kotonoha 0.4.0 → 0.4.2

package/skills/obsidian-bases/assets/templates/cards.base

@@ -0,0 +1,8 @@
+filters: 'file.inFolder("Reading") && file.ext == "md"'
+properties:
+  note.author:
+    displayName: Author
+views:
+  - type: cards
+    name: Reading candidates
+    order: [file.name, note.author, note.description]

package/skills/obsidian-bases/assets/templates/kanban.base

@@ -0,0 +1,7 @@
+filters: 'file.inFolder("Tasks") && file.ext == "md"'
+views:
+  - type: kanban
+    name: Work by status
+    order: [file.name, note.owner]
+    groupBy: {property: note.status, direction: ASC}
+    groupOrder: [Backlog, Active, Done, null]

package/skills/obsidian-bases/assets/templates/list.base

@@ -0,0 +1,8 @@
+filters:
+  and:
+    - 'file.ext == "md"'
+    - 'file.hasTag("guide")'
+views:
+  - type: list
+    name: Guide index
+    order: [file.name, note.description]

package/skills/obsidian-bases/assets/templates/table.base

@@ -0,0 +1,10 @@
+filters: 'file.inFolder("Tasks") && file.ext == "md"'
+properties:
+  note.status:
+    displayName: Status
+views:
+  - type: table
+    name: Task overview
+    order: [file.name, note.status, note.due, note.owner]
+    groupBy: {property: note.status, direction: ASC}
+    limit: 50

package/skills/obsidian-bases/references/execution-contract.json

@@ -0,0 +1,246 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Request",
+  "title": "kotonoha Bases read-only validation contract",
+  "x-contract-version": 1,
+  "x-schema-validation": {"strict": true, "strictRequired": false, "allErrors": true, "allowUnionTypes": true, "ownProperties": true, "metadata": "Remove top-level x-* metadata before compiling; select the desired $defs entry through $ref. Conditional required properties are declared in the shared parent schemas."},
+  "x-runtime": {
+    "node": ">=18",
+    "dependencies": {"ajv": "8.20.0", "jsep": "1.4.0", "jsonc-parser": "3.3.1", "yaml": "2.9.1"},
+    "prepare": "npm ci --prefix <bases-dir>/scripts --ignore-scripts --no-audit --no-fund",
+    "prepare-offline": "npm ci --prefix <bases-dir>/scripts --offline --ignore-scripts --no-audit --no-fund",
+    "invoke": "node <bases-dir>/scripts/check.cjs --stdin",
+    "dependency-resolution": "Only scripts/node_modules; do not fall back to ancestor modules, NODE_PATH, downloads or npx.",
+    "vault_access": false,
+    "writes": false,
+    "expression_evaluation": false
+  },
+  "x-commands": {
+    "--stdin": {"input": "Request", "output": "Report", "stdin_max_bytes": 16777216},
+    "--help": {"input": null, "output": "Usage", "dependencies_required": false},
+    "other": "Missing, duplicate, abbreviated, positional and unknown arguments fail with invalid_input/1."
+  },
+  "x-limits": {
+    "document_bytes": 1048576,
+    "yaml_depth": 64,
+    "yaml_nodes": 10000,
+    "expression_chars": 4096,
+    "expression_nodes": 1024,
+    "expression_depth": 64,
+    "formulas": 256,
+    "diagnostics": 256,
+    "output_bytes": 1048576,
+    "policy": "Hard safety caps, disclosed before use; no unbounded override. Exceeding a cap prohibits saving and must be reported, not silently truncated."
+  },
+  "x-packaging": {
+    "lock": "scripts/package-lock.json is canonical and must be included byte-for-byte in the parent npm tarball and Skill installation.",
+    "exclude": "Exclude all nested node_modules from the parent package files list, the source Skill installer copy, and git tracking.",
+    "no-bootstrap": "Dependency preparation is explicit npm ci; check.cjs never prepares dependencies or writes a lockfile."
