@supersuit/superskill 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Changelog
 
+## 0.5.0 (2026-10-06)
+
+**Superskill needs a golden from a real run.** Before, any golden a person approved counted, so a
+skill could reach the top level on examples its author invented. (Gary Sheng, on five invented
+goldens written to lift Freedom's flagship skills: *"I'm just concerned about hallucination that
+we're accepting just to get higher doctor ratings."*) **Breaking for anyone at superskill today:**
+an approved golden without the new `PROVENANCE.json` no longer counts, and the doctor says which
+golden and why.
+
+- `goldens/<id>/PROVENANCE.json`: `source` (`real-run`, `synthetic`, `synthetic-reconstruction`),
+  the `run` it came from (session, commit or ledger id), and who `accepted` the output when it ran,
+  and when. Only `real-run` with all of that counts for `golden-approved`. An anonymized twin of a
+  private golden counts with `derived_from` and the anonymizer's `ANONYMIZED.json` receipt.
+- **Private goldens.** `--private-goldens <dir>` (or `SUPERSKILL_PRIVATE_GOLDENS`) on `doctor`,
+  `approve` and `doctor --run` also reads `<dir>/<skill-name>/<id>/`, for real runs too personal
+  to ship with the skill. `approve` writes the approval beside the golden it found.
+- `init --from-session` writes a `real-run` provenance with `accepted` left empty, so the golden
+  counts only once someone records who accepted it.
+- **`evals-real` (tested):** a `superskill init` `REPLACE:` placeholder, or the same prompt or
+  trigger query twice, is not a case. Measured in Freedom on 2026-10-05: the init scaffold copied up
+  to 3 evals and 10 triggers scored `tested` while testing nothing.
+- **`doctor --run` is never recorded as a real use.** Every harness spawns its child with
+  `FREEDOM_SKILL_LEDGER=off` and `SUPERSKILL_SANDBOX=1`. Measured 2026-10-05: three sandbox runs
+  landed in Freedom's skill ledger as perfect one-shot runs of a skill nobody had used.
+- **`real-use` (info):** where the run ledger records what the person's next message made of each
+  run, the doctor prints how many of the last 30 days' judged runs they accepted, beside the level.
+- `miss import --freedom-ledger` skips sandbox records, matches `freedom:<skill>` records, and
+  points a correction's "Should have" at the person's next message (session and time, never text).
+  It reads `FREEDOM_SKILL_LEDGER_HOME` when Freedom's ledger was re-pointed.
+- Tests: 11 new; each guard broken on purpose and seen red (invented golden reaching superskill,
+  placeholders counting, duplicate prompts counting, a sandbox run becoming a miss, a twin with no
+  receipt counting, the ledger off switch missing from the run env, codex spawned without it).
+
+## 0.4.0 (2026-09-29)
+
+**Approve from your phone.** `superskill approve` worked only at an interactive terminal, so an
+operator who reviews on a phone had to find a laptop to say yes. (Gary Sheng: *"The best way for
+me to approve it is to click yes, approve, not you telling me to go to my terminal. I'm normally
+mobile first."*) Away from a terminal it now accepts `--approved-by "<the person>"` and
+`--via "<where they said yes>"`, after that person approved with a tap on a board or a review page.
+Both are required and both are recorded (`via` on the approval), so an approval an agent relayed is
+always distinguishable from one typed at a terminal, and an agent still cannot approve with no
+named person and no channel. A rationale is required either way.
+
+- Tests: refused with no name, refused with a name and no channel, refused with no rationale;
+  recorded with person, channel and basis. The channel requirement was mutated out and went red.
+
 ## 0.3.1 (2026-09-29)
 
 The 0.3.0 changes below, released. The v0.3.0 tag's publish refused on a red test (SPEC.md still

package/README.md

@@ -37,7 +37,7 @@ file error. `--json` prints one JSON document and nothing else.
    hard-coded machine paths, nothing that reads like a prompt injection.
 2. **tested**: at least three task evals with checks a machine can verify, and a trigger set of
    at least ten requests, some that should load the skill and some near-misses that should not.
-3. **superskill**: a golden a person approved; no miss open longer than 14 days and every fixed
+3. **superskill**: a golden from a real run, accepted when it ran and approved by a person; no miss open longer than 14 days and every fixed
    miss guarded by an eval; a recent `--run` on file where the skill beats the same task done
    without it. "Recent" follows `metadata.cadence` (a weekly skill's proof lasts 30 days).
 
@@ -54,7 +54,7 @@ Every rule and threshold is in [SPEC.md](SPEC.md).
 | `superskill init <skill> --from-session <transcript>` | Turn the session where you did the job by hand into the first eval and a golden candidate (Claude Code `.jsonl`, or any text file as the request). |
 | `superskill miss <skill> "<what happened>" [--expected "..."]` | Log a time the skill got it wrong. |
 | `superskill fix <skill> <miss-id> --eval <id> [--commit <sha>]` | Close a miss. Refuses without an eval that exists. |
-| `superskill approve <skill> <golden> [--basis judgment\|outcome] [--rationale ...] [--evidence ...]` | A person signs off on a golden, saying why and what it rests on: `judgment` (it reads right) or `outcome` (it produced a checkable result, with evidence). Terminal only, asks for your name, so an agent cannot approve its own output. Approvals accumulate. |
+| `superskill approve <skill> <golden> [--basis judgment\|outcome] [--rationale ...] [--evidence ...]` | A person signs off on a golden, saying why and what it rests on: `judgment` (it reads right) or `outcome` (it produced a checkable result, with evidence). At a terminal it asks for your name; from your phone, an agent records your tap with `--approved-by` and `--via`. Approvals accumulate. |
 | `superskill collection <folder...> [--budget <chars>] [--overlap 0.5]` | Listing budget used, descriptions that get cut off, pairs of skills an agent could confuse (with near-miss triggers to add). |
 | `superskill miss import <skill> --freedom-ledger [--ledger <file>]` | Import runs that needed correcting from Freedom's run ledger. |
 | `superskill snippet` | Print a block for `AGENTS.md` / `CLAUDE.md` that teaches any agent these habits. |
@@ -70,7 +70,7 @@ my-skill/
   SKILL.md
   evals/evals.json          task evals (Anthropic skill-creator format)
   evals/triggers.json       should / should-not load (skill-creator format)
-  goldens/<id>/             input.md, output.md, APPROVAL.json
+  goldens/<id>/             input.md, output.md, PROVENANCE.json, APPROVAL.json
   MISSES.md                 every miss, open or fixed with its eval
   evals/results/latest.json the last --run
 ```

package/SPEC.md

@@ -1,6 +1,6 @@
 # The superskill standard
 
-**Version 0.3.1** (2026-09-29). The reference checker is `@supersuit/superskill`; where this
+**Version 0.5.0** (2026-10-06). The reference checker is `@supersuit/superskill`; where this
 document and the checker disagree, the checker has a bug.
