@caupulican/pi-adaptative 0.81.41 → 0.81.43

package/dist/bundled-resources/skills/authorized-web-security-audit/references/assessment-contract.md

@@ -0,0 +1,92 @@
+# Assessment contract
+
+Use this contract before active web or API testing. A missing required field
+keeps the work in Review or Plan mode.
+
+## Scope manifest
+
+```text
+Engagement id:
+Approving owner:
+Written authorization pointer:
+Allowed hosts/CIDRs:
+Allowed schemes/ports:
+Environment:
+Allowed test accounts/roles:
+Explicit exclusions:
+Allowed techniques:
+State-changing probes allowed: no | exact list
+Start/end window:
+Requests/second:
+Concurrency:
+Per-request timeout:
+Per-tool timeout:
+Maximum redirects/body/response/crawl depth:
+Credential source and redaction rule:
+Evidence directory and retention:
+Emergency stop contact:
+Cleanup obligation:
+```
+
+## Admission gate
+
+All answers must be yes before active execution:
+
+- Is authorization explicit, current, attributable, and applicable to this
+  exact target and technique?
+- Does canonical parsing produce an allowed scheme, host, port, and address?
+- Are redirect hops and DNS results revalidated against the same rules?
+- Are private, loopback, link-local, multicast, and metadata destinations
+  denied unless individually approved?
+- Are request rate, concurrency, count, size, depth, and elapsed time bounded?
+- Is the selected tool unable to exceed the manifest through custom input?
+- Are credentials kept outside model context, logs, argv, and reports?
+- Is cancellation wired to sockets, processes, browsers, and child tasks?
+- Will completion or failure emit one terminal event to the owning session?
+- Is a baseline or negative control available for the claimed signal?
+
+## Evidence record
+
+```text
+Candidate id:
+Scope manifest id:
+Hypothesis:
+Security invariant and owner:
+Sanitized request identity:
+Control request identity:
+Observed differential:
+Raw artifact pointer and digest:
+Tool/version/environment:
+Reproduction count:
+Confidence:
+Severity:
+Disposition: confirmed | rejected | incomplete | needs_review
+Reason:
+Regression test:
+Cleanup status:
+```
+
+Never put credentials, session cookies, authorization headers, personal data,
+database contents, private keys, or full sensitive response bodies in this
+record. Store protected raw evidence separately with least-privilege access and
+a retention deadline.
+
+## Safe controls by finding type
+
+| Candidate | Minimum useful control |
+|---|---|
+| Missing endpoint authorization | Distinct low-privilege identity plus nonexistent-object control |
+| Sensitive file exposure | Random path baseline plus expected file-shape validation |
+| Injection | Untainted value plus unique inert marker; require a semantic differential |
+| Timing behavior | Repeated interleaved control/test trials within a strict budget |
+| Open redirect | Same-origin benign destination plus redirect-hop scope validation |
+| SSRF | Approved local fixture or correlated callback; never probe unrelated internal ranges |
+| Rate limiting | Explicit load allowance, low initial rate, recovery observation, hard stop |
+
+## Provenance boundary
+
+FrameSeven commit `2c711dc3a080707daa94d5954e9f4c0e4a726f53` was reviewed
+as an untrusted design input for staged tools, budgets, engagement records, and
+false-positive reduction. This contract is independently written for Pi and
+adds fail-closed authorization, redirect/DNS scope enforcement, tenant-bound
+background lifecycle, secret handling, and stronger evidence requirements.

