blun-king-cli 9.1.587 → 9.1.588

package/standard-skills/translate-native/SKILL.md

@@ -1,39 +1,189 @@
 ---
 name: translate-native
-description: Translate, localize, rewrite, and review user-visible language with native orthography, structural fidelity, and a fail-closed BLUN release gate.
+description: Translate, localize, transcreate, rewrite, or proofread human-language content so it reads as if originally written by a native speaker in any requested language, locale, dialect, register, or script. Use for prose, UI copy, websites, documentation, subtitles, emails, marketing, agent-generated target text, JSON/YAML/XML/PO/ARB resource files, and every other translation task—including Swedish, Chinese, Catalan, Basque, Czech, minority languages, and low-resource languages. In one self-contained workflow, preserve meaning and protected syntax, reject grammatical-but-unnatural wording and translationese, and enforce native Unicode spelling, diacritics, alphabets, scripts, punctuation, and locale conventions.
 ---
 
 # Translate Native
 
-Use this skill for every translation, localization, translated rewrite, translation review, or user-visible internationalization edit.
+## Mandatory host enforcement
 
-This bundled adaptation is based on translate-native 6.42.13. Read [references/native-translation-standard.md](references/native-translation-standard.md) and [references/evaluation-protocol.md](references/evaluation-protocol.md) for the full quality contract. For structured data, also read [references/structured-content.md](references/structured-content.md).
+When a host exposes the BLUN Language Gateway, every user-visible natural-language answer must pass through it before it can reach the user, a file, a commit, or a deployment. The host must set `task_kind: response` for an agent's own answer and `task_kind: translation` for every translation or localization output. Never bypass the gateway because the task is short, conversational, generated by another agent, or already appears fluent. A gateway `BLOCK`, missing receipt, stale receipt, edited target, wrong receipt purpose, or unavailable mandatory gateway blocks release.
 
-## Seven-pass review
+For an ordinary answer, call `release_response` with the complete final text, exact host-supplied language tag, and truthful nativeness and orthography attestations. For a translation, load this skill before drafting and call only `release_translation` with the complete source-target pair and all seven attestations. Never downgrade a translation to the response path or omit its source. The host—not the agent—must own task classification and expected language.
 
-Treat every proposed target as an untrusted draft. Review it in seven distinct passes:
+The MCP server injects this policy in its initialization response and exposes a `translate-native` prompt for clients that support MCP prompts. That makes the workflow difficult to forget, but skills, prompts, and tool descriptions are not themselves non-bypassable. Production hosts must intercept candidate output outside the agent and invoke `integrations/language_gateway.py`, or an equivalent trusted adapter, in fail-closed mode. The signing key and gateway process must run outside the agent's writable sandbox for strong isolation. If the agent can read the key, replace the gateway, choose the task kind, or suppress the source, cryptographic receipts prove no meaningful separation.
 
-1. Meaning and omissions: preserve every claim, condition, negation, number, and relationship.
-2. Native idiom: remove source-language syntax and translationese without changing meaning.
-3. Register and audience: match locale, tone, formality, and product context.
-4. Terminology and consistency: preserve protected names, commands, paths, placeholders, and repeated terms.
-5. Orthography: use native script, diacritics, capitalization, punctuation, and typography.
-6. Structure and integrity: preserve markup, keys, variables, links, code, and required formatting.
-7. Independent release review: reread source and target as complete documents and attest only what was actually checked.
+Version 6.2 and later production hosts should use the isolated guard service and verify-before-send adapters. The service—not the agent or delivery process—owns the signing key. Candidate streaming must be buffered until the complete two-field envelope is verified, and a service outage must block without local-key fallback. Content-free audit records may contain hashes and finding codes, but never source text, target text, release tokens, service tokens, or model reasoning.
 
