@sigrun/sigrun 0.4.2 → 0.6.0

package/dist/harness/tools.js

@@ -29,6 +29,7 @@
 import { Type } from "@earendil-works/pi-ai";
 import { createBashTool, createEditTool, createReadTool, createWriteTool, } from "@earendil-works/pi-durable/tools";
 import { defineExtension, defineTool } from "@earendil-works/pi-durable";
+import { SessionMetaDoc } from "../server/session-meta.js";
 // ---------------------------------------------------------------------------
 // Coding tools (read/write/edit/bash)
 // ---------------------------------------------------------------------------
@@ -77,11 +78,80 @@ export const imageReadTool = defineTool({
         return { output: [image] };
     },
 });
+/**
+ * Wrap the read tool with learned-root usage counting. The wrapper
+ * resolves the conversation owner through the api's document reader
+ * (the SessionMeta doc — the A3 pattern), and the read's absolute path
+ * against the owner's learned root; a path inside it (a SKILL.md or a
+ * support file) bumps `read` for the owning skill. The wrapped result
+ * passes through unchanged.
+ */
+export function countReadUsage(seam, base = imageReadTool) {
+    return {
+        ...base,
+        execute: async (args, api, context) => {
+            const result = await base.execute(args, api, context);
+            void countLearnedRead(seam, args.path, api, context);
+            return result;
+        },
+    };
+}
+/** Bump `read` for a learned-root path, when it lands inside one. */
+async function countLearnedRead(seam, path, api, context) {
+    try {
+        const meta = await api.snapshot(SessionMetaDoc, api.conversationId, context);
+        const owner = meta?.owner;
+        const counters = seam.countersOf(owner);
+        const root = seam.learnedRootOf(owner);
+        if (counters === undefined || root === undefined || api.env === undefined)
+            return;
+        const resolved = await api.env.absolutePath(path, context);
+        if (!resolved.ok)
+            return;
+        const skill = learnedSkillOf(resolved.value, root);
+        if (skill !== undefined) {
+            counters.bump(skill, "read");
+            void counters.flush();
+        }
+    }
+    catch {
+        // Counting is advisory: no read ever fails because usage telemetry
+        // could not resolve the owner or the path.
+    }
+}
+/** The `skills/<name>/…` segment of a path inside a learned root; `undefined` outside. */
+function learnedSkillOf(absolute, root) {
+    if (absolute === root || !absolute.startsWith(`${root}/`))
+        return undefined;
+    const rest = absolute.slice(root.length + 1).split("/");
+    const name = rest[0];
+    if (name === undefined || name === "")
+        return undefined;
+    return name;
+}
 /** `read`, `write`, `edit`, `bash` — core-installed for every conversation. */
 export const codingToolsExtension = defineExtension({
     name: "sigrun.coding-tools",
     tools: [imageReadTool, createWriteTool(), createEditTool(), createBashTool()],
 });
+/**
+ * The coding tools with learned-root usage counting (curator A6, P4):
+ * with a {@link ReadUsageSeam} the `read` tool is wrapped so reads
+ * inside the conversation owner's learned root bump the owner's
+ * counters. Without one, the plain surface — the boot default until
+ * the curation wiring hands both seam halves.
+ */
+export function createCodingToolsExtension(options) {
+    return defineExtension({
+        name: "sigrun.coding-tools",
+        tools: [
+            options === undefined ? imageReadTool : countReadUsage(options),
+            createWriteTool(),
+            createEditTool(),
+            createBashTool(),
+        ],
+    });
+}
 // ---------------------------------------------------------------------------
 // Search tools (find/grep/ls) — pure TS over ExecutionEnv
 // ---------------------------------------------------------------------------