 
 A **superskill** runs on frontier intelligence, is checked against examples a person approved,
@@ -23,7 +23,7 @@ a file in the skill's own folder, so the evidence travels with the skill whereve
 | The clause | What proves it | Where it lives |
 |---|---|---|
 | A skill at all | A valid `SKILL.md` under the Agent Skills spec, plus the hygiene rules below | `SKILL.md` |
-| Checked against examples you approved | At least one golden: a real input, the output a person said was right, and a record of who approved it and when | `goldens/<id>/` |
+| Checked against examples you approved | At least one golden from a real run: the real input, the output the person accepted when it ran, where it came from, and a record of who approved it as a golden and when | `goldens/<id>/` (or a private folder, see below) |
 | Fixed every time it gets something wrong | A miss log where every miss is open (recently) or fixed with a regression eval that would catch it again | `MISSES.md` + `evals/evals.json` |
 | Runs on frontier intelligence | Its evals last passed on a current model, recently, and beat the same task run without the skill | `evals/results/latest.json` |
 
@@ -35,6 +35,7 @@ my-skill/
   evals/triggers.json               trigger evals     (level: tested)
   goldens/<id>/input.md             approved examples (level: superskill)
   goldens/<id>/output.md
+  goldens/<id>/PROVENANCE.json
   goldens/<id>/APPROVAL.json
   MISSES.md                         miss log          (level: superskill)
   evals/results/latest.json         last --run        (level: superskill)
@@ -91,13 +92,15 @@ A line in a bundled file containing `superskill-ignore` is skipped by `no-absolu
 |---|---|---|
 | `evals-present` | fail | `evals/evals.json` parses and there are at least 3 cases (each golden with an input and an output counts as one) |
 | `evals-verifiable` | fail | every case in `evals.json` has a prompt and at least one expectation |
+| `evals-real` | fail | no eval case and no trigger still holds a `superskill init` `REPLACE:` placeholder, no two cases share a prompt, and no two triggers share a query |
 | `triggers-present` | fail | `evals/triggers.json` has at least 10 queries, at least 3 that should load the skill and at least 3 near-misses that should not |
 
 ### Level 3: superskill
 
 | Rule | Severity | Threshold |
 |---|---|---|
-| `golden-approved` | fail | at least one golden has an approval with non-empty `approved_by` and a valid `approved_at`; info when it was approved against an earlier `SKILL.md`; info naming the weight (judgment and outcome approvals per golden), and saying so plainly when no golden has an outcome yet |
+| `golden-approved` | fail | at least one golden **from a real run** (its `PROVENANCE.json` says `source: real-run`, names the run, and names who accepted it and when; an anonymized twin also carries `ANONYMIZED.json`) has an approval with non-empty `approved_by` and a valid `approved_at`. An approved golden without that provenance is named and does not count. Info when it was approved against an earlier `SKILL.md`; info naming the weight (judgment and outcome approvals per golden), and saying so plainly when no golden has an outcome yet |
+| `real-use` | info | when the run ledger records what the person's next message made of each run (Freedom's `next_turn`), the share of those runs in the last 30 days they accepted; sandbox runs are never counted |
 | `misses-log-present` | fail | `MISSES.md` exists (it may have no entries) |
 | `no-stale-open-miss` | fail | no miss has been open more than 14 days |
 | `fixed-miss-has-eval` | fail | every fixed miss names an eval id present in `evals.json` or `goldens/` |
@@ -157,7 +160,7 @@ A bare array of cases is accepted on read, as is `assertions` for `expectations`
 - `input.md`: the real request.
 - `output.md` (or any other file that is not `input.*` or `APPROVAL.json`): the output a person
   said was right.
-- `APPROVAL.json`, written only by `superskill approve` at an interactive terminal:
+- `APPROVAL.json`, written only by `superskill approve`: at an interactive terminal, or relayed by an agent with `--approved-by` and `--via` after the person approved with a tap (the `via` field records where):
 
 ```json
 { "approvals": [
@@ -181,6 +184,38 @@ approval whose `note` is its rationale.
 A golden is also an eval: `--run` judges the skill's output for `input.md` against the approved
 output.
 
+**`PROVENANCE.json` says where the example came from (0.5.0).** Only a golden from a real run
+counts toward superskill. An invented input with an invented output puts "a person said this was
+right" on something no person's work produced, and a skill could then reach the top level on its
+author's fiction. Invented cases still belong in `evals/evals.json`, where they hold a skill at
+`tested`.
+
+```json
+{
+  "source": "real-run",
+  "run": { "session": "88696e1b-...", "ledger_id": "inv_2026-09-28T02-28-29Z_ab12", "commit": null, "at": "2026-09-28T02:28:29Z" },
+  "accepted": { "by": "Ann Example", "at": "2026-09-28T03:22:51Z", "signal": "close", "evidence": "her next message after the run" }
+}
+```
+
+- `source`: `real-run`, `synthetic`, or `synthetic-reconstruction`. Only `real-run` counts.
+- `run`: at least one of `session`, `commit`, `ledger_id` names the run it came from.
+- `accepted`: who accepted the output **when it ran** (`by`), and when (`at`). This is not the
+  approval: accepting is what the person did at the time (moved on, closed, said go); approving
+  is saying afterwards that this example is the standard. Both are required.
+- An **anonymized twin** of a private golden says `anonymized: true` and `derived_from` (a hash of
+  the original, never its path or content) in place of the run, and carries `ANONYMIZED.json`, the
+  anonymizer's receipt (`checker`, `checked_at`, `counts` by kind, `fingerprint`, never the
+  mapping). Without the receipt the twin does not count.
+- `superskill init --from-session` writes `source: real-run` with `accepted` empty, so the golden
+  cannot count until someone records who accepted it.
