@godv61/dsh-task-engine 0.26.1 → 0.27.1

package/lib/dev-task.js

@@ -18,6 +18,7 @@ import { defineTool } from '@deepseek-ai/dsh-tools';
 import { assertAdvance, bindingsForStage, checkFileScope, commitCheckpoint, applyRevision, completionBlockers, formatResourceRef, invalidatedBy, legalTargets, resourceBlockers, newTask, taskIdFromMessage, unmetGuards, validateCommitMessage, validateWorkflow, verificationBlockers, } from "./engine.js";
 import { HIGH_RISK_REQUIRED_CAPABILITIES, flowSatisfies, resolveFlow, } from "./workflows.js";
 import { hashConfig, hashText } from "./snapshot.js";
+import { withUserSkillProfiles } from "./user-skill-profiles.js";
 import { loadedSkills, needsSkillReceipt, obligationStages, skillBlockers } from "./skill-audit.js";
 import { detectRoot, detectType, defaultVerifyCommand, listProjectRules, listProjectSkills, presentGovernanceFiles, } from "./project.js";
 /** Bundled commit-msg hook, copied into `.git/hooks/` by the `install_hook` operation. */
@@ -184,15 +185,23 @@ async function resolveWorkflow(fs, cwd) {
             source: 'invalid',
         };
     }
-    const resolved = resolveFlow(parsed.flow, {
-        flow: parsed.flow,
-        ...(parsed.stage_bindings !== undefined ? { stage_bindings: parsed.stage_bindings } : {}),
-        ...(parsed.skill_profiles !== undefined ? { skill_profiles: parsed.skill_profiles } : {}),
-        ...(parsed.commit !== undefined ? { commit: parsed.commit } : {}),
-        ...(parsed.artifacts !== undefined ? { artifacts: parsed.artifacts } : {}),
-        ...(parsed.review_depth !== undefined ? { review_depth: parsed.review_depth } : {}),
-        ...(parsed.commit_required !== undefined ? { commit_required: parsed.commit_required } : {}),
-    });
+    let project;
+    try {
+        project = withUserSkillProfiles({
+            flow: parsed.flow,
+            ...(parsed.stage_bindings !== undefined ? { stage_bindings: parsed.stage_bindings } : {}),
+            ...(parsed.skill_profiles !== undefined ? { skill_profiles: parsed.skill_profiles } : {}),
+            ...(parsed.commit !== undefined ? { commit: parsed.commit } : {}),
+            ...(parsed.artifacts !== undefined ? { artifacts: parsed.artifacts } : {}),
+            ...(parsed.review_depth !== undefined ? { review_depth: parsed.review_depth } : {}),
+            ...(parsed.commit_required !== undefined ? { commit_required: parsed.commit_required } : {}),
+        });
+    }
+    catch (error) {
+        const standard = standardWorkflow();
+        return { ...standard, problems: [`用户级技能规则档案无法读取：${error instanceof Error ? error.message : String(error)}`], source: 'invalid' };
+    }
+    const resolved = resolveFlow(parsed.flow, project);
     if (!resolved.ok) {
         const standard = standardWorkflow();
         return {
@@ -337,19 +346,6 @@ function readAbsRule(file) {
         return undefined;
     }
 }
-/** The bundled rule files whose contents the frozen tasks' bindings reference. */
-const BUILTIN_RULE_FILES = ['commit-conventions', 'coding-conventions', 'security-redlines'];
-/**
- * Fingerprint of the bundled rules this package ships. A task created now
- * freezes this value; when a later package version ships changed rules, the
- * disclosure reports the drift instead of silently applying new content.
- */
-function builtinRulesFingerprint() {
-    const contents = BUILTIN_RULE_FILES
-        .map(name => readAbsRule(fileURLToPath(new URL(`../rules/${name}.md`, import.meta.url))) ?? '')
-        .join('\n');
-    return hashText(contents);
-}
 /** Read one rule body from a specific layer, so a reference decides where to look. */
 async function readRuleAt(source, name, fs, cwd) {
     const safe = sanitize(name);
@@ -395,17 +391,18 @@ async function readSkillAt(ref, fs, cwd) {
             return read(join(BUNDLED_SKILLS_DIR, safe, 'SKILL.md'));
         case 'project':
             return await readText(fs, '.dsh/skills/' + safe + '/SKILL.md', cwd);
+        case 'codex-project':
+            return await readText(fs, '.agents/skills/' + safe + '/SKILL.md', cwd);
         case 'user':
             return read(join(dshHome(), 'skills', safe, 'SKILL.md'));
     }
 }
 /**
- * Freeze every skill and rule body the config resolves to.