package/dist/bundled-resources/skills/deduplicate-by-evidence/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: deduplicate-by-evidence
+description: "Detect hidden textual and semantic duplication, harden clone-scanner coverage, centralize real ownership, split duplicated god-unit responsibilities, and gate releases on evidence. Use for deduplication, DRY/refactor work, repeated or scattered rules, copy-paste bugs, oversized files that scanners may skip, cross-layer contract drift, duplicated state transitions, or requests to prove that a codebase has one mandatory implementation path."
+---
+
+# Deduplicate by Evidence
+
+## How to use the skill
+
+Use Detect → Verify → Score → Gate. Treat scanner output as candidate evidence until scope and coverage are proven.
+
+Select the strongest mode authorized by the request:
+
+- **Audit**: inspect without changing files; return an evidence-ranked ownership map.
+- **Enforce**: harden scanner coverage and add a regression gate. Leave the gate failing while real clones remain.
+- **Remediate**: enforce, centralize one bounded clone family, and verify behavior.
+- **Continuous**: repeat bounded green slices until owned production code reaches the agreed zero-clone gate.
+
+Pair production changes with `evidence-gated-tdd`. Preserve provider neutrality: this workflow is Markdown guidance for any Pi agent/model and has no provider-specific metadata or tool assumptions.
+
+## North Star
+
+Prove that every owned production source file is scanned at pinned sensitivity, then move each verified invariant behind one named owner without changing authority, failure semantics, timing, or hot-path cost.
+
+Think before coding, state assumptions and the oracle, prefer the existing owner, make surgical changes, and stop only at verifiable evidence. Humans retain control over credentials, destructive actions, dependency installation, publishing, releases, pushes/tags, authority expansion, and material product decisions.
+
+## Core Sections
+
+### 1. Establish scope and invariants
+
+1. Read repository instructions and inspect worktree state. Preserve unrelated work.
+2. Identify owned production roots, languages, generated sources, vendored code, tests, fixtures, migrations, build output, symlinks, and nested workspaces.
+3. Gate owned production source independently. Audit tests/migrations separately so their volume cannot dilute production findings.
+4. Exclude generated or vendored files only by exact, proven ownership. Keep the generator or upstream license marker as evidence.
+5. Record invariants a refactor must preserve: authority, validation order, atomicity, security boundaries, dependency direction, state transitions, latency, and allocation bounds.
+
+### 2. Prove scanner coverage
+
+Inspect the scanner, wrapper, package scripts, and CI command before trusting a green result. Verify:
+
+- supported extensions and parser failures;
+- candidate-file count versus analyzed-file count;
+- hidden maximum line/byte limits;
+- minimum clone lines/tokens and detection mode;
+- ignore/config inheritance, symlink behavior, and nested-package traversal;
+- whether skipped/oversized/failed files merely warn;
+- whether CI runs the exact local gate.
+
+For jscpd:
+
+1. Prefer an existing repository wrapper such as `npm run check:clones`.
+2. Require pinned jscpd v5 and verify the major version before relying on its Rust-native CLI. Do not silently fall back to the v4 Node engine.
+3. Explicitly configure `maxLines` and `maxSize`; defaults can omit god units. Keep both far above the largest legitimate owned file.
+4. Pin `minLines`, `minTokens`, `mode`, formats, cross-format policy, exact ignores, JSON reporter, and zero threshold in a regression test.
+5. Reconcile every owned candidate with the analyzed count. Account for below-minimum files by exact path and proof that they cannot contain the configured block size.
+6. Keep console projection bounded and retain the complete JSON report out of model context for explicit inspection.
+
+Never make the gate green by raising thresholds, increasing minimum clone size, adding broad ignores, renaming identifiers, or reformatting clone blocks.
+
+### 3. Detect semantic duplication
+
+Search beyond scanner matches for repeated validation, limits, error mappings, state transitions, retry/idempotency loops, authorization, projections, serialization, canonicalization, persistence adapters, provider behavior, and constants with the same meaning.
