@ccoalm/ccl-skills 0.13.0 → 0.15.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/SKILL.md

@@ -87,28 +87,23 @@ The shared skill never pins a provider or model. Kimi inherits the user's local
 
 Client discovery is separate from model ownership. For Kimi, the wrapper accepts an absolute executable `KIMI_BIN`; otherwise it checks `PATH`, then `$KIMI_CODE_HOME/bin/kimi` when configured, then the standard `~/.kimi-code/bin/kimi` location. The resolved executable must be absolute and executable before the wrapper changes directory. This avoids treating a non-interactive shell's narrower `PATH` as proof that Kimi is not installed, honors a custom Kimi home, and avoids relative-PATH drift in the temporary workspace; it does not change the user's model/provider settings. An executable PATH selection keeps normal shell precedence; use `KIMI_BIN` to bypass a broken executable shim explicitly.
 
-The Claude provider wrapper implements help inspection, built-in tool availability restriction, safe-mode customization isolation, strict empty MCP configuration, empty user/project/local setting sources, CLAUDE.md and auto-memory disabling, repository directory scoping with `--add-dir`, consult dirty-worktree fail-closed checks, prompt-only consult for pasted evidence, temp prompt file permissions and cleanup, Python subprocess capture without putting diff content on argv, structured JSON parsing, schema validation, timeout handling, auth false-negative classification, and the two-invocation cap. Runs without selected owner skills disable skills/commands. Owner-aware runs load the already-installed CCL skill plugin through `--plugin-dir` and explicitly invoke each selected skill; they do not manufacture a selected-only plugin or claim that unselected installed skills are unavailable. Claude's own built-in identifiers and all skills present in the controller-supplied registry may remain visible in stream init; only selected owners are frozen-hash verified and counted as explicit invocation. The parser rejects entries outside that registered surface or duplicate identifiers and keeps tools/MCP isolated. For review/challenge it also accepts the orchestrator's frozen `--diff-file` and emits stable `reason_code`, `fallback_eligible`, and `next_action` fields on every inconclusive path. Every mode captures Claude with structured stream JSON and adds `--json-schema` when the CLI advertises it; `parse_review_json.py` unwraps the result event's structured payload and rejects any envelope whose `is_error`, `subtype`, `api_error_status`, or `permission_denials` fields signal a non-clean run. `classify_envelope.py` reads those same structured fields to classify auth/quota/permission/error failures, so raw-text matching on the CLI's prose is only a fallback for the case where no JSON envelope was produced. On an auth false negative the wrapper returns `auth_path_unavailable`; a host rerun of the same gate adds `--host-remediation-attempted`. `--timeout` controls each formal invocation and must be an integer of at least 5 seconds; values above 1200 are clamped to 1200. The wrapper does not make a separate behavior-probe request. The formal invocation's own stream-init must declare exactly the expected tool set: packet-only modes allow only Claude's internal `StructuredOutput` tool when schema output is enabled, while repository consult additionally allows `Read,Grep,Glob`. Unexpected tool use, MCP inheritance, or schema drift fails closed. `--allowedTools` is a permission auto-approval rule, not an availability restriction, and is never used as the sandbox. The wrapper deliberately never runs `claude auth status` through command substitution, because that path can itself report a false logged-out state on this machine.
-
-Owner-aware Claude init must declare the `ccl-skills` plugin. Current public
-init output does not enumerate selected plugin skills or commands, so the wrapper
-binds those through frozen package hashes and explicit names in the prompt instead
-of manufacturing an unavailable observation. Other skills from the verified
-installed registry may remain visible. Plugin registration proves the native
-entrypoint was loaded; it does not prove that the model read a skill body. When
-init begins enumerating ccl-registry skills or `ccl-skills:` commands,
-every selected owner must appear or the run fails closed; built-ins alone do not
-imply plugin enumeration.
-
-Owner-aware Claude requires `--safe-mode` plus the explicit `--plugin-dir`.
