litgrok-ai 0.2.5 → 0.2.7

package/.grok/skills/autoconference/references/_canonical-corpus/manifest.json

@@ -6,8 +6,8 @@
     "selection": "25 companion files retained; SKILL.md is a Grok-native adapter"
   },
   "file_count": 25,
-  "byte_count": 54924,
-  "aggregate_sha256": "13060670bae942a618c1c905243ca6cda158f153fab25ffa6e46d55a42778170",
+  "byte_count": 55711,
+  "aggregate_sha256": "406a7ca96354e3b863577cdbcb783122031fd451f967d0a2bfadfcdd1949fd34",
   "files": [
     {
       "path": "assets/conference_template.md",
@@ -101,8 +101,8 @@
     },
     {
       "path": "scripts/init_conference.py",
-      "size": 21078,
-      "sha256": "cb83623c1338b7e3a5be7a7beac7a17b8ae362fc24fbc01d1caff634db290dfc"
+      "size": 21865,
+      "sha256": "58aaaa91d3f31bdacfccac4c3a736efb62cb89563f7d37281be0e49f84651187"
     },
     {
       "path": "templates/code-performance.md",

package/.grok/skills/autoconference/scripts/init_conference.py

@@ -209,6 +209,23 @@ def preflight_capabilities() -> None:
         )
 
 
+def same_directory_identity(left: os.stat_result, right: os.stat_result) -> bool:
+    """Compare path identity, including ctime to reject recreated directories."""
+    return (
+        left.st_dev,
+        left.st_ino,
+        left.st_mode,
+        left.st_uid,
+        left.st_ctime_ns,
+    ) == (
+        right.st_dev,
+        right.st_ino,
+        right.st_mode,
+        right.st_uid,
+        right.st_ctime_ns,
+    )
+
+
 def open_safe_directory(path: Path) -> Tuple[int, Path]:
     """Create/open path one component at a time without following symlinks."""
     absolute = Path(os.path.abspath(os.fspath(path)))
@@ -233,7 +250,16 @@ def open_safe_directory(path: Path) -> Tuple[int, Path]:
                 fail("UNSAFE_OUTPUT_SYMLINK", f"output component is a symlink: {absolute}")
             if not stat.S_ISDIR(info.st_mode):
                 fail("UNSAFE_OUTPUT_PATH", f"output component is not a directory: {absolute}")
-            next_fd = os.open(part, flags | nofollow, dir_fd=fd)
+            next_fd = None
+            try:
+                next_fd = os.open(part, flags | nofollow, dir_fd=fd)
+                opened = os.fstat(next_fd)
+                if not same_directory_identity(info, opened):
+                    fail("UNSAFE_OUTPUT_SWAP", f"output component identity changed: {absolute}")
+            except BaseException:
+                if next_fd is not None:
+                    os.close(next_fd)
+                raise
             os.close(fd)
             fd = next_fd
         verify_directory_identity(absolute, fd)
@@ -251,7 +277,7 @@ def verify_directory_identity(path: Path, fd: int) -> None:
     opened = os.fstat(fd)
     if stat.S_ISLNK(named.st_mode) or not stat.S_ISDIR(named.st_mode):
         fail("UNSAFE_OUTPUT_SYMLINK", f"output directory is no longer a real directory: {path}")
-    if (named.st_dev, named.st_ino) != (opened.st_dev, opened.st_ino):
+    if not same_directory_identity(named, opened):
         fail("UNSAFE_OUTPUT_SWAP", f"output directory identity changed: {path}")
 
 

package/.grok/skills/autoconference/scripts/verify-canonical-corpus.mjs

@@ -11,8 +11,8 @@ const VERIFIER_RELATIVE = 'scripts/verify-canonical-corpus.mjs';
 const EXPECTED = Object.freeze({
   "schemaVersion": "litgrok.autoconference-corpus/v1",
   "fileCount": 25,
-  "byteCount": 54924,
-  "aggregateSha256": "13060670bae942a618c1c905243ca6cda158f153fab25ffa6e46d55a42778170",
+  "byteCount": 55711,
+  "aggregateSha256": "406a7ca96354e3b863577cdbcb783122031fd451f967d0a2bfadfcdd1949fd34",
   "files": {
     "assets/conference_template.md": "c1b0a1bbfb52080384e9bf6d725a91d2165a2105a4f055820660a607c913c7e7",
     "assets/report_template.md": "73a00032dc143f34f67a97a257f76e7a5acd9365d367e0b27d0c72e439a336ab",
@@ -32,7 +32,7 @@ const EXPECTED = Object.freeze({
     "references/modes/survey.md": "93866084c2abe5d7a1c6ef7251e5594e03044545ddda5e80c1ca42ef450769d0",
     "references/results-logging.md": "829714f30af623aa78a4ebc9e13a0ba7135b2c876af3443e1c1274af8857fe96",
     "references/visualization-guide.md": "4f7e705735b948038193c5a9c111e2db85672f5d97bb1c570aad217843868331",
-    "scripts/init_conference.py": "cb83623c1338b7e3a5be7a7beac7a17b8ae362fc24fbc01d1caff634db290dfc",
+    "scripts/init_conference.py": "58aaaa91d3f31bdacfccac4c3a736efb62cb89563f7d37281be0e49f84651187",
     "templates/code-performance.md": "a90d1425477d9aec002778ba695299cfabb593ccd3dbab82ed0d76038e17a4d5",
     "templates/debate-mode.md": "9c74435dc7eb2e2d24d32b0a80381aadc62890f4674d916022ce6ef220aab966",
     "templates/prompt-optimization.md": "8d78c233529533bb742986769941347eebc460fdb2a2dac63952e65883398e10",

