@sigrun/sigrun 0.4.2 → 0.6.0

package/CHANGELOG.md

@@ -5,7 +5,97 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.6.0] - 2026-11-02
+
+### Added
+- **Escalations core.** Extensions send notices through `host.notify`
+  (validated targets, delivered on the bounded side lane), look jobs up
+  with `host.jobs.get`, create job-scoped conversations, and read a
+  conversation's history through the trusted `host.conversations.entries`
+  / `entry` (callers enforce access themselves).
+- **Per-job state.** Each job gets a state folder under its owner's jobs
+  root (jail-granted to the run); the run's prompt names it. State follows
+  the job through delete, transfer and retire, and resets on request
+  (`POST /v1/jobs/{id}/state/reset`, and a Reset button in the jobs tab).
+- Extension views and panels render through the block renderer (they were
+  a JSON placeholder in 0.5.0 — the curator view showed raw data).
+- The settings page gains the `builtinExtensions.gateway` toggle.
+
+### Changed
+- **Ownerless jobs belong to the primary admin** (the earliest-created
+  directory admin): run conversations, access checks, `host.jobs.get` and
+  job state all use that effective owner. A single-operator install with
+  an empty directory stays ownerless.
+- The identity prompt section is multi-user and no longer names the agent
+  (naming is persona territory, `SOUL.md`).
+- Built-in documentation says six built-ins everywhere (codemode, MCP,
+  tool search, gateway, OAuth, curator); everything else is optional.
+
+### Fixed
+- The web conversation list heals after the events stream drops: it
+  reloads on every reconnect and when the tab becomes visible again, and
+  reopens an EventSource the browser gave up on (5-60 s backoff).
+  Conversations created on another device no longer stay invisible until
+  a reload.
+- Leaving an extension view: the Chats rail entry works and picking a
+  conversation in the sidebar returns to the chat.
+- Phone layout: a long URL in a user message no longer makes the chat
+  slide sideways; tables keep readable columns and scroll inside their
+  card; the composer's controls stay on one row.
+- Extension surfaces: params-carrying action/data URLs, zero-width surface
+  pages, and cadence refreshes.
+- `SIGRUN_EXTENSIONS` without a model env no longer crashes boot.
+
+## [0.5.0] - 2026-11-02
+
+### Added
+- **The curator** (sixth built-in, `@sigrun/ext-curator`): per-user
+  curation over learned skills and curation targets. Message attribution
+  records the submitting user per input; fork reviews (loop 1) run after
+  conversation activity past a threshold; the idle maintenance pass
+  (loop 2, the `curator-tick` job) digests mixed-authorship
+  conversations — per-entry attribution keeps other users' turns out of
+  the digest input; the versioned per-user skill store (feed, pins,
+  content scan, undo); usage telemetry; internal runs hidden from every
+  owner-keyed path; the curation-target contract (`@sigrun/memory-markdown`
+  0.2.0 is the first target: per-user USER.md/MEMORY.md with hard limits
+  and versions); notices + the undo view; hint-by-wrapping interception
+  with provable authorship.
+- A default `stream.timeoutMs` (5 minutes) via the boot settings getter:
+  a model request with no explicit timeout could wedge forever (the
+  OpenAI SDK's timeout is a headers-arrival deadline; a request that
+  never reaches the provider never gets headers). Caller seam and
+  settings file override field-wise.
+
+### Fixed
+- The seam host's pre-bind `curation.skills(user)`/`overlays(user)`
+  returned a promise of the store instead of a store (loop 2's archive
+  step read `.list` off a promise). A lazy store proxy now preserves the
+  sync-store contract through the pre-bind window.
+
+### Added
+- `host.notify` lets extensions send validated explicit notices through
+  every declared notifier, with optional conversation or declared-view
+  deep links. Delivery is enqueued on the bounded side lane and is not
+  gated by `notifications.runSettled`.
+- Extension host job hooks: `host.jobs.get(id)` returns a read-only live-job
+  projection with its effective owner, and `host.conversations.create({job})`
+  stamps a validated job association in the session-meta creation commit.
+  Unknown, retired, and owner-mismatched jobs are rejected before storage
+  writes; creating the conversation does not create a job run or `lastRun`.
+
+### Changed
+- Ownerless and orphaned-owner jobs now run as the primary admin; their
+  runs are no longer visible to every user. The effective owner is
+  resolved live without rewriting the declared record.
+- Reworded the `pi` manifest handling so it no longer implies pi
+  extension compatibility. Sigrun reads `pi.extensions`/`pi.skills` only
+  to LOCATE files and shares the SKILL.md format; it does not implement
+  pi's `ExtensionAPI` (a pi extension's `registerTool`/`registerCommand`
+  have no counterpart here). `docs/extending.md` gains a "Not pi
+  extensions" section stating the two ABIs are unrelated and that only
+  the skills layer transfers. The `.ts` skip and empty-entry warnings now
+  say `pi manifest:` instead of `pi-compat:`.
 