package/dist/harness/workspace.js

@@ -1,15 +1,43 @@
 /** Resolve each conversation's ExecutionEnv: single-user, jailed, or fail-closed. */
-import { isAbsolute, resolve } from "node:path";
+import { isAbsolute, join, resolve } from "node:path";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { buildUserPolicy } from "../sandbox/policy.js";
 import { SandboxedExecutionEnv } from "../sandbox/sandboxed-env.js";
 import { UnavailableExecutionEnv } from "../sandbox/unavailable-env.js";
 import { selfPackageRoot } from "./packages.js";
 import { defaultModuleTrees } from "../sandbox/policy.js";
+import { primaryAdmin } from "./identity/primary-admin.js";
 import { AgentExecutionEnv } from "./agent-env.js";
 import { lookupOsAccount } from "../sandbox/os-account.js";
+/** The live owner's record, falling back to the primary admin. */
+export function selectRecord(records, owner) {
+    return records.find((record) => record.user === owner) ?? primaryAdmin(records);
+}
 export function createWorkspaceService(deps) {
     return {
+        jobsRoot(owner) {
+            if (deps === undefined)
+                return undefined;
+            const { directory, managed } = deps;
+            const records = directory.list();
+            const record = selectRecord(records, owner);
+            if (record === undefined)
+                return join(managed.roots.dataDir, "jobs");
+            if (record.osUser !== undefined) {
+                if (deps.osUsers?.available !== true)
+                    return undefined;
+                try {
+                    const account = (deps.lookupAccount ?? lookupOsAccount)(record.osUser);
+                    return account === undefined
+                        ? undefined
+                        : join(account.home, ".local", "state", "sigrun", "jobs");
+                }
+                catch {
+                    return undefined;
+                }
+            }
+            return join(managed.userAreas(record.user), "jobs");
+        },
         async forConversation(conversation, prefs, read, ctx) {
             const workspace = prefs.defaultWorkspace;
             if (workspace.type !== "local") {
@@ -22,8 +50,7 @@ export function createWorkspaceService(deps) {
             const owner = read === undefined
                 ? undefined
                 : await deps.ownerOf(conversation.id, read, ctx ?? BACKGROUND_CONTEXT);
-            const record = records.find((candidate) => candidate.user === owner)
-                ?? records.find((candidate) => candidate.admin);
+            const record = selectRecord(records, owner);
             let osAccount;
             if (record?.osUser !== undefined) {
                 if (deps.osUsers?.available !== true) {

