diff --git a/tests/tasks/uipath-maestro-flow/hitl/quality_01_schema_design.yaml b/tests/tasks/uipath-maestro-flow/hitl/quality_01_schema_design.yaml
index 16c9ea2bb9..cc864ecc99 100644
--- a/tests/tasks/uipath-maestro-flow/hitl/quality_01_schema_design.yaml
+++ b/tests/tasks/uipath-maestro-flow/hitl/quality_01_schema_design.yaml
@@ -55,6 +55,7 @@ success_criteria:
   - type: run_command
     description: "HITL node has input-direction fields (read-only context for reviewer)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name VendorPOReview '\"direction\": \"input\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -63,6 +64,7 @@ success_criteria:
   - type: run_command
     description: "HITL node has output-direction fields (reviewer fills in)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name VendorPOReview '\"direction\": \"output\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -71,6 +73,7 @@ success_criteria:
   - type: run_command
     description: "Flow has Approve and Reject outcomes"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name VendorPOReview 'Approve' 'Reject'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -79,6 +82,7 @@ success_criteria:
   - type: run_command
     description: "Priority is set to High"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name VendorPOReview '\"High\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
diff --git a/tests/tasks/uipath-maestro-flow/hitl/quality_02_result_downstream.yaml b/tests/tasks/uipath-maestro-flow/hitl/quality_02_result_downstream.yaml
index 8f239f5ce5..eab1b9ff24 100644
--- a/tests/tasks/uipath-maestro-flow/hitl/quality_02_result_downstream.yaml
+++ b/tests/tasks/uipath-maestro-flow/hitl/quality_02_result_downstream.yaml
@@ -59,6 +59,7 @@ success_criteria:
   - type: run_command
     description: "Flow contains inline HITL node"
     command: "python3 $REFERENCE_DIR/_shared/check_simulated_hitl.py quick-form"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -67,6 +68,7 @@ success_criteria:
   - type: run_command
     description: "Flow references the HITL output variable"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name ExpenseApproval '$vars.' '.output'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 3.0
@@ -75,6 +77,7 @@ success_criteria:
   - type: run_command
     description: "Flow has a boolean output field for approved"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name ExpenseApproval '\"boolean\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
diff --git a/tests/tasks/uipath-maestro-flow/hitl/quality_03_boolean_decision.yaml b/tests/tasks/uipath-maestro-flow/hitl/quality_03_boolean_decision.yaml
index 838569b104..d3342be249 100644
--- a/tests/tasks/uipath-maestro-flow/hitl/quality_03_boolean_decision.yaml
+++ b/tests/tasks/uipath-maestro-flow/hitl/quality_03_boolean_decision.yaml
@@ -62,6 +62,7 @@ success_criteria:
   - type: run_command
     description: "HITL node has a boolean output field"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name VendorApproval '\"boolean\"' '\"direction\": \"output\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -70,6 +71,7 @@ success_criteria:
   - type: run_command
     description: "Decision node condition references field-level HITL output"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name VendorApproval '$vars.' '.output.approved'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 3.0
@@ -78,6 +80,7 @@ success_criteria:
   - type: run_command
     description: "Both Decision branches wired (true and false handles)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name VendorApproval '\"true\"' '\"false\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
diff --git a/tests/tasks/uipath-maestro-flow/hitl/quality_04_brownfield_insert.yaml b/tests/tasks/uipath-maestro-flow/hitl/quality_04_brownfield_insert.yaml
index f01ffcd875..8770ba98fb 100644
--- a/tests/tasks/uipath-maestro-flow/hitl/quality_04_brownfield_insert.yaml
+++ b/tests/tasks/uipath-maestro-flow/hitl/quality_04_brownfield_insert.yaml
@@ -60,6 +60,7 @@ success_criteria:
   - type: run_command
     description: "Flow contains the original script node"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name ContractReview '\"extractMeta\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
@@ -68,6 +69,7 @@ success_criteria:
   - type: run_command
     description: "Flow contains the inserted HITL node"