+
+Do not merge intentionally distinct trust, security, timing, provider, public/private, or failure boundaries. Similar syntax is not proof of shared ownership.
+
+### 4. Verify and classify
+
+For every candidate, record exact locations and behavior, classification, intended owner, divergence risk, and fix direction. Reproduce divergent behavior with a deterministic test and negative control before promoting a scanner/static finding to a confirmed defect.
+
+Prefer a domain-named owner:
+
+- shared engine/kernel for reusable mechanism;
+- provider adapter for unique I/O;
+- protocol/schema package for wire contracts;
+- domain/plugin module for concrete policy;
+- one coordinator for correlated state transitions.
+
+Avoid generic utility dumping grounds and parameter-heavy abstractions.
+
+### 5. Score and remediate
+
+Score verified families 0–3 for divergence likelihood, blast radius, boundary harm, and change confidence. Fix the highest-risk family first, using confidence to bound slice size.
+
+Use evidence-gated TDD:
+
+1. **Red**: preserve the hardened scan and add behavioral/configuration regressions.
+2. **Green**: move the invariant to the lowest authoritative owner and route all callers through it.
+3. **Refactor**: remove replaced paths, aliases, fallbacks, and duplicate transitions in the same migration.
+4. **Focused gate**: run affected tests, type/build checks required by the repository, and the clone scan.
+5. **Release gate**: run the declared broader suite and inspect the report body, diff, and worktree scope.
+
+### 6. Gate and hand off
+
+Do not claim completion until scanner coverage reconciles, the owned production gate reports zero textual clones at pinned sensitivity, verified rules have one owner or tested intentional separation, required tests/checks pass, and unrelated work remains untouched.
+
+Report confirmed-and-fixed families, rejected candidates and why, incomplete probes, scanner coverage, remaining risks, and commit identifiers only when a commit was authorized and created.
+
+## Anti-Patterns
+
+- Trusting a green percentage without proving file coverage.
+- Treating every textual match as one semantic responsibility.
+- Excluding god units because defaults cannot process them.
+- Merging trusted/private and untrusted/public shapes.
+- Hand-editing generated code instead of its generator.
+- Trading duplication for allocations or network expansion on a hot path.
+- Creating a new shared helper while the old paths remain callable.
+- Loading a full clone report into agent context when a bounded index suffices.
+
+## Examples
+
+**Oversized coordinator:** enumerate all production files, raise explicit scanner caps with 2× or greater headroom, add a coverage regression, preserve the red report, then split only verified duplicated responsibilities behind named owners.
+
+**Provider adapters:** two providers share ranking/error/cache policy but differ in transport. Centralize provider-neutral policy while leaving unique I/O in adapters; test both shared behavior and distinct failure semantics.
+
+**Incidental syntax:** two short parsers share a loop shape but enforce different trust boundaries. Retain them separately and record the negative control instead of forcing an abstraction.
+
+## Self-Check
+
+- Owned production scope and languages are explicit.
+- Generated/vendor exclusions have exact proof.
+- Largest line/byte sizes fit with large headroom.
+- Candidate/analyzed counts reconcile without unexplained omissions.
+- jscpd is pinned to v5 Rust with sensitivity/config regression coverage.
+- Every promoted defect has a deterministic reproduction and negative control.
+- One authoritative owner replaces all competing paths.
+- Focused and repository-required gates were inspected, not inferred from exit status.
+- Output is bounded while full evidence remains retrievable.
+- Human authority and unrelated work are preserved.
+
+## Known Gaps
+
+- jscpd proves textual/token overlap, not semantic ownership; deliberate search and behavioral verification remain required.
+- A zero textual-clone result does not prove the absence of structurally equivalent rules written differently.
+- Large legacy clone inventories may require multiple authorized remediation slices; the honest gate remains red meanwhile.

