") or "").strip() or None,
+        }
+
+    @staticmethod
+    def _extract_description(block: str) -> str:
+        """First paragraph after **Description**, trimmed."""
+        m = re.search(
+            r"\*\*Description\*\*\s*\n+(.+?)(?:\n\n|\*\*Circuit\s*/\s*Constraint\*\*|\*\*Fix\*\*)",
+            block,
+            re.DOTALL,
+        )
+        if not m:
+            return ""
+        return m.group(1).strip().replace("\n", " ")
+
+    def _parse_leads_section(self, raw: str) -> List[CircomAuditorIssue]:
+        start = raw.find("## Leads")
+        if start < 0:
+            return []
+        end_markers = ["---\n\n>", "\n\n> ⚠️"]
+        end = len(raw)
+        for marker in end_markers:
+            idx = raw.find(marker, start)
+            if 0 <= idx < end:
+                end = idx
+        section = raw[start:end]
+
+        issues: List[CircomAuditorIssue] = []
+        for line in section.splitlines():
+            m = _LEAD_RE.match(line)
+            if not m:
+                continue
+            issues.append(
+                CircomAuditorIssue(
+                    title=m.group("title").strip(),
+                    confidence=0,
+                    template=m.group("template"),
+                    file=None,
+                    line=None,
+                    line_end=None,
+                    signal=(m.group("signal") or "").strip() or None,
+                    description=f"Code smells: {m.group('smells').strip()}",
+                    severity="lead",
+                )
+            )
+        return issues
+
+    # ----------------------------------------------------- standardization
+
+    def _helper_generate_uniform_results(
+        self,
+        parsed_output: CircomAuditorParsed,
+        tool_output: ToolOutput,
+    ) -> Tuple[AnalysisStatus, List[Finding]]:
+        """Convert parsed findings into uniform Finding objects."""
+        if parsed_output.status == "timeout":
+            return AnalysisStatus.TIMEOUT, []
+        if parsed_output.status == "error":
+            return AnalysisStatus.ERROR, []
+
+        confirmed = [i for i in parsed_output.issues if i.severity == "finding"]
+        analysis_status = (
+            AnalysisStatus.BUGS_FOUND if confirmed else AnalysisStatus.NO_BUGS
+        )
+
+        findings: List[Finding] = []
+        for issue in parsed_output.issues:
+            unified = self._classify(issue.title)
+            findings.append(
+                Finding(
+                    bug_title=issue.title,
+                    unified_bug_title=unified,
+                    description=issue.description,
+                    file=issue.file or "",
+                    position={
+                        "line": issue.line,
+                        "column": None,
+                        "template": issue.template,
+                        "signal": issue.signal,
+                        "line_end": issue.line_end,
+                    },
+                    metadata={
+                        "severity": issue.severity,
+                        "confidence": issue.confidence,
+                        "agents": issue.agents,
+                    },
+                )
+            )
+        return analysis_status, findings
+
+    @staticmethod
+    def _classify(title: str) -> StandardizedBugCategory:
+        haystack = title.lower()
+        for slug, category in BUG_CLASS_TO_STANDARD:
+            if slug in haystack:
+                return category
+        return StandardizedBugCategory.UNDER_CONSTRAINED
+
+    # ------------------------------------------------------ zkbugs eval API
+
+    def evaluate_zkbugs_ground_truth(
+        self,
+        tool: str,
+        dsl: str,
+        bug_name: str,
+        ground_truth: Path,
+        tool_result_path: Path,
+    ) -> Dict[str, Any]:
+        """Compare findings against zkbugs ground truth.
+
+        Matching strategy: vulnerability-class match plus line-range overlap
+        → TruePositive; class-match-only → Undecided; no match → FalseNegative.
+        """
+        gt_data = self.load_json_file(ground_truth)
+        gt_vulnerability = (gt_data.get("vulnerability") or "").strip()
+        gt_location = gt_data.get("location", {}) or {}
+        gt_lines = gt_location.get("Line")
+
+        tool_results = self.load_json_file(tool_result_path)
+        findings = tool_results.get("findings", [])
+        # Only confirmed findings count toward recall; leads don't.