-Safe mode disables ambient customizations while the explicit plugin supplies the
-full installed skill registry, and it preserves the user's normal OAuth/keychain
-authentication path. The wrapper must not add `--bare`: that flag disables OAuth
-and keychain reads and makes a normally logged-in CLI unusable without a separate
-API key.
-Before loading the installed plugin, the wrapper validates that its manifest
-exposes only the native `./skills` entrypoint and no top-level agents, commands,
-hooks, or MCP servers. A broader plugin manifest is capability-ineligible for
-this bounded lane and fails closed before Claude starts.
+The Claude provider wrapper implements help inspection, built-in tool availability restriction, safe-mode customization isolation, strict empty MCP configuration, empty user/project/local setting sources, CLAUDE.md and auto-memory disabling, repository directory scoping with `--add-dir`, consult dirty-worktree fail-closed checks, prompt-only consult for pasted evidence, temp prompt file permissions and cleanup, Python subprocess capture without putting diff content on argv, structured JSON parsing, schema validation, timeout handling, auth false-negative classification, and the two-invocation cap. Runs without selected owner skills pass `--disable-slash-commands` when the CLI offers it. Owner-aware runs load the installed CCL skill plugin through `--plugin-dir` and explicitly invoke each selected skill; they never manufacture a selected-only plugin. If that registry is absent, older than the profile, or unloadable, the run still reviews without owner skills and reports `native_skill_binding=unavailable`. Init's command, skill, and plugin lists are vocabulary the parser never judges; tools, MCP, and permission mode are the isolation proof. For review/challenge it also accepts the orchestrator's frozen `--diff-file` and emits stable `reason_code`, `fallback_eligible`, and `next_action` fields on every inconclusive path. Every mode captures Claude with structured stream JSON and adds `--json-schema` when the CLI advertises it; `parse_review_json.py` unwraps the result event's structured payload and rejects any envelope whose `is_error`, `subtype`, `api_error_status`, or `permission_denials` fields signal a non-clean run. `classify_envelope.py` reads those same structured fields to classify auth/quota/permission/error failures, so raw-text matching on the CLI's prose is only a fallback for the case where no JSON envelope was produced. On an auth false negative the wrapper returns `auth_path_unavailable`; a host rerun of the same gate adds `--host-remediation-attempted`. `--timeout` controls each formal invocation and must be an integer of at least 5 seconds; values above 1200 are clamped to 1200. The wrapper does not make a separate behavior-probe request. The formal invocation's own stream-init must declare exactly the expected tool set: packet-only modes allow only Claude's internal `StructuredOutput` tool when schema output is enabled, while repository consult additionally allows `Read,Grep,Glob`. Unexpected tool use, MCP inheritance, or schema drift fails closed. `--allowedTools` is a permission auto-approval rule, not an availability restriction, and is never used as the sandbox. The wrapper deliberately never runs `claude auth status` through command substitution, because that path can itself report a false logged-out state on this machine.
+
+Owner-aware Claude binds the selected owners through frozen package hashes
+against the installed registry and explicit names in the prompt, and loads that
+plugin through `--plugin-dir`; that is what `native_skill_binding=established`
+attests. Public init output is not read for the binding, and neither receipt
+proves the model read a skill body.
+
+Owner-aware Claude requires `--safe-mode`; `--plugin-dir` is added only when the
+installed registry verifies against the profile and its manifest exposes only
+the native `./skills` entrypoint (no top-level agents, commands, hooks, or MCP
+servers), otherwise the run attests `native_skill_binding=unavailable` without
+it. Safe mode disables ambient customizations, including a loaded plugin's
+hooks, while the explicit plugin supplies the installed skill registry, and it
+preserves the user's normal OAuth/keychain authentication path. The wrapper must
+not add `--bare`: that flag disables OAuth and keychain reads and makes a
+normally logged-in CLI unusable without a separate API key.
 
 ```bash
 # Set this to the expanded code-review skill directory shown in the
@@ -296,13 +291,13 @@ substitute raw provider commands for review/challenge. Do not repeat host
 remediation, and only tell the user to log in again when the host/local auth path
 also reports logged out.
