@awebai/oats 0.30.0 → 0.30.2

package/docs/workspaces.md

@@ -54,8 +54,8 @@ members:                                   # repo refs, NO @revision (E_WORKSPAC
   - git:github.com/acme/tools              # a member that ALSO publishes a package (see below)
 
 packages:                                  # the ONLY versioned things
-  oats.framework: v1.4.0                   # bare version → resolves through the official catalog
-  oats.okf: v4.0.4
+  oats.framework: v1.4.1                   # bare version → resolves through the official catalog
+  oats.okf: v4.0.5
   acme.tools: git:github.com/acme/tools@v0.4.0   # outside the catalog → git:<repo>@<tag|OID>; still a package
 
 teams:                                     # SHARED teams: the same provider team for everyone
@@ -226,6 +226,11 @@ A repository may be a **member** (it completed the handshake; its `souls/*` and
   version }` on the member row (informational) and does **not** list the
   package's capabilities as member capabilities.
 
+A publisher that also keeps copies of its package's capabilities (a mirror, a
+fixture) keeps them outside `capabilities/`, or discovery lists them as member
+capabilities too: the same capability offered twice, once at latest state. The
+`oats` repository keeps its mirrors of the official packages in `mirrors/`.
+
 So the framework's own souls say `oats.okf: { from: package }` even though
 `oats-okf` is a member of the OATS workspace, and every package repo carries a
 member soul that is the expert in that capability (`oats-okf-expert`,

package/lib/core.mjs

@@ -2992,7 +2992,7 @@ function* spawnBody(root, agent, o = {}) {
     return e;
   };
   // Workspace model: copy every resolved capability WHOLE into the new home
-  // (.oats/modules/<cap>/ + .agents/skills/<cap>/) and record modules/providers
+  // (.oats/modules/<cap>/, its skills flat in .agents/skills/<skill>/) and record modules/providers
   // in instance.json. Then REBUILD the capability rows against the copies that
   // landed (H1): until now `resolvedCfg.capabilities` were PLANNED rows (no
   // skills, no inject, no dir) — hooks, environment, requirements, retirement
@@ -3034,9 +3034,14 @@ function* spawnBody(root, agent, o = {}) {
         const row = rows.find((c) => c.id === r.module);
         if (r.type === "injection") { r.path = row?.inject; continue; }
         if (r.type === "skill-tree") {
-          const skillsRoot = join(home, ".agents", "skills", r.module);
+          // Module skills land flat in the canonical skills root; the entries are
+          // the names materialize placed for this module (what the resolution
+          // promised), verified against the root in the completeness check.
+          const skillsRoot = join(home, ".agents", "skills");
           r.path = existsSync(skillsRoot) ? skillsRoot : undefined;
-          r.entries = (row?.skills || []).map((p) => basename(p));
+          r.entries = Array.isArray(materializeOutcome?.skills)
+            ? materializeOutcome.skills.filter((s) => s.module === r.module).map((s) => s.name)
+            : (row?.skills || []).map((p) => basename(p));
         }
       }
     } catch (e) { throw rollbackEmptyOrPreparedHome(e); }
@@ -3074,30 +3079,43 @@ function* spawnBody(root, agent, o = {}) {
   }
   if (!existsSync(join(home, "CLAUDE.md"))) symlinkSync("AGENTS.md", join(home, "CLAUDE.md"));
 
