Consolidate skills lifecycle, routing and SDK 0.160.1 qualification

[seathatflowsinourveins]

Scope

Consolidate the skills lifecycle and round-two routing work into this draft. The central lifecycle gains native-stack-research and the vendor-generated hf-cli record; workers inherit central held/pruned decisions and explicitly exclude unsupported generated payloads. The routing manifest, renderer/validator, preload variants, foundation path rule, recorder and routing-hook sources preserve unresolved delivery gates. The worker keeps its exact SDK/runtime guard while qualifying 0.160.1.

• Base commit: d9eb68750311d5f888adec140723da174f9fe10c.
• Lane: lane:foundation.
• Owned paths: skills/workflow lifecycle recipes, manifests and templates; role variants and foundation rules; maintained worker example and dependency locks; scoped validators/tests; source-reviewed landscape publication and sanitized evidence.
• Folds: Fix skills lifecycle gates and retain skills qualification evidence #719, Record skill provenance and native catalog limits #792, Record skill-state transitions with safe descriptors and profile views #793, Prepare held skill routing with native filters and frozen B13 gates #794 and Reconcile held skill inventory and plan native discovery #817. Their branches are retained. The co-op verifies byte comparisons before closing the originals.
• Host settings, hook registration, role grants, installation and retirement remain command-center actions. S3 and S9 are PR-only; S9's upstream A/B-before-live hold remains.
• The five Gate A role bodies and historical observations remain unchanged. Current carriers and generator inputs are corrected; dated decided text receives only appended amendments.

Landing path

Co-op delta GPT read of the frozen consolidated head, followed by command-center Claude adjudication and ACK, then 5f's assigned foundation queue and landing cue. This is the command-center-approved retained PR under FOLDS-RULED review023012Z. The command center and 5f assign its queue position; this lane never merges or closes the originals. No DIRTY-only rebase or new draft.

SOTA sources

• Claude native subagents, skill preloads and role grants, plus path-specific rules. Existing acceptance source: native-agent-stack@ecfa1127:tests/test_install_claude_profile.py:1289-1346. Held grants remain plan inputs.
• Codex skill host roots at rust-v0.160.1 and native skills documentation. Routing references reuse existing stores; they do not duplicate pins.
• OpenAI Codex SDK rust-v0.160.1 and published openai-codex 0.160.1. Unchanged installed-SDK smoke follows the vendor's pinned .github/workflows/sdk.yml; the worker's exact initialize guard remains.
• Vercel Skills CLI v1.7.0, supported source-store lifecycle behavior. Inactive rows do not authorize installation.
• Hugging Face's native skills generator, the hf-cli generator pin. Its central generated recipe is not a Git tree or a supported worker-project install.
• Anthropic skill-creator at 8a1541c4 and promptfoo 0.123.1 eval skill: maintained comparison paths, with no new runner. The current acceptance amendment makes S1 assertions non-gating and forbids running them as a row-closing campaign; S9's separate before-live gate remains.
• Organic v1.1 grader at 536487a4, with the six unchanged source hashes recorded in the census receipt. Native child attribution and partial observations stay separate.
• PyYAML 6.0.3 wheel metadata: nine verified wheel hashes in one lock, retaining main's three Linux hashes in order and adding the reviewed Mac hashes.
• Native landscape publication, source review and ledger procedures: native-agent-stack@d9eb68750311d5f888adec140723da174f9fe10c:tools/sota-convergence/landscape-sweep/README.md; hot-file registration: docs/lanes.md at the frozen base.

Fold comparisons and overlaps

Frozen source comparisons are comparison.json; exact unions are overlaps.md. Non-hot source files are #719 193/203, #792 4/11, #793 7/7, #794 20/22 and #817 3/5 identical; no original file is missing. Registry and ledger are rebuilt natively rather than merged.

Overlaps preserve the research and HF objects; the existing Claude template guards and research override; Codex eligibility prose with lifecycle/research identities and operations retained in the manifest and installer; central held-state inheritance with record/retire; all correction rows plus the three lifecycle rows; the catalog's new tasks/sources with held browser state; the validation requirements lock, the routing fixture's dependency-free manifest exemption and both coverage test hunks. Current catalog/schema tests align the approved 17-task input. All 134 selected worker rows remain; HF has a source-bound unsupported-installer exclusion. Pending reasons now distinguish present central stores from missing Tier B recording and native consumers, without activating routes. The SDK upgrade is a separately qualified overlay.

Fold statement

At f809570b2175908e14ab6b88e5dbe394eab220bb, the absent original added lines are accounted for below. No skill/source entry, historical observation or incoming registry registration was dropped. Literal line retention differs from JSON value equality; obsolete totals and assertions are explicitly superseded.

