opensquid 0.5.395

package/packs/builtin/cycle-pack/manifest.yaml

@@ -0,0 +1,20 @@
+# cycle-pack — built-in opensquid context-clearing cycle.
+#
+# Authoritative source: docs/opensquid-real-design.md §"Context-clearing
+# cycle" + §"Two-stage wedge gate" Stage 1.
+#
+# Ships with the npm package (see package.json `files` field). Loaded
+# universal scope so it's active in every session unless explicitly
+# disabled by the user's setup.
+name: cycle-pack
+version: 0.1.0
+scope: universal
+goal: free up context by offloading lessons to RAG via the wedge gate
+description: |
+  Built-in opensquid context-clearing cycle.
+
+  Implements the four-step cycle (triage → validate → persist → proceed)
+  on every prompt_submit event. Candidate lessons are surfaced for the
+  user to validate before they enter the wedge-gate pipeline; nothing
+  is promoted silently.
+evolves: false

package/packs/builtin/cycle-pack/skills/lesson-capture/prose.md

@@ -0,0 +1,34 @@
+# lesson-capture — LLM-facing guidance
+
+You are running inside opensquid with the built-in `cycle-pack` loaded.
+This file is loaded into your context when the `lesson-capture` skill
+activates (on every prompt submit).
+
+## What to do
+
+On every user prompt, before generating your reply:
+
+1. **Scan recent turns** for evidence of a lesson worth offloading:
+   - **Workflow** — a missing or out-of-order step in how the user works
+     (e.g. "they run lint before committing").
+   - **Preference** — a stable user preference that should bias future
+     choices (e.g. "they always use pnpm, never npm").
+   - **Skill upgrade** — a behavior change to an existing skill (e.g. add
+     a new rule, tighten an existing matcher). These require Stage 2
+     outcome validation later.
+2. **Propose a candidate**, do NOT silently persist. Use the capture
+   primitive — that writes the candidate to the session-scoped pending-
+   lessons buffer for the user to review.
+3. **Continue with the user's actual request.** The cycle is a
+   background pass; it never replaces the primary task.
+
+## What NOT to do
+
+- **Do not self-grade.** Whether a lesson is good is judged by outcome
+  metrics (Stage 2) + the user (Stage 1) — never by you. opensquid's
+  whole strategic moat depends on this.
+- **Do not evict user-authored lessons.** They are immune. If you spot
+  what feels like a duplicate or conflict, propose a new lesson and let
+  the user reconcile.
+- **Do not over-capture.** If nothing in the recent turns warrants a
+  lesson, emit `NONE` and the cycle short-circuits with a pass verdict.

package/packs/builtin/cycle-pack/skills/lesson-capture/skill.yaml

@@ -0,0 +1,57 @@
+# lesson-capture — Stage 1 of the wedge gate, run on every prompt_submit.
+#
+# Triage is a model-aliased classification (the model is declared in the
+# user's models.yaml — `fast_classifier` resolves to whatever cheap model
+# they've configured). If the classifier emits a known lesson type, the
+# downstream cycle (validate → persist → proceed) takes over via the
+# capture + buffer primitives. Otherwise the rule emits a pass verdict.
+name: lesson-capture
+load: preload
+when_to_load:
+  - event_type: prompt_submit
+# T-RJ-FOLLOWUPS FU.2 (2026-06-01): triggers on prompt_submit (was defaulting to
+# tool_call — fired a contentless llm_classify on every tool call). Now captures
+# the settled recent turns via `recent_turns` (UPS-filled from the transcript)
+# and interpolates them into the classifier prompt via `{{turns}}`, so the model
+# actually sees the conversation it's triaging.
+triggers:
+  - kind: prompt_submit
+rules:
+  - id: triage
+    kind: track_check
+    process:
+      - call: recent_turns
+        as: turns
+      - call: llm_classify
+        args:
+          model: fast_classifier
+          prompt: |
+            Inspect the recent conversation turns below. Identify candidate
+            lessons (workflow, preference, skill_upgrade) suitable for offload
+            to RAG via the wedge gate. Emit one label.
+
+            --- RECENT TURNS ---
+            {{turns}}
+          allowed_labels:
+            - WORKFLOW
+            - PREFERENCE
+            - SKILL_UPGRADE
+            - NONE
+        as: candidates
+      - call: verdict
+        if: candidates == "NONE"
+        args:
+          level: pass
+          message: nothing to capture
+prose: |
+  This skill drives the opensquid context-clearing cycle. On every prompt
+  submit, the agent should:
+
+  1. Look back at the recent turns.
+  2. Identify whether a workflow, preference, or skill upgrade was
+     surfaced that the agent should remember.
+  3. Surface the candidate to the user for validation BEFORE persisting
+     anything to long-term memory.
+
+  Validation is mandatory — silent persistence breaks the anti-self-
+  grading discipline that anchors opensquid's strategic moat.