package/.grok/skills/autoresearch/references/_canonical-corpus/manifest.json

@@ -6,8 +6,8 @@
     "selection": "27 companion files retained; SKILL.md is a Grok-native adapter"
   },
   "file_count": 27,
-  "byte_count": 38018,
-  "aggregate_sha256": "520a3c79715f484e912439dd0b350b652e30e3e78c8eb278061bfc90174e124c",
+  "byte_count": 38805,
+  "aggregate_sha256": "0296ca6e52fb7cb68a37f3e17f148248146955ad9624e37e449e60b56eeeb1d3",
   "files": [
     {
       "path": "assets/report_template.md",
@@ -136,8 +136,8 @@
     },
     {
       "path": "scripts/init_research.py",
-      "size": 13374,
-      "sha256": "a5434711928eb4d0487d933df5e1b374f8553140004c6ab8e38fe577ae074d05"
+      "size": 14161,
+      "sha256": "b675ea22abf0794e32dbbf59b95248f20878bbf3d071fa10d37b5a004a7f880c"
     },
     {
       "path": "scripts/style_presets.py",

package/.grok/skills/autoresearch/scripts/init_research.py

@@ -103,6 +103,23 @@ def preflight_capabilities() -> None:
         )
 
 
+def same_directory_identity(left: os.stat_result, right: os.stat_result) -> bool:
+    """Compare path identity, including ctime to reject recreated directories."""
+    return (
+        left.st_dev,
+        left.st_ino,
+        left.st_mode,
+        left.st_uid,
+        left.st_ctime_ns,
+    ) == (
+        right.st_dev,
+        right.st_ino,
+        right.st_mode,
+        right.st_uid,
+        right.st_ctime_ns,
+    )
+
+
 def open_safe_directory(path: Path) -> Tuple[int, Path]:
     """Create/open path one component at a time without following symlinks."""
     absolute = Path(os.path.abspath(os.fspath(path)))
@@ -127,7 +144,16 @@ def open_safe_directory(path: Path) -> Tuple[int, Path]:
                 fail("UNSAFE_OUTPUT_SYMLINK", f"output component is a symlink: {absolute}")
             if not stat.S_ISDIR(info.st_mode):
                 fail("UNSAFE_OUTPUT_PATH", f"output component is not a directory: {absolute}")
-            next_fd = os.open(part, flags | nofollow, dir_fd=fd)
+            next_fd = None
+            try:
+                next_fd = os.open(part, flags | nofollow, dir_fd=fd)
+                opened = os.fstat(next_fd)
+                if not same_directory_identity(info, opened):
+                    fail("UNSAFE_OUTPUT_SWAP", f"output component identity changed: {absolute}")
+            except BaseException:
+                if next_fd is not None:
+                    os.close(next_fd)
+                raise
             os.close(fd)
             fd = next_fd
         verify_directory_identity(absolute, fd)
@@ -146,7 +172,7 @@ def verify_directory_identity(path: Path, fd: int) -> None:
     opened = os.fstat(fd)
     if stat.S_ISLNK(named.st_mode) or not stat.S_ISDIR(named.st_mode):
         fail("UNSAFE_OUTPUT_SYMLINK", f"output directory is no longer a real directory: {path}")
-    if (named.st_dev, named.st_ino) != (opened.st_dev, opened.st_ino):
+    if not same_directory_identity(named, opened):
         fail("UNSAFE_OUTPUT_SWAP", f"output directory identity changed: {path}")
 
 

package/.grok/skills/autoresearch/scripts/verify-canonical-corpus.mjs

@@ -11,8 +11,8 @@ const VERIFIER_RELATIVE = 'scripts/verify-canonical-corpus.mjs';
 const EXPECTED = Object.freeze({
   "schemaVersion": "litgrok.autoresearch-corpus/v1",
   "fileCount": 27,
-  "byteCount": 38018,
-  "aggregateSha256": "520a3c79715f484e912439dd0b350b652e30e3e78c8eb278061bfc90174e124c",
+  "byteCount": 38805,
+  "aggregateSha256": "0296ca6e52fb7cb68a37f3e17f148248146955ad9624e37e449e60b56eeeb1d3",
   "files": {
     "assets/report_template.md": "b6b7607488736f24d3bacea8f3ec8563da40ff782cc1d85c064ab53b2488a4f9",
     "assets/research_template.md": "726d175cd2db92dfe58a738117d9c6cc88211e519d3be8fb7cb05b66ba34c050",
@@ -39,7 +39,7 @@ const EXPECTED = Object.freeze({
     "references/modes/ship/type-checklists.md": "6bea500594cad1e23bdeee2df34f6dd079d02b279773b20f914d313cabd630b3",
     "references/results-logging.md": "4671c19df6d389b42091f2f117fd90726cb32f3082b44dbc9a895dc3625b9832",
     "references/visualization-guide.md": "2ca249d74b30b41e7660c8b7ba91a59b0c33a1e74fc18b2ec2f867441a6e4b27",
-    "scripts/init_research.py": "a5434711928eb4d0487d933df5e1b374f8553140004c6ab8e38fe577ae074d05",
+    "scripts/init_research.py": "b675ea22abf0794e32dbbf59b95248f20878bbf3d071fa10d37b5a004a7f880c",
     "scripts/style_presets.py": "b1c7d495016b0737b622684f4381f87990dfaae77934b3acae44e19742ebdfd5"
   }
 });

package/.grok/skills/skill-observer/scripts/skill-loop.mjs

@@ -10,6 +10,7 @@ import {
   fstatSync,
   fsyncSync,
   lstatSync,
+  linkSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -301,10 +302,119 @@ function validateLockFileSecurity(path, identity) {
   return status;
 }
 