package/dist/jobs/fire.js

@@ -39,6 +39,7 @@ import { parseModelSpec } from "../config.js";
 import { expandInput } from "../commands/expand.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
 import { noteThen } from "../server/turns/submit-turn.js";
+import { recordAuthor } from "../curation/attribution.js";
 import { JobRunDoc, patchJob, readJob } from "./docs.js";
 /**
  * Fire one job under `fireKey`. `fireAt` is the epoch ms the key pins
@@ -122,7 +123,9 @@ async function jobPromptText(deps, conversationId, prompt, context) {
     if (conversation === undefined)
         return prompt;
     const env = await conversationEnv(deps, conversation);
-    const expansion = await expandInput([{ type: "text", text: prompt }], deps.commandExpansion, env, context);
+    // Curator A3: the learned root is the conversation owner's.
+    const meta = await deps.harness.snapshot(SessionMetaDoc, conversationId, context);
+    const expansion = await expandInput([{ type: "text", text: prompt }], deps.commandExpansion, env, context, meta?.owner);
     const part = expansion.parts[0];
     return part !== undefined && part.type === "text" ? part.text : prompt;
 }
@@ -175,11 +178,21 @@ async function firePrompt(deps, id, record, fireKey, baseRun, prior, context) {
             }, context);
         }
         const prompt = await jobPromptText(deps, conversationId, action.prompt, context);
-        await noteThen(deps.harness, conversation, () => conversation.submit({
-            type: "input",
-            content: [{ type: "text", text: prompt }],
-            requestId: `job:${fireKey}`,
-        }, context), context);
+        await noteThen(deps.harness, conversation, 
+        // Attribution (curator P1): the job's input is authored by the
+        // job's owner — `byRequest` before the admission, `bySubmission`
+        // after, exactly like submitOp (an ownerless job records nothing).
+        async () => {
+            const requestId = `job:${fireKey}`;
+            await recordAuthor(conversation, { requestId }, record.owner, context);
+            const submission = await conversation.submit({
+                type: "input",
+                content: [{ type: "text", text: prompt }],
+                requestId,
+            }, context);
+            await recordAuthor(conversation, { submissionId: submission.id }, record.owner, context);
+            return submission;
+        }, context);
         return { outcome: "running", conversationId };
     }
     // conversation: "new" — the run record + conversation in ONE commit.
@@ -203,6 +216,7 @@ async function firePrompt(deps, id, record, fireKey, baseRun, prior, context) {
                     : { thinkingLevel: action.thinking }),
             },
             init: async (tx, newId) => {
+                const owner = deps.effectiveOwner(record.owner);
                 const run = {
                     ...baseRun,
                     conversationId: newId,
@@ -216,9 +230,9 @@ async function firePrompt(deps, id, record, fireKey, baseRun, prior, context) {
                 meta.jobId = id;
                 if (action.deliver !== undefined)
                     meta.deliver = [...action.deliver];
-                if (record.owner !== undefined)
-                    meta.owner = record.owner;
-                await deps.rewriteUserSelection?.(tx, newId, undefined, record.owner);
+                if (owner !== undefined)
+                    meta.owner = owner;
+                await deps.rewriteUserSelection?.(tx, newId, undefined, owner);
                 if (action.runSharing !== undefined)
                     meta.sharing = action.runSharing;
                 meta.name = runName(record.spec.name, deps.now(), record, deps);
@@ -237,11 +251,20 @@ async function firePrompt(deps, id, record, fireKey, baseRun, prior, context) {
         return { outcome: "blocked" };
     }
     const prompt = await jobPromptText(deps, conversationId, action.prompt, context);
-    await noteThen(deps.harness, conversation, () => conversation.submit({
-        type: "input",
-        content: [{ type: "text", text: prompt }],
-        requestId: `job:${fireKey}`,
-    }, context), context);
+    await noteThen(deps.harness, conversation, 
+    // Attribution (curator P1), the twin of the fixed-conversation site
+    // above: the job's owner authors the job's input.
+    async () => {
+        const requestId = `job:${fireKey}`;
+        await recordAuthor(conversation, { requestId }, record.owner, context);
+        const submission = await conversation.submit({
+            type: "input",
+            content: [{ type: "text", text: prompt }],
+            requestId,
+        }, context);
+        await recordAuthor(conversation, { submissionId: submission.id }, record.owner, context);
+        return submission;
+    }, context);
     return { outcome: "running", conversationId };
 }
 /** `<job name> · <YYYY-MM-DD HH:mm in the job's timezone>` (the plan's name). */

