Skills: every model-invocable skill listed on and Codex-enabled, six re-pins, one retirement, the skill lifecycle guide and MCP_TIMEOUT parity (unit F3)

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: Every model-invocable skill is listed on for Claude and enabled for Codex; six pins are refreshed and resolving-merge-conflicts is retired after upstream removed it. adoption/skills/lifecycle.md becomes the single skill lifecycle document, and the Claude template sets MCP_TIMEOUT to 120000 to match the Codex lane's MCP startup allowance.
• Base commit: 11227bfdf25b55b0481a9e78985c3fed26052472
• Lane: lane:foundation
• Owned paths touched: adoption/skills/{manifest.json,lifecycle.md}; adoption/templates/claude.settings.template.json (skillOverrides, skillListingBudgetFraction, env MCP_TIMEOUT); adoption/templates/codex.config.template.toml ([skills]); adoption/bootstrap.md (one step-4 line); blueprints/runtime-workers/skills/{manifest.json,README.md,research.md}; docs/decisions/{2026-09-25-skills-trial-and-usage.md (addendum), 2026-09-30-skills-llm-native-listing.md, 2026-09-30-native-skill-lifecycle.md}; evidence/artifacts/{native-skill-lifecycle-20260930,native-skill-finalization-20260930}/; tests/{test_skills_manifest,test_runtime_worker_skills,test_install_claude_profile,test_skill_usage}.py; manifests/evidence.json (final commit only).
• Frozen surfaces touched (Gate A): adoption/skills/manifest.json and adoption/templates/claude.settings.template.json (the freeze is lifted for unit F3 only; this PR merges in the Gate A batch after U6 with the owner's go, and applies nothing to any host); adoption/templates/codex.config.template.toml [skills] (B1 input); manifests/evidence.json under the docs/lanes.md hot-file protocol (last commit only).
• grants: none
• Attribution: the source-review fold contains pre-existing uncommitted changes observed in the main checkout; original author not established (snapshot r2, tracked.diff sha256 314bd1b260da09396a0c9cbb708c81b1b280d3cab74d3206ff1a5a09ef3427fe), kept as docs/decisions/2026-09-30-native-skill-lifecycle.md.
• Merge order: no later than unit F1 (its AGENTS.md line cites adoption/skills/lifecycle.md).

SOTA sources

• Claude Code docs, read 2026-09-30: skills https://code.claude.com/docs/en/skills (fetched markdown sha256 adc20053…; L290-294 watcher, /reload-skills, /reload-plugins; L372 1,536-char cap; L1124-1130 1% budget, least-invoked dropped first, --debug warning, skillListingBudgetFraction); env vars https://code.claude.com/docs/en/env-vars (a908ea67…; L470 MCP_TIMEOUT "MCP server startup (default: 30000)"; L486 SLASH_COMMAND_TOOL_CHAR_BUDGET 1% with an 8,000-char fallback); MCP https://code.claude.com/docs/en/mcp (86b6d45a…; L403-404 the per-server timeout covers tool execution only); settings reference (skillOverrides, skillListingBudgetFraction). claude mcp add --help on 2.1.285 lists no timeout option.
• Codex: https://developers.openai.com/codex/skills (d1579156…; L129 and L172-173 automatic detection with restart fallback, L180-185 [[skills.config]], L215 allow_implicit_invocation); openai/codex rust-v0.159.2 (ff6aec96948b70d94983af2641a6b67c94faeff5): codex-rs/ext/skills/src/render.rs L19-27, L126-152, L241-266; codex-rs/core/config.schema.json L4122-4127; codex-rs/models-manager/models.json (gpt-6-astra and gpt-6.1-sol context_window 272000); skills_config.rs, provider/host.rs and skills/src/lib.rs byte-identical to rust-v0.157.1 (36650394c5b38c2990ccf2a3457165ca3e9d9726).
• Skills CLI: vercel-labs/skills v1.7.0 7407f3893ad4dceab546ac002c3ef806e4000c73 (newest tag; npm latest 1.7.0): src/cli.ts L394-401 (check/update/upgrade call runUpdate), src/list.ts L60-62, src/remove.ts L409-411, skills/find-skills/SKILL.md L35-103.
• Skill sources, each verified from a blobless clone: affaan-m/ECC c70874fae9eb0e5ad0365beb7e2955899fd1d30f skills/search-first and 2b6e839771e53096d8451a213d40dc64ec8acac0 skills/iterative-retrieval; mattpocock/skills d81f3a183412e71a5b1e84ca21bc1a35eea03a60 (diagnosing-bugs, tdd, codebase-design, improve-codebase-architecture; .changeset/remove-resolving-merge-conflicts.md; removal commit daa01d8) and c55ee46073ed923f86ce59a5eb3b6d895095d1b7 (grill-me, writing-for-agents, the retired skill's historical pin); trailofbits/skills 82fe8226252622fa807643bdca1710901198553a plugins/static-analysis/skills/semgrep (commit 82fe822) and 0cc1c73a5e96749ab32d7ea5e14892fafa6972ae (eight others); anthropics/skills 8a1541c4a3ffa5a20a5a91de0dcf3f0bab1d1ef4 skills/skill-creator and 33375500bcea98d610eb30ce10ac4e59b89c390d (mcp-builder, frontend-design); openai/skills 49f948faa9258a0c61caceaf225e179651397431; typesafe-ai/skills 65a39f393687675ce170e6094757de20370365b9; vercel-labs/agent-browser d01253d9db28d75080e36da3c1c31ef89454731e; cloudflare/security-audit-skill c1c8a8c1471069fb0e188eeaff69b8e8db6564a8.
• Evaluation method cited in the lifecycle guide: https://developers.openai.com/blog/eval-skills; https://developers.openai.com/blog/rethinking-skills-and-prompts-for-gpt-6-astra.