-German `ss` is not deterministic evidence of broken native orthography because it may be correct. ASCII substitutions such as `ae`, `oe`, and `ue` require context-sensitive review against native spelling.
+For Claude Code, use the Version 6.3 authenticated loopback Streamable HTTP MCP together with the Version 6.64.0 `translate-native` plugin. The service survives client disconnects; the plugin injects mandatory session policy at `SessionStart` and repeats the exact release workflow for every child at `SubagentStart`. Require `Stop` and `SubagentStop` to consume a fresh service-signed one-time delivery grant bound to the canonical source and target hashes, exact language, task purpose, content policy, delivery channel, Claude session, service-authoritative current session-start epoch, agent identity, guard version, and current service boot. Accept Claude's documented `session_id` and optional `agent_id` only as non-empty, NUL-free strings; never coerce malformed hook identities into a grant namespace. Route `SubagentStop` through its dedicated hook mode, require its explicit `agent_id`, forbid `agent_id` on the main-thread `Stop` route, and reject a route/event mismatch before reading protected state so neither boundary can address the other's grant namespace. After an isolated-service restart, recover a missing session epoch only while authorizing a freshly verified release receipt; never recover during grant consumption or replace a different current epoch. Rotate the owner-only random epoch on every startup, resume, clear, compaction, fork, or `StopFailure` event; register its hash with the isolated service before writing the local marker, reject reused, missing, or unsafe epochs, and never allow a copied local grant record plus its old marker to authorize output. On `StopFailure`, remove the old local marker first, emit no error or candidate, keep other sessions isolated, and remain fail-closed until `SessionStart` if service registration or local replacement fails. On `SessionEnd`, remove the exact session's local epoch and grants first, then compare-and-swap only its still-current service epoch to an undisclosed tombstone within the cleanup budget; emit nothing, preserve parallel sessions, reject delayed retirement after a newer start, and require a fresh `SessionStart` before delivery can resume. Never let a subagent rely on the parent's grant or treat startup context as enforcement; the service-backed stop boundary remains authoritative. Persist only the source hash in hook state, never the complete translation source. Invalidate every unconsumed grant for the current session at `UserPromptSubmit`, before the new turn is processed, and again when `StopFailure` reports that the turn ended on an API error; never let a grant survive an interruption or failed turn into a later attempt, never emit the error or candidate from this cleanup, and never invalidate another labeled concurrent session. When `release_response` or `release_translation` fails at transport level, use `PostToolUseFailure` to invalidate the earlier grant for that exact session and agent before requesting a reconnect and fresh release. When the tool returns without a usable receipt, the isolated verifier rejects it, authorization becomes unavailable, or protected state cannot be replaced, invalidate the exact record both before the attempt and again on rejection so concurrent hooks cannot leave stale authority behind. Preserve unrelated agents and sessions, and block if protected state cannot be cleared. Discard structurally valid grant records created before Version 6.18 when they lack the session epoch required for safe resume isolation. Classify readable Morse runs of at least three separated valid letter codes using both dots and dashes, plus the exact bounded compact SOS prosign, as natural language; accept literal, HTML-encoded, standard typographic, punctuation-wrapped, and emoji-adjacent forms while retaining short decorative and incomplete-signal compatibility. Classify contiguous multi-symbol Unicode Roman numeral runs as natural language only when compatibility normalization cannot parse them as a non-increasing additive/subtractive Roman number; retain genuine numeric and isolated-symbol compatibility. Require Anthropic's documented `stop_hook_active` field to be an exact boolean on both `Stop` and `SubagentStop`; terminate malformed values with `continue: false` before reading or consuming any protected grant state. Give Claude one protected correction attempt after an invalid stop; if `stop_hook_active` is already true and the corrected answer is still unverified, terminate processing with `continue: false` instead of entering the client's finite block loop. A newly released exact answer may still pass during that correction attempt. Apply the same rule to `SubagentStop`. Keep the operating-system health monitor enabled so it proves an audit-free release/signature/tamper round trip, executes a real Swedish Unicode MCP tool call, checks the enrolled Claude plugin cache every minute, repairs one ordered dependency pass, applies persistent exponential backoff after repeated repair failures, and remains fail-closed during recovery. Never steal the shared maintenance lock from a live owner solely because it exceeds the stale-age threshold; bind new locks to the operating-system process-start identity so a reused numeric PID cannot preserve a crashed owner, recover only a confirmed dead, mismatched-generation, or untrusted old owner, preserve ambiguous and legacy live owners, and compare the exact file identity again before removing or releasing a lock. Never auto-install a missing plugin; enroll only an observed installation. Before executing candidate code, require the active repository to have a valid completely clean `HEAD`, including untracked paths; recheck the identical clean revision before fetch and again after fetch immediately before fast-forward, then require the exact tested revision and a clean checkout immediately after cutover and after post-update tests before any runtime activation. Never stash or delete local work; use only `reset --keep` to undo a cutover or post-test race with uncommitted concurrent changes, and never reset or automatically execute an independently advanced `HEAD`. Strictly validate the clean tested candidate before changing the active repository or either persistent runtime, refresh only the trusted marketplace, and require its publicly advertised version to equal the candidate version. Permit the cutover only after that preflight succeeds without changing the installed plugin cache; then apply the official user-scope plugin update and verify enabled state, load errors, and the exact installed version through Claude's public CLI. Remain degraded on every mismatch or process loss, preserve the active runtime when preflight fails, and require `/reload-plugins` or a new session before treating downloaded hooks as loaded. When signed-commit policy is enabled in the caller, active updater policy, or rollback-paused policy, combine those requirements monotonically and verify the exact update or rollback commit before test discovery or any other repository-owned code executes. Reject symbolic links, special files, oversized input, malformed JSON, and invalid stored updater field types fail-closed on every public updater path; write policy JSON only through unpredictable owner-only atomic temporary files. When enabling automatic updates again, preserve any active or rollback-paused signature requirement; lower it only through an explicit disable followed by a new enable. For emergency recovery, use only the installer's tested `rollback` command: it accepts the updater-recorded ancestor, requires the same completely clean exact `HEAD` after preflight and the clean exact target after cutover, after post-rollback tests, and again after runtime and Claude-cache probes before pausing updates, preserves uncommitted race-time bytes with `reset --keep`, never resets an independent commit, preserves signature policy, requires an already matching Claude cache, probes restarted runtimes, and pauses automatic updates after success. Portable receipt verification must only read an existing owner-only key; it must never create, replace, or repair signing state. An advertised tool list, heartbeat, successful tool call, or locally forged hook record alone is insufficient. Do not edit the text after release, reuse a prior grant, relabel a grant across source, locale, purpose, content policy, or session epoch, or fall back to an unguarded response when the HTTP MCP or isolated guard is unavailable.
 