 ## [0.4.2] - 2026-10-31
 
@@ -650,3 +740,4 @@ recreate).*
   surface, settings panel, command surface).
 - pi-durable upgraded 1.0.2 → 1.2.0: ToolExecutionResult `output` rename across
   core, registry-driven settings roster, `modelTools` two-layer filtering.
+

package/README.md

@@ -1,19 +1,19 @@
 # Sigrun
 
-Sigrun is a **durable, multi-user personal-assistant server** built on
-[pi-durable](https://www.npmjs.com/package/@earendil-works/pi-durable).
-One agent loop serves every surface — a web UI, a terminal UI, an HTTP
-API, and (via the gateway extension) chat channels — over long-lived
-conversations stored in SQLite.
-An extension model installs extra tools, providers, prompt sections,
-memory systems, and login providers at boot.
-
-**Why use it?** Conversations survive restarts and resume where they
-stopped; memory and integrations are extension-owned and individually
-replaceable; multi-user boundaries are explicit (real authentication plus
-a per-user execution jail); and it deploys as an npm package, a Docker
-compose reference, or a Helm chart. [`docs/why.md`](docs/why.md) is the
-longer rationale.
+Sigrun is a **self-hosted, multi-user personal-assistant server**. Each
+user signs in to their own conversations, settings, credentials, and
+tools, and their agent runs in its own execution jail. One agent loop
+serves every surface — a web UI, a terminal UI, an HTTP API, scheduled
+jobs, and (via the gateway extension) chat-channel adapters. The core
+stays small: memory, model providers, tools, MCP support, and login are
+extensions installed at boot.
+
+**Why use it?** Several people can share one install without sharing an
+agent: real authentication, per-user extensions and secrets, and a
+per-user execution jail that fails closed. Memory and integrations are
+extension-owned and individually replaceable. Conversations survive
+restarts, and it deploys as an npm package, a Docker compose reference,
+or a Helm chart. [`docs/why.md`](docs/why.md) is the longer rationale.
 
 **Status:** 0.x — useful and exercised, but extension and settings
 contracts can still evolve between minor releases. See
@@ -24,12 +24,12 @@ posture, and [`CONTRIBUTING.md`](CONTRIBUTING.md) to build and test.
 [Install](#install) and [Quickstart](#quickstart) for the model/credential
 setup every install needs.
 
-- **Durable** — conversations, submissions, and schedules live in one
-  SQLite database (`SIGRUN_STORAGE_PATH`); a restart resumes where it
-  stopped.
-- **pi-durable core** — the harness primitives (conversations, inbox
-  steering/follow-up modes, retries, streaming, compaction) come from
-  pi-durable; sigrun is the deployable shell around them.
+- **Multi-user** — token, proxy, and OIDC/GitHub/Discord sign-in, with
+  invites after the first admin claims the install; per-user extension
+  settings, secrets, and services; and a Landlock execution jail per user.
+  A second user is refused when isolation is unavailable. See
+  [Authentication](#authentication) and
+  [Multi-user execution isolation](#multi-user-execution-isolation).
 - **Extensions** — separate npm packages loaded from `SIGRUN_EXTENSIONS` (or the settings file's
   top-level `extensions` list); a failing extension is quarantined and
   reported, never a boot abort.
@@ -42,6 +42,12 @@ setup every install needs.
   API the web UI consumes (feature parity by design): conversation
   sidebar, streaming conversation pane, fork, the interaction and
   ambient seams, slash commands. See [Launch modes](#launch-modes).
+- **Restart-safe** — conversations, submissions, and schedules live in one
+  SQLite database (`SIGRUN_STORAGE_PATH`), and a restart resumes where it
+  stopped. The harness primitives (conversations, inbox steering/follow-up
+  modes, retries, streaming, compaction) come from
+  [pi-durable](https://www.npmjs.com/package/@earendil-works/pi-durable);
+  sigrun is the deployable shell around them.
 