     command: "python3 $REFERENCE_DIR/_shared/check_simulated_hitl.py quick-form"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.5
@@ -76,6 +78,7 @@ success_criteria:
   - type: run_command
     description: "Both HITL outcome ports (Approve and Reject) are wired, not the outcome-completed placeholder"
     command: "python3 $REFERENCE_DIR/_shared/check_simulated_hitl.py outcome-wiring"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -84,6 +87,7 @@ success_criteria:
   - type: run_command
     description: "HITL has a boolean output field for the approval decision"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name ContractReview '\"boolean\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
diff --git a/tests/tasks/uipath-maestro-flow/hitl/smoke_01_hitl_node_placed.yaml b/tests/tasks/uipath-maestro-flow/hitl/smoke_01_hitl_node_placed.yaml
index 0980a16751..dfa279c2e7 100644
--- a/tests/tasks/uipath-maestro-flow/hitl/smoke_01_hitl_node_placed.yaml
+++ b/tests/tasks/uipath-maestro-flow/hitl/smoke_01_hitl_node_placed.yaml
@@ -44,6 +44,7 @@ success_criteria:
   - type: run_command
     description: "Flow file was created"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -52,6 +53,7 @@ success_criteria:
   - type: run_command
     description: "Flow contains the inline HITL node type"
     command: "python3 $REFERENCE_DIR/_shared/check_simulated_hitl.py quick-form"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 3.0
diff --git a/tests/tasks/uipath-maestro-flow/hitl/smoke_02_completed_port_wired.yaml b/tests/tasks/uipath-maestro-flow/hitl/smoke_02_completed_port_wired.yaml
index bffa467801..5bbf67d0c3 100644
--- a/tests/tasks/uipath-maestro-flow/hitl/smoke_02_completed_port_wired.yaml
+++ b/tests/tasks/uipath-maestro-flow/hitl/smoke_02_completed_port_wired.yaml
@@ -53,6 +53,7 @@ success_criteria:
   - type: run_command
     description: "Flow file was created"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
@@ -61,6 +62,7 @@ success_criteria:
   - type: run_command
     description: "Every outcome on the HITL node has its own wired port — none on the outcome-completed placeholder"
     command: "python3 $REFERENCE_DIR/_shared/check_simulated_hitl.py outcome-wiring"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 3.0
diff --git a/tests/tasks/uipath-maestro-flow/hitl/smoke_03_multi_outcome_routing.yaml b/tests/tasks/uipath-maestro-flow/hitl/smoke_03_multi_outcome_routing.yaml
index 4b8c47cc5d..ecc4ab3da4 100644
--- a/tests/tasks/uipath-maestro-flow/hitl/smoke_03_multi_outcome_routing.yaml
+++ b/tests/tasks/uipath-maestro-flow/hitl/smoke_03_multi_outcome_routing.yaml
@@ -63,6 +63,7 @@ success_criteria:
   - type: run_command
     description: "Flow contains inline HITL node"
     command: "python3 $REFERENCE_DIR/_shared/check_simulated_hitl.py quick-form"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -71,6 +72,7 @@ success_criteria:
   - type: run_command
     description: "Flow contains a Decision node"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py '\"core.logic.decision\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -79,6 +81,7 @@ success_criteria:
   - type: run_command
     description: "Decision node references HITL output variable"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py '$vars.' '.output'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.5
@@ -87,6 +90,7 @@ success_criteria:
   - type: run_command
     description: "Both Decision branches are wired (true and false handles present)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py '\"true\"' '\"false\"'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
diff --git a/tests/tasks/uipath-maestro-flow/interactive/bellevue_weather_simulated/bellevue_weather_simulated.yaml b/tests/tasks/uipath-maestro-flow/interactive/bellevue_weather_simulated/bellevue_weather_simulated.yaml
index 3be690aebd..fc13e3a3a2 100644
--- a/tests/tasks/uipath-maestro-flow/interactive/bellevue_weather_simulated/bellevue_weather_simulated.yaml
+++ b/tests/tasks/uipath-maestro-flow/interactive/bellevue_weather_simulated/bellevue_weather_simulated.yaml
@@ -95,6 +95,7 @@ success_criteria:
   - type: run_command
     description: "Project/flow is named BellevueWeather (elicited from the user)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name BellevueWeather"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/interactive/cli_dice_roller_simulated/cli_dice_roller_simulated.yaml b/tests/tasks/uipath-maestro-flow/interactive/cli_dice_roller_simulated/cli_dice_roller_simulated.yaml
