nubos-pilot 1.2.1 → 1.2.3

package/lib/memory.cjs

@@ -4,6 +4,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { atomicWriteFileSync, appendJsonl, withFileLockAsync, NubosPilotError, projectStateDir } = require('./core.cjs');
+const { validate } = require('./validate.cjs');
 
 let _memLog;
 function _log() {
@@ -15,6 +16,19 @@ const TYPE_ENUM = new Set(['learning', 'handoff', 'critic', 'research']);
 const PROVENANCE_ENUM = new Set(['VERIFIED', 'CITED', 'ASSUMED', 'CACHED']);
 const SCHEMA_VERSION = 1;
 
+const RECORD_SCHEMA = 'memory-record.v1';
+const MANIFEST_SCHEMA = 'memory-manifest.v1';
+
+const _RECORD_CODE_BY_FIELD = Object.freeze({
+  type: 'memory-invalid-type',
+  title: 'memory-missing-title',
+  body: 'memory-missing-body',
+  tags: 'memory-invalid-tags',
+  provenance: 'memory-invalid-provenance',
+  id: 'memory-invalid-id',
+  phase: 'memory-invalid-phase',
+});
+
 function _memoryRoot(cwd) {
   return path.join(projectStateDir(cwd || process.cwd()), 'memory');
 }
@@ -24,38 +38,14 @@ function _indexPath(cwd) { return path.join(_memoryRoot(cwd), 'index.usearch');
 function _manifestPath(cwd) { return path.join(_memoryRoot(cwd), 'manifest.json'); }
 
 function _validateRecord(record) {
-  if (!record || typeof record !== 'object') {
+  if (!record || typeof record !== 'object' || Array.isArray(record)) {
     throw new NubosPilotError('memory-invalid-record', 'record must be object', {});
   }
-  if (typeof record.type !== 'string' || !TYPE_ENUM.has(record.type)) {
-    throw new NubosPilotError(
-      'memory-invalid-type',
-      `type must be one of [${[...TYPE_ENUM].join(', ')}]`,
-      { type: record.type },
-    );
-  }
-  if (typeof record.title !== 'string' || record.title.length === 0) {
-    throw new NubosPilotError('memory-missing-title', 'title required as non-empty string', {});
-  }
-  if (typeof record.body !== 'string') {
-    throw new NubosPilotError('memory-missing-body', 'body required as string', { type: typeof record.body });
-  }
-  if (record.tags !== undefined && record.tags !== null && !Array.isArray(record.tags)) {
-    throw new NubosPilotError('memory-invalid-tags', 'tags must be array of strings or null', {});
-  }
-  if (record.provenance !== undefined && record.provenance !== null && !PROVENANCE_ENUM.has(record.provenance)) {
-    throw new NubosPilotError(
-      'memory-invalid-provenance',
-      `provenance must be one of [${[...PROVENANCE_ENUM].join(', ')}]`,
-      { provenance: record.provenance },
-    );
-  }
-  if (record.id !== undefined && record.id !== null && typeof record.id !== 'string') {
-    throw new NubosPilotError('memory-invalid-id', 'id must be string or null', { id: record.id });
-  }
-  if (record.phase !== undefined && record.phase !== null && typeof record.phase !== 'string') {
-    throw new NubosPilotError('memory-invalid-phase', 'phase must be string or null', { phase: record.phase });
-  }
+  const errors = validate(record, RECORD_SCHEMA);
+  if (errors.length === 0) return;
+  const first = errors[0];
+  const code = _RECORD_CODE_BY_FIELD[first.field] || 'memory-invalid-record';
+  throw new NubosPilotError(code, first.message, { field: first.field, value: record[first.field] });
 }
 