-  // Skills: module skills were copied WHOLE into <home>/.agents/skills/<module>/
+  // Skills: module skills were copied WHOLE and FLAT into <home>/.agents/skills/<skill>/
   // by materialize (decision 7/13); here only the soul's own skills join them, one
-  // directory each. There is no override: a soul skill named like a module's
-  // directory is a duplicate (decision 16). The harness is launched with its normal
+  // directory each, at the same level — the one level every harness discovers. There
+  // is no override: a soul skill named like a module's skill is a duplicate (decision 16). The harness is launched with its normal
   // discovery — the machine's and the repo's skills are the harness's business.
   const sources = [];
   const soulSkills = join(soulDir, "skills");
   if (existsSync(soulSkills)) sources.push({ id: "soul", path: soulSkills });
   const chosen = new Map();
+  // Names compare case-insensitively: one directory per skill on a case-insensitive
+  // filesystem (APFS, NTFS) must not silently merge `Foo` into `foo`.
+  const moduleSkillOwner = new Map((materializeOutcome?.skills || []).map((s) => [s.name.toLowerCase(), s.module]));
+  const chosenKeys = new Map();
   const offer = (name, src, source) => {
-    if (chosen.has(name) || existsSync(join(home, ".agents", "skills", name))) throw oatsError("E_SKILL_DUPLICATE", `skill "${name}" from ${source} collides with ${chosen.get(name)?.source ?? `module ${name}'s skill directory`}`);
+    const key = name.toLowerCase();
+    if (chosenKeys.has(key) || moduleSkillOwner.has(key) || existsSync(join(home, ".agents", "skills", name))) {
+      const other = chosenKeys.get(key) ?? (moduleSkillOwner.has(key) ? `module ${moduleSkillOwner.get(key)}'s skill` : `the existing .agents/skills/${name}`);
+      throw oatsError("E_SKILL_DUPLICATE", `skill "${name}" from ${source} collides with ${other}`);
+    }
     chosen.set(name, { src, source });
+    chosenKeys.set(key, source);
   };
-  // Same enumerator preflight used, so "what a tree promises" and "what gets
-  // copied" cannot drift apart.
-  for (const source of sources) for (const entry of skillEntriesIn(source.path)) offer(entry.name, entry.src, source.id);
-  mkdirSync(join(home, ".agents", "skills"), { recursive: true });
-  mkdirSync(join(home, ".claude"), { recursive: true });
-  for (const [name, selected] of [...chosen].sort(([a], [b]) => a.localeCompare(b))) {
-    // Pi's recursive skill scanner does not descend through directory symlinks.
-    // Copy each selected tree so the exact instance-local set is real and immutable.
-    copyTreeSafe(realpathSync(selected.src), join(home, ".agents", "skills", name));
-  }
-  if (!existsSync(join(home, ".claude", "skills"))) symlinkSync(join("..", ".agents", "skills"), join(home, ".claude", "skills"));
+  // A refusal here comes after materialize populated the home: remove it whole,
+  // like every other failure between materialize and the completeness check.
+  try {
+    // Same enumerator preflight used, so "what a tree promises" and "what gets
+    // copied" cannot drift apart.
+    for (const source of sources) for (const entry of skillEntriesIn(source.path)) offer(entry.name, entry.src, source.id);
+    mkdirSync(join(home, ".agents", "skills"), { recursive: true });
+    mkdirSync(join(home, ".claude"), { recursive: true });
+    for (const [name, selected] of [...chosen].sort(([a], [b]) => a.localeCompare(b))) {
+      // Pi's recursive skill scanner does not descend through directory symlinks.
+      // Copy each selected tree so the exact instance-local set is real and immutable.
+      copyTreeSafe(realpathSync(selected.src), join(home, ".agents", "skills", name));
+    }
+    if (!existsSync(join(home, ".claude", "skills"))) symlinkSync(join("..", ".agents", "skills"), join(home, ".claude", "skills"));
+  } catch (e) { throw rollbackEmptyOrPreparedHome(e); }
 
   // EXPECTED == MATERIALIZED. Preflight proved every declared resource resolves;
   // this proves the copies actually landed, so "the composition is complete" is
@@ -3119,18 +3137,14 @@ function* spawnBody(root, agent, o = {}) {
       if (!chosen.has(name)) incomplete.push(`skill "${name}", promised by ${r.source} (${r.declared}), is missing from the composed set`);
     }
   }
-  // Prepared spawn: every module's declared skill must have been copied under
-  // .agents/skills/<module>/<skill>/ by materialize — verify the copies landed
-  // as readable skills (the module directory alone proves nothing).
+  // Prepared spawn: every module's declared skill must have been copied to
+  // .agents/skills/<skill>/ by materialize — verify the copies landed as
+  // readable skills, one level deep, where the harnesses discover them.
   if (o.prepared) {
-    for (const m of o.prepared.resolution.modules) for (const s of m.manifest.skills || []) {
-      const sk = join(home, ".agents", "skills", m.name);
-      if (!existsSync(sk)) { incomplete.push(`module "${m.name}" declares skills but .agents/skills/${m.name} is absent`); break; }
-    }
     for (const r of expectedResources) {
       if (r.deferred !== "materialize" || r.type !== "skill-tree") continue;
-      if (!r.path) { incomplete.push(`module "${r.module}" declares skill tree ${r.declared} but .agents/skills/${r.module} is absent`); continue; }
-      if (!r.entries.length) incomplete.push(`module "${r.module}" declares skill tree ${r.declared} but no skill was copied under .agents/skills/${r.module}`);
+      if (!r.path) { incomplete.push(`module "${r.module}" declares skill tree ${r.declared} but .agents/skills is absent`); continue; }
+      if (!r.entries.length) incomplete.push(`module "${r.module}" declares skill tree ${r.declared} but none of its skills was copied into .agents/skills`);
       for (const name of r.entries) if (!hasSkillDoc(join(r.path, name))) incomplete.push(`skill "${name}" (module ${r.module}) did not materialize as a readable SKILL.md`);
     }
   }
@@ -3475,7 +3489,7 @@ ${task.trim() ? `\n## Task\n\n${task.trim()}\n` : "\nNo task was provided at spa
     if (triggerEventFile) recipe.env.OATS_TRIGGER_EVENT_FILE = triggerEventFile;
     const cmdline = renderLaunchRecipe(recipe, { home, instance });
 
