@1aboveio/skills 1.0.8 → 1.0.9

package/skills/engineering/e2e-test/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: e2e-test
 description: "Playwright end-to-end standard: the 3-tier suite (render-health / functional / journey), generated route manifest, and presentation sweep. Use when browser routes or user flows ship or change, or a Playwright test flakes. NOT for non-browser tests, defining what to test (ensure-coverage), the curated ALIVE/DEAD golden-path gate (golden-path), or CI workflow YAML (github-actions)."
-release-version: 0.43.1
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # E2E Testing Standard

package/skills/engineering/e2e-test/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/engineering-runtime/SKILL.md

@@ -3,7 +3,7 @@ name: engineering-runtime
 description: Internal support package for shared Engineering Workflow executable behavior. Never select or invoke this package as a user capability.
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.43.1
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Engineering Runtime

package/skills/engineering/engineering-runtime/coherence/workflow.json

@@ -369,7 +369,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "a37292865bf496db5c900602b3a2fefb87b5ebc9e6e7a185e2c8471d498c9a38",
+      "contentDigest": "ae8ace5c97889e14e669829d72a92bd90d593ba1099c4bd690c98eca8b9c94e3",
       "digestExcludes": []
     },
     {
@@ -382,7 +382,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "76e79c091a20274fc7a11296e5dbb2bb128525499596129baae4a11179ef7f71",
+      "contentDigest": "ddf8e11e23f667cdc677c9d70edb6ed59da53b5a0b82af29f6be36eda35861c2",
       "digestExcludes": []
     },
     {
@@ -395,7 +395,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "e4c79b9b236babd8413778b57b67e157edc81b7870302ac38153ebd15eca6b66",
+      "contentDigest": "0e3c87b01b5c337a7628ae5ba5c78a3b208ab404b8d848e4d8299f221224726d",
       "digestExcludes": []
     },
     {
@@ -408,7 +408,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "c91d1d12fb3110f42779c00aa7666a7f9401bae04e63c681034c84276adab222",
+      "contentDigest": "de98656af030369ea229112e90f441626863dcca5e21f2f358e26041d0624f3e",
       "digestExcludes": []
     },
     {
@@ -421,7 +421,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "800748e040c2c47a78b65713fd88d1586206feb7f5a5ce052da051a72cc82743",
+      "contentDigest": "c4f55e7aed013006d00fde40504db87c32c48ca8b04ef4aeacf9c7fe31995fed",
       "digestExcludes": []
     },
     {
@@ -434,7 +434,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "5441c5a8c40c27c1455001ee65b5cf055d25932963410b852d6fd7753e03c7e0",
+      "contentDigest": "7ec336f6920ec1195fbe08b40234ac72f8213a3b94f575e2c463108b36884a25",
       "digestExcludes": []
     },
     {
@@ -447,7 +447,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "22b2d51f863c5e215dda1036ada423d65873652d05aee4efa83ff4e4995dfc2d",
+      "contentDigest": "845c78252f5308aa71b8eaabc80718c25a772d016d5d74eb888737cd7ffbe664",
       "digestExcludes": []
     },
     {
@@ -460,7 +460,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "f293e919a756e073894e959f25d874d69ef94839ccd98a92aa5073308f18f643",
+      "contentDigest": "0c9e35d5014ebd7b4512aeb7705cd39977252ccaa639821fa87f8f463364b613",
       "digestExcludes": []
     },
     {
@@ -473,7 +473,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "3d9dd1501f80995d27026e1b7ba9751e2e10f4db7f1a427c36bd1f9eec24fcdf",
+      "contentDigest": "1c5c3dd92653706d7ca78926f10dbf266e4be4a807e6759ea6e8560b3be72f24",
       "digestExcludes": []
     },
     {
@@ -486,7 +486,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "4d5e6c1570bb2395813382991aa04437b60b7f20fd54234d07a7af5dbd2b31e3",
+      "contentDigest": "d4f589fdb746755388a47eef8d34670a631584fac2bd32af1550da741434b4d6",
       "digestExcludes": []
     },
     {
@@ -499,7 +499,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "8d32ffe5807e680193e4ee05d51a7c6691e25ffea54bd657405e1025e318cf09",
+      "contentDigest": "d8b6513b1259b3b91f81c4ac9e9ebe66c2c3735534326ee793b99dc305dc3897",
       "digestExcludes": []
     },
     {
@@ -512,13 +512,13 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "6fcf7271652b12f8a64e03cdce85fdeee10cc8456f89ac1b39631281e2e52615",
+      "contentDigest": "bf49dc85c84e81e6561b6682003709bb792f4309a295cddad2c5e97e5e85f5b1",
       "digestExcludes": [
         "coherence/workflow.json"
       ]
     }
   ],
-  "releaseIdentity": "0e956b77698da11b37a94d960a5f7a7102af5b761b788f1fe52a6c9716cf132d",
+  "releaseIdentity": "a7f5ec670bb7b0f8dcfb585c5de1d5cfd0bd55799d72e994034674c7c84f5c40",
   "lifecycleAuthority": "native-skills-cli",
   "repairRecipe": {
     "id": "engineering-workflow-dependency-first",