+
+**Private goldens.** A real run's input and output are usually about real people and should not
+travel with a skill that is shared. `--private-goldens <dir>` (or `SUPERSKILL_PRIVATE_GOLDENS`)
+makes `doctor`, `approve` and `doctor --run` also read `<dir>/<skill-name>/<id>/`, laid out exactly
+like `goldens/<id>/`. A private golden counts for the operator who holds it. A miss is closed only
+by an eval or golden that ships with the skill.
+
 ### `MISSES.md`
 
 ```markdown
@@ -246,7 +281,12 @@ exist they are read as plain files:
   `{id, skill, started, outcome, interventions: [{kind, note|what}], errors}`. A record with an
   intervention of kind `redirect`, `correction` or `rescue`, or with `outcome: "failed"`, becomes
   an open miss dated from `started`; `taste` interventions are skipped; the ledger id is kept on
-  a `Source:` line so a record is never imported twice.
+  a `Source:` line so a record is never imported twice. A record with `synthetic: true` (a
+  sandbox run) is skipped. A record corrected after it handed back (`corrected_after`, with
+  `next_turn_ref`) gets a "Should have" that points at the person's correction: the session and
+  the time, never their words.
+- **`doctor --run` is never recorded as a use.** Every harness spawns its child with
+  `FREEDOM_SKILL_LEDGER=off` and `SUPERSKILL_SANDBOX=1`, in a folder named `superskill-run-*`.
 
 ## Versioning
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supersuit/superskill",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Score any agent skill folder as skill, tested, or superskill. An open standard and a zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/approve.mjs

@@ -5,17 +5,25 @@ import { createInterface } from "node:readline/promises";
 import { parseArgs, clock, UsageError } from "../args.mjs";
 import { skillDir, refuse } from "./common.mjs";
 import { readGoldens, approvalEntry, withApproval, BASES } from "../goldens.mjs";
+import { parseSkillFile } from "../frontmatter.mjs";
 
-export const help = `superskill approve <skill> <golden-id> [--rationale "<why it is right>"] [--basis judgment|outcome] [--evidence "<what happened, where to check>"]
+export const help = `superskill approve <skill> <golden-id> [--rationale "<why it is right>"] [--basis judgment|outcome] [--evidence "<what happened, where to check>"] [--private-goldens <dir>]
 
-Record that a person checked goldens/<id>/ and signs off on its output. Works only at an
-interactive terminal and asks for your name, so an agent cannot approve its own output.
+Record that a person checked goldens/<id>/ and signs off on its output. At a terminal it asks
+for your name. From an agent (a phone tap on a board or review page), pass --approved-by
+"<the person>" and --via "<where they said yes>": both are required and both are recorded, so an
+approval an agent relayed is always distinguishable from one typed at a terminal.
 
 Every approval says WHY (--rationale, or asked) and WHAT IT RESTS ON (--basis, or asked):
   judgment  you read it and it is right (the default)
   outcome   it produced a result someone can check; --evidence is required
 Approvals accumulate: two people approving, or a judgment approval later backed by an outcome,
 all stay on the record. Writes goldens/<id>/APPROVAL.json with the SKILL.md hash.
+
+--private-goldens <dir> (or SUPERSKILL_PRIVATE_GOLDENS) also looks for the golden in
+<dir>/<skill-name>/<id>/, where an operator keeps goldens made from real runs that are too
+personal to travel with the skill. Approving records the approval; it never changes where a
+golden came from (PROVENANCE.json), and only a golden from a real run counts for superskill.
 `;
 
 export async function run(argv) {
@@ -24,10 +32,29 @@ export async function run(argv) {
   const dir = skillDir(a._[0], "approve");
   const id = a._[1];
   if (!id) throw new UsageError("approve needs a golden id");
-  if (!(process.stdin.isTTY && process.stdout.isTTY)) return refuse("approval needs a person at a terminal. Run this yourself, not through an agent.");
-  const g = readGoldens(dir).find((x) => x.id === id);
-  if (!g) return refuse(`no goldens/${id}/`);
+  const name = parseSkillFile(readFileSync(join(dir, "SKILL.md"), "utf8")).data.name || "";
+  const privateGoldens = a.flags["private-goldens"] || process.env.SUPERSKILL_PRIVATE_GOLDENS || null;
+  const found = readGoldens(dir, { privateGoldens, name }).filter((x) => x.id === id);
+  // The private copy wins when both exist: it is the one the operator was shown.
+  const g = found.find((x) => x.private) || found[0];
+  if (!g) return refuse(`no goldens/${id}/${privateGoldens ? ` (nor ${join(privateGoldens, name, id)})` : ""}`);
   if (g.input === null || g.output === null || !g.output.trim()) return refuse(`goldens/${id}/ needs an input file and a non-empty output file before it can be approved`);
+  if (!(process.stdin.isTTY && process.stdout.isTTY)) {
+    // Mobile first: a person approves with a tap (a board, a review page) and an agent records it.
+    // The record names the person AND the channel, so an approval relayed by an agent is never
+    // mistaken for one typed at a terminal. Without both, an agent could approve its own output.
+    const name = String(a.flags["approved-by"] || "").trim();
+    const via = String(a.flags.via || "").trim();
+    if (!name || !via) return refuse("approval needs a person. At a terminal it asks for your name; from an agent, pass --approved-by \"<the person>\" and --via \"<where they approved: the tap, the page, the message>\", after that person said yes");
+    const sha = createHash("sha256").update(readFileSync(join(dir, "SKILL.md"))).digest("hex");
+    const made = approvalEntry({ name, rationale: a.flags.rationale || a.flags.note, basis: a.flags.basis || "judgment", evidence: a.flags.evidence, at: clock(a.flags).toISOString(), sha });
+    if (made.error) return refuse(made.error);
+    const p = join(g.dir, "APPROVAL.json");
+    const existed = existsSync(p);
+    writeFileSync(p, JSON.stringify(withApproval(existed ? g.approval : null, { ...made.entry, via }), null, 2) + "\n");
+    process.stdout.write(`${existed ? "added an approval to" : "approved"} goldens/${id}/ by ${name} (${made.entry.basis}, via ${via})\n`);
+    return 0;
+  }
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
     process.stdout.write(`\n--- goldens/${id}/${g.outputFile} ---\n${g.output.slice(0, 2000)}${g.output.length > 2000 ? "\n[...]" : ""}\n---\n`);
@@ -40,7 +67,7 @@ export async function run(argv) {
     const sha = createHash("sha256").update(readFileSync(join(dir, "SKILL.md"))).digest("hex");
     const made = approvalEntry({ name, rationale, basis, evidence, at: clock(a.flags).toISOString(), sha });
     if (made.error) return refuse(made.error);
-    const p = join(dir, "goldens", id, "APPROVAL.json");
+    const p = join(g.dir, "APPROVAL.json");
     const existed = existsSync(p);
     const prior = existed ? g.approval : null;
     writeFileSync(p, JSON.stringify(withApproval(prior, made.entry), null, 2) + "\n");

package/src/commands/doctor.mjs

@@ -8,8 +8,9 @@ import { changedFiles, touchedSkills, levelDrops } from "../changed.mjs";
 export const help = `superskill doctor <path...> [options]
 
 Score one skill, a folder of skills, or a plugin (skills/*/SKILL.md).