-    // Module skills as materialize landed them (.agents/skills/<module>/<skill>/),
+    // Module skills as materialize landed them (flat, .agents/skills/<skill>/),
     // beside the soul's own: per-skill provenance `module:<cap>` (lead decision c3),
     // `from` = the home's module copy the skill was copied from.
     const moduleSkills = (materializeOutcome?.skills || []).map((row) => ({ name: row.name, source: `module:${row.module}`, from: join(home, row.from) }));

package/lib/instance-inspect.mjs

@@ -221,7 +221,7 @@ function capabilityRows(t) {
       return { ...op, argv: [m.command ?? null, op.command], available: !reason, reason };
     });
     // composedFrom (feature desktop-facts): where the soul's composition took it from — "workspace" |
-    // "team:<label>" | "soul" (layers-from vocabulary); null for a home (not recorded at spawn). `from` is the module's origin.
+    // "soul" (layers-from vocabulary); null for a home (not recorded at spawn). `from` is the module's origin.
     return { id: name, version: m.version ?? null, layer: m.layer ?? null, command: m.command ?? null, from, composedFrom: t.capabilitiesFrom?.[name] ?? null, dir,
       settings: obj(t.payloads[name]) ? t.payloads[name] : {}, declares: declaredSettings(m), compatibility: compatibilityRow(name, m), missingRequires: missing, operations };
   });

package/lib/instance-resolution.mjs

@@ -5,7 +5,7 @@
  *  its Git remotes in the operator's access context → find the soul among the
  *  confirmed members (or external souls) → resolve every capability by `from:`
  *  (member = latest state, package = the locked version) → materialize
- *  each capability WHOLE into the new home (`.oats/modules/`, `.agents/skills/`) →
+ *  each capability WHOLE into the new home (`.oats/modules/`, skills flat in `.agents/skills/`) →
  *  compose AGENTS.md → launch the harness normally.
  *
  *  This module owns the async half (discover + resolve) and the materialize call;
@@ -24,7 +24,7 @@ import { resolveSoul, kernelCompatibility } from "./resolve.mjs";
 import { BY_TEAM_REMOVED, recordedTeams, reportRows, soulKeyOf, soulTeams, teamModel } from "./teams.mjs";
 import { launchLayers } from "./launch-preference.mjs";
 import { declaredSettings } from "./capability-contract.mjs";
-import { materialize, MODULES_DIR, SKILLS_DIR } from "./materialize.mjs";
+import { materialize, moduleSkills, MODULES_DIR, SKILLS_DIR } from "./materialize.mjs";
 import { fetchRemoteTree } from "./remote.mjs";
 import { mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync, symlinkSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -524,9 +524,11 @@ export function toCapabilityRows(resolution, home) {
   for (const m of resolution.modules) {
     const dir = join(home, MODULES_DIR, m.name);
     const manifest = m.manifest;
-    const skills = [];
-    const skillsRoot = join(home, SKILLS_DIR, m.name);
-    if (existsSync(skillsRoot)) for (const e of readdirSync(skillsRoot, { withFileTypes: true })) if (e.isDirectory()) skills.push(join(skillsRoot, e.name));
+    // Skills are flat under <home>/.agents/skills/<skill>/; which of them this module
+    // contributed is read from its own copy, enumerated exactly as materialize placed them.
+    const skills = existsSync(dir)
+      ? moduleSkills(resolution, m, dir).map((s) => join(home, SKILLS_DIR, s.name)).filter((p) => existsSync(p))
+      : [];
     const inject = manifest.inject ? join(dir, manifest.inject) : undefined;
     rows.push({
       id: m.name, capability: m.name, manifest, layer: manifest.layer ?? undefined, command: manifest.command,
@@ -564,8 +566,12 @@ function requiredHooksOf(manifest) {
   return Object.entries(hooks).filter(([, s]) => s && typeof s === "object" && s.required === true).map(([e]) => e);
 }
 
