litgrok-ai 0.2.6 → 0.2.8

package/.grok/skills/lit-scientific-visualization/SKILL.md

@@ -32,7 +32,7 @@ artifact_type: grok_build_skill
 surface: .grok/skills/lit-scientific-visualization/SKILL.md
 invocation: user-invocable skill or an explicit scientific-visualization request
 activation_banner: "🔥 LITBURN IGNITED · lit-scientific-visualization 🔥"
-resource_root: this skill directory
+resource_root: ../../vendor/045_scientific-visualization
 verdicts: [PASS, DEGRADED, FAIL, BLOCKED]
 ```
 
@@ -62,20 +62,20 @@ Resolve all resource paths relative to this entrypoint's directory. The followin
 shipped resources; load only what the request needs, but run the verifier before relying on any
 helper or style:
 
-    - Load `references/matplotlib_examples.md` when a worked plotting pattern is needed.
-    - Load `references/publication_guidelines.md` when choosing publication geometry or export rules.
-    - Load `references/journal_requirements.md` when a venue-specific requirement is in scope.
-    - Load `references/color_palettes.md` when choosing categorical or accessible colors.
-    - Load `references/seaborn_for_publications.md` when a seaborn workflow is requested.
-    - Load `references/mdanalysis_martini_visualization.md` when a molecular trajectory is in scope.
-- [style presets](scripts/style_presets.py), [figure export helpers](scripts/figure_export.py),
+    - Load `../../vendor/045_scientific-visualization/references/matplotlib_examples.md` when a worked plotting pattern is needed.
+    - Load `../../vendor/045_scientific-visualization/references/publication_guidelines.md` when choosing publication geometry or export rules.
+    - Load `../../vendor/045_scientific-visualization/references/journal_requirements.md` when a venue-specific requirement is in scope.
+    - Load `../../vendor/045_scientific-visualization/references/color_palettes.md` when choosing categorical or accessible colors.
+    - Load `../../vendor/045_scientific-visualization/references/seaborn_for_publications.md` when a seaborn workflow is requested.
+    - Load `../../vendor/045_scientific-visualization/references/mdanalysis_martini_visualization.md` when a molecular trajectory is in scope.
+- [style presets](../../vendor/045_scientific-visualization/scripts/style_presets.py), [figure export helpers](../../vendor/045_scientific-visualization/scripts/figure_export.py),
   and the [canonical corpus verifier](scripts/verify-canonical-corpus.mjs).
-- [color palettes](assets/color_palettes.py), [publication style](assets/publication.mplstyle),
-  [Nature style](assets/nature.mplstyle), and [presentation style](assets/presentation.mplstyle).
-- [evaluation cases](evals/evals.json) describe the behavioral checks this resource set is meant
-  to support. The [source manifest](references/_canonical-corpus/manifest.json) pins the 15
-  companion files and their digests. The Python [helper tests](tests/test_style_presets.py) and
-  [export tests](tests/test_figure_export.py) are regression fixtures, not user data.
+- [color palettes](../../vendor/045_scientific-visualization/assets/color_palettes.py), [publication style](../../vendor/045_scientific-visualization/assets/publication.mplstyle),
+  [Nature style](../../vendor/045_scientific-visualization/assets/nature.mplstyle), and [presentation style](../../vendor/045_scientific-visualization/assets/presentation.mplstyle).
+- [evaluation cases](../../vendor/045_scientific-visualization/evals/evals.json) describe the behavioral checks this resource set is meant
+  to support. The [source manifest](../../vendor/045_scientific-visualization/references/_canonical-corpus/manifest.json) pins the 15
+  companion files and their digests. The Python [helper tests](../../vendor/045_scientific-visualization/tests/test_style_presets.py) and
+  [export tests](../../vendor/045_scientific-visualization/tests/test_figure_export.py) are regression fixtures, not user data.
 
 Run `node scripts/verify-canonical-corpus.mjs` from this skill directory before relying on any
 helper. A nonzero result is a `BLOCKED` source-integrity condition: do not run a modified helper
@@ -143,11 +143,11 @@ from pathlib import Path
 import sys
 
 PROJECT_ROOT = Path.cwd().resolve()
-SKILL_ROOT = PROJECT_ROOT / ".grok" / "skills" / "lit-scientific-visualization"
-if not (SKILL_ROOT / "SKILL.md").is_file():
-    raise FileNotFoundError(f"package-owned visualization skill is missing: {SKILL_ROOT}")
-SCRIPTS = SKILL_ROOT / "scripts"
-ASSETS = SKILL_ROOT / "assets"
+CORPUS_ROOT = PROJECT_ROOT / ".grok" / "vendor" / "045_scientific-visualization"
+if not (CORPUS_ROOT / "references" / "_canonical-corpus" / "manifest.json").is_file():
+    raise FileNotFoundError(f"package-owned visualization corpus is missing: {CORPUS_ROOT}")
+SCRIPTS = CORPUS_ROOT / "scripts"
+ASSETS = CORPUS_ROOT / "assets"
 sys.path.insert(0, str(SCRIPTS))
 sys.path.insert(0, str(ASSETS))
 

package/.grok/skills/lit-scientific-visualization/scripts/verify-canonical-corpus.mjs

@@ -5,10 +5,18 @@ import { existsSync, lstatSync, readdirSync, readFileSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-const SKILL_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const SKILL_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../../../vendor/045_scientific-visualization');