 
-Tool-boundary invariants are defined under **Harness Exclusion** above. Missing built-in, customization, skill/command, MCP, setting-source, CLAUDE.md, or auto-memory isolation is inconclusive; `--allowedTools` never substitutes for `--tools`. Prompt wording and `--add-dir` are not filesystem sandboxes.
+Tool-boundary invariants are defined under **Harness Exclusion** above. Missing built-in tool, MCP, setting-source, safe-mode, CLAUDE.md, or auto-memory isolation is inconclusive; `--allowedTools` never substitutes for `--tools`. Prompt wording and `--add-dir` are not filesystem sandboxes.
 
 For the numbered auth-recovery procedure, runtime classification detail, per-mode flag matrix, `--no-session-persistence`/model-pinning notes, and the CLI capability adoption policy (`--safe-mode`, `--bare`, `--output-format json`, `--fallback-model`, `--max-budget-usd`), see `references/timeout-auth-and-capabilities.md`.
 
 ## Reviewer Client Routing
 
-`review_gate.sh` owns the handoff. It preserves mode, packet hash, attribution, permission boundaries, timeout, native skill binding, and parseable verdict semantics across the configured client order. Availability, auth/quota/timeout, capability, and malformed-model-output failures may continue only when the wrapper marks them candidate-local; security, binding, family, mode, input, egress, and unknown failures stop. Kimi is uniformly attributed to Moonshot, seeds a private writable runtime home from the validated user configuration inputs while linking any existing validated credential directories back to their user-owned paths so OAuth token rotation persists for homes that already have one (a replaced or missing link after the run is terminal `binding_mismatch`), and keeps the user's default model while running from a temporary workspace; it registers the installed skill directory through controlled `--skills-dir`, explicitly names selected owners, and must cover the exact packet through bounded contiguous `Read` pages before a verdict is eligible. Codex is uniformly attributed to OpenAI, receives the packet over stdin, verifies that each selected owner package exists with a safe package shape in its installed skill system, invokes it with `$skill-name`, and runs read-only/ephemeral without manufacturing a temporary skill tree. A newer installed CCL release is accepted by selected name rather than byte equality with an older candidate branch. An exact sandbox-only in-process app-server `EPERM` requests one same-packet host retry before it can become fallback-eligible. Neither client is subdivided by local provider/model aliases, and neither wrapper passes `--model`. Any packet-external tool activity invalidates those results. OpenCode registers the controller-supplied installed registry through project `skills.paths`, explicitly sets `permission.skill: allow`, and uses its public `debug agent` and session export surfaces; only selected owners are frozen-hash verified. It never reads the private session database. Its actual exported provider/model remains the dynamic family binding. A successful owner-aware wrapper must return `native_skill_binding=established`; without that controller-owned receipt, the gate does not populate `reviewed_skills` or claim native invocation. None of the four client paths makes a separate model behavior-probe request. If the owning workflow requires review AND challenge, each lane still needs its own valid result. Load `references/client-routing.md` for details.
