diff --git a/skills/process-engine-pattern-author/SKILL.md b/skills/process-engine-pattern-author/SKILL.md index 4b0f0de..e2ebcfb 100644 --- a/skills/process-engine-pattern-author/SKILL.md +++ b/skills/process-engine-pattern-author/SKILL.md @@ -117,6 +117,66 @@ handed to review. separate manifest/artifact. Do not prescribe specific tools or mechanisms (shell, MCP, wrappers, reloads) — require coherence, not implementation doctrine. + + **Destination-skill preflight (generated Turnstone skills).** Once a + generated skill's canonical Agent Skills `name` is selected and the + intended destination is Turnstone, perform a destination-state preflight + **when an authoritative native read-only skill-catalog capability is + available in the active generator context** — do not run it before the + proposed identity exists, and do not make it another pipeline stage. + Record exactly one of: + - **PROVEN PRESENT** — authoritative Turnstone catalog evidence shows an + existing destination skill whose identity materially collides with the + proposed generated skill. Preserve the proposed canonical name, the + existing skill identity/name, returned object identity where available, + and the evidence source. + - **PROVEN ABSENT** — use only when the authoritative Turnstone lookup + semantics genuinely support proving absence for the queried skill + identity. A generic search returning zero results is NOT automatically + PROVEN ABSENT. + - **UNPROVEN** — generator lacks the authoritative read surface; the + lookup cannot establish absence; the result is ambiguous; returned + identity cannot be resolved confidently; or the lookup fails. Never + guess. + Do not invent a fuzzy-matching or normalization engine: use the generated + Agent Skills canonical `name`, authoritative Turnstone skill identity/name + fields, and native matching semantics where provided. When returned + evidence reveals casing/display-name/identity ambiguity, preserve it — do + not silently collapse distinct identities without evidence about their + object identities. Broader semantic overlap may be surfaced as a heads-up + when materially useful, but is NOT a mandatory catalog-wide ritual. + If PROVEN PRESENT, you may propose possible dispositions for later + operator consideration (rename the new skill; retain/coexist + intentionally; later supersede the old skill; revise/update where + supported). You must NOT choose one automatically, and must NOT create, + update, enable, disable, delete, or supersede anything. Destination-state + evidence informs the draft; it does not grant mutation authority. This + scope is generated **skills** only — do not extend to personas, projects, + policies, templates, or every Turnstone artifact without evidence. + + **Identity-bound evidence.** The recorded destination-skill evidence is + valid only for the **same canonical skill identity it queried**. Keep the + queried/proposed canonical Agent Skills `name`, returned destination + identity/object evidence where applicable, the PRESENT/ABSENT/UNPROVEN + state, and the evidence source together as one reviewable unit (no new + manifest or persisted schema). If a collision disposition changes the + generated skill's canonical `name` (e.g. `openclaw-management` → + `openclaw-remote-maintenance`), that is a **revision**, not merely a + future deployment instruction: update the draft identity, **re-run the + destination-skill preflight for the new canonical name**, record fresh + PRESENT/ABSENT/UNPROVEN evidence, and return to Review. The old receipt + must not carry forward as evidence for the new identity. No re-run is + required when the disposition leaves the generated canonical `name` + unchanged (intentional coexistence using the same proposed identity; + later operator-gated supersession of an existing skill; another + disposition that does not change the canonical name). + + **Point-in-time semantics.** PROVEN PRESENT / PROVEN ABSENT means proven + by the named authoritative catalog evidence **at the time of the + preflight**. It is destination-state evidence for author/review, not a + transactional guarantee that catalog state cannot change before Ship. + Do not create locks, reservations, state leases, transactional catalog + logic, or a new Ship preflight on this evidence. 8. **Assemble the package** — project/persona/skills/templates/governance as one bundle; skill folders mirror the spec layout (SKILL.md + references/ + optional scripts/ and assets/) when shipped as repo content. @@ -162,4 +222,5 @@ handed to review. - [ ] Governance artifacts: prompt policy + advisory judge rules (Turnstone-native) - [ ] Acceptance criteria written - [ ] Executable capability path identified where procedures depend on tools/capabilities; package declarations internally consistent with it (no prescribed tool/mechanism doctrine) +- [ ] Destination-skill preflight recorded for generated Turnstone skills when authoritative native catalog read is available (PROVEN PRESENT / PROVEN ABSENT / UNPROVEN); no mutation; no automatic disposition - [ ] Marked DRAFT, handed to review diff --git a/skills/process-engine-review/SKILL.md b/skills/process-engine-review/SKILL.md index d8d56d8..b569d3a 100644 --- a/skills/process-engine-review/SKILL.md +++ b/skills/process-engine-review/SKILL.md @@ -49,6 +49,38 @@ the gate. executable declaration in the package, REVISE. Review checks internal package coherence here; it does not prove runtime availability — that is Trial's job. + + **Destination-skill evidence (generated Turnstone skills)**: for each + generated Turnstone skill, check the recorded destination-state evidence + from Pattern: + - **PROVEN ABSENT** — collision dimension satisfied; do not manufacture a + collision concern. + - **PROVEN PRESENT** — require an explicit, reversible, operator-gated + disposition (e.g. intentional coexistence; create-new then + operator-approved disable-old; later operator-gated supersession; + another supported reversible plan that leaves the generated canonical + `name` unchanged). Review checks the plan; it does NOT execute it. + Silent overwrite / accidental duplicate assumptions → REVISE. + **Identity binding:** confirm the recorded destination-skill evidence + corresponds to the **current canonical `name` in the draft being + reviewed**. If the evidence belongs to a different skill identity + (stale receipt after a rename), REVISE — old evidence cannot satisfy + the collision check. A mere future "rename before deployment" plan is + NOT sufficient: if the disposition changes identity, the rename must + happen in Pattern first and the new identity must receive its own + preflight evidence before Review can evaluate it. If the draft has + already been renamed and a fresh receipt exists for that exact new + canonical name, evaluate the new PRESENT/ABSENT/UNPROVEN result + normally. + - **UNPROVEN** — for a generated Turnstone skill intended for deployment, + REVISE with the missing destination-state evidence identified. Do not + let UNPROVEN silently become PASS merely because Ship later has an + operator gate. + Point-in-time: PROVEN PRESENT/ABSENT reflects the named authoritative + catalog evidence at preflight time; it is not a transactional guarantee + that catalog state cannot change before Ship. + Review performs zero catalog mutation: no create, update, enable, disable, + delete, or supersede. Ship/operator authority remains unchanged. 3. **Safeguard review** (risk-relevant intents only): per-package safeguards present, evidence-named, sized to the domain — no preset doctrine (references/safety.md). @@ -109,6 +141,7 @@ the gate. - [ ] Native parse evidence recorded in Review (skill identity, parse invoked, result) - [ ] Allowed-field comparison performed against Agent Skills contract; no unexpected/non-spec frontmatter keys present (REVISE if present, regardless of parse result) - [ ] Capability-path consistency checked for procedures requiring tools/capabilities (REVISE if no executable declaration) +- [ ] Destination-skill evidence checked for generated Turnstone skills (bound to current canonical name in reviewed draft; PROVEN ABSENT ok; PROVEN PRESENT requires explicit reversible operator-gated disposition without identity change; stale/future-rename receipt or UNPROVEN → REVISE); zero catalog mutation - [ ] Safeguard review completed (risk-relevant intents only) - [ ] Coverage check completed against the catalog - [ ] Verdict recorded with evidence