Improve Alden original-file search, reading and knowledge graphs; adopt alden-cli

.agents/skills/verify-alden-graph-scope/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: verify-alden-graph-scope
+description: Check bounded actual-code graph scope and lifecycle schedules, with isolated broken variants, after changes to Alden graph refresh ownership or result-state invalidation.
+---
+
+# Verify Alden graph scope
+
+Read `docs/evaluation/graph-scope-state-20261027/README.md`, its statechart and
+coverage ledger from the repository root. The safety promise is that an earlier
+asynchronous graph reply cannot replace the current project's graph or present
+its result as current after a scope or lifecycle epoch boundary. A → B → A still
+rejects the first A reply. Current successful replies must also visibly apply.
+
+Production source inspected and aligned: `d89738332a9f3370d4209c2976c90fa2189dc9d8`.
+The ledger records exact source hashes and await boundaries. Runtime files were
+not changed for this verification addition. Every run records the actual HEAD,
+source bytes, dependency versions and bounds; a recorded baseline is not a pin
+for silently accepting changed code.
+
+Run this single command from the repository root:
+
+```sh
+python3 -B scripts/verify_alden_graph_scope_state.py
+```
+
+Use the existing menu Python 3.11 runtime and `/opt/homebrew/bin/node` for local
+delivery verification. `--node` selects an existing runtime; `--output` selects a
+new evidence directory. The default is an ignored, timestamped `runs/` directory
+beside this skill. Nothing is installed. An existing output is never overwritten.
+
+The command executes both real-controller suites in isolated source copies:
+one generated-schedule test and 21 independent adversarial cases. The generated
+domain is depth ≤5, two projects, ≤2 project switches, ≤2 pause toggles, ≤2
+visibility changes, ≤2 FIFO replies and ≤1 timer advance of 1000 ms. It includes
+4735 candidate words; only 2839 finish as executable schedules. The other 1896
+prefixes request a completion before any pending read exists and are counted
+separately. The independent cases cover sibling awaits, revision probes, search,
+detail, affinity, navigation, terminal history and selected time boundaries.
+
+Require current code to pass all 22 checks, four deliberately broken variants
+to fail with the intended scope-oracle message, and a fresh positive replay
+after broken-copy removal. The epoch variant removes both independent reply
+fences. The fourth variant erases a current successful graph after applying it;
+the oracle must check each reply's final visible identity and result state,
+not merely count replacement calls. Compile/setup errors alone do not count as
+a rejected bad variant.
+Require unchanged main source bytes and dependency symlink and removed scratch
+copies in `verification.json`. Inspect the JSON fields and failure traces, not
+only the process exit code.
+
+For a genuine current-code failure, preserve the counterexample and distinguish
+a product bug, fixture error and changed input contract. For an obsolete mutation
+anchor, review the source transition and update the discriminating variant;
+never weaken the promise just to pass. When covered source or writers change,
+review all await splits, update the source map/statechart/bounds and rerun.
+
+These are bounded generated-input checks against actual code, not a theorem,
+refinement proof, liveness proof or complete ST15 certification. They do not
+execute native startup, GPU layout, source authorization, source truth, original
+databases, installed UI, activity/quality workflows or external release review.
+Preserve all independent native, source, audit and release holds.