+  },
+  "x-expression": {
+    "ast": ["Literal", "Identifier", "ThisExpression", "MemberExpression", "CallExpression", "UnaryExpression", "BinaryExpression", "ArrayExpression"],
+    "unary": ["!", "+", "-"],
+    "binary": ["+", "-", "*", "/", "%", "==", "!=", ">", ">=", "<", "<=", "&&", "||"],
+    "global_calls": {"if": [2, 3], "today": [0, 0], "now": [0, 0], "date": [1, 1], "link": [1, 2], "list": [1, 1], "min": [2, 128], "max": [2, 128]},
+    "method_calls": {
+      "hasTag": [1, 128], "hasLink": [1, 1], "inFolder": [1, 1],
+      "contains": [1, 1], "lower": [0, 0], "trim": [0, 0],
+      "round": [0, 1], "toFixed": [1, 1], "mean": [0, 0],
+      "join": [1, 1], "unique": [0, 0]
+    },
+    "computed_members": "Literal string or nonnegative safe integer only; formula access requires a literal string. Dynamic indices are unsupported.",
+    "literal_types": ["string", "number", "boolean"],
+    "formula_references": "Walk accepted ASTs, not raw text. Collect formula.name and formula[\"name\"]. Bare note properties do not require declarations.",
+    "summary_context": "values is available only in custom summaries. mean() is admitted only on values in custom summaries from the pinned Bases syntax example, despite its omission from the pinned Functions index; no additional undocumented methods are inferred.",
+    "unsupported": "Unparsed expressions, other AST nodes/operators/calls/arities, nonfinite numeric literals, sparse arrays, optional chaining, dynamic call targets and dynamic indices prohibit saving. No eval or function invocation.",
+    "runtime_types": "Not inferred as proven from method names. Actual values, result sets and rendering are not evaluated."
+  },
+  "x-summary-names": ["Average", "Min", "Max", "Sum", "Range", "Median", "Stddev", "Earliest", "Latest", "Checked", "Unchecked", "Empty", "Filled", "Unique"],
+  "x-minimum-app": {"table": "1.9.0", "cards": "1.9.0", "list": "1.10.0", "kanban": "1.14.0"},
+  "x-issue-codes": {"$ref": "#/$defs/IssueCode"},
+  "x-result-policy": [
+    "Precedence: execution failure/1, known invalid/2, known insufficient version/4, unsupported or unknown version/3, complete/0. Do not run secondary version/reference checks when their prerequisites are unsupported.",
+    "Control/argument/UTF-8 input failure: failed/1; no document processing.",
+    "Unexpected execution failure: failed/1; do not expose raw exception or input.",
+    "Missing local dependency: not_performed/4.",
+    "Known invalid YAML/structure or unresolved formula/summary or formula cycle: not_performed/2.",
+    "Known insufficient declared application version: not_performed/4.",
+    "Unsupported content, resource exhaustion, or unknown application version: partial/3.",
+    "Complete supported static checks with only cautions: completed/0.",
+    "static_checks_passed is true only for completed/0 with at least one view; it never establishes authorization, actual application compatibility, proofreading approval, runtime results or successful saving.",
+    "Every report has read_only=true, authorization=not_assessed, write_status=not_requested, render_check=not_performed and expression_evaluation=not_performed."