Evidence-class table

Claim	Evidence class	Command / receipt
All 28 pins match their upstream tree, SKILL.md sha256 and bytes, description length and invocation flag; each ref is on its default branch; each path is unchanged at HEAD	source_review	blobless clones plus a scratchpad pin checker (28 PASS, 0 failures)
resolving-merge-conflicts removed upstream (daa01d8), absent at d81f3a18	source_review	git rev-parse and git log in the mattpocock/skills clone; changeset text
Listing states, budget sums, template mirror, retired "off", runtime-worker reuse and counts	local_integration	tests.test_skills_manifest, tests.test_runtime_worker_skills, tests.test_skills_status (failed first where new)
MCP_TIMEOUT "120000" in the template env	local_integration	McpStartupTimeoutTemplateTests (failed first: None != '120000')
Claude MCP_TIMEOUT semantics; no per-server startup knob	source_review	env-vars and mcp docs; claude mcp add --help (2.1.285)
Lifecycle guide commands and flags exist	source_review	install_skills.py and skills_status.py --help; Skills CLI v1.7.0 source
RenderTextAndCli no longer depends on the caller's XDG_STATE_HOME	local_integration	tests.test_skill_usage under a scratch XDG_STATE_HOME: 2 failures before, OK after
Codex lane's native activation runs and lifecycle receipt	native_proven as recorded by the attributed receipts; not re-run in this PR	evidence/artifacts/native-skill-finalization-20260930/results.json, native-skill-lifecycle-20260930/receipt.json
Listing overflow and invocation on any host	not claimed (host run pending)	measurement plan in the skills-trial addendum
Cross-family review (GPT-6 through the OmniRoute gateway, read-only)	review	verdict line posted as a PR comment when it completes

Description-character sums (declared equals computed): 28 skills, 26 on, 2 user-invocable-only (grill-me, improve-codebase-architecture: upstream disable-model-invocation, replacement pending the skills sweep and paired benchmark), 27 Codex-enabled; Claude on-listed sum 10,191 of the 10,500 cap; Codex-enabled sum 10,048, of which 9,872 reach Codex's automatic catalog. Listing fraction: at about 4 characters per token, 0.01 of a 200k window (8,000 chars) overflows the 10,191 listing, 0.05 (40,000 chars) holds it about four times over; Codex's default 2% of the 272,000-token window is 5,440 tokens and the template sets 6,000 (the 25 automatically shown skills render to about 2,976 tokens).