+        findings = [
+            f
+            for f in findings
+            if f.get("metadata", {}).get("severity") == "finding"
+        ]
+
+        if not findings:
+            return {
+                "status": "FalseNegative",
+                "reason": "Tool found no confirmed findings (only leads, if any)",
+                "need_manual_analysis": False,
+                "manual_analysis": "N/A",
+                "manual_analysis_reasoning": "N/A",
+            }
+
+        if gt_lines:
+            if "-" in gt_lines:
+                gt_start, gt_end = gt_lines.split("-", 1)
+                gt_startline, gt_endline = int(gt_start), int(gt_end)
+            else:
+                gt_startline = gt_endline = int(gt_lines)
+        else:
+            gt_startline = gt_endline = None
+
+        exact_match = False
+        partial_matches: List[str] = []
+        for finding in findings:
+            unified_title = finding.get("unified_bug_title", "")
+            position = finding.get("position", {}) or {}
+            finding_line = position.get("line")
+
+            vuln_match = (
+                gt_vulnerability
+                and unified_title.lower() == gt_vulnerability.lower()
+            )
+
+            if finding_line is not None and gt_startline is not None:
+                line_match = gt_startline <= finding_line <= gt_endline
+            else:
+                line_match = None
+
+            if vuln_match and line_match:
+                exact_match = True
+            elif vuln_match:
+                partial_matches.append(
+                    f"Found {unified_title} but at different line "
+                    f"({finding_line} vs {gt_lines})"
+                )
+
+        if exact_match:
+            return {
+                "status": "TruePositive",
+                "reason": f"Found {gt_vulnerability} at lines {gt_lines}",
+                "need_manual_analysis": False,
+                "manual_analysis": "N/A",
+                "manual_analysis_reasoning": "N/A",
+            }
+        if partial_matches:
+            return {
+                "status": "Undecided",
+                "reason": "; ".join(partial_matches),
+                "need_manual_analysis": True,
+                "manual_analysis": "Pending",
+                "manual_analysis_reasoning": "TODO",
+            }
+        return {
+            "status": "Undecided",
+            "reason": (
+                f"Tool found {len(findings)} confirmed findings but none "
+                f"match {gt_vulnerability}"
+            ),
+            "need_manual_analysis": True,
+            "manual_analysis": "Pending",
+            "manual_analysis_reasoning": "TODO",
+        }
+
+    # ---------------------------------------------- include-closure builder
+
+    @classmethod
+    def _strip_comments(cls, source: str) -> str:
+        return cls._LINE_COMMENT_RE.sub(
+            "", cls._BLOCK_COMMENT_RE.sub("", source)
+        )
+
+    @classmethod
+    def _extract_includes(cls, source: str) -> List[str]:
+        return cls._INCLUDE_RE.findall(cls._strip_comments(source))
+
+    @staticmethod
+    def _resolve_include(
+        spec: str, from_file: Path, link_paths: List[Path]
+    ) -> Optional[Path]:
+        """Mirror circom's resolution: relative to including file first,
+        then each -l root in order. Returns first existing match."""
+        candidates = [from_file.parent / spec]
+        for lp in link_paths:
+            candidates.append(lp / spec)
+        for candidate in candidates:
+            if candidate.is_file():
+                try:
+                    return candidate.resolve()
+                except OSError:
+                    return candidate
+        return None
+
+    def _resolve_include_closure(
+        self,
+        wrapper: Path,
+        link_paths: List[Path],
+        max_lines: int,
+    ) -> Tuple[List[Path], int, List[str]]:
+        """BFS the include graph from `wrapper`, capped at `max_lines`."""