+  ],
+  "x-host-data-policy": "Do not repurpose source text or diagnostic names for public logs. Do not claim control of the host's own conversation or file retention. Read, model-input, write and external-copy permissions remain distinct.",
+  "x-processing-order": [
+    "Arguments/help, dependency availability, bounded strict UTF-8 JSON control, Request schema, document Unicode and source hash, document byte cap, YAML parse/features, YAML node/depth caps, local structure/value checks, supported expression/reference checks, application version, output caps.",
+    "Collect local known-invalid and unsupported findings in independently inspectable subtrees. Skip references whose definitions or expression AST are incomplete. Never invent missing-reference errors from an unsupported expression.",
+    "Run application-version checks only when structure and expression/reference validation are fully supported and no known-invalid issue exists. Therefore unknown content plus an old declared version reports unsupported/3 without a version issue; invalid plus old version reports invalid/2 without a version issue.",
+    "The View groupOrder/groupBy dependency is an initial-subset restriction: missing groupBy for a non-Kanban groupOrder is unsupported_value/3 at groupOrder. Kanban missing groupBy is missing_required/2 at groupBy. Do not expose duplicate Ajv condition errors.",
+    "Wrong scalar/container types, required type/name/groupBy for Kanban, direction outside ASC/DESC are known-invalid. Empty names/map keys/expressions/display names, nonpositive/out-of-subset integral limit, multi-key/empty filter operator objects, and groupOrder without groupBy on non-Kanban are unsupported_value/3. Unknown filter operator keys are unknown_key/3.",
+    "A merge mapping key << is unsupported_yaml_feature at root, even without an anchor. __proto__, constructor and prototype are ordinary owned data keys in user-name dictionaries and must never mutate prototypes; unknown top-level keys with those names are unknown_key/3.",
+    "Missing views or empty views is an operation constraint, not a YAML shape error. Evaluate it only for otherwise fully supported documents, after local structure/value/expression/reference checks: inspect returns no_views caution/0; create/edit/proofread returns missing_required/2, structure=supported. Do not emit no_views or this operation constraint when invalid/unsupported/resource issues already exist. Other known-invalid issues make structure=invalid. Unsupported content makes structure=unsupported unless invalid dominates.",
+    "Emit only the first YAML parser error by source offset, using root path and 1-based line/column; duplicate key uses duplicate_yaml_key, other parse errors invalid_yaml. Do not continue after this error. Unsupported document-wide YAML features similarly stop secondary checks.",
+    "For each duplicate view name after its first occurrence, emit one duplicate_view_name at the later name path with related containing only the first index as a decimal string. Three equal names produce issues at indexes 1 and 2, both related=[\"0\"]."
+  ],
+  "x-early-report": {
+    "defaults": {
+      "schema_version": 1, "structure": "unprocessed", "source_sha256": null,
+      "static_checks_passed": false, "unprocessed": [],
+      "read_only": true, "authorization": "not_assessed", "write_status": "not_requested",
+      "render_check": "not_performed", "expression_evaluation": "not_performed",
+      "proofread_gate": "not_requested", "application_version": null,
+      "application_version_source": "user_declared"
+    },
+    "invalid_control": "status=failed, exit_code=1; exactly one invalid_input/input issue at [], line/column=null, related=[]. Applies to argument, UTF-8/JSON/Request/JSON-byte-cap failures.",
+    "dependency_failure": "status=not_performed, exit_code=4; exactly one dependency_missing/capability issue at [], line/column=null, related=[]. Applies before control parsing for a missing or wrong-pinned dependency.",
+    "runtime_failure": "status=failed, exit_code=1; exactly one runtime_error/runtime issue at [], line/column=null, related=[]. Clear partially computed report fields to defaults.",
+    "usage": "Exactly the Usage object; compact JSON plus one LF, exit 0, no standard input consumption or dependency loading."
+  },
+  "x-counting": {
+    "yaml_nodes": "Count each Scalar, Alias, YAMLMap and YAMLSeq once, including root, keys, values, scalar null and empty collections. Pair wrappers do not count. Traverse AST before conversion; YAML parser-produced null slots count as one scalar null.",
