Skills trial: 26 pinned skills, portable installer, status check and invoke-rate monitoring (all hosts)

adoption/templates/claude.settings.template.json

@@ -235,5 +235,33 @@
   "showThinkingSummaries": true,
   "cleanupPeriodDays": 3650,
   "autoContinueAtUsageLimit": true,
-  "switchModelsOnFlag": false
+  "switchModelsOnFlag": false,
+  "skillOverrides": {
+    "typesafe-ai": "name-only",
+    "gh-fix-ci": "on",
+    "security-best-practices": "on",
+    "iterative-retrieval": "name-only",
+    "search-first": "name-only",
+    "diagnosing-bugs": "on",
+    "tdd": "on",
+    "codebase-design": "on",
+    "resolving-merge-conflicts": "on",
+    "grill-me": "user-invocable-only",
+    "improve-codebase-architecture": "user-invocable-only",
+    "verification-before-completion": "on",
+    "security-threat-model": "on",
+    "gh-address-comments": "on",
+    "semgrep": "on",
+    "codeql": "on",
+    "supply-chain-risk-auditor": "on",
+    "agentic-actions-auditor": "on",
+    "property-based-testing": "on",
+    "modern-python": "on",
+    "sarif-parsing": "on",
+    "fp-check": "on",
+    "mcp-builder": "on",
+    "frontend-design": "on",
+    "agent-browser": "name-only",
+    "find-skills": "user-invocable-only"
+  }
 }

adoption/update.md

@@ -211,6 +211,29 @@ qmd --index native-agent-stack-catalog search "native worker" \
 
 Use `qmd get` on the exact returned document URI with a bounded range. [Native catalog setup](../catalogs/us-equities/native-workflows.md) records explicit collections; do not index the whole home or authentication directories. The frozen retrieval evaluation retains its original corpus and queries even when the live index grows. A generation-model upgrade does not automatically change embeddings or retrieval quality.
 
+## Apply the skills manifest
+
+On a host that has adopted [`adoption/skills/manifest.json`](skills/manifest.json) (added after
+`v2026.09.25.2`; see [the trial record](../docs/decisions/2026-09-25-skills-trial-and-usage.md)):
+
+```sh
+SKILLS=<tools-root>/skills-1.7.0/bin/skills
+npm install --global --prefix <tools-root>/skills-1.7.0 skills@1.7.0    # the manifest's cli.install (pinned, isolated)
+python3 tools/adoption/install_skills.py --skills-bin "$SKILLS" --dry-run   # prints what would change, changes nothing
+python3 tools/adoption/install_skills.py --skills-bin "$SKILLS"             # installs every manifest entry at its pinned ref
+python3 tools/adoption/install_skills.py --print-codex-config              # [[skills.config]] lines for ~/.codex/config.toml
+python3 scripts/skills_status.py --skills-bin "$SKILLS"                    # per-skill ref, lock, links, listing state, Codex config
+claude -p "/skill-doctor" --output-format json                             # native per-skill use count, 0 API tokens
+```
+
+Run the dry run first on a host that has never applied this manifest, and compare its printed
+changes against the manifest before running `--write`. The status script and `/skill-doctor` are
+both read-only and safe to re-run by hand on any schedule; neither installs, removes or updates
+anything, and `/skill-doctor` costs 0 API tokens (`num_turns` 0, model `<synthetic>`). Do not
+wrap either read-only command in a systemd/launchd timer: this project's `automatic_model_calls`
+policy is `false`, and a timer that invokes a model command is exactly what that policy
+excludes, whatever the command's own token cost.
+
 ## Current next moves
 
 The current entry point is the [20-layer research queue](../catalogs/landscape/research-state.json)

blueprints/native-skill-practice/README.md

@@ -9,19 +9,52 @@ review, installation, returned native results and remaining limits.
 
 ## Install only the selected skills
 
-Use the upstream `skills` installer for both clients; do not additionally install
-the TypeSafe marketplace plugin for the same skill:
+[`adoption/skills/manifest.json`](../../adoption/skills/manifest.json) is the single source of
+truth for which skills are installed, at which upstream revision, and at which listing state
+(`kept`/`trial`, `claude_listing`, `codex_enabled`); its
+[2026-09-25 trial record](../../docs/decisions/2026-09-25-skills-trial-and-usage.md) is the
+decision record. Two scripts read that manifest instead of a hand-run upstream installer:
+
+```sh
+SKILLS=<tools-root>/skills-1.7.0/bin/skills
+npm install --global --prefix <tools-root>/skills-1.7.0 skills@1.7.0    # the manifest's cli.install (pinned, isolated)
+python3 tools/adoption/install_skills.py --skills-bin "$SKILLS" --dry-run   # prints what would change, changes nothing
+python3 tools/adoption/install_skills.py --skills-bin "$SKILLS"             # installs every manifest entry at its pinned ref
+python3 tools/adoption/install_skills.py --print-codex-config              # [[skills.config]] lines for ~/.codex/config.toml
+python3 scripts/skills_status.py --skills-bin "$SKILLS"                    # per-skill ref, lock, links, listing state, Codex config
+claude -p "/skill-doctor" --output-format json                             # native per-skill use count, 0 API tokens
+```
+
+`install_skills.py` does not install the CLI itself: it requires the pinned `skills` CLI (the
+manifest's `cli.version`, installed into an isolated npm prefix by `cli.install`, never a global
+or bare `npx` install), refuses with that install command when `--skills-bin` is missing or
+reports another version, and runs every
+invocation with `DISABLE_TELEMETRY=1` so neither the telemetry event nor the add-time audit call
+fires. It installs each skill at the manifest's exact 40-hex `ref`, for both Claude and Codex in
+one command (`skills add <tree URL> --skill <name> -g -y -a claude-code codex`), and checks the
+manifest's `tree_sha`/`skill_md_sha256` against the installed copy rather than trusting the
+installer's own exit code. Do not additionally install the TypeSafe marketplace plugin for the
+same skill, and do not run the bare upstream `skills` CLI by hand against manifest entries: that
+installs outside the pinned prefix and without the telemetry guard. Preserve existing skills,
+native sign-in and configuration. The recorded source commits and file hashes in the manifest
+identify the reviewed versions; a later installer result requires a fresh source comparison.
+Installer risk badges (skills.sh's Gen Agent Trust Hub, Socket, Snyk) are not native acceptance
+or a security certification.
+
+### Historical: the pre-manifest three-skill install (superseded 2026-09-25)
+
+Before the manifest and its two scripts existed, the three then-selected skills were installed
+by hand with the bare upstream installer, with no pinned CLI version and no telemetry guard:
 
 ```sh
 npx skills add typesafe-ai/skills --skill typesafe-ai --agent codex claude-code --global
 npx skills add openai/skills --skill gh-fix-ci security-best-practices --agent codex claude-code --global
 ```
 
-For a project-owned copy, omit `--global` and use `--copy`. Preserve existing
-skills, native sign-in and configuration. The recorded source commits and file
-hashes in the manifest identify the reviewed versions; a later installer result
-requires a fresh source comparison. Installer risk badges are not native
-acceptance or a security certification.
+For a project-owned copy instead of a global one, that installer took `--copy` in place of
+`--global`. These three skills are unchanged `kept` winners in the current manifest, so a host
+that already ran these two commands does not need to re-run them; a new host uses
+`install_skills.py` instead, which also covers the manifest's other 23 skills.
 
 Use the [Claude role](../../examples/claude-native/agents/semantic-evidence-reviewer.md)
 or [Codex role](../../examples/codex-native/agents/semantic-evidence-reviewer.toml)