+ * Capture every skill and rule body the config resolves to at task creation.
  *
- * Names alone cannot keep an in-flight task stable: editing a rule that a running
- * task uses would silently change what that task is doing. Each resolved body is
- * copied with its content hash, so a deleted or edited source cannot change a
- * running task, and identical bodies are stored once per hash.
+ * The copy is an audit baseline, not the runtime authority: task interactions
+ * always read the latest body at the same source-qualified reference. Capturing
+ * hashes makes changes visible and rejects an unreadable binding at creation.
  * @param config - the frozen workflow config.
  * @param fs - sandboxed filesystem for project-level lookups.
  * @returns the frozen resources plus the refs that could not be read.
@@ -446,8 +443,8 @@ async function freezeResources(config, fs, cwd) {
  * Resolve a bare legacy rule name to the layer that precedence selects.
  *
  * Precedence, unchanged from before: bundled wins over project, which wins over
- * user. A project cannot shadow a shipped rule like `security-redlines` with a
- * weaker local copy; local additions use distinct names instead.
+ * user. A source-qualified reference identifies the intended body even when
+ * two resource layers use the same name.
  * @param name - the bare rule name from a legacy config.
  * @param fs - sandboxed filesystem for the project-level lookup.
  * @returns the layer that holds this name, or undefined when none does.
@@ -480,10 +477,8 @@ async function resolveLegacyRuleSource(name, fs, cwd, frozen) {
 async function resolveRules(refs, fs, cwd, frozen) {
     const resolved = [];
     const missing = [];
-    // A frozen body is the authority for a task that has one. Freezing used to only
-    // ARCHIVE the content: status and the stage disclosure still read the live files,
-    // so editing a rule silently changed what a running task was told to follow —
-    // the exact instability the snapshot exists to prevent.
+    // Creation-time copies are an audit baseline. The source-qualified reference
+    // remains stable, while its body is read afresh on each interaction.
     const frozenByRef = new Map();
     // Pre-0.26 snapshots have no kind. If such a snapshot reused a skill's ref
     // for a rule, its rule was never frozen; fail closed instead of reading the
@@ -499,25 +494,15 @@ async function resolveRules(refs, fs, cwd, frozen) {
     for (const ref of refs) {
         const key = formatResourceRef(ref);
         const snapshot = frozenByRef.get(key);
-        if (snapshot !== undefined) {
-            resolved.push({ name: ref.name, content: snapshot.content, source: ref.source });
-            // Report when the source no longer matches what was frozen, so drift is
-            // visible instead of looking like the frozen text was simply current.
-            const live = await readRuleAt(ref.source, ref.name, fs, cwd);
-            if (live === undefined)
-                stale.push(key + ' (source deleted)');
-            else if (hashText(live) !== snapshot.hash)
-                stale.push(key + ' (source edited)');
-            continue;
-        }
-        // No snapshot (a pre-freezing task) or this ref was not frozen: read live, and
-        // report a rule that resolves nowhere rather than dropping it, because omitting
-        // it made a deleted file indistinguishable from an unbound one.