Local commands run

$ python3 -m unittest tests.test_skills_manifest tests.test_runtime_worker_skills tests.test_skills_status tests.test_landscape_sweep_harness tests.test_skill_usage tests.test_adoption_docs_consistency tests.test_install_claude_profile
exit 0; Ran 529 tests; OK (skipped=18, all environmental: PyYAML, tree-sitter parser, bash 3.2, shellcheck, context-mode security.js, one release-note profile)
$ python3 scripts/validate.py
exit 0; {"components": 69, "hashed_files": 8530, "profiles": 4, "receipts": 176, "status": "passed"}
$ python3 -m unittest tests.test_osv_lockfile_coverage.LockfileInventoryTests.test_every_tracked_lockfile_and_manifest_is_listed tests.test_blind_checkout.RepositoryClassificationTests.test_every_blueprint_value_under_a_label_key_is_classified tests.test_workflow_security_coverage.NewWorkflowSecurityCoverageTests.test_all_published_workflows_are_listed_and_covered
exit 0; Ran 3 tests; OK
$ python3 scripts/validate_convergence.py --all-recorded --root . --json
exit 0; valid, 25 records
$ python3 -m unittest tests.test_install_skills
exit 0; Ran 65 tests; OK
$ python3 scripts/build_ecosystem.py --check && python3 scripts/landscape.py --root . && python3 scripts/validate_catalogs.py
exit 0 each
$ python3 scripts/validate.py --scan-file <each of the 28 changed files>
exit 0; {"scanned_files": 28, "status": "passed"}; host user name 0 hits; personal paths 0 hits

Decision record

docs/decisions/2026-09-30-skills-llm-native-listing.md (alternatives, overturn conditions, sources); the 2026-09-30 addendum in docs/decisions/2026-09-25-skills-trial-and-usage.md; the attributed docs/decisions/2026-09-30-native-skill-lifecycle.md.

Host evidence

Not applicable: no files under evidence/hosts/ change. Nothing was installed or applied on a host; the host-batch steps (install the re-pins and skill-creator, remove resolving-merge-conflicts, apply the settings, render the Codex config, run the listing measure-then-lower plan) are in the addendum and belong to B1 after the Gate A owner's go.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no workflow changes).
• New/changed workflows declare top-level permissions: contents: read (no workflow changes).
• No secrets are printed, logged or committed; no new required secret was added.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (the main checkout was only read, via the r2 snapshot).

🤖 Generated with Claude Code

[seathatflowsinourveins]

Cross-family review (GPT-6 through the OmniRoute gateway, read-only, max effort) of 589c227a: verdict: needs_changes. Coordinator adjudication: (1) accepted, medium: the name-keyed [[skills.config]] rule emitted for the disabled Anthropic skill-creator also disables Codex's bundled .system/skill-creator (Codex's matcher applies a name rule to every skill of that name; SkillConfig has path), so the emitter moves to path-keyed exclusions and the status check accepts them, with regression coverage keeping the bundled skill; (2) rejected: MCP_TIMEOUT, the bootstrap.md line and the installer test are in scope by the coordinator's delta brief and the Gate A owner's explicit acceptance (recorded in the unit brief's amendments); (3) accepted, low: the reporter still treats the 8,000-character fallback as the active Codex cap (codex_within_cap: false against a configured 6,000-token budget); the manifest gains the configured budget and the reporter compares the rendered catalog in tokens; (4) accepted in part, low: the provenance line keeps the neutral wording the Codex runtime lane asked for, with one sentence explaining why the fold briefs' earlier attribution (a process census of file writes) does not establish authorship; (5) accepted, low: the Codex template comment's skill count is synchronised with the listing record. A repair round follows on this PR before the Gate A batch.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Rebased onto origin/main 8fc8611 (after #546) with the hot-file protocol: main's manifests/evidence.json taken and this unit's files re-registered in the last commit; python3 scripts/validate.py passed; new head 657ff9df, tree otherwise unchanged.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Review repair, round 2 (GPT-6 cross-family review of 589c227). Branch rebuilt on origin/main 1f2cdce; head d6041854. manifests/evidence.json changes only in the last commit.

