@1aboveio/skills 1.0.7 → 1.0.9

package/skills/core/reg-parser/SKILL.md

@@ -2,7 +2,7 @@
 name: reg-parser
 version: 1.1.0
 description: "Parse regulatory/scheme documents into structured outputs: convert a regulation (AML, VARS, PCI-DSS, KYC, GDPR) into an audit-ready compliance checklist, or trace contract clauses to a mandate source. Suggest proactively when a regulation PDF accompanies a contract review or compliance task. NOT general summarization (doc-to-md), or writing the gap analysis or policy from the checklist (write-doc)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # reg-parser

package/skills/core/reg-parser/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/core/terminology/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: terminology
 description: "Build and keep a project's TERMINOLOGY.md: the preferred term per concept in English, 简体 and 繁體, and the terms to avoid. Use to set it up from the project's documents, when the user settles or corrects a term, or when another writing skill needs the format. NOT for writing documents (write-doc) or the code domain model (domain-modeling)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Terminology

package/skills/core/terminology/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/core/write-doc/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: write-doc
 description: "Write or edit documents and compliance reports in the project's house style: BRD, PRD, gap analysis, technical spec, integration guide, proposal, policy, risk procedure, audit report, external assessment, management report or Visa VARS Review Report; English, Chinese or bilingual. Use automatically whenever asked to draft, write, revise or edit a document, without needing a slash command, including 'write up the findings'. Route explicit requests to remember a writing preference to its persistence owner. Markdown by default; export when requested. NOT for ordinary chat replies (plain-language), learning style from samples or preference-only saves (distill-writing), performing an audit (compliance-audit), or WeChat articles (wechat-article-writer)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Write a document

package/skills/core/write-doc/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/better-review/SKILL.md

@@ -4,7 +4,7 @@ description: "Slash/explicit-only (/better-review). Single-agent adversarial rev
 disable-model-invocation: true
 dependencies:
   - engineering-runtime
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Better Review

package/skills/engineering/better-review/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/contributing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contributing
 description: "The conventions a repo's CONTRIBUTING.md holds, starting with tracker routing: which tracker an issue belongs in (GitHub for engineering, Linear for product), duplicate search, and linking back to the source requirement. Use before creating any issue, spec, epic, ticket or sub-issue on GitHub or Linear, including inside /to-spec, /to-tickets and /triage, and whenever work that started from a Linear issue turns into engineering work. Also writes the rules as the Issue tracking section of the repo's CONTRIBUTING.md. NOT for delivering a PR (github-flow) or splitting work into slices (to-tickets)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contributing

package/skills/engineering/contributing/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/e2e-test/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: e2e-test
 description: "Playwright end-to-end standard: the 3-tier suite (render-health / functional / journey), generated route manifest, and presentation sweep. Use when browser routes or user flows ship or change, or a Playwright test flakes. NOT for non-browser tests, defining what to test (ensure-coverage), the curated ALIVE/DEAD golden-path gate (golden-path), or CI workflow YAML (github-actions)."
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # E2E Testing Standard

package/skills/engineering/e2e-test/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/engineering-runtime/SKILL.md

@@ -3,7 +3,7 @@ name: engineering-runtime
 description: Internal support package for shared Engineering Workflow executable behavior. Never select or invoke this package as a user capability.
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.43.0
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Engineering Runtime