package/packs/builtin/default-discipline/channels.yaml

@@ -0,0 +1,8 @@
+# default-discipline channel suggestions.
+#
+# Empty: this pack does NOT declare abstract channel names. The user's
+# local config at ~/.opensquid/channels.yaml maps `chat` + `alerts` +
+# Telegram topics to concrete URIs at the user layer. Keeping the
+# pack-side file empty avoids leaking personal endpoint defaults into
+# the package.
+{}

package/packs/builtin/default-discipline/drift_response.yaml

@@ -0,0 +1,51 @@
+# default-discipline drift response policy.
+#
+# Default per project_opensquid_drift_response_is_pack_declared:
+# `full_stop_and_redo` — halt the entire task, restart from the user's
+# defined workflow. Per-rule overrides downshift to softer policies where
+# the legacy rule was a `severity: warn` (honesty-ledger) or where a
+# softer response is appropriate (substrate-purity).
+#
+# FC.1b (2026-06-03): the git / engine-vocab / versioning / honesty-ledger /
+# phase-logging rules are now compiled guards, so their rule ids are
+# `guard:<name>` (the `default-discipline/guards` synthetic skill). Keys are
+# quoted because of the embedded colon. The two `workflow` keys below are
+# UNCHANGED — that skill was not migrated.
+default: full_stop_and_redo
+per_rule:
+  # Git hygiene — block the one tool call, don't halt the whole task.
+  'guard:never-amend': block_tool
+  'guard:no-force-push-main': block_tool
+
+  # Substrate-purity is a soft warn (engine-side smell, not a stop signal).
+  'guard:substrate-purity': warn
+
+  # Version slot assignment is loud — pause for user input.
+  'guard:version-slot-assignment': notify_and_pause
+
+  # Honesty-ledger claim rules — all warn, never block.
+  'guard:research-start': warn
+  'guard:research-spawning': warn
+  'guard:starting-now': warn
+  'guard:running-tests': warn
+  'guard:running-build': warn
+  'guard:committed': warn
+  'guard:telegram-sent': warn
+  'guard:pushed': warn
+  'guard:tagged': warn
+  'guard:fmt-clippy': warn
+  'guard:phase-logged': warn
+  'guard:audit-done': warn
+  'guard:pre-push-checklist': warn
+  'guard:ci-verify-after-push': warn
+
+  # Phase-logging claim gates — warn.
+  'guard:phase-claim-forward': warn
+  'guard:session-no-task': warn
+
+  # Versioning hard-stop (migrated guard).
+  'guard:versioning-pre1-patch-only': full_stop_and_redo
+
+  # Workflow hard-stops — NOT migrated (workflow skill keeps bare rule ids).
+  workflow-phases-required: full_stop_and_redo
+  phase-logged-before-commit: full_stop_and_redo

