@phuetz/code-buddy 2.0.0 → 2.1.0

package/dist/agent/self-improvement/skill-engine.js

@@ -5,12 +5,18 @@
  *
  * @module agent/self-improvement/skill-engine
  */
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { evaluateSkillBehavior } from './skill-behavior-gate.js';
+import { SKILL_BEHAVIOR_TASKS } from './skill-behavior-benchmark.js';
 import { EvolutionaryArchive } from './evolutionary-archive.js';
 import { resolveAutonomy } from './engine.js';
 import { PendingProposalStore } from './proposal-store.js';
+import { SkillApplyJournal } from './skill-apply-journal.js';
 import { validateSkillProposal } from './skill-gate.js';
-import { LiveSkillMutator } from './skill-mutator.js';
+import { ensureFrontmatter, isAuthoredSkillName, LiveSkillMutator } from './skill-mutator.js';
 export class SkillImprovementEngine {
+    evaluateBehavior;
     scenarios;
     proposer;
     mutator;
@@ -18,27 +24,64 @@ export class SkillImprovementEngine {
     autonomy;
     now;
     proposals;
+    applyJournal;
+    workDir;
+    readInstalledSkill;
     covered = new Set();
     attempted = new Set();
     constructor(options) {
         this.scenarios = options.scenarios;
+        this.evaluateBehavior = options.evaluateBehavior ?? ((content, id) => evaluateSkillBehavior(content, SKILL_BEHAVIOR_TASKS[id] ?? []));
         this.proposer = options.proposer;
-        this.mutator = options.mutator ?? new LiveSkillMutator();
         this.archive = options.archive ?? new EvolutionaryArchive({ workDir: options.workDir });
+        this.workDir = options.workDir ?? this.archive.workDir;
+        this.mutator = options.mutator ?? new LiveSkillMutator(path.join(this.workDir, '.codebuddy', 'skills'));
         this.autonomy = options.autonomy ?? resolveAutonomy();
         this.now = options.now ?? (() => new Date());
-        this.proposals = options.proposalStore ?? new PendingProposalStore({ workDir: options.workDir });
+        this.proposals = options.proposalStore ?? new PendingProposalStore({ workDir: this.workDir });
+        this.applyJournal = options.applyJournal ?? new SkillApplyJournal({ workDir: this.workDir, now: this.now });
+        this.readInstalledSkill = options.readInstalledSkill ?? ((name) => this.mutator.readInstalled?.(name) ?? null);
     }
     async runCycle() {
         const startedAt = this.now().toISOString();
         const base = { kind: 'skill_improvement_cycle', startedAt, autonomy: this.autonomy };
+        const pendingPeek = this.peekPendingRecords();
+        if (!pendingPeek.ok) {
+            return {
+                ...base,
+                selectedScenarioId: null,
+                proposalId: null,
+                gate: null,
+                applied: false,
+                notes: ['apply journal unreadable; refusing to install', pendingPeek.error],
+            };
+        }
+        if (this.autonomy !== 'auto-apply') {
+            const pending = pendingPeek.records[0];
+            if (pending) {
+                return {
+                    ...base,
+                    selectedScenarioId: pending.scenarioId,
+                    proposalId: pending.proposalId,
+                    gate: null,
+                    applied: false,
+                    applyPhase: pending.phase,
+                    notes: ['pending skill apply requires auto-apply; not installed'],
+                };
+            }
+        }
+        else {
+            const resumed = this.resumePending(base, pendingPeek.records);
+            if (resumed)
+                return resumed;
+        }
         for (const scenario of this.scenarios) {
             if (this.covered.has(scenario.id) || this.attempted.has(scenario.id))
                 continue;
             if (this.autonomy === 'auto-apply') {
                 const pending = this.proposals.loadSkill(scenario.id);
                 if (pending) {
-                    const appliedPending = this.finishCycle(base, scenario, pending.proposal, true);
+                    const appliedPending = await this.finishCycle(base, scenario, pending.proposal, true);
                     if (appliedPending.applied)
                         this.proposals.remove('skill', scenario.id);
                     return appliedPending;
@@ -76,10 +119,26 @@ export class SkillImprovementEngine {
         }
         return results;
     }