 const MANIFEST_RELATIVE = 'references/_canonical-corpus/manifest.json';
 const EXPECTED = Object.freeze({
   schemaVersion: 'litgrok.scientific-visualization-corpus/v1',
+  license: 'MIT',
+  author: 'Woojin',
+  upstreamCommit: '235ed3af614a7becaee6ef1d1a18e5c4b13994f4',
+  omittedFile: Object.freeze({
+    path: 'SKILL.md',
+    sha256: 'd6084a7e3adf283157820ea20dbe1b46fa22fa1be17b138ab1203be550f4ef68',
+    reason: 'deliberately replaced by the Grok-native adapter',
+  }),
   fileCount: 15,
   byteCount: 114577,
   aggregateSha256: 'bf4719645e2c784f788993bb1d9f17d99dfb26301b1df474b1d26e9fcb9b4962',
@@ -58,7 +66,7 @@ function listFiles(directory, prefix = '') {
 function parseRoot(argv) {
   if (argv.length === 0) return SKILL_ROOT;
   if (argv.length === 2 && argv[0] === '--root' && argv[1] && !argv[1].startsWith('-')) return resolve(argv[1]);
-  throw new Error('usage: verify-canonical-corpus.mjs [--root <skill-directory>]');
+  throw new Error('usage: verify-canonical-corpus.mjs [--root <corpus-directory>]');
 }
 
 function verify(skillRoot) {
@@ -73,11 +81,26 @@ function verify(skillRoot) {
     return [`manifest unreadable: ${error instanceof Error ? error.message : String(error)}`];
   }
 
-  const expectedManifestKeys = ['aggregate_sha256', 'byte_count', 'file_count', 'files', 'schema_version', 'source'];
+  const expectedManifestKeys = [
+    'aggregate_sha256',
+    'author',
+    'byte_count',
+    'file_count',
+    'files',
+    'license',
+    'omitted_files',
+    'schema_version',
+    'source',
+    'upstream_commit',
+  ];
   if (JSON.stringify(Object.keys(manifest).sort()) !== JSON.stringify(expectedManifestKeys.sort())) {
     failures.push('manifest keys mismatch');
   }
   if (manifest.schema_version !== EXPECTED.schemaVersion) failures.push('schema_version mismatch');
+  if (manifest.license !== EXPECTED.license) failures.push('license mismatch');
+  if (manifest.author !== EXPECTED.author) failures.push('author mismatch');
+  if (manifest.upstream_commit !== EXPECTED.upstreamCommit) failures.push('upstream_commit mismatch');
+  if (JSON.stringify(manifest.omitted_files) !== JSON.stringify([EXPECTED.omittedFile])) failures.push('omitted_files mismatch');
   if (manifest.file_count !== EXPECTED.fileCount) failures.push(`file_count expected ${EXPECTED.fileCount}, got ${manifest.file_count}`);
   if (manifest.byte_count !== EXPECTED.byteCount) failures.push(`byte_count expected ${EXPECTED.byteCount}, got ${manifest.byte_count}`);
   if (manifest.aggregate_sha256 !== EXPECTED.aggregateSha256) failures.push('aggregate_sha256 mismatch');

package/.grok/{skills/lit-scientific-visualization → vendor/045_scientific-visualization}/references/_canonical-corpus/manifest.json

@@ -5,6 +5,16 @@
     "reviewed_on": "2026-08-30",
     "selection": "15 companion files retained; the skill entrypoint is a Grok-native adapter"
   },
+  "license": "MIT",
+  "author": "Woojin",
+  "upstream_commit": "235ed3af614a7becaee6ef1d1a18e5c4b13994f4",
+  "omitted_files": [
+    {
+      "path": "SKILL.md",
+      "sha256": "d6084a7e3adf283157820ea20dbe1b46fa22fa1be17b138ab1203be550f4ef68",
+      "reason": "deliberately replaced by the Grok-native adapter"
+    }
+  ],
   "file_count": 15,
   "byte_count": 114577,
   "aggregate_sha256": "bf4719645e2c784f788993bb1d9f17d99dfb26301b1df474b1d26e9fcb9b4962",

package/.grok/vendor/NOTICE.md

@@ -0,0 +1,16 @@
+# Scientific visualization notice
+
+The LitGrok `lit-scientific-visualization` skill includes 15 retained companion files from the
+owner-authorized 16-file canonical source snapshot. They are distributed under the adjacent MIT
+license with explicit authorization from the owner.
+
+The upstream `SKILL.md` has SHA-256
+`d6084a7e3adf283157820ea20dbe1b46fa22fa1be17b138ab1203be550f4ef68` and is deliberately omitted,
+replaced by the Grok-native adapter at `.grok/skills/lit-scientific-visualization/SKILL.md`. The
+retained-file hashes and this omission are recorded in
+`045_scientific-visualization/references/_canonical-corpus/manifest.json` and
+`provenance/045_scientific-visualization.md`.
+
+The corpus contains scientific guidance, examples, and references to external tools and publishers.
+Those names do not imply endorsement; external software, websites, datasets, and author instructions
+remain subject to their own terms and should be checked at the time of use.

package/.grok/vendor/licenses/045_scientific-visualization-MIT.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Woojin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/.grok/vendor/provenance/045_scientific-visualization.md

@@ -0,0 +1,37 @@
+# Lit scientific visualization provenance
+
+- Source repository: `~/skills` (local canonical source; path is provenance only, never a runtime dependency)
+- Packaged corpus root: `.grok/vendor/045_scientific-visualization/`
+- Source commit: `235ed3af614a7becaee6ef1d1a18e5c4b13994f4`
+- Distribution authorization: public MIT inclusion authorized by the owner for LitFamily packaging.