package/packs/builtin/default-discipline/manifest.yaml

@@ -0,0 +1,297 @@
+# default-discipline — generic drift-gate discipline as a pack.
+#
+# Renamed from `sangmin-personal` per T-BUILTIN-RETIRE BR.1 (2026-05-29):
+# the previous name implied personal content despite carrying generic
+# drift-gate discipline (workflow / versioning / git / d9-guard /
+# honesty-ledger / phase-logging / engine-vocab). Authoritative source:
+# docs/tasks/T-builtin-retire.md.
+#
+# Two skill folders remain (d9-guard/, workflow/) — the rest of the cluster
+# (git / engine-vocab / versioning / honesty-ledger / phase-logging) is now
+# the `guards:` block below (FC.1b, 2026-06-03): 21 shape-perfect detect→verdict
+# gates compiled into the synthetic `default-discipline/guards` skill. Drift
+# policy per rule is keyed `guard:<name>` in drift_response.yaml.
+#
+# Ships with the npm package (see package.json `files` field) as a dormant
+# opt-in template — NOT auto-loaded. Users who want this baseline add
+# `default-discipline` to their scope's `active.json`. The user's
+# personal discipline (instance-specific rules, identity claims, etc.)
+# belongs in a user-scope pack under `~/.opensquid/packs/`, not here.
+name: default-discipline
+version: 0.1.0
+scope: universal
+goal: ship verified work with locked drift-gate discipline
+description: |
+  Default discipline pack — encodes generic git hygiene, 7-phase workflow,
+  PATCH-only pre-1.0 versioning, honesty-ledger claim catalog, and
+  phase-logging discipline. Opt-in via your scope's active.json.
+evolves: true
+# --- guards (FC.1b) -------------------------------------------------------
+# Command gates (on: tool_call) — match_command, default `as: hit`, `when: hit`.
+# Claim gates (on: prompt_submit) — text_pattern_match on priorAssistantText,
+# `as: claimed`, `when: len(claimed.matched) > 0`. Patterns are byte-identical
+# to the retired skills (single-quoted so regex backslashes + the FU.14
+# command-boundary prefixes survive).
+guards:
+  # git hygiene (block_tool)
+  - name: never-amend
+    on: tool_call
+    detect:
+      call: match_command
+      args:
+        pattern: '(?:^|[;&|\n(])\s*git\s+(?:-[cC]\s+\S+\s+)*commit\b[^\n]*\s--amend\b'
+        target: tool_args.command
+    when: hit
+    level: block
+    message: >-
+      BLOCKED: `git commit --amend` violates the never-amend rule.
+      Even on unpushed commits — make a follow-up commit instead.
+      Override only if the user explicitly requested an amend in
+      THIS turn.
+  - name: no-force-push-main
+    on: tool_call
+    detect:
+      call: match_command
+      args:
+        pattern: '(?:^|[;&|\n(])\s*git\s+(?:-[cC]\s+\S+\s+)*push\b[^\n]*(--force|-f)\b[^\n]*\b(main|master)\b'
+        target: tool_args.command
+    when: hit
+    level: block
+    message: >-
+      BLOCKED: force-push to main/master is destructive. Requires
+      explicit user request — and even then, prefer a regular push
+      or a new branch.
+
+  # engine substrate-purity (warn)
+  - name: substrate-purity
+    on: tool_call
+    detect:
+      call: match_command
+      args:
+        pattern: 'loop/engine.*git\s+commit[^\n]*-m[^\n]*(pack|opensquid|MindCraftor)'
+        target: tool_args.command
+    when: hit
+    level: warn
+    message: >-
+      WARN: engine commit message references a consumer-product
+      concept (pack / opensquid / MindCraftor). Engine speaks in
+      engine types only — re-word using substrate vocabulary.
+
+  # versioning patch-only (full_stop_and_redo per drift_response)
+  - name: versioning-pre1-patch-only
+    on: tool_call
+    detect:
+      call: match_command
+      args:
+        pattern: '(?:^|[;&|\n(])\s*npm\s+version\s+(minor|major)\b'
+        target: tool_args.command
+    when: hit
+    level: block
+    message: >-
+      BLOCKED: pre-1.0 is PATCH-ONLY. The agent may only bump
+      patch. Minor/major slot allocation is exclusively the
+      user's call (feedback_pre1_versioning v4).
+
+  # honesty-ledger claim catalog (warn) — on: prompt_submit
+  - name: research-start
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\b(?:pre-?research|research)\s+(starting|begins?)\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: spawn a research agent or do explicit reading
+  - name: research-spawning
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\bspawn(?:ing)?\s+(?:a\s+)?(?:research\s+)?agent\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: spawn a research agent