 function _readRecordsJsonlWithStats(cwd) {
@@ -66,8 +56,11 @@ function _readRecordsJsonlWithStats(cwd) {
   let skipped = 0;
   for (const line of raw.split('\n')) {
     if (!line.trim()) continue;
-    try { records.push(JSON.parse(line)); }
-    catch { skipped += 1; }
+    let rec;
+    try { rec = JSON.parse(line); }
+    catch { skipped += 1; continue; }
+    if (validate(rec, RECORD_SCHEMA).length > 0) { skipped += 1; continue; }
+    records.push(rec);
   }
   if (skipped > 0) {
     _log().warn('skipped corrupt records.jsonl lines', {
@@ -92,7 +85,19 @@ function _writeManifest(cwd, manifest) {
 function _readManifest(cwd) {
   const p = _manifestPath(cwd);
   if (!fs.existsSync(p)) return null;
-  try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; }
+  let obj;
+  try { obj = JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; }
+  const errors = validate(obj, MANIFEST_SCHEMA);
+  if (errors.length > 0) {
+    _log().warn('ignoring corrupt memory manifest', {
+      event: 'memory-manifest-corrupt',
+      file: 'manifest.json',
+      violation: errors[0].message,
+      hint: 'manifest will be rewritten on next index/rebuild; run `memory-rebuild` if model/dim changed',
+    });
+    return null;
+  }
+  return obj;
 }
 
 function _embeddingText(record) {

package/lib/messaging.cjs

@@ -4,6 +4,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { atomicWriteFileSync, atomicCreateExclusiveSync, fsyncDir, appendJsonl, withFileLock, NubosPilotError, projectStateDir } = require('./core.cjs');
+const { validate, assertValid } = require('./validate.cjs');
 
 function _runId() {
   try { return require('./run-context.cjs').getRunId(); }
@@ -13,6 +14,8 @@ function _runId() {
 const KIND_ENUM = new Set(['request', 'response', 'notify']);
 const AGENT_RE = /^[a-zA-Z0-9_-]+$/;
 const ID_RE = /^\d+-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const MAX_BODY_BYTES = 256 * 1024;
+const MESSAGE_SCHEMA = 'message.v1';
 
 function _messagesRoot(cwd) {
   return path.join(projectStateDir(cwd || process.cwd()), 'messages');
@@ -81,11 +84,11 @@ function _appendManifest(cwd, event) {
 function _readMessageFile(filePath) {
   let raw;
   try { raw = fs.readFileSync(filePath, 'utf-8'); } catch { return null; }
-  try {
-    const parsed = JSON.parse(raw);
-    Object.defineProperty(parsed, '__path', { value: filePath, enumerable: false });
-    return parsed;
-  } catch { return null; }
+  let parsed;
+  try { parsed = JSON.parse(raw); } catch { return null; }
+  if (validate(parsed, MESSAGE_SCHEMA).length > 0) return null;
+  Object.defineProperty(parsed, '__path', { value: filePath, enumerable: false });
+  return parsed;
 }
 
 function _scanDir(dir) {
@@ -118,7 +121,6 @@ function send(opts, cwd) {
   if (typeof o.body !== 'string') {
     throw new NubosPilotError('messages-missing-body', 'body required (string, may be empty)', {});
   }
-  const MAX_BODY_BYTES = 256 * 1024;
   if (Buffer.byteLength(o.body, 'utf-8') > MAX_BODY_BYTES) {
     throw new NubosPilotError(
       'messages-body-too-large',
@@ -157,6 +159,7 @@ function send(opts, cwd) {
     in_reply_to: o.in_reply_to || null,
     created_at: createdAt,
   };
+  assertValid(message, MESSAGE_SCHEMA, 'messages-invalid-record', { id });
 
   const workingDir = cwd || process.cwd();
   const dir = _inboxDir(workingDir, o.to);
@@ -472,4 +475,7 @@ module.exports = {
   pendingReplies,
   sweepTaskOnCommit,
   KIND_ENUM,
+  AGENT_RE,
+  ID_RE,
+  MAX_BODY_BYTES,
 };

package/lib/metrics-aggregate.cjs

@@ -5,6 +5,9 @@ const path = require('node:path');
 const readline = require('node:readline');
 const { NubosPilotError, findProjectRoot } = require('./core.cjs');
 const { SAFE_PHASE_RE } = require('./metrics.cjs');
+const { validate } = require('./validate.cjs');
+
+const RECORD_SCHEMA = 'metrics-record.v1';
 
