Record skill provenance and native catalog limits

[seathatflowsinourveins]

Scope

Record installed skill identities through the existing lifecycle and report retained native catalog evidence separately from metadata. This draft adds the already installed vendor-generated hf-cli, preserves the 10,500-character repository policy cap, and adds an amendment superseding the original cap-retirement proposal without rewriting that dated record.

• Base commit: d9eb68750311d5f888adec140723da174f9fe10c.
• Lane: lane:foundation.
• Owned paths: adoption/skills/, the Codex template's explanatory comment, tools/adoption/install_skills.py, scripts/skills_status.py, their tests, linked decision records and the existing recording receipt. manifests/evidence.json is rebuilt natively from that exact base and committed last.
• Draft only. No host installation, retirement, client settings or hooks are applied. CC review/ACK and host application remain separate.

SOTA sources

• Vercel Skills CLI v1.7.0 at 7407f389: src/skill-lock.ts:168–171, src/local-lock.ts, src/remove.ts:209,293–340. Reconciliation and removal compose the maintained lifecycle; the supported upstream installer remains the writer.
• Hugging Face Hub v2.1.1 generator at bd4a7603: :65–94; native skills commands: :308,323–327,363–366,442–470. The generated file and mirror retain distinct provenance; no invented Git tree for generated bytes.
• Codex renderer at a956835d: :19–29,126–160; native SkillsListResponse. Catalog upper bounds and absent warning/implicit-policy fields stay explicitly limited.
• Claude settings reference: skillListingBudgetFraction, skillListingMaxDescChars; installed native listing evidence and truncation remain distinct from repository arithmetic.
• Repository cap source: native-agent-stack@0d5e6506434fab598dee861c749a22e628beb75a:adoption/skills/manifest.json:676–679, preserved by the owner's A18 ruling. Registry procedure: native-agent-stack@d9eb68750311d5f888adec140723da174f9fe10c:docs/lanes.md:94.

Evidence-class table

Claim	Evidence class	Command / receipt
Identity reconciliation, retained removal limits and metadata-only coverage	local_integration / synthetic	Existing evidence/artifacts/skills-recording-live-catalog-20261006/local-checks.json; prior failures preserved
Fresh focused contracts after rebase and cap restoration	local_integration	Three test modules: 198 tests, exit 0, 19.885s; no skips reported
Final source hashes, references and scope	source_review / structural validation	scripts/validate.py, exit 0: 69 components, 10,384 hashed files, four profiles, 223 receipts
HF native generator/version observations	native_proven, historical retained scope only	Original dated recording decision and receipt; no fresh generator or install in this amendment
Repository totals remain within 10,500	source_review / structural validation	Manifest 10,492; cap contract; no fresh-client visibility or invocation claim
MinerU/research future combined total exceeds that cap	source_review, pending proposal scenario	New amendment's frozen draft count sources; those skills are not activated here
Fresh catalog/first-prompt discovery and final host acceptance	pending	Not established by this PR's local checks

Local commands run

nice -n 19 ionice -c3 python3 -B -m unittest tests.test_install_skills tests.test_skills_manifest tests.test_skills_status
exit 0; Ran 198 tests in 19.885s; OK

nice -n 19 ionice -c3 python3 -B scripts/component_matrix.py --write
exit 0; 32 rows; zero flip-rule violations

nice -n 19 ionice -c3 python3 -B scripts/new_host_grand_list.py --write
exit 0; 32 layers; 66 winners

nice -n 19 ionice -c3 python3 -B scripts/validate.py
exit 0; 69 components; 10384 hashed files; 4 profiles; 223 receipts

Actual shell commands carry the installed rtk prefix. The final returned validation log SHA256 is f3d49f91010012ca7187d86ac04dc57b898614bf588370d5e7911047b80108c7. Private outputs retain exact native results. Rebase stopped only on the evidence registry (exit 1); taking the frozen base and native registrations resolved it, and the intermediate validation also passed. No hand-merged registry or other-owner source conflict.

Decision record

docs/decisions/2026-10-06-skill-recording-and-live-catalog-budgets.md remains byte-identical to the earlier published draft. Its cap-retirement proposal is superseded by docs/decisions/2026-10-06-skill-recording-cap-amendment.md; the current lifecycle guide links the amendment. Native catalogs and the repository policy ceiling both remain relevant, with different claim boundaries.

Host evidence

No host receipt or platform-status change. No new native client/model session, host install, removal or configuration apply in this amendment.

Checklist

• Existing native installers and upstream source identities retained.
• Historical decision and receipt bytes preserved; supersession uses a new record.
• No secrets or client authentication stores read, copied or committed.
• No new paid surface or subscription.
• Peer-owned paths and worktrees preserved.
• Required validation and touched checks passed; registry last.
• CC cross-family read/ACK and any later host actions remain pending; PR stays draft.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[seathatflowsinourveins]

Folded into #795 by the PR triage of 2026-10-07 (the command center's ruling, item review-ns2604-coop-20261007T023012Z, section 3). Closed with a record, not merged. The co-op verified the fold at #795's head f809570: 4/12 of this PR's files are byte-identical there, and the shared files (the skills manifest, the Codex template, the lifecycle recipe, the tests and the registry) are merged; the cross-family read of #795 at that head (cc-reads-20261005/pr795/GPT-VERDICT-f809570b2.md, fold-completeness table) found every omitted incoming line superseded correctly or its content retained, with the registry rebuilt and matching. #795's description names this fold and its overlap record is evidence/artifacts/skills-folds-20261007/overlaps.md (a dated correction of two of its descriptions is pending in #795). This branch codex/ns2604-skills-r2-lifecycle-20261006 stays on origin at ae17e43. Reopen trigger: none, because its content lives in #795.