-    finishCycle(base, scenario, proposal, keepOnAccept) {
+    async finishCycle(base, scenario, proposal, keepOnAccept) {
+        let gate = validateSkillProposal(proposal, scenario, this.mutator, { keepOnAccept: false });
+        let behavior;
+        if (gate.accepted && keepOnAccept) {
+            const content = proposal.spec.content;
+            try {
+                behavior = await this.evaluateBehavior(content, scenario.id);
+            }
+            catch (error) {
+                behavior = { accepted: false, wins: 0, losses: 0, tested: 0, cases: [], error: error instanceof Error ? error.message : String(error) };
+            }
+            if (content !== proposal.spec.content)
+                behavior = { ...behavior, accepted: false, error: 'Proposal changed during behavioral validation' };
+            if (!behavior.accepted) {
+                this.attempted.add(scenario.id);
+                return { ...base, selectedScenarioId: scenario.id, proposalId: proposal.id, gate: { ...gate, accepted: false, reasons: ['Behavioral validation did not demonstrate a gain without regression'] }, behavior, applied: false, notes: [behavior.error ?? 'No verified behavioral improvement; proposal not installed'] };
+            }
+            return this.settleApplication(base, scenario, proposal, behavior, gate);
+        }
         this.attempted.add(scenario.id);
-        const gate = validateSkillProposal(proposal, scenario, this.mutator, { keepOnAccept });
-        const applied = gate.accepted && !!gate.appliedRef;
         if (gate.accepted && !keepOnAccept) {
             this.proposals.saveSkill({
                 scenarioId: scenario.id,
@@ -88,8 +147,181 @@ export class SkillImprovementEngine {
                 gate,
             });
         }
-        if (applied) {
-            this.covered.add(scenario.id);
+        return {
+            ...base,
+            selectedScenarioId: scenario.id,
+            proposalId: proposal.id,
+            gate,
+            applied: false,
+            notes: gate.reasons,
+            ...(behavior ? { behavior } : {}),
+        };
+    }
+    peekPendingRecords() {
+        try {
+            return { ok: true, records: this.applyJournal.listPending() };
+        }
+        catch (error) {
+            return { ok: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    resumePending(base, pending) {
+        const record = pending.find((item) => !this.attempted.has(item.scenarioId));
+        if (!record)
+            return null;
+        const scenario = this.scenarios.find((item) => item.id === record.scenarioId);
+        if (!scenario) {
+            return {
+                ...base,
+                selectedScenarioId: record.scenarioId,
+                proposalId: record.proposalId,
+                gate: null,
+                applied: false,
+                notes: ['pending apply scenario is missing; not installed'],
+            };
+        }
+        const identityError = savedIdentityMismatch(record, scenario, record.proposal);
+        if (identityError) {
+            this.attempted.add(scenario.id);
+            return {
+                ...base,
+                selectedScenarioId: scenario.id,
+                proposalId: record.proposalId,
+                gate: null,
+                applied: false,
+                applyPhase: 'conflict',
+                notes: [identityError],
+            };
+        }
+        const coverage = validateSkillProposal(record.proposal, scenario, this.mutator, { keepOnAccept: false });
+        if (!coverage.accepted) {
+            this.attempted.add(scenario.id);
+            return {
+                ...base,
+                selectedScenarioId: scenario.id,
+                proposalId: record.proposal.id,
+                gate: coverage,
+                applied: false,
+                notes: coverage.reasons,
+            };
+        }
+        if (!record.behavior) {
+            this.attempted.add(scenario.id);
+            return {
+                ...base,
+                selectedScenarioId: scenario.id,
+                proposalId: record.proposal.id,
+                gate: {
+                    ...coverage,
+                    accepted: false,
+                    rejectionReason: 'behavior-required',
+                    reasons: ['pending apply is missing a behavioral receipt'],
+                },