-## Mandatory release gate
+For titles, meta descriptions, and UI strings, pass the exact `content_type`. A short result with insufficient deterministic evidence returns `REVIEW_REQUIRED`, not `PASS`. `short_text_reviewed` is compatibility metadata, not proof: the caller must never use it to override a finding, and the guard does not allow it to suppress measurable ASCII-folding pressure. Genuine independence requires a host-controlled gateway or reviewer outside the releasing agent's authority. The receipt binds the review flag and content type. Transport-only BOM and CRLF/LF differences are canonicalized; mojibake and character changes are never canonicalized away.
 
-Before releasing target-language text, call the BLUN language guard tool `release_translation` with:
+Do not treat German `ss` as deterministic evidence of ASCII folding. It is native spelling in many words and requires lexical plus locale context to distinguish it from `ß`. The measurable German folding-pressure rule therefore covers `ae`, `oe`, and `ue`; leave `ss`/`ß` ambiguity to a locale-aware dictionary or native reviewer.
 
-- the complete source and complete target;
-- the exact language tag and content type;
-- truthful attestations for all seven passes;
-- `short_text_reviewed: true` only after an independent native review of a short UI string, title, or metadata field.
+Translate meaning, not word order. Re-author the message so a native speaker would believe it was written in the target language from the beginning, while preserving every source claim and constraint.
 
-Release only when the response says `release_allowed: true`. Confirm its receipt using `verify_release_token` with the exact same source, target, language, content type, review status, version, and expiry. Never fabricate, edit, reuse, expose, request, or log a release token or signing key.
+## Enforce the release gate
 
-If the gate blocks, revise and run it again. If the enforced service is unavailable, fail closed for publication-grade or structured translation work. For ordinary conversational translation, run the bundled local guards, label the enforced gate unavailable, and keep the response provisional.
+When the `blun-language-guard` MCP server is available, call `release_translation` after the seven-pass quality gate and before delivering any translation. Supply the complete source, complete target, exact language tag, and seven truthful pass attestations. Delivery is allowed only when the server returns `release_allowed: true` and a release token for that exact source-target pair.
 