index a31273ec6e..cef76b184c 100644
--- a/tests/tasks/uipath-maestro-flow/interactive/cli_dice_roller_simulated/cli_dice_roller_simulated.yaml
+++ b/tests/tasks/uipath-maestro-flow/interactive/cli_dice_roller_simulated/cli_dice_roller_simulated.yaml
@@ -110,6 +110,7 @@ success_criteria:
   - type: run_command
     description: "Project/flow is named DiceRoller (elicited from the user)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name DiceRoller"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/interactive/customer_escalation_simulated/customer_escalation_simulated.yaml b/tests/tasks/uipath-maestro-flow/interactive/customer_escalation_simulated/customer_escalation_simulated.yaml
index 4cfba6b759..401178cf9c 100644
--- a/tests/tasks/uipath-maestro-flow/interactive/customer_escalation_simulated/customer_escalation_simulated.yaml
+++ b/tests/tasks/uipath-maestro-flow/interactive/customer_escalation_simulated/customer_escalation_simulated.yaml
@@ -95,6 +95,7 @@ success_criteria:
   - type: run_command
     description: "Flow performs the triage: trigger, urgency+VIP routing, Slack notify, email reply, ticket creation"
     command: "python3 $REFERENCE_DIR/_shared/check_escalation_behavior.py"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 10.0
@@ -108,6 +109,7 @@ success_criteria:
   - type: run_command
     description: "Project/flow is named CustomerEscalation (elicited from the user)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name CustomerEscalation"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/interactive/expense_approval_simulated/expense_approval_simulated.yaml b/tests/tasks/uipath-maestro-flow/interactive/expense_approval_simulated/expense_approval_simulated.yaml
index f32d6054fe..0008d66c70 100644
--- a/tests/tasks/uipath-maestro-flow/interactive/expense_approval_simulated/expense_approval_simulated.yaml
+++ b/tests/tasks/uipath-maestro-flow/interactive/expense_approval_simulated/expense_approval_simulated.yaml
@@ -93,6 +93,7 @@ success_criteria:
   - type: run_command
     description: "Flow has a correct inline HITL schema, decision capture, outcome-port wiring, and downstream .output access"
     command: "python3 $REFERENCE_DIR/_shared/check_simulated_hitl.py expense"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 6.0
@@ -106,6 +107,7 @@ success_criteria:
   - type: run_command
     description: "Project/flow is named ExpenseApproval (elicited from the user)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name ExpenseApproval"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/interactive/hitl_schema_design_simulated/hitl_schema_design_simulated.yaml b/tests/tasks/uipath-maestro-flow/interactive/hitl_schema_design_simulated/hitl_schema_design_simulated.yaml
index eccbc25892..a8086e5998 100644
--- a/tests/tasks/uipath-maestro-flow/interactive/hitl_schema_design_simulated/hitl_schema_design_simulated.yaml
+++ b/tests/tasks/uipath-maestro-flow/interactive/hitl_schema_design_simulated/hitl_schema_design_simulated.yaml
@@ -91,6 +91,7 @@ success_criteria:
   - type: run_command
     description: "HITL quickform has input + output fields and Approve/Reject outcomes"
     command: "python3 $REFERENCE_DIR/_shared/check_simulated_hitl.py schema"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 4.0
@@ -103,6 +104,7 @@ success_criteria:
   - type: run_command
     description: "HITL review priority is set to High (elicited from the user)"
     command: "python3 $REFERENCE_DIR/_shared/check_simulated_hitl.py priority"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.5
@@ -116,6 +118,7 @@ success_criteria:
   - type: run_command
     description: "Project/flow is named VendorPOReview (elicited from the user)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name VendorPOReview"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/interactive/ixp_invoice_extraction_simulated/ixp_invoice_extraction_simulated.yaml b/tests/tasks/uipath-maestro-flow/interactive/ixp_invoice_extraction_simulated/ixp_invoice_extraction_simulated.yaml
index 28417f69ca..b2743b1e34 100644
--- a/tests/tasks/uipath-maestro-flow/interactive/ixp_invoice_extraction_simulated/ixp_invoice_extraction_simulated.yaml
+++ b/tests/tasks/uipath-maestro-flow/interactive/ixp_invoice_extraction_simulated/ixp_invoice_extraction_simulated.yaml