-Levels: skill (spec-valid, hygienic) < tested (evals + triggers) < superskill
-(approved golden, misses fixed with evals, a fresh --run that beats no-skill).
+Levels: skill (spec-valid, hygienic) < tested (real evals + triggers) < superskill
+(an approved golden from a real run a person accepted, misses fixed with evals, a fresh
+--run that beats no-skill).
 
 Options:
   --level <skill|tested|superskill>  target level for the exit code (default skill)
@@ -20,6 +21,8 @@ Options:
   --baseline-json <file>             a previous --json; exit 1 if any skill's level dropped
   --run                              run the evals with and without the skill (costs
                                      model calls; see "superskill doctor --run --help")
+  --private-goldens <dir>            also read goldens from <dir>/<skill-name>/<id>/ (or set
+                                     SUPERSKILL_PRIVATE_GOLDENS): real runs kept out of the skill
   --now <iso date>                   evaluate dates as of this moment
   --help                             this text
 
@@ -34,7 +37,7 @@ export async function run(argv) {
   const level = a.flags.level || "skill";
   if (!LEVELS.includes(level)) throw new UsageError(`--level must be one of ${LEVELS.join(", ")}`);
   if (!a._.length) throw new UsageError("doctor needs a path");
-  const opts = { level, now: clock(a.flags) };
+  const opts = { level, now: clock(a.flags), privateGoldens: a.flags["private-goldens"] || process.env.SUPERSKILL_PRIVATE_GOLDENS || null };
   if (a.flags.changed) {
     const all = a._.flatMap((p) => findSkills(p));
     const files = a._.flatMap((p) => changedFiles(p, a.flags.base));

package/src/commands/init.mjs

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, basename } from "node:path";
 import { parseArgs, UsageError } from "../args.mjs";
 import { skillDir } from "./common.mjs";
 import { MISSES_HEADER } from "../misses.mjs";
@@ -15,7 +15,9 @@ Never overwrites a file that exists.
 --from-session <file>  build the first eval and golden candidate from the session where
                        the job was done by hand. A Claude Code .jsonl gives the first
                        request and the final answer; any other file is the request.
-                       The golden waits for a person: run \`superskill approve\`.
+                       The golden waits for a person: fill in accepted.by and
+                       accepted.at in its PROVENANCE.json (who accepted the
+                       output when it ran), then \`superskill approve\`.
 `;
 
 const TRIGGER_EXAMPLE = [
@@ -65,6 +67,10 @@ export async function run(argv) {
     writeFileSync(evalsPath, JSON.stringify(doc, null, 2) + "\n");
     put(`goldens/${id}/input.md`, sessionCase.prompt + "\n");
     put(`goldens/${id}/output.md`, sessionCase.output ? sessionCase.output + "\n" : "");
+    // A real run, but nobody has said yet that its output was accepted. Until accepted.by and
+    // accepted.at are filled in (by the person, or by a tool that read their next message), this
+    // golden cannot count toward superskill however it is approved.
+    put(`goldens/${id}/PROVENANCE.json`, JSON.stringify({ source: "real-run", run: { session: basename(session), ledger_id: null, commit: null, at: null }, accepted: { by: null, at: null, signal: null, evidence: "" } }, null, 2) + "\n");
     process.stdout.write(`eval ${id} and golden candidate goldens/${id}/ written from ${session}\n`);
     process.stdout.write(`a person approves it with: superskill approve ${a._[0]} ${id}\n`);
   }

package/src/doctor.mjs

@@ -37,6 +37,7 @@ export function findSkills(path) {
 /** Score one loaded skill. */
 export function scoreSkill(dir, opts = {}) {
   const ctx = loadSkill(dir);
+  if (opts.privateGoldens) ctx.privateGoldens = opts.privateGoldens;
   const findings = runRules(ctx, opts.rules || allRules, opts);
   const level = computeLevel(findings);
   const up = nextLevel(level);

package/src/goldens.mjs

@@ -1,38 +1,90 @@
 // goldens/<id>/: input.md, the approved output (output.md, or any other non-input file),
-// and APPROVAL.json written by a person: { approvals: [{approved_by, approved_at, skill_sha,
-// rationale, basis, evidence}] }, or the single-approval shape from before 0.3.0.
+// APPROVAL.json written by a person: { approvals: [{approved_by, approved_at, skill_sha,
+// rationale, basis, evidence}] } (or the single-approval shape from before 0.3.0),
+// PROVENANCE.json saying where the example came from (0.5.0), and, for an anonymized twin of a
+// private golden, ANONYMIZED.json, the anonymizer's receipt.
+//
+// A golden may also live OUTSIDE the skill, in a private folder the operator keeps
+// (<private>/<skill-name>/<id>/), because a real run's input and output are usually about real
+// people and should not travel with a skill that is shared. The doctor reads both.