M1 fixed: install_skills.py --print-codex-config now disables by path, never by name. A name rule applies to every loaded skill of that name (openai/codex rust-v0.159.2 codex-rs/config/src/skills_config.rs L109-119), so name = "skill-creator" also hid Codex's bundled .system/skill-creator. Each table now names the installed <home>/.agents/skills/<name>/SKILL.md: Codex matches that against each skill's canonical path_to_skills_md (ext/skills/src/host_service.rs L366-371, host_outcome.rs L52-54) and loads user skills from $HOME/.agents/skills (host_roots.rs L103-108); skills@7407f389 installs a global Codex skill only there (src/installer.ts L392-402), and the Codex skills page shows the same form. Note: the path is the SKILL.md file under $HOME/.agents/skills, not a folder under the Codex home as the review wording suggested; a folder path matches nothing. scripts/skills_status.py accepts the path form (resolving ~, a path relative to the config folder, and symlinks as Codex does) and fails a name-keyed table for any name Codex's bundled skills use (imagegen, openai-docs, review-agent, skill-creator, skill-installer) as name_entry_hides_bundled_skill. The project-scoped runtime manifest now prints only with --project-dir.

L1 fixed: budget.codex_default_budget_chars is now codex_fallback_budget_chars (metadata only). codex_configured_budget_tokens = 6000 is tied by a test to the template's [skills] max_context_tokens. codex_catalog_description_chars = 9,872 counts the 25 skills Codex shows; upstream_allow_implicit_invocation: false marks the two it keeps to an explicit $name. The reporter estimates the shown catalog the way render.rs charges it (each line plus newline at ceil(bytes/4); L154-160, L25, L258-267) and reports that estimate beside the configured budget: about 2,990 tokens against 6,000.

L3 fixed: the template comment says 25 catalog-visible skills, about 11,900 bytes, about 2,990 tokens, and five .system skills at rust-v0.159.2; a test ties the count to the manifest.

L2 fixed: all three records use "pre-existing uncommitted changes observed in the main checkout; original author not established" with the snapshot hash, plus one sentence that the earlier attribution rested on a process census of file writes, which does not establish authorship, and that the lane concerned asked for the neutral wording.

M2: no change, per the coordinator's adjudication (MCP_TIMEOUT is in scope and accepted).

Also: a Codex path containing a NUL no longer crashes the status check; the lifecycle guide and the host steps say to restart Codex after changing config.toml (Codex skills page L188).

Evidence (our integration checks, not upstream tests or a Codex run): python3 -m unittest tests.test_skills_manifest tests.test_runtime_worker_skills tests.test_skills_status tests.test_install_skills tests.test_skill_usage tests.test_adoption_docs_consistency tests.test_install_claude_profile 487 OK (15 env skips; 468 before the repair); install_skills.py --print-codex-config with an example home prints the path-keyed skill-creator table; validate.py passed (8558 files, 177 receipts); the three registry tests OK; privacy scan of the 7,449 added lines 0. Every new test failed first against the pre-repair code and data (installer 9/14, reporter 13 failures + 4 errors, manifest 2 + 2, template count 26 != 27). Residuals: the reporter checks rule presence, not rule order or full schema validity; the bundled-name list is the rust-v0.159.2 set; the token estimate counts description characters as bytes and excludes bundled and plugin skills; no native Codex run.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Review repair, round 3 (the Gate A owner's review of d604185, ACCEPT WITH CHANGES). Branch rebased onto origin/main 29458b4 without conflicts; head 1b95c047. manifests/evidence.json changes only in the last commit.

1. #381 interaction recorded. The listing record's Scope has a "#381 interaction" paragraph, with counts read from the #381 preregistration (thresholds, arm_b_opportunity_counts, each task's family/arms/lane_tags) and the two manifests:

• Codex arms B and A go from 11 to 25 visible skills; 14 are new, including agent-browser, semgrep, codeql, security-audit and find-skills. Arm N runs with --ignore-user-config and, by the Gate A owner's count, already saw 26.
• A call diverted to a newly visible skill could miss M4 (at least 90% routed fetches; 5 of the fetch lane's 10 arm-B opportunities are seed-codex-web-table-1..5) or M8 (at least 80% correct lane use per required lane; 2 of symbol-references' 9 and 1 of ai-memory's 7 are Codex tasks). The B-versus-A gates cannot see it, because A changes the same way.
• The applied settings are frozen values too (claude.settings.user.sha256; permissions_deny_count goes from 88 to 130).
• Decision point 9 states the Gate A owner's decision as theirs: Amendment 4 names the catalog as part of the measured practice, no threshold is loosened, and diverted calls are reported and never reclassified.