-For programmatic integrations, return the verified `release_response` unchanged rather than reconstructing it.
+Never invent, reuse, alter, or expose a release token. If the gate returns `BLOCK`, correct the target and run it again. If the MCP server is unavailable, run the bundled structural and orthography guards directly. Fail closed for publication-grade or structured work; for ordinary conversational translation, disclose that the enforced MCP validation was unavailable.
+
+The MCP gate enforces execution discipline and deterministic checks. Version 6 issues a cryptographically signed, purpose-bound receipt for either an ordinary response or a translation. It binds the exact target, locale, task purpose, guard version, issue time, expiry, and the complete source for translations. Verify it with `verify_release_token` or the portable pre-output hook; never trust a token based on its prefix or appearance. The receipt proves process integrity, not native fluency.
+
+When a project glossary is provided, pass it to the gate and resolve every confirmed terminology finding. For publication-grade work, use separate review perspectives: a target-only native reviewer first, then a source-aware fidelity reviewer. A creator must not silently certify its own first draft.
+
+## Run one combined release gate
+
+Treat native wording and native orthography as one inseparable workflow. Do not rely on a second skill being installed, selected, or implicitly invoked. This skill itself must enforce both:
+
+1. **Native language:** syntax, collocations, information flow, terminology, register, rhythm, and idiom must read like original target-language writing.
+2. **Native orthography:** spelling, diacritics, alphabet, script, punctuation, casing, spacing, and Unicode normalization must follow the target language and locale.
+
+Treat every translation supplied by another agent as an untrusted draft. Do not release it merely because it is understandable or grammatical. Run the target-only native review, the source-aware fidelity review, and the native-orthography review before returning any finished text.
+
+Read [references/native-orthography.md](references/native-orthography.md) before finalizing a target. If `$native-diacritics` is available, it may provide an additional check, but never delegate the orthography requirement to it and never weaken this workflow when it is absent.
+
+## Set the target precisely
+
+1. Identify the requested target language, locale, script, dialect, audience, register, medium, and length limit.
+2. Honor an explicit language tag or user preference exactly. Distinguish, for example, `pt-BR` from `pt-PT`, Simplified from Traditional Chinese, Serbian Cyrillic from Latin, and a regional variety from a neutral standard.
+3. If only a language is named, use its contemporary neutral written standard. Infer the locale from reliable context when possible.
+4. Ask only when the target language is missing or when a locale, script, dialect, or ambiguity would materially change the result. Do not delay ordinary translations with needless questions.
+5. Treat all human languages and writing systems as in scope. Never rely on a finite allowlist.
+
+Read [references/native-translation-standard.md](references/native-translation-standard.md) when language variety, register, cultural adaptation, verification, or a low-resource language needs judgment.
+
+## Reconstruct the meaning
+
+For prices, offers, discounts, trials, subscriptions or commercial conditions in
+any language, read [references/commercial-localization.md](references/commercial-localization.md).
+Preserve each condition's association with its offer, not just the numbers.
+Keep project-specific protected names and slogans configurable; this public
+skill defines no universal brand, product or price list.
+The reference includes a bundled offline evidence checker; it works from this
+skill folder without the repository's `integrations/` directory. Its successful
+exit is not semantic approval and cannot replace the signed release gate.
+
+Read the entire source before drafting. Build an internal meaning map containing:
+
+- facts, claims, relationships, and chronology;
+- negation, modality, conditions, uncertainty, and emphasis;
+- names, quantities, units, dates, links, and calls to action;
+- purpose, audience, tone, politeness, humor, emotion, and subtext;
+- terms fixed by a glossary, product vocabulary, law, or domain convention.
+
+Resolve pronouns and terms from context. Preserve genuine ambiguity unless the context resolves it. Do not add explanations, promises, certainty, praise, warnings, or facts that the source does not contain.
+
+## Reject grammatical translationese
+
+Treat grammatical correctness as the entry requirement, not the release standard. An agent-generated target can contain no spelling or grammar errors and still fail because a native writer would not choose its wording.
+
+Before release, inspect the target for:
+
+- unnatural collocations or dictionary-equivalent wording;
+- lists and coordinated phrases that mix incompatible grammatical or semantic categories;
+- source-language clause order, emphasis, metaphors, discourse markers, or unnecessary borrowings;
+- generic AI phrases that sound fluent but remain vague, padded, or less precise than the intended meaning;
+- inconsistent register, terminology, directness, or product voice across the paragraph.