 import { readdirSync, readFileSync, existsSync, statSync } from "node:fs";
 import { join } from "node:path";
 
-export function readGoldens(dir) {
-  const root = join(dir, "goldens");
-  if (!existsSync(root)) return [];
+/** Files in a golden folder that describe it rather than being its input or output. */
+export const META_FILES = new Set(["APPROVAL.json", "PROVENANCE.json", "ANONYMIZED.json"]);
+
+/** Where goldens are read from: the skill's own goldens/, then the private folder for its name. */
+export function goldenRoots(dir, { privateGoldens = null, name = null } = {}) {
+  const roots = [{ root: join(dir, "goldens"), private: false }];
+  if (privateGoldens && name) roots.push({ root: join(privateGoldens, name), private: true });
+  return roots;
+}
+
+const readJsonFile = (p) => {
+  if (!existsSync(p)) return { value: null, error: null };
+  try { return { value: JSON.parse(readFileSync(p, "utf8")), error: null }; }
+  catch (e) { return { value: null, error: e.message }; }
+};
+
+export function readGoldens(dir, opts = {}) {
   const out = [];
-  for (const id of readdirSync(root).sort()) {
-    const gdir = join(root, id);
-    try { if (!statSync(gdir).isDirectory()) continue; } catch { continue; }
-    const files = readdirSync(gdir);
-    const inputName = files.find((f) => /^input\./i.test(f));
-    const outputName = files.find((f) => /^output\./i.test(f)) || files.find((f) => f !== inputName && f !== "APPROVAL.json" && !f.startsWith("."));
-    let approval = null, approvalError = null;
-    if (files.includes("APPROVAL.json")) {
-      try { approval = JSON.parse(readFileSync(join(gdir, "APPROVAL.json"), "utf8")); }
-      catch (e) { approvalError = e.message; }
+  for (const { root, private: priv } of goldenRoots(dir, opts)) {
+    if (!existsSync(root)) continue;
+    for (const id of readdirSync(root).sort()) {
+      const gdir = join(root, id);
+      try { if (!statSync(gdir).isDirectory()) continue; } catch { continue; }
+      const files = readdirSync(gdir).filter((f) => { try { return statSync(join(gdir, f)).isFile(); } catch { return false; } });
+      const inputName = files.find((f) => /^input\./i.test(f));
+      const outputName = files.find((f) => /^output\./i.test(f)) || files.find((f) => f !== inputName && !META_FILES.has(f) && !f.startsWith("."));
+      const appr = readJsonFile(join(gdir, "APPROVAL.json"));
+      const prov = readJsonFile(join(gdir, "PROVENANCE.json"));
+      const anon = readJsonFile(join(gdir, "ANONYMIZED.json"));
+      const provenance = prov.value;
+      out.push({
+        id,
+        dir: gdir,
+        private: priv,
+        input: inputName ? readFileSync(join(gdir, inputName), "utf8") : null,
+        outputFile: outputName || null,
+        output: outputName ? readFileSync(join(gdir, outputName), "utf8") : null,
+        approval: appr.value,
+        approvals: approvalsOf(appr.value),
+        approvalError: appr.error,
+        provenance,
+        provenanceError: prov.error,
+        anonymized: anon.value,
+        origin: originOf(provenance, anon.value),
+      });
     }
-    out.push({
-      id,
-      dir: gdir,
-      input: inputName ? readFileSync(join(gdir, inputName), "utf8") : null,
-      outputFile: outputName || null,
-      output: outputName ? readFileSync(join(gdir, outputName), "utf8") : null,
-      approval,
-      approvals: approvalsOf(approval),
-      approvalError,
-    });
   }
   return out;
 }
 
+/** Where a golden's example came from. `real-run` is the only source that can reach superskill. */
+export const SOURCES = ["real-run", "synthetic", "synthetic-reconstruction"];
+
+/**
+ * Is this golden a real run a person accepted, and if not, why not?
+ *
+ * A real run names the run it came from (a session, a commit, a ledger id, or, for an
+ * anonymized twin, `derived_from`: a hash of the private original, never its content) and the
+ * person who accepted the output when it happened, and when. An anonymized twin must also carry
+ * the anonymizer's receipt, because "the original was accepted" and "this twin still says the
+ * same thing" are different claims.
+ */
+export function originOf(prov, receipt = null) {
+  if (!prov || typeof prov !== "object") return { real: false, why: "no PROVENANCE.json" };
+  if (prov.source !== "real-run") return { real: false, why: `source is ${JSON.stringify(prov.source ?? null)}, not "real-run"` };
+  const run = prov.run && typeof prov.run === "object" ? prov.run : {};
+  const ref = ["session", "commit", "ledger_id"].map((k) => run[k]).concat(prov.derived_from).find((x) => typeof x === "string" && x.trim());
+  if (!ref) return { real: false, why: "names no run (run.session, run.commit, run.ledger_id or derived_from)" };
+  const acc = prov.accepted && typeof prov.accepted === "object" ? prov.accepted : {};
+  if (!(typeof acc.by === "string" && acc.by.trim())) return { real: false, why: "names no person who accepted the run (accepted.by)" };
+  if (!validDate(acc.at)) return { real: false, why: "has no valid accepted.at" };
+  if (prov.anonymized === true && !(receipt && typeof receipt === "object" && receipt.fingerprint)) return { real: false, why: "is an anonymized twin with no ANONYMIZED.json receipt" };
+  return { real: true, why: "" };
+}
+
 /** What an approval rests on. `judgment`: the people who approved it read it and said it is right.
  *  `outcome`: it produced a result in the world someone can check (a client landed, a call booked).
  *  Being liked and being proven are different weights, and a golden says which it carries. */
@@ -54,6 +106,7 @@ export function approvalsOf(approval) {
       rationale: String(a.rationale ?? a.note ?? "").trim(),
       basis: a.basis === "outcome" ? "outcome" : "judgment",
       evidence: String(a.evidence ?? "").trim(),
+      via: String(a.via ?? "").trim(),
     }));
 }
 
@@ -81,3 +134,12 @@ export function withApproval(existing, entry) {
 }
 
 export const isApproved = (g) => approvalsOf(g.approval).length > 0;
+
+/** Approved AND from a real run a person accepted: the only golden that counts for superskill. */
+export const isRealApproved = (g) => isApproved(g) && (g.origin || originOf(g.provenance, g.anonymized)).real;
+
+/** The options readGoldens needs for a loaded skill: its name and the private folder, if any. */
+export const goldenOpts = (ctx, opts = {}) => ({
+  name: (typeof ctx.data?.name === "string" && ctx.data.name) || ctx.folderName,
+  privateGoldens: opts.privateGoldens ?? ctx.privateGoldens ?? process.env.SUPERSKILL_PRIVATE_GOLDENS ?? null,
+});

package/src/ledger.mjs

@@ -12,7 +12,10 @@ export function ledgerPaths(skillDir, skillName) {
   const out = [];
   const local = join(skillDir, "invocations.jsonl");
   if (existsSync(local)) out.push(local);
-  const root = join(homedir(), ".freedom", "ledger", "skills");
+  // FREEDOM_SKILL_LEDGER_HOME is where Freedom itself writes when it is re-pointed (tests, a
+  // second profile); read the same place it writes.