package/skills/engineering/engineering-runtime/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/engineering-runtime/scripts/installation-resolver.mjs

@@ -0,0 +1,191 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { contentDigest, contentFiles, firstPartySource } from './workflow-coherence.mjs';
+import { reviewedSourceInjections } from './invocation-policy.mjs';
+import { isMainModule } from './main-module.mjs';
+
+export const NATIVE_METADATA_PATH = '.codex-plugin/resources.json';
+export const NATIVE_PLUGIN_NAME = '1aboveio-skills';
+const SHA256 = /^[a-f0-9]{64}$/;
+const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+function freeze(value) {
+  if (value && typeof value === 'object') {
+    for (const child of Object.values(value)) freeze(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+
+export function containedPath(root, path) {
+  if (!isAbsolute(root) || typeof path !== 'string' || !path || isAbsolute(path)
+      || path.includes('\\') || path.split('/').some((part) => !part || part === '.' || part === '..')) {
+    throw new Error('Invalid installation root or relative resource path');
+  }
+  const target = resolve(root, path);
+  if (relative(root, target).startsWith('..')) throw new Error('Resource escapes selected installation');
+  // Reject links at every component, including the root. No cache or shared-store fallback.
+  if (realpathSync(root) !== root) throw new Error('Selected installation root changed or is ambiguous');
+  let current = root;
+  for (const part of path.split('/')) {
+    current = join(current, part);
+    if (lstatSync(current).isSymbolicLink()) throw new Error(`Resource symlink is not supported: ${path}`);
+  }
+  return target;
+}
+
+export function metadataIdentity(metadata) {
+  const { releaseIdentity, ...body } = metadata;
+  return sha256(JSON.stringify(body));
+}
+
+export function validateResourceMetadata(metadata) {
+  if (metadata?.schemaVersion !== 1 || metadata.pluginName !== NATIVE_PLUGIN_NAME
+      || metadata.packageName !== '@1aboveio/skills' || !SHA256.test(metadata.releaseIdentity ?? '')
+      || metadataIdentity(metadata) !== metadata.releaseIdentity || !Array.isArray(metadata.members)
+      || metadata.members.length === 0) throw new Error('Invalid native resource metadata identity');
+  const names = new Set();
+  const paths = new Set();
+  for (const member of metadata.members) {
+    if (!NAME.test(member.canonicalName ?? '') || names.has(member.canonicalName)
+        || !SHA256.test(member.contentDigest ?? '') || !member.expectedSource
+        || !Array.isArray(member.digestExcludes) || !member.resourceDigests
+        || (firstPartySource(member.expectedSource) && !SHA256.test(member.resourceDigests['SKILL.md'] ?? ''))) throw new Error('Invalid or duplicate resource member');
+    names.add(member.canonicalName);
+    const source = member.expectedSource;
+    if (firstPartySource(source)) {
+      if (source.id !== 'first-party' || source.repository !== '1aboveio/ai' || source.revision !== 'main'
+          || !NAME.test(member.packageId ?? '') || member.bundlePath !== `skills/${member.packageId}/${member.canonicalName}`
+          || paths.has(member.bundlePath)) throw new Error('Invalid first-party resource ownership');
+      paths.add(member.bundlePath);
+    } else if (source.type !== 'external' || !SHA256.test(member.contentDigest)
+        || !/^[a-f0-9]{40}$/.test(source.revision ?? '') || !source.repository) {
+      throw new Error('Invalid pinned external identity');
+    }
+  }
+  return metadata;
+}
+