+`review_gate.sh` owns the handoff. It preserves mode, packet hash, attribution, permission boundaries, timeout, native skill binding, and parseable verdict semantics across the configured client order. Availability, auth/quota/timeout, capability, and malformed-model-output failures may continue only when the wrapper marks them candidate-local; security, binding, family, mode, input, egress, and unknown failures stop. Kimi is uniformly attributed to Moonshot, seeds a private writable runtime home from the validated user configuration inputs while linking any existing validated credential directories back to their user-owned paths so OAuth token rotation persists for homes that already have one (a replaced or missing link after the run is terminal `binding_mismatch`), and keeps the user's default model while running from a temporary workspace; it registers the installed skill directory through controlled `--skills-dir`, explicitly names selected owners, and must cover the exact packet through bounded contiguous `Read` pages before a verdict is eligible. Codex is uniformly attributed to OpenAI, receives the packet over stdin, verifies that each selected owner package exists with a safe package shape in its installed skill system, invokes it with `$skill-name`, and runs read-only/ephemeral without manufacturing a temporary skill tree. A newer installed CCL release is accepted by selected name rather than byte equality with an older candidate branch. An exact sandbox-only in-process app-server `EPERM` requests one same-packet host retry before it can become fallback-eligible. Neither client is subdivided by local provider/model aliases, and neither wrapper passes `--model`. Any packet-external tool activity invalidates those results. OpenCode registers the controller-supplied installed registry through project `skills.paths`, explicitly sets `permission.skill: allow`, and uses its public `debug agent` and session export surfaces; only selected owners are frozen-hash verified. It never reads the private session database. Its actual exported provider/model remains the dynamic family binding. A successful owner-aware wrapper must attest the binding: `native_skill_binding=established` populates `reviewed_skills` and records native explicit invocation; `native_skill_binding=unavailable` (registry or plugin unusable, packet reviewed without owner skills) keeps the verdict with `controller-profile` skill evidence and no natively reviewed skills; a wrapper attesting neither fails closed. None of the four client paths makes a separate model behavior-probe request. If the owning workflow requires review AND challenge, each lane still needs its own valid result. Load `references/client-routing.md` for details.
 
 Across all four clients, `native_skill_binding=established` means the wrapper
 verified the controller profile and selected-name arguments, established a safe

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/client-routing.md

@@ -193,38 +193,38 @@ operators bypass a broken executable shim with explicit `KIMI_BIN`.
 
 ## Client Tool Boundaries
 
-Claude owner-aware review takes a bounded host-vocabulary baseline before the
-formal invocation. The baseline uses the same resolved Claude executable with
-an independent empty working directory and no tools, plugins, MCP servers,
-settings, workspace instructions, custom commands, agents, or user skills. Its
-model result is ignored; only the init event is used. The wrapper also requires
-the installed CLI's own `--safe-mode` help contract to state that skills are
-disabled; if an upgrade removes that contract, this lane refuses and may
-cascade instead of treating user vocabulary as host vocabulary. The formal
-init may reuse unique whole-string baseline commands only when each name is
-either bare or an already pinned built-in with a non-bare spelling, and both
-events report the same CLI version. Baseline-reported skills never grant
-formal-run authority: a new skill remains fallback-eligible until it is pinned
-as a reviewed built-in or selected by the controller. `terminal_slash_commands`
-must be a unique plain-string subset of the declared slash commands.
-
-The baseline and formal invocation share one caller-granted timeout budget.
-Baseline elapsed time, including validation, is deducted before the formal
-call; if no whole second remains, the Claude lane reports a fallback-eligible
-timeout instead of extending the controller deadline.
-
-The baseline never weakens the executable boundary. Any baseline tool, plugin,
-MCP server, permission change, malformed entry, or unknown non-empty surface
-invalidates the lane. The formal invocation still rejects tools, authority
-drift, namespaced customizations, and host names absent from its baseline. A
-version mismatch or an unbaselined bare host identifier refuses this Claude
-lane but may cascade as unverified capability drift; a proven tool, authority,
-or customization breach remains terminal.
-Owner-free review disables slash commands and does not need this probe. Routine
-Claude built-in command changes therefore do not require a repository allowlist
-update. A new skill, tool, authority mode, or unreviewed schema may still make
-the Claude lane unavailable by design because those surfaces can carry
-capability rather than display-only vocabulary.
+Claude makes no separate probe or baseline invocation: the formal invocation,
+retried at most once on a non-conforming envelope, is the only model call, and
+its stream init proves isolation: the exact expected `tools` set, no
+tool_use outside it, an empty `mcp_servers` list, and a pinned
+`permissionMode`. The `slash_commands`, `terminal_slash_commands`, `skills`,
+and `plugins` lists are host and plugin vocabulary, recorded and never judged:
+nothing listed there is invocable past the pinned tool set, so a new built-in
+shipped by a CLI release, an installed plugin's other entries, or an unfamiliar
+spelling changes nothing about the verdict. The wrapper requires the
+`--safe-mode` flag to exist and passes it; it does not parse the flag's help
+prose. `--disable-slash-commands` is passed when the CLI offers it and no
+plugin is loaded, as tidiness rather than a prerequisite.