@@ -94,6 +94,7 @@ success_criteria:
   - type: run_command
     description: "Flow has IxP extraction + SharePoint + HTTP nodes and a $vars downstream reference"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py '$vars.' --regex '(?i)(uipath\\.ixp|core\\.logic\\.mock)' --regex '(?i)sharepoint' --regex '(?i)\"type\"\\s*:\\s*\"[^\"]*http'"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 6.0
@@ -107,6 +108,7 @@ success_criteria:
   - type: run_command
     description: "Project/flow is named InvoiceProcessing (elicited from the user)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name InvoiceProcessing"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/interactive/slack_channel_description_simulated/slack_channel_description_simulated.yaml b/tests/tasks/uipath-maestro-flow/interactive/slack_channel_description_simulated/slack_channel_description_simulated.yaml
index bfffd79a23..e016e94549 100644
--- a/tests/tasks/uipath-maestro-flow/interactive/slack_channel_description_simulated/slack_channel_description_simulated.yaml
+++ b/tests/tasks/uipath-maestro-flow/interactive/slack_channel_description_simulated/slack_channel_description_simulated.yaml
@@ -126,6 +126,7 @@ success_criteria:
   - type: run_command
     description: "Flow targets the #office-bellevue channel (elicited from the user)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --regex '(?i)(office-bellevue|conversationsInfoId[^A-Za-z0-9]+C[A-Z0-9]{6,})'"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 3.0
@@ -139,6 +140,7 @@ success_criteria:
   - type: run_command
     description: "Project/flow is named SlackChannelDescription (elicited from the user)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name SlackChannelDescription"
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/interactive/solution_select.yaml b/tests/tasks/uipath-maestro-flow/interactive/solution_select.yaml
index 2a76a2cb10..859fb5bdf8 100644
--- a/tests/tasks/uipath-maestro-flow/interactive/solution_select.yaml
+++ b/tests/tasks/uipath-maestro-flow/interactive/solution_select.yaml
@@ -78,6 +78,7 @@ success_criteria:
   - type: run_command
     description: "Flow file created inside the user-selected solution"
     command: "python3 $REFERENCE_DIR/interactive/check_solution_select.py flow"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -87,6 +88,7 @@ success_criteria:
   - type: run_command
     description: "Agent did not init the Flow project inside a pre-existing solution"
     command: "python3 $REFERENCE_DIR/interactive/check_solution_select.py existing-untouched"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
@@ -124,6 +126,7 @@ success_criteria:
   - type: run_command
     description: "Selected solution contains an initialized Flow project"
     command: "python3 $REFERENCE_DIR/interactive/check_solution_select.py project"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.0
@@ -133,6 +136,7 @@ success_criteria:
   - type: run_command
     description: "Agent created the selected solution artifact"
     command: "python3 $REFERENCE_DIR/interactive/check_solution_select.py solution"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.0
@@ -141,6 +145,7 @@ success_criteria:
   - type: run_command
     description: "Advisory: no default WeatherAlert solution before the name was given — records the default-then-repair inefficiency; nondeterministic on simulator name-timing, so non-gating"
     command: "python3 $REFERENCE_DIR/interactive/check_solution_select.py no-extra-solution"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/ixp/e2e_01_invoice_extraction_greenfield.yaml b/tests/tasks/uipath-maestro-flow/ixp/e2e_01_invoice_extraction_greenfield.yaml
index aed4e6d897..d73ea0a4ef 100644
--- a/tests/tasks/uipath-maestro-flow/ixp/e2e_01_invoice_extraction_greenfield.yaml
+++ b/tests/tasks/uipath-maestro-flow/ixp/e2e_01_invoice_extraction_greenfield.yaml
@@ -53,6 +53,7 @@ success_criteria:
   - type: run_command
     description: Generated flow contains an IxP extraction node or core.logic.mock fallback
     command: grep -rqE "\"type\"[[:space:]]*:[[:space:]]*\"(uipath\.ixp|core\.logic\.mock)" --include="*.flow" .
+    read_only: true
     expected_exit_code: 0
     weight: 2.0
     pass_threshold: 1.0
@@ -61,18 +62,21 @@ success_criteria:
   - type: run_command
     description: Generated flow contains a SharePoint trigger or connector node
     command: grep -rqiE "sharepoint" --include="*.flow" .
