A specialty Shipped
The unit the whole pipeline is built around: a Worker Focus that says what to hunt for, and Verify criteria that say what a complete pass over that ground looks like.
A specialty is two paragraphs and a job description. Worker Focus tells a reviewer what to hunt for; Verify criteria tell a second, independent actor what a complete pass over that ground would have covered. Splitting the two is what makes verification possible at all — without the second half, a verifier can only re-litigate whether a finding is correct, which is a different and much weaker question.
Shared, not owned
A specialty is a pool entry, not a possession. security/cors is declared by three different specialists on devteam, and they get the same lens text — because the question "did you check CORS" does not change depending on who is asking it.