+
+Owner-skill binding is best effort. When the controller selected owner skills,
+the wrapper verifies the installed CCL registry against the profile and loads
+the plugin through `--plugin-dir`; a run that did so reports
+`native_skill_binding=established`. When the registry is absent, older, or
+fails verification, or the CLI cannot load a skills-only plugin, the wrapper
+still reviews the packet without owner skills and reports
+`native_skill_binding=unavailable`, which the controller records as
+`controller-profile` skill evidence with no natively reviewed skills. A
+profile that names no owners yet fails its own consistency check, or owner
+arguments without a profile, remain caller errors.
+
+A declared or invoked tool outside the expected set, an MCP server, or a
+permission mode outside `default`/`plan` invalidates the lane and stays
+terminal; schema drift in an unknown non-empty container or an unverifiable
+authority knob refuses this Claude lane but may cascade as capability drift.
+Routine built-in command or skill changes in a CLI release require no
+repository update. A new tool, authority mode, or unreviewed schema may still
+make the lane unavailable by design, because those surfaces can carry
+capability rather than vocabulary.
 
 Kimi retains the user's credentials and ordinary provider/model settings by
 seeding a private writable runtime home from the validated source home. Session,

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/manual-invocation-and-prompts.md

@@ -32,20 +32,22 @@ CLAUDE_CODE_DISABLE_CLAUDE_MDS=1 CLAUDE_CODE_DISABLE_AUTO_MEMORY=1 claude --prin
 
 Use a temporary prompt file for construction, then invoke Claude through the wrapper. The wrapper feeds the prompt through its controlled stdin/subprocess path so diff and source content do not appear in process argv. On this machine, ad hoc shell stdin redirection, command substitution, redirecting Claude stdout/stderr to files, and sandboxed subprocess capture can produce false `Not logged in` results even while local OAuth auth works; do not call `claude --print < "$PROMPT_FILE"` or `out=$(claude ...)` for review evidence. If capture fails this way and local auth is logged in, the wrapper's only allowed recovery is to rerun the same wrapper command from a host/escalated path (optionally with `--direct`), which still writes the Claude envelope to a temp file and accepts only parser-valid review JSON. For consult (tool-enabled) runs, run Claude from `<REPO_ROOT>` and pass `--add-dir <REPO_ROOT>` as workspace context; review and challenge run no-tools and pass no `--add-dir`, seeing only the diff packet. Either way, do not add `$HOME`, the skill directory, or parent source trees for ordinary product reviews. Do not embed attacker-controlled diff or file content directly in a heredoc; a line containing only the delimiter terminates the heredoc early. Backticks and `$...` inside double quotes or unquoted heredocs can execute in the caller shell before Claude sees the prompt. Single quotes are acceptable only for short prompts without apostrophes.