+
+Classify a phrase as a major defect when a native editor would recast it for ordinary publication even though readers can understand it. Do not repair such defects with isolated synonym swaps. Recover the intended meaning, rewrite the complete clause or paragraph in the target language, and then rerun the fidelity pass.
+
+Read [references/translationese-review.md](references/translationese-review.md) when reviewing an existing translation, agent-written copy, product or marketing prose, or any target that is grammatical but still feels translated.
+
+## Separate creation from judgment
+
+Use two deliberately different review perspectives. Do not collapse them into one vague reread.
+
+1. **Native pass:** Draft from the meaning map rather than translating sentence by sentence. Then hide the source and read only the target as original writing. Remove unnatural syntax, collocations, category mixing, unnecessary borrowings, vague AI filler, rhythm, repetition, discourse markers, politeness, and medium-inappropriate wording. If the target passes only because the source wording is still visible, it fails.
+2. **Fidelity pass:** Compare the revised target against the complete source. Restore anything omitted and remove anything added. Recheck negation, modality, quantities, causality, uncertainty, names, terminology, and calls to action.
+3. **Integrity pass:** Verify protected syntax and native orthography only after the wording is stable.
+
+For consequential, publication-grade, long-form, or linguistically uncertain work, use an independent reviewer when another agent or reviewer is available. Give it the source, candidate target, target specification, and the defect rubric—never the intended answer. Ask for defects rather than a replacement translation, revise the candidate, then rerun both passes.
+
+Read [references/evaluation-protocol.md](references/evaluation-protocol.md) for the blocking defect classes, independent-review contract, confidence routing, and long-document procedure.
+
+## Re-author natively
+
+Put the source sentence structure aside after understanding it. Express the same meaning with native syntax, collocations, information flow, rhythm, idiom, punctuation, and level of directness.
+
+- Prefer what a native writer would naturally say over a dictionary-equivalent phrase.
+- Replace calques and source-language discourse patterns with target-language conventions.
+- Match the audience and medium: support reply, legal notice, product UI, conversation, documentation, marketing, or literature.
+- Preserve intentional code-switching, names, trademarks, and established technical terms.
+- Avoid bland translationese, inflated marketing language, generic AI filler, and vague claims such as “in a smart way” when the intended operation can be stated precisely.
+- Use native script and Unicode characters. Never strip accents or transliterate unless asked or technically required.
+- Run the built-in orthography gate from [native-orthography.md](references/native-orthography.md). Correct every confirmed spelling, diacritic, alphabet, script, punctuation, spacing, casing, or Unicode defect before delivery.
+
+Default to faithful native translation. Localize measurements, formats, examples, or cultural references only when the task or medium calls for it. Transcreate more freely only when asked or when preserving communicative effect clearly requires it; never change factual claims silently.
+
+## Protect structured content
+
+Treat i18n files as containers, not as permission to write robotic i18n language. Translate every user-visible value natively while preserving the container exactly.
+
+- Preserve keys, hierarchy, ordering when significant, types, escaping, markup, links, code, placeholders, ICU plural/select logic, and interpolation syntax.
+- Inspect neighboring entries and all branches before choosing terminology.
+- Translate each plural, gender, and select branch as a complete native utterance; do not mechanically reuse the source grammar.
+- Obey UI length, capitalization, and platform constraints without dropping meaning.
+- Never translate variable names, enum values, identifiers, or program syntax unless explicitly requested.
+
+Read [references/structured-content.md](references/structured-content.md) before editing JSON, YAML, XML, PO, ARB, Android, Apple strings, ICU MessageFormat, Markdown containing code, or HTML.
+
+After editing a source/target pair, run:
+
+```bash
+python3 scripts/translation_guard.py SOURCE TARGET
+```
+
+The guard also measures linguistic volume and segment coverage and blocks targets that remain identical to the source. Compare human-language segments in structured formats and treat a plain-text input as one segment. Block an untranslated value even when the rest of the file changed or values were reordered. Keep JSON alignment independent of property order; check identity across the complete target segment set in other formats. Never grant copyright or rights notices an automatic fixed-content exemption. Block every unchanged copyright-marked segment, including one below the normal segment threshold, and route a legitimate fixed legal line to explicit human handling outside the automatic release gate. Permit short shared product names such as `BLUN King` when they remain below the measured identity threshold. Treat a volume, segment-count, source-identity, or `unchanged-linguistic-segment` failure as blocking. Repeat the unconditional identity, structured-segment identity, and auto-detected volume checks in mandatory MCP `release_translation`; never let caller attestations suppress them. Never describe exit code `0` as proof that a translation is complete, faithful, or native: it proves only the deterministic structure, protected-token, identity, volume, and Unicode checks that actually ran.