-/** What a preview shows about modules: from/commit/digest per module and whether
- *  it changed since the newest existing instance of the same soul in `agentsRoot`. */
+/** What a preview shows about modules: from/commit/digest per module, whether
+ *  it changed since the newest existing instance of the same soul in `agentsRoot`,
+ *  and `composedFrom` (feature preview-composed-from): why the soul's composition
+ *  has it — "soul" | "workspace", the resolution's capabilitiesFrom. Provenance
+ *  only: it is outside every fingerprint. `null` only for a resolution without
+ *  capabilitiesFrom (an older in-process caller); never for a resolved module. */
 export function modulesPreview(resolution, agentsRoot, soulName) {
   let previous = null;
   const instancesDir = join(agentsRoot, soulName, "instances");
@@ -583,7 +589,8 @@ export function modulesPreview(resolution, agentsRoot, soulName) {
   return resolution.modules.map((m) => {
     const prev = previous?.modules?.[m.name];
     const changedSince = !previous ? null : !prev ? { instance: previous.name, was: null } : (prev.commit !== m.from.commit ? { instance: previous.name, was: prev.commit } : false);
-    return { name: m.name, from: m.from, layer: m.manifest.layer ?? null, private: !!m.private, declares: declaredSettings(m.manifest), changedSince };
+    return { name: m.name, from: m.from, layer: m.manifest.layer ?? null, private: !!m.private, declares: declaredSettings(m.manifest), changedSince,
+      composedFrom: resolution.capabilitiesFrom?.[m.name] ?? null };
   });
 }
 

package/lib/materialize.mjs

@@ -6,7 +6,9 @@
  * materialize(resolution, home, options)
  *   For every module of the resolution: fetch its capability directory whole into
  *   <home>/.oats/modules/<name>/, verify the copy's content digest, copy its skills as
- *   FULL copies into <home>/.agents/skills/<name>/<skill>/, compose <home>/AGENTS.md
+ *   FULL copies into <home>/.agents/skills/<skill>/ — FLAT, one level deep, where every
+ *   harness discovers them (Claude Code through .claude/skills/<skill>/); skill names are
+ *   unique across the modules (E_SKILL_DUPLICATE) — compose <home>/AGENTS.md
  *   (soul body + each module's inject, same marker comments as the kernel composer),
  *   keep the CLAUDE.md / .claude/skills aliases, and record modules + providers in
  *   <home>/instance.json.
@@ -16,7 +18,7 @@
  * place. Any failure before the commit removes the staging directory and leaves the home
  * exactly as it was (a `.oats/` directory created only for staging is removed too). The
  * commit re-checks the home's shape (no symlink planted at .oats/.agents/.claude or the
- * module targets during the fetch), then runs a short sequence of renames — modules,
+ * module and skill targets during the fetch), then runs a short sequence of renames — modules,
  * skills, AGENTS.md, instance.json, and the CLAUDE.md / .claude/skills aliases — with a
  * rollback journal: should any step fail, everything already placed is undone and the
  * previous AGENTS.md / instance.json restored before a named error (E_MATERIALIZE_HOME)
@@ -205,7 +207,7 @@ function hasSkillDoc(dir) {
 /** The skills a module contributes → [{ name, path }] (path relative to the module root).
  * Precedence: resolution.skills rows for the module; else manifest.skills; else every
  * skills/<dir>/SKILL.md in the fetched tree. */
-function moduleSkills(resolution, module, moduleDir) {
+export function moduleSkills(resolution, module, moduleDir) {
   const declared = (resolution.skills || []).filter((s) => s && s.module === module.name);
   const rows = [];
   if (declared.length) {
@@ -335,13 +337,22 @@ export async function materialize(resolution, home, options = {}) {
   const parents = [join(homeAbs, ".oats"), modulesRoot, join(homeAbs, ".agents"), skillsRoot, join(homeAbs, ".claude")];
   /** The home must still be what we checked: module targets absent, every parent a real directory (or absent).
    * Run before the fetch AND immediately before the commit — a symlink planted in between must not be written through. */
+  // Skill targets are known only once each module is fetched; the commit-time re-check covers them.
+  // skill name, lower-cased → { module, path, name }: one directory per skill, and on a
+  // case-insensitive filesystem `Foo` and `foo` are one directory.
+  const skillOwners = new Map();
   const assertHomeShape = () => {
     for (const { module } of sources) {
-      for (const target of [join(modulesRoot, module.name), join(skillsRoot, module.name)]) {
-        let st = null;
-        try { st = lstatSync(target); } catch {}
-        if (st) throw fail("E_MATERIALIZE_HOME", `${target} already exists — the instance already carries module ${module.name}; materialize never overwrites a module in place`, { home: homeAbs, module: module.name, path: target });
-      }
+      const target = join(modulesRoot, module.name);
+      let st = null;
+      try { st = lstatSync(target); } catch {}
+      if (st) throw fail("E_MATERIALIZE_HOME", `${target} already exists — the instance already carries module ${module.name}; materialize never overwrites a module in place`, { home: homeAbs, module: module.name, path: target });
+    }
+    for (const owner of skillOwners.values()) {
+      const name = owner.name, target = join(skillsRoot, name);
+      let st = null;
+      try { st = lstatSync(target); } catch {}
+      if (st) throw fail("E_MATERIALIZE_HOME", `${target} already exists — the instance already carries a skill named ${name}; materialize never overwrites a skill in place`, { home: homeAbs, module: owner.module, skill: name, path: target });
     }
     for (const p of parents) {
       let st = null;
@@ -378,7 +389,6 @@ export async function materialize(resolution, home, options = {}) {
     mkdirSync(join(staging, "skills"), { recursive: true, mode: 0o755 });
 