package/skills/engineering/engineering-runtime/coherence/workflow.json

@@ -369,7 +369,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "8f0be335debec8a0b64bb40201a412eb0bc9ccc402074a7af0a483609daac28e",
+      "contentDigest": "ae8ace5c97889e14e669829d72a92bd90d593ba1099c4bd690c98eca8b9c94e3",
       "digestExcludes": []
     },
     {
@@ -382,7 +382,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "54c4c3e8579168b32c9d894f91d9bd6950dde2bf44ebd908cc7c548bdc0f6435",
+      "contentDigest": "ddf8e11e23f667cdc677c9d70edb6ed59da53b5a0b82af29f6be36eda35861c2",
       "digestExcludes": []
     },
     {
@@ -395,7 +395,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "8e6ae6a6065c670b6ed61c2b881dbea921847a7d80818916e853c4b73dd02e56",
+      "contentDigest": "0e3c87b01b5c337a7628ae5ba5c78a3b208ab404b8d848e4d8299f221224726d",
       "digestExcludes": []
     },
     {
@@ -408,7 +408,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "d5c96b3b0a7272a6ae6d4670f3deca7196c39cdb857d52936b076e880d338bcd",
+      "contentDigest": "de98656af030369ea229112e90f441626863dcca5e21f2f358e26041d0624f3e",
       "digestExcludes": []
     },
     {
@@ -421,7 +421,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "077317f2b2e8a142bd46c75d00bf2ba23b34cc24daa3f49bb9e4bb7247f7590c",
+      "contentDigest": "c4f55e7aed013006d00fde40504db87c32c48ca8b04ef4aeacf9c7fe31995fed",
       "digestExcludes": []
     },
     {
@@ -434,7 +434,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "a755c90afd1aef1e3de56fd35af08e98fc111b7cea775a63c7a34593ec1e499b",
+      "contentDigest": "7ec336f6920ec1195fbe08b40234ac72f8213a3b94f575e2c463108b36884a25",
       "digestExcludes": []
     },
     {
@@ -447,7 +447,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "937c2139aa3ca8f9f0a325c8a1300b1a84faba2f16132f8c608169e4e0732631",
+      "contentDigest": "845c78252f5308aa71b8eaabc80718c25a772d016d5d74eb888737cd7ffbe664",
       "digestExcludes": []
     },
     {
@@ -460,7 +460,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "a2e269f07c9309c5404eafe1b2ca2f5913dd390711c9a3ea7bffb3ae13c88a58",
+      "contentDigest": "0c9e35d5014ebd7b4512aeb7705cd39977252ccaa639821fa87f8f463364b613",
       "digestExcludes": []
     },
     {
@@ -473,7 +473,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "9c2920ba1dd60e6546831d5c5e0d32c2ce620cfd81cbb6b336c19dde223cacbb",
+      "contentDigest": "1c5c3dd92653706d7ca78926f10dbf266e4be4a807e6759ea6e8560b3be72f24",
       "digestExcludes": []
     },
     {
@@ -486,7 +486,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "4b85a0b25eec4594b40d95f41307ae1960b57d648df6e032cc0c780187432805",
+      "contentDigest": "d4f589fdb746755388a47eef8d34670a631584fac2bd32af1550da741434b4d6",
       "digestExcludes": []
     },
     {
@@ -499,7 +499,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "ee9204746c76d9734873b6f4953c2bf4854d01544bdd8212fe93df80d51e1c28",
+      "contentDigest": "d8b6513b1259b3b91f81c4ac9e9ebe66c2c3735534326ee793b99dc305dc3897",
       "digestExcludes": []
     },
     {
@@ -512,13 +512,13 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "1924382a6facdc4ad20cf9a70ee608c33c9d3dcba0babc2c1ed900876f6f1bb2",
+      "contentDigest": "bf49dc85c84e81e6561b6682003709bb792f4309a295cddad2c5e97e5e85f5b1",
       "digestExcludes": [
         "coherence/workflow.json"
       ]
     }
   ],
-  "releaseIdentity": "931e08c86e3cec4a44ba5568386488328de64187ae452e1db2a952043068d0f6",
+  "releaseIdentity": "a7f5ec670bb7b0f8dcfb585c5de1d5cfd0bd55799d72e994034674c7c84f5c40",
   "lifecycleAuthority": "native-skills-cli",
   "repairRecipe": {
     "id": "engineering-workflow-dependency-first",

package/skills/engineering/engineering-runtime/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/engineering-runtime/scripts/installation-resolver.mjs