+function readPinnedMetadata(root, path, digest, identity) {
+  const bytes = readFileSync(containedPath(root, path));
+  if (sha256(bytes) !== digest) throw new Error('Resource metadata digest mismatch');
+  const metadata = validateResourceMetadata(JSON.parse(bytes));
+  if (metadata.releaseIdentity !== identity) throw new Error('Selected release identity mismatch');
+  return metadata;
+}
+
+// Callers obtain these pins from a verified artifact or trusted generation, not the mutable
+// package group index. The JSON descriptor is safe to persist in a run and pass to workers.
+export function selectInstallation({ layout, root, metadataPath, metadataDigest, releaseIdentity, externalRoots = {} }) {
+  if (!['source', 'installed', 'bundle'].includes(layout) || typeof root !== 'string' || !isAbsolute(root)
+      || !SHA256.test(metadataDigest ?? '') || !SHA256.test(releaseIdentity ?? '')) {
+    throw new Error('Select one absolute installation root and expected metadata/release identities');
+  }
+  const canonicalRoot = realpathSync(root);
+  if (canonicalRoot !== root) throw new Error('Selected installation root changed or is ambiguous');
+  const path = metadataPath ?? (layout === 'bundle' ? NATIVE_METADATA_PATH : null);
+  const metadata = readPinnedMetadata(canonicalRoot, path, metadataDigest, releaseIdentity);
+  const roots = {};
+  for (const [name, mapping] of Object.entries(externalRoots)) {
+    const member = metadata.members.find((candidate) => candidate.canonicalName === name);
+    if (!member || firstPartySource(member.expectedSource) || !isAbsolute(mapping?.root ?? '')
+        || !isDeepStrictEqual(mapping.expectedSource, member.expectedSource)) {
+      throw new Error(`Unknown or unpinned external root: ${name}`);
+    }
+    const externalRoot = realpathSync(mapping.root);
+    if (externalRoot !== mapping.root || externalRoot === canonicalRoot
+        || Object.values(roots).some((entry) => entry.root === externalRoot)) {
+      throw new Error(`Ambiguous external root: ${name}`);
+    }
+    roots[name] = { root: externalRoot, expectedSource: structuredClone(mapping.expectedSource) };
+  }
+  return freeze({ layout, root: canonicalRoot, metadataPath: path, metadataDigest, releaseIdentity, externalRoots: roots });
+}
+
+export function installationMetadata(installation) {
+  const selected = selectInstallation(installation);
+  return freeze(readPinnedMetadata(selected.root, selected.metadataPath, selected.metadataDigest, selected.releaseIdentity));
+}
+
+export function memberPath(installation, member) {
+  if (!firstPartySource(member.expectedSource)) {
+    const mapping = installation.externalRoots?.[member.canonicalName];
+    if (!mapping || !isDeepStrictEqual(mapping.expectedSource, member.expectedSource)) {
+      throw new Error(`Missing pinned external dependency: ${member.canonicalName}`);
+    }
+    // The explicit external root is the member itself, not a directory to search.
+    containedPath(mapping.root, 'SKILL.md');
+    return mapping.root;
+  }
+  return containedPath(installation.root, installation.layout === 'bundle' ? member.bundlePath
+    : installation.layout === 'installed' ? member.canonicalName : member.sourcePath);
+}
+
+export function resolveResource(installation, canonicalName, resource = 'SKILL.md', { hostIdentity = null } = {}) {
+  const selected = selectInstallation(installation);
+  const metadata = installationMetadata(selected);
+  const member = metadata.members.find((candidate) => candidate.canonicalName === canonicalName);
+  if (!member) throw new Error(`Unknown canonical skill: ${canonicalName}`);