+    "yaml_depth": "Maximum nested collection count on a root-to-leaf path, with a root collection at 1. Scalars/keys do not increase depth.",
+    "expression_nodes": "Count AST objects with a type field, including callee/member/property identifier/literal nodes; array containers themselves do not count, holes are unsupported. Root node counts once.",
+    "expression_depth": "Maximum AST typed-node count on a root-to-leaf path, root=1. Count property/callee/argument child nodes. Parentheses do not add AST nodes/depth.",
+    "preparse_nesting": "Separate safety cap 64 on simultaneous unquoted (), [] delimiters, ignoring escaped characters in quoted strings. Above 64 gives limit_exceeded before jsep. AST depth is checked independently after parsing.",
+    "json_bytes": "Raw stdin bytes including whitespace; limit inclusive.",
+    "document_bytes": "Exact UTF-8 document bytes including BOM, comments, whitespace and CRLF; limit inclusive.",
+    "output_bytes": "Compact JSON.stringify(Report) plus exactly one LF, UTF-8 byte count. Construct Report properties in the order listed in Report.required; Issue properties code,category,path,line,column,related. No pretty printing.",
+    "diagnostics": "Exactly 256 collected distinct issues is allowed, including cautions. More than 256 or an oversized serialized report triggers the root fallback below. limit_exceeded itself is included in the final issue count.",
+    "cap_fallback": "If diagnostic/output caps overflow, replace issues with exactly one limit_exceeded/unsupported at [], line/column=null, related=[]; unprocessed=[[]], static_checks_passed=false. Preserve prior known-invalid dominance as structure=invalid, not_performed/2; otherwise structure=unsupported, partial/3. Preserve source hash and accepted request metadata. Do not copy oversized paths into the fallback.",
+    "parse_resource_failure": "Unexpected RangeError or parser resource failure yields runtime_error/1 with early defaults, not a claimed measured limit_exceeded. Explicitly measured caps alone produce limit_exceeded/3.",
+    "resource_paths": "Document bytes, YAML depth/nodes use []; formula count uses [formulas]; expression chars/nodes/depth/preparse nesting use the exact expression path. unprocessed contains exactly that path when the resource issue is the only issue.",
+    "resource_precedence": "Stop further document validation on Unicode, document bytes, parser/features, YAML node/depth or formula-count failure. Per-expression measured limit failures emit only limit_exceeded for that expression and skip its AST/reference checks. Formula names remain known. No missing-reference or version secondary issues are emitted after a resource failure."
+  },
+  "$defs": {
+    "Nonempty": {"type": "string", "minLength": 1},
+    "Path": {"type": "array", "items": {"oneOf": [{"type": "string"}, {"type": "integer", "minimum": 0}]}},
+    "Request": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "intent", "document", "application_version"],
+      "properties": {
+        "schema_version": {"const": 1},
+        "intent": {"enum": ["inspect", "create", "edit", "proofread"]},
+        "document": {"type": "string"},
+        "application_version": {"oneOf": [{"type": "null"}, {"type": "string", "pattern": "^[0-9]{1,3}\\.[0-9]{1,3}(\\.[0-9]{1,3})?$"}]}
+      }
+    },
+    "Filter": {
+      "oneOf": [
+        {"$ref": "#/$defs/Nonempty"},
+        {
+          "type": "object", "minProperties": 1, "maxProperties": 1, "additionalProperties": false,
+          "properties": {
+            "and": {"type": "array", "items": {"$ref": "#/$defs/Filter"}},
+            "or": {"type": "array", "items": {"$ref": "#/$defs/Filter"}},
+            "not": {"type": "array", "items": {"$ref": "#/$defs/Filter"}}
+          }
+        }
+      ]
+    },
+    "ExpressionMap": {
+      "type": "object", "propertyNames": {"$ref": "#/$defs/Nonempty"},
+      "additionalProperties": {"$ref": "#/$defs/Nonempty"}
+    },
+    "SummaryAssignments": {
+      "type": "object", "propertyNames": {"$ref": "#/$defs/Nonempty"},
+      "additionalProperties": {"$ref": "#/$defs/Nonempty"}
+    },
+    "GroupBy": {
+      "type": "object", "additionalProperties": false,
+      "required": ["property"],
+      "properties": {"property": {"$ref": "#/$defs/Nonempty"}, "direction": {"enum": ["ASC", "DESC"]}}
+    },
+    "View": {
+      "type": "object", "additionalProperties": false, "required": ["type", "name"],
+      "properties": {