     const moduleRows = [], skillRows = [], capabilityBlocks = [], recorded = {};
-    const skillOwners = new Map();
     for (const { module, source } of sources) {
       const stagedModule = join(staging, "modules", module.name);
       const finalModule = join(modulesRoot, module.name);
@@ -412,15 +422,21 @@ export async function materialize(resolution, home, options = {}) {
       }
 
       for (const skill of moduleSkills(resolution, module, stagedModule)) {
-        const owner = skillOwners.get(skill.name);
-        if (owner && owner !== module.name) {
-          throw fail("E_SKILL_DUPLICATE", `skill ${JSON.stringify(skill.name)} is contributed by both ${owner} and ${module.name}`, { name: skill.name, modules: [owner, module.name] });
+        // Skills land flat, so a name is one directory in the home: two sources for one
+        // name — two modules, or two paths of one module — are a duplicate.
+        const key = skill.name.toLowerCase();
+        const owner = skillOwners.get(key);
+        if (owner && owner.module === module.name && owner.path === skill.path && owner.name === skill.name) continue;
+        if (owner) {
+          const detail = owner.module === module.name ? `${module.name} (${owner.path} and ${skill.path})` : `both ${owner.module} and ${module.name}`;
+          const names = owner.name === skill.name ? JSON.stringify(skill.name) : `${JSON.stringify(owner.name)} / ${JSON.stringify(skill.name)} (one directory on a case-insensitive filesystem)`;
+          throw fail("E_SKILL_DUPLICATE", `skill ${names} is contributed by ${detail}`, { name: skill.name, modules: [owner.module, module.name] });
         }
-        skillOwners.set(skill.name, module.name);
+        skillOwners.set(key, { module: module.name, path: skill.path, name: skill.name });
         const src = join(stagedModule, ...skill.path.split("/"));
-        const staged = join(staging, "skills", module.name, skill.name);
+        const staged = join(staging, "skills", skill.name);
         copyTree(src, staged, `${module.name}/${skill.path}`);
-        skillRows.push({ module: module.name, name: skill.name, from: `${MODULES_DIR}/${module.name}/${skill.path}`.split(sep).join("/"), path: join(skillsRoot, module.name, skill.name) });
+        skillRows.push({ module: module.name, name: skill.name, from: `${MODULES_DIR}/${module.name}/${skill.path}`.split(sep).join("/"), path: join(skillsRoot, skill.name) });
       }
 