 ## Install
 
@@ -525,8 +531,8 @@ form when the effective auth methods include `token`; `/v1/auth/providers`
 returns an empty list on proxy-only deployments because their completed
 sign-ins could not authenticate the resulting session. The TUI continues to
 use tokens. Login providers come from extensions.
-The reference implementation is **`@sigrun/oauth`, the fourth built-in
-extension**. It is bundled and loads by default, so no `extensions` entry is
+The reference implementation is **`@sigrun/oauth`, one of the six built-in
+extensions**. It is bundled and loads by default, so no `extensions` entry is
 needed. Set `"builtinExtensions": {"oauth": false}` to disable it; like the
 other built-in toggles, this is restart-required. A configured extension
 whose package name is also `@sigrun/oauth` replaces the built-in. If the
@@ -716,7 +722,8 @@ links, stops their worker and services, and removes their per-user tool
 entries. Extensions then receive `userDeleted` while the old record and
 secrets remain readable, so they can revoke external provider
 credentials. Finally core removes the directory record, per-user secrets,
-user-settings directory, and per-user cache directories.
+user-settings directory, per-user cache directories, and that user's
+learned skills and curation state (never transferred).
 
 **Credentials belong to a person and never transfer.** Data and state
 stay for the extension to retain, move, or delete according to its own
@@ -1008,11 +1015,11 @@ Entry grammar:
   checkout `FETCH_HEAD`; present without a ref → fetch only (the
   checkout stays where you left it). Entry discovery: the object form's
   `entry` → a `sigrun` manifest (`{"sigrun": {"extension": "./index.js"}}`)
-  → a pi-compat manifest (the first non-`.ts` `pi.extensions` entry; each
+  → a `pi` manifest (the first non-`.ts` `pi.extensions` entry; each
   `.ts` entry is skipped with one warning — it cannot load under plain
   node) → `dist/index.js`.
 - **Skills from packages** — a package may ship skills instead of (or
-  beside) extension code: manifest `sigrun.skills` or pi-compat
+  beside) extension code: manifest `sigrun.skills` or the `pi`-shaped
   `pi.skills` (`["./skills"]`, the same SKILL.md format), or a
   factory-result `skills` field (absolute dirs). A package that declares
   skills and has no loadable entry is a valid **skills-only** package
@@ -1075,10 +1082,13 @@ a dashboard) are in
 
 ## Built-in extensions
 
-Five extensions are built into core — **codemode**, **MCP**, **tool
-search**, **gateway**, and **OAuth login**. The first three mirror
-what pi 1.3.0 ships built-in; the gateway is sigrun's own channel-adapter
-engine; OAuth provides OIDC, GitHub, and Discord login providers. They
+Six extensions are built into core — **codemode**, **MCP**, **tool
+search**, **gateway**, **OAuth login**, and the **curator**. The first
+three mirror what pi 1.3.0 ships built-in; the gateway is sigrun's own
+channel-adapter engine; OAuth provides OIDC, GitHub, and Discord login
+providers; the curator learns per-user skills (see
+[Skills and prompt templates](#skills-and-prompt-templates)). Every other extension is optional
+and loads only when `extensions` names it. The built-ins
 load by default on every boot, with no settings entry, and resolve from
 core's own `node_modules` (they are core dependencies, never installed
 into the packages dir — `extensions` has nothing to install for them,
@@ -1086,7 +1096,8 @@ unless a same-named package is deliberately installed to replace one;
 see below).
 A default install therefore has pi's tool surface without configuring
 anything. On `GET /v1/extensions` they report under the names
-`codemode`, `sigrun-mcp`, `tool-search`, `gateway`, and `oauth`.
+`codemode`, `sigrun-mcp`, `tool-search`, `gateway`, `oauth`, and
+`curator`.
 Configure OAuth providers in `settings/oauth.json`; see the
 `@sigrun/oauth` package README for provider settings and secrets.
 