+- License: MIT, Copyright (c) 2026 Woojin
+- Canonical file count: 16 Git-tracked authored files.
+- Retained file count: 15 companion files.
+- Omitted file: upstream `SKILL.md`, SHA-256 `d6084a7e3adf283157820ea20dbe1b46fa22fa1be17b138ab1203be550f4ef68`, deliberately replaced by the Grok-native adapter at `.grok/skills/lit-scientific-visualization/SKILL.md`.
+- Approved retained-byte manifest SHA-256: `bf4719645e2c784f788993bb1d9f17d99dfb26301b1df474b1d26e9fcb9b4962`.
+
+The retained-file manifest is SHA-256 over records of the form
+`<sha256(raw bytes)><two spaces><repo-relative path><LF>`. Modes, sizes, xattrs,
+and generated caches are excluded.
+
+| Relative path | SHA-256 |
+| --- | --- |
+| `assets/color_palettes.py` | `ffea28da930406ecb11bbeaebfc530dfac40b772827a7653f449cb3b0bb35309` |
+| `assets/nature.mplstyle` | `6a7343788bf772b7e1bc813d094f7bafa97c1e5544586e7b76002ad8547229b6` |
+| `assets/presentation.mplstyle` | `e3ee23f0470d7fb07a0be75cd1210e231becfc2f5267aa404e4186aa077a3339` |
+| `assets/publication.mplstyle` | `18447af3bc47310d23fc27255413c23d8bbe3ff441463cc54fcecdfacd205bea` |
+| `evals/evals.json` | `366dc61b6e042f08f28bf33f2534feea80219d771b84497ec7094b30263e935b` |
+| `references/color_palettes.md` | `0298691c8de8379570488a7b7768663971bc20af1fb05d464c5438d43a21dcfa` |
+| `references/journal_requirements.md` | `56fdde590a9d778547dbcb609b77d86f1f31865e803bcecca5d8c4c72b91b3c7` |
+| `references/matplotlib_examples.md` | `c99cd4f83e2452773e9580e2fa0984e61433c7a9b57ca0d2562dc400dfe4f83d` |
+| `references/mdanalysis_martini_visualization.md` | `abcb3c61f1c3984ba9014d9ae197b726d23c1df844dc90988ecc4d8f0e349bfe` |
+| `references/publication_guidelines.md` | `d9f5d0f115872c4c190a11d83432d44635e38ef9f1740db471fcc70f4c91dd2c` |
+| `references/seaborn_for_publications.md` | `2da2147ae8974b4b5d16096c1484b982d5d1e5f91113808ebfd12111a0a6597a` |
+| `scripts/figure_export.py` | `b22c7708afaf2a1cfa4f821eb9230d4262f1d52948af7f0815855aa9d0960403` |
+| `scripts/style_presets.py` | `e9d450bd4ab6b11303b02d5029177c8d49466cc597648d12de0ecdb7620f64c4` |
+| `tests/test_figure_export.py` | `b18414369e6721ad93d417914114d71af006248675eb20bb1f4989c48ec9a58e` |
+| `tests/test_style_presets.py` | `ff0e190196480848f1fea2398220038771f386ee7967a0ef122b0dfbca3aed46` |
+
+The Grok-native adapter is outside the retained companion-file table. The omitted upstream
+entrypoint remains identified in the manifest so the 15 retained files and the 16-file canonical
+source are both auditable.

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.2.8 (pending) — 2026-09-02
+
+- Move the scientific-visualization corpus to `.grok/vendor/` so the skill
+  adapter stays a wrapper over the original files.
+- Count vendor license, provenance, and NOTICE companions in family
+  payload-parity so packed skills keep the material they name.
+
+## 0.2.7 (pending) — 2026-09-02
+
+- Repair payload upgrades across the ownership-manifest transition: installs now
+  record a schema-checked `.grok/.litgrok-install-manifest.json` of SHA-256
+  payload hashes, classify files matching recorded hashes as installer-owned,
+  and atomically replace owned files during upgrades. Uninstall removes owned
+  files and the manifest only after payload removal succeeds.
+- Migrate a pristine manifest-free 0.2.5 payload through the bundled seven-file
+  legacy hash snapshot, while malformed manifests and modified or unrecognized
+  files still fail closed before payload writes.
+- Add regression coverage for historical migration, legacy user edits,
+  malformed ownership metadata, and manifest cleanup; enable full-history CI
+  checkout for the historical archive fixture and document the ownership
+  behavior in both READMEs.
+
 ## 0.2.6 (pending) — 2026-09-02
 
 - Harden inode-reuse handling across skill-loop state locks and the

package/README.md

@@ -22,7 +22,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litgrok--ai-cb3837" alt="npm: litgrok-ai" />
-  <img src="https://img.shields.io/badge/version-0.2.6-2ea44f" alt="version 0.2.6" />
+  <img src="https://img.shields.io/badge/version-0.2.8-2ea44f" alt="version 0.2.8" />
   <img src="https://img.shields.io/badge/Grok%20Build-skills%20%2B%20rules-111827" alt="Grok Build skills and project rules" />
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license" />
 </p>
@@ -105,7 +105,7 @@ npx --yes litgrok-ai@latest install
 Pin a version when you need a reproducible install:
 
 ```bash
-npx --yes litgrok-ai@0.2.6 install
+npx --yes litgrok-ai@0.2.8 install
 ```
 
 Preview without writing files:
@@ -120,7 +120,7 @@ Default install writes the whole payload into the current project's `.grok/` tre
 npx --yes litgrok-ai@latest install --user
 ```
 
-`--user` targets `~/.grok/skills`, `~/.grok/rules`, and `~/.grok/hooks`. Dry-run, `NO_COLOR`, and non-interactive runs do not mutate files. Reinstall is idempotent for byte-identical payload files. A different file occupying any packaged path refuses the whole install rather than being overwritten.
