@hasna/skills 0.10.75 → 0.10.77

package/README.md

@@ -80,7 +80,11 @@ Stations provisioned with a fleet key keep using the internal gateway
 no recorded URL (the Keychain item, `HASNA_SKILLS_API_KEY` alone, or an older
 credentials file) always stays on that gateway and is never sent anywhere else.
 The gateway has no interactive login service, so on such a station
-`skills login` says so, sends nothing, and names the credential to unset first.
+`skills login` says so and sends nothing. A stored gateway credential or vault
+reference is preserved even with `--url`. Use a separate credential profile for
+customer sign-in: `skills --profile skillsmd login`. Later product commands use that
+profile too, for example `skills --profile skillsmd whoami --json`; fleet
+commands keep their original configuration.
 Obtain a workspace API key through your administrator's provisioning process
 and configure it using the [credential resolution](#credentials) below. Check
 the selected identity and available capabilities before syncing:
@@ -882,8 +886,25 @@ handshake alone does not establish those semantics. Admitting a release does not
 admit its corpus: the transport still requires the existing native corpus
 admission (see `docs/codex-corpus-writers.md`).
 
+Upstream Codex builds that lack `corpus-admission-inspect`, such as 0.160.0 and
+0.162.1, use an interim fallback instead: an exclusive Skills-owned lock at
+`<realpath(dirname(codex home))>/.hasna/skills/codex-corpus-locks/`, outside the
+Codex home and independent of data-root overrides, recorded as
+`nativeAdmission: "unavailable"` with the probe record in every receipt. The
+probe record identifies the selected executable file (for npm installs, the
+launcher script), not the vendor binary it starts. Its guarantee is weaker.
+Upstream Codex's own refresh writes are not coordinated with that lock, only
+Skills writers exclude each other, and preimage checks refuse only the races they
+detect. For a project-level `.codex`, or a symlinked `~/.codex`, the lock lives
+under the target's parent, such as `<project>/.hasna/skills/codex-corpus-locks/`;
+ignore that folder there. Probes run with a fresh, Skills-created `CODEX_HOME` in
+`<Skills data root>/codex-probe-homes/`, removed after each probe.
+The fallback is retired in the first release after the Harnesses
+enrollment/inspect route is live for that build line.
+
 The capture refuses an existing output file, writes mode `0600`, verifies the
-exact bytes, and reports only version, directory, count, file path and SHA-256.
+exact bytes, and reports only version, directory, count, file path and SHA-256,
+plus the admission record when the interim fallback applies.
 Its safe catalog shape is `{version,cwd,skills,plugins}`; skills have
 `{name,path,enabled,pluginId}` and plugins have
 `{id,name,installed,enabled,localVersion}`. Older reviewed catalogs without
@@ -3301,6 +3322,6 @@ membership too; an executable digest does not prove dynamic backend behavior or
 native adoption. These captures read files and never launch a native consumer.
 
 
-Codex cache witnesses migrate separately through `skills hook rebind-cache --agent codex`. Preview requires the exact current policy and configuration SHA-256 values. Name each reviewed remote app-only parent with `--app-only-parent`; name each already reviewed native `mcp_tool` parent with `--reviewed-hook-parent`. Hook parents require exact enrolled manifest and hook bytes. When the owning installer created a remote-install receipt, its exact schema, identity and bytes are required. A local marketplace install with no receipt is accepted only when the exact full marketplace source is already enrolled and the unchanged Codex settings enable that exact plugin identity. The complete cache census refuses unknown parents, cache-member aliases, new skills, direct hooks selecting cache inputs, and changed app/MCP/hook/receipt or marketplace capabilities. Reviewed whole Codex root aliases keep their existing identity/CAS guards; hook selection through either the alias or canonical cache path is refused. Commands containing the direct `plugins/cache` selector are conservatively refused, including HOME, tilde and relative spellings; no shell evaluation is performed. App-only bootstrap verifies the old full manifest and receipt sources, then explicitly reviews current app capabilities; it does not claim those app bytes were historically witnessed.
+Codex cache witnesses migrate separately through `skills hook rebind-cache --agent codex`. Preview requires the exact current policy and configuration SHA-256 values. Name each reviewed remote app-only parent with `--app-only-parent`; name each already reviewed native `mcp_tool` parent with `--reviewed-hook-parent`. Hook parents require exact enrolled manifest and hook bytes. When the owning installer created a remote-install receipt, its exact schema, identity and bytes are required. A local marketplace install with no receipt is accepted only when the exact full marketplace source is already enrolled and the unchanged Codex settings enable that exact plugin identity. The complete cache census refuses unknown parents, cache-member aliases, new skills, direct hooks selecting cache inputs, and changed app/MCP/hook/receipt or marketplace capabilities. It also refuses every capability location Codex reads in a plugin version root that the witness does not bind (the Agent Plugins root `plugin.json`, `.claude-plugin` and `.cursor-plugin` manifests, a root `hooks.json`, `commands/` and `agents/` directories, and a skill document not spelled exactly `SKILL.md`), compared without regard to case; the vendor-refresh guard reads the same list. A semantic binding captured by an earlier release is checked against this census at every guard run, so one of these paths makes it refuse until a fresh discovery review. Reviewed whole Codex root aliases keep their existing identity/CAS guards; hook selection through either the alias or canonical cache path is refused. Commands containing the direct `plugins/cache` selector are conservatively refused, including HOME, tilde and relative spellings; no shell evaluation is performed. App-only bootstrap verifies the old full manifest and receipt sources, then explicitly reviews current app capabilities; it does not claim those app bytes were historically witnessed.
 
 Review the returned semantic cache digest, then repeat with `--expected-cache-witness-sha256 <digest> --apply`. The owning apply path preserves/readbacks the original policy, recomputes the whole plan, compares policy/config/cache preimages, writes only the Skills policy, and verifies the resulting consumer. Historical directory hashes and source rows remain retained as provenance; this command cannot reconstruct an unavailable old directory tree or waive an ancestor directory containing unrelated inputs. Equivalent version materializations and inert assets then leave the new Codex-specific witness unchanged. Every other discovery source, directory, settings witness, native control and session pin stays under its existing contract. Settings and cache upgrades remain independent; neither silently repairs drift in the other.