@@ -1102,7 +1113,8 @@ default. They join the offered set when an enabled MCP server's
   automatic decision (auto-enable only narrows the default set, never a
   named list).
 - **Turning one off** — `"builtinExtensions": {"codemode": false,
-  "mcp": false, "toolSearch": false, "gateway": false, "oauth": false}`.
+  "mcp": false, "toolSearch": false, "gateway": false, "oauth": false,
+  "curator": false}`.
   Each defaults to `true`; each is restart-required. A disabled built-in
   disappears from `GET /v1/extensions` entirely — no row, not even a
   skipped one — and its config is then ignored.
@@ -1129,12 +1141,13 @@ docs/extending.md).
   "extensions": [ // configured extensions install + load as above
     "@acme/sigrun-ext-example@^0.1.0"
   ],
-  "builtinExtensions": { // all five default to true; restart required
+  "builtinExtensions": { // all six default to true; restart required
     "codemode": true,
     "mcp": true,
     "toolSearch": false,
     "gateway": true,
-    "oauth": true
+    "oauth": true,
+    "curator": true
   }
 }
 ```
@@ -1193,6 +1206,23 @@ typed — the submission's user entry carries
 `{kind: "sigrun.user.expanded", data: {typed, command}}` while the
 model receives the expanded text.
 
+**The curator and learned skills.** Beyond the three roots above, every
+user has a private fourth root — learned skills the curator records for
+them under `<data-dir>/users/<user>/skills/`. For skills it ranks second:
+the workspace wins over it, and it wins over the user dir and packages. The curator reviews the
+user's conversations (owner-authored tool calls are captured as
+"Noted" hints, never executed on the spot) and writes through the
+versioned `skill_manage` surface, so every learned skill keeps its last
+ten versions, a change feed, and one-call undo. Learned skills never
+leave their user: they are not shared, not transferred on ownership
+moves, and removed with the user on `DELETE /v1/users/{user}`. Each
+user can pause or disable the curator in their own per-user settings —
+`PUT /v1/me/extensions/curator/settings` with `{"paused": true}` stops
+new reviews until flipped back, `{"enabled": false}` turns the curator
+off entirely (both are per-user and take effect on the next run) — and
+an operator can disable it server-wide with
+`"builtinExtensions": {"curator": false}` (restart required).
+
 ## Jobs
 
 A job is a schedule plus an action, durable by construction — one

package/dist/commands/expand.js

@@ -31,6 +31,7 @@
  * kind must not start with `pi.`).
  */
 import { listSkills, } from "../skills/index.js";
+import { OVERLAY_HEADING, overlayForSkill } from "../curation/overlays.js";
 import { discoverTemplates, } from "./templates.js";
 /** The user entry kind an expanded input is placed as. */
 export const EXPANDED_ENTRY_KIND = "sigrun.user.expanded";
@@ -149,8 +150,13 @@ export function expandTemplate(text, templates) {
  * shape): the `<skill …>` block, plus a blank line and the trimmed
  * arguments ONLY when arguments were given. An unknown skill — or any
  * other text — passes through UNCHANGED.
+ *
+ * `overlays` (curator A5, P2): the acting owner's overlay text per
+ * skill name — when present, the block's body carries the upstream
+ * body followed by `OVERLAY_HEADING` and the overlay text, the same
+ * shape `load_skill` serves. Absent = the plain pi shape.
  */
-export function expandSkillCommand(text, skills) {
+export function expandSkillCommand(text, skills, overlays) {
     if (!text.startsWith("/skill:"))
         return text;
     const spaceIndex = text.indexOf(" ");
@@ -160,9 +166,12 @@ export function expandSkillCommand(text, skills) {
     if (skill === undefined)
         return text;
     const location = `${skill.dir}/SKILL.md`;
+    const overlay = overlays?.get(skill.name);
     // Pi parity: the body is the frontmatter-stripped SKILL.md, trimmed —
     // `</skill>` sits on its own line with no stray blank lines.
-    const body = skill.body.trim();
+    const body = (overlay === undefined
+        ? skill.body
+        : `${skill.body}\n${OVERLAY_HEADING}\n\n${overlay}`).trim();
     const block = `<skill name="${skill.name}" location="${location}">\n` +