+    read_only: true
     expected_exit_code: 0
     weight: 2.0
     pass_threshold: 1.0
   - type: run_command
     description: Generated flow contains an HTTP action node (core.action.http)
     command: grep -rqE "core\.action\.http|\"type\"[[:space:]]*:[[:space:]]*\"[^\"]*http[^\"]*\"" --include="*.flow" .
+    read_only: true
     expected_exit_code: 0
     weight: 2.0
     pass_threshold: 1.0
   - type: run_command
     description: Generated flow references the IxP extraction output via $vars (downstream consumption)
     command: grep -rqF '$vars.' --include="*.flow" .
+    read_only: true
     expected_exit_code: 0
     weight: 1.5
     pass_threshold: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/ixp/e2e_02_project_selection.yaml b/tests/tasks/uipath-maestro-flow/ixp/e2e_02_project_selection.yaml
index 6e86658646..77e8b04330 100644
--- a/tests/tasks/uipath-maestro-flow/ixp/e2e_02_project_selection.yaml
+++ b/tests/tasks/uipath-maestro-flow/ixp/e2e_02_project_selection.yaml
@@ -93,6 +93,7 @@ success_criteria:
   - type: run_command
     description: "Generated flow contains a real uipath.ixp.* node"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --regex '\"type\"\\s*:\\s*\"uipath\\.ixp\\.'"
+    read_only: true
     expected_exit_code: 0
     weight: 3.0
     pass_threshold: 1.0
@@ -100,6 +101,7 @@ success_criteria:
   - type: run_command
     description: "Generated flow does NOT contain a core.logic.mock fallback"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --absent-regex '\"type\"\\s*:\\s*\"core\\.logic\\.mock\"'"
+    read_only: true
     expected_exit_code: 0
     weight: 2.0
     pass_threshold: 1.0
@@ -113,6 +115,7 @@ success_criteria:
   - type: run_command
     description: "IxP node references the exact published model for this row's domain (strict)"
     command: "python3 $REFERENCE_DIR/ixp/check_project_selection.py"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 5.0
diff --git a/tests/tasks/uipath-maestro-flow/ixp/integration_handle_routing.yaml b/tests/tasks/uipath-maestro-flow/ixp/integration_handle_routing.yaml
index 6ff7381e77..47200cea0e 100644
--- a/tests/tasks/uipath-maestro-flow/ixp/integration_handle_routing.yaml
+++ b/tests/tasks/uipath-maestro-flow/ixp/integration_handle_routing.yaml
@@ -83,6 +83,7 @@ success_criteria:
   - type: run_command
     description: "Generated flow contains an IxP extraction node or core.logic.mock fallback"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --regex '\"type\"\\s*:\\s*\"(uipath\\.ixp|core\\.logic\\.mock)'"
+    read_only: true
     expected_exit_code: 0
     weight: 2.0
     pass_threshold: 1.0
@@ -92,6 +93,7 @@ success_criteria:
   - type: run_command
     description: "Flow contains a Decision node (core.logic.decision)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py 'core.logic.decision'"
+    read_only: true
     expected_exit_code: 0
     weight: 2.0
     pass_threshold: 1.0
@@ -99,6 +101,7 @@ success_criteria:
   - type: run_command
     description: "Decision condition references the canonical IxP output path ($vars.<ixp>.output.ExtractionResult.ResultsDocument.Fields)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py '$vars.' 'ExtractionResult' 'ResultsDocument' 'Fields'"
+    read_only: true
     expected_exit_code: 0
     weight: 3.0
     pass_threshold: 1.0
@@ -106,6 +109,7 @@ success_criteria:
   - type: run_command
     description: "Both branch script nodes are present by name"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py 'HighValueReview' 'AutoApprove'"
+    read_only: true
     expected_exit_code: 0
     weight: 2.5
     pass_threshold: 1.0
@@ -113,6 +117,7 @@ success_criteria:
   - type: run_command
     description: "Both Decision branches wired (true and false handles)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py '\"true\"' '\"false\"'"
+    read_only: true
     expected_exit_code: 0
     weight: 2.0
     pass_threshold: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/ixp/routing.yaml b/tests/tasks/uipath-maestro-flow/ixp/routing.yaml
index 0f5030da83..311427c028 100644
--- a/tests/tasks/uipath-maestro-flow/ixp/routing.yaml