         const content = await readRuleAt(ref.source, ref.name, fs, cwd);
         if (content === undefined) {
             missing.push(key);
+            if (snapshot !== undefined)
+                stale.push(key + ' (source deleted)');
             continue;
         }
+        if (snapshot !== undefined && hashText(content) !== snapshot.hash)
+            stale.push(key + ' (source edited)');
         resolved.push({ name: ref.name, content, source: ref.source });
     }
     return { resolved, missing, stale };
@@ -573,20 +558,45 @@ async function rulesForBinding(binding, fs, cwd, frozen) {
         stale: [...stale, ...legacyResult.stale],
     };
 }
-/** Return the task's frozen skill instructions, falling back to live bodies for old tasks. */
-async function skillBodiesForBinding(binding, fs, cwd, frozen) {
+/** Return current skill instructions at each stable source-qualified reference. */
+async function skillBodiesForBinding(binding, fs, cwd) {
     const result = [];
     for (const entry of binding?.skills ?? []) {
-        const key = formatResourceRef(entry.skill);
-        const archived = frozen?.find(resource => (resource.kind === 'skill'
-            || (resource.kind === undefined && resource.content.startsWith('---')))
-            && formatResourceRef(resource.ref) === key);
-        const content = archived?.content ?? await readSkillAt(entry.skill, fs, cwd);
+        const content = await readSkillAt(entry.skill, fs, cwd);
         if (content !== undefined)
             result.push({ name: entry.skill.name, source: entry.skill.source, content });
     }
     return result;
 }
+/** Missing live skill files cannot be satisfied by the creation-time archive. */
+async function missingSkillRefs(binding, fs, cwd) {
+    const missing = [];
+    for (const entry of binding?.skills ?? []) {
+        if ((await readSkillAt(entry.skill, fs, cwd)) === undefined)
+            missing.push(formatResourceRef(entry.skill));
+    }
+    return missing;
+}
+function skillResourceBlockers(missing, stage) {
+    return missing.map(ref => `${stage}: bound skill ${ref} resolves nowhere; restore the file or remove the binding for a new task`);
+}
+async function changedSkillRefs(binding, fs, cwd, baseline) {
+    const changed = [];
+    for (const entry of binding?.skills ?? []) {
+        const key = formatResourceRef(entry.skill);
+        const original = baseline?.find(resource => (resource.kind === 'skill'
+            || (resource.kind === undefined && resource.content.startsWith('---')))
+            && formatResourceRef(resource.ref) === key);
+        if (original === undefined)
+            continue;
+        const live = await readSkillAt(entry.skill, fs, cwd);
+        if (live === undefined)
+            changed.push(key + ' (source deleted)');
+        else if (hashText(live) !== original.hash)
+            changed.push(key + ' (source edited)');
+    }
+    return changed;
+}
 /**
  * Render a stage's progressive-disclosure payload: skill names to load via the
  * `skill` tool, plus the resolved rule bodies to follow. Empty text means the
@@ -603,11 +613,11 @@ async function renderBindings(stage, workflow, fs, cwd, frozen) {
         return '';
     const { resolved: rules, missing, legacy } = await rulesForBinding(binding, fs, cwd, frozen);
     const skillPart = skills.length > 0
-        ? `skills to load: ${skills.map(skill => formatResourceRef(skill.skill)).join(', ')}  (use the skill tool by name)`
+        ? `skills to load: ${skills.map(skill => formatResourceRef(skill.skill)).join(', ')}  (use the skill tool by name; for codex-project skills use dev_task operation=load_skill with the qualified skill_name)`
         : 'skills to load: none';
-    const frozenSkills = await skillBodiesForBinding(binding, fs, cwd, frozen);
-    const skillInstructions = frozenSkills.length > 0
-        ? `skill instructions for this task (frozen at creation when available; these are authoritative if the live skill changed):\n${frozenSkills.map(skill => `### ${skill.source}:${skill.name}\n${skill.content}`).join('\n\n')}`
+    const currentSkills = await skillBodiesForBinding(binding, fs, cwd);
+    const skillInstructions = currentSkills.length > 0
+        ? `current skill instructions for this task (read at this interaction):\n${currentSkills.map(skill => `### ${skill.source}:${skill.name}\n${skill.content}`).join('\n\n')}`
         : '';
     const rulePart = rules.length > 0
         ? `rules in force at this stage (each belongs to the skill shown by the binding):\n${rules.map(r => `### ${r.source}:${r.name}\n${r.content}`).join('\n\n')}`
@@ -617,6 +627,9 @@ async function renderBindings(stage, workflow, fs, cwd, frozen) {
     const missingPart = missing.length > 0
         ? `rules in force at this stage but NOT FOUND in their declared layer: ${missing.join(', ')}`
         : '';
+    const missingSkillPart = skills.length > currentSkills.length
+        ? `bound skills NOT FOUND in their declared layer: ${(await missingSkillRefs(binding, fs, cwd)).join(', ')}`
+        : '';
     // Legacy stage-level rules are disclosed (so nothing is lost) but named as
     // unassigned, because a stage-level list never recorded which skill they were
     // meant for and guessing would invent an answer the config did not contain.