package/dist/bundled-resources/skills/evidence-gated-tdd/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: evidence-gated-tdd
+description: "Build or harden software through a Detect → Verify → Score → Gate TDD workflow. Use when Pi is asked to add regression coverage, reproduce bugs, red-team an owned system, assess scanner/static-analysis findings, prevent false positives, test authority or atomicity, add crash/replay/concurrency tests, or decide whether evidence is strong enough to block a release."
+---
+
+# Evidence-Gated TDD
+
+## How to use the skill
+
+Turn broad findings into deterministic regression gates. Treat detectors, logs, workers, fuzzers, and scanners as hypothesis generators; require independent verification before changing product behavior or declaring a release blocker.
+
+Read [references/evidence-model.md](references/evidence-model.md) when triaging multiple findings or uncertain scanner output. Read [references/security-scanners.md](references/security-scanners.md) before offensive scanning or network fuzzing.
+
+## North Star
+
+Make one observable invariant fail for the suspected reason, prove it with a negative control, fix it at the lowest authoritative owner, and retain the change only when focused and proportional broader gates pass.
+
+Think before coding, surface assumptions and tradeoffs, choose the simplest enforcing boundary, keep changes surgical, and measure the requested outcome. Humans approve credentials, destructive actions, external state-changing probes, dependency installation, publishing, releases, pushes/tags, authority expansion, and material product choices.
+
+## Core Sections
+
+### 1. State the invariant
+
+Define what must always hold, what must never happen, and which boundary owns the rule. Prefer observable authorization, conservation, atomicity, boundedness, ordering, lifecycle, and wire-shape invariants over implementation details.
+
+### 2. Establish the baseline
+
+Run the narrowest existing test or read-only reproduction first. Record exact inputs, outputs, versions, timing, and environment needed to distinguish the defect from existing noise. Characterize unsafe legacy behavior before refactoring it.
+
+### 3. Detect broadly
+
+Use focused code search, static analysis, fuzzing, scanners, logs, property tests, or adversarial inputs to generate candidates. Preserve raw evidence and tool errors outside model context. A successful exit is not proof, and an incomplete scan is not a passing scan.
+
+### 4. Verify independently
+
+1. Add a focused test that fails for the suspected reason.
+2. Add a negative control and, when useful, a baseline/differential comparison.
+3. For stateful systems, exercise stale versions, duplicate requests, concurrency, cancellation, rollback, replay, shutdown, and ambiguous response loss.
+4. For parsers/protocols, exercise size/depth bounds, missing fields, alternate shapes, duplicate keys, unsafe integers, accessors, prototype pollution, and trailing data.
+5. For UI/rendering, combine state assertions with production-shaped interaction or visual evidence.
+6. Reproduce delegated/scanner claims locally before promotion. Use a clean-context verifier only when user/project policy authorizes delegation.
+
+### 5. Score the evidence
+
+Separate confidence from severity. Promote only deterministic or independently reproduced findings to confirmed defects. Keep low-confidence candidates visible without letting them drive speculative changes. Apply the confidence bands in `references/evidence-model.md` when the queue is non-trivial.
+
+### 6. Fix the owning boundary
+
+Centralize the invariant at the lowest reusable owner that can enforce it completely. Keep provider/product policy in its adapter, generic mechanism free of concrete vocabulary, and one mandatory path for state transitions. Remove obsolete fallbacks and compensation paths after replacement is proven.
+
+### 7. Gate the regression
+
+Run the focused reproduction, adjacent tests, then repository-required type, build, duplication, dependency, security, and production-shaped gates in proportion to risk. Review the report body, not only process exit status. Require zero unexplained tool errors or skipped probes. Inspect worktree scope and generated artifacts before any authorized commit.
+
+### 8. Hand off evidence
+
+Report the invariant and root cause, regression and negative-control tests, confirmed/fixed findings, rejected candidates and why, incomplete probes, validation matrix, and remaining risk. Never call a system secure, release-ready, complete, or bug-free from happy-path tests alone.
+
+## Anti-Patterns
+
+- Weakening a failing test to match current behavior.
+- Fixing a scanner match without reproducing its claimed effect.
+- Using sleeps or probabilistic races when deterministic barriers/fault hooks exist.
+- Testing only the first participant or mutation in a multi-step transaction.
+- Asserting success without absence of partial side effects.
+- Treating worker self-report, exit code zero, or a green percentage as trusted proof.
+- Running active security probes outside explicit ownership and authority.
+
+## Examples
+
+**Replay safety:** send one request, replay the exact idempotency key and intent, then reuse the key with different intent. Assert exact replay is inert and intent mismatch fails closed with no additional durable effects.
+
+**Scanner candidate:** preserve the report, reproduce one claimed duplicate rule with a focused behavioral test plus an intentionally different negative control, then centralize only if both blocks own the same invariant.
+
+**Crash atomicity:** inject failure after the penultimate durable mutation, restart, and assert state, versions, journals, events, metrics, and notifications are either entirely committed or entirely absent.
+
+## Self-Check
+
+- The invariant is observable and names its owner.
+- Baseline and failure reason are recorded.
+- Focused regression fails before the fix and passes after it.
+- A negative control rejects the competing explanation.
+- Tool errors, omissions, and skipped probes are counted.
+- The fix is at the lowest authoritative boundary with obsolete paths removed.
+- Focused and proportional broader gates pass and their bodies were inspected.
+- Confirmed, rejected, incomplete, and residual findings are separated.
+- Authority and unrelated work remain unchanged.
+
+## Known Gaps
+
+- Deterministic tests cannot prove every stochastic/provider/environment interaction; report the untested surface.
+- External scanners may have parser and transport blind spots; their output always requires local verification.
+- This skill does not grant authority for destructive or state-changing security tests.