+++ b/tests/tasks/uipath-maestro-flow/ixp/routing.yaml
@@ -105,6 +105,7 @@ success_criteria:
   - type: run_command
     description: "Agent added an IxP or core.logic.mock placeholder node to a .flow file (per references/plugins/ixp/impl.md)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --regex '\"type\"\\s*:\\s*\"(uipath\\.ixp|core\\.logic\\.mock)'"
+    read_only: true
     expected_exit_code: 0
     suite_thresholds: {mean: 0.85}
 
diff --git a/tests/tasks/uipath-maestro-flow/ixp/scaffold_minimal.yaml b/tests/tasks/uipath-maestro-flow/ixp/scaffold_minimal.yaml
index 694d23148b..ee6000b5f2 100644
--- a/tests/tasks/uipath-maestro-flow/ixp/scaffold_minimal.yaml
+++ b/tests/tasks/uipath-maestro-flow/ixp/scaffold_minimal.yaml
@@ -80,6 +80,7 @@ success_criteria:
   - type: run_command
     description: "Generated flow contains an IxP extraction node or core.logic.mock fallback (per references/plugins/ixp/impl.md)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --regex '\"type\"\\s*:\\s*\"(uipath\\.ixp|core\\.logic\\.mock)'"
+    read_only: true
     expected_exit_code: 0
     weight: 2.0
     pass_threshold: 1.0
@@ -89,6 +90,7 @@ success_criteria:
   - type: run_command
     description: "Script node consumes the extraction output via $vars expression"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py '$vars.'"
+    read_only: true
     expected_exit_code: 0
     weight: 1.5
     pass_threshold: 1.0
diff --git a/tests/tasks/uipath-maestro-flow/ixp/scaffold_multinode.yaml b/tests/tasks/uipath-maestro-flow/ixp/scaffold_multinode.yaml
index 5213c520df..b08533fa95 100644
--- a/tests/tasks/uipath-maestro-flow/ixp/scaffold_multinode.yaml
+++ b/tests/tasks/uipath-maestro-flow/ixp/scaffold_multinode.yaml
@@ -84,6 +84,7 @@ success_criteria:
   - type: run_command
     description: "Generated flow contains an IxP extraction node or core.logic.mock fallback (per references/plugins/ixp/impl.md)"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --regex '\"type\"\\s*:\\s*\"(uipath\\.ixp|core\\.logic\\.mock)'"
+    read_only: true
     expected_exit_code: 0
     weight: 2.0
     pass_threshold: 1.0
@@ -91,6 +92,7 @@ success_criteria:
   - type: run_command
     description: "All three script nodes are present by name"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name ReceiptIntake 'postReceipt' 'sendToValidation' 'logError'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.5
@@ -99,6 +101,7 @@ success_criteria:
   - type: run_command
     description: "Scripts reference the extraction output via $vars expression"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name ReceiptIntake '$vars.'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
diff --git a/tests/tasks/uipath-maestro-flow/smoke/init_maestro_automate.yaml b/tests/tasks/uipath-maestro-flow/smoke/init_maestro_automate.yaml
index 0660dec09d..46f9c5abf4 100644
--- a/tests/tasks/uipath-maestro-flow/smoke/init_maestro_automate.yaml
+++ b/tests/tasks/uipath-maestro-flow/smoke/init_maestro_automate.yaml
@@ -46,6 +46,7 @@ success_criteria:
     command: >
       python3 $REFERENCE_DIR/_shared/project_profile.py --flow-name InvoiceIntake
       --expect-profile Lite --expect-sentinel
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 5.0
@@ -56,6 +57,7 @@ success_criteria:
   - type: run_command
     description: "Flow file was created in a supported authoring layout"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name InvoiceIntake"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
diff --git a/tests/tasks/uipath-maestro-flow/smoke/init_plain_flow_default.yaml b/tests/tasks/uipath-maestro-flow/smoke/init_plain_flow_default.yaml
index 9994e817c9..f312d8074a 100644
--- a/tests/tasks/uipath-maestro-flow/smoke/init_plain_flow_default.yaml
+++ b/tests/tasks/uipath-maestro-flow/smoke/init_plain_flow_default.yaml
@@ -41,6 +41,7 @@ success_criteria:
     command: >
       python3 $REFERENCE_DIR/_shared/project_profile.py --flow-name ShipmentTracker
       --expect-profile Standard --expect-no-sentinel
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 5.0