+`--user` targets `~/.grok/skills`, `~/.grok/rules`, and `~/.grok/hooks`. Dry-run, `NO_COLOR`, and non-interactive runs do not mutate files. The installer records SHA-256 ownership in `.grok/.litgrok-install-manifest.json`: byte-identical files stay untouched, and files matching a previously recorded payload hash may be replaced during an upgrade. A user-modified or otherwise unrecognized file refuses the whole install rather than being overwritten. A pristine pre-manifest 0.2.5 payload is recognized through the bundled migration snapshot while no manifest exists and receives a new manifest after the upgrade.
 
 ### Install output
 
@@ -146,7 +146,7 @@ npx --yes litgrok-ai@latest uninstall
 npx --yes litgrok-ai@latest uninstall --user
 ```
 
-If any installed payload file was changed, uninstall refuses the whole removal. Reinstall by running the matching `install` command again; byte-identical files are left untouched.
+If any installed payload file was changed, uninstall refuses the whole removal. Files recorded as installer-owned are removed too, and the ownership manifest is removed only after the payload removal succeeds. Reinstall by running the matching `install` command again; byte-identical files are left untouched.
 
 ## First use
 
@@ -198,12 +198,12 @@ Review is proposal-only. `autoApply` is always false, transcript text is inert d
 From an installed project, use the package CLI directly when you want a replayable foreground command:
 
 ```bash
-npx --yes litgrok-ai@0.2.6 skill-loop review <session-id>
-npx --yes litgrok-ai@0.2.6 skill-loop list
-npx --yes litgrok-ai@0.2.6 skill-loop apply <proposal-id>
-npx --yes litgrok-ai@0.2.6 skill-loop reject <proposal-id>
-npx --yes litgrok-ai@0.2.6 skill-loop rollback <ledger-id>
-npx --yes litgrok-ai@0.2.6 skill-loop curator
+npx --yes litgrok-ai@0.2.8 skill-loop review <session-id>
+npx --yes litgrok-ai@0.2.8 skill-loop list
+npx --yes litgrok-ai@0.2.8 skill-loop apply <proposal-id>
+npx --yes litgrok-ai@0.2.8 skill-loop reject <proposal-id>
+npx --yes litgrok-ai@0.2.8 skill-loop rollback <ledger-id>
+npx --yes litgrok-ai@0.2.8 skill-loop curator
 ```
 
 `apply` prints the ledger id needed for rollback. The deterministic curator is also user-invoked: by default it runs at most once every seven days, requires at least two idle hours, marks eligible unpinned agent-owned skills stale after 30 idle days, and archives them outside discovery after 90 idle days. It makes a full backup before a transition and never deletes a skill package; `--force` bypasses only the seven-day run interval for an explicit test or maintenance invocation.

package/README_ko-KR.md

@@ -22,7 +22,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litgrok--ai-cb3837" alt="npm: litgrok-ai" />
-  <img src="https://img.shields.io/badge/version-0.2.6-2ea44f" alt="version 0.2.6" />
+  <img src="https://img.shields.io/badge/version-0.2.8-2ea44f" alt="version 0.2.8" />
   <img src="https://img.shields.io/badge/Grok%20Build-skills%20%2B%20rules-111827" alt="Grok Build skills and project rules" />
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license" />
 </p>
@@ -105,7 +105,7 @@ npx --yes litgrok-ai@latest install
 재현 가능한 설치는 버전을 고정합니다.
 
 ```bash
-npx --yes litgrok-ai@0.2.6 install
+npx --yes litgrok-ai@0.2.8 install
 ```
 
 파일을 쓰지 않고 미리보기:
@@ -120,7 +120,7 @@ npx --yes litgrok-ai@latest install --dry-run
 npx --yes litgrok-ai@latest install --user
 ```
 
-`--user`는 `~/.grok/skills`, `~/.grok/rules`, `~/.grok/hooks`를 대상으로 합니다. dry-run, `NO_COLOR`, non-interactive는 파일을 바꾸지 않습니다. byte가 같은 payload 재설치는 멱등입니다. package path 하나라도 다른 파일이 차지하면 전체 설치를 거절하고 덮어쓰지 않습니다.
+`--user`는 `~/.grok/skills`, `~/.grok/rules`, `~/.grok/hooks`를 대상으로 합니다. dry-run, `NO_COLOR`, non-interactive는 파일을 바꾸지 않습니다. installer는 `.grok/.litgrok-install-manifest.json`에 SHA-256 소유권을 기록합니다. byte가 같은 파일은 다시 쓰지 않고, 이전 payload hash와 일치하는 installer 소유 파일은 업그레이드에서 교체할 수 있습니다. 사용자가 바꿨거나 소유권을 확인할 수 없는 파일이 있으면 전체 설치를 거절하고 덮어쓰지 않습니다. manifest가 없을 때 0.2.5의 pristine payload는 내장 migration snapshot으로 인식하며 업그레이드 뒤 새 manifest를 기록합니다.