 let _maLog;
 function _log() {
@@ -41,15 +44,24 @@ function _readJsonlLines(filePath, onRecord) {
     rl.on('line', (raw) => {
       const line = String(raw).trim();
       if (!line) return;
+      let rec;
       try {
-        const rec = JSON.parse(line);
-        onRecord(rec);
+        rec = JSON.parse(line);
       } catch (_err) {
         _log().warn('skipping malformed JSONL line', {
           event: 'metrics-aggregate-malformed-line',
           file: require('node:path').basename(filePath),
         });
+        return;
+      }
+      if (validate(rec, RECORD_SCHEMA).length > 0) {
+        _log().warn('skipping schema-invalid JSONL line', {
+          event: 'metrics-aggregate-invalid-line',
+          file: require('node:path').basename(filePath),
+        });
+        return;
       }
+      onRecord(rec);
     });
     rl.on('close', () => resolve());
     rl.on('error', (err) => reject(err));

package/lib/migrate.cjs

@@ -0,0 +1,29 @@
+'use strict';
+
+const { assertValid } = require('./validate.cjs');
+
+const MAX_HOPS = 100;
+
+function runMigrators(obj, opts) {
+  const o = opts || {};
+  const versionField = o.versionField || 'version';
+  const target = o.targetVersion;
+  const migrators = o.migrators || {};
+  let cur = obj;
+  let hops = 0;
+  while (cur && typeof cur === 'object' && !Array.isArray(cur) && cur[versionField] !== target) {
+    if (hops >= MAX_HOPS) return null;
+    hops += 1;
+    const key = cur[versionField];
+    if (!Object.prototype.hasOwnProperty.call(migrators, key)) return null;
+    const fn = migrators[key];
+    if (typeof fn !== 'function') return null;
+    cur = fn(cur);
+    if (!cur || typeof cur !== 'object' || Array.isArray(cur)) return null;
+  }
+  if (!cur || typeof cur !== 'object' || Array.isArray(cur)) return null;
+  if (o.schema) assertValid(cur, o.schema, o.code || 'data-migration-invalid', o.details || {});
+  return cur;
+}
+
+module.exports = { runMigrators, MAX_HOPS };

package/lib/migrate.test.cjs

@@ -0,0 +1,91 @@
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+
+const { runMigrators, MAX_HOPS } = require('./migrate.cjs');
+const { NubosPilotError } = require('./core.cjs');
+
+test('MIG-1: object already at target version is returned unchanged', () => {
+  const obj = { version: 2, payload: 'x' };
+  const out = runMigrators(obj, { targetVersion: 2, migrators: {} });
+  assert.equal(out, obj);
+});
+
+test('MIG-2: single hop runs the matching migrator', () => {
+  const out = runMigrators({ version: 1, n: 1 }, {
+    targetVersion: 2,
+    migrators: { 1: (v) => ({ version: 2, n: v.n + 1 }) },
+  });
+  assert.deepEqual(out, { version: 2, n: 2 });
+});
+
+test('MIG-3: multi-hop chain runs each hop until target', () => {
+  const out = runMigrators({ version: 0, steps: [] }, {
+    targetVersion: 3,
+    migrators: {
+      0: (v) => ({ version: 1, steps: [...v.steps, 'a'] }),
+      1: (v) => ({ version: 2, steps: [...v.steps, 'b'] }),
+      2: (v) => ({ version: 3, steps: [...v.steps, 'c'] }),
+    },
+  });
+  assert.deepEqual(out.steps, ['a', 'b', 'c']);
+});
+
+test('MIG-4: missing migrator for a version returns null', () => {
+  const out = runMigrators({ version: 99 }, { targetVersion: 1, migrators: {} });
+  assert.equal(out, null);
+});
+
+test('MIG-5: migrator returning a non-object returns null', () => {
+  const out = runMigrators({ version: 0 }, { targetVersion: 1, migrators: { 0: () => null } });
+  assert.equal(out, null);
+});
+
+test('MIG-6: hop cap prevents an infinite migrator cycle', () => {
+  const out = runMigrators({ version: 0 }, {
+    targetVersion: 999,
+    migrators: { 0: () => ({ version: 0 }) },
+  });
+  assert.equal(out, null);
+});
+
+test('MIG-7: pure function — input object is not mutated', () => {
+  const input = { version: 0, n: 1 };
+  runMigrators(input, { targetVersion: 1, migrators: { 0: (v) => ({ version: 1, n: v.n + 1 }) } });
+  assert.deepEqual(input, { version: 0, n: 1 });
+});
+
+test('MIG-8: migrated shape is validated against the given schema', () => {
+  assert.throws(
+    () => runMigrators({ version: 0, learnings: [] }, {
+      targetVersion: 1,
+      migrators: { 0: () => ({ version: 1, learnings: [{ fingerprint: 'NOTHEX', occurrence: 1 }] }) },
+      schema: 'learnings.v1',
+      code: 'learnings-store-corrupt',
+      details: { path: '<test>' },
+    }),
+    (err) => err instanceof NubosPilotError && err.code === 'learnings-store-corrupt',
+  );
+});
+
+test('MIG-9: custom versionField is honoured', () => {
+  const out = runMigrators({ schema_version: 1, ok: true }, {
+    versionField: 'schema_version',
+    targetVersion: 1,
+    migrators: {},
+  });
+  assert.deepEqual(out, { schema_version: 1, ok: true });
+});
+
+test('MIG-10: MAX_HOPS is a finite positive cap', () => {
+  assert.ok(Number.isInteger(MAX_HOPS) && MAX_HOPS > 0);
+});
+
+test('MIG-11: a version matching an Object.prototype member returns null, not a raw throw', () => {
+  for (const poison of ['valueOf', 'hasOwnProperty', 'toString', 'constructor', '__proto__']) {
+    let out;
+    assert.doesNotThrow(() => { out = runMigrators({ version: poison }, { targetVersion: 1, migrators: {} }); });
+    assert.equal(out, null);
+  }
+});