 
-Before running any mode, inspect `claude -p --help`. The required boundary flags are `--safe-mode`, `--tools`, `--strict-mcp-config`, `--mcp-config`, `--setting-sources`, `--output-format`, and `--verbose`; repository consult also requires `--permission-mode` and `--add-dir`. Runs without selected owner skills require `--disable-slash-commands`; owner-aware runs require controlled `--plugin-dir` instead. `--tools` restricts built-in availability, while `--allowedTools` only auto-approves matching tools and leaves other tools available, so the latter is never a substitute. Review, challenge, and prompt-only consult use `--tools ""`; repository consult uses `--tools Read,Grep,Glob`. Every mode disables inherited customizations, CLAUDE.md, and auto memory and supplies strict empty MCP and setting-source configuration; owner-aware review/challenge loads the verified installed CCL plugin and explicitly invokes the selected skills by name. Preflight must declare the exact tool set; schema-enabled main may add only the internal `StructuredOutput` tool, while schema-less main remains stream-validated without it. Runtime init may list the audited Claude built-ins plus any skill registered by that verified CCL plugin. Unknown or duplicate entries, an unknown plugin, missing fields, and schema drift fail closed; registry or built-in changes require an explicit update. The stream has no applied-setting-source or hook inventory, so `--setting-sources ""` is capability/argv checked under the CLI contract but cannot be independently runtime-attested; a CLI defect that ignores it and managed policy hooks remain residual host risks. The disable-memory environment variables are defense in depth behind required safe mode. Managed settings policy, including policy-configured hooks, and authentication/model/global state remain host-owned inputs. Choose prompt-only only when the needed evidence was already gathered by Codex/codegraph, the repository is not safely available to Claude, or the question is intentionally evidence-only. If the question is answerable from a repository Claude may read, use repository consult with the correct `--cwd` and keep `--extra` to trusted operator scope instead of pasted low-trust excerpts. The final JSON's `status`, `consult_scope`, and `tool_identity` are wrapper-injected coverage markers; if they are absent, treat the consult result as inconclusive. `parse_review_json.py` validates Claude's raw structured output before wrapper metadata injection and intentionally rejects wrapper-final identity/scope fields; do not re-feed the final wrapper JSON into that parser as pass evidence. Do not use permission allow-rules or a denylist as the primary availability boundary. Append `--no-session-persistence` only after confirming help lists it. If exact built-in, customization, command, MCP, settings, memory, or runtime-init isolation is unavailable, fail closed; switch to prompt-only only when its own no-tool boundary is supported and the pasted evidence is sufficient.
-
-For owner-aware Claude runs, public init must register the `ccl-skills`
-plugin. Current init does not enumerate selected plugin skills or commands; the
-wrapper instead verifies their frozen package hashes and explicitly names them
-in the prompt. Other skills from the verified installed registry may remain
-visible. Plugin registration is binding evidence, not proof that the model read
-the skill body. If init begins enumerating ccl-registry skills or
-`ccl-skills:` commands, every selected owner must appear or the run fails
-closed; built-in entries alone do not imply plugin enumeration.
-
-Owner-aware Claude must receive `--safe-mode` alongside the explicit
-`--plugin-dir`. Safe mode disables ambient customizations while the explicitly
-loaded installed plugin supplies the full skill registry. Do not add `--bare`:
+Before running any mode, inspect `claude -p --help`. The required boundary flags are `--safe-mode`, `--tools`, `--strict-mcp-config`, `--mcp-config`, `--setting-sources`, `--output-format`, and `--verbose`; repository consult also requires `--permission-mode` and `--add-dir`. Runs without selected owner skills pass `--disable-slash-commands` when the CLI offers it; owner-aware runs load the installed CCL plugin through `--plugin-dir` when the CLI and the installed registry allow it, and otherwise review without owner skills and report `native_skill_binding=unavailable`. `--tools` restricts built-in availability, while `--allowedTools` only auto-approves matching tools and leaves other tools available, so the latter is never a substitute. Review, challenge, and prompt-only consult use `--tools ""`; repository consult uses `--tools Read,Grep,Glob`. Every mode disables inherited customizations, CLAUDE.md, and auto memory and supplies strict empty MCP and setting-source configuration; owner-aware review/challenge loads the verified installed CCL plugin and explicitly invokes the selected skills by name. Preflight must declare the exact tool set; schema-enabled main may add only the internal `StructuredOutput` tool, while schema-less main remains stream-validated without it. Runtime init may list any commands, skills, and plugins: those lists are vocabulary, never judged, and a CLI release or plugin that adds names to them changes nothing. Only the exact tool set, tool use, the empty MCP list, the pinned `permissionMode`, and schema drift in unknown non-empty containers decide, and they fail closed. The stream has no applied-setting-source or hook inventory, so `--setting-sources ""` is capability/argv checked under the CLI contract but cannot be independently runtime-attested; a CLI defect that ignores it and managed policy hooks remain residual host risks. The disable-memory environment variables are defense in depth behind required safe mode. Managed settings policy, including policy-configured hooks, and authentication/model/global state remain host-owned inputs. Choose prompt-only only when the needed evidence was already gathered by Codex/codegraph, the repository is not safely available to Claude, or the question is intentionally evidence-only. If the question is answerable from a repository Claude may read, use repository consult with the correct `--cwd` and keep `--extra` to trusted operator scope instead of pasted low-trust excerpts. The final JSON's `status`, `consult_scope`, and `tool_identity` are wrapper-injected coverage markers; if they are absent, treat the consult result as inconclusive. `parse_review_json.py` validates Claude's raw structured output before wrapper metadata injection and intentionally rejects wrapper-final identity/scope fields; do not re-feed the final wrapper JSON into that parser as pass evidence. Do not use permission allow-rules or a denylist as the primary availability boundary. Append `--no-session-persistence` only after confirming help lists it. If exact built-in tool, MCP, settings, memory, safe-mode, or runtime-init isolation is unavailable, fail closed; switch to prompt-only only when its own no-tool boundary is supported and the pasted evidence is sufficient.