package/dist/bundled-resources/skills/evidence-gated-tdd/references/evidence-model.md

@@ -0,0 +1,27 @@
+# Evidence model
+
+Use confidence to prioritize verification, not to replace it.
+
+| Confidence | Typical evidence | Gate treatment |
+|---:|---|---|
+| 1.00 | Deterministic unauthorized effect, sensitive extraction, corruption, or invariant violation with exact reproduction | Confirmed blocker; add regression immediately |
+| 0.85–0.95 | Repeatable differential result with valid baseline, negative control, and expected response shape | Confirmed unless a documented environment effect explains it |
+| 0.70–0.84 | Repeatable indirect signal, timing result with replay, or production log correlation | Needs focused verification before product changes |
+| 0.40–0.69 | Single detector signal, heuristic static match, or scanner result without a stable control | Candidate; investigate, do not gate yet |
+| 0.00–0.39 | Unverified hypothesis, malformed probe response, generic fallback, or incomplete tool run | Reject or rerun with corrected conditions |
+
+## Verification checklist
+
+- Reproduction is deterministic and bounded.
+- Baseline uses the same endpoint/state except for the tested variable.
+- Negative control does not trigger the signal.
+- Response type/shape matches the target surface rather than a generic fallback.
+- Authentication and tenant/session identity match the claim.
+- Cache, retry, routing, and rate-limit behavior cannot explain the difference.
+- Side effects are measured at the authoritative store or public boundary.
+- Tool errors and skipped probes are counted separately from clean results.
+- The regression test fails before the fix and passes after it.
+
+## Severity is separate
+
+Confidence answers “is it real?” Severity answers “how much can it hurt?” Do not inflate confidence because impact would be large, and do not dismiss a high-confidence defect because current impact appears small.

package/dist/bundled-resources/skills/evidence-gated-tdd/references/security-scanners.md

@@ -0,0 +1,24 @@
+# Security scanner adapter
+
+## Before running
+
+- Confirm ownership or explicit authorization for the exact target.
+- Prefer a local isolated server with disposable state and a dedicated port.
+- Pin the scanner release and verify its published checksum when downloading a binary.
+- Read tool descriptions and identify probes that change state.
+- Start non-destructively. Enable destructive/active mode only when the user explicitly includes those effects.
+- Bound concurrency, request count, per-request timeout, and whole-tool timeout.
+- Use a distinctive authorized-test User-Agent when the protocol supports it.
+
+## During and after running
+
+- Keep server logs and scanner reports together as evidence.
+- Treat connection failures, timeouts, skipped tools, missing dependencies, and report-render failures as an incomplete run.
+- Inspect structured findings; do not equate exit code zero with no findings.
+- Reproduce each material finding with a focused project-owned test and negative control.
+- Check common false positives: generic application fallbacks, catch-all routes, static assets, authentication redirects, cache-busting parameters, proxy-generated errors, and local HTTP runs missing production transport policy.
+- Rerun the focused scanner probe after the fix, then run the local regression suite.
+
+## Tool-specific notes
+
+Treat any tool-specific exit-code, authentication, or active-scan behavior as unstable external API. Verify it against the pinned tool’s first-party documentation before use. Never infer permission for state-changing probes from general filesystem or network access.