package/lib/nubosloop-audit.cjs

@@ -88,6 +88,106 @@ function searchEvidenceForRound(taskId, round, cwd) {
   return evidence.filter((e) => e && (Number(e.round) || 1) === target);
 }
 
+// ── Skill-bar consultation evidence (additive; mirrors search-evidence) ──────
+// The orchestrator records the skills it injected for a task (`recordExpectedSkills`);
+// the executor stamps each skill it actually consulted (`recordSkillEvidence`, via
+// `skill-audit ack`). skillFindingsFromState turns an unmet expectation into a
+// `skill-bar-unconsulted` finding (ROUTE_TABLE → executor), round-stamped and
+// emitted at most once per round via `skill_routed_rounds` — same anti-re-route
+// guarantee as the Rule-9 path. The Rule-9 functions below are left untouched.
+
+function _normSkillName(s) {
+  const v = String(s || '').trim();
+  // A path like `.claude/skills/<skill>/SKILL.md` names the skill by its directory.
+  const dir = v.match(/([^/]+)\/SKILL\.md$/i);
+  if (dir) return dir[1];
+  // Otherwise a bare name (optionally with a stray .md): take the basename.
+  return v.replace(/^.*\//, '').replace(/\.md$/i, '');
+}
+
+function recordSkillEvidence(taskId, skill, cwd) {
+  if (!TASK_ID_RE.test(taskId)) return null;
+  const name = _normSkillName(skill);
+  if (!name) return null;
+  let stampedRound = 1;
+  checkpoint.mergeCheckpoint(
+    taskId,
+    (cur) => {
+      const prev = (cur && cur.nubosloop) || {};
+      stampedRound = Number(prev.round) || 1;
+      const evidence = Array.isArray(prev.skill_evidence) ? prev.skill_evidence.slice() : [];
+      evidence.push({ round: stampedRound, skill: name, recorded_at: new Date().toISOString() });
+      return { nubosloop: safeAssign({}, prev, { skill_evidence: evidence }) };
+    },
+    cwd,
+  );
+  return { task_id: taskId, round: stampedRound, skill: name };
+}
+
+function recordExpectedSkills(taskId, skills, cwd) {
+  if (!TASK_ID_RE.test(taskId)) return null;
+  const names = (Array.isArray(skills) ? skills : []).map(_normSkillName).filter(Boolean);
+  if (names.length === 0) return { task_id: taskId, expected: [] };
+  let stampedRound = 1;
+  checkpoint.mergeCheckpoint(
+    taskId,
+    (cur) => {
+      const prev = (cur && cur.nubosloop) || {};
+      stampedRound = Number(prev.round) || 1;
+      const expect = Array.isArray(prev.skill_expect) ? prev.skill_expect.slice() : [];
+      expect.push({ round: stampedRound, skills: names, recorded_at: new Date().toISOString() });
+      return { nubosloop: safeAssign({}, prev, { skill_expect: expect }) };
+    },
+    cwd,
+  );
+  return { task_id: taskId, round: stampedRound, expected: names };
+}
+
+function _collectForRound(listVal, round, key) {
+  const out = [];
+  if (!Array.isArray(listVal)) return out;
+  for (const e of listVal) {
+    if (!e || (Number(e.round) || 1) !== round) continue;
+    const v = e[key];
+    if (Array.isArray(v)) out.push(...v);
+    else if (v) out.push(v);
+  }
+  return out;
+}
+
+// Pure: derive skill-bar findings from a checkpoint's nubosloop sub-object.
+function skillFindingsFromState(prevNubosloop, round, taskId) {
+  const prev = prevNubosloop || {};
+  const t = Number(round);
+  if (!Number.isFinite(t) || t < 1) return [];
+  const routed = Array.isArray(prev.skill_routed_rounds) ? prev.skill_routed_rounds : [];
+  if (routed.includes(t)) return [];
+  const expected = Array.from(new Set(_collectForRound(prev.skill_expect, t, 'skills')));
+  if (expected.length === 0) return [];
+  const acked = new Set(_collectForRound(prev.skill_evidence, t, 'skill'));
+  const missing = expected.filter((s) => !acked.has(s));
+  if (missing.length === 0) return [];
+  return [{
+    category: 'skill-bar-unconsulted',
+    severity: 'fail',
+    file: '-',
+    line: null,
+    remediation: 'Spawn was given Nubos skills as the quality bar for this task but did not consult '
+      + (missing.length === 1 ? 'it' : 'them') + ': [' + missing.join(', ') + ']. For each, `Read` '
+      + '`.claude/skills/<skill>/SKILL.md`, satisfy its "Verification bar" in the diff, then stamp '
+      + '`node np-tools.cjs skill-audit ack --task ' + taskId + ' --skill <skill>` — before editing.',
+    raw: { missing_skills: missing, expected_skills: expected },
+  }];
+}
+
+function markSkillFindingsRoutedInArray(routedRounds, round) {
+  const t = Number(round);
+  const arr = Array.isArray(routedRounds) ? routedRounds.slice() : [];
+  if (!Number.isFinite(t) || t < 1 || arr.includes(t)) return arr;
+  arr.push(t);
+  return arr;
+}
+
 function auditToolUse(taskId, agent, toolUseLog, cwd) {
   if (!TASK_ID_RE.test(taskId)) {
     throw new NubosPilotError(
@@ -232,6 +332,10 @@ module.exports = {
   auditToolUse,
   recordSearchEvidence,
   searchEvidenceForRound,
+  recordSkillEvidence,
+  recordExpectedSkills,
+  skillFindingsFromState,
+  markSkillFindingsRoutedInArray,
   readToolUseAudit,
   auditFindingsForRound,
   auditFindingsFromAudits,