+
+Inspect the complete diagnostic output, not only the process return code. Confirm that a negative regression failed for the intended finding. For `translation_guard.py`, exit code `1` means evaluated content was blocked; exit code `2` means the input could not be read. `cannot read file` means the test input was not evaluated and must never be reported as proof that an identity, structure, or language rule fired.
+
+Use `--format json` for JSON regardless of the file suffix. Treat a nonzero exit as a blocking structural or protected-token defect and fix it before delivery.
+
+Use `--format html` for HTML fragments or documents. It permits native translation of linguistic attributes and recognized linguistic metadata while protecting technical metadata, structure, scripts, styles, links, code, and placeholders. The guard also supports `xml`, `po`, `strings`, and `subtitle`; auto-detection covers XML/XLIFF/Android, PO/POT, Apple strings, SRT, VTT, and ASS. ARB uses the JSON guard.
+
+For every generated or edited UTF-8 target file, also run the bundled orthography linter:
+
+```bash
+python3 scripts/check_diacritics.py --language TARGET_LANGUAGE TARGET
+```
+
+Use a supported language code when known, `auto` for ordinary single-language prose, or `all` for deliberately mixed Latin-script samples. Inspect every finding and correct each real violation. A clean linter result is not proof of correct orthography; the mandatory language-aware gate still covers all languages and writing systems beyond the linter's heuristic patterns.
+
+## Maintain long-document coherence
+
+Before translating a long document, establish a compact translation brief containing the exact locale and script, audience, form of address, voice, tense policy, glossary, names, product terms, units, and formatting rules. Translate in context-aware sections with enough neighboring material to resolve references. After all sections are complete, run a document-level pass for terminology drift, pronouns, headings, cross-references, narrative voice, repeated phrases, and contradictions. Never judge a long translation only one chunk at a time.
+
+## Verify when fluency is uncertain
+
+Never bluff native competence. For an unfamiliar, endangered, disputed, historical, or low-resource language variety:
+
+1. Confirm the exact language tag, script, and requested standard.
+2. Prefer community, academy, government, or native-edited sources for grammar and contemporary usage.
+3. Use Unicode CLDR for locale conventions and exemplar characters; use a curated monolingual corpus for usage; use parallel corpora only as supporting evidence.
+4. Treat FLORES+ as an evaluation reference, not training material. Treat OPUS and open web corpora as noisy evidence that may contain literal translations or bad alignments.
+5. Cross-check important wording in more than one independent source when tools permit.
+6. State a material uncertainty or ask for a native review when reliable evidence is insufficient. Do not invent a dialect form.
+
+## Run the seven-pass quality gate
+
+Before returning the result, silently perform every pass:
+
+1. **Meaning:** every claim, relationship, condition, and implication remains equivalent.
+2. **Completeness:** nothing is omitted, duplicated, or added.
+3. **Precision:** negation, modality, numbers, units, entities, terminology, and ambiguity are correct.
+4. **Nativeness:** no calque, source syntax, unnatural collocation, category mixing, unnecessary borrowing, generic AI filler, or grammatical-but-translated wording remains.
+5. **Fit:** locale, script, register, tone, audience, and medium are consistent.
+6. **Integrity:** placeholders, keys, links, markup, code, escapes, and file structure are intact.
+7. **Orthography:** spelling, diacritics, casing, punctuation, spacing, and Unicode normalization are native and correct.
+
+Any meaning, completeness, precision, integrity, or major nativeness defect blocks delivery. “Understandable” and “grammatically correct” are never sufficient release arguments. If a pass fails, revise and repeat all affected passes. Do not expose internal scores or review notes unless the user asks.
+
+Do not output a raw first draft as the finished translation. Release only after both the native-language gate and native-orthography gate pass. A clean structural script result proves neither natural wording nor correct language-specific spelling.
+
+## Return the result cleanly
+
+Return only the finished translation by default. Preserve the user's requested structure. Do not prepend “Translation,” explain choices, romanize the text, or repeat the source unless asked.
+
+For legal, medical, safety-critical, contractual, or publication-grade material, keep the translation conservative, mark consequential ambiguity, and recommend qualified native review where appropriate. Never hide uncertainty behind fluent prose.