@@ -0,0 +1,191 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { contentDigest, contentFiles, firstPartySource } from './workflow-coherence.mjs';
+import { reviewedSourceInjections } from './invocation-policy.mjs';
+import { isMainModule } from './main-module.mjs';
+
+export const NATIVE_METADATA_PATH = '.codex-plugin/resources.json';
+export const NATIVE_PLUGIN_NAME = '1aboveio-skills';
+const SHA256 = /^[a-f0-9]{64}$/;
+const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+function freeze(value) {
+  if (value && typeof value === 'object') {
+    for (const child of Object.values(value)) freeze(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+
+export function containedPath(root, path) {
+  if (!isAbsolute(root) || typeof path !== 'string' || !path || isAbsolute(path)
+      || path.includes('\\') || path.split('/').some((part) => !part || part === '.' || part === '..')) {
+    throw new Error('Invalid installation root or relative resource path');
+  }
+  const target = resolve(root, path);
+  if (relative(root, target).startsWith('..')) throw new Error('Resource escapes selected installation');
+  // Reject links at every component, including the root. No cache or shared-store fallback.
+  if (realpathSync(root) !== root) throw new Error('Selected installation root changed or is ambiguous');
+  let current = root;
+  for (const part of path.split('/')) {
+    current = join(current, part);
+    if (lstatSync(current).isSymbolicLink()) throw new Error(`Resource symlink is not supported: ${path}`);
+  }
+  return target;
+}
+
+export function metadataIdentity(metadata) {
+  const { releaseIdentity, ...body } = metadata;
+  return sha256(JSON.stringify(body));
+}
+
+export function validateResourceMetadata(metadata) {
+  if (metadata?.schemaVersion !== 1 || metadata.pluginName !== NATIVE_PLUGIN_NAME
+      || metadata.packageName !== '@1aboveio/skills' || !SHA256.test(metadata.releaseIdentity ?? '')
+      || metadataIdentity(metadata) !== metadata.releaseIdentity || !Array.isArray(metadata.members)
+      || metadata.members.length === 0) throw new Error('Invalid native resource metadata identity');
+  const names = new Set();
+  const paths = new Set();
+  for (const member of metadata.members) {
+    if (!NAME.test(member.canonicalName ?? '') || names.has(member.canonicalName)
+        || !SHA256.test(member.contentDigest ?? '') || !member.expectedSource
+        || !Array.isArray(member.digestExcludes) || !member.resourceDigests
+        || (firstPartySource(member.expectedSource) && !SHA256.test(member.resourceDigests['SKILL.md'] ?? ''))) throw new Error('Invalid or duplicate resource member');
+    names.add(member.canonicalName);
+    const source = member.expectedSource;
+    if (firstPartySource(source)) {
+      if (source.id !== 'first-party' || source.repository !== '1aboveio/ai' || source.revision !== 'main'
+          || !NAME.test(member.packageId ?? '') || member.bundlePath !== `skills/${member.packageId}/${member.canonicalName}`
+          || paths.has(member.bundlePath)) throw new Error('Invalid first-party resource ownership');
+      paths.add(member.bundlePath);
+    } else if (source.type !== 'external' || !SHA256.test(member.contentDigest)
+        || !/^[a-f0-9]{40}$/.test(source.revision ?? '') || !source.repository) {
+      throw new Error('Invalid pinned external identity');
+    }
+  }
+  return metadata;
+}
+
+function readPinnedMetadata(root, path, digest, identity) {
+  const bytes = readFileSync(containedPath(root, path));
+  if (sha256(bytes) !== digest) throw new Error('Resource metadata digest mismatch');
+  const metadata = validateResourceMetadata(JSON.parse(bytes));
+  if (metadata.releaseIdentity !== identity) throw new Error('Selected release identity mismatch');
+  return metadata;
+}
+
+// Callers obtain these pins from a verified artifact or trusted generation, not the mutable
+// package group index. The JSON descriptor is safe to persist in a run and pass to workers.
+export function selectInstallation({ layout, root, metadataPath, metadataDigest, releaseIdentity, externalRoots = {} }) {
+  if (!['source', 'installed', 'bundle'].includes(layout) || typeof root !== 'string' || !isAbsolute(root)
+      || !SHA256.test(metadataDigest ?? '') || !SHA256.test(releaseIdentity ?? '')) {
+    throw new Error('Select one absolute installation root and expected metadata/release identities');
+  }
+  const canonicalRoot = realpathSync(root);
+  if (canonicalRoot !== root) throw new Error('Selected installation root changed or is ambiguous');
+  const path = metadataPath ?? (layout === 'bundle' ? NATIVE_METADATA_PATH : null);
+  const metadata = readPinnedMetadata(canonicalRoot, path, metadataDigest, releaseIdentity);
+  const roots = {};
+  for (const [name, mapping] of Object.entries(externalRoots)) {
+    const member = metadata.members.find((candidate) => candidate.canonicalName === name);
+    if (!member || firstPartySource(member.expectedSource) || !isAbsolute(mapping?.root ?? '')
+        || !isDeepStrictEqual(mapping.expectedSource, member.expectedSource)) {
+      throw new Error(`Unknown or unpinned external root: ${name}`);
+    }
+    const externalRoot = realpathSync(mapping.root);
+    if (externalRoot !== mapping.root || externalRoot === canonicalRoot