package/dist/bundled-resources/skills/harness-self-adaptation/SKILL.md

@@ -26,7 +26,8 @@ Choose one mode before acting:
 
 Load the narrow specialist when the candidate enters its domain. In particular,
 use `pi-harness-learning` for after-action classification and durable learning,
-`skill-architect` when authoring instructions, `tool-call-repair` for model tool
+`skill-architect` when designing instructions, `skill-creator` when packaging a
+Pi skill, `tool-call-repair` for model tool
 argument/protocol failures, and `source-grounded-docs` for codebase documentation.
 This skill owns the adaptation loop, not those domain procedures.
 
@@ -290,7 +291,8 @@ record it only under the granted scope. A transient formatting correction remain
 **Successful repeatable workflow**
 
 Two tasks benefit from the same non-obvious review sequence. Audit existing
-skills first. If no existing owner fits, use `skill-architect` to create one
+skills first. If no existing owner fits, use `skill-architect` to design one and
+`skill-creator` to scaffold and validate it
 narrow skill with an oracle and known gaps; otherwise refine the existing skill.
 
 ## Self-Check

package/dist/bundled-resources/skills/secure-agent-tool-surfaces/SKILL.md

@@ -0,0 +1,217 @@
+---
+name: secure-agent-tool-surfaces
+description: "Threat-model, build, review, and red-team AI-agent tools, MCP servers/clients, extensions, background workers, memory, and multi-agent boundaries. Use when adding tool authority, external connectors, process/filesystem/network access, remote transports, persistent state, delegated work, or when investigating prompt injection, tool poisoning, SSRF, tenant crossover, replay, credential leakage, or excessive agency."
+---
+
+# Secure Agent Tool Surfaces
+
+## How to use the skill
+
+Use this skill for agent-facing execution and data boundaries. It is not an
+offensive-testing grant. Pair implementation with `evidence-gated-tdd` and use
+`authorized-web-security-audit` before active network probing.
+
+**Freedom Dial: High Freedom.** Threat modeling and boundary selection require
+judgment; identity, capability, tenant, input, egress, secret, lifecycle, and
+evidence rules are mandatory gates.
+
+Read [references/tool-boundary-checklist.md](references/tool-boundary-checklist.md)
+when designing or reviewing a tool. Read
+[references/defensive-exploit-catalogue.md](references/defensive-exploit-catalogue.md)
+when building a threat model or adversarial regression matrix.
+
+## North Star
+
+Treat the model as an untrusted planner and every external result as untrusted
+data. Enforce authority in deterministic host code so no prompt, tool
+description, result, memory entry, delegated message, resumed event, or provider
+can grant itself capability, cross a session tenant, disclose secrets, or widen
+network/process/filesystem reach.
+
+Think before coding, prefer a small capability over a broad filter, change the
+lowest authoritative owner, prove behavior with adversarial tests, and keep
+humans at credentials, destructive/irreversible actions, external publication,
+authority expansion, and material security decisions.
+
+## Core Sections
+
+### 1. Draw trust and authority boundaries
+
+Inventory principals and data flows:
+
+- human owner, foreground agent, delegated agent, session tenant, tool host,
+  extension, MCP client/server, provider, external service, and storage;
+- trusted instructions versus untrusted user/repository/web/tool/worker content;
+- capabilities for filesystem paths, commands, network destinations, secrets,
+  memory, durable state, notifications, and external mutations;
+- where identity is established, narrowed, persisted, resumed, and revoked.
+
+Represent authority as immutable host-owned data. The effective grant is the
+intersection of user approval, session role, tool profile, current host policy,
+resource ownership, and operation-specific scope. Text cannot add to it.
+
+### 2. Enforce session and principal isolation
+
+Every live task, shell/coordinator process, background lane, event queue,
+notification, credential view, memory write, and temporary artifact belongs to
+one session tenant by default. Same directory, process, account, or MCP server
+does not imply shared authority.