+                applied: false,
+                notes: ['pending apply is missing a behavioral receipt'],
+            };
+        }
+        return this.settleApplication(base, scenario, record.proposal, record.behavior, coverage, record);
+    }
+    settleApplication(base, scenario, proposal, behavior, coverageGate, existing) {
+        const name = proposal.spec.name;
+        let record = existing ?? this.applyJournal.get(scenario.id);
+        const computedSha = sha256Hex(intendedSkillBody(proposal));
+        if (record) {
+            const identityError = savedIdentityMismatch(record, scenario, proposal);
+            if (identityError) {
+                this.attempted.add(scenario.id);
+                return {
+                    ...base,
+                    selectedScenarioId: scenario.id,
+                    proposalId: proposal.id,
+                    gate: coverageGate,
+                    applied: false,
+                    applyPhase: 'conflict',
+                    notes: [identityError],
+                    behavior,
+                };
+            }
+        }
+        const intendedSha256 = record?.intendedSha256 ?? computedSha;
+        let gate = coverageGate;
+        if (!record) {
+            try {
+                record = this.applyJournal.upsert({
+                    scenarioId: scenario.id,
+                    proposalId: proposal.id,
+                    proposal,
+                    intendedSha256,
+                    phase: 'intent',
+                    behavior,
+                });
+            }
+            catch (error) {
+                return {
+                    ...base,
+                    selectedScenarioId: scenario.id,
+                    proposalId: proposal.id,
+                    gate: coverageGate,
+                    applied: false,
+                    applyPhase: 'intent',
+                    notes: [
+                        'apply journal write failed before installation; skill not installed',
+                        error instanceof Error ? error.message : String(error),
+                    ],
+                    behavior,
+                };
+            }
+        }
+        const installed = this.ensureInstalled(proposal, scenario, behavior, intendedSha256);
+        if (installed.kind === 'conflict') {
+            this.markConflict(scenario.id, proposal, intendedSha256, behavior);
+            this.attempted.add(scenario.id);
+            return this.conflictResult(base, scenario, proposal, coverageGate, behavior, name);
+        }
+        if (installed.kind === 'failed') {
+            return {
+                ...base,
+                selectedScenarioId: scenario.id,
+                proposalId: proposal.id,
+                gate: coverageGate,
+                applied: false,
+                applyPhase: 'intent',
+                notes: ['installation pending', installed.error],
+                behavior,
+            };
+        }
+        if (installed.kind === 'rejected') {
+            this.attempted.add(scenario.id);
+            if (record.phase === 'intent' && this.peekInstalled(name) === null) {
+                this.applyJournal.remove(scenario.id);
+            }
+            return {
+                ...base,
+                selectedScenarioId: scenario.id,
+                proposalId: proposal.id,
+                gate: installed.gate,
+                applied: false,
+                notes: installed.gate.reasons,
+                behavior,
+            };
+        }
+        try {
+            record = this.applyJournal.upsert({
+                scenarioId: scenario.id,
+                proposalId: proposal.id,
+                proposal,
+                intendedSha256,
+                phase: 'installed',
+                appliedRef: installed.appliedRef,
+                behavior,
+            });
+        }
+        catch {
+            /* disk has the skill; retry still sees identical content + intent/installed */
+        }
+        gate = installed.gate;
+        const appliedRef = record?.appliedRef ?? gate.appliedRef ?? name;
+        try {
             this.archive.append({
                 proposalId: proposal.id,
                 kind: 'skill',
@@ -97,17 +329,157 @@ export class SkillImprovementEngine {
                 experienceId: proposal.experienceId,
                 delta: 1,