+function sameLockIdentity(left, right) {
+  return left.isFile() === right.isFile()
+    && left.isSymbolicLink() === right.isSymbolicLink()
+    && left.dev === right.dev
+    && left.ino === right.ino
+    && left.uid === right.uid
+    && left.mode === right.mode
+    && left.nlink === right.nlink
+    && left.size === right.size
+    && left.ctimeMs === right.ctimeMs
+    && left.birthtimeMs === right.birthtimeMs;
+}
+
+function sameLockHandle(left, right) {
+  return left.isFile() === right.isFile()
+    && left.isSymbolicLink() === right.isSymbolicLink()
+    && left.dev === right.dev
+    && left.ino === right.ino
+    && left.uid === right.uid
+    && left.mode === right.mode
+    && left.nlink === right.nlink
+    && left.size === right.size;
+}
+
+function sameLockLocation(left, right) {
+  return left.isFile() === right.isFile()
+    && left.isSymbolicLink() === right.isSymbolicLink()
+    && left.dev === right.dev
+    && left.ino === right.ino
+    && left.uid === right.uid
+    && left.nlink === right.nlink;
+}
+
+function inspectLockAgainstDescriptor(path, descriptor, identity, secure) {
+  const named = secure ? validateLockFileSecurity(path, identity) : lstatSync(path);
+  if (!named.isFile() || named.isSymbolicLink() || named.size > 4096 || named.nlink !== 1) fail('STATE_LOCK_INVALID', path);
+  const held = fstatSync(descriptor);
+  if (held.size > 4096) fail('STATE_LOCK_INVALID', path);
+  let reader;
+  try {
+    reader = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const opened = fstatSync(reader);
+    if (!sameLockLocation(opened, held) || opened.size !== named.size) fail('STATE_LOCK_RACE', path);
+    const bytes = readFileSync(reader);
+    const current = secure ? validateLockFileSecurity(path, identity) : lstatSync(path);
+    if (!sameLockLocation(current, held) || current.size !== opened.size) fail('STATE_LOCK_RACE', path);
+    return { bytes, digest: createHash('sha256').update(bytes).digest('hex'), status: current };
+  } finally {
+    if (reader !== undefined) closeSync(reader);
+  }
+}
+
+function restoreMovedLock(path, tombstone) {
+  try {
+    linkSync(tombstone, path);
+    unlinkSync(tombstone);
+  } catch (error) {
+    if (error?.code !== 'EEXIST') throw error;
+  }
+}
+
+function removePinnedLock(path, descriptor, identity, expected, expectedBytes, code, {
+  secure = false,
+  tokenWritten = true,
+  bytesWritten = Buffer.byteLength(expectedBytes, 'utf8'),
+  faultInjector,
+  phase,
+} = {}) {
+  const bytes = Buffer.from(expectedBytes, 'utf8');
+  const prefix = bytes.subarray(0, bytesWritten);
+  const matches = (entry, beforeRename) => {
+    const identityMatches = secure ? sameLockHandle(entry.status, expected) : sameLockLocation(entry.status, expected);
+    if (!identityMatches) return false;
+    if (tokenWritten ? !entry.bytes.equals(bytes) : !entry.bytes.equals(prefix)) return false;
+    return !beforeRename || tokenWritten || bytesWritten > 0 || sameLockIdentity(entry.status, expected);
+  };
+  let checked;
+  try {
+    checked = inspectLockAgainstDescriptor(path, descriptor, identity, secure);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return 'vanished';
+    throw error;
+  }
+  if (!matches(checked, true)) fail(code, path);
+  faultInjector?.(phase, { path, descriptor, expectedBytes });
+  checked = inspectLockAgainstDescriptor(path, descriptor, identity, secure);
+  if (!matches(checked, true)) fail(code, path);
+  const tombstone = `${path}.cleanup-${process.pid}-${randomUUID()}`;
+  try {
+    renameSync(path, tombstone);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return 'vanished';
+    throw error;
+  }
+  let moved;
+  try {
+    moved = inspectLockAgainstDescriptor(tombstone, descriptor, identity, secure);
+  } catch (error) {
+    restoreMovedLock(path, tombstone);
+    throw error;
+  }
+  if (!matches(moved, false)) {
+    restoreMovedLock(path, tombstone);
+    fail(code, path);
+  }
+  unlinkSync(tombstone);
+  return 'removed';
+}
+
 function readSecureLock(path, identity, options = {}) {
   let expected;
   try {
-    expected = validateLockFileSecurity(path, identity);
+    expected = options.expectedStatus ?? validateLockFileSecurity(path, identity);
   } catch (error) {
     if (options.missingLock === 'propagate' && error?.code === 'ENOENT') throw error;
     throw error instanceof SkillLoopError ? error : new SkillLoopError('STATE_LOCK_INVALID', path);
@@ -313,12 +423,15 @@ function readSecureLock(path, identity, options = {}) {
   try {
     descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
     const opened = fstatSync(descriptor);
-    if (!opened.isFile() || opened.size > 4096 || opened.nlink !== 1
-      || opened.dev !== expected.dev || opened.ino !== expected.ino) fail('STATE_LOCK_INVALID', path);
-    const contents = readFileSync(descriptor, 'utf8').trim();
+    if (!opened.isFile() || opened.size > 4096 || opened.nlink !== 1 || !sameLockIdentity(opened, expected)) {
+      fail('STATE_LOCK_INVALID', path);
+    }
+    const bytes = readFileSync(descriptor);
+    const contents = bytes.toString('utf8').trim();
+    const digest = createHash('sha256').update(bytes).digest('hex');
     const current = validateLockFileSecurity(path, identity);
-    if (current.dev !== opened.dev || current.ino !== opened.ino || current.size !== opened.size) fail('STATE_LOCK_RACE', path);
-    return { contents, status: current };
+    if (!sameLockIdentity(current, opened)) fail('STATE_LOCK_RACE', path);
+    return { contents, digest, status: current };
   } catch (error) {
     if (error instanceof SkillLoopError) throw error;
     if (options.missingLock === 'propagate' && error?.code === 'ENOENT') throw error;
@@ -344,12 +457,12 @@ function reclaimStaleLock(path, identity, options = {}) {
   options.faultInjector?.('reclaim-read', { path });
   let secureRead;
   try {
-    secureRead = readSecureLock(path, identity, { missingLock: 'propagate' });
+    secureRead = readSecureLock(path, identity, { missingLock: 'propagate', expectedStatus: initial });
   } catch (error) {
     if (error?.code === 'ENOENT') return 'vanished';
     throw error;
   }
-  const { contents, status } = secureRead;
+  const { contents, digest, status } = secureRead;
   let record;
   if (/^[1-9][0-9]{0,14}$/.test(contents)) {
     if (identity.platform === 'win32') fail('STATE_LOCK_INVALID', 'legacy owner unavailable');
@@ -381,57 +494,46 @@ function reclaimStaleLock(path, identity, options = {}) {
     throw error;
   }
   const moved = readSecureLock(tombstone, identity);
-  if (moved.status.dev !== status.dev || moved.status.ino !== status.ino || moved.contents !== contents) {
-    if (!existsSync(path)) renameSync(tombstone, path);
+  if (!sameLockHandle(moved.status, status) || moved.contents !== contents || moved.digest !== digest) {
+    restoreMovedLock(path, tombstone);
     fail('STATE_LOCK_RACE', path);
   }
   unlinkSync(tombstone);
   return 'reclaimed';
 }
 