+        included: List[Path] = []
+        visited: set = set()
+        unresolved: List[str] = []
+        wrapper_resolved = wrapper.resolve()
+        included.append(wrapper_resolved)
+        visited.add(wrapper_resolved)
+        try:
+            wrapper_lines = wrapper.read_text(errors="replace").count("\n")
+        except OSError:
+            wrapper_lines = 0
+        total_lines = wrapper_lines
+
+        queue: deque = deque([wrapper_resolved])
+        while queue:
+            current = queue.popleft()
+            try:
+                content = current.read_text(errors="replace")
+            except OSError:
+                continue
+            for spec in self._extract_includes(content):
+                resolved = self._resolve_include(spec, current, link_paths)
+                if resolved is None:
+                    if spec not in unresolved:
+                        unresolved.append(spec)
+                    continue
+                if resolved in visited:
+                    continue
+                try:
+                    line_count = resolved.read_text(errors="replace").count(
+                        "\n"
+                    )
+                except OSError:
+                    continue
+                if total_lines + line_count > max_lines:
+                    unresolved.append(
+                        f"<truncated at budget: would exceed {max_lines} lines "
+                        f"after adding {resolved.name} (+{line_count})>"
+                    )
+                    return included, total_lines, unresolved
+                visited.add(resolved)
+                included.append(resolved)
+                total_lines += line_count
+                queue.append(resolved)
+        return included, total_lines, unresolved
+
+    @staticmethod
+    def _shadow_path_for(
+        target: Path, link_paths: List[Path], wrapper_dir: Path
+    ) -> Optional[Path]:
+        """Compute the relative path a dep should occupy in the scratch dir."""
+        candidates = [wrapper_dir, *link_paths]
+        for root in candidates:
+            try:
+                return target.resolve().relative_to(root.resolve())
+            except (ValueError, OSError):
+                continue
+        return None
+
+    def _is_source_file(self, path: Path) -> bool:
+        return path.suffix.lower() in self._ALLOWED_SUFFIXES
+
+    @staticmethod
+    def _extract_link_paths(link_flags: List[str]) -> List[str]:
+        paths: List[str] = []
+        it = iter(link_flags)
+        for flag in it:
+            if flag in ("-l", "-L", "--link-libraries"):
+                try:
+                    paths.append(next(it))
+                except StopIteration:
+                    break
+        return paths
+
+    def _prepare_scratch_dir(
+        self, input_paths: Input, circuit_file_path: Path
+    ) -> Tuple[Path, Path, "_ScopeInfo"]:
+        """Build a sandboxed working dir scoped to the wrapper's include closure.
+
+        Excluded by construction: READMEs, zkbugs_config.json,
+        direct_input.json, and anything beyond the line cap, so the answer
+        key never reaches the model during zkbugs evaluation.
+        """
+        scratch_root = Path(tempfile.mkdtemp(prefix=f"zkhydra-{self.name}-"))
+
+        # 1. Copy the wrapper itself.
+        target_wrapper = scratch_root / circuit_file_path.name
+        shutil.copy2(circuit_file_path, target_wrapper)
+
+        # 2. Copy sibling .circom files at the top level of circuit_dir.
+        circuit_dir = Path(input_paths.circuit_dir).resolve()
+        if circuit_dir.is_dir():
+            for child in circuit_dir.iterdir():
+                if not child.is_file():
+                    continue
+                if child.resolve() == circuit_file_path.resolve():
+                    continue
+                if not self._is_source_file(child):
+                    continue
+                dest = scratch_root / child.name
+                if dest.exists():
+                    continue
+                shutil.copy2(child, dest)
+
+        # 3. Trace the include closure.
+        link_paths_str = self._extract_link_paths(input_paths.link_flags)
+        link_paths = [Path(p) for p in link_paths_str if Path(p).is_dir()]
+        wrapper_dir = circuit_file_path.parent
+
+        closure, total_lines, unresolved = self._resolve_include_closure(
+            circuit_file_path, link_paths, self.max_lines
+        )
+        deps = [
+            p for p in closure if p.resolve() != circuit_file_path.resolve()
+        ]
+
+        symlinked = 0
+        skipped_no_root: List[Path] = []
+        for dep in deps:
+            rel = self._shadow_path_for(dep, link_paths, wrapper_dir)
+            if rel is None:
+                skipped_no_root.append(dep)
+                continue
+            dest = scratch_root / rel
+            if dest.exists() or dest.is_symlink():
+                continue
+            try:
+                dest.parent.mkdir(parents=True, exist_ok=True)
+                os.symlink(dep, dest)
+                symlinked += 1
+            except OSError as exc:
+                logging.debug(
+                    "%s scratch: cannot symlink %s -> %s: %s",
+                    self.name,
+                    dep,
+                    dest,
+                    exc,
+                )
+
+        # 4. Write the focus manifest.