package/dist/jobs/index.js

@@ -28,6 +28,7 @@ import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { JobDoc, listRevisions, listRuns, pruneHistory, readJob, scanJobs, writeJobChange, } from "./docs.js";
 import { fireJob } from "./fire.js";
 import { reconcileJobs, } from "./reconcile.js";
+import { jobStateDir, removeJobState } from "./state-dir.js";
 import { specHash } from "./spec.js";
 /** Thrown when an API write targets a `file:`/`ext:` job id (409 `job_declared`). */
 export class JobDeclaredError extends Error {
@@ -53,13 +54,15 @@ function historyLimits(settings) {
 }
 /** The wire row of a record (access left for the caller: the ROUTE
  *  computes it per principal; the raw row carries the neutral default).
- *  Exported for boot's `job.changed` publication (W4 Task 4). */
-export function jobWireOf(id, record) {
+ *  Exported for boot's `job.changed` publication (W4 Task 4). The
+ *  effective owner is resolved by the caller; the stored record and its
+ *  spec hash remain untouched (spec §6.5). */
+export function jobWireOf(id, record, owner) {
     return {
         id,
         name: record.spec.name,
         source: record.source,
-        ...(record.owner === undefined ? {} : { owner: record.owner }),
+        ...(owner === undefined ? {} : { owner }),
         ...(record.sharing === undefined
             ? {}
             : { sharing: JSON.parse(JSON.stringify(record.sharing)) }),
@@ -82,6 +85,17 @@ export function jobWireOf(id, record) {
 export function createJobsService(deps) {
     const ctx = BACKGROUND_CONTEXT;
     const limits = () => historyLimits(deps.settings);
+    const wireOf = (id, record) => jobWireOf(id, record, deps.effectiveOwner(record.owner));
+    const stateRoot = (owner) => deps.jobsRoot?.(owner);
+    const removeStateBestEffort = async (root, id) => {
+        try {
+            await removeJobState(root, id);
+        }
+        catch (error) {
+            const path = root === undefined ? id : jobStateDir(root, id);
+            console.warn(`jobs: could not remove job state ${path}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
     // `job.changed` observation (W4 Task 4): ONE commit subscription over
     // the `sigrun.job` family invokes the injected hook after EVERY record
     // change — the service's own API writes, the executor's status patches
@@ -114,15 +128,16 @@ export function createJobsService(deps) {
         runtime: deps.runtime,
         rootId: deps.rootId,
         sources: deps.sources,
+        ...(deps.jobsRoot === undefined ? {} : { jobsRoot: deps.jobsRoot }),
     }, ctx);
     return {
         async list() {
             const records = await scanJobs(deps.storage, ctx);
-            return records.map(({ id, record }) => jobWireOf(id, record));
+            return records.map(({ id, record }) => wireOf(id, record));
         },
         async get(id) {
             const record = await readJob(deps.harness, id, ctx);
-            return record === undefined ? undefined : jobWireOf(id, record);
+            return record === undefined ? undefined : wireOf(id, record);
         },
         async createApi(spec, owner) {
             const id = `api:${crypto.randomUUID()}`;
@@ -150,7 +165,7 @@ export function createJobsService(deps) {
             const record = await readJob(deps.harness, id, ctx);
             if (record === undefined)
                 throw new JobNotFoundError(id);
-            return jobWireOf(id, record);
+            return wireOf(id, record);
         },
         async updateApi(id, patch, changedBy) {
             const prior = await readJob(deps.harness, id, ctx);
@@ -191,7 +206,7 @@ export function createJobsService(deps) {
             const record = await readJob(deps.harness, id, ctx);
             if (record === undefined)
                 throw new JobNotFoundError(id);
-            return jobWireOf(id, record);
+            return wireOf(id, record);
         },
         async runs(id, limit) {
             return await listRuns(deps.storage, id, Math.max(0, limit), ctx);
@@ -205,14 +220,26 @@ export function createJobsService(deps) {
                 throw new JobNotFoundError(id);
             if (prior.source !== "api")
                 throw new JobDeclaredError(id);
+            // Resolve against the prior owner: the retiring commit removes the
+            // record, and state cleanup must not fall back to another user.
+            const root = stateRoot(prior.owner);
             const nowIso = new Date(deps.runtime.now()).toISOString();
             await deps.harness.commit(async (tx) => {
                 // The final `enabled:false` revision, then the retire.
                 await writeJobChange(tx, id, { ...prior, enabled: false }, changedBy, nowIso);
                 await tx.retireDoc(JobDoc, id);
             }, ctx);
+            await removeStateBestEffort(root, id);
             await reconcileOne();
         },
+        async resetState(id) {
+            const record = await readJob(deps.harness, id, ctx);
+            if (record === undefined)
+                throw new JobNotFoundError(id);
+            // Unlike delete/transfer/reconcile, an explicit reset surfaces I/O
+            // failure to its caller; it never rewrites or retires the job.
+            await removeJobState(stateRoot(record.owner), id);
+        },
         async runNow(id) {
             // ONE clock reading: the manual fire key and the run's fireAt must
             // agree — the settle path re-derives the run-record key from

package/dist/jobs/reconcile.js

@@ -38,6 +38,7 @@
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { JobDoc, patchJob, scanJobs, writeJobChange, } from "./docs.js";
 import { nextFireAt } from "./schedule.js";
+import { jobStateDir, removeJobState } from "./state-dir.js";
 import { specHash } from "./spec.js";
 import { createScheduleTask } from "./task.js";
 const SCAN_PAGE = 500;
@@ -153,6 +154,14 @@ export async function reconcileJobs(deps, ctx = BACKGROUND_CONTEXT) {
         if (declaredIds.has(id))
             continue;
         await retireRecord(deps.harness, id, record, nowIso, ctx);
+        const root = deps.jobsRoot?.(record.owner);
+        try {
+            await removeJobState(root, id);
+        }
+        catch (error) {
+            const path = root === undefined ? id : jobStateDir(root, id);
+            console.warn(`jobs: could not remove retired job state ${path}: ${error instanceof Error ? error.message : String(error)}`);
+        }
     }
     // ── Pass 2: records → tasks ─────────────────────────────────────
     const after = new Map();