-function cleanupFailedLockAcquisition(path, descriptor, created, expectedBytes, tokenWritten) {
-  try {
-    closeSync(descriptor);
-  } catch {
-    fail('STATE_LOCK_ACQUISITION_CLEANUP_FAILED', 'descriptor');
-  }
-  let current;
+function cleanupFailedLockAcquisition(path, descriptor, created, expectedBytes, tokenWritten, bytesWritten, identity, options = {}) {
   try {
-    current = lstatSync(path);
-  } catch {
-    fail('STATE_LOCK_ACQUISITION_CLEANUP_FAILED', 'missing');
-  }
-  if (!current.isFile() || current.isSymbolicLink() || current.dev !== created.dev || current.ino !== created.ino
-    || current.nlink !== 1 || current.size > 4096) fail('STATE_LOCK_ACQUISITION_CLEANUP_FAILED', 'identity');
-  let reader;
-  if (tokenWritten) {
     try {
-      reader = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-      const opened = fstatSync(reader);
-      if (opened.dev !== created.dev || opened.ino !== created.ino || opened.size > 4096
-        || readFileSync(reader, 'utf8') !== expectedBytes) fail('STATE_LOCK_ACQUISITION_CLEANUP_FAILED', 'token');
+      removePinnedLock(path, descriptor, identity, created, expectedBytes, 'STATE_LOCK_ACQUISITION_CLEANUP_FAILED', {
+        tokenWritten,
+        bytesWritten,
+        faultInjector: options.faultInjector,
+        phase: 'before-acquisition-cleanup-rename',
+      });
     } catch (error) {
-      if (error instanceof SkillLoopError) throw error;
-      fail('STATE_LOCK_ACQUISITION_CLEANUP_FAILED', 'read');
-    } finally {
-      if (reader !== undefined) closeSync(reader);
+      if (error?.code === 'STATE_LOCK_ACQUISITION_CLEANUP_FAILED') throw error;
+      fail('STATE_LOCK_ACQUISITION_CLEANUP_FAILED', error?.code ?? 'retargeted');
+    }
+  } finally {
+    try {
+      closeSync(descriptor);
+    } catch {
+      fail('STATE_LOCK_ACQUISITION_CLEANUP_FAILED', 'descriptor');
     }
   }
-  const final = lstatSync(path);
-  if (final.dev !== created.dev || final.ino !== created.ino || final.nlink !== 1) {
-    fail('STATE_LOCK_ACQUISITION_CLEANUP_FAILED', 'retargeted');
-  }
-  unlinkSync(path);
 }
 
 export function withStateLock(path, operation, attempts = 200, options = {}) {
   safeMkdir(dirname(path));
   const identity = lockIdentity(path);
   let descriptor;
+  let ownerBytes;
   for (let index = 0; index < attempts; index += 1) {
     let created;
     let expectedBytes;
     let tokenWritten = false;
+    let bytesWritten = 0;
     try {
       descriptor = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
       created = fstatSync(descriptor);
@@ -442,12 +544,15 @@ export function withStateLock(path, operation, attempts = 200, options = {}) {
         createdAt: new Date().toISOString(),
         nonce: randomUUID(),
       })}\n`;
+      ownerBytes = expectedBytes;
       const bytes = Buffer.from(expectedBytes, 'utf8');
       let offset = 0;
       while (offset < bytes.length) {
+        options.faultInjector?.('before-token-write', { descriptor, path });
         const written = writeSync(descriptor, bytes, offset, bytes.length - offset);
         if (!Number.isSafeInteger(written) || written < 1) fail('STATE_LOCK_WRITE_FAILED');
         offset += written;
+        bytesWritten = offset;
       }
       tokenWritten = true;
       fsyncSync(descriptor);
@@ -456,7 +561,7 @@ export function withStateLock(path, operation, attempts = 200, options = {}) {
       break;
     } catch (error) {
       if (descriptor !== undefined) {
-        cleanupFailedLockAcquisition(path, descriptor, created, expectedBytes, tokenWritten);
+        cleanupFailedLockAcquisition(path, descriptor, created, expectedBytes, tokenWritten, bytesWritten, identity, options);
         descriptor = undefined;
       }
       if (error?.code !== 'EEXIST') throw error;
@@ -474,13 +579,16 @@ export function withStateLock(path, operation, attempts = 200, options = {}) {
   try {
     return operation();
   } finally {
-    closeSync(descriptor);
     try {
-      const status = validateLockFileSecurity(path, identity);
-      if (status.dev !== owned.dev || status.ino !== owned.ino) fail('STATE_LOCK_OWNERSHIP_LOST', path);
-      unlinkSync(path);
+      removePinnedLock(path, descriptor, identity, owned, ownerBytes, 'STATE_LOCK_OWNERSHIP_LOST', {
+        secure: true,
+        faultInjector: options.faultInjector,
+        phase: 'before-release-rename',
+      });
     } catch (error) {
       if (error?.code !== 'ENOENT') throw error;
+    } finally {
+      closeSync(descriptor);
     }
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 0.2.7 (pending) — 2026-09-02
+
+- Repair payload upgrades across the ownership-manifest transition: installs now
+  record a schema-checked `.grok/.litgrok-install-manifest.json` of SHA-256
+  payload hashes, classify files matching recorded hashes as installer-owned,
+  and atomically replace owned files during upgrades. Uninstall removes owned
+  files and the manifest only after payload removal succeeds.
+- Migrate a pristine manifest-free 0.2.5 payload through the bundled seven-file
+  legacy hash snapshot, while malformed manifests and modified or unrecognized
+  files still fail closed before payload writes.
+- Add regression coverage for historical migration, legacy user edits,
+  malformed ownership metadata, and manifest cleanup; enable full-history CI
+  checkout for the historical archive fixture and document the ownership
+  behavior in both READMEs.
+
+## 0.2.6 (pending) — 2026-09-02
+
+- Harden inode-reuse handling across skill-loop state locks and the
+  autoconference/autoresearch output scaffolders: lock reclaim, failed-acquisition
+  cleanup, and release stay bound to descriptor identity, ctime/birthtime, and
+  exact bytes through tombstone checks, while opened output directories are
+  revalidated against full stat identity before publication. Add same-inode race
+  regressions and regenerate the affected canonical manifests so replacements fail
+  closed while authorized rotations remain valid.
+
 ## 0.2.5 (pending) — 2026-09-01
 