package/lib/nubosloop-skill-audit.test.cjs

@@ -0,0 +1,98 @@
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const loop = require('./nubosloop.cjs');
+const checkpoint = require('./checkpoint.cjs');
+
+function _mkRoot() {
+  const r = fs.mkdtempSync(path.join(os.tmpdir(), 'np-skill-audit-'));
+  fs.mkdirSync(path.join(r, '.nubos-pilot', 'checkpoints'), { recursive: true });
+  fs.writeFileSync(
+    path.join(r, '.nubos-pilot', 'STATE.md'),
+    '---\nschema_version: 2\ncurrent_phase: null\ncurrent_plan: null\ncurrent_task: null\n---\n',
+    'utf-8',
+  );
+  return r;
+}
+const TID = 'M001-S001-T0001';
+function _nubosloop(r) { return (checkpoint.readCheckpoint(TID, r) || {}).nubosloop || {}; }
+
+test('SA-1: expected-but-unacked skill → skill-bar-unconsulted finding', () => {
+  const r = _mkRoot();
+  try {
+    checkpoint.startTask({ id: TID }, r);
+    loop.recordExpectedSkills(TID, ['np-secure-code-review', 'np-api-design'], r);
+    loop.recordSkillEvidence(TID, 'np-api-design', r); // only one acked
+    const findings = loop.skillFindingsFromState(_nubosloop(r), 1, TID);
+    assert.equal(findings.length, 1);
+    assert.equal(findings[0].category, 'skill-bar-unconsulted');
+    assert.deepEqual(findings[0].raw.missing_skills, ['np-secure-code-review']);
+  } finally { fs.rmSync(r, { recursive: true, force: true }); }
+});
+
+test('SA-2: all expected skills acked → no finding', () => {
+  const r = _mkRoot();
+  try {
+    checkpoint.startTask({ id: TID }, r);
+    loop.recordExpectedSkills(TID, ['np-api-design'], r);
+    loop.recordSkillEvidence(TID, 'np-api-design', r);
+    assert.equal(loop.skillFindingsFromState(_nubosloop(r), 1, TID).length, 0);
+  } finally { fs.rmSync(r, { recursive: true, force: true }); }
+});
+
+test('SA-3: no expected skills → no finding (skill block was correctly omitted)', () => {
+  const r = _mkRoot();
+  try {
+    checkpoint.startTask({ id: TID }, r);
+    assert.equal(loop.skillFindingsFromState(_nubosloop(r), 1, TID).length, 0);
+  } finally { fs.rmSync(r, { recursive: true, force: true }); }
+});
+
+test('SA-4: ack tolerates a SKILL.md path, not just a bare name', () => {
+  const r = _mkRoot();
+  try {
+    checkpoint.startTask({ id: TID }, r);
+    loop.recordExpectedSkills(TID, ['np-encryption'], r);
+    loop.recordSkillEvidence(TID, '.claude/skills/np-encryption/SKILL.md', r);
+    assert.equal(loop.skillFindingsFromState(_nubosloop(r), 1, TID).length, 0);
+  } finally { fs.rmSync(r, { recursive: true, force: true }); }
+});
+
+test('SA-5: routed round is not re-emitted (anti-spurious-loop)', () => {