+
+For owner-aware Claude runs, the wrapper verifies the selected owners' frozen
+package hashes against the installed registry, loads that plugin through
+`--plugin-dir`, and explicitly names the owners in the prompt; that is what
+`native_skill_binding=established` attests. What init enumerates for the
+plugin, if anything, is not read. When the installed registry cannot be
+verified or the plugin cannot be loaded, the run proceeds without owner skills
+and attests `native_skill_binding=unavailable`. Neither receipt is proof that
+the model read a skill body.
+
+Owner-aware Claude must receive `--safe-mode`; `--plugin-dir` is added only on
+the established binding path (verified registry, skills-only manifest),
+otherwise the run attests `native_skill_binding=unavailable` without it. Safe
+mode disables ambient customizations, including a loaded plugin's hooks, while
+the explicitly loaded installed plugin supplies the full skill registry. Do not add `--bare`:
 it disables OAuth/keychain authentication and makes a normally logged-in CLI
 unusable unless a separate API key is injected. Do not emulate the registry with
 a selected-only plugin directory.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/staged-review-contract.md

@@ -90,10 +90,12 @@ and their frozen hashes. They verify that binding, use the already-installed
 CCL skill registry through each client-native mechanism, and explicitly
 name the selected owners: Claude `--plugin-dir`, Kimi `--skills-dir`, OpenCode
 `skills.paths`, or Codex `$skill-name`. Skill bodies are never copied into the
-review profile or prompt. A client unable to establish this native binding is
-ineligible for the owner-aware lane. Each successful owner-aware wrapper adds a
-post-parse `native_skill_binding=established` receipt; absence fails closed
-before the controller claims usage. Receipt injection itself is part of the
+review profile or prompt. Each successful owner-aware wrapper adds a
+post-parse `native_skill_binding` receipt: `established` when the owners were
+natively bound, or `unavailable` when the wrapper reviewed the packet without
+owner skills because the installed registry or plugin could not be used (the
+Claude wrapper degrades this way rather than refusing). A receipt saying
+neither fails closed before the controller claims usage. Receipt injection itself is part of the
 trusted wrapper path: a local serialization or output failure is terminal
 `local_tool_failure`, never an empty or apparently successful result. After a
 valid verdict, `reviewed_skills` contains only the selected owners passed
@@ -104,19 +106,15 @@ Codex, an independently updated installed package must exist and pass the same
 safe-package validation, but its bytes need not equal an older candidate
 branch; `$skill-name` binds the selected identity. The frozen source hash still
 binds controller routing and review-chain reuse, not the host release version.
-For Claude, the public init surface must register the `ccl-skills` plugin while
-the wrapper separately verifies the selected package hashes and explicitly
-names the owners. Current init does not enumerate the selected plugin skills or
-commands; plugin registration is binding evidence, not proof that the model
-read a skill body. If init begins enumerating ccl-registry skills or
-`ccl-skills:` commands, every selected owner must appear in those lists or
-the wrapper fails closed; built-in entries alone do not imply plugin enumeration.