+  if (firstPartySource(member.expectedSource) && !Object.hasOwn(member.resourceDigests, resource)) {
+    throw new Error(`Unknown resource: ${canonicalName}/${resource}`);
+  }
+  const directory = memberPath(selected, member);
+  let injected = [];
+  if (!firstPartySource(member.expectedSource) && member.invocationPolicy) {
+    try { injected = reviewedSourceInjections(directory, member.invocationPolicy); } catch { /* Raw upstream is also allowed. */ }
+  }
+  const digestOptions = { exclude: member.digestExcludes, published: firstPartySource(member.expectedSource), injected };
+  const actual = contentDigest(directory, digestOptions);
+  if (actual !== member.contentDigest) throw new Error(`Modified skill resources: ${canonicalName}`);
+  const pinned = Object.hasOwn(member.resourceDigests, resource);
+  if (!pinned && !contentFiles(directory, digestOptions).some((file) => file.relativePath === resource)) {
+    throw new Error(`Unverified resource: ${canonicalName}/${resource}`);
+  }
+  const path = containedPath(directory, resource);
+  const actualResourceDigest = sha256(readFileSync(path));
+  if (pinned && actualResourceDigest !== member.resourceDigests[resource]) {
+    throw new Error(`Modified resource: ${canonicalName}/${resource}`);
+  }
+  return freeze({ canonicalName, hostIdentity, path, directory, expectedSource: structuredClone(member.expectedSource),
+    contentDigest: actual, resourceDigest: actualResourceDigest, releaseIdentity: selected.releaseIdentity, installation: selected });
+}
+
+export function workerResources(installation, requests) {
+  if (!Array.isArray(requests) || requests.length === 0) throw new Error('Worker resources must be explicit');
+  return freeze(requests.map(({ canonicalName, resource, hostIdentity }) =>
+    resolveResource(installation, canonicalName, resource, { hostIdentity })));
+}
+
+export function diagnoseOverlap(installation, sharedRoot) {
+  if (!isAbsolute(sharedRoot ?? '')) throw new Error('Overlap diagnosis needs an explicit shared root');
+  return installationMetadata(installation).members.filter((member) => firstPartySource(member.expectedSource)
+    && existsSync(join(sharedRoot, member.canonicalName, 'SKILL.md')))
+    .map((member) => ({ canonicalName: member.canonicalName, selected: memberPath(installation, member),
+      shared: join(sharedRoot, member.canonicalName), requiresExplicitSelection: true }));
+}
+
+// Identify only the fixed bundle ancestor of a known executing skill. Never scan caches.
+export function executingBundleRoot(skillDirectory) {
+  const root = resolve(skillDirectory, '../../..');
+  try {
+    const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+    if (pkg.name === '@1aboveio/skills' && existsSync(join(root, NATIVE_METADATA_PATH))
+        && relative(root, skillDirectory).startsWith('skills/')) return root;
+  } catch { /* Source and flat installations have no bundle marker. */ }
+  return null;
+}
+
+if (isMainModule(import.meta.url)) {
+  try {
+    const [command, descriptor, name, resource] = process.argv.slice(2);
+    const selected = JSON.parse(readFileSync(descriptor, 'utf8'));
+    const result = command === 'select' ? selectInstallation(selected)
+      : command === 'resolve' ? resolveResource(selected, name, resource)
+        : command === 'overlap' ? diagnoseOverlap(selected, name) : null;
+    if (!result) throw new Error('Usage: installation-resolver.mjs <select|resolve|overlap> <descriptor.json> [canonical-name|shared-root] [resource]');
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
+}