@@ -630,12 +643,12 @@ async function renderBindings(stage, workflow, fs, cwd, frozen) {
     // run something irrelevant.
     const additional = skills
         .filter(entry => entry.evidence === undefined || entry.evidence === 'command')
-        .map(entry => entry.skill.name)
+        .map(entry => entry.skill.source === 'codex-project' ? formatResourceRef(entry.skill) : entry.skill.name)
         .filter(name => needsSkillReceipt(name));
     const receiptPart = additional.length
         ? `additional skills requiring skill_result command receipts: ${additional.join(', ')}`
         : 'no command skill_result receipt required for this stage; other evidence kinds follow their configured stage operations';
-    return [skillPart, skillInstructions, receiptPart, rulePart, missingPart, legacyPart].filter(Boolean).join('\n');
+    return [skillPart, skillInstructions, receiptPart, rulePart, missingPart, missingSkillPart, legacyPart].filter(Boolean).join('\n');
 }
 /** Normalize the tool's `items` argument into complete TaskItem records. */
 function normalizeItems(items, previous = []) {
@@ -759,7 +772,7 @@ export async function approveAdvance(ctx, state, target, workflow, confirmations
         state.solution_confirmed = true;
     return assertAdvance(state, target, workflow);
 }
-const OPERATIONS = ['status', 'create', 'record', 'items', 'scope', 'dispatch', 'review_item', 'advance', 'verify', 'review', 'commit', 'complete', 'revise', 'config', 'install_hook', 'verify_hook', 'init', 'set_risk', 'skill_result'];
+const OPERATIONS = ['status', 'create', 'load_skill', 'record', 'items', 'scope', 'dispatch', 'review_item', 'advance', 'verify', 'review', 'commit', 'complete', 'revise', 'config', 'install_hook', 'verify_hook', 'init', 'set_risk', 'skill_result'];
 const TOOL_DESCRIPTION = 'Own the engineering delivery workflow as hard state. Read or create the task record, record a ' +
     'stage artifact, record each implementation item\'s subagent dispatch and two-stage (spec + quality) ' +
     'review audit (the flow decides how many verdicts per item), advance one stage (rejected unless every configured guard already holds, including ' +
@@ -784,7 +797,7 @@ export function registerDevTask(ctx) {
         parameters: {
             operation: { type: 'string', enum: [...OPERATIONS], required: true, description: 'Which task-record action to perform.' },
             task_id: { type: 'string', description: 'Task id. Omit on status to discover tasks in the current workspace; optionally filter by branch.' },
-            skill_name: { type: 'string', description: 'Bound skill to record after executing it (skill_result): requires prior successful skill load. Command evidence needs a real validation command; manual evidence needs human approval. target_stage may name the upcoming terminal stage.' },
+            skill_name: { type: 'string', description: 'Bound skill to load or record. For a codex-project skill, pass codex-project:name to load_skill and skill_result. Command evidence needs a real validation command; manual evidence needs human approval.' },
             branch: { type: 'string', description: 'Current git branch (recorded on create).' },
             title: { type: 'string', description: 'Task title (create).' },
             work_size: { type: 'string', enum: ['tiny', 'standard', 'complex'], description: 'Workload tier (create).' },
@@ -1000,7 +1013,6 @@ export function registerDevTask(ctx) {
                 state.items = normalizeItems(a.items);
                 state.execution_version = 1;
                 state.files = a.files ?? [];
-                state.bindings_fingerprint = builtinRulesFingerprint();
                 assertInsideRoot(root, cwd ?? '', taskPath(state.id));
                 await writeTask(fs, state, cwd, await resolveWriteMode(ctx, a, exec));
                 return `created ${state.id} at stage ${state.stage}; legal next: ${legalTargets(state.stage, flow.config).join(', ') || 'none'}\n${await renderBindings(state.stage, flow.config, fs, cwd, flow.resources)}\nBefore advance, load all bound skills. Record each skill's declared evidence. Terminal bindings must finish before entering the terminal stage.`;
@@ -1015,9 +1027,28 @@ export function registerDevTask(ctx) {
             if (state.completed !== undefined && a.operation !== 'status' && a.operation !== 'revise') {
                 throw new Error('task is completed; use revise to reopen it before changing task state');
             }
+            if (a.operation === 'load_skill') {
+                const stage = a.target_stage ?? state.stage;
+                if (!obligationStages(state, workflow).includes(stage))
+                    throw new Error(`stage "${stage}" is not currently actionable`);
+                const entry = (workflow.stage_bindings?.[stage]?.skills ?? [])
+                    .find(binding => formatResourceRef(binding.skill) === a.skill_name);
+                if (!entry || entry.skill.source !== 'codex-project')
+                    throw new Error('load_skill requires a bound codex-project:name at the current or upcoming terminal stage');
+                const content = await readSkillAt(entry.skill, fs, cwd);
+                if (content === undefined)
+                    throw new Error(`bound skill ${a.skill_name} cannot be read`);
+                const { resolved, missing } = await resolveRules(entry.rules, fs, cwd, state.flow?.resources);
+                if (missing.length)
+                    throw new Error(`bound rule for ${a.skill_name} cannot be read: ${missing.join(', ')}`);
+                return [`skill: ${a.skill_name}`, `current skill instructions:\n${content}`,
+                    resolved.length ? `rules attached to this skill:\n${resolved.map(rule => `### ${rule.source}:${rule.name}\n${rule.content}`).join('\n\n')}` : 'rules attached to this skill: none'].join('\n\n');
+            }
             if (a.operation === 'status') {
                 const binding = bindingsForStage(state.stage, workflow);
                 const { resolved: rules, missing: missingRules, legacy: legacyRules, stale: staleRules, } = await rulesForBinding(binding, fs, cwd, state.flow?.resources);
+                const missingSkillFiles = await missingSkillRefs(binding, fs, cwd);
+                const changedSkillFiles = await changedSkillRefs(binding, fs, cwd, state.flow?.resources);
                 const missingSkills = skillBlockers(state, workflow, session);
                 const staleEvidence = await evidenceBlockers(fs, state, workflow, cwd);
                 const checkpoint = commitCheckpoint(state, workflow);
@@ -1025,9 +1056,12 @@ export function registerDevTask(ctx) {
                 // one says the receipt no longer matches the tree, the other says the flow
                 // needs a passing verification and does not have one. Callers act on both.