@@ -49,6 +50,7 @@ success_criteria:
   - type: run_command
     description: "Flow file was created in a supported authoring layout"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name ShipmentTracker"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
diff --git a/tests/tasks/uipath-maestro-flow/smoke/init_validate.yaml b/tests/tasks/uipath-maestro-flow/smoke/init_validate.yaml
index fa1f91fa18..d7ce41e6c1 100644
--- a/tests/tasks/uipath-maestro-flow/smoke/init_validate.yaml
+++ b/tests/tasks/uipath-maestro-flow/smoke/init_validate.yaml
@@ -40,6 +40,7 @@ success_criteria:
   - type: run_command
     description: "Initialized flow has the default manual trigger"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name WeatherAlert 'core.trigger.manual'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
@@ -71,6 +72,7 @@ success_criteria:
   - type: run_command
     description: "Flow file was created in a supported authoring layout"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name WeatherAlert"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
diff --git a/tests/tasks/uipath-maestro-flow/smoke/inline_agent_robust.yaml b/tests/tasks/uipath-maestro-flow/smoke/inline_agent_robust.yaml
index 11825532fa..653dbb3641 100644
--- a/tests/tasks/uipath-maestro-flow/smoke/inline_agent_robust.yaml
+++ b/tests/tasks/uipath-maestro-flow/smoke/inline_agent_robust.yaml
@@ -45,6 +45,7 @@ success_criteria:
   - type: run_command
     description: "Inline agent sidecar was created"
     command: 'python3 "$REFERENCE_DIR/_shared/check_inline_agent.py" --check exists "**/agent.json"'
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.5
@@ -53,6 +54,7 @@ success_criteria:
   - type: run_command
     description: "Inline agent uses an explicitly selected current model"
     command: 'python3 "$REFERENCE_DIR/_shared/check_inline_agent.py" --check model "**/agent.json"'
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 1.0
@@ -61,6 +63,7 @@ success_criteria:
   - type: run_command
     description: "Flow file was created in a supported authoring layout"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name EmailTriage"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 1.5
@@ -69,6 +72,7 @@ success_criteria:
   - type: run_command
     description: "Flow contains the inline agent node type"
     command: "python3 $REFERENCE_DIR/_shared/flow_contains.py --flow-name EmailTriage 'uipath.agent.autonomous'"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 2.0
@@ -83,6 +87,7 @@ success_criteria:
   - type: run_command
     description: "Inline agent.json: model overridden, real system prompt, typed outputSchema"
     command: 'python3 "$REFERENCE_DIR/_shared/check_inline_agent.py" "**/agent.json"'
+    read_only: true
     timeout: 15
     expected_exit_code: 0
     weight: 3.0
diff --git a/tests/tasks/uipath-maestro-flow/smoke/merge_parallel_sync.yaml b/tests/tasks/uipath-maestro-flow/smoke/merge_parallel_sync.yaml
index 4ba868fe82..e2555cf3c1 100644
--- a/tests/tasks/uipath-maestro-flow/smoke/merge_parallel_sync.yaml
+++ b/tests/tasks/uipath-maestro-flow/smoke/merge_parallel_sync.yaml
@@ -76,6 +76,7 @@ success_criteria:
   - type: run_command
     description: "Exactly one core.logic.merge with >=2 distinct branches converging, a fork upstream, and a downstream continuation"
     command: "python3 $REFERENCE_DIR/smoke/check_merge_parallel_sync_flow.py"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 5.0
diff --git a/tests/tasks/uipath-maestro-flow/smoke/scheduled_trigger.yaml b/tests/tasks/uipath-maestro-flow/smoke/scheduled_trigger.yaml
index e1d8e43b8e..4c7375addd 100644
--- a/tests/tasks/uipath-maestro-flow/smoke/scheduled_trigger.yaml
+++ b/tests/tasks/uipath-maestro-flow/smoke/scheduled_trigger.yaml
@@ -64,6 +64,7 @@ success_criteria:
   - type: run_command
     description: "Start node is core.trigger.scheduled, manual trigger removed, valid timeCycle schedule + bpmn:TimerEventDefinition"
     command: "python3 $REFERENCE_DIR/smoke/check_scheduled_trigger_flow.py"
+    read_only: true
     timeout: 30
     expected_exit_code: 0
     weight: 5.0