+  const r = _mkRoot();
+  try {
+    checkpoint.startTask({ id: TID }, r);
+    loop.recordExpectedSkills(TID, ['np-secure-code-review'], r);
+    assert.equal(loop.skillFindingsFromState(_nubosloop(r), 1, TID).length, 1);
+    // simulate the loop marking round 1 routed
+    checkpoint.mergeCheckpoint(TID, (cur) => {
+      const prev = (cur && cur.nubosloop) || {};
+      return { nubosloop: Object.assign({}, prev, { skill_routed_rounds: [1] }) };
+    }, r);
+    assert.equal(loop.skillFindingsFromState(_nubosloop(r), 1, TID).length, 0);
+  } finally { fs.rmSync(r, { recursive: true, force: true }); }
+});
+
+test('SA-6: a skill finding routes to executor, never stuck (ROUTE_TABLE wired)', () => {
+  const r = _mkRoot();
+  try {
+    checkpoint.startTask({ id: TID }, r);
+    loop.recordExpectedSkills(TID, ['np-secure-code-review'], r);
+    const findings = loop.skillFindingsFromState(_nubosloop(r), 1, TID);
+    const evalRes = loop.evaluateLoop({ round: 1 }, [], { maxRounds: 3, auditFindings: findings });
+    assert.equal(evalRes.next_action, 'executor');
+    assert.equal(evalRes.stuck, false);
+    // and the merged finding kept its category (not downgraded to unknown→stuck)
+    assert.ok(evalRes.findings.some((f) => f.category === 'skill-bar-unconsulted' && f.route === 'executor'));
+  } finally { fs.rmSync(r, { recursive: true, force: true }); }
+});
+
+test('SA-7: markSkillFindingsRoutedInArray is idempotent', () => {
+  assert.deepEqual(loop.markSkillFindingsRoutedInArray([], 1), [1]);
+  assert.deepEqual(loop.markSkillFindingsRoutedInArray([1], 1), [1]);
+  assert.deepEqual(loop.markSkillFindingsRoutedInArray([1], 2), [1, 2]);
+});

package/lib/nubosloop.cjs

@@ -24,6 +24,7 @@ const ROUTE_TABLE = {
   'lint-violation': 'executor',
   'critic-error': 'stuck',
   'rule-9-violation': 'executor',
+  'skill-bar-unconsulted': 'executor',
   'missing-test': 'executor',
   'edge-case-gap': 'executor',
   'weak-assertion': 'executor',
@@ -311,6 +312,10 @@ const {
   auditToolUse,
   recordSearchEvidence,
   searchEvidenceForRound,
+  recordSkillEvidence,
+  recordExpectedSkills,
+  skillFindingsFromState,
+  markSkillFindingsRoutedInArray,
   readToolUseAudit,
   auditFindingsForRound,
   auditFindingsFromAudits,
@@ -502,6 +507,10 @@ module.exports = {
   auditToolUse,
   recordSearchEvidence,
   searchEvidenceForRound,
+  recordSkillEvidence,
+  recordExpectedSkills,
+  skillFindingsFromState,
+  markSkillFindingsRoutedInArray,
   readToolUseAudit,
   auditFindingsForRound,
   auditFindingsFromAudits,