package/dist/jobs/skills-refs.js

@@ -0,0 +1,40 @@
+/**
+ * The core-side job skill-reference reader (curator P6, A9): the skill
+ * names a user's job PROMPTS reference — `/skill:name` tokens in every
+ * prompt action's text, from job records the durable scan sees (api,
+ * file, and extension sources alike), ENABLED AND PAUSED alike.
+ *
+ * The curator's diet step (Part B) needs this as the "job depends on
+ * this skill" signal: archiving a skill a paused job still references
+ * would break the job the moment it is re-enabled, so paused jobs count
+ * exactly as much as live ones.
+ *
+ * Pure read: one storage scan over the `sigrun.job` family (the same
+ * `scanJobs` primitive the jobs service's own reads use), filtered by
+ * owner, then a text scan for `/skill:name` tokens. No mutation, no
+ * task enumeration.
+ */
+import { scanJobs } from "./docs.js";
+/** The `/skill:name` token grammar (the expansion path's own prefix). */
+const SKILL_TOKEN = /(?:^|\s)\/skill:([A-Za-z0-9][A-Za-z0-9._-]*)/g;
+/**
+ * Every skill name the user's job prompts reference (`/skill:name`
+ * tokens), paused jobs included. A user with no jobs (or an unknown
+ * user) reads an empty set — the scan is the truth, never a directory
+ * check.
+ */
+export async function jobSkillRefs(storage, user, ctx) {
+    const jobs = await scanJobs(storage, ctx);
+    const refs = new Set();
+    for (const { record } of jobs) {
+        if (record.owner !== user)
+            continue;
+        const action = record.spec.action;
+        if (action.kind !== "prompt")
+            continue;
+        for (const match of action.prompt.matchAll(SKILL_TOKEN)) {
+            refs.add(match[1]);
+        }
+    }
+    return refs;
+}

package/dist/jobs/state-dir.js

@@ -0,0 +1,16 @@
+/** Resolve and remove one job's on-disk state directory. */
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+/** The complete job id is encoded into one path segment. */
+export function jobStateDir(root, jobId) {
+    return join(root, encodeURIComponent(jobId));
+}
+/**
+ * Remove job state, or do nothing when the selected owner has no jobs root.
+ * Deletion failures reject so each job operation can apply its own policy.
+ */
+export async function removeJobState(root, jobId) {
+    if (root === undefined)
+        return;
+    await rm(jobStateDir(root, jobId), { recursive: true, force: true });
+}

package/dist/jobs/transfer.js

@@ -17,8 +17,10 @@
  * ownerless until the source is edited — spec §8.3's posture).
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { join } from "node:path";
 import { registerOwnershipParticipant } from "../server/ownership.js";
 import { scanJobs, writeJobChange } from "./docs.js";
+import { jobStateDir } from "./state-dir.js";
 import { specHash } from "./spec.js";
 /**
  * Register the jobs transfer participant on `ctx` (createServer calls
@@ -36,6 +38,18 @@ export function registerJobsOwnershipParticipant(ctx) {
                 continue;
             if (record.owner !== from)
                 continue;
+            try {
+                // Before the owner rewrite: resetState resolves the old owner's
+                // root. The recipient's folder is deliberately never created.
+                await jobs.resetState(id);
+            }
+            catch (error) {
+                // Directory-user api jobs use their managed user area. (OS-user
+                // jobs cannot enter this transfer path — user deletion refuses
+                // osUser workspaces before any participant runs.)
+                const root = join(ctx.managedPaths.userAreas(from), "jobs");
+                console.warn(`jobs: could not remove transferred job state ${jobStateDir(root, id)}: ${error instanceof Error ? error.message : String(error)}`);
+            }
             const spec = { ...record.spec, owner: to };
             const next = {
                 ...record,