+  const home = process.env.FREEDOM_SKILL_LEDGER_HOME || join(homedir(), ".freedom", "ledger");
+  const root = join(home, "skills");
   if (existsSync(root) && skillName) {
     for (const plugin of readdirSync(root).sort()) {
       const p = join(root, plugin, `${skillName}.jsonl`);
@@ -30,15 +33,48 @@ export function ledgerMisses(path, known, skillName) {
     let rec;
     try { rec = JSON.parse(line); } catch { continue; }
     if (!rec || !rec.id || known.has(rec.id)) continue;
-    if (skillName && rec.skill && rec.skill !== skillName) continue;
+    // A sandbox run (superskill doctor --run) is a test of the skill, not a use of it.
+    if (rec.synthetic) continue;
+    if (skillName && rec.skill && bare(rec.skill) !== bare(skillName)) continue;
     const kinds = (Array.isArray(rec.interventions) ? rec.interventions : []).filter((i) => i && MISS_KINDS.has(i.kind));
     const failed = rec.outcome === "failed";
     if (!kinds.length && !failed) continue;
     const parts = kinds.map((i) => `${i.kind}${i.note || i.what ? `: ${i.note || i.what}` : ""}`);
-    if (failed) parts.unshift(`run failed${Array.isArray(rec.errors) && rec.errors.length ? ` (${rec.errors.slice(0, 2).join("; ")})` : ""}`);
+    if (failed) parts.unshift(`run failed${Array.isArray(rec.errors) && rec.errors.length ? ` (${rec.errors.slice(0, 2).map((e) => (typeof e === "string" ? e : e?.kind || "error")).join("; ")})` : ""}`);
     const date = typeof rec.started === "string" && /^\d{4}-\d{2}-\d{2}/.test(rec.started) ? rec.started.slice(0, 10) : null;
-    out.push({ date, status: "open", what: parts.join("; ").replace(/\s+/g, " ").slice(0, 300), expected: "", source: `freedom-ledger ${rec.id}` });
+    // A correction made in the operator's NEXT message is the best "should have" there is, and the
+    // ledger keeps only where it is, never its words: point at it, so the fixer reads it there.
+    const ref = rec.next_turn_ref && rec.session_id ? ` (the correction is the operator's message in session ${String(rec.session_id).slice(0, 8)} at ${rec.next_turn_ref.at || "?"}${Number.isFinite(rec.next_turn_ref.offset) ? `, transcript byte ${rec.next_turn_ref.offset}` : ""})` : "";
+    const expected = rec.corrected_after ? `what the operator asked for instead${ref}` : "";
+    out.push({ date, status: "open", what: parts.join("; ").replace(/\s+/g, " ").slice(0, 300), expected, source: `freedom-ledger ${rec.id}` });
     known.add(rec.id);
   }
   return out;
 }
+
+const bare = (name) => String(name || "").split(":").pop();
+
+/**
+ * How many runs the person accepted, from Freedom's `next_turn` verdict (the class of the first
+ * message after a run handed back). Runs with no verdict are left out of both sides, so a missing
+ * record can never read as an acceptance, and sandbox runs never count.
+ */
+export function acceptedRate(paths, { now = new Date(), days = 30 } = {}) {
+  const since = now.getTime() - days * 86400000;
+  let judged = 0, accepted = 0, synthetic = 0;
+  for (const p of paths) {
+    let text = "";
+    try { text = readFileSync(p, "utf8"); } catch { continue; }
+    for (const line of text.split("\n")) {
+      if (!line.trim()) continue;
+      let rec; try { rec = JSON.parse(line); } catch { continue; }
+      const t = Date.parse(rec?.started || "");
+      if (!Number.isFinite(t) || t < since || t > now.getTime()) continue;
+      if (rec.synthetic) { synthetic++; continue; }
+      if (!rec.next_turn || rec.next_turn === "none") continue;
+      judged++;
+      if (["close", "go", "new_topic"].includes(rec.next_turn) && !rec.corrected_after && !["failed", "abandoned"].includes(rec.outcome)) accepted++;
+    }
+  }
+  return { judged, accepted, synthetic };
+}

package/src/rules/superskill.mjs

@@ -2,13 +2,15 @@
 // got something wrong, and proven recently on a current model against the no-skill baseline.
 import { createHash } from "node:crypto";
 import { defineRules } from "./define.mjs";
-import { readGoldens, isApproved, weightOf } from "../goldens.mjs";
+import { readGoldens, isApproved, isRealApproved, weightOf, goldenOpts } from "../goldens.mjs";
+import { ledgerPaths, acceptedRate } from "../ledger.mjs";
 import { readMisses } from "../misses.mjs";
 import { readEvals, readLatestRun } from "../evals.mjs";
 
 const f = (severity, message, fix) => ({ severity, message, fix });
 const DAY = 86400000;
 export const OPEN_MISS_DAYS = 14;
+export const REAL_USE_DAYS = 30;
 /** How long a --run stays fresh, by metadata.cadence. */
 export const FRESH_DAYS = { daily: 30, weekly: 30, monthly: 60, quarterly: 120, yearly: 365 };
 const DEFAULT_FRESH = 30;
@@ -19,15 +21,27 @@ export const superskillRules = defineRules([
   {
     id: "golden-approved",
     level: "superskill",
-    check(ctx) {
+    check(ctx, opts = {}) {
       if (ctx.error) return [];
-      const goldens = readGoldens(ctx.dir);
-      const approved = goldens.filter(isApproved);
+      const goldens = readGoldens(ctx.dir, goldenOpts(ctx, opts));
+      const approvedAny = goldens.filter(isApproved);
+      // 0.5.0: only a golden from a real run a person accepted counts. An invented example, however
+      // careful, puts "a person said this was right" on something no person's work produced, and a
+      // skill could then reach the top level on its author's fiction.