       for (const rel of moduleInjects(resolution, module, stagedModule)) {
@@ -478,10 +494,8 @@ export async function materialize(resolution, home, options = {}) {
     };
     try {
       for (const p of [join(homeAbs, ".oats"), modulesRoot, join(homeAbs, ".agents"), skillsRoot, join(homeAbs, ".claude")]) mkdirTracked(p);
-      for (const { module } of sources) {
-        placeDir(join(staging, "modules", module.name), join(modulesRoot, module.name));
-        if (existsSync(join(staging, "skills", module.name))) placeDir(join(staging, "skills", module.name), join(skillsRoot, module.name));
-      }
+      for (const { module } of sources) placeDir(join(staging, "modules", module.name), join(modulesRoot, module.name));
+      for (const row of skillRows) placeDir(join(staging, "skills", row.name), row.path);
       swapIn(join(staging, "AGENTS.md"), join(homeAbs, "AGENTS.md"), "AGENTS.md");
       swapIn(join(staging, "instance.json"), instanceFile, "instance.json");
       // Aliases (relative symlinks), only when absent — the canonical-plus-alias construction stays; inside the transaction.

package/lib/packages.mjs

@@ -2,7 +2,7 @@
  * OATS packages — versions, lock v3 (workspace model v2).
  *
  * Contract: docs/design/2026-09-23-workspace-module-contracts.md §4.
- * Decision: agents/oats-expert/soul/knowledge/decisions/workspace-model-v2.md.
+ * Decision: https://github.com/awebai/oats-knowledge/blob/main/knowledge/nodes/oats-expert/decisions/workspace-model-v2.md.
  *
  * A package is a place to fetch from WITH a version attached. Nothing is
  * installed: `resolvePackages` turns each `workspace.packages` entry into an

package/lib/resolve.mjs

@@ -2,7 +2,7 @@
  * lib/resolve.mjs — from a soul to an immutable resolution (module contract §3).
  *
  * Contract: docs/design/2026-09-23-workspace-module-contracts.md §3.
- * Decision: agents/oats-expert/soul/knowledge/decisions/workspace-model-v2.md (6, 12, 14, 16, 19–21).
+ * Decision: https://github.com/awebai/oats-knowledge/blob/main/knowledge/nodes/oats-expert/decisions/workspace-model-v2.md (6, 12, 14, 16, 19–21).
  *
  * `resolveSoul(discovery, soulEntry, options)` turns a discovered soul into the
  * exact set of modules an instance will be built from: which capability comes

package/package-catalog.json

@@ -3,7 +3,7 @@
   "packages": {
     "oats.okf": {
       "url": "https://github.com/awebai/oats-okf.git",
-      "ref": "v4.0.4",
+      "ref": "v4.0.5",
       "path": "oats-package"
     },
     "oats.aweb": {
@@ -28,12 +28,12 @@
     },
     "oats.engineering": {
       "url": "https://github.com/awebai/oats-engineering.git",
-      "ref": "v1.1.0",
+      "ref": "v1.3.0",
       "path": "oats-package"
     },
     "oats.framework": {
       "url": "https://github.com/awebai/oats.git",
-      "ref": "oats-framework/v1.4.0",
+      "ref": "oats-framework/v1.4.1",
       "path": "oats-package"
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.30.0",
+  "version": "0.30.2",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",
@@ -18,7 +18,6 @@
     "check": "node scripts/check-package-dry-runs.mjs --syntax-only",
     "check:pi": "node --experimental-strip-types --check packages/pi/extension/index.ts",
     "validate": "node scripts/validate-project.mjs",
-    "validate:okf": "node scripts/validate-okf.mjs",
     "pack:check": "node scripts/check-package-dry-runs.mjs",
     "smoke:tarball": "node scripts/clean-room-smoke.mjs"
   },
@@ -32,7 +31,6 @@
     "lib/",
     "skills/",
     "injects/",
-    "capabilities/",
     "docs/",
     "README.md",
     "package-catalog.json",

package/skills/oats-getting-started/SKILL.md

@@ -60,8 +60,8 @@ members:
   - git:github.com/acme/agents          # the host is a member too
   - git:github.com/acme/platform
 packages:
-  oats.framework: v1.4.0                # bare versions resolve through the official catalog
-  oats.okf: v4.0.4
+  oats.framework: v1.4.1                # bare versions resolve through the official catalog
+  oats.okf: v4.0.5
 defaults:
   capabilities: { oats.core: { from: package } }
   knowledge: { oats.okf: { from: package } }

package/capabilities/oats-authoring/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 OATS Framework
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/capabilities/oats-authoring/oats-package.json

