diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..f9c7a05
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,9 @@
+[submodule "external/rl-rewardhacking"]
+	path = external/rl-rewardhacking
+	url = https://github.com/ariahw/rl-rewardhacking.git
+[submodule "docs/vendor/lora-lite"]
+	path = docs/vendor/lora-lite
+	url = https://github.com/wassname/lora-lite.git
+[submodule "docs/vendor/simple_GRPO"]
+	path = docs/vendor/simple_GRPO
+	url = https://github.com/lsdefine/simple_GRPO.git
diff --git a/docs/handover.md b/docs/handover.md
index 8ccd4b6..5e00a9b 100644
--- a/docs/handover.md
+++ b/docs/handover.md
@@ -114,13 +114,19 @@ Assuming the box has uv + nvidia drivers + python 3.13:
 git clone <repo> projected_grpo && cd projected_grpo
 uv sync
 
-# 2. warm HF cache (avoids re-download on first pueue job)
+# 2. clone the external data repo (NOT a submodule; `sync-external` only
+#    `git pull`s an existing clone). train.py loads the leetcode jsonl from
+#    external/rl-rewardhacking/results/data/ — vanilla training crashes with
+#    FileNotFoundError without this. The jsonl ships in the repo (~30 MB).
+git clone --depth 1 https://github.com/ariahw/rl-rewardhacking.git external/rl-rewardhacking
+
+# 3. warm HF cache (avoids re-download on first pueue job)
 just download-model
 
-# 3. start pueue daemon if not running
+# 4. start pueue daemon if not running
 pueued -d 2>/dev/null || true
 
-# 4. single-seed gate (~6-9h on a 96GB Blackwell-class card)
+# 5. single-seed gate (~6-9h on a 96GB Blackwell-class card)
 pueue add --immediate --follow -w "$PWD" -o 9 \
   -l "why: gated full probe; resolve: extract+heldout pass, vanilla hacks, projected fires" \
   -- just probe-full-seed 41
@@ -132,7 +138,10 @@ pueue add --immediate --follow -w "$PWD" -o 9 \
 2. `pueue status` — confirm idle.
 3. `uv sync` — flash-attn wheel needs to install; mjun0812 prebuild covers
    sm_120 (Blackwell).
-4. `ls out/` — empty / nonexistent; probe creates everything from scratch.
+4. `ls external/rl-rewardhacking/results/data/` — must contain
+   `leetcode_train_medhard_filtered.jsonl`. If empty, the external repo was
+   never cloned (step 2 above). This is the #1 fresh-box gotcha.
+5. `ls out/` — empty / nonexistent; probe creates everything from scratch.
 
 ## Gates to check during the probe