+        scope = _ScopeInfo(
+            wrapper_name=target_wrapper.name,
+            file_count=len(closure),
+            total_lines=total_lines,
+            cap_lines=self.max_lines,
+            unresolved=unresolved,
+            skipped_no_root=[str(p) for p in skipped_no_root],
+        )
+        try:
+            (scratch_root / "_SCOPE.md").write_text(scope.manifest_markdown())
+        except OSError:
+            pass
+
+        logging.info(
+            "%s: closure=%d files / %d lines (cap=%d), "
+            "symlinked=%d, unresolved=%d, no-root=%d",
+            self.name,
+            scope.file_count,
+            scope.total_lines,
+            scope.cap_lines,
+            symlinked,
+            len(unresolved),
+            len(skipped_no_root),
+        )
+
+        return scratch_root, target_wrapper, scope
diff --git a/zkhydra/tools/circom_auditor_claude.py b/zkhydra/tools/circom_auditor_claude.py
new file mode 100644
index 0000000..6271a5d
--- /dev/null
+++ b/zkhydra/tools/circom_auditor_claude.py
@@ -0,0 +1,158 @@
+"""
+circom-auditor (Claude variant) — wraps the Claude Code skill at
+https://github.com/zksecurity/zk-skills via `claude --print`.
+
+**Native-only tool.** OAuth credentials live in the host OS keychain
+(macOS Keychain / libsecret on Linux / DPAPI on Windows), which cannot
+be mounted into a Linux container. Run zkhydra on the host.
+
+Setup (one-time, on host):
+
+  1. Install Claude Code CLI: ``npm install -g @anthropic-ai/claude-code``
+  2. Authenticate: ``claude login``  (or ``export ANTHROPIC_API_KEY=...``)
+  3. Clone zk-skills + symlink the skill::
+
+         git clone https://github.com/zksecurity/zk-skills.git ~/zk-skills
+         mkdir -p ~/audit-plugin/skills
+         ln -s ~/zk-skills/circom-auditor ~/audit-plugin/skills/circom-auditor
+         export CLAUDE_PLUGIN_DIR=~/audit-plugin
+
+Runtime characteristics:
+
+- Each run takes 3-5 minutes (the skill spawns 9 parallel sub-agents).
+- Consumes Claude subscription quota or Anthropic API tokens.
+"""
+
+import logging
+import os
+import shutil
+import sys
+from pathlib import Path
+
+from zkhydra.tools.base import Input, ToolOutput
+from zkhydra.tools.circom_auditor_base import CircomAuditorBase
+
+# Tools the auditor must never invoke during eval. The first two are
+# built-in Claude Code tools; the rest are common MCP web tools.
+_DISALLOWED_TOOLS = (
+    "WebSearch",
+    "WebFetch",
+    "mcp__exa__web_search_exa",
+    "mcp__exa__web_fetch_exa",
+)
+
+_SANDBOX_SYSTEM_NOTE = (
+    "Sandboxed evaluation mode. Do not perform web searches, web fetches, "
+    "or any external lookups. Audit only the .circom source files in the "
+    "current working directory. Reason from the constraint system alone."
+)
+
+
+class CircomAuditorClaude(CircomAuditorBase):
+    """ZK-Security circom-auditor Claude skill, packaged as a zkhydra tool.
+
+    Invokes `claude --print --plugin-dir $CLAUDE_PLUGIN_DIR` from a sandboxed
+    scratch directory containing only the wrapper's include closure.
+    """
+
+    def __init__(self) -> None:
+        super().__init__("circom_auditor_claude")
+
+        if not self.check_binary_exists("claude"):
+            logging.error(
+                "circom_auditor_claude: `claude` not found on PATH. Install with "
+                "`npm install -g @anthropic-ai/claude-code` and run "
+                "`claude login` (subscription) or export ANTHROPIC_API_KEY."
+            )
+            sys.exit(1)
+
+        self.plugin_dir = os.environ.get("CLAUDE_PLUGIN_DIR")
+        if not self.plugin_dir:
+            logging.error(
+                "circom_auditor_claude: CLAUDE_PLUGIN_DIR is not set. Clone "
+                "https://github.com/zksecurity/zk-skills, symlink "
+                "`circom-auditor/` under <plugin-dir>/skills/, and "
+                "export CLAUDE_PLUGIN_DIR=<plugin-dir>."