+
+Use opaque unpredictable identifiers plus an owner identity derived from a
+trusted channel. Bind every read, mutation, resume, cancellation, delivery, and
+cleanup to both. Do not use a session id alone as authentication. Reject stale,
+replayed, out-of-order, duplicate, cross-user, and cross-session messages before
+side effects. Make idempotency keys bind operation intent, principal, and scope.
+
+Delegation only narrows authority. A worker cannot create workers, mutate global
+settings/memory, acquire credentials, or expand tools unless the owner explicitly
+granted that exact capability and policy allows it.
+
+### 3. Validate tool contracts at one choke point
+
+Use typed, versioned input and output schemas. Canonicalize once, then validate:
+
+- reject unknown fields where ambiguity is dangerous;
+- cap strings, arrays, nesting, decoded bytes, files, results, and fan-out;
+- handle duplicate keys, unsafe integers, accessors, prototype keys, alternate
+  encodings, Unicode/path normalization, trailing data, and decompression ratio;
+- distinguish shape repair from semantic decisions; never invent authority,
+  paths, destinations, credentials, or intent;
+- bind tool identity and schema hash at approval and re-check on change to catch
+  tool-description/schema rug pulls and shadowing.
+
+Keep policy out of model-visible descriptions. A description may explain a
+capability, but only host code may authorize it.
+
+### 4. Constrain filesystem, process, and network effects
+
+Filesystem operations use canonical, symlink-safe handles rooted in an approved
+workspace or resource capability. Validate the final opened object, not only the
+input path. Deny credential, state, auth, and cross-tenant paths by default.
+
+Process tools prefer direct executable plus argument arrays. Do not interpolate
+model text into a shell. If a shell is the declared capability, keep a bounded
+grammar, explicit working directory/environment, process-tree cancellation,
+output limits, and no implicit privilege escalation.
+
+For network tools, prevent SSRF with established URL/IP libraries, destination
+allowlists, HTTPS in production, redirect-hop validation, DNS pinning or
+revalidation, and default denial of private, loopback, link-local, multicast,
+and metadata ranges. An explicit local-development grant may allow loopback;
+never let arbitrary web content select that exception. Strip credentials on
+origin changes and constrain egress independently of prompt policy.
+
+### 5. Harden MCP and extension transports
+
+Prefer stdio for local MCP servers and display the exact executable/arguments
+for human approval before first launch. Pin and review dependencies, manifests,
+tool schemas, and updates as executable supply-chain input. Sandbox local
+servers with the smallest filesystem, environment, process, and network access.
+
+For Streamable HTTP:
+
+- bind local servers to loopback by default;
+- authenticate every connection and validate token issuer, audience, expiry,
+  scopes, and principal; never use token passthrough;
+- validate `Origin` on every incoming connection and reject invalid origins;
+- bind session state and resumable events to the authenticated principal;
+- prevent cross-node event injection and cross-stream replay;
+- use TLS outside an explicitly local development boundary;
+- expose health endpoints without tool authority or sensitive diagnostics.
+
+Tool-list changes, schema changes, reconnects, and resumed streams require the
+same trust decision as a new tool. Never silently inherit newly advertised
+capabilities.
+
+### 6. Contain untrusted results, memory, and secrets
+
+Parse a tool's structured result against a bounded schema and label all content
+as untrusted result data before model ingestion. It cannot override system/user
+intent, authorize another tool, request secret access, change policy, or become
+durable memory without an independent host-owned gate.
+
+Keep secrets in a model-blind store. Inject only into the authorized adapter at
+execution time, redact stdout/stderr/errors/telemetry, and block secret-bearing
+values from URLs, argv, prompts, reports, caches, and worker handoffs.
+
+Memory writes require provenance, tenant, category, size, sensitivity, and