• adoption/templates/codex.config.template.toml: superseded prose — Fix skills lifecycle gates and retain skills qualification evidence #719's four lines (25 catalog-visible, 9,318 characters and budget charging) and Record skill provenance and native catalog limits #792's three lines (25 eligible from 26) become lines 37–42: 26 catalog-eligible from 27, held-browser/Claude-only-Creator qualifications, and explicit fresh-visibility uncertainty. UTF-8 names/descriptions/paths/newline charging remains ceil(bytes / 4); max_context_tokens = 6000 is unchanged. A12's Claude skillListingBudgetFraction: 0.05 property lives in claude.settings.template.json:399, and its directive sentence remains in the manifest's client_budgets; neither was dropped or moved into Codex configuration.
• tests/test_skills_status.py: superseded fixture expectation/prose — Fix skills lifecycle gates and retain skills qualification evidence #719's 9,318-character comment is replaced by the metadata-versus-measurement comment at line 1314; the expected 25 entries becomes 26 at line 1318 for the HF/research union, including held-browser metadata. Native budget/within-budget remain None when absent (lines 1317/1321); no fake 6,000-token host observation replaces them.
• catalogs/landscape/skills-lifecycle.json: formatting only, not supersession or content loss — the requested locator adoption/skills/skills-lifecycle.json is absent; this is the actual catalog. Fix skills lifecycle gates and retain skills qualification evidence #719's four absent literal lines are multiline expansions of the identical native-agent-stack source object (line 100), installed research array (194), eight source IDs (199) and research-gap string (209). Reconcile held skill inventory and plan native discovery #817's absent literal line is the identical held-browser gap string expanded at line 469. Each corresponding parsed JSON value equals its frozen source; the 1/5 and 3/4 literal-line counts reflect formatting.
• adoption/skills/manifest.json: formatting plus superseded derived totals/prose — the complete native-stack-research and hf-cli objects equal their frozen Fix skills lifecycle gates and retain skills qualification evidence #719/Record skill provenance and native catalog limits #792 JSON entries. Record skill provenance and native catalog limits #792's four absent compact pin_policy/install/update/preview lines are expanded JSON with identical values. Fix skills lifecycle gates and retain skills qualification evidence #719's sums 9,637/9,318/9,318 and Record skill provenance and native catalog limits #792's 10,492/10,173/10,173 are superseded by the union's 10,645/10,326/10,326. Fix skills lifecycle gates and retain skills qualification evidence #719's older client_budgets sentence is retained with corrected 26-entry eligibility prose and the dated A26 amendment. Both policy mirrors become 10,645 by A26; native 0.05/6,000 settings and pinned descriptions remain unchanged.
• adoption/skills/lifecycle.md: superseded current policy pointer — Record skill provenance and native catalog limits #792's two absent lines naming 10,500 and the October 6 cap amendment become 10,645 and the October 7 bounded amendment at lines 298–299. The metadata-versus-fresh-visibility limit remains at line 300; older decided text is untouched.
• tests/test_skills_manifest.py: superseded assertions — Record skill provenance and native catalog limits #792's trial-cap prohibition is replaced by review-window checks plus equality of the legacy trial mirror and canonical ceiling (lines 60–65). Its A18/10,500-only expectation is superseded by the cited A26 assertions for exact 10,645/10,326 and the retained ceiling comparison (190–195). The template check likewise says catalog-eligible and asserts fresh visibility is not claimed; these are deliberate invariant updates, not lost checks.
• manifests/evidence.json: superseded generated hashes/byte counts — the main registry was taken and this lane's files re-registered through native host_receipts.register_file. All 204/11/7/22/5 incoming registrations from Fix skills lifecycle gates and retain skills qualification evidence #719/Record skill provenance and native catalog limits #792/Record skill-state transitions with safe descriptors and profile views #793/Prepare held skill routing with native filters and frozen B13 gates #794/Reconcile held skill inventory and plan native discovery #817 respectively are present; 10/7/0/2/2 require fresh hashes/bytes for merged files. Every registered hash matches the retained file. This accounts for the 955/975, 17/31, 100/104 and 21/25 literal-line retention counts; no receipt or convergence-record addition was dropped, and the registry was not hand-merged.

Evidence-class table

Claim	Evidence class	Command / receipt
SDK 0.160.1 installed through pinned supported locks; exact initialize guard	native_proven, scoped installed runtime	qualification and 25-name folded read-back, exit 0; no inference
Unchanged vendor SDK test, using its localhost MockResponsesServer	synthetic, unchanged upstream test	pinned installed_sdk_smoke.py, exit 0; no external provider inference
Local SDK and cross-layer lifecycle/routing checks	local_integration	31 SDK fixtures; repaired combined check: 550 tests, 3 skips, exit 0
Folded pending-route correction	local_integration	32 workflow tests, exit 0; routes remain inert
Source reviews and stopped landscape returns	source_review	retained original, FU1 and FU2 artifacts; degraded/missing votes and source stops disclosed
BEFORE organic attribution	native observations, incomplete	fixed 2 GiB source-budget stop, exit 2; denominators UNKNOWN, gap counts and partial successful calls separate
Dependency locks and hashes	source_review, local_integration	nine vendor wheel hashes; native Linux binary-only hash-locked dry-run exit 0; no Mac execution claim
Manifest/registry consistency	structural validation	validate.py exit 0; native registry registration and ledger check, not provider acceptance