package/lib/schemas/data/checkpoint.v1.json

@@ -0,0 +1,13 @@
+{
+  "$id": "checkpoint.v1",
+  "title": "Task checkpoint (checkpoints/<task_id>.json)",
+  "type": "object",
+  "required": ["schema_version"],
+  "properties": {
+    "schema_version": { "type": "integer", "minimum": 1 },
+    "task_id": { "type": "string" },
+    "status": { "type": "string" },
+    "files_touched": { "type": "array" },
+    "nubosloop": { "type": "object" }
+  }
+}

package/lib/schemas/data/codebase-manifest.v1.json

@@ -0,0 +1,22 @@
+{
+  "$id": "codebase-manifest.v1",
+  "title": "Codebase hash manifest (codebase/.hashes.json)",
+  "type": "object",
+  "required": ["schema_version"],
+  "properties": {
+    "schema_version": { "type": "integer", "minimum": 1 },
+    "generated_at": { "type": ["string", "null"] },
+    "files": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "required": ["sha256"],
+        "properties": {
+          "sha256": { "type": "string" },
+          "size": { "type": "integer", "minimum": 0 },
+          "ext": { "type": "string" }
+        }
+      }
+    }
+  }
+}

package/lib/schemas/data/learnings.v1.json

@@ -0,0 +1,28 @@
+{
+  "$id": "learnings.v1",
+  "title": "Learnings store (knowledge/learnings.json)",
+  "type": "object",
+  "required": ["version", "learnings"],
+  "properties": {
+    "version": { "type": "integer", "minimum": 1 },
+    "learnings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["fingerprint", "pattern", "outcome", "occurrence", "first_seen", "last_seen"],
+        "properties": {
+          "fingerprint": { "type": "string", "pattern": "^[a-f0-9]{16}$" },
+          "pattern": { "type": "string", "maxBytes": 4096 },
+          "outcome": { "type": "string", "maxBytes": 4096 },
+          "occurrence": { "type": "integer", "minimum": 1 },
+          "first_seen": { "type": "string" },
+          "last_seen": { "type": "string" },
+          "tokens": { "type": "array", "items": { "type": "string" } },
+          "task_ids": { "type": "array", "items": { "type": "string" } },
+          "milestone_ids": { "type": "array", "items": { "type": "string" } },
+          "outcome_history": { "type": "array" }
+        }
+      }
+    }
+  }
+}

package/lib/schemas/data/memory-manifest.v1.json

@@ -0,0 +1,14 @@
+{
+  "$id": "memory-manifest.v1",
+  "title": "Memory manifest (memory/manifest.json)",
+  "type": "object",
+  "required": ["schema_version", "model", "dim"],
+  "properties": {
+    "schema_version": { "type": "integer", "minimum": 1 },
+    "model": { "type": "string", "minLength": 1 },
+    "dim": { "type": "integer", "minimum": 1 },
+    "alpha": { "type": "number" },
+    "created_at": { "type": "string" },
+    "rebuilt_at": { "type": "string" }
+  }
+}

package/lib/schemas/data/memory-record.v1.json

@@ -0,0 +1,16 @@
+{
+  "$id": "memory-record.v1",
+  "title": "Memory record (memory/records.jsonl line)",
+  "type": "object",
+  "required": ["type", "title", "body"],
+  "properties": {
+    "type": { "enum": ["learning", "handoff", "critic", "research"] },
+    "title": { "type": "string", "minLength": 1 },
+    "body": { "type": "string" },
+    "tags": { "type": ["array", "null"] },
+    "provenance": { "enum": ["VERIFIED", "CITED", "ASSUMED", "CACHED", null] },
+    "id": { "type": ["string", "null"] },
+    "phase": { "type": ["string", "null"] },
+    "created_at": { "type": ["string", "null"] }
+  }
+}