+  - name: starting-now
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\b(?:starting|kicking off)\s+(?:#?\w+\s+)?now\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: actually start the work (any tool call counts)
+  - name: running-tests
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\brunning\s+(?:the\s+)?tests?\b|\btests?\s+pass(?:ing|ed|es)?\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: run npm test / cargo test
+  - name: running-build
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\brunning\s+(?:the\s+)?build\b|\bbuild\s+(?:pass(?:ing|es|ed)?|clean|green)\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: run the build
+  - name: committed
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\b(?:committed|just committed|committing)\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: git commit
+  - name: audit-done
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\b(?:audit\s+(?:done|complete)|Phase\s+\d+\s*[—-]\s*Audit)\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: do the audit (any inspection tool call)
+  - name: telegram-sent
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns:
+          - '\b(?:telegram(?:\s+(?:report|message))?\s+(?:sent|delivered)|sent\s+(?:to|via)\s+telegram|pinged\s+(?:you|telegram))\b'
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: call the telegram reply tool or chat_send
+  - name: pushed
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns:
+          - '\b(?:pushed|pushing)\s+(?:to\s+(?:origin|main|remote|github)|it|up|the\s+(?:commit|tag|fix|changes?|branch|release|PR|update))\b'
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: git push origin <branch>
+  - name: tagged
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns:
+          - '\b(?:just\s+)?tagged\s+v?\d+\.\d+(?:\.\d+)?\b|\bcreated\s+(?:the\s+|a\s+)?tag\s+v?\d+\.\d+\b'
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: git tag <name>
+  - name: fmt-clippy
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\b(?:fmt|clippy|prettier|formatting)\s+(?:clean|passes?|passing|green|ok)\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: run cargo fmt / cargo clippy / prettier / npm run format
+  - name: phase-logged
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns:
+          - '\b(?:logged|logging)\s+(?:the\s+)?(?:audit|post[_-]?research|fix|test|code|learn|pre[_-]?research)\s+phase\b'
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: call mcp__opensquid__log_phase
+  - name: pre-push-checklist
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\b(?:ready\s+to\s+push|gates\s+green|pre-push\s+(?:clean|done))\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: run typecheck + prettier + test + build before pushing
+  - name: ci-verify-after-push
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns: ['\b(?:CI\s+green|CI\s+passing|workflow\s+passed)\b']
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: 'verify CI via `gh run view <id> --json conclusion` (NOT `gh run watch`) before claiming CI green'
+
+  # phase-logging claim gates — on: prompt_submit
+  - name: version-slot-assignment
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns:
+          - '\b(?:next\s+minor|next\s+major|bump(?:ing)?\s+(?:to\s+)?(?:minor|major)|ships?\s+as\s+v?[0-9]+\.[0-9]+\.[0-9]+)\b'
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: >-
+      ASK the user before naming a non-patch version slot
+      (call AskUserQuestion); never pick v0.8/v0.9/v1.0
+      unilaterally.
+  - name: phase-claim-forward
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns:
+          - '\bPhase\s+[1-7](?:\s*\/\s*7)?\s*[—\-:]\s*(?:pre[_-]?research|learn|code|test|audit|post[_-]?research|fix)\b'
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: >-
+      call mcp__opensquid__log_phase for the phase you announced
+  - name: session-no-task
+    on: prompt_submit
+    detect:
+      call: text_pattern_match
+      args:
+        text_field: priorAssistantText
+        patterns:
+          - "\\b(?:let\\s+me\\s+(?:run|execute|implement|fix|build|wire)|now\\s+i'?ll\\s+(?:run|implement|fix|build|wire))\\b"
+    as: claimed
+    when: 'len(claimed.matched) > 0'
+    level: warn
+    message: >-
+      create or update a task (TaskCreate/TaskUpdate) before doing
+      substantive work — keeps the workflow-gate enforceable