+        "type": {"enum": ["table", "cards", "list", "kanban"]},
+        "name": {"$ref": "#/$defs/Nonempty"},
+        "filters": {"$ref": "#/$defs/Filter"},
+        "order": {"type": "array", "items": {"$ref": "#/$defs/Nonempty"}},
+        "limit": {"type": "integer", "minimum": 1, "maximum": 1000000},
+        "groupBy": {"$ref": "#/$defs/GroupBy"},
+        "groupOrder": {"type": "array", "items": {"type": ["string", "number", "boolean", "null"]}},
+        "summaries": {"$ref": "#/$defs/SummaryAssignments"}
+      },
+      "allOf": [
+        {"if": {"properties": {"type": {"const": "kanban"}}, "required": ["type"]}, "then": {"required": ["groupBy"]}},
+        {"if": {"required": ["groupOrder"]}, "then": {"required": ["groupBy"]}}
+      ]
+    },
+    "Document": {
+      "type": "object", "additionalProperties": false,
+      "properties": {
+        "filters": {"$ref": "#/$defs/Filter"},
+        "formulas": {"$ref": "#/$defs/ExpressionMap"},
+        "summaries": {"$ref": "#/$defs/ExpressionMap"},
+        "properties": {
+          "type": "object", "propertyNames": {"$ref": "#/$defs/Nonempty"},
+          "additionalProperties": {
+            "type": "object", "additionalProperties": false,
+            "properties": {"displayName": {"$ref": "#/$defs/Nonempty"}}
+          }
+        },
+        "views": {"type": "array", "items": {"$ref": "#/$defs/View"}}
+      }
+    },
+    "IssueCode": {
+      "enum": [
+        "invalid_input", "dependency_missing", "invalid_yaml", "duplicate_yaml_key",
+        "multiple_yaml_documents", "unsupported_yaml_feature", "unsupported_unicode",
+        "unsupported_number", "unsupported_value", "unknown_key", "invalid_type", "missing_required",
+        "invalid_enum", "unsupported_view", "unsupported_expression", "unsupported_operator",
+        "unsupported_function", "formula_missing", "formula_cycle", "summary_missing",
+        "application_version_unknown", "application_version_insufficient",
+        "duplicate_view_name", "no_views", "limit_exceeded", "runtime_error"
+      ]
+    },
+    "Issue": {
+      "type": "object", "additionalProperties": false,
+      "required": ["code", "category", "path", "line", "column", "related"],
+      "properties": {
+        "code": {"$ref": "#/$defs/IssueCode"},
+        "category": {"enum": ["input", "format", "unsupported", "expression", "capability", "caution", "runtime"]},
+        "path": {"$ref": "#/$defs/Path"},
+        "line": {"type": ["integer", "null"], "minimum": 1},
+        "column": {"type": ["integer", "null"], "minimum": 1},
+        "related": {"type": "array", "items": {"type": "string"}}
+      }
+    },
+    "Report": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schema_version", "status", "exit_code", "structure", "source_sha256", "static_checks_passed", "issues", "unprocessed", "read_only", "authorization", "write_status", "render_check", "expression_evaluation", "proofread_gate", "application_version", "application_version_source"],
+      "properties": {
+        "schema_version": {"const": 1},
+        "status": {"enum": ["completed", "failed", "not_performed", "partial"]},
+        "exit_code": {"enum": [0, 1, 2, 3, 4]},
+        "structure": {"enum": ["supported", "invalid", "unsupported", "unprocessed"]},
+        "source_sha256": {"oneOf": [{"type": "null"}, {"type": "string", "pattern": "^[a-f0-9]{64}$"}]},
+        "static_checks_passed": {"type": "boolean"},
+        "issues": {"type": "array", "maxItems": 256, "items": {"$ref": "#/$defs/Issue"}},
+        "unprocessed": {"type": "array", "items": {"$ref": "#/$defs/Path"}},
+        "read_only": {"const": true},
+        "authorization": {"const": "not_assessed"},
+        "write_status": {"const": "not_requested"},
+        "render_check": {"const": "not_performed"},
+        "expression_evaluation": {"const": "not_performed"},
+        "proofread_gate": {"enum": ["not_requested", "external_required"]},
+        "application_version": {"type": ["string", "null"]},
+        "application_version_source": {"const": "user_declared"}
+      },
+      "allOf": [
+        {"if": {"properties": {"exit_code": {"const": 0}}}, "then": {"properties": {"status": {"const": "completed"}, "structure": {"const": "supported"}}}},
+        {"if": {"properties": {"exit_code": {"const": 1}}}, "then": {"properties": {"status": {"const": "failed"}, "structure": {"const": "unprocessed"}, "static_checks_passed": {"const": false}}}},
+        {"if": {"properties": {"exit_code": {"enum": [2, 4]}}}, "then": {"properties": {"status": {"const": "not_performed"}, "static_checks_passed": {"const": false}}}},