 - Add the shared stacked LitFamily ASCII wordmark to the installer and lead both

package/README.md

@@ -22,7 +22,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litgrok--ai-cb3837" alt="npm: litgrok-ai" />
-  <img src="https://img.shields.io/badge/version-0.2.5-2ea44f" alt="version 0.2.5" />
+  <img src="https://img.shields.io/badge/version-0.2.7-2ea44f" alt="version 0.2.7" />
   <img src="https://img.shields.io/badge/Grok%20Build-skills%20%2B%20rules-111827" alt="Grok Build skills and project rules" />
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license" />
 </p>
@@ -105,7 +105,7 @@ npx --yes litgrok-ai@latest install
 Pin a version when you need a reproducible install:
 
 ```bash
-npx --yes litgrok-ai@0.2.5 install
+npx --yes litgrok-ai@0.2.7 install
 ```
 
 Preview without writing files:
@@ -120,7 +120,7 @@ Default install writes the whole payload into the current project's `.grok/` tre
 npx --yes litgrok-ai@latest install --user
 ```
 
-`--user` targets `~/.grok/skills`, `~/.grok/rules`, and `~/.grok/hooks`. Dry-run, `NO_COLOR`, and non-interactive runs do not mutate files. Reinstall is idempotent for byte-identical payload files. A different file occupying any packaged path refuses the whole install rather than being overwritten.
+`--user` targets `~/.grok/skills`, `~/.grok/rules`, and `~/.grok/hooks`. Dry-run, `NO_COLOR`, and non-interactive runs do not mutate files. The installer records SHA-256 ownership in `.grok/.litgrok-install-manifest.json`: byte-identical files stay untouched, and files matching a previously recorded payload hash may be replaced during an upgrade. A user-modified or otherwise unrecognized file refuses the whole install rather than being overwritten. A pristine pre-manifest 0.2.5 payload is recognized through the bundled migration snapshot while no manifest exists and receives a new manifest after the upgrade.
 
 ### Install output
 
@@ -146,7 +146,7 @@ npx --yes litgrok-ai@latest uninstall
 npx --yes litgrok-ai@latest uninstall --user
 ```
 
-If any installed payload file was changed, uninstall refuses the whole removal. Reinstall by running the matching `install` command again; byte-identical files are left untouched.
+If any installed payload file was changed, uninstall refuses the whole removal. Files recorded as installer-owned are removed too, and the ownership manifest is removed only after the payload removal succeeds. Reinstall by running the matching `install` command again; byte-identical files are left untouched.
 
 ## First use
 
@@ -198,12 +198,12 @@ Review is proposal-only. `autoApply` is always false, transcript text is inert d
 From an installed project, use the package CLI directly when you want a replayable foreground command:
 
 ```bash
-npx --yes litgrok-ai@0.2.5 skill-loop review <session-id>
-npx --yes litgrok-ai@0.2.5 skill-loop list
-npx --yes litgrok-ai@0.2.5 skill-loop apply <proposal-id>
-npx --yes litgrok-ai@0.2.5 skill-loop reject <proposal-id>
-npx --yes litgrok-ai@0.2.5 skill-loop rollback <ledger-id>
-npx --yes litgrok-ai@0.2.5 skill-loop curator
+npx --yes litgrok-ai@0.2.7 skill-loop review <session-id>
+npx --yes litgrok-ai@0.2.7 skill-loop list
+npx --yes litgrok-ai@0.2.7 skill-loop apply <proposal-id>
+npx --yes litgrok-ai@0.2.7 skill-loop reject <proposal-id>
+npx --yes litgrok-ai@0.2.7 skill-loop rollback <ledger-id>
+npx --yes litgrok-ai@0.2.7 skill-loop curator
 ```
 
 `apply` prints the ledger id needed for rollback. The deterministic curator is also user-invoked: by default it runs at most once every seven days, requires at least two idle hours, marks eligible unpinned agent-owned skills stale after 30 idle days, and archives them outside discovery after 90 idle days. It makes a full backup before a transition and never deletes a skill package; `--force` bypasses only the seven-day run interval for an explicit test or maintenance invocation.