 
 ### 설치 출력
 
@@ -146,7 +146,7 @@ npx --yes litgrok-ai@latest uninstall
 npx --yes litgrok-ai@latest uninstall --user
 ```
 
-설치된 payload 파일 하나라도 바뀌었다면 uninstall은 전체 삭제를 거절합니다. 재설치는 같은 `install` 명령을 다시 실행합니다. byte가 같은 파일은 다시 쓰지 않습니다.
+설치된 payload 파일 하나라도 바뀌었다면 uninstall은 전체 삭제를 거절합니다. installer 소유로 기록된 파일도 삭제하며, payload 삭제가 성공한 뒤에만 ownership manifest를 삭제합니다. 재설치는 같은 `install` 명령을 다시 실행합니다. byte가 같은 파일은 다시 쓰지 않습니다.
 
 ## 처음 사용하기
 
@@ -198,12 +198,12 @@ Review는 proposal만 만듭니다. `autoApply`는 항상 false이고 transcript
 설치된 project에서는 다음 package CLI를 foreground command로 실행할 수 있습니다.
 
 ```bash
-npx --yes litgrok-ai@0.2.6 skill-loop review <session-id>
-npx --yes litgrok-ai@0.2.6 skill-loop list
-npx --yes litgrok-ai@0.2.6 skill-loop apply <proposal-id>
-npx --yes litgrok-ai@0.2.6 skill-loop reject <proposal-id>
-npx --yes litgrok-ai@0.2.6 skill-loop rollback <ledger-id>
-npx --yes litgrok-ai@0.2.6 skill-loop curator
+npx --yes litgrok-ai@0.2.8 skill-loop review <session-id>
+npx --yes litgrok-ai@0.2.8 skill-loop list
+npx --yes litgrok-ai@0.2.8 skill-loop apply <proposal-id>
+npx --yes litgrok-ai@0.2.8 skill-loop reject <proposal-id>
+npx --yes litgrok-ai@0.2.8 skill-loop rollback <ledger-id>
+npx --yes litgrok-ai@0.2.8 skill-loop curator
 ```
 
 `apply`는 rollback에 필요한 ledger id를 출력합니다. Deterministic curator도 user-invoked입니다. 기본적으로 7일에 한 번만 실행되고, 마지막 activity 뒤 최소 2시간이 지나야 하며, pin되지 않은 agent-owned skill을 30일 idle 뒤 stale로 표시하고 90일 idle 뒤 discovery 밖으로 archive합니다. Transition 전에는 전체 backup을 만들고 skill package를 삭제하지 않습니다. `--force`는 명시적인 test 또는 maintenance 실행에서 7일 interval만 건너뜁니다.

package/bin/litgrok.mjs

@@ -1,12 +1,50 @@
 #!/usr/bin/env node
 
-import { constants, copyFileSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, unlinkSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, copyFileSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join, relative, resolve, sep } from 'node:path';
+import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const PAYLOAD_ROOT = join(PACKAGE_ROOT, '.grok');
+const INSTALL_MANIFEST_NAME = '.litgrok-install-manifest.json';
+const INSTALL_MANIFEST_SCHEMA = 'litgrok.install-manifest/v1';
+const PACKAGE_NAME = 'litgrok-ai';
+
+// 0.2.5 was the last release before ownership manifests existed. These are the
+// payload hashes changed since that release, so a pristine 0.2.5 install can
+// migrate while no manifest exists without treating package-owned files as conflicts.
+const PRE_MANIFEST_PAYLOAD_HASHES = Object.freeze({
+  'skills/autoconference/references/_canonical-corpus/manifest.json': '4554ee4041b73577a844abc27a97db91e941b8412f1888209203251dc1fee500',
+  'skills/autoconference/scripts/init_conference.py': 'cb83623c1338b7e3a5be7a7beac7a17b8ae362fc24fbc01d1caff634db290dfc',
+  'skills/autoconference/scripts/verify-canonical-corpus.mjs': '4a4afb7dc0b58519a4c521c987cb8998495afc09b89fb87cafb0f1db0047c28d',
+  'skills/autoresearch/references/_canonical-corpus/manifest.json': '9667f852081d4877c579d14e63c0759ebbe863e4170a9c3d5e6487cdb1f0c323',
+  'skills/autoresearch/scripts/init_research.py': 'a5434711928eb4d0487d933df5e1b374f8553140004c6ab8e38fe577ae074d05',
+  'skills/autoresearch/scripts/verify-canonical-corpus.mjs': '80a85ed4ba0c168bd7f7abef5754c4089a629975a827b6ddb3f01cd813602274',
+  'skills/lit-scientific-visualization/SKILL.md': 'ffc3b2ea49dd7e7c4c7d4568f289df294a3a30f953c11039f98aaf6f8fb983ee',
+  'skills/lit-scientific-visualization/references/_canonical-corpus/manifest.json': '9cafbdc5e1259aea053a5bf637e18d034f8e169be74b2c5732fc5bfd30f7c5bd',
+  'skills/lit-scientific-visualization/scripts/verify-canonical-corpus.mjs': 'a1cfe0578195098dc4afc2d25f0d391f38aeaa57cd3970fa7dca51e20cbf929d',
+  'skills/skill-observer/scripts/skill-loop.mjs': '3f3f5265928c0d71175b0f23f71b836d1dc05e7efba407bfdc2d263c6aaed0ce',
+});
+const PRE_MANIFEST_LEGACY_PAYLOAD_HASHES = Object.freeze({
+  'skills/lit-scientific-visualization/assets/color_palettes.py': 'ffea28da930406ecb11bbeaebfc530dfac40b772827a7653f449cb3b0bb35309',
+  'skills/lit-scientific-visualization/assets/nature.mplstyle': '6a7343788bf772b7e1bc813d094f7bafa97c1e5544586e7b76002ad8547229b6',