+      const approved = goldens.filter(isRealApproved);
       const out = [];
+      const where = (g) => (g.private ? `private golden ${g.id}` : `goldens/${g.id}`);
       for (const g of goldens.filter((x) => x.approvalError))
-        out.push(f("fail", `goldens/${g.id}/APPROVAL.json is not valid JSON`, `Re-record it with \`superskill approve . ${g.id}\`.`));
+        out.push(f("fail", `${where(g)}/APPROVAL.json is not valid JSON`, `Re-record it with \`superskill approve . ${g.id}\`.`));
+      for (const g of goldens.filter((x) => x.provenanceError))
+        out.push(f("fail", `${where(g)}/PROVENANCE.json is not valid JSON`, "Rewrite it: source, run, accepted (see SPEC.md, goldens)."));
       if (!approved.length) {
-        out.push(f("fail", goldens.length ? `${goldens.length} golden${goldens.length === 1 ? "" : "s"}, none approved by a person` : "no goldens", goldens.length ? "A person runs `superskill approve <skill> <golden>` at a terminal after checking the output." : "Save a real input and the output you would sign off on under goldens/<id>/, then `superskill approve`."));
+        if (approvedAny.length) {
+          const why = approvedAny.map((g) => `${g.id} ${g.origin.why}`).join("; ");
+          out.push(f("fail", `${approvedAny.length} approved golden${approvedAny.length === 1 ? "" : "s"}, none from a real run a person accepted (${why})`, "A golden counts toward superskill only when goldens/<id>/PROVENANCE.json says source: real-run, names the run (session, commit, ledger id, or derived_from for an anonymized twin) and who accepted it and when. Invented examples belong in evals/evals.json, where they hold the skill at tested."));
+        } else {
+          out.push(f("fail", goldens.length ? `${goldens.length} golden${goldens.length === 1 ? "" : "s"}, none approved by a person` : "no goldens", goldens.length ? "A person runs `superskill approve <skill> <golden>` at a terminal (or relays a tap with --approved-by and --via) after checking the output." : "Save a real run's input and the output a person accepted under goldens/<id>/ with PROVENANCE.json, then `superskill approve`."));
+        }
         return out;
       }
       const sha = createHash("sha256").update(ctx.raw).digest("hex");
@@ -43,6 +57,19 @@ export const superskillRules = defineRules([
       return out;
     },
   },
+  {
+    // The real number beside the level: of the runs whose next message is recorded, how many did
+    // the person accept. Info only. A level is evidence about examples; this is evidence about use.
+    id: "real-use",
+    level: "superskill",
+    check(ctx, { now = new Date() } = {}) {
+      if (ctx.error) return [];
+      const name = (typeof ctx.data?.name === "string" && ctx.data.name) || ctx.folderName;
+      const r = acceptedRate(ledgerPaths(ctx.dir, name), { now, days: REAL_USE_DAYS });
+      if (!r.judged) return [];
+      return [f("info", `real use, last ${REAL_USE_DAYS} days: ${r.accepted} of ${r.judged} judged runs accepted (${pct(r.accepted / r.judged)})${r.synthetic ? `; ${r.synthetic} sandbox run${r.synthetic === 1 ? "" : "s"} not counted` : ""}`, "")];
+    },
+  },
   {
     id: "misses-log-present",
     level: "superskill",
@@ -74,6 +101,7 @@ export const superskillRules = defineRules([
       const misses = (readMisses(ctx.dir) || []).filter((m) => m.status === "fixed");
       if (!misses.length) return [];
       const ids = new Set(readEvals(ctx.dir).cases.map((c) => String(c.id)));
+      // Shipped goldens only: a miss is closed by a check that travels with the skill.
       for (const g of readGoldens(ctx.dir)) ids.add(g.id);
       return misses
         .filter((m) => !m.eval || !ids.has(String(m.eval)))

package/src/rules/tested.mjs

@@ -2,7 +2,7 @@
 // with both should-load requests and near-misses that should not load the skill.
 import { defineRules } from "./define.mjs";
 import { readEvals, readTriggers } from "../evals.mjs";
-import { readGoldens } from "../goldens.mjs";
+import { readGoldens, goldenOpts } from "../goldens.mjs";
 
 const f = (severity, message, fix) => ({ severity, message, fix });
 export const MIN_EVALS = 3, MIN_TRIGGERS = 10, MIN_EACH_SIDE = 3;
@@ -15,7 +15,7 @@ export const testedRules = defineRules([
       if (ctx.error) return [];
       const e = readEvals(ctx.dir);
       if (e.error) return [f("fail", e.error, "Fix evals/evals.json so it parses as skill-creator's {skill_name, evals: [...]}.")];
-      const goldenCases = readGoldens(ctx.dir).filter((g) => g.input !== null && g.output !== null).length;
+      const goldenCases = readGoldens(ctx.dir, goldenOpts(ctx)).filter((g) => g.input !== null && g.output !== null).length;
       const n = e.cases.length + goldenCases;
       if (n < MIN_EVALS)
         return [f("fail", `${n} eval case${n === 1 ? "" : "s"} (need ${MIN_EVALS})`, "Add real requests to evals/evals.json (`superskill init` writes an example).")];
@@ -35,6 +35,29 @@ export const testedRules = defineRules([
         : [];
     },
   },
+  {
+    // MEASURED 2026-10-05 (freedom-dev): `superskill init` writes one example eval and two example
+    // triggers, each starting "REPLACE:", and a skill whose author copied those up to 3 and 10
+    // scored `tested` while testing nothing. A placeholder, or the same request twice, is not a case.
+    id: "evals-real",
+    level: "tested",
+    check(ctx) {
+      if (ctx.error) return [];
+      const e = readEvals(ctx.dir), t = readTriggers(ctx.dir);
+      const out = [];
+      const placeholder = (x) => /\bREPLACE:/.test(JSON.stringify(x));
+      const evalHits = e.cases.filter((c) => placeholder([c.prompt, c.expected_output, c.assertions])).map((c) => c.id);
+      if (evalHits.length) out.push(f("fail", `eval case${evalHits.length === 1 ? "" : "s"} ${evalHits.join(", ")} still hold${evalHits.length === 1 ? "s" : ""} a \`superskill init\` REPLACE: placeholder`, "Replace every example with a real request this skill handles and what a good answer must contain."));
+      const trigHits = t.triggers.filter((x) => placeholder(x.query)).length;
+      if (trigHits) out.push(f("fail", `${trigHits} trigger${trigHits === 1 ? "" : "s"} still hold a REPLACE: placeholder`, "Replace them with realistic requests, including near-misses that should not load the skill."));
+      const dup = (list) => list.filter((x, i) => x && list.indexOf(x) !== i);
+      const dp = [...new Set(dup(e.cases.map((c) => c.prompt.trim())))];
+      if (dp.length) out.push(f("fail", `${dp.length} eval prompt${dp.length === 1 ? " is" : "s are"} repeated: the same request twice is one case`, "Make each case a different request."));
+      const dq = [...new Set(dup(t.triggers.map((x) => x.query.trim().toLowerCase())))];
+      if (dq.length) out.push(f("fail", `${dq.length} trigger quer${dq.length === 1 ? "y is" : "ies are"} repeated`, "Make each trigger a different request."));
+      return out;
+    },
+  },
   {
     id: "triggers-present",
     level: "tested",

package/src/run/claude.mjs

@@ -3,12 +3,13 @@
 // a copy installed at user level cannot leak into the baseline.