package/standard-skills/translate-native/VERSION

@@ -1 +1 @@
-6.42.13
+6.64.0

package/standard-skills/translate-native/agents/openai.yaml

@@ -0,0 +1,18 @@
+interface:
+  display_name: "Translate Native"
+  short_description: "Native Übersetzungen mit verpflichtendem Gate"
+  default_prompt: "Use $translate-native to create a native, meaning-faithful translation with correct Unicode and release it only through the mandatory translation gate."
+  icon_small: "./assets/icon.svg"
+  icon_large: "./assets/icon.svg"
+policy:
+  products:
+  - "chatgpt"
+  - "codex"
+  - "api"
+  - "atlas"
+  allow_implicit_invocation: true
+dependencies:
+  tools:
+  - type: "mcp"
+    value: "blun-language-guard"
+    description: "Mandatory native-orthography gate for agent responses and translations"

package/standard-skills/translate-native/assets/icon.svg

@@ -0,0 +1,8 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M19.58 4.38996C18.05 2.86996 15.68 2.88996 14.18 4.38996L5.26999 13.33C4.25999 14.34 3.84999 14.92 3.59999 16.26L3.06999 19.56C2.88999 20.47 3.50999 21.09 4.43999 20.93L7.74999 20.39C9.06999 20.18 9.64999 19.76 10.66 18.75L19.58 9.82996C21.1 8.30996 21.12 5.93996 19.58 4.40996V4.38996Z" fill="#FEBD08"/>
+<path d="M19.58 9.81997C21.1 8.29997 21.12 5.92997 19.58 4.39997C18.05 2.87997 15.68 2.89997 14.18 4.39997L13.77 4.80997L19.18 10.22L19.58 9.81997Z" fill="#FF928C"/>
+<path d="M13.7694 4.81308L12.3552 6.22729L17.7646 11.6367L19.1788 10.2224L13.7694 4.81308Z" fill="#D9D9D9"/>
+<path opacity="0.5" d="M12.36 6.22998L5.26998 13.34C4.25998 14.35 3.84998 14.93 3.59998 16.27L3.06998 19.57C2.97998 20.02 3.08998 20.4 3.32998 20.65L15.05 8.92998L12.36 6.22998Z" fill="white"/>
+<path d="M4.60001 14.05C4.06001 14.69 3.79001 15.27 3.60001 16.26L3.51001 16.81L7.18001 20.48L7.75001 20.39C8.74001 20.23 9.31001 19.96 9.95001 19.41L4.60001 14.05Z" fill="#FFDDBC"/>
+<path d="M3.50999 16.8101L3.06999 19.5601C2.88999 20.4701 3.50999 21.0901 4.43999 20.9301L7.17999 20.4801L3.50999 16.8101Z" fill="#4D4D4D"/>
+</svg>