+            )
+            sys.exit(1)
+
+        skill_path = (
+            Path(self.plugin_dir) / "skills" / "circom-auditor" / "SKILL.md"
+        )
+        if not skill_path.is_file():
+            logging.error(
+                "circom_auditor_claude: SKILL.md not found at %s. The plugin "
+                "directory must contain `skills/circom-auditor/SKILL.md`.",
+                skill_path,
+            )
+            sys.exit(1)
+
+        if not os.environ.get("ANTHROPIC_API_KEY"):
+            logging.info(
+                "circom_auditor_claude: no ANTHROPIC_API_KEY set — assuming "
+                "host-level Claude Code auth (`claude login`). "
+                "If the run fails with a 401, set ANTHROPIC_API_KEY."
+            )
+
+    def _materialize_skill(self, target_dir: Path) -> None:
+        """Symlink the circom-auditor skill into the sandbox at skills/circom-auditor/.
+
+        SKILL.md instructs claude to run:
+            python3 skills/circom-auditor/scripts/build_audit_context.py --repo "$PWD"
+        That relative path only resolves if the skill tree is present under the cwd.
+        """
+        skill_src = (
+            Path(self.plugin_dir) / "skills" / "circom-auditor"
+        ).resolve()
+        scratch_skill = target_dir / "skills" / "circom-auditor"
+        if scratch_skill.exists():
+            return
+        scratch_skill.parent.mkdir(parents=True, exist_ok=True)
+        try:
+            scratch_skill.symlink_to(skill_src, target_is_directory=True)
+        except OSError:
+            shutil.copytree(skill_src, scratch_skill, symlinks=True)
+
+    def _internal_execute(self, input_paths: Input, timeout: int) -> ToolOutput:
+        """Run `claude --print` on a sandboxed copy of the circuit dir."""
+        circuit_file_path = Path(input_paths.circuit_file)
+        target_dir, target_file, scope = self._prepare_scratch_dir(
+            input_paths, circuit_file_path
+        )
+        self._materialize_skill(target_dir)
+
+        prompt = (
+            f"Run the circom-auditor skill on `{target_file.name}`. "
+            f"Use the full delegated multi-agent workflow. "
+            f"Scope: {scope.summary_line()}"
+        )
+        cmd = [
+            "claude",
+            "--print",
+            "--plugin-dir",
+            self.plugin_dir,
+            "--dangerously-skip-permissions",
+            "--setting-sources",
+            "",
+            "--disallowedTools",
+            " ".join(_DISALLOWED_TOOLS),
+            "--append-system-prompt",
+            _SANDBOX_SYSTEM_NOTE,
+            "--output-format",
+            "text",
+            prompt,
+        ]
+
+        original_cwd = Path.cwd()
+        logging.info(
+            "circom_auditor_claude: launching claude in sandbox %s "
+            "(target=%s, plugin_dir=%s)",
+            target_dir,
+            target_file.name,
+            self.plugin_dir,
+        )
+        try:
+            self.change_directory(target_dir)
+            return self.run_command(cmd, timeout, str(target_dir))
+        finally:
+            self.change_directory(original_cwd)
diff --git a/zkhydra/tools/circom_auditor_codex.py b/zkhydra/tools/circom_auditor_codex.py
new file mode 100644
index 0000000..166505b
--- /dev/null
+++ b/zkhydra/tools/circom_auditor_codex.py
@@ -0,0 +1,315 @@
+"""
+circom-auditor (Codex variant) — wraps the circom-auditor skill instructions
+via the OpenAI Codex CLI (`codex exec`) and Codex's native skill discovery.
+
+Unlike the Claude variant, Codex has no `--plugin-dir` flag. It discovers
+skills from `.agents/skills`, user, admin, system, and installed plugin
+locations. This wrapper locates the circom-auditor skill, exposes it inside the
+scratch directory as `.agents/skills/circom-auditor` when needed, and invokes it
+explicitly as `$circom-auditor`. The wrapper prebuilds the delegated agent
+bundles and forbids Codex's local fallback path; if subagents are unavailable,
+the run reports delegated mode as unavailable instead of doing a single-agent
+audit.
+
+**Native-only tool.** Codex CLI authentication must be available in the host
+environment. Does not run inside Docker.