+  'skills/lit-scientific-visualization/assets/presentation.mplstyle': 'e3ee23f0470d7fb07a0be75cd1210e231becfc2f5267aa404e4186aa077a3339',
+  'skills/lit-scientific-visualization/assets/publication.mplstyle': '18447af3bc47310d23fc27255413c23d8bbe3ff441463cc54fcecdfacd205bea',
+  'skills/lit-scientific-visualization/evals/evals.json': '366dc61b6e042f08f28bf33f2534feea80219d771b84497ec7094b30263e935b',
+  'skills/lit-scientific-visualization/references/_canonical-corpus/manifest.json': '9cafbdc5e1259aea053a5bf637e18d034f8e169be74b2c5732fc5bfd30f7c5bd',
+  'skills/lit-scientific-visualization/references/color_palettes.md': '0298691c8de8379570488a7b7768663971bc20af1fb05d464c5438d43a21dcfa',
+  'skills/lit-scientific-visualization/references/journal_requirements.md': '56fdde590a9d778547dbcb609b77d86f1f31865e803bcecca5d8c4c72b91b3c7',
+  'skills/lit-scientific-visualization/references/matplotlib_examples.md': 'c99cd4f83e2452773e9580e2fa0984e61433c7a9b57ca0d2562dc400dfe4f83d',
+  'skills/lit-scientific-visualization/references/mdanalysis_martini_visualization.md': 'abcb3c61f1c3984ba9014d9ae197b726d23c1df844dc90988ecc4d8f0e349bfe',
+  'skills/lit-scientific-visualization/references/publication_guidelines.md': 'd9f5d0f115872c4c190a11d83432d44635e38ef9f1740db471fcc70f4c91dd2c',
+  'skills/lit-scientific-visualization/references/seaborn_for_publications.md': '2da2147ae8974b4b5d16096c1484b982d5d1e5f91113808ebfd12111a0a6597a',
+  'skills/lit-scientific-visualization/scripts/figure_export.py': 'b22c7708afaf2a1cfa4f821eb9230d4262f1d52948af7f0815855aa9d0960403',
+  'skills/lit-scientific-visualization/scripts/style_presets.py': 'e9d450bd4ab6b11303b02d5029177c8d49466cc597648d12de0ecdb7620f64c4',
+  'skills/lit-scientific-visualization/tests/test_figure_export.py': 'b18414369e6721ad93d417914114d71af006248675eb20bb1f4989c48ec9a58e',
+  'skills/lit-scientific-visualization/tests/test_style_presets.py': 'ff0e190196480848f1fea2398220038771f386ee7967a0ef122b0dfbca3aed46',
+});
 const USAGE = 'Usage: litgrok [install|uninstall] [--user|--project] [--dry-run] [--no-color] [--yes]\n       litgrok skill-loop <review|propose|list|apply|reject|rollback|curator> ...\n';
 const BRAILLE_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
 const SPINNER_INTERVAL_MS = 80;
@@ -235,17 +273,196 @@ function reportFailure(error, { stderr, stdout, options, root, colors, step }) {
   stdout.write(failureCard(options, root, colors, error?.step ?? step, errorText(error)));
 }
 
-function targetState(source, target) {
+function normalizedRelativePath(relativePath) {
+  return relativePath.split(sep).join('/');
+}
+
+function sha256File(filePath) {
+  return createHash('sha256').update(readFileSync(filePath)).digest('hex');
+}
+
+function ownershipManifestFailure(reason) {
+  const message = `Refusing to use ${INSTALL_MANIFEST_NAME}: ${reason}`;
+  const error = new Error(message);
+  error.step = 'OWNERSHIP';
+  error.stderrLines = [message];
+  return error;
+}
+
+function ownershipManifestPath(root) {
+  return join(root, INSTALL_MANIFEST_NAME);
+}
+
+function readOwnershipManifest(root) {
+  const target = ownershipManifestPath(root);
+  let stat;
+  try {
+    stat = lstatSync(target);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+  if (stat.isSymbolicLink() || !stat.isFile()) throw ownershipManifestFailure('path is not a regular file');
+
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(target, 'utf8'));
+  } catch {
+    throw ownershipManifestFailure('file is not valid JSON');
+  }
+  if (
+    !parsed ||
+    parsed.schema !== INSTALL_MANIFEST_SCHEMA ||
+    parsed.package !== PACKAGE_NAME ||
+    typeof parsed.version !== 'string' ||
+    parsed.version.length === 0 ||
+    !parsed.files ||
+    Array.isArray(parsed.files) ||
+    typeof parsed.files !== 'object'
+  ) {
+    throw ownershipManifestFailure('schema is invalid');
+  }
+
+  const hashes = new Map();
+  for (const [relativePath, hash] of Object.entries(parsed.files)) {
+    const segments = relativePath.split('/');
+    if (
+      relativePath.length === 0 ||
+      relativePath.startsWith('/') ||
+      relativePath.includes('\\') ||
+      segments.some((segment) => segment.length === 0 || segment === '.' || segment === '..')