package/README_ko-KR.md

@@ -22,7 +22,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litgrok--ai-cb3837" alt="npm: litgrok-ai" />
-  <img src="https://img.shields.io/badge/version-0.2.5-2ea44f" alt="version 0.2.5" />
+  <img src="https://img.shields.io/badge/version-0.2.7-2ea44f" alt="version 0.2.7" />
   <img src="https://img.shields.io/badge/Grok%20Build-skills%20%2B%20rules-111827" alt="Grok Build skills and project rules" />
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license" />
 </p>
@@ -105,7 +105,7 @@ npx --yes litgrok-ai@latest install
 재현 가능한 설치는 버전을 고정합니다.
 
 ```bash
-npx --yes litgrok-ai@0.2.5 install
+npx --yes litgrok-ai@0.2.7 install
 ```
 
 파일을 쓰지 않고 미리보기:
@@ -120,7 +120,7 @@ npx --yes litgrok-ai@latest install --dry-run
 npx --yes litgrok-ai@latest install --user
 ```
 
-`--user`는 `~/.grok/skills`, `~/.grok/rules`, `~/.grok/hooks`를 대상으로 합니다. dry-run, `NO_COLOR`, non-interactive는 파일을 바꾸지 않습니다. byte가 같은 payload 재설치는 멱등입니다. package path 하나라도 다른 파일이 차지하면 전체 설치를 거절하고 덮어쓰지 않습니다.
+`--user`는 `~/.grok/skills`, `~/.grok/rules`, `~/.grok/hooks`를 대상으로 합니다. dry-run, `NO_COLOR`, non-interactive는 파일을 바꾸지 않습니다. installer는 `.grok/.litgrok-install-manifest.json`에 SHA-256 소유권을 기록합니다. byte가 같은 파일은 다시 쓰지 않고, 이전 payload hash와 일치하는 installer 소유 파일은 업그레이드에서 교체할 수 있습니다. 사용자가 바꿨거나 소유권을 확인할 수 없는 파일이 있으면 전체 설치를 거절하고 덮어쓰지 않습니다. manifest가 없을 때 0.2.5의 pristine payload는 내장 migration snapshot으로 인식하며 업그레이드 뒤 새 manifest를 기록합니다.
 
 ### 설치 출력
 
@@ -146,7 +146,7 @@ npx --yes litgrok-ai@latest uninstall
 npx --yes litgrok-ai@latest uninstall --user
 ```
 
-설치된 payload 파일 하나라도 바뀌었다면 uninstall은 전체 삭제를 거절합니다. 재설치는 같은 `install` 명령을 다시 실행합니다. byte가 같은 파일은 다시 쓰지 않습니다.
+설치된 payload 파일 하나라도 바뀌었다면 uninstall은 전체 삭제를 거절합니다. installer 소유로 기록된 파일도 삭제하며, payload 삭제가 성공한 뒤에만 ownership manifest를 삭제합니다. 재설치는 같은 `install` 명령을 다시 실행합니다. byte가 같은 파일은 다시 쓰지 않습니다.
 
 ## 처음 사용하기
 
@@ -198,12 +198,12 @@ Review는 proposal만 만듭니다. `autoApply`는 항상 false이고 transcript
 설치된 project에서는 다음 package CLI를 foreground command로 실행할 수 있습니다.
 
 ```bash
-npx --yes litgrok-ai@0.2.5 skill-loop review <session-id>
-npx --yes litgrok-ai@0.2.5 skill-loop list
-npx --yes litgrok-ai@0.2.5 skill-loop apply <proposal-id>
-npx --yes litgrok-ai@0.2.5 skill-loop reject <proposal-id>
-npx --yes litgrok-ai@0.2.5 skill-loop rollback <ledger-id>
-npx --yes litgrok-ai@0.2.5 skill-loop curator
+npx --yes litgrok-ai@0.2.7 skill-loop review <session-id>
+npx --yes litgrok-ai@0.2.7 skill-loop list
+npx --yes litgrok-ai@0.2.7 skill-loop apply <proposal-id>
+npx --yes litgrok-ai@0.2.7 skill-loop reject <proposal-id>
+npx --yes litgrok-ai@0.2.7 skill-loop rollback <ledger-id>
+npx --yes litgrok-ai@0.2.7 skill-loop curator
 ```
 
 `apply`는 rollback에 필요한 ledger id를 출력합니다. Deterministic curator도 user-invoked입니다. 기본적으로 7일에 한 번만 실행되고, 마지막 activity 뒤 최소 2시간이 지나야 하며, pin되지 않은 agent-owned skill을 30일 idle 뒤 stale로 표시하고 90일 idle 뒤 discovery 밖으로 archive합니다. Transition 전에는 전체 backup을 만들고 skill package를 삭제하지 않습니다. `--force`는 명시적인 test 또는 maintenance 실행에서 7일 interval만 건너뜁니다.