+
+Setup (one-time, on host):
+
+  1. Install Codex CLI: ``npm install -g @openai/codex``
+  2. Authenticate: ``codex login`` or set ``CODEX_API_KEY`` for automation.
+  3. Install the skill in a Codex skill location, for example::
+
+         git clone https://github.com/zksecurity/zk-skills.git ~/zk-skills
+         mkdir -p ~/.agents/skills
+         ln -s ~/zk-skills/skills/circom-auditor ~/.agents/skills/circom-auditor
+
+     A repo-local `.agents/skills/circom-auditor` symlink also works.
+     For compatibility, CODEX_PLUGIN_DIR / CLAUDE_PLUGIN_DIR are still accepted
+     if they point at a directory containing `skills/circom-auditor/SKILL.md`::
+
+         export CODEX_PLUGIN_DIR=~/zk-skills
+
+Runtime characteristics:
+
+- Each run takes 3-10 minutes depending on circuit size and model.
+- Consumes OpenAI API tokens or Codex account quota.
+- Model is configurable via CODEX_MODEL env var.
+"""
+
+import logging
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+from zkhydra.tools.base import Input, OutputStatus, ToolOutput
+from zkhydra.tools.circom_auditor_base import CircomAuditorBase
+
+_SKILL_NAME = "circom-auditor"
+_CONTEXT_DIR_NAME = "_circom_auditor_context"
+
+_SANDBOX_NOTE = (
+    "Sandboxed evaluation mode. Do NOT perform web searches or external lookups. "
+    "Do NOT run build, compile, package-manager, solver, prover, network, or "
+    "test commands (circom, node, npm, snarkjs, git, curl, etc.). Read-only "
+    "file inspection commands such as cat, sed, rg, and wc are permitted only "
+    "for .circom files already present in the working directory and markdown "
+    "bundles under the delegated context directory. "
+    "Do NOT rebuild audit context; delegated agent bundles are already present. "
+    "Do NOT create or modify any files. "
+    "Your only permitted actions are reading .circom files already present in "
+    "the working directory and markdown bundles under the delegated context "
+    "directory. Audit only the constraint system. "
+    "Output your complete findings report to stdout following the report format "
+    "specified in the skill instructions above. Do NOT write any files."
+)
+
+
+class CircomAuditorCodex(CircomAuditorBase):
+    """ZK-Security circom-auditor via OpenAI Codex CLI.
+
+    Uses Codex native skills (`.agents/skills` / user skills / admin skills),
+    then invokes `codex exec` in a sandboxed scratch directory.
+    """
+
+    def __init__(self) -> None:
+        super().__init__("circom_auditor_codex")
+
+        if not self.check_binary_exists("codex"):
+            logging.error(
+                "circom_auditor_codex: `codex` not found on PATH. Install with "
+                "`npm install -g @openai/codex` and run `codex login` or set "
+                "CODEX_API_KEY."
+            )
+            sys.exit(1)
+
+        self.skill_dir = self._find_skill_dir()
+        if self.skill_dir is None:
+            logging.error(
+                "circom_auditor_codex: `%s` skill not found. Install it at "
+                "~/.agents/skills/%s, repo .agents/skills/%s, or set "
+                "CODEX_PLUGIN_DIR / CLAUDE_PLUGIN_DIR to a directory containing "
+                "skills/%s/SKILL.md.",
+                _SKILL_NAME,
+                _SKILL_NAME,
+                _SKILL_NAME,
+                _SKILL_NAME,
+            )
+            sys.exit(1)
+
+        if not os.environ.get("CODEX_API_KEY") and not os.environ.get(
+            "OPENAI_API_KEY"
+        ):
+            logging.info(
+                "circom_auditor_codex: no CODEX_API_KEY / OPENAI_API_KEY set; "
+                "assuming saved Codex CLI auth."
+            )
+
+    @staticmethod
+    def _as_skill_dir(path: Path) -> Path | None:
+        """Accept a skill dir, a skills parent, or a legacy plugin root."""