+        {"if": {"properties": {"exit_code": {"const": 3}}}, "then": {"properties": {"status": {"const": "partial"}, "static_checks_passed": {"const": false}}}},
+        {"if": {"properties": {"structure": {"const": "invalid"}}}, "then": {"properties": {"exit_code": {"const": 2}, "static_checks_passed": {"const": false}}}},
+        {"if": {"properties": {"structure": {"const": "unsupported"}}}, "then": {"properties": {"exit_code": {"const": 3}, "static_checks_passed": {"const": false}}}},
+        {"if": {"properties": {"static_checks_passed": {"const": true}}}, "then": {"properties": {"status": {"const": "completed"}, "exit_code": {"const": 0}, "structure": {"const": "supported"}, "source_sha256": {"type": "string", "pattern": "^[a-f0-9]{64}$"}}}}
+      ]
+    },
+    "Usage": {
+      "type": "object", "additionalProperties": false, "required": ["usage", "read_only"],
+      "properties": {"usage": {"const": "node <bases-dir>/scripts/check.cjs --stdin"}, "read_only": {"const": true}}
+    }
+  }
+}

package/skills/obsidian-bases/references/workflow.md

@@ -0,0 +1,155 @@
+# Bases workflow
+
+Use this guide with the Skill's scope, byte-preservation and authority rules.
+Standalone `.base` is YAML configuration over Vault files, not a separate
+database. No Obsidian app, official CLI, MCP, Python or Vault storage API is
+required for ordinary direct editing.
+
+## Setup
+
+Install only the requested Skill; existing installations require explicit
+replacement authority. Do not overwrite local customizations without consent.
+
+```text
+npx kotonoha install --skill obsidian-bases
+```
+
+Installation copies authored assets and the canonical private lockfile, not
+`node_modules`. Before dependency preparation explain the local installation
+directory and possible package-registry traffic; get separate permission.
+Use Node >=18 and the exact local scripts manifest/lock:
+
+```text
+npm ci --prefix <bases-dir>/scripts --ignore-scripts --no-audit --no-fund
+```
+
+For an explicitly offline preparation use:
+
+```text
+npm ci --prefix <bases-dir>/scripts --offline --ignore-scripts --no-audit --no-fund
+```
+
+These are alternatives, not automatic fallbacks. A cache miss does not authorize
+online installation. The checker never prepares dependencies. Missing or wrong
+local dependencies return exit 4 even if a parent/global module is available.
+`--help` works without them. The fixed versions and supported JSON schema live
+in [execution-contract.json](execution-contract.json), not a second config.
+
+## Examples and paths
+
+Example: "In /absolute/Vault, read Tasks.base only. Rename view index 0 from Tasks
+to Active tasks and save; keep everything else unchanged." This can authorize
+the exact ordinary name edit without a mandatory plan or repeated approval.
+"Propose a base" or "show the diff before saving" never authorizes saving.
+
+Example: "Use /absolute/Vault/Views as the working directory; create reading.base
+with Cards for Markdown files in Reading. Show the settings before saving."
+Confirm actual folder/property names and application version without assuming
+permission to inspect every matching note. An example filter is a proposed
+display scope, not a host reading permission.
+
+User workdir takes precedence; otherwise use cwd at request start. Resolve its
+relative form from that start and relative targets from the selected workdir.
+Preserve absolute and explicitly Vault-relative paths. A directory choice is
+not Vault authority. If the target's existing parent or allowed scope is missing,
+stop instead of creating directories or saving elsewhere. Never substitute
+session-state copies for the target.
+
+## Check exact text
+
+Use strict UTF-8 byte access; BOM must not disappear, invalid bytes must not
+become replacement characters. Capture raw SHA-256 independently. Send JSON
+through stdin safely, never interpolate document text into shell commands:
+
+```json
+{
+  "schema_version": 1,
+  "intent": "inspect",
+  "document": "filters: 'file.ext == \"md\"'\nviews:\n  - {type: table, name: Notes, order: [file.name]}\n",
+  "application_version": "1.14.0"
+}
+```
+
+```text
+node <bases-dir>/scripts/check.cjs --stdin
+```
+
+Use inspect for existing text and create/edit/proofread for the corresponding
+candidate. The Report hash must match raw original bytes and exact candidate
+write bytes respectively. No path, output-file, save, fix or evaluation flags
+exist. The checker never reads a target or follows a formula's URL.