+    ) {
+      throw ownershipManifestFailure(`path is invalid: ${relativePath}`);
+    }
+    if (typeof hash !== 'string' || !/^[0-9a-f]{64}$/u.test(hash)) {
+      throw ownershipManifestFailure(`hash is invalid: ${relativePath}`);
+    }
+    hashes.set(relativePath, hash);
+  }
+  return { path: target, hashes };
+}
+
+function targetState(source, target, relativePath, manifest) {
   try {
     const targetStat = lstatSync(target);
     if (!targetStat.isFile()) return 'conflict';
-    return readFileSync(source).equals(readFileSync(target)) ? 'current' : 'conflict';
+    const targetHash = sha256File(target);
+    if (targetHash === sha256File(source)) return 'current';
+    const previousHash = manifest?.hashes.get(normalizedRelativePath(relativePath)) ??
+      (manifest === null ? PRE_MANIFEST_PAYLOAD_HASHES[normalizedRelativePath(relativePath)] : undefined);
+    return targetHash === previousHash ? 'owned' : 'conflict';
   } catch (error) {
     if (error?.code === 'ENOENT') return 'missing';
     throw error;
   }
 }
 
+function legacyTargetState(root, relativePath, expectedHash) {
+  const target = join(root, relativePath);
+  let ancestor = dirname(target);
+  while (ancestor !== root) {
+    try {
+      const ancestorStat = lstatSync(ancestor);
+      if (ancestorStat.isSymbolicLink() || !ancestorStat.isDirectory()) return 'conflict';
+    } catch (error) {
+      if (error?.code === 'ENOENT') break;
+      throw error;
+    }
+    ancestor = dirname(ancestor);
+  }
+
+  try {
+    const targetStat = lstatSync(target);
+    if (!targetStat.isFile()) return 'conflict';
+    return sha256File(target) === expectedHash ? 'owned' : 'conflict';
+  } catch (error) {
+    if (error?.code === 'ENOENT') return 'missing';
+    throw error;
+  }
+}
+
+function removeLegacyFiles(entries) {
+  let removed = 0;
+  for (const entry of entries) {
+    const state = legacyTargetState(entry.root, entry.relativePath, entry.expectedHash);
+    if (state === 'missing') continue;
+    if (state !== 'owned') throw new Error(`Refusing to remove different existing file: ${entry.target}`);
+    unlinkSync(entry.target);
+    removed += 1;
+  }
+  return removed;
+}
+
+function manifestContent(files) {
+  const hashes = Object.fromEntries(
+    files
+      .map(({ relativePath, source }) => [normalizedRelativePath(relativePath), sha256File(source)])
+      .sort(([left], [right]) => left.localeCompare(right)),
+  );
+  return `${JSON.stringify({
+    schema: INSTALL_MANIFEST_SCHEMA,
+    package: PACKAGE_NAME,
+    version: packageVersion(),
+    files: hashes,
+  }, null, 2)}\n`;
+}
+
+function writeOwnershipManifest(root, files, previousManifest) {
+  const target = ownershipManifestPath(root);
+  const content = manifestContent(files);
+  let existing;
+  try {
+    const stat = lstatSync(target);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw ownershipManifestFailure('path is not a regular file');
+    existing = readFileSync(target, 'utf8');
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+  if (existing === content) return false;
+  if (previousManifest === null && existing !== undefined) {
+    throw ownershipManifestFailure('path appeared during installation');
+  }
+
+  const temporary = join(root, `.${basename(target)}.${randomUUID()}.tmp`);
+  try {
+    writeFileSync(temporary, content, { flag: 'wx', mode: 0o600 });
+    renameSync(temporary, target);
+  } finally {
+    try {
+      unlinkSync(temporary);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
+  return true;
+}
+
+function replaceOwnedFile(source, target) {
+  const temporary = join(dirname(target), `.${basename(target)}.${randomUUID()}.tmp`);
+  try {
+    copyFileSync(source, temporary, constants.COPYFILE_EXCL);
+    renameSync(temporary, target);
+  } finally {
+    try {
+      unlinkSync(temporary);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+function removeOwnershipManifest(root, previousManifest) {
+  if (previousManifest === null) return;
+  const target = ownershipManifestPath(root);
+  try {
+    const stat = lstatSync(target);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw ownershipManifestFailure('path is not a regular file');
+    unlinkSync(target);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+}
+
 function discoverPayloadFiles(root = PAYLOAD_ROOT) {
   const files = [];
 
@@ -383,25 +600,50 @@ export async function run(args, context = {}) {
 
     step = 'OWNERSHIP';
     const states = runStep(progress, 'OWNERSHIP', () => {
-      const owned = files.map(({ source, target }) => targetState(source, target));
+      const manifest = readOwnershipManifest(root);
+      const owned = files.map(({ relativePath, source, target }) => targetState(source, target, relativePath, manifest));
+      const legacyEntries = manifest === null
+        ? Object.entries(PRE_MANIFEST_LEGACY_PAYLOAD_HASHES).map(([relativePath, expectedHash]) => ({
+          root,
+          relativePath,
+          expectedHash,
+          target: join(root, relativePath),
+        }))
+        : [];
+      const legacyStates = legacyEntries.map(({ relativePath, expectedHash }) => legacyTargetState(root, relativePath, expectedHash));
       const counts = {
         missing: owned.filter((state) => state === 'missing').length,
         current: owned.filter((state) => state === 'current').length,
+        owned: owned.filter((state) => state === 'owned').length,
         conflicts: owned.filter((state) => state === 'conflict').length,
       };
-      if (counts.conflicts > 0) {
+      const legacyCounts = {
+        missing: legacyStates.filter((state) => state === 'missing').length,
+        owned: legacyStates.filter((state) => state === 'owned').length,
+        conflicts: legacyStates.filter((state) => state === 'conflict').length,