+        candidates = (
+            path,
+            path / _SKILL_NAME,
+            path / "skills" / _SKILL_NAME,
+            path / ".agents" / "skills" / _SKILL_NAME,
+        )
+        for candidate in candidates:
+            if (candidate / "SKILL.md").is_file():
+                return candidate.resolve()
+        return None
+
+    @classmethod
+    def _find_skill_dir(cls) -> Path | None:
+        candidates: list[Path] = []
+
+        explicit = os.environ.get("CIRCOM_AUDITOR_CODEX_SKILL_DIR")
+        if explicit:
+            candidates.append(Path(explicit).expanduser())
+
+        # Backwards compatibility with the Claude-style setup.
+        for env_name in ("CODEX_PLUGIN_DIR", "CLAUDE_PLUGIN_DIR"):
+            value = os.environ.get(env_name)
+            if value:
+                candidates.append(Path(value).expanduser())
+
+        cwd = Path.cwd().resolve()
+        for root in (cwd, *cwd.parents):
+            candidates.append(root / ".agents" / "skills")
+            if (root / ".git").exists():
+                break
+
+        home = Path.home()
+        candidates.append(home / ".agents" / "skills")
+        candidates.append(Path("/etc/codex/skills"))
+
+        seen: set[Path] = set()
+        for candidate in candidates:
+            skill_dir = cls._as_skill_dir(candidate)
+            if skill_dir is None or skill_dir in seen:
+                continue
+            seen.add(skill_dir)
+            return skill_dir
+        return None
+
+    def _materialize_skill(self, target_dir: Path) -> None:
+        """Make the selected skill visible to Codex from the scratch cwd."""
+        scratch_skill_dir = target_dir / ".agents" / "skills" / _SKILL_NAME
+        if scratch_skill_dir.exists():
+            return
+
+        scratch_skill_dir.parent.mkdir(parents=True, exist_ok=True)
+        try:
+            scratch_skill_dir.symlink_to(
+                self.skill_dir, target_is_directory=True
+            )
+        except OSError:
+            shutil.copytree(self.skill_dir, scratch_skill_dir, symlinks=True)
+
+    def _build_delegated_context(
+        self, target_dir: Path, target_file: Path
+    ) -> Path:
+        """Prebuild delegated agent bundles so Codex can run read-only."""
+        context_dir = target_dir / _CONTEXT_DIR_NAME
+        script = self.skill_dir / "scripts" / "build_audit_context.py"
+        if not script.is_file():
+            raise RuntimeError(f"delegated context builder not found: {script}")
+        cmd = [
+            sys.executable,
+            str(script),
+            "--repo",
+            str(target_dir),
+            "--skill-dir",
+            str(self.skill_dir),
+            "--out",
+            str(context_dir),
+            "--files",
+            target_file.name,
+        ]
+        logging.info(
+            "circom_auditor_codex: building delegated context with %s",
+            " ".join(cmd),
+        )
+        try:
+            subprocess.run(
+                cmd,
+                capture_output=True,
+                text=True,
+                check=True,
+                timeout=60,
+            )
+        except subprocess.TimeoutExpired as e:
+            stdout = e.stdout or ""
+            stderr = e.stderr or ""
+            raise RuntimeError(
+                "delegated context builder timed out\n"
+                f"stdout:\n{stdout}\nstderr:\n{stderr}"
+            )
+        except subprocess.CalledProcessError as e:
+            stdout = e.stdout or ""
+            stderr = e.stderr or ""
+            raise RuntimeError(
+                "delegated context builder failed\n"
+                f"stdout:\n{stdout}\nstderr:\n{stderr}"
+            )
+
+        missing = [
+            f"agent-{agent_id}-bundle.md"
+            for agent_id in range(1, 18)
+            if not (context_dir / f"agent-{agent_id}-bundle.md").is_file()
+        ]
+        if missing:
+            raise RuntimeError(
+                "delegated context missing expected bundle(s): "
+                + ", ".join(missing)
+            )
+        return context_dir
+
+    def _internal_execute(self, input_paths: Input, timeout: int) -> ToolOutput:
+        """Run `codex exec` on a sandboxed copy of the circuit dir.
+
+        The `$circom-auditor` skill should produce the same markdown report
+        format handled by the shared parser.