package/bin/litgrok.mjs

@@ -1,12 +1,30 @@
 #!/usr/bin/env node
 
-import { constants, copyFileSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, unlinkSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, copyFileSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join, relative, resolve, sep } from 'node:path';
+import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const PAYLOAD_ROOT = join(PACKAGE_ROOT, '.grok');
+const INSTALL_MANIFEST_NAME = '.litgrok-install-manifest.json';
+const INSTALL_MANIFEST_SCHEMA = 'litgrok.install-manifest/v1';
+const PACKAGE_NAME = 'litgrok-ai';
+
+// 0.2.5 was the last release before ownership manifests existed. These are the
+// only payload hashes changed by the current security release, so a pristine
+// 0.2.5 install can migrate while no manifest exists without treating its
+// seven security-fix files as user conflicts.
+const PRE_MANIFEST_PAYLOAD_HASHES = Object.freeze({
+  'skills/autoconference/references/_canonical-corpus/manifest.json': '4554ee4041b73577a844abc27a97db91e941b8412f1888209203251dc1fee500',
+  'skills/autoconference/scripts/init_conference.py': 'cb83623c1338b7e3a5be7a7beac7a17b8ae362fc24fbc01d1caff634db290dfc',
+  'skills/autoconference/scripts/verify-canonical-corpus.mjs': '4a4afb7dc0b58519a4c521c987cb8998495afc09b89fb87cafb0f1db0047c28d',
+  'skills/autoresearch/references/_canonical-corpus/manifest.json': '9667f852081d4877c579d14e63c0759ebbe863e4170a9c3d5e6487cdb1f0c323',
+  'skills/autoresearch/scripts/init_research.py': 'a5434711928eb4d0487d933df5e1b374f8553140004c6ab8e38fe577ae074d05',
+  'skills/autoresearch/scripts/verify-canonical-corpus.mjs': '80a85ed4ba0c168bd7f7abef5754c4089a629975a827b6ddb3f01cd813602274',
+  'skills/skill-observer/scripts/skill-loop.mjs': '3f3f5265928c0d71175b0f23f71b836d1dc05e7efba407bfdc2d263c6aaed0ce',
+});
 const USAGE = 'Usage: litgrok [install|uninstall] [--user|--project] [--dry-run] [--no-color] [--yes]\n       litgrok skill-loop <review|propose|list|apply|reject|rollback|curator> ...\n';
 const BRAILLE_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
 const SPINNER_INTERVAL_MS = 80;
@@ -235,17 +253,160 @@ function reportFailure(error, { stderr, stdout, options, root, colors, step }) {
   stdout.write(failureCard(options, root, colors, error?.step ?? step, errorText(error)));
 }
 
-function targetState(source, target) {
+function normalizedRelativePath(relativePath) {
+  return relativePath.split(sep).join('/');
+}
+
+function sha256File(filePath) {
+  return createHash('sha256').update(readFileSync(filePath)).digest('hex');
+}
+
+function ownershipManifestFailure(reason) {
+  const message = `Refusing to use ${INSTALL_MANIFEST_NAME}: ${reason}`;
+  const error = new Error(message);
+  error.step = 'OWNERSHIP';
+  error.stderrLines = [message];
+  return error;
+}
+
+function ownershipManifestPath(root) {
+  return join(root, INSTALL_MANIFEST_NAME);
+}
+
+function readOwnershipManifest(root) {
+  const target = ownershipManifestPath(root);
+  let stat;
+  try {
+    stat = lstatSync(target);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+  if (stat.isSymbolicLink() || !stat.isFile()) throw ownershipManifestFailure('path is not a regular file');
+
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(target, 'utf8'));
+  } catch {
+    throw ownershipManifestFailure('file is not valid JSON');
+  }
+  if (
+    !parsed ||
+    parsed.schema !== INSTALL_MANIFEST_SCHEMA ||
+    parsed.package !== PACKAGE_NAME ||
+    typeof parsed.version !== 'string' ||
+    parsed.version.length === 0 ||
+    !parsed.files ||
+    Array.isArray(parsed.files) ||
+    typeof parsed.files !== 'object'
+  ) {
+    throw ownershipManifestFailure('schema is invalid');
+  }
+
+  const hashes = new Map();
+  for (const [relativePath, hash] of Object.entries(parsed.files)) {
+    const segments = relativePath.split('/');
+    if (
+      relativePath.length === 0 ||
+      relativePath.startsWith('/') ||
+      relativePath.includes('\\') ||
+      segments.some((segment) => segment.length === 0 || segment === '.' || segment === '..')
+    ) {
+      throw ownershipManifestFailure(`path is invalid: ${relativePath}`);
+    }
+    if (typeof hash !== 'string' || !/^[0-9a-f]{64}$/u.test(hash)) {
+      throw ownershipManifestFailure(`hash is invalid: ${relativePath}`);
+    }
+    hashes.set(relativePath, hash);
+  }
+  return { path: target, hashes };
+}
+
+function targetState(source, target, relativePath, manifest) {
   try {
     const targetStat = lstatSync(target);
     if (!targetStat.isFile()) return 'conflict';
-    return readFileSync(source).equals(readFileSync(target)) ? 'current' : 'conflict';
+    const targetHash = sha256File(target);
+    if (targetHash === sha256File(source)) return 'current';
+    const previousHash = manifest?.hashes.get(normalizedRelativePath(relativePath)) ??
+      (manifest === null ? PRE_MANIFEST_PAYLOAD_HASHES[normalizedRelativePath(relativePath)] : undefined);
+    return targetHash === previousHash ? 'owned' : 'conflict';
   } catch (error) {
     if (error?.code === 'ENOENT') return 'missing';
     throw error;
   }
 }
 
+function manifestContent(files) {
+  const hashes = Object.fromEntries(
+    files
+      .map(({ relativePath, source }) => [normalizedRelativePath(relativePath), sha256File(source)])
+      .sort(([left], [right]) => left.localeCompare(right)),
+  );
+  return `${JSON.stringify({
+    schema: INSTALL_MANIFEST_SCHEMA,
+    package: PACKAGE_NAME,
+    version: packageVersion(),
+    files: hashes,
+  }, null, 2)}\n`;
+}
+
+function writeOwnershipManifest(root, files, previousManifest) {
+  const target = ownershipManifestPath(root);
+  const content = manifestContent(files);
+  let existing;
+  try {
+    const stat = lstatSync(target);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw ownershipManifestFailure('path is not a regular file');
+    existing = readFileSync(target, 'utf8');
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+  if (existing === content) return false;
+  if (previousManifest === null && existing !== undefined) {
+    throw ownershipManifestFailure('path appeared during installation');
+  }
+
+  const temporary = join(root, `.${basename(target)}.${randomUUID()}.tmp`);
+  try {
+    writeFileSync(temporary, content, { flag: 'wx', mode: 0o600 });
+    renameSync(temporary, target);
+  } finally {
+    try {
+      unlinkSync(temporary);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
+  return true;
+}
+
+function replaceOwnedFile(source, target) {
+  const temporary = join(dirname(target), `.${basename(target)}.${randomUUID()}.tmp`);
+  try {
+    copyFileSync(source, temporary, constants.COPYFILE_EXCL);
+    renameSync(temporary, target);
+  } finally {
+    try {
+      unlinkSync(temporary);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+function removeOwnershipManifest(root, previousManifest) {
+  if (previousManifest === null) return;
+  const target = ownershipManifestPath(root);
+  try {
+    const stat = lstatSync(target);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw ownershipManifestFailure('path is not a regular file');
+    unlinkSync(target);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+}
+
 function discoverPayloadFiles(root = PAYLOAD_ROOT) {
   const files = [];
 