package/packs/builtin/default-discipline/models.yaml

@@ -0,0 +1,8 @@
+# default-discipline model aliases.
+#
+# Empty: this pack does not hardcode model choices. The user's local config
+# at ~/.opensquid/models.yaml maps `reasoning` + `fast_classifier` to
+# whichever subscription/SDK/API the user prefers. The pack's
+# destination_check rule references the alias `reasoning`; the user picks
+# the backend.
+{}

package/packs/builtin/default-discipline/notifications.yaml

@@ -0,0 +1,12 @@
+# default-discipline notification routing.
+#
+# Minimal defaults that compose with the schema defaults: critical + error
+# go to `alerts`; warning + info go to `chat`. Users can override per-project
+# in their user-scope pack (e.g. route engine-repo `warning` to a dedicated
+# Telegram topic).
+severity_tiers:
+  critical: [alerts]
+  error: [alerts]
+  warning: [chat]
+  info: [chat]
+per_project_override: {}

package/packs/builtin/default-discipline/skills/d9-guard/skill.yaml

@@ -0,0 +1,82 @@
+# d9-guard — "politeness reflex" detector, AUTOMATION-GATED (G.12).
+#
+# The original D9 rule (the inline `~/.claude/settings.json` prompt hook) was
+# firing on every turn, including normal interactive turns where a blocking
+# question to the user is the CORRECT behavior. The G.12 pack-managed version
+# short-circuits the llm_classify call unless the session is in automation mode
+# (the user is running `/loop` or similar full-automation track that explicitly
+# forbids ping-pong AskUserQuestion). Outside automation, the rule is a no-op.
+#
+# Two automation signals are OR'd by the `is_automation_mode` primitive:
+#   1. `OPENSQUID_AUTOMATION=1` env var (manual / wrapper override)
+#   2. `~/.opensquid/sessions/<id>/automation.flag` (the `opensquid automation
+#      on|off` CLI writes/removes this)
+#
+# T-RESPONSE-JUDGING-UPS RJ.3 (2026-06-01): runs at UserPromptSubmit, NOT Stop.
+# Two fixes land here: (1) per the lexicon law, a gate that judges the
+# just-emitted response belongs at UPS (the prior turn is SETTLED — no
+# off-by-one). (2) The classifier was fed a CONTENTLESS prompt — it said "the
+# assistant message below" but interpolated nothing and never captured the
+# message. Now `last_assistant_message` captures the settled prior turn (RJ.1
+# priorAssistantText) into `msg`, and the prompt interpolates it via `{{msg}}`
+# so the classifier actually sees what it's judging.
+#
+# The cleanup of the legacy inline D9-guard prompt hook in ~/.claude/settings
+# .json is a SEPARATE concern: this pack-version supersedes it but does not
+# auto-remove it. Users should `opensquid setup wizard hooks` or hand-edit
+# settings.json to delete the inline entry once they've verified the pack-
+# managed version is firing correctly.
+name: d9-guard
+load: preload
+when_to_load:
+  - kind: event_type
+    type: prompt_submit
+triggers:
+  - kind: prompt_submit
+rules:
+  - id: d9-blocking-question-check
+    kind: track_check
+    process:
+      - call: is_automation_mode
+        as: automation
+      - call: last_assistant_message
+        as: msg
+      - call: llm_classify
+        if: automation.value == true
+        as: classification
+        args:
+          model: fast_classifier
+          prompt: |
+            The assistant message below ended a turn. Determine whether it
+            terminated with a genuine BLOCKING question (one the agent
+            cannot proceed without a user answer to) or a POLITENESS
+            REFLEX (a soft "let me know if you want me to ..." / "should I
+            do X?" that the agent should have just decided + executed in
+            automation mode).
+
+            Emit one label: BLOCK if it's a politeness reflex that should
+            have been auto-decided; ALLOW if it's a genuine blocking
+            question or not a question at all.
+
+            --- ASSISTANT MESSAGE ---
+            {{msg}}
+          allowed_labels:
+            - ALLOW
+            - BLOCK
+      - call: verdict
+        if: automation.value == true && classification == "BLOCK"
+        args:
+          level: warn
+          message: 'D9-guard: politeness reflex detected in automation mode — decide with sensible defaults and proceed instead of pinging back.'
+prose: |
+  Codifies the "automation mode = NO questions" feedback (the user-flagged
+  2026-05-21 rule against ping-pong AskUserQuestion inside `/loop` and
+  similar automation tracks). The rule fires ONLY when
+  `is_automation_mode()` returns true, so interactive turns where a
+  question to the user IS appropriate are left untouched.
+
+  Gating model: `if: automation.value == true` short-circuits BOTH the
+  llm_classify call AND the verdict. Outside automation, the rule executes
+  zero LLM calls and emits no verdict — a true no-op. The classifier judges
+  the settled prior assistant turn (priorAssistantText), interpolated into
+  the prompt via `{{msg}}`.