package/skills/engineering/engineering-runtime/scripts/workflow-coherence.mjs

@@ -3,6 +3,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { isAbsolute, join, normalize, relative } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 
+import { containedPath, resolveResource, selectInstallation } from './installation-resolver.mjs';
 import { reviewedSourceInjections } from './invocation-policy.mjs';
 import { isMainModule } from './main-module.mjs';
 import {
@@ -190,6 +191,7 @@ function collectFiles(baseDir, currentDir, excludedPaths, files, published) {
 }
 
 /**
+ * List the exact digest-covered files, including reviewed replacements for invocation overlays.
  * @param {object} [options]
  * @param {string[]} [options.exclude]  member-relative paths to omit
  * @param {object[]} [options.injected] generated content to digest instead of reading from disk
@@ -198,13 +200,17 @@ function collectFiles(baseDir, currentDir, excludedPaths, files, published) {
  *   published release; left off for external members, whose authority is the reviewed upstream tree
  *   byte for byte. See {@link publishedContentExcluded}.
  */
-export function contentDigest(directory, { exclude = [], injected = [], published = false } = {}) {
+export function contentFiles(directory, { exclude = [], injected = [], published = false } = {}) {
   const files = [];
   const excluded = new Set(exclude);
   for (const file of injected) excluded.add(file.relativePath);
   collectFiles(directory, directory, excluded, files, published);
   for (const file of injected) files.push({ relativePath: file.relativePath, contents: file.contents });
-  files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+  return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+}
+
+export function contentDigest(directory, options = {}) {
+  const files = contentFiles(directory, options);
   const hash = createHash('sha256');
   for (const file of files) {
     hash.update(file.relativePath);
@@ -354,9 +360,10 @@ function validateManifest(manifest) {
 }
 
 function memberDirectory(member, options) {
-  if (options.layout === 'installed') return join(options.skillsRoot, member.installName);
+  if (options.installation) return resolveResource(options.installation, member.installName).directory;
+  if (options.layout === 'installed') return containedPath(options.skillsRoot, member.installName);
   const sourceRoot = options.sourceRoots?.[member.expectedSource.id];
-  return sourceRoot ? join(sourceRoot, member.sourcePath) : null;
+  return sourceRoot ? containedPath(sourceRoot, member.sourcePath) : null;
 }
 
 function missingManifestResult(layout, code, detail, invokedSkills) {
@@ -380,11 +387,32 @@ function missingManifestResult(layout, code, detail, invokedSkills) {
 }
 
 export function verifyWorkflowCoherence(options = {}) {
+  let result;
+  try {
+    const installation = options.installation ? selectInstallation(options.installation) : null;
+    result = verifySelectedWorkflow({ ...options, ...(installation ? { installation, layout: installation.layout } : {}) });
+  } catch (error) {
+    result = missingManifestResult(options.installation?.layout ?? options.layout ?? 'installed',
+      'installation-invalid', error.message, options.invokedSkills);
+  }
+  if (options.installation?.layout === 'bundle') {
+    result.repairRecipe = null;
+    for (const entry of result.findings) entry.repairRecipe = null;
+  }
+  return result;
+}
+
+function verifySelectedWorkflow(options = {}) {
   const layout = options.layout ?? 'installed';
-  if (!['installed', 'source'].includes(layout)) {
+  if (!['installed', 'source', 'bundle'].includes(layout) || layout === 'bundle' && !options.installation) {
     return missingManifestResult(layout, 'layout-invalid', 'The requested installation layout is unsupported.', options.invokedSkills);
   }
-  const manifestPath = options.manifestPath ?? (layout === 'installed'
+  const selectedManifest = options.installation
+    ? resolveResource(options.installation, 'engineering-runtime', 'coherence/workflow.json').path : null;
+  if (selectedManifest && options.manifestPath && options.manifestPath !== selectedManifest) {
+    throw new Error('A selected installation cannot use another coherence manifest');
+  }
+  const manifestPath = selectedManifest ?? options.manifestPath ?? (layout === 'installed'
     ? join(options.skillsRoot ?? '', 'engineering-runtime', 'coherence', 'workflow.json')
     : join(options.sourceRoots?.['first-party'] ?? '', WORKFLOW_COHERENCE_PATH));
   if (!manifestPath || !existsSync(manifestPath)) {
@@ -451,7 +479,14 @@ export function verifyWorkflowCoherence(options = {}) {
 