Local commands run

PYTHONDONTWRITEBYTECODE=1 nice -n 19 ionice -c3 python3 -B -m unittest tests.test_runtime_worker_openhands tests.test_runtime_worker_openhands_resolver tests.test_runtime_worker_skills tests.test_landscape_sweep_skills tests.test_osv_lockfile_coverage tests.test_skill_routing_hook tests.test_skill_state_recorder tests.test_workflow_manifest
exit 0; 550 tests; 48.675 s; 3 skips

PYTHONDONTWRITEBYTECODE=1 nice -n 19 ionice -c3 python3 -B -m unittest tests.test_workflow_manifest
exit 0; 32 tests; 0.055 s

PYTHONDONTWRITEBYTECODE=1 nice -n 19 ionice -c3 python3 -B -m unittest tests.test_install_skills tests.test_skills_status tests.test_skills_manifest
exit 0; 200 tests; 20.612 s

PYTHONDONTWRITEBYTECODE=1 nice -n 19 ionice -c3 python3 -B -m unittest tests.test_install_claude_profile tests.test_render_config
exit 0; 151 tests; 2.702 s; 1 skip

PYTHONDONTWRITEBYTECODE=1 nice -n 19 ionice -c3 python3 -B scripts/validate.py
exit 0; integrity/scope checks only

PYTHONDONTWRITEBYTECODE=1 nice -n 19 ionice -c3 python3 -B scripts/saturation_ledger.py --check --base d9eb68750311d5f888adec140723da174f9fe10c
exit 0; 8 records, bindings verified

PYTHONDONTWRITEBYTECODE=1 nice -n 19 ionice -c3 python3 -B scripts/host_receipts.py validate
exit 0; 183 host receipts

Initial combined failures, the unsuccessful first worker repair, the three pre-amendment budget-test failures and the missing-SDK default-Python inspect attempt remain recorded separately. The inspect repair used the already-qualified isolated interpreter without a global install or source change. A smoke is a smoke; catalog availability is not rendered description visibility, organic use or provider acceptance.

Decision record

The dated S1 decision remains unchanged. Its new acceptance amendment is the current carrier: upstream choice, lifecycle install, one real-use smoke per consuming client and native organic counters. BEFORE stays UNKNOWN with three historical-binding gaps and the fixed source-budget stop; no retrospective inference or larger-budget rerun. AFTER is pending command-center deployment and seven days of native measurement, with forward definition/carrier/lifecycle hashes captured through existing hooks.

The October 7 amendment records A26's exact metadata ceiling of 10,645 for the ruled union. Both existing policy mirrors carry it, and tests bind Claude 10,645 and Codex 10,326 so further unreviewed growth fails. The native 0.05 fraction and 6,000-token setting and every pinned description stay unchanged. Approximately 40,000 listing characters is the older decision's inference, not a fresh visibility measurement; the separate 15,000 proposal is still unapproved.

J795 review corrections

At 37d60bc205e3485c6fbdbac6808633a2634cdd3d, P2 and P3 are fixed in one subsequent repair push, with the registry committed last.

• P2: Dated provenance addendum names operator-private relative locators and verified SHA256 values. The original 23-name baseline is skills-r2-private/sdk-01601-qualification-20261007/native-01601-readback.jsonl, digest b4ea1b8b55fc28792b1dd043ff0f449c1449edf159a272601923270f29259fb1; the final 25-name folded observation is skills-r2-private/sdk-01601-qualification-20261007/final-native-01601-readback.jsonl, digest 561d9ef562b4308dc097cb386508afc8afe407184df6b0ae7b6e75267588fa4c. Their public observations and private raw bytes remain unchanged; raw contents are not published.
• P3: Appended dated correction supersedes the two inaccurate merge descriptions. The Codex template contains eligibility prose, delegates manifest-specific configuration to the native installer and keeps its 6,000-token budget; it gains no lifecycle/research per-skill tables. OSV retains the validation requirements lock and the routing fixture's dependency-free manifest exemption. The old record bytes are an exact prefix; observed values are unchanged.
• Native registration and PYTHONDONTWRITEBYTECODE=1 nice -n 19 ionice -c3 python3 -B scripts/validate.py exited 0 (69 components, 10,643 hashed files, 4 profiles, 223 receipts). A bounded read-only review confirms the locators/digests and unchanged observation bytes. No source behavior changed and no model/test campaign or host action was repeated. Remote required CI remains pending the single landing-turn rebase; local validation is its own evidence class.

Host evidence

No platform-status change, client registration, host configuration or service start. Native observations retain their exact operation/input/runtime scopes; local fixtures are not upstream or ecosystem acceptance.

Checklist

• Supported native formats, source stores and upstream harnesses reused.
• Historical observations and decided text preserved.
• Credentials and active client configuration absent from public evidence.
• No new paid service; peer-owned paths preserved.
• A26 resolved; required focused checks pass; registry/checksums committed last.
• One consolidated push; final source comparison and SDK qualification retained.
• Co-op delta read and command-center ACK; draft remains until their direction.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.