                 const verification = verificationBlockers(state, workflow);
-                const commitBlockers = [...staleEvidence, ...missingSkills, ...verification];
+                const commitBlockers = [...staleEvidence, ...missingSkills,
+                    ...skillResourceBlockers(missingSkillFiles, state.stage), ...verification];
                 const completionIssues = state.completed === undefined
-                    ? [...completionBlockers(state, workflow), ...missingSkills, ...resourceBlockers(missingRules, state.stage), ...staleEvidence]
+                    ? [...completionBlockers(state, workflow), ...missingSkills,
+                        ...skillResourceBlockers(missingSkillFiles, state.stage),
+                        ...resourceBlockers(missingRules, state.stage), ...staleEvidence]
                     : [];
                 return JSON.stringify({
                     id: state.id,
@@ -1043,12 +1077,12 @@ export function registerDevTask(ctx) {
                     items: state.items,
                     skill_obligations: obligationStages(state, workflow).map(stage => {
                         const bindings = workflow.stage_bindings?.[stage]?.skills ?? [];
-                        const skills = bindings.map(entry => entry.skill.name);
+                        const skills = bindings.map(entry => entry.skill.source === 'codex-project' ? formatResourceRef(entry.skill) : entry.skill.name);
                         // Only bindings whose evidence is a command owe a command receipt, so a
                         // document-producing skill is not told to run something irrelevant.
                         const command_receipts_required = bindings
                             .filter(entry => entry.evidence === undefined || entry.evidence === 'command')
-                            .map(entry => entry.skill.name)
+                            .map(entry => entry.skill.source === 'codex-project' ? formatResourceRef(entry.skill) : entry.skill.name)
                             .filter(name => needsSkillReceipt(name));
                         return { stage, skills, command_receipts_required };
                     }),
@@ -1060,12 +1094,15 @@ export function registerDevTask(ctx) {
                     // awaiting an owner. A skill's own list is the complete answer to what it
                     // runs under, and this mirrors that list for the current stage.
                     missing_rules: missingRules,
+                    missing_skills: missingSkillFiles,
+                    changed_source_skills: changedSkillFiles,
                     rules: rules.map(rule => ({ name: rule.name, source: rule.source })),
-                    // Rules whose SOURCE no longer matches what the task froze. The task keeps
-                    // following the frozen text — that is what freezing is for — and this reports
-                    // the drift, so a rule edited or deleted underneath a running task is visible
-                    // instead of silently authoritative.
+                    // Rules that differ from the creation-time audit copy. Edited bodies
+                    // are already in force; deleted sources are reported as missing.
                     stale_source_rules: staleRules,
+                    resource_update_notice: changedSkillFiles.length || staleRules.length
+                        ? 'Skill/Rule source changed since task creation; the current source body is in force. Recheck prior evidence against the updated instructions.'
+                        : undefined,
                     unassigned_legacy_rules: legacyRules,
                     skill_results: state.skill_results ?? {},
                     commits: state.commits,
@@ -1083,16 +1120,13 @@ export function registerDevTask(ctx) {
                         : checkpoint,
                     bindings: {
                         skills: binding?.skills ?? [],
-                        skill_contents: await skillBodiesForBinding(binding, fs, cwd, state.flow?.resources),
+                        skill_contents: await skillBodiesForBinding(binding, fs, cwd),
                         // The layer is disclosed with each rule, because two same-named rules in
                         // different layers are distinct resources and the caller needs to know
                         // which one is actually in force. Reporting only the name made them
                         // indistinguishable in exactly the case where the distinction matters.