@@ -383,10 +544,12 @@ export async function run(args, context = {}) {
 
     step = 'OWNERSHIP';
     const states = runStep(progress, 'OWNERSHIP', () => {
-      const owned = files.map(({ source, target }) => targetState(source, target));
+      const manifest = readOwnershipManifest(root);
+      const owned = files.map(({ relativePath, source, target }) => targetState(source, target, relativePath, manifest));
       const counts = {
         missing: owned.filter((state) => state === 'missing').length,
         current: owned.filter((state) => state === 'current').length,
+        owned: owned.filter((state) => state === 'owned').length,
         conflicts: owned.filter((state) => state === 'conflict').length,
       };
       if (counts.conflicts > 0) {
@@ -394,14 +557,14 @@ export async function run(args, context = {}) {
         for (let index = 0; index < files.length; index += 1) {
           if (owned[index] === 'conflict') stderrLines.push(`Refusing to ${options.command === 'install' ? 'overwrite' : 'remove'} different existing file: ${files[index].target}`);
         }
-        const error = new Error(`${counts.missing} missing · ${counts.current} already-current · ${counts.conflicts} conflicts`);
+        const error = new Error(`${counts.missing} missing · ${counts.current} already-current · ${counts.owned} owned · ${counts.conflicts} conflicts`);
         error.step = 'OWNERSHIP';
         error.stderrLines = stderrLines;
         throw error;
       }
       return {
-        value: { states: owned, counts },
-        detail: `${counts.missing} missing · ${counts.current} already-current · ${counts.conflicts} conflicts`,
+        value: { states: owned, counts, manifest },
+        detail: `${counts.missing} missing · ${counts.current} already-current · ${counts.owned} owned · ${counts.conflicts} conflicts`,
       };
     });
 
@@ -410,12 +573,19 @@ export async function run(args, context = {}) {
       const writeStarted = process.hrtime.bigint();
       progress.start('WRITE');
       let removed = 0;
-      for (let index = 0; index < files.length; index += 1) {
-        if (states.states[index] !== 'current') continue;
-        unlinkSync(files[index].target);
-        removed += 1;
+      try {
+        for (let index = 0; index < files.length; index += 1) {
+          if (!['current', 'owned'].includes(states.states[index])) continue;
+          unlinkSync(files[index].target);
+          removed += 1;
+        }
+        removeOwnershipManifest(root, states.manifest);
+        progress.finish('ok', 'WRITE', `${removed} removed · ${states.counts.missing} already absent`, elapsedSince(writeStarted));
+      } catch (error) {
+        progress.finish('failed', 'WRITE', errorText(error), elapsedSince(writeStarted));
+        if (error && typeof error === 'object') error.step = 'WRITE';
+        throw error;
       }
-      progress.finish('ok', 'WRITE', `${removed} removed · ${states.counts.missing} already absent`, elapsedSince(writeStarted));
       const receipt = receiptCard(options, displayRoot, colors, { status: 'Removed', written: 0, current: states.counts.current });
       progress.close();
       stdout.write(receipt);
@@ -423,6 +593,12 @@ export async function run(args, context = {}) {
     }
 
     if (states.states.every((state) => state === 'current')) {
+      try {
+        writeOwnershipManifest(root, files, states.manifest);
+      } catch (error) {
+        if (error && typeof error === 'object') error.step = 'WRITE';
+        throw error;
+      }
       skipStep(progress, 'WRITE', `SKIPPED · 0 written · ${states.counts.current} already-current`);
       const receipt = receiptCard(options, displayRoot, colors, { status: 'Already current', written: 0, current: states.counts.current });
       progress.close();
@@ -438,10 +614,12 @@ export async function run(args, context = {}) {
         if (states.states[index] === 'current') continue;
         const { source, target } = files[index];
         mkdirSync(dirname(target), { recursive: true });
-        copyFileSync(source, target, constants.COPYFILE_EXCL);
+        if (states.states[index] === 'owned') replaceOwnedFile(source, target);
+        else copyFileSync(source, target, constants.COPYFILE_EXCL);
         installed += 1;
       }
-      progress.finish('ok', 'WRITE', `${installed} written · ${states.counts.current} already-current`, elapsedSince(writeStarted));
+      writeOwnershipManifest(root, files, states.manifest);
+      progress.finish('ok', 'WRITE', `${installed} written · ${states.counts.current} already-current · ${states.counts.owned} owned`, elapsedSince(writeStarted));
     } catch (error) {
       progress.finish('failed', 'WRITE', errorText(error), elapsedSince(writeStarted));
       if (error && typeof error === 'object') error.step = 'WRITE';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litgrok-ai",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Grok Build skills, project rules, and hooks installer.",
   "type": "module",
   "bin": {

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "litgrok",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Grok Build skills, project rules, and bounded lifecycle hooks for evidence-first lit work.",
   "author": {
     "name": "LitGrok contributors"