   const selectedMembers = manifest.members.filter((member) => selectedNames.has(member.installName));
   for (const member of selectedMembers) {
-    const directory = memberDirectory(member, { ...options, layout });
+    let directory;
+    try { directory = memberDirectory(member, { ...options, layout }); } catch (error) {
+      if (error.code !== 'ENOENT') {
+        findings.push(finding({ state: 'missing', code: 'member-resolution-invalid', member: member.installName,
+          ownership: member.ownership, expectedSource: member.expectedSource, manifest, detail: error.message }));
+        continue;
+      }
+    }
     if (!directory || !existsSync(directory)) {
       findings.push(finding({
         state: 'missing',
@@ -475,7 +510,7 @@ export function verifyWorkflowCoherence(options = {}) {
       // proved `expectedSource` deep-equal to the trusted policy above (`member-source-identity-
       // invalid` returns before this loop), so the derivation reads trusted data, not manifest claims.
       let policyInjections = [];
-      if (layout === 'installed' && member.invocationPolicy) {
+      if (layout !== 'source' && member.invocationPolicy) {
         try {
           policyInjections = reviewedSourceInjections(directory, member.invocationPolicy);
         } catch {
@@ -520,7 +555,8 @@ export function verifyWorkflowCoherence(options = {}) {
   const memberByName = new Map(manifest.members.map((member) => [member.installName, member]));
   for (const identity of selectedGenerated.values()) {
     const member = memberByName.get(identity.member);
-    const directory = member ? memberDirectory(member, { ...options, layout }) : null;
+    let directory = null;
+    try { directory = member ? memberDirectory(member, { ...options, layout }) : null; } catch { /* Report missing identity below. */ }
     const generatedPath = directory ? join(directory, identity.path) : null;
     let actualDigest = null;
     if (generatedPath && existsSync(generatedPath)) {
@@ -555,7 +591,8 @@ export function verifyWorkflowCoherence(options = {}) {
 export function runWorkflowCoherenceCli(args) {
   if (args[0] !== 'verify') {
     process.stderr.write(
-      'Usage: workflow-coherence.mjs verify --layout installed --skills-root <path> [--manifest <path>] [--invoked-skill <name>]...\n'
+      'Usage: workflow-coherence.mjs verify --installation <descriptor.json> [--invoked-skill <canonical-name>]...\n'
+      + '   or: workflow-coherence.mjs verify --layout installed --skills-root <path> [--manifest <path>] [--invoked-skill <name>]...\n'
       + '   or: workflow-coherence.mjs verify --layout source --source-root <id=path>... [--manifest <path>] [--invoked-skill <name>]...\n',
     );
     return 2;
@@ -570,6 +607,10 @@ export function runWorkflowCoherenceCli(args) {
       const key = argument === '--layout' ? 'layout' : argument === '--skills-root' ? 'skillsRoot' : 'manifestPath';
       options[key] = value;
       index += 1;
+    } else if (argument === '--installation') {
+      if (!value) return 2;
+      try { options.installation = JSON.parse(readFileSync(value, 'utf8')); } catch { return 2; }
+      index += 1;
     } else if (argument === '--source-root') {
       const separator = value?.indexOf('=') ?? -1;
       if (separator < 1 || separator === value.length - 1) return 2;

package/skills/engineering/ensure-coverage/SKILL.md

@@ -2,7 +2,7 @@
 name: ensure-coverage
 description: "Define or audit behavior-first test criteria — ACs, required test levels, mock/integration/E2E policy — across three axes: breadth (Coverage Ledger), depth (over-mocking), presentation (perceivability of browser surfaces). NOT judging whether a single test is any good (test-quality), authoring browser tests (e2e-test), reviewing a PR (better-review), or delivering issues (resolve-issues)."
 disable-model-invocation: true
-release-version: 0.43.1
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Ensure Coverage

package/skills/engineering/ensure-coverage/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/golden-path/SKILL.md