+        """
+        circuit_file_path = Path(input_paths.circuit_file)
+        target_dir, target_file, scope = self._prepare_scratch_dir(
+            input_paths, circuit_file_path
+        )
+        self._materialize_skill(target_dir)
+        try:
+            context_dir = self._build_delegated_context(target_dir, target_file)
+        except RuntimeError as e:
+            msg = f"stdout:\n\nstderr:\n{e}"
+            return ToolOutput(
+                status=OutputStatus.FAIL,
+                stdout="",
+                stderr=str(e),
+                return_code=1,
+                msg=msg,
+            )
+
+        prompt = (
+            f"Use the ${_SKILL_NAME} skill.\n\n"
+            "Run delegated parallel audit mode only. Spawn Codex subagents over "
+            f"the prebuilt bundles in `{context_dir.name}/`: "
+            "`agent-1-bundle.md` through `agent-17-bundle.md`. Use the Codex "
+            "orchestration reference, keep at most 6 agents running at once, "
+            "wait for all selected delegated workers, deduplicate their "
+            "FINDING/LEAD blocks, then validate and produce the final report.\n\n"
+            "Important Codex runtime constraints for this wrapper:\n"
+            "- A finished subagent still occupies runtime capacity until it is "
+            "closed. Before spawning a queued replacement, close the completed "
+            "agent, then spawn the next queued bundle.\n"
+            "- If a delegated worker lacks a native file-read tool, it may use "
+            "read-only shell inspection commands only to read its assigned "
+            f"`{context_dir.name}/agent-N-bundle.md` file and in-scope `.circom` "
+            "files. It must not run compilers, package managers, tests, "
+            "network commands, or any command that writes files.\n"
+            "- Do not stop merely because the worker needs a read-only shell "
+            "command to inspect its assigned bundle; that is permitted by this "
+            "zkhydra sandbox policy.\n\n"
+            "Do not run the local audit workflow and do not use local fallback. "
+            "If Codex subagents or delegated spawning are unavailable, stop and "
+            "return `## Delegated Audit Unavailable` with the concrete reason; "
+            "do not perform a single-agent/local audit.\n\n"
+            f"Audit target: `{target_file.name}` — {scope.summary_line()}\n\n"
+            f"Delegated context: `{context_dir.name}`.\n\n"
+            f"{_SANDBOX_NOTE}"
+        )
+
+        # `codex exec` runs non-interactively.
+        # --sandbox read-only: the auditor only needs to inspect the scratch dir.
+        # -C: set working directory so relative file reads resolve correctly.
+        # --skip-git-repo-check: scratch dirs are intentionally not git repos.
+        # --ephemeral: don't persist session state to disk.
+        cmd = [
+            "codex",
+            "exec",
+            "--enable",
+            "multi_agent",
+            "-c",
+            "agents.max_threads=6",
+            "-c",
+            "agents.max_depth=1",
+            "--sandbox",
+            "read-only",
+            "-C",
+            str(target_dir),
+            "--skip-git-repo-check",
+            "--ephemeral",
+        ]
+        model = os.environ.get("CODEX_MODEL")
+        if model:
+            cmd.extend(["-m", model])
+        cmd.append(prompt)
+
+        logging.info(
+            "circom_auditor_codex: launching codex in sandbox %s "
+            "(target=%s, skill=%s)",
+            target_dir,
+            target_file.name,
+            self.skill_dir,
+        )
+        return self.run_command(cmd, timeout, str(target_dir))
diff --git a/zkhydra/utils/tools_resolver.py b/zkhydra/utils/tools_resolver.py
index 9391825..a23b7c0 100644
--- a/zkhydra/utils/tools_resolver.py
+++ b/zkhydra/utils/tools_resolver.py
@@ -10,6 +10,8 @@
 from zkhydra.tools.base import AbstractTool
 
 # Import all tool instances
+from zkhydra.tools.circom_auditor_claude import CircomAuditorClaude
+from zkhydra.tools.circom_auditor_codex import CircomAuditorCodex
 from zkhydra.tools.circom_civer import CircomCiver
 from zkhydra.tools.circomspect import Circomspect
 from zkhydra.tools.conscs import ConsCS
@@ -28,7 +30,8 @@
     "zkfuzz": ZkFuzz,
     "picus": Picus,
     "ecneproject": EcneProject,
-    # Add other tools here as they are refactored
+    "circom_auditor_claude": CircomAuditorClaude,
+    "circom_auditor_codex": CircomAuditorCodex,
 }