+        || Object.values(roots).some((entry) => entry.root === externalRoot)) {
+      throw new Error(`Ambiguous external root: ${name}`);
+    }
+    roots[name] = { root: externalRoot, expectedSource: structuredClone(mapping.expectedSource) };
+  }
+  return freeze({ layout, root: canonicalRoot, metadataPath: path, metadataDigest, releaseIdentity, externalRoots: roots });
+}
+
+export function installationMetadata(installation) {
+  const selected = selectInstallation(installation);
+  return freeze(readPinnedMetadata(selected.root, selected.metadataPath, selected.metadataDigest, selected.releaseIdentity));
+}
+
+export function memberPath(installation, member) {
+  if (!firstPartySource(member.expectedSource)) {
+    const mapping = installation.externalRoots?.[member.canonicalName];
+    if (!mapping || !isDeepStrictEqual(mapping.expectedSource, member.expectedSource)) {
+      throw new Error(`Missing pinned external dependency: ${member.canonicalName}`);
+    }
+    // The explicit external root is the member itself, not a directory to search.
+    containedPath(mapping.root, 'SKILL.md');
+    return mapping.root;
+  }
+  return containedPath(installation.root, installation.layout === 'bundle' ? member.bundlePath
+    : installation.layout === 'installed' ? member.canonicalName : member.sourcePath);
+}
+
+export function resolveResource(installation, canonicalName, resource = 'SKILL.md', { hostIdentity = null } = {}) {
+  const selected = selectInstallation(installation);
+  const metadata = installationMetadata(selected);
+  const member = metadata.members.find((candidate) => candidate.canonicalName === canonicalName);
+  if (!member) throw new Error(`Unknown canonical skill: ${canonicalName}`);
+  if (firstPartySource(member.expectedSource) && !Object.hasOwn(member.resourceDigests, resource)) {
+    throw new Error(`Unknown resource: ${canonicalName}/${resource}`);
+  }
+  const directory = memberPath(selected, member);
+  let injected = [];
+  if (!firstPartySource(member.expectedSource) && member.invocationPolicy) {
+    try { injected = reviewedSourceInjections(directory, member.invocationPolicy); } catch { /* Raw upstream is also allowed. */ }
+  }
+  const digestOptions = { exclude: member.digestExcludes, published: firstPartySource(member.expectedSource), injected };
+  const actual = contentDigest(directory, digestOptions);
+  if (actual !== member.contentDigest) throw new Error(`Modified skill resources: ${canonicalName}`);
+  const pinned = Object.hasOwn(member.resourceDigests, resource);
+  if (!pinned && !contentFiles(directory, digestOptions).some((file) => file.relativePath === resource)) {
+    throw new Error(`Unverified resource: ${canonicalName}/${resource}`);
+  }
+  const path = containedPath(directory, resource);
+  const actualResourceDigest = sha256(readFileSync(path));
+  if (pinned && actualResourceDigest !== member.resourceDigests[resource]) {
+    throw new Error(`Modified resource: ${canonicalName}/${resource}`);
+  }
+  return freeze({ canonicalName, hostIdentity, path, directory, expectedSource: structuredClone(member.expectedSource),
+    contentDigest: actual, resourceDigest: actualResourceDigest, releaseIdentity: selected.releaseIdentity, installation: selected });
+}
+
+export function workerResources(installation, requests) {
+  if (!Array.isArray(requests) || requests.length === 0) throw new Error('Worker resources must be explicit');
+  return freeze(requests.map(({ canonicalName, resource, hostIdentity }) =>
+    resolveResource(installation, canonicalName, resource, { hostIdentity })));
+}
+
+export function diagnoseOverlap(installation, sharedRoot) {
+  if (!isAbsolute(sharedRoot ?? '')) throw new Error('Overlap diagnosis needs an explicit shared root');
+  return installationMetadata(installation).members.filter((member) => firstPartySource(member.expectedSource)
+    && existsSync(join(sharedRoot, member.canonicalName, 'SKILL.md')))
+    .map((member) => ({ canonicalName: member.canonicalName, selected: memberPath(installation, member),
+      shared: join(sharedRoot, member.canonicalName), requiresExplicitSelection: true }));
+}
+
+// Identify only the fixed bundle ancestor of a known executing skill. Never scan caches.
+export function executingBundleRoot(skillDirectory) {
+  const root = resolve(skillDirectory, '../../..');
+  try {
+    const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+    if (pkg.name === '@1aboveio/skills' && existsSync(join(root, NATIVE_METADATA_PATH))
+        && relative(root, skillDirectory).startsWith('skills/')) return root;
+  } catch { /* Source and flat installations have no bundle marker. */ }
+  return null;
+}
+
+if (isMainModule(import.meta.url)) {
+  try {
+    const [command, descriptor, name, resource] = process.argv.slice(2);
+    const selected = JSON.parse(readFileSync(descriptor, 'utf8'));
+    const result = command === 'select' ? selectInstallation(selected)
+      : command === 'resolve' ? resolveResource(selected, name, resource)
+        : command === 'overlap' ? diagnoseOverlap(selected, name) : null;
+    if (!result) throw new Error('Usage: installation-resolver.mjs <select|resolve|overlap> <descriptor.json> [canonical-name|shared-root] [resource]');
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
+}