@@ -3,7 +3,7 @@ name: golden-path
 description: "Golden-path E2E: the short list of user journeys whose failure blocks a release, kept in a repo as one contract (golden-paths.json) with a generated GOLDEN_PATHS.md and a generated GitHub Actions workflow, and run against a local build or a deployed URL for an ALIVE/DEAD verdict. Use to set golden paths up in a repo ('init golden paths', 'add golden-path CI'), to migrate an older smoke.manifest.json or a hand-built smoke setup ('audit', 'migrate smoke'), to add, change, or remove a golden path, to ask 'is the build alive?' or run them before a PR or release, or when a change touches a flow listed in GOLDEN_PATHS.md. NOT for writing the Playwright specs themselves (e2e-test), deciding what a change must prove (ensure-coverage), or general workflow YAML (github-actions)."
 dependencies:
   - e2e-test
-release-version: 0.43.1
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Golden path

package/skills/engineering/golden-path/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/harness-runtime/SKILL.md

@@ -3,7 +3,7 @@ name: harness-runtime
 description: Internal import-only library shared by first-party engineering packages. Not a workflow skill; never select or invoke it as a user capability.
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.43.1
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Harness Runtime

package/skills/engineering/harness-runtime/release-check.mjs

@@ -2,7 +2,7 @@
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -46,6 +46,8 @@ function writeCache(path, value) {
 
 function main(now = Date.now()) {
   if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const bundle = readJson(join(resolve(here, '../../..'), 'package.json'));
+  if (bundle.name === '@1aboveio/skills' && bundle.nativeCodex?.schemaVersion === 1) return;
   const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
   const name = frontmatterValue(skill, 'name');
   const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));

package/skills/engineering/resolve-issues/SKILL.md

@@ -8,7 +8,7 @@ dependencies:
   - better-review
   - golden-path
   - harness-runtime
-release-version: 0.43.1
+release-version: 0.44.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve issues

package/skills/engineering/resolve-issues/references/preflight.md

@@ -45,6 +45,13 @@ sub-issues, never a checklist.
 
 ### Compaction hook
 
+For a native Codex bundle, first follow [Native Codex selection](shared-modules.md#native-codex-selection).
+The hook command returns `plugin-no-global-hooks` and writes nothing, even without
+`--check`. Do not offer a machine-wide cached-path hook. Preserve the installation
+descriptor in the plan and use the selected copy's recovery command after resume.
+Native host compaction/resume still requires separate client certification.
+The remaining hook instructions apply to standalone installations.
+
 **A compaction summary keeps the run's state and drops the skill's rules, so
 a hook makes you read the skills again after every compaction.** Check it:
 

package/skills/engineering/resolve-issues/references/shared-modules.md

@@ -4,6 +4,33 @@ Use the owning skill for models, review, golden paths, and the merge queue; neve
 copy its doctrine here. Resolve a leaf skill from the active skills root only
 for a stage that invokes it, and pass its absolute path.
 
+## Native Codex selection
+
+For a native bundle invocation, run the invoked copy's
+`scripts/active-installation.mjs capture` before spawning workers. Save its JSON as
+`installation` in this run's task plan and as a run-local `installation.json`.
+Capture reads only the executing bundle's fixed ancestor, never another cache.
+A certifier passes independently verified pins as `capture <expected-pins.json>`;
+ordinary capture starts from the artifact selected by Codex. Neither operation is
+a signature or published-artifact certification.
+
+Use `scripts/active-installation.mjs worker <installation.json> <canonical-name>...`
+to obtain verified absolute instruction paths. Resolve other resources through
+`engineering-runtime/scripts/installation-resolver.mjs resolve <installation.json>
+<canonical-name> <member-relative-resource>`. Pass those paths and the unchanged
+installation descriptor in worker briefs. Keep the host's observed namespaced
+identity separate from the canonical catalog name; never strip arbitrary prefixes
+to resolve dependencies. Missing, changed or ambiguous resources stop the affected
+workflow; do not search caches, use a shared namesake, or install dependencies.
+Model slots and reviewer independence still follow the policy below.
+
+After compaction or resume, run the selected copy's `scripts/rehydrate.mjs --cwd
+<project>` and read the returned instruction paths in full. It verifies the saved
+installation before returning paths and reports blocked recovery on drift. Native
+bundle invocations do not install global hooks. Scripted recovery alone is not
+proof that a Codex surface triggers it; native host compaction/resume certification
+must pass before that surface is advertised as supported.
+
 ## Model catalog
 
 Owner: [`harness-runtime`](../../harness-runtime/) (catalog doctrine and seed