+authority checks. Repository text, web pages, tool results, and worker claims do
+not become trusted instructions or global/user memory. Compact and index data
+without erasing its trust label or owner.
+
+### 7. Make lifecycle bounded and auditable
+
+Every call has admission, running, terminal, canceled, and failed states with
+one coordinator. Long work moves to a session-owned background lane; completion
+is event-driven, persists a bounded handoff, and notifies only the owning parent
+session. Never poll output merely to discover completion or inject a late result
+into an unrelated active transcript.
+
+Enforce request, cost, token, CPU, memory, output, recursion, retry, concurrency,
+and wall-time budgets. Cancellation reaches descendants and durable state.
+Shutdown/reload must fence stale generations and close files, sockets, browsers,
+workers, and subprocess trees.
+
+Log identities, decisions, hashes, counts, and protected artifact pointers—not
+secrets or raw sensitive bodies. Audit failures must fail closed for mutations.
+
+### 8. Red-team and gate
+
+For every privileged boundary, add a focused regression and negative control.
+Exercise prompt/tool injection, schema rug pulls, name shadowing, malformed and
+oversized values, path aliases/symlinks, redirects and DNS rebinding, replay,
+duplicate/out-of-order events, cancellation at each phase, crash/restart,
+cross-session access, worker escalation, secret-bearing errors, and unbounded
+loops/fan-out.
+
+Verify absence of partial side effects. A green model response, tool exit code,
+or scanner label is not proof. Gate on deterministic host behavior and inspect
+the evidence body for skipped probes and errors.
+
+## Anti-Patterns
+
+- Relying on a system prompt to enforce permissions.
+- Treating a tool description, annotation, or `destructiveHint` as access control.
+- Sharing one process, queue, cache, memory namespace, or credential view across sessions.
+- Accepting bearer tokens for the wrong audience or forwarding them downstream.
+- Exposing an unauthenticated HTTP tool server, even on loopback, without Origin checks.
+- Passing raw tool output into trusted instructions or durable memory.
+- Validating a path before following symlinks or a URL before redirects/DNS use.
+- Letting timeout, disconnect, or session disposal stand in for cancellation.
+- Hiding full evidence in model context or logging secrets for debugging.
+
+## Examples
+
+**Poisoned tool result:** an external search result says to read a credential
+file and upload it. The result remains labeled data; host UAC denies the file and
+egress operations, and no memory write occurs. A regression asserts all three.
+
+**Two sessions in one workspace:** each receives a distinct coordinator,
+background namespace, event stream, and credential capability. Guessing or
+replaying the other session's task id returns not found without revealing
+existence.
+
+**Remote MCP server:** the HTTP listener uses TLS, authentication, audience and
+scope validation, an Origin allowlist, principal-bound sessions, bounded tools,
+and egress policy. A valid session token from another user is a negative control.
+
+## Self-Check
+
+- Every capability is host-owned, explicit, least privilege, and session-bound.
+- Delegation and resume can only preserve or reduce authority.
+- Inputs, outputs, paths, destinations, redirects, schemas, and tool identities are bounded.
+- Stdio/HTTP transport protections match the exposure.
+- Secrets remain model-blind and redacted from every failure path.
+- Untrusted results and memory retain provenance and cannot become instructions.
+- Background completion is event-driven and owner-session scoped.
+- Cancellation, crash, reload, replay, and cross-tenant tests cover side effects.
+- Focused regressions and negative controls pass with no skipped security probes.
+
+## Known Gaps
+
+- No schema or content filter can perfectly detect instruction-like text; hard
+  capability isolation remains required.
+- Application-specific authorization and data-classification policy must be
+  supplied by the product owner.
+- This skill cannot establish that a third-party server or package is benign;
+  provenance review, sandboxing, and runtime containment are still necessary.