                         rules: rules.map(r => ({ name: r.name, source: r.source, content: r.content })),
                     },
-                    bindings_drift: state.bindings_fingerprint !== undefined && state.bindings_fingerprint !== builtinRulesFingerprint()
-                        ? 'bundled rules changed since this task froze — the frozen fingerprint no longer matches the shipped rules'
-                        : undefined,
                     risk_downgrades: state.risk_downgrades ?? [],
                 }, null, 2);
             }
@@ -1152,10 +1186,13 @@ export function registerDevTask(ctx) {
                 // terminal stage has no way out.
                 await assertFreshEvidence(fs, state, workflow, cwd);
                 const missingSkills = skillBlockers(state, workflow, session);
-                const unresolvedRules = (await rulesForBinding(bindingsForStage(state.stage, workflow), fs, cwd, state.flow?.resources)).missing;
+                const currentBinding = bindingsForStage(state.stage, workflow);
+                const missingSkillFiles = await missingSkillRefs(currentBinding, fs, cwd);
+                const unresolvedRules = (await rulesForBinding(currentBinding, fs, cwd, state.flow?.resources)).missing;
                 const blockers = [
                     ...completionBlockers(state, workflow),
                     ...missingSkills,
+                    ...skillResourceBlockers(missingSkillFiles, state.stage),
                     ...resourceBlockers(unresolvedRules, state.stage),
                 ];
                 if (blockers.length > 0)
@@ -1264,6 +1301,10 @@ export function registerDevTask(ctx) {
                     const missingSkills = skillBlockers(state, workflow, session);
                     if (missingSkills.length)
                         throw new Error(missingSkills.join('; '));
+                    const missingSkillFiles = await missingSkillRefs(bindingsForStage(state.stage, workflow), fs, cwd);
+                    const missingSkillIssues = skillResourceBlockers(missingSkillFiles, state.stage);
+                    if (missingSkillIssues.length)
+                        throw new Error(missingSkillIssues.join('; '));
                     // A stage whose rules cannot be resolved must not be passable. This was
                     // reported in status and never enforced, so deleting a bound rule still let the
                     // task advance — the stage ran without the constraints it was configured with
@@ -1365,12 +1406,22 @@ export function registerDevTask(ctx) {
                 }
                 case 'skill_result': {
                     const stage = a.target_stage ?? state.stage;
-                    const entry = (workflow.stage_bindings?.[stage]?.skills ?? []).find(binding => binding.skill.name === a.skill_name);
+                    const entry = (workflow.stage_bindings?.[stage]?.skills ?? []).find(binding => (binding.skill.source === 'codex-project' ? formatResourceRef(binding.skill) : binding.skill.name) === a.skill_name);
                     if (!obligationStages(state, workflow).includes(stage) || !entry)
                         throw new Error('skill_result requires a skill bound to this stage or its upcoming terminal stage');
-                    const loadCall = loadedSkills(session).get(a.skill_name);
+                    if ((await readSkillAt(entry.skill, fs, cwd)) === undefined) {
+                        throw new Error(`bound skill ${formatResourceRef(entry.skill)} resolves nowhere; restore its source before recording a result`);
+                    }
+                    const unresolvedForSkill = (await resolveRules(entry.rules, fs, cwd, state.flow?.resources)).missing;
+                    if (unresolvedForSkill.length > 0) {
+                        throw new Error(`bound rule for ${formatResourceRef(entry.skill)} resolves nowhere: ${unresolvedForSkill.join(', ')}`);
+                    }
+                    const loadKey = entry.skill.source === 'codex-project' ? `${state.id}#${a.skill_name}` : a.skill_name;
+                    const loadCall = loadedSkills(session).get(loadKey);
                     if (!loadCall)
-                        throw new Error(`load skill "${a.skill_name}" successfully before recording execution`);
+                        throw new Error(entry.skill.source === 'codex-project'
+                            ? `load skill "${a.skill_name}" with dev_task operation=load_skill before recording execution`
+                            : `load skill "${a.skill_name}" successfully before recording execution`);
                     if (entry.evidence === 'manual') {
                         if (!a.evidence?.length || a.evidence.some(value => !value.trim()))
                             throw new Error('manual skill_result requires non-empty evidence');