package/skills/engineering/engineering-runtime/scripts/workflow-coherence.mjs

@@ -3,6 +3,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { isAbsolute, join, normalize, relative } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 
+import { containedPath, resolveResource, selectInstallation } from './installation-resolver.mjs';
 import { reviewedSourceInjections } from './invocation-policy.mjs';
 import { isMainModule } from './main-module.mjs';
 import {
@@ -190,6 +191,7 @@ function collectFiles(baseDir, currentDir, excludedPaths, files, published) {
 }
 
 /**
+ * List the exact digest-covered files, including reviewed replacements for invocation overlays.
  * @param {object} [options]
  * @param {string[]} [options.exclude]  member-relative paths to omit
  * @param {object[]} [options.injected] generated content to digest instead of reading from disk
@@ -198,13 +200,17 @@ function collectFiles(baseDir, currentDir, excludedPaths, files, published) {
  *   published release; left off for external members, whose authority is the reviewed upstream tree
  *   byte for byte. See {@link publishedContentExcluded}.
  */
-export function contentDigest(directory, { exclude = [], injected = [], published = false } = {}) {
+export function contentFiles(directory, { exclude = [], injected = [], published = false } = {}) {
   const files = [];
   const excluded = new Set(exclude);
   for (const file of injected) excluded.add(file.relativePath);
   collectFiles(directory, directory, excluded, files, published);
   for (const file of injected) files.push({ relativePath: file.relativePath, contents: file.contents });
-  files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+  return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+}
+
+export function contentDigest(directory, options = {}) {
+  const files = contentFiles(directory, options);
   const hash = createHash('sha256');
   for (const file of files) {
     hash.update(file.relativePath);
@@ -354,9 +360,10 @@ function validateManifest(manifest) {
 }
 
 function memberDirectory(member, options) {
-  if (options.layout === 'installed') return join(options.skillsRoot, member.installName);
+  if (options.installation) return resolveResource(options.installation, member.installName).directory;
+  if (options.layout === 'installed') return containedPath(options.skillsRoot, member.installName);
   const sourceRoot = options.sourceRoots?.[member.expectedSource.id];
-  return sourceRoot ? join(sourceRoot, member.sourcePath) : null;
+  return sourceRoot ? containedPath(sourceRoot, member.sourcePath) : null;
 }
 
 function missingManifestResult(layout, code, detail, invokedSkills) {
@@ -380,11 +387,32 @@ function missingManifestResult(layout, code, detail, invokedSkills) {
 }
 