package/dist/sandbox/policy.js

@@ -3,6 +3,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, realpathSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { agentEnv } from "../harness/agent-env.js";
+import { learnedSkillsDir } from "../curation/paths.js";
 import { revalidate, validateGrantPath } from "./grants.js";
 function canonical(path) {
     try {
@@ -161,24 +162,35 @@ export function buildUserPolicy(record, ctx) {
         };
     }
     // EVERY per-user path passes the same validator before entering policy:
-    // stored workspace/grants via revalidate, and workspace/home again below.
+    // stored workspace/grants via revalidate, and workspace/home/jobs again below.
     // An osAccount home must validate BEFORE any directory is created.
     // tmp is the ONE sanctioned stateDir exception: it is derived only from
     // stateDir/sandbox/<user>/tmp and never silently routed around validation.
     const userArea = ctx.managed.userAreas(record.user);
     const requestedWorkspace = record.workspace ?? ctx.osAccount?.home ?? join(userArea, "workspace");
     const requestedHome = ctx.osAccount?.home ?? join(userArea, "home");
+    const requestedJobs = join(userArea, "jobs");
     if (ctx.osAccount !== undefined) {
         const validation = validateUserPath(requestedHome, record, ctx.managed);
         if (!validation.ok)
             return invalidReason(requestedHome, validation.reason);
     }
     const tmp = join(ctx.managed.roots.stateDir, "sandbox", record.user, "tmp");
-    for (const path of [requestedWorkspace, requestedHome, tmp]) {
-        if (ctx.osAccount !== undefined && path === tmp)
+    for (const path of [requestedWorkspace, requestedHome, tmp, requestedJobs]) {
+        if (ctx.osAccount !== undefined && (path === tmp || path === requestedJobs))
             continue;
         mkdirSync(path, { recursive: true, mode: 0o700 });
     }
+    // Curator A3: the owner's learned skills root exists and is granted
+    // read-only below. Created here (the designed empty case is an absent
+    // dir), validated like every other per-user path before entering
+    // policy — never another user's root.
+    const learned = learnedSkillsDir(userArea);
+    mkdirSync(learned, { recursive: true, mode: 0o700 });
+    const learnedValidation = validateUserPath(learned, record, ctx.managed);
+    if (!learnedValidation.ok) {
+        return invalidReason(learned, learnedValidation.reason);
+    }
     const workspaceValidation = validateUserPath(requestedWorkspace, record, ctx.managed);
     if (!workspaceValidation.ok) {
         return invalidReason(requestedWorkspace, workspaceValidation.reason);
@@ -186,6 +198,12 @@ export function buildUserPolicy(record, ctx) {
     const homeValidation = validateUserPath(requestedHome, record, ctx.managed);
     if (!homeValidation.ok)
         return invalidReason(requestedHome, homeValidation.reason);
+    const jobsValidation = ctx.osAccount === undefined
+        ? validateUserPath(requestedJobs, record, ctx.managed)
+        : undefined;
+    if (jobsValidation !== undefined && !jobsValidation.ok) {
+        return invalidReason(requestedJobs, jobsValidation.reason);
+    }
     const realTmp = canonical(tmp) ?? (ctx.osAccount === undefined
         ? undefined
         : resolve(tmp));
@@ -193,6 +211,7 @@ export function buildUserPolicy(record, ctx) {
         return invalidReason(tmp, "path cannot be resolved");
     const realWorkspace = workspaceValidation.realpath;
     const realHome = homeValidation.realpath;
+    const realJobs = jobsValidation?.realpath;
     // A source checkout that has ever been built has BOTH src/ and dist/;
     // defaultModuleTrees picks one while the worker entry may use the other
     // (dist worker.js when present, src worker.ts via tsx otherwise).
@@ -216,9 +235,10 @@ export function buildUserPolicy(record, ctx) {
         ...grants.flatMap((grant) => (grant.access === "rw" ? [grant.path] : [])),
         realHome,
         realTmp,
+        ...(realJobs === undefined ? [] : [realJobs]),
         // Device creation belongs to rw, but the selected devices' ordinary
         // read/write I/O survives a read-only Landlock rule. rw stays empty
-        // except for workspace/home/tmp/grants so /dev/shm remains denied.
+        // except for workspace/home/jobs/tmp/grants so /dev/shm remains denied.
     ]);
     const ro = sortedUnique([
         "/dev",
@@ -243,6 +263,9 @@ export function buildUserPolicy(record, ctx) {
         ...moduleTrees.paths,
         defaultPackageConfig(ctx.managed.coreRoot),
         ...grants.flatMap((grant) => (grant.access === "ro" ? [grant.path] : [])),
+        // Curator A3: read access to the owner's own learned skills (support
+        // files are read with ordinary file tools); writes go through P3.
+        learnedValidation.realpath,
     ]);
     const env = agentEnv();
     delete env.SSH_AUTH_SOCK;