         `References are relative to ${skill.dir}.\n` +
         `\n${body}\n` +
@@ -205,7 +214,7 @@ export function expandableTemplates(templates, commandNames) {
  * error `parseCommandArgs` raises) — the submit path maps it to a
  * client error.
  */
-export async function expandInput(parts, expansion, env, context) {
+export async function expandInput(parts, expansion, env, context, owner) {
     // Only a LEADING text part starting with `/` is a command: the
     // command is what the user typed first (attachments and later text
     // parts pass through untouched, in place).
@@ -223,10 +232,33 @@ export async function expandInput(parts, expansion, env, context) {
     if (reserved.has(commandName))
         return { parts };
     if (commandName.startsWith("skill:")) {
-        const skills = await listSkills(env, context, expansion.skills);
-        const expanded = expandSkillCommand(text, skills);
+        const skillName = commandName.slice("skill:".length);
+        const skills = await listSkills(env, context, expansion.skills, { owner });
+        // Curator A5 (P2): the owner's overlay rides on the upstream body,
+        // the same shape `load_skill` serves — discovered skills without
+        // one (or an owner without a store) map nothing, and the block
+        // keeps pi's plain shape.
+        const overlays = new Map();
+        for (const skill of skills) {
+            const overlay = await overlayForSkill(expansion.skills, owner, skill, env);
+            if (overlay !== undefined)
+                overlays.set(skill.name, overlay);
+        }
+        const expanded = expandSkillCommand(text, skills, overlays);
         if (expanded === text)
             return { parts };
+        // Curator A6 (P4): a `/skill:name` that actually expanded counts as
+        // usage for the owner (the discovered skill was a learned one).
+        if (owner !== undefined) {
+            const skill = skills.find((candidate) => candidate.name === skillName);
+            if (skill?.root === "learned") {
+                const usage = expansion.skills.usage?.(owner);
+                if (usage !== undefined) {
+                    usage.bump(skill.name, "expand");
+                    void usage.flush();
+                }
+            }
+        }
         return {
             parts: parts.map((part) => (part === textPart ? { type: "text", text: expanded } : part)),
             typed: text,

package/dist/curation/attribution.js

@@ -0,0 +1,135 @@
+/**
+ * Message attribution (curator P1, spec §6.1): every user input records
+ * the submitting user through every admission path — HTTP submit (the
+ * resolved principal), the extension host bridge (`opts.user`, recorded
+ * verbatim; extensions own their user mapping), a block answer (the
+ * acting user), and a job fire (the job's owner).
+ *
+ * The carrier is a SIDE record, the `sigrun.authors` conversation doc:
+ * `pi.user` entries are `Entry<never>` (they cannot carry data), and a
+ * new input entry kind would have to be taught to every `UserEntry.is`
+ * consumer. The doc keys the author two ways:
+ *
+ * - `byRequest` — written BEFORE `conversation.submit` (the requestId
+ *   exists pre-admission, so this never races). An orphan record from a
+ *   failed submit is harmless.
+ * - `bySubmission` — written right after admission returns: the key the
+ *   live run's input ids resolve against, readable from a tool through
+ *   any `DocumentReader`. A tool call that lands before this write reads
+ *   "unattributed" and fails closed.
+ *
+ * An `undefined` user (an unidentified caller) records nothing: its
+ * entries read unattributed, exactly like every entry admitted before
+ * this doc existed — unattributed entries are never curation input.
+ */
+import { randomUUID } from "node:crypto";
+import { defineDoc, UserEntry } from "@earendil-works/pi-durable";
+import { EXPANDED_ENTRY_KIND } from "../commands/expand.js";
+import { BlocksAnswerEntry } from "../harness/blocks/entries.js";
+/** The `sigrun.authors` doc (latest-only singleton per conversation). */
+export const AuthorsDoc = defineDoc({
+    kind: "sigrun.authors",
+    version: 1,
+    scope: "conversation",