                 scoreAfter: 1,
-                appliedRef: gate.appliedRef,
+                appliedRef,
+                evidence: {
+                    artifactSha256: intendedSha256,
+                    benchmarkSha256: sha256Hex(JSON.stringify(SKILL_BEHAVIOR_TASKS[scenario.id] ?? [])),
+                    wins: behavior.wins,
+                    losses: behavior.losses,
+                    cases: behavior.cases,
+                },
             });
         }
+        catch (error) {
+            return {
+                ...base,
+                selectedScenarioId: scenario.id,
+                proposalId: proposal.id,
+                gate: { ...gate, accepted: true, appliedRef },
+                applied: false,
+                proofPending: true,
+                applyPhase: 'installed',
+                notes: ['installed, proof pending', error instanceof Error ? error.message : String(error)],
+                behavior,
+            };
+        }
+        this.applyJournal.remove(scenario.id);
+        this.proposals.remove('skill', scenario.id);
+        this.covered.add(scenario.id);
+        this.attempted.add(scenario.id);
         return {
             ...base,
             selectedScenarioId: scenario.id,
             proposalId: proposal.id,
-            gate,
-            applied,
-            notes: gate.reasons,
+            gate: {
+                ...gate,
+                accepted: true,
+                validationLevel: 'behavioral',
+                appliedRef,
+                reasons: gate.appliedRef
+                    ? gate.reasons
+                    : ['accepted and installed (auto-apply): firewall-clean + covers the scenario'],
+            },
+            applied: true,
+            applyPhase: 'archived',
+            notes: gate.appliedRef
+                ? gate.reasons
+                : ['accepted and installed (auto-apply): firewall-clean + covers the scenario'],
+            behavior,
         };
     }
+    ensureInstalled(proposal, scenario, behavior, intendedSha256) {
+        const name = proposal.spec.name;
+        if (!isAuthoredSkillName(name)) {
+            return {
+                kind: 'rejected',
+                gate: {
+                    proposalId: proposal.id,
+                    scenarioId: scenario.id,
+                    accepted: false,
+                    reasons: ['not an authored skill name'],
+                },
+            };
+        }
+        const disk = this.peekInstalled(name);
+        if (disk !== null && sha256Hex(disk) !== intendedSha256) {
+            return { kind: 'conflict' };
+        }
+        const dryGate = validateSkillProposal(proposal, scenario, this.dryMutator(), {
+            keepOnAccept: true,
+            behavior,
+        });
+        if (!dryGate.accepted) {
+            return { kind: 'rejected', gate: dryGate };
+        }
+        if (disk !== null && sha256Hex(disk) === intendedSha256) {
+            return { kind: 'ready', appliedRef: dryGate.appliedRef ?? name, gate: dryGate };
+        }
+        if (this.mutator.has(name))
+            return { kind: 'conflict' };
+        try {
+            const gate = validateSkillProposal(proposal, scenario, this.mutator, { keepOnAccept: true, behavior });
+            if (!gate.accepted || !gate.appliedRef)
+                return { kind: 'rejected', gate };
+            return { kind: 'ready', appliedRef: gate.appliedRef, gate };
+        }
+        catch (error) {
+            return { kind: 'failed', error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    dryMutator() {
+        const port = {
+            create: (spec) => ({ name: spec.name }),
+            remove: () => false,
+            has: (name) => this.mutator.has(name),
+        };
+        if (this.mutator.readInstalled) {
+            port.readInstalled = (name) => this.mutator.readInstalled(name);
+        }
+        return port;
+    }
+    peekInstalled(name) {
+        if (!isAuthoredSkillName(name))
+            return null;
+        return this.readInstalledSkill(name);
+    }
+    markConflict(scenarioId, proposal, intendedSha256, behavior, appliedRef) {
+        try {
+            this.applyJournal.upsert({
+                scenarioId,
+                proposalId: proposal.id,
+                proposal,
+                intendedSha256,
+                phase: 'conflict',