+      };
+      if (counts.conflicts > 0 || legacyCounts.conflicts > 0) {
         const stderrLines = [];
         for (let index = 0; index < files.length; index += 1) {
           if (owned[index] === 'conflict') stderrLines.push(`Refusing to ${options.command === 'install' ? 'overwrite' : 'remove'} different existing file: ${files[index].target}`);
         }
-        const error = new Error(`${counts.missing} missing · ${counts.current} already-current · ${counts.conflicts} conflicts`);
+        for (let index = 0; index < legacyEntries.length; index += 1) {
+          if (legacyStates[index] === 'conflict') stderrLines.push(`Refusing to ${options.command === 'install' ? 'overwrite' : 'remove'} different existing file: ${legacyEntries[index].target}`);
+        }
+        const legacyDetail = legacyEntries.length === 0
+          ? ''
+          : ` · ${legacyCounts.missing} legacy missing · ${legacyCounts.owned} legacy owned · ${legacyCounts.conflicts} legacy conflicts`;
+        const error = new Error(`${counts.missing} missing · ${counts.current} already-current · ${counts.owned} owned · ${counts.conflicts} conflicts${legacyDetail}`);
         error.step = 'OWNERSHIP';
         error.stderrLines = stderrLines;
         throw error;
       }
+      const legacyDetail = legacyEntries.length === 0
+        ? ''
+        : ` · ${legacyCounts.missing} legacy missing · ${legacyCounts.owned} legacy owned · ${legacyCounts.conflicts} legacy conflicts`;
       return {
-        value: { states: owned, counts },
-        detail: `${counts.missing} missing · ${counts.current} already-current · ${counts.conflicts} conflicts`,
+        value: { states: owned, counts, manifest, legacyEntries, legacyStates, legacyCounts },
+        detail: `${counts.missing} missing · ${counts.current} already-current · ${counts.owned} owned · ${counts.conflicts} conflicts${legacyDetail}`,
       };
     });
 
@@ -410,19 +652,33 @@ export async function run(args, context = {}) {
       const writeStarted = process.hrtime.bigint();
       progress.start('WRITE');
       let removed = 0;
-      for (let index = 0; index < files.length; index += 1) {
-        if (states.states[index] !== 'current') continue;
-        unlinkSync(files[index].target);
-        removed += 1;
+      try {
+        for (let index = 0; index < files.length; index += 1) {
+          if (!['current', 'owned'].includes(states.states[index])) continue;
+          unlinkSync(files[index].target);
+          removed += 1;
+        }
+        removed += removeLegacyFiles(states.legacyEntries);
+        removeOwnershipManifest(root, states.manifest);
+        progress.finish('ok', 'WRITE', `${removed} removed · ${states.counts.missing} already absent`, elapsedSince(writeStarted));
+      } catch (error) {
+        progress.finish('failed', 'WRITE', errorText(error), elapsedSince(writeStarted));
+        if (error && typeof error === 'object') error.step = 'WRITE';
+        throw error;
       }
-      progress.finish('ok', 'WRITE', `${removed} removed · ${states.counts.missing} already absent`, elapsedSince(writeStarted));
       const receipt = receiptCard(options, displayRoot, colors, { status: 'Removed', written: 0, current: states.counts.current });
       progress.close();
       stdout.write(receipt);
       return 0;
     }
 
-    if (states.states.every((state) => state === 'current')) {
+    if (states.states.every((state) => state === 'current') && states.legacyStates.every((state) => state === 'missing')) {
+      try {
+        writeOwnershipManifest(root, files, states.manifest);
+      } catch (error) {
+        if (error && typeof error === 'object') error.step = 'WRITE';
+        throw error;
+      }
       skipStep(progress, 'WRITE', `SKIPPED · 0 written · ${states.counts.current} already-current`);
       const receipt = receiptCard(options, displayRoot, colors, { status: 'Already current', written: 0, current: states.counts.current });
       progress.close();
@@ -438,10 +694,14 @@ export async function run(args, context = {}) {
         if (states.states[index] === 'current') continue;
         const { source, target } = files[index];
         mkdirSync(dirname(target), { recursive: true });
-        copyFileSync(source, target, constants.COPYFILE_EXCL);
+        if (states.states[index] === 'owned') replaceOwnedFile(source, target);
+        else copyFileSync(source, target, constants.COPYFILE_EXCL);
         installed += 1;
       }
-      progress.finish('ok', 'WRITE', `${installed} written · ${states.counts.current} already-current`, elapsedSince(writeStarted));
+      const removedLegacy = removeLegacyFiles(states.legacyEntries);
+      writeOwnershipManifest(root, files, states.manifest);
+      const legacyDetail = removedLegacy === 0 ? '' : ` · ${removedLegacy} legacy removed`;
+      progress.finish('ok', 'WRITE', `${installed} written · ${states.counts.current} already-current · ${states.counts.owned} owned${legacyDetail}`, elapsedSince(writeStarted));
     } catch (error) {
       progress.finish('failed', 'WRITE', errorText(error), elapsedSince(writeStarted));
       if (error && typeof error === 'object') error.step = 'WRITE';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litgrok-ai",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "Grok Build skills, project rules, and hooks installer.",
   "type": "module",
   "bin": {
@@ -14,6 +14,7 @@
   "files": [
     "plugin.json",
     ".grok/skills",
+    ".grok/vendor",
     ".grok/agents",
     ".grok/rules",
     ".grok/hooks",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "litgrok",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "Grok Build skills, project rules, and bounded lifecycle hooks for evidence-first lit work.",
   "author": {
     "name": "LitGrok contributors"