.agents/skills/verify-alden-messenger-publication/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: verify-alden-messenger-publication
+description: Recheck messenger store/frontier/outbox commit ordering, current-version read authority and durable activity receipts after relevant Alden source changes.
+---
+
+# Verify messenger publication
+
+Read `docs/evaluation/messenger-stream-20261021/PUBLICATION_STATE.md` from the
+checkout. The property is that reads between separate database commits must
+neither expose a body before the frontier commits nor permanently lose its
+later refresh receipt. A wrong current membership/version must remain denied.
+
+Source coverage is `Frontier._prepare`, `_publish`, `_source_access`,
+`_release_activity`, `step` and `activity_releases` in
+`scripts/alden_messenger_runtime.py`, and
+`CollectionStore.ingest`, `release_activity`, `_event` and `activity_page` in
+`scripts/alden_collection.py`. The UI's history counts and terminal labels keep
+the readiness stage distinct from stored changes. Base inspected is
+`7d7a5149f8a05dbd913add6cf8e5cc5fa3f4adc6`; implementation aligned at
+`583bee9e54aa76721ac62e63fb5585cd0a8c014a`. Exact tested source hashes live in
+the verification/native receipts. Advance the sync revision only after checking
+that each modeled boundary still corresponds to a real commit in the source.
+
+Run `python3 -B scripts/verify_alden_messenger_publication.py` using the pinned
+menu Python3.11 interpreter for local delivery checks. Current source must pass
+all15 isolated SQLite/source-boundary cases, and all3 temporary broken variants
+must fail. The checker does not write native sources, send messages, grant
+consent, launch models or alter installed Resources. It removes its temporary
+mutants. Reconfirm the actual controlled trace and retain a genuine counterexample
+if the check fails; do not weaken body-withholding or cursor-delivery properties.
+
+These are bounded behavioral/mutation checks. No whole-system mathematical
+proof, complete source-visibility guarantee, installed UI/combat verification or
+unbounded liveness follows. Runtime/private native probes, external review and
+release gates remain separate. Source/claim mismatch is a modeling error;
+a real violated invariant remains a product finding.
+
+The stream/content separation has its own finite retry check:
+`python3 -B scripts/verify_alden_activity_stream.py`. Read
+`docs/evaluation/messenger-stream-20261021/STREAM_IDENTITY.md` for the covered
+functions, source hashes, bounds and the separate UI test. This checks three
+backend cases and rejects three process-local broken variants; it does not
+expand the fifteen-case publication check or verify native combat.

.agents/skills/verify-alden-realtime-state/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: verify-alden-realtime-state
+description: Verify Alden watcher retry, gate ordering and pending-input preservation after changes to realtime collection, scheduler ownership or SQLite error handling.
+---
+
+# Verify Alden realtime state
+
+Read `docs/evaluation/messenger-stream-20261021/STATE_VERIFICATION.md` from the
+repository root. The property is that transient SQLite contention preserves
+durable work and returns to a fresh gate check after a bounded wait; non-contention
+errors stay visible. This protects against silently losing the realtime worker
+or collecting when current source/control state is unknown.
+
+Coverage: `scripts/alden_realtime_collection.py:watch`, its calls to
+`CollectionStore.open_existing`, scheduler pause/abort/voice/cycle and realtime
+policy/scan/heartbeat. Tests are `tests/test_alden_realtime_collection.py` and
+`tests/test_alden_realtime_state.py`. This does not verify the scheduler's full
+publication protocol, source arrival, native readers, UI/combat or installed app.
+
+Baseline inspected: `1eb223652533fb47c66a8e888716c1088c134569`.
+Aligned implementation: `04b854b9600046d6b7549a038de58b026ed6e163`;
+watcher SHA-256 `3bdda372a926c64fe1394371d746e4aeb690a827d801ce341ce61cf235a59043`.
+Current source alignment is additionally bound by the SHA-256 in the generated
+verification receipt. Update this record to the delivered source commit only
+after confirming that the modeled boundaries still match that implementation.
+
+Run `python3 -B scripts/verify_alden_realtime_state.py` from the repository root.
+Use the pinned menu Python 3.11 runtime for local delivery verification. The
+checker runs 84 generated busy/control traces, two periodic retry cases, eight
+fatal-error cases (two ticks maximum), a real private SQLite-lock journey and
+two temporary mutations of actual source. Current code must pass and both
+broken variants must fail. No product source, native DB, consent, model, queue
+or installed Resources is changed; temporary variants are removed automatically.
+
+If a mutation is not rejected, inspect source-to-property alignment rather than
+weakening the property. If an intended source change makes a mutation anchor
+obsolete, review the new transition, update the discriminating broken variant
+and rerun. Preserve a genuine counterexample. Source changes, bound changes and
+test-oracle errors are distinct findings. This is bounded generated-input
+verification, not an unbounded mathematical proof or whole-project certification.