+                behavior,
+                ...(appliedRef ? { appliedRef } : {}),
+            });
+        }
+        catch {
+            /* conflict is also represented by the on-disk mismatch */
+        }
+    }
+    conflictResult(base, scenario, proposal, gate, behavior, name) {
+        return {
+            ...base,
+            selectedScenarioId: scenario.id,
+            proposalId: proposal.id,
+            gate: { ...gate, appliedRef: gate.appliedRef ?? (this.mutator.has(name) ? name : undefined) },
+            applied: false,
+            applyPhase: 'conflict',
+            notes: ['installed artifact differs from intended; not archived'],
+            behavior,
+        };
+    }
+}
+function intendedSkillBody(proposal) {
+    return ensureFrontmatter(proposal.spec.name, proposal.spec.description, proposal.spec.content);
+}
+function sha256Hex(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function savedIdentityMismatch(record, scenario, proposal) {
+    if (record.proposalId !== proposal.id)
+        return 'pending apply proposalId does not match proposal.id';
+    if (record.scenarioId !== scenario.id)
+        return 'pending apply scenarioId does not match scenario';
+    if (proposal.targetScenarioId !== scenario.id)
+        return 'pending apply targetScenarioId does not match scenario';
+    if (record.scenarioId !== proposal.targetScenarioId) {
+        return 'pending apply scenarioId does not match targetScenarioId';
+    }
+    if (record.intendedSha256 !== sha256Hex(intendedSkillBody(proposal))) {
+        return 'pending apply intendedSha256 does not match proposal artifact';
+    }
+    return null;
 }
 //# sourceMappingURL=skill-engine.js.map

package/dist/agent/self-improvement/skill-gate.d.ts

@@ -9,10 +9,12 @@
  *
  * @module agent/self-improvement/skill-gate
  */
+import type { SkillBehaviorResult } from './skill-behavior-gate.js';
 import { type SkillMutatorPort } from './skill-mutator.js';
 import type { SkillBenchmarkScenario, SkillGateOutcome, SkillProposal } from './skill-types.js';
 export interface ValidateSkillOptions {
     keepOnAccept: boolean;
+    behavior?: SkillBehaviorResult;
 }
 /** Deterministic coverage check: the skill content surfaces all expected guidance. */
 export declare function coversScenario(content: string, scenario: SkillBenchmarkScenario): boolean;

package/dist/agent/self-improvement/skill-gate.js

@@ -9,7 +9,7 @@
  *
  * @module agent/self-improvement/skill-gate
  */
-import { safetyGateSkill } from './skill-mutator.js';
+import { ensureFrontmatter, safetyGateSkill } from './skill-mutator.js';
 /** Deterministic coverage check: the skill content surfaces all expected guidance. */
 export function coversScenario(content, scenario) {
     const lower = content.toLowerCase();
@@ -30,6 +30,14 @@ export function validateSkillProposal(proposal, scenario, mutator, options) {
             reasons: ['SG1: skill content is empty or too short, or missing name'],
         };
     }
+    try {
+        ensureFrontmatter(proposal.spec.name, proposal.spec.description, content);
+        if (!/^#{1,6}\s+\S/m.test(content))
+            throw new Error('skill must have a Markdown title');
+    }
+    catch (error) {
+        return { ...base, accepted: false, rejectionReason: 'static-scan', reasons: [`SG1: ${error instanceof Error ? error.message : String(error)}`] };
+    }
     // SG2: static scan + skill firewall (prompt-injection / exfiltration / safety)
     const safety = safetyGateSkill(content);
     if (!safety.ok) {
@@ -63,6 +71,12 @@ export function validateSkillProposal(proposal, scenario, mutator, options) {
             reasons: [`SG4: held-out secret coverage failed, missing: ${JSON.stringify(missingHeldOut)}`],
         };
     }
+    if (options.keepOnAccept) {
+        const evidence = options.behavior;
+        if (!evidence?.accepted || evidence.tested < 1 || evidence.cases.length !== evidence.tested || evidence.wins < 1 || evidence.losses !== 0 || !evidence.cases.every(item => item.after) || evidence.cases.filter(item => !item.before && item.after).length !== evidence.wins) {
+            return { ...base, accepted: false, rejectionReason: 'behavior-required', reasons: ['Installation requires a measured behavioral gain without regression'] };
+        }
+    }
     // Accepted. Install (auto-apply) or just report (propose-only).