+    checkpointWhen: () => false,
+    history: "latest",
+    fork: "current",
+    initial: () => ({ byRequest: {}, bySubmission: {} }),
+});
+/** The entry kinds an input submission places (the author carriers). */
+const INPUT_KINDS = new Set([
+    UserEntry.kind,
+    EXPANDED_ENTRY_KIND,
+    BlocksAnswerEntry.kind,
+]);
+/** Whether one entry is a placed user input (any of {@link INPUT_KINDS}). */
+function isInputEntry(entry) {
+    return INPUT_KINDS.has(entry.kind);
+}
+/**
+ * The requestId an input is admitted under: the caller's own id, or a
+ * generated `sigrun:`-prefixed UUID when the caller passed none — every
+ * input submission carries one, so `byRequest` can key every admission.
+ */
+export function ensureRequestId(requestId) {
+    return requestId ?? `sigrun:${randomUUID()}`;
+}
+/**
+ * Record `user` as the author of one input, keyed by its requestId
+ * (pre-admission) or its submission id (post-admission). A no-op for an
+ * `undefined` user: an unidentified caller leaves no record and its
+ * entries read unattributed.
+ */
+export async function recordAuthor(conversation, key, user, ctx) {
+    if (user === undefined)
+        return;
+    await conversation.commit(async (tx) => {
+        const doc = await tx.doc(AuthorsDoc, conversation.id);
+        if ("requestId" in key)
+            doc.byRequest[key.requestId] = user;
+        else
+            doc.bySubmission[String(key.submissionId)] = user;
+    }, ctx);
+}
+/**
+ * The author of one submission, from any `DocumentReader` — including the
+ * `ToolExecutionApi` a tool runs with. Reads `bySubmission` only, so a
+ * tool call that lands before the post-admission write resolves
+ * `undefined` (unattributed — fail closed, never guess).
+ */
+export async function authorOfSubmission(read, conversationId, submissionId, ctx) {
+    const doc = await read.snapshot(AuthorsDoc, conversationId, ctx);
+    return doc?.bySubmission[String(submissionId)];
+}
+/**
+ * Every user-input entry in the conversation's ACTIVE context mapped to
+ * its author — host-side (full `Session` access; the harness resolves
+ * both record keys through the submission's `entry` link and its
+ * `requestId`). Entries with no attribution (everything admitted before
+ * this doc, or by an unidentified caller) are present with `undefined`:
+ * the map's presence set is the input entries, the values are authors.
+ */
+export async function authorsOfEntries(harness, conversationId, ctx) {
+    const result = new Map();
+    const conversation = await harness.conversation(conversationId, ctx);
+    if (conversation === undefined)
+        return result;
+    const view = await conversation.context(ctx);
+    for (const entry of view.entries) {
+        if (isInputEntry(entry))
+            result.set(entry.id, undefined);
+    }
+    const doc = await harness.snapshot(AuthorsDoc, conversationId, ctx);
+    if (doc === undefined)
+        return result;
+    // The byRequest join: the requestId resolves to the submission (and
+    // its placed entry) through the transaction's conversation-scoped
+    // lookup — the one typed path from a requestId to the record.
+    const byRequest = await harness.commit(async (tx) => {
+        const resolved = [];
+        for (const [requestId, user] of Object.entries(doc.byRequest)) {
+            const submission = await tx.submissionByRequest(conversationId, requestId);
+            if (submission?.entry !== undefined) {
+                resolved.push({ entry: submission.entry, user });
+            }
+        }
+        return resolved;
+    }, ctx);
+    for (const { entry, user } of byRequest) {
+        if (result.has(entry))
+            result.set(entry, user);
+    }
+    // The bySubmission join (authoritative: keyed by the exact id). The
+    // submission handle re-reads the live record, so a still-queued input
+    // joins once its entry places.
+    for (const [id, user] of Object.entries(doc.bySubmission)) {
+        const submission = await harness.submission(Number(id), ctx);
+        if (submission === undefined)
+            continue;
+        const record = await submission.status(ctx);