package/dist/serve.js

@@ -175,9 +175,11 @@ export async function serve(env, options) {
     const envModel = env.SIGRUN_DEFAULT_MODEL?.trim() || env.SIGRUN_MODEL?.trim() || undefined;
     const settingsStore = new SettingsStore({ dir: defaultSettingsDir() });
     settingsStore.bootstrap(envServerSection(env), {
-        extensions: env.SIGRUN_EXTENSIONS?.trim() === undefined
-            ? undefined
-            : envConfig.extensions,
+        // E8 smoke: SIGRUN_EXTENSIONS without any model env crashed boot —
+        // envConfig is only resolved when a model env is set (see envHasModel
+        // above), so envConfig!.extensions dereferenced undefined here.
+        // parseExtensionList is the env-side source of truth; use it directly.
+        extensions: parseExtensionList(env.SIGRUN_EXTENSIONS),
         defaultModel: envModel === undefined
             ? undefined
             : `${envConfig.models.provider}/${envConfig.models.modelId}`,

package/dist/server/blocks/answers.js

@@ -13,7 +13,9 @@
  * The surface's unnoted change records fold into `content` first and
  * `notedThrough` advances BEFORE the §8.3 note step runs — so the turn
  * sends no separate note for this surface, while changes on OTHER
- * surfaces still note. `requestId` makes a double click one turn.
+ * surfaces still note. `requestId` makes a double click one turn. The
+ * acting `user` rides through to `submitOp` as the answer's author
+ * (curator P1).
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { toText } from "@sigrun/shared/blocks";
@@ -30,14 +32,15 @@ import { BlocksStateDoc } from "../../harness/blocks/state.js";
  * `skipNoteFor` (this surface notes no further this turn) and the
  * answer entry. The route owns access gating and actionId dedup; this
  * caller runs only for a located, write-accessible block whose handler
- * starts a turn.
+ * starts a turn. `user` is the acting user (curator P1): recorded as the
+ * answer input's author, `undefined` for an unidentified caller.
  *
  * The fold and the `notedThrough` advance run in ONE commit BEFORE the
  * note step (§8.4: "The surface's unnoted change records are folded into
  * `content` first, and `notedThrough` advances, before the §8.3 note
  * step runs"), so the answer turn never double-reports its surface.
  */
-export async function answerBlock(ctx, conversationId, entryId, action, payload, actionId) {
+export async function answerBlock(ctx, conversationId, entryId, action, payload, actionId, user) {
     const { opened } = ctx;
     const block = await readChatBlock(opened.harness, conversationId, entryId);
     if (block === undefined) {
@@ -80,6 +83,9 @@ export async function answerBlock(ctx, conversationId, entryId, action, payload,
     }, BACKGROUND_CONTEXT);
     await submitOp(ctx, conversation, folded.content, {
         ...(actionId === undefined ? {} : { requestId: `blocks:${actionId}` }),
+        // Attribution (curator P1): the answering user authors the answer's
+        // input turn.
+        ...(user === undefined ? {} : { user }),
         skipNoteFor: entryId,
         entry: {
             kind: BlocksAnswerEntry.kind,