2. No ad hoc installs from a session. The settings template now denies every Skills CLI command that writes installed skills (skills@7407f389 src/cli.ts L336-402: add, a, i, install, remove, rm, r, check, update, upgrade, experimental_*).

• The rules cover four forms: a bare skills, npx [flags] skills, npx [flags] skills@<version> and a path ending in bin/skills (the pinned <tools-root>/skills-1.7.0/bin/skills). That is 41 Bash(...) rules, plus Edit(~/.agents/**).
• The rules follow https://code.claude.com/docs/en/permissions: "Wildcard patterns", "Compound commands", "Wrappers" (npx is not stripped; a deny rule matches past a leading assignment) and "What a Bash rule doesn't match".
• find, list, init, use and --version stay allowed. install_skills.py's own add and rollback remove run as subprocesses, which the rules do not see.
• The rule set goes beyond add/remove to cover their aliases and check/update/upgrade: find-skills L29 advertises npx skills update, and at v1.7.0 check runs the same update code.
• test_a_session_cannot_install_or_remove_skills_through_the_skills_cli checks the rules exist, that blocked samples match (find-skills' own npx skills add <owner/repo@skill> -g -y, versioned npx, the pinned path, DISABLE_TELEMETRY=1 skills remove …, a compound command), and that allowed samples (skills find, list, the installer, a commit message, a grep) do not. It failed first against the previous template: 71 failures (42 rules, 29 samples).
• lifecycle.md records the rule: a session never installs a skill ad hoc; it records the candidate and the coordinator pins it. Removal now runs from a shell outside a session.

3. MCP_TIMEOUT decision record. docs/decisions/2026-09-30-mcp-startup-timeout.md records:

• the alternatives: Claude Code's 30 s default (env-vars L470); no per-server startup option (claude mcp add --help on 2.1.286 lists none, as on 2.1.285); MCP_CONNECT_TIMEOUT_MS and CLAUDE_CODE_MCP_STARTUP_WAIT_MS bound different waits;
• the cost: a -p run with --mcp-config waits up to MCP_TIMEOUT for pending servers (headless L240);
• the overturn conditions: a measured start-up distribution under 30 s for every stack server on the reference host, or an upstream per-server option.

4. Fraction plan. Step 3 now reads: not inside #381 window W; a change after the Amendment 4 seal re-seals.

5. lifecycle.md. The absent finalization record's citation now points at evidence/artifacts/native-skill-finalization-20260930/README.md, and says the record lands with unit F1. Step 1 lists the model-invocable skills within the listing budgets: the two upstream user-only skills are not listed, and an overflowing listing loses descriptions.

6. Pin verification retained. evidence/artifacts/skills-pin-verification-20260930/pin-verification.json keeps the checker's 28 rows (codebase-design, improve-codebase-architecture, semgrep and skill-creator included) from the 18:02Z run, with the method and the manifest blob. A 22:53Z recheck after a fresh fetch, with every remote HEAD confirmed by git ls-remote, returned byte-identical output.

Also: a test fixture path /home/example/… became /srv/example-home/… so the privacy pattern stays clean.

Evidence (our integration checks, not upstream tests or a client run): the unittest set passed 490 (15 skipped); validate.py passed (8604 files, 177 receipts); the three registry tests passed; the F-tier invariant check passed 18 of 18; the privacy scan found 0 matches in 7,610 added lines.

Residuals:

• The rules match command text: "$SKILLS_BIN" add, sh -c, other runners and file copies are not matched.
• Context Mode (6f0cc684) applies the same rules server-side, but without bare-command matching or leading-assignment stripping.
• npx skills@… find is blocked when the query contains a writer word.
• No Claude Code run exercised the rules.
• Applying the template changes frozen PR-H: E2E preregistration for the token-save-practice stack (frozen tasks, metrics, gate, procedure) #381 values (permissions_deny_count 88 → 130, claude.settings.user.sha256): it lands before the seal or the seal is re-taken (the Gate A owner's call).

🤖 Generated with Claude Code