-An owner name that collides with an audited Claude built-in is not representable
-on this surface and is rejected before a binding receipt.
-`skill_usage_evidence` records
-native explicit invocation with `observed=false`; only a public client
-event/export may populate `observed_skill_usage`. Reviewer prose and private
-client databases do not count as observation evidence.
+For Claude, the wrapper verifies the selected package hashes against the
+installed registry, loads that plugin through `--plugin-dir`, and explicitly
+names the owners; what the public init surface enumerates is vocabulary and is
+not read. Loading the plugin is binding evidence, not proof that the model read
+a skill body. `skill_usage_evidence` records native explicit invocation with
+`observed=false` after an `established` receipt and `controller-profile` after
+an `unavailable` one; only a public client event/export may populate
+`observed_skill_usage`. Reviewer prose and private client databases do not
+count as observation evidence.
 
 For every client, `native_skill_binding=established` means the wrapper verified
 the frozen selected packages and emitted that client's native explicit-invocation
@@ -127,15 +125,15 @@ This binding check also applies to direct wrapper calls. If a native-installed
 profile selects owners but the matching registry root or owner arguments are
 omitted, every wrapper returns terminal `binding_mismatch` before inference.
 
-Owner-aware Claude requires `--safe-mode` with the explicit `--plugin-dir`, so
-ambient customizations stay disabled while the full installed plugin supplies
-skills and normal OAuth/keychain authentication remains available. The wrapper
-must not add `--bare`, because that flag disables the ordinary OAuth/keychain
-path and turns a logged-in CLI into an auth failure unless a separate API key is
-injected.
-The Claude wrapper also validates the installed plugin manifest before launch:
-its skills entrypoint must be `./skills`, and top-level agents, commands, hooks,
-or MCP servers make the plugin ineligible for this bounded review lane.
+Owner-aware Claude requires `--safe-mode`; `--plugin-dir` is added only when
+the installed registry verifies and the plugin manifest exposes only the
+`./skills` entrypoint, so ambient customizations stay disabled while the
+installed plugin supplies skills and normal OAuth/keychain authentication
+remains available; otherwise the run proceeds without owner skills and attests
+`native_skill_binding=unavailable`. The wrapper must not add `--bare`, because
+that flag disables the ordinary OAuth/keychain path and turns a logged-in CLI
+into an auth failure unless a separate API key is injected. A manifest declaring
+top-level agents, commands, hooks, or MCP servers is not loaded.
 
 Wrappers keep an explicit selected-owner count instead of testing empty Bash
 arrays under `set -u`, preserving the no-owner lane on Bash 3.2.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/AGENTS.md

@@ -16,6 +16,17 @@ Rules:
   or empty-container, and `agents`/`capabilities` are list-of-strings checks
   with no value vocabulary. Only `permissionMode` stays value-pinned (it widens
   what the runtime may do with no tool added).
+- **Skill, command and plugin lists are vocabulary, not a boundary.**
+  `slash_commands`, `terminal_slash_commands`, `skills` and `plugins` may hold
+  any value and are never judged by name, shape, or origin; only `mcp_servers`
+  must still be empty. A third attempt at a vocabulary boundary -- a snapshot
+  of the host's own built-in names, later backed by a baseline invocation --
+  turned every CLI release that shipped a new skill or command into a Claude
+  lane outage. Do not add a name list, a baseline, or an "unclassifiable entry"
+  class back; nothing in those lists is invocable past the pinned `tools` set.
+  The same holds for the installed CCL plugin: an absent or unverifiable
+  registry costs the owner-skill binding (`native_skill_binding=unavailable`),
+  never the review.
 - **Keep unsafe *values* out of the schema-drift class.** An unrecognized shape
   means this lane cannot verify isolation → fallback-eligible. A known field
   carrying an unsafe value (`permissionMode: "bypassPermissions"`) is a breached