@@ -1,11 +0,0 @@
-{
-  "package": "oats.authoring",
-  "version": "1.0.3",
-  "description": "Official additive OATS guidance for capability, skill, and soul authoring.",
-  "compatibility": {
-    "oats": ">=0.25.0"
-  },
-  "capabilities": [
-    "."
-  ]
-}

package/capabilities/oats-authoring/oats.json

@@ -1,12 +0,0 @@
-{
-  "capability": "oats.authoring",
-  "version": "1.0.3",
-  "compatibility": { "oats": ">=0.25.0" },
-  "description": "Additive framework-authoring guidance for capability packages, agent skills, and souls.",
-  "requires": [],
-  "skills": [
-    "skills/integration-authoring",
-    "skills/skill-craft",
-    "skills/soul-craft"
-  ]
-}

package/capabilities/oats-authoring/skills/integration-authoring/SKILL.md

@@ -1,84 +0,0 @@
----
-name: integration-authoring
-description: >-
-  Route custom OATS capability-package and integration work to the framework's
-  integrations expert. Use when building, adapting, or debugging a reusable
-  capability, new tasks/messaging/knowledge core capability, oats.json manifest,
-  lifecycle hook, or operational command—not merely activating an existing
-  package. Triggers: "custom integration", "capability package", "integrate
-  our tracker", "new messaging integration", "write an oats.json".
----
-
-# Capability and integration authoring — delegate
-
-A capability package may ship skills, instance instructions, requirements,
-namespaced commands, and declared hooks. A core capability is the constrained
-kind that fills one of the knowledge, messaging or tasks positions (its
-manifest's `layer` field names which). Building either requires
-manifest, security, targeting-boundary, collision, and probe discipline; use
-the framework's **integrations-expert** soul rather than improvising.
-
-If the user only wants an existing package, declare it and give it to souls;
-no build is needed:
-
-```yaml
-# oats-workspace.yaml (host repository): declaring the package is the trust decision
-packages:
-  vendor.review: git:github.com/vendor/review@v1.0.0
-# a soul's soul.yaml, or the workspace defaults: a capability the package exports
-# (a package may export several; the soul names each one it wants)
-capabilities:
-  vendor.review: { from: package }
-```
-
-Then run `oats sync` (fetch, verify integrity, lock). The oats.setup
-capability's **oats-package-pins** skill has the procedure.
-
-## 1. Verify the expert is available
-
-Run `oats souls` in the deployment and confirm it resolves the
-`integrations-expert` soul (a member repository or package provides it). If it
-is absent, ask the human which OATS deployment owns reusable package work;
-never locate or import private kernel files.
-
-## 2. Spawn the expert against the package's repository
-
-The package lives in its own repository. Make that repository a member of the
-workspace (or use the member that already holds it), then spawn the expert on
-it:
-
-```bash
-oats spawn integrations-expert --preview \
-  --purpose <package-slug> \
-  --repo <member clone of the package repository> \
-  --work worktree \
-  --task '<capability intent; layer if any; skills/instructions/commands/hooks; external tools; which souls should get it; distribution path>'
-# review the preview, then run the same command without --preview
-```
-
-Use `--relation child --relative-to <your-instance>` only when the documented
-workflow makes the expert your child; otherwise leave the spawn unrelated. A
-package is distributed from its own repository as `oats-package/` with a
-version tag; a framework contribution belongs in the framework's repository.
-
-## 3. Brief the design boundary
-
-Tell the expert:
-
-- whether it is additive or implements exactly one of knowledge/messaging/tasks;
-- external requirements and executable surfaces (commands, hooks);
-- intended distribution and version/compatibility;
-- which souls or workspace defaults should receive it, and its settings; and
-- expected skill/instruction collisions (a duplicate skill name fails the spawn).
-
-Which souls get a capability is declared by the workspace (`defaults`) and the
-souls (`soul.yaml` `capabilities`), never in the manifest. The expert must
-test exact pi/Claude/Codex instance materialization, generated instructions,
-command gating, deterministic hooks, and the lock's integrity check as
-applicable.
-
-## 4. Hand off
-
-Report the new instance (`oats status`). The expert follows its
-package/integration craft, runs a preview-only probe, and leaves the
-`packages:` pin and the `oats sync` for the user.