+        if (record.entry !== undefined && result.has(record.entry)) {
+            result.set(record.entry, user);
+        }
+    }
+    return result;
+}

package/dist/curation/deletion.js

@@ -0,0 +1,32 @@
+/**
+ * Curation state removal on user deletion (curator A10, spec §6.4):
+ * a departing user's learned skills and curation state are REMOVED with
+ * them, never transferred — a skill distilled from their conversations
+ * can carry their paths, hosts and preferences, and must not load for
+ * the recipient (memory's shape; the spec's call).
+ *
+ * Core owns exactly the two roots under the managed user area:
+ * `<userArea>/skills` (the learned root) and `<userArea>/curation`
+ * (versions, overlays, the feed, usage counters). The user area itself,
+ * workspaces and every extension-owned per-user dir stay for the §10.6
+ * recipient/retention rules; targets clean their own data through their
+ * `userDeleted` handler.
+ *
+ * Fail-closed counterpart (Review Focus 1): the per-user stores gate
+ * EVERY operation on the live directory record (A4/A5's `userExists`),
+ * so a curator run in flight when its user is deleted cannot write —
+ * its late calls fail `user removed` and create nothing. This function
+ * only removes what exists; it never recreates a root.
+ */
+import { rm } from "node:fs/promises";
+import { curationDir, learnedSkillsDir } from "./paths.js";
+/**
+ * Remove one user's learned skills root and curation state directory.
+ * Idempotent (`force`): absent roots are a no-op, and nothing is ever
+ * created. Symlink-safe by construction — `rm` removes a symlinked
+ * root itself, never its target.
+ */
+export async function removeUserCuration(userArea) {
+    await rm(learnedSkillsDir(userArea), { recursive: true, force: true });
+    await rm(curationDir(userArea), { recursive: true, force: true });
+}

package/dist/curation/gate.js

@@ -0,0 +1,50 @@
+/**
+ * The curator-run gate (curator P6): `sigrun.curation-gate` — a
+ * hooks-only core extension that confines an internal curator run to
+ * its allow list.
+ *
+ * Selected ONLY in the run conversations A9's producer creates (this
+ * task installs it; boot keeps it OUT of the host default extension
+ * selection, the same never-defaulted treatment as per-user entries).
+ * Its `beforeTool` blocks any tool not in `CurationRunDoc.allow` with
+ * `"<tool> is not available in this review; use one of: <allow,
+ * comma-separated>"` — a decision only; it writes nothing (a hook
+ * cannot commit, and the gate has no write to make). A conversation
+ * with no run doc (never, for a correctly-created run) allows
+ * everything: the gate is a confinement, not a filter on ordinary
+ * conversations.
+ */
+import { defineExtension, hook, ToolTask } from "@earendil-works/pi-durable";
+import { curationRun } from "./run-doc.js";
+/** The gate extension's registered name. */
+export const CURATION_GATE_EXTENSION = "sigrun.curation-gate";
+/**
+ * Build the gate extension: one `pi.tool` hook, no tools, no sections,
+ * no prompt bytes. Boot installs it into the registry; A9's producer
+ * selects it in the internal run conversations it creates.
+ */
+export function createCurationGateExtension() {
+    return defineExtension({
+        name: CURATION_GATE_EXTENSION,
+        hooks: [
+            hook(ToolTask, {
+                /**
+                 * Block any tool outside the run's allow list, naming the
+                 * allowed list so the model can recover without another
+                 * round of guessing. `undefined` (no run doc, or the tool
+                 * is allowed) lets the call proceed.
+                 */
+                async beforeTool(call, api, context) {
+                    const run = await curationRun(api, api.conversationId, context);
+                    if (run === undefined)
+                        return undefined;
+                    if (run.allow.includes(call.name))
+                        return undefined;
+                    return {
+                        block: `${call.name} is not available in this review; use one of: ${run.allow.join(", ")}`,
+                    };
+                },
+            }),
+        ],
+    });
+}