     let appliedRef;
     if (options.keepOnAccept) {
@@ -71,9 +85,10 @@ export function validateSkillProposal(proposal, scenario, mutator, options) {
     return {
         ...base,
         accepted: true,
+        validationLevel: options.keepOnAccept ? 'behavioral' : 'coverage',
         reasons: options.keepOnAccept
             ? ['accepted and installed (auto-apply): firewall-clean + covers the scenario']
-            : ['accepted (propose-only): firewall-clean + covers the scenario, not installed'],
+            : ['coverage validated only; behavioral verification is required before the improvement engine installs this proposal'],
         ...(appliedRef ? { appliedRef } : {}),
     };
 }

package/dist/agent/self-improvement/skill-mutator.d.ts

@@ -49,6 +49,8 @@ export interface SkillMutatorPort {
     };
     remove(name: string): boolean;
     has(name: string): boolean;
+    /** Read SKILL.md from this mutator's actual root. Engine must not guess paths. */
+    readInstalled?(name: string): string | null;
 }
 export interface MutationResult {
     ok: boolean;
@@ -64,8 +66,11 @@ export declare class LiveSkillMutator implements SkillMutatorPort {
     private reload;
     private readContent;
     has(name: string): boolean;
+    readInstalled(name: string): string | null;
     isPinned(name: string): boolean;
-    create(spec: SkillSpec): {
+    create(spec: SkillSpec, options?: {
+        overwrite?: boolean;
+    }): {
         name: string;
     };
     /** Full re-author of an existing authored skill, re-gated. Refuses pinned. */

package/dist/agent/self-improvement/skill-mutator.js

@@ -13,6 +13,8 @@
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
+import * as yaml from 'yaml';
+import { parseSkillFile, validateSkill } from '../../skills/parser.js';
 import { randomUUID } from 'crypto';
 import { getSkillRegistry } from '../../skills/registry.js';
 import { logger } from '../../utils/logger.js';
@@ -61,10 +63,18 @@ export function isAuthoredSkillName(name) {
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
 /** Ensure the content begins with YAML frontmatter carrying name + description. */
 export function ensureFrontmatter(name, description, content) {
-    if (FRONTMATTER_RE.test(content))
-        return content;
-    const desc = description.replace(/"/g, "'").replace(/\r?\n/g, ' ').trim();
-    return `---\nname: ${name}\ndescription: "${desc}"\n---\n\n${content.trim()}\n`;
+    const match = content.match(FRONTMATTER_RE);
+    const metadata = match ? yaml.parse(match[1]) : {};
+    if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata))
+        throw new Error('Invalid skill metadata');
+    if (metadata.name !== undefined && metadata.name !== name)
+        throw new Error('Skill frontmatter identity differs from requested name');
+    const body = match ? content.slice(match[0].length) : content;
+    const result = `---\n${yaml.stringify({ ...metadata, name, description: description.trim() || metadata.description })}---\n\n${body.trim()}\n`;
+    const validation = validateSkill(parseSkillFile(result, 'authored-skill', 'workspace'));
+    if (!validation.valid)
+        throw new Error(validation.errors.join('; '));
+    return result;
 }
 export function readPinned(content) {
     const m = content.match(FRONTMATTER_RE);
@@ -187,13 +197,18 @@ export class LiveSkillMutator {
             return false;
         return fs.existsSync(this.skillFile(name));
     }
+    readInstalled(name) {
+        if (!isAuthoredSkillName(name))
+            return null;
+        return this.readContent(name);
+    }
     isPinned(name) {
         if (!isSafeSkillSegment(name))
             return false;
         const c = this.readContent(name);
         return c ? readPinned(c) : false;
     }
-    create(spec) {