 export function verifyWorkflowCoherence(options = {}) {
+  let result;
+  try {
+    const installation = options.installation ? selectInstallation(options.installation) : null;
+    result = verifySelectedWorkflow({ ...options, ...(installation ? { installation, layout: installation.layout } : {}) });
+  } catch (error) {
+    result = missingManifestResult(options.installation?.layout ?? options.layout ?? 'installed',
+      'installation-invalid', error.message, options.invokedSkills);
+  }
+  if (options.installation?.layout === 'bundle') {
+    result.repairRecipe = null;
+    for (const entry of result.findings) entry.repairRecipe = null;
+  }
+  return result;
+}
+
+function verifySelectedWorkflow(options = {}) {
   const layout = options.layout ?? 'installed';
-  if (!['installed', 'source'].includes(layout)) {
+  if (!['installed', 'source', 'bundle'].includes(layout) || layout === 'bundle' && !options.installation) {
     return missingManifestResult(layout, 'layout-invalid', 'The requested installation layout is unsupported.', options.invokedSkills);
   }
-  const manifestPath = options.manifestPath ?? (layout === 'installed'
+  const selectedManifest = options.installation
+    ? resolveResource(options.installation, 'engineering-runtime', 'coherence/workflow.json').path : null;
+  if (selectedManifest && options.manifestPath && options.manifestPath !== selectedManifest) {
+    throw new Error('A selected installation cannot use another coherence manifest');
+  }
+  const manifestPath = selectedManifest ?? options.manifestPath ?? (layout === 'installed'
     ? join(options.skillsRoot ?? '', 'engineering-runtime', 'coherence', 'workflow.json')
     : join(options.sourceRoots?.['first-party'] ?? '', WORKFLOW_COHERENCE_PATH));
   if (!manifestPath || !existsSync(manifestPath)) {
@@ -451,7 +479,14 @@ export function verifyWorkflowCoherence(options = {}) {
 
   const selectedMembers = manifest.members.filter((member) => selectedNames.has(member.installName));
   for (const member of selectedMembers) {
-    const directory = memberDirectory(member, { ...options, layout });
+    let directory;
+    try { directory = memberDirectory(member, { ...options, layout }); } catch (error) {
+      if (error.code !== 'ENOENT') {
+        findings.push(finding({ state: 'missing', code: 'member-resolution-invalid', member: member.installName,
+          ownership: member.ownership, expectedSource: member.expectedSource, manifest, detail: error.message }));
+        continue;
+      }
+    }
     if (!directory || !existsSync(directory)) {
       findings.push(finding({
         state: 'missing',
@@ -475,7 +510,7 @@ export function verifyWorkflowCoherence(options = {}) {
       // proved `expectedSource` deep-equal to the trusted policy above (`member-source-identity-
       // invalid` returns before this loop), so the derivation reads trusted data, not manifest claims.
       let policyInjections = [];
-      if (layout === 'installed' && member.invocationPolicy) {
+      if (layout !== 'source' && member.invocationPolicy) {
         try {
           policyInjections = reviewedSourceInjections(directory, member.invocationPolicy);
         } catch {
@@ -520,7 +555,8 @@ export function verifyWorkflowCoherence(options = {}) {
   const memberByName = new Map(manifest.members.map((member) => [member.installName, member]));
   for (const identity of selectedGenerated.values()) {
     const member = memberByName.get(identity.member);
-    const directory = member ? memberDirectory(member, { ...options, layout }) : null;
+    let directory = null;
+    try { directory = member ? memberDirectory(member, { ...options, layout }) : null; } catch { /* Report missing identity below. */ }
     const generatedPath = directory ? join(directory, identity.path) : null;
     let actualDigest = null;
     if (generatedPath && existsSync(generatedPath)) {
@@ -555,7 +591,8 @@ export function verifyWorkflowCoherence(options = {}) {
 export function runWorkflowCoherenceCli(args) {
   if (args[0] !== 'verify') {
     process.stderr.write(
-      'Usage: workflow-coherence.mjs verify --layout installed --skills-root <path> [--manifest <path>] [--invoked-skill <name>]...\n'
+      'Usage: workflow-coherence.mjs verify --installation <descriptor.json> [--invoked-skill <canonical-name>]...\n'
+      + '   or: workflow-coherence.mjs verify --layout installed --skills-root <path> [--manifest <path>] [--invoked-skill <name>]...\n'
       + '   or: workflow-coherence.mjs verify --layout source --source-root <id=path>... [--manifest <path>] [--invoked-skill <name>]...\n',
     );
     return 2;
@@ -570,6 +607,10 @@ export function runWorkflowCoherenceCli(args) {
       const key = argument === '--layout' ? 'layout' : argument === '--skills-root' ? 'skillsRoot' : 'manifestPath';
       options[key] = value;
       index += 1;
+    } else if (argument === '--installation') {
+      if (!value) return 2;
+      try { options.installation = JSON.parse(readFileSync(value, 'utf8')); } catch { return 2; }
+      index += 1;
     } else if (argument === '--source-root') {
       const separator = value?.indexOf('=') ?? -1;
       if (separator < 1 || separator === value.length - 1) return 2;