package/standard-skills/translate-native/docs/BLUN_CODE_INTEGRATION.md

@@ -0,0 +1,76 @@
+# BLUN Code mandatory language release
+
+## Security boundary
+
+BLUN Code must treat model output as untrusted until the isolated Language Guard verifies the exact final envelope. The runtime must buffer model `text-delta` and `done` events, retain Telegram and HTTP credentials outside the agent process, and invoke a sender only with the verified `target_text`.
+
+The only agent-owned final fields are:
+
+```json
+{
+  "target_text": "Natürlich ist das möglich.",
+  "release_token": "blg6.…"
+}
+```
+
+BLUN Code owns the task kind, exact language, complete translation source, content type, agent identity, and delivery channel. Unknown fields or an attempt to return these host fields blocks before delivery.
+
+## Runtime sequence
+
+1. The installer writes the named MCP entry to `~/.blun/mcp.json`, creates the service token, and starts the isolated guard service.
+2. BLUN Code imports that named entry once into its encrypted MCP store without replacing existing MCP servers.
+3. The host creates a structured route. Ordinary chat without a source defaults to `response`; a translation supplies `languageGuardSourceText` and `languageGuardLanguage`. Explicit `languageGuardTaskKind: translation` remains supported. A source with no explicit task kind selects translation; a source combined with explicit `response` blocks as contradictory metadata.
+4. BLUN Code adds a mandatory instruction to the model turn and suppresses candidate text events.
+5. The agent applies `translate-native` for translations, calls the correct release tool, and returns the strict envelope.
+6. BLUN Code asks the isolated service to verify the exact text, purpose, source, language, content policy, and receipt.
+7. Only a valid result becomes a renderer delta, desktop result, Telegram message, or another external response.
+
+Errors, cancellations, approvals, and host-generated status messages are not model prose and may remain visible, but they must never interpolate an unverified candidate.
+
+## Trusted metadata
+
+The adapter accepts these host-owned fields in `meta`:
+
+- `languageGuardTaskKind`: `response` or `translation`;
+- `languageGuardLanguage`: exact BCP 47 language or locale;
+- `languageGuardSourceText`: complete independently captured source for translations;
+- `languageGuardContentType`: `prose`, `title`, `meta_description`, or `ui`.
+
+Telegram may use the sender's `language_code` as the response language when no explicit session language is set. Desktop sessions fall back to the configured BLUN interface language. A product should expose an explicit conversation language when interface language and response language can differ.
+
+Free-form prompt inspection is not an authority boundary. No regex or model classifier can prove that arbitrary text is or is not a translation request. A translation workflow therefore needs a structured UI or API route that supplies the source and target language. Until that route exists, the adapter instructs an agent not to execute a translation through the response path; high-assurance deployments should block ambiguous free-form translation requests at intake.
+
+## Deployment levels
+
+- Per-user autostart protects against accidental secret inheritance and forgotten tools.
+- A separate service account or container protects the key from a hostile agent running as the desktop user.
+- A remote signer additionally separates the host machine, but must use authenticated transport, replay limits, bounded requests, and the same content-free audit policy.
+
+The automatic repository updater refreshes the skill, MCP server, service, and portable adapters. BLUN Code itself follows its own signed application update channel; updating one repository does not silently rewrite the other.
+
+## BLUN adapter compatibility evidence
+
+Claude `Stop`/`SubagentStop` payloads are not the BLUN adapter contract. BLUN
+hosts use the `meta` fields above and return an `answer`/`reply` release envelope;
+they must not invent Claude `stop_hook_active` or `agent_id` fields to satisfy
+a different client's hook. Agent identity is supplied separately by the host.
+
+Premortem: filtering the source based on an explicit task label could discard
+translation evidence before the shared router sees it. Coercing malformed
+metadata to strings could also turn invalid input into an apparently valid
+request. The adapter now passes task and source unchanged into that router.
+The regression first reproduced the downgrade, then verified its rejection,
+source-based inference, exact source/locale forwarding and invalid-type rejection
+for desktop and Telegram. Existing response and explicit-translation contracts
+remain supported.
+
+Run `node tests/blun_code_language_guard_test.js` for these adapter probes.
+They use a simulated verification service, not a live King process or real
+ExampleAgent session. Passing them does not establish compatibility with a particular
+installed King build. Before deploying that build, capture its actual host
+metadata and event/result shapes without credentials, replay them in an isolated
+test, and verify normal responses, translation source/locale binding, cancelled
+turns, streaming and service outages. Keep model text buffered and confirm that
+no desktop/Telegram sender receives rejected text. Record the King and guard
+revisions with the result; do not install or restart a live agent as part of
+these repository tests.