+    create(spec, options = {}) {
         // Backstops durs, miroir de LiveToolMutator.register : (a) namespace
         // authored-* obligatoire — sans lui, un spec nommé comme une skill user/
         // bundled l'écraserait ; (b) re-gate de sûreté — les appelants légitimes
@@ -203,6 +218,12 @@ export class LiveSkillMutator {
         if (!isAuthoredSkillName(spec.name)) {
             throw new Error(`refusing to create skill "${spec.name}": authored skills must be named "${AUTHORED_SKILL_PREFIX}*" (never shadow a user/bundled skill)`);
         }
+        if (this.has(spec.name)) {
+            if (this.isPinned(spec.name))
+                throw new Error('Skill is pinned');
+            if (!options.overwrite)
+                throw new Error('Skill already exists; explicit overwrite required');
+        }
         const content = ensureFrontmatter(spec.name, spec.description, spec.content);
         const gate = safetyGateSkill(content);
         if (!gate.ok) {
@@ -210,9 +231,24 @@ export class LiveSkillMutator {
         }
         const dir = this.dirFor(spec.name);
         fs.mkdirSync(dir, { recursive: true });
-        writeFileAtomicSync(this.skillFile(spec.name), content);
-        this.reload(spec.name);
-        return { name: spec.name };
+        const file = this.skillFile(spec.name);
+        const previous = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : undefined;
+        try {
+            writeFileAtomicSync(file, content);
+            const registry = getSkillRegistry();
+            const installed = registry.registerSkillFileSync(file, 'workspace');
+            if (registry.get(spec.name) !== installed)
+                throw new Error('Skill registry refused installation');
+            return { name: spec.name };
+        }
+        catch (error) {
+            if (previous !== undefined)
+                writeFileAtomicSync(file, previous);
+            else
+                fs.rmSync(file, { force: true });
+            this.reload(spec.name);
+            throw error;
+        }
     }
     /** Full re-author of an existing authored skill, re-gated. Refuses pinned. */
     update(name, newContent, description = '') {
@@ -222,13 +258,13 @@ export class LiveSkillMutator {
             return { ok: false, reasons: ['skill does not exist'] };
         if (this.isPinned(name))
             return { ok: false, reasons: ['skill is pinned'] };
-        const withFm = ensureFrontmatter(name, description, newContent);
-        const gate = safetyGateSkill(withFm);
-        if (!gate.ok)
-            return gate;
-        writeFileAtomicSync(this.skillFile(name), withFm);
-        this.reload(name);
-        return { ok: true, reasons: [] };
+        try {
+            this.create({ name, description: description || parseSkillFile(this.readContent(name), this.skillFile(name), 'workspace').metadata.description, content: newContent }, { overwrite: true });
+            return { ok: true, reasons: [] };
+        }
+        catch (error) {
+            return { ok: false, reasons: [error instanceof Error ? error.message : String(error)] };
+        }
     }
     /** Find/replace within an authored skill body (exact; fail on multiple unless replaceAll). */
     patch(name, oldStr, newStr, opts = {}) {

package/dist/agent/self-improvement/skill-types.d.ts

@@ -33,9 +33,10 @@ export interface SkillProposal {
     experienceId?: string;
     spec: SkillSpec;
 }
-export type SkillGateRejection = 'static-scan' | 'firewall' | 'coverage-fail';
+export type SkillGateRejection = 'static-scan' | 'firewall' | 'coverage-fail' | 'behavior-required';
 export interface SkillGateOutcome {
     accepted: boolean;
+    validationLevel?: 'coverage' | 'behavioral';
     proposalId: string;
     scenarioId: string;
     rejectionReason?: SkillGateRejection;