 import { spawnSync } from "node:child_process";
 import { prepareWorkspace } from "./workspace.mjs";
+import { sandboxEnv } from "./env.mjs";
 
 export const name = "claude";
 
 function call(args, cwd) {
   const t0 = Date.now();
-  const r = spawnSync("claude", args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, timeout: 15 * 60 * 1000 });
+  const r = spawnSync("claude", args, { cwd, env: sandboxEnv(), encoding: "utf8", maxBuffer: 64 * 1024 * 1024, timeout: 15 * 60 * 1000 });
   const ms = Date.now() - t0;
   if (r.error) throw Object.assign(new Error(`claude failed to start: ${r.error.message}`), { code: "SUPERSKILL" });
   let doc = null;

package/src/run/codex.mjs

@@ -5,6 +5,7 @@ import { spawnSync } from "node:child_process";
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { prepareWorkspace } from "./workspace.mjs";
+import { sandboxEnv } from "./env.mjs";
 
 export const name = "codex";
 
@@ -14,7 +15,7 @@ function call(prompt, cwd, model) {
   if (model) args.push("-m", model);
   args.push(prompt);
   const t0 = Date.now();
-  const r = spawnSync("codex", args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, timeout: 15 * 60 * 1000 });
+  const r = spawnSync("codex", args, { cwd, env: sandboxEnv(), encoding: "utf8", maxBuffer: 64 * 1024 * 1024, timeout: 15 * 60 * 1000 });
   if (r.error) throw Object.assign(new Error(`codex failed to start: ${r.error.message}`), { code: "SUPERSKILL" });
   const output = existsSync(out) ? readFileSync(out, "utf8") : r.stdout;
   const tok = (r.stderr + r.stdout).match(/tokens used[:\s]+([\d,]+)/i);

package/src/run/env.mjs

@@ -0,0 +1,17 @@
+// The environment every sandboxed run gets, so a `doctor --run` session is never counted as a
+// real use of the skill by whatever is recording real uses.
+//
+// MEASURED, NOT FEARED (2026-10-05): Freedom's skill ledger records every skill run from a
+// harness hook. The doctor's own sandbox runs fired that hook, so three runs of a skill nobody had
+// ever used for real landed in the operator's ledger as perfect one-shot runs. Left alone, every
+// `doctor --run` raises the number that is meant to keep the doctor honest.
+//
+// Two signals, because a caller's recorder may honour either: FREEDOM_SKILL_LEDGER=off is the
+// Freedom ledger's documented off switch, and SUPERSKILL_SANDBOX=1 names the run for any other
+// recorder. The run folder's own name (SANDBOX_PREFIX) is the third, for a recorder that reads
+// only the hook payload's cwd.
+export const SANDBOX_PREFIX = "superskill-run-";
+
+export function sandboxEnv(base = process.env) {
+  return { ...base, FREEDOM_SKILL_LEDGER: "off", SUPERSKILL_SANDBOX: "1" };
+}

package/src/run/fake.mjs

@@ -3,12 +3,13 @@
 // {output, tokens?, model?}. Never calls a model.
 import { spawnSync } from "node:child_process";
 import { prepareWorkspace } from "./workspace.mjs";
+import { sandboxEnv } from "./env.mjs";
 
 export const name = "fake";
 
 function call(script, req) {
   const t0 = Date.now();
-  const r = spawnSync(process.execPath, [script], { input: JSON.stringify(req), encoding: "utf8" });
+  const r = spawnSync(process.execPath, [script], { input: JSON.stringify(req), env: sandboxEnv(), encoding: "utf8" });
   if (r.status !== 0) throw Object.assign(new Error(`fake harness failed: ${r.stderr}`), { code: "SUPERSKILL" });
   const doc = JSON.parse(r.stdout);
   return { output: doc.output ?? "", tokens: doc.tokens ?? null, model: doc.model ?? "fake", ms: Date.now() - t0, failed: false };

package/src/run/index.mjs

@@ -39,11 +39,12 @@ export function pickHarness(name) {
 }
 
 /** Every case the run will execute: evals.json cases plus goldens judged against their approved output. */
-export function collectCases(skillDir) {
+export function collectCases(skillDir, { privateGoldens = process.env.SUPERSKILL_PRIVATE_GOLDENS || null } = {}) {
   const e = readEvals(skillDir);
+  const name = parseSkillFile(readFileSync(join(skillDir, "SKILL.md"), "utf8")).data.name || "";
   if (e.error) throw new UsageError(e.error);
   const cases = e.cases.filter((c) => c.prompt.trim()).map((c) => ({ id: String(c.id), prompt: c.prompt, files: c.files, assertions: c.assertions.length ? c.assertions : [c.expected_output].filter(Boolean) }));
-  for (const g of readGoldens(skillDir)) {
+  for (const g of readGoldens(skillDir, { privateGoldens, name })) {
     if (!g.input || !g.output || !g.output.trim()) continue;
     cases.push({ id: `golden:${g.id}`, prompt: g.input, files: [], assertions: [`The output matches this approved output in substance (same facts, same shape; wording may differ):\n${g.output}`] });
   }

package/src/run/workspace.mjs

@@ -1,6 +1,7 @@
 import { mkdtempSync, mkdirSync, symlinkSync, cpSync, existsSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
+import { SANDBOX_PREFIX } from "./env.mjs";
 
 /**
  * A fresh working folder for one run. With `linkAt` (e.g. ".claude/skills"), the skill is
@@ -8,7 +9,7 @@ import { join, dirname } from "node:path";
  * files (paths relative to the skill) are copied in at the same relative paths.
  */
 export function prepareWorkspace({ skillDir, skillName, files = [], linkAt = null }) {
-  const cwd = mkdtempSync(join(tmpdir(), "superskill-run-"));
+  const cwd = mkdtempSync(join(tmpdir(), SANDBOX_PREFIX));
   if (linkAt) {
     const target = join(cwd, linkAt, skillName);
     mkdirSync(dirname(target), { recursive: true });