+
+| Exit | Meaning | Action |
+|---|---|---|
+| 0 | Complete static processing; may contain cautions | Check static_checks_passed and every separate host/consent requirement |
+| 1 | Invalid control or runtime failure | Not complete; no save |
+| 2 | Known structure/reference problem or missing candidate views | Explain exact issues; no save |
+| 3 | Unsupported feature, limit or unknown application version | Preserve original; diagnosis only |
+| 4 | Local dependency or declared application capability insufficient | Report missing capability; no auto-install or save |
+
+Reports always say read_only=true, authorization=not_assessed and
+write_status=not_requested. They never certify saving, evaluation or rendering.
+Non-parser issues identify a key/index path, not an invented source line;
+YAML parser issues use 1-based line/column. Limit fallbacks explicitly retain
+unprocessed root. A partial report is never all-file success.
+
+## Supported edits and display consequences
+
+Use `table.base`, `cards.base`, `list.base` and `kanban.base` from the sibling
+assets/templates directory. They are independently authored proposals. Adapt
+their scope/property names only with authority; do not claim they match real data.
+Every view supports creation and name/display-order/filter edits. Kanban requires
+its group property; group order and ASC/DESC can be intentionally edited.
+Other minimum settings are defined in the contract; unknown extensions cause
+whole-file editing refusal, even when only a known name would change.
+
+`order` is display property order, not row sorting. Never infer undocumented
+image, marker, sort or plugin keys. The expression subset is deliberately narrow:
+unknown documented functions can still be unsupported in this checker.
+Defined formula names and known property references are not proof of actual note
+types; accepted ASTs are not executed.
+
+Treat every filter/formulas change as potentially widening. Present the actual
+before/after and save authority, without proving arbitrary set containment.
+No filters means all Vault files when opened. Explain that before an unfiltered
+creation or last-filter removal, and obtain authority for that exact content.
+Global/view filters combine with AND. groupOrder can hide groups independently;
+an empty groupOrder hides every group. Do not invent counts or reinterpret these
+conditions as security controls.
+
+## Save through host tools
+
+Follow every numbered step in SKILL.md. Do not read forbidden paths to "verify"
+them. Check authorized root-to-target identities, exact spelling, no symlinks,
+no management paths, local regular files and preservable metadata. No xattrs or
+multiple hard links; do not strip SELinux labels or other safety features.
+
+Keep untouched bytes exactly, including comments, quoted values, key/view order,
+spaces and CRLF. Do not round-trip YAML through a serializer. Duplicate names
+need user-resolved index/content. A candidate that passes cannot repair an
+unsupported/invalid original without changing the agreed scope.
+
+Recheck current bytes and identity just before writing. Exclusive creation must
+not overwrite an equivalent existing name. Edit only if the host can preserve
+exact bytes, owner/group/modes. Re-read after saving; compare to validated bytes
+and hashes. Tools that cannot verify these properties are insufficient.
+
+On a possible partial write or readback mismatch, say the result is unknown.
+Do not automatically retry, roll back, switch tools or report a fabricated CLI
+receipt. Confirm the current target before requesting authority for remediation.
+There is no CLI transaction/root lock/replay guard, and a final-check race remains.
+
+## Proofreading and retention
+
+Proofread selected name/displayName values only, through `japanese-prose`.
+Obtain copy consent first: specify an external location, purpose, retention until
+user deletion and cleanup of known files only. A workdir inside the Vault cannot
+silently redirect copies to session storage. Ask for a suitable external place.
+Keep immutable source bytes and a real nine-check semantic review for each
+changed string; missing/stale/failed gates prohibit saving. Keep formula text,
+identifiers, operators, numbers and all unselected spans unchanged.
+
+Do not send source or diagnostic names to public logs, additional models or web
+services without permission. Do not claim control over host conversation logs.
+The caller's file tools and model must follow these instructions; no arbitrary
+host sandbox or flawless semantic understanding is promised.