package/packs/builtin/default-discipline/skills/inbound-greeter/SKILL.md

@@ -0,0 +1,38 @@
+# inbound-greeter
+
+A reference skill demonstrating the **`inbound_channel`** trigger shipped in
+T-L3-LOOP (opensquid 0.5.227 → 0.5.232). On any inbound chat message reaching
+this session, emits a `surface` verdict acknowledging receipt.
+
+## How the trigger fires
+
+1. The chat-daemon receives a Telegram / Slack / Discord message + appends an
+   `InboxRow` to `~/.opensquid/projects/<projectUuid>/inbox/<platform>.jsonl`.
+2. The LL.3 inbound watcher (started by `opensquid chat watch`) chokidar-tails
+   the file + reads the appended row.
+3. The watcher resolves the live session via `live-session.lease` (LL.2). If
+   no fresh lease, the row stays in inbox + an `unrouted.jsonl` entry is
+   written (per pack-runtime.md §7.5).
+4. The watcher fires an `InboundChannelEvent`
+   (`{kind: 'inbound_channel', channelUri, sender, text, threadKey, receivedAt}`)
+   against the session's loaded packs.
+5. This skill's `triggers:` block matches; its `surface-acknowledgment` rule
+   fires + emits a `surface` verdict.
+
+## Reading the additionalContext
+
+Separately, the LL.4 UPS hook drains unacked inbox rows into
+`additionalContext` at the start of the agent's next turn (formatted as
+`📨 Inbound messages (N)`). The skill's verdict + the UPS envelope coexist —
+both reach the agent through the same prompt-submit hook payload.
+
+## Customizing
+
+- `channel: telegram` — fire only on Telegram messages
+- `sender_pattern: '^(alice|bob)$'` — fire only when the named senders message
+- Replace the rule's `verdict` with a richer process (call `llm_classify`
+  for intent triage, then conditionally emit `directive` or `block`)
+
+See [pack-runtime.md §2.4](../../../../docs/pack-runtime.md) for the full
+`inbound_channel` trigger filter reference and §7.5 for inbound-specific
+anti-patterns (best-effort dispatch; passive evaluators).

package/packs/builtin/default-discipline/skills/inbound-greeter/skill.yaml

@@ -0,0 +1,36 @@
+# inbound-greeter — Reference example for the `inbound_channel` trigger pattern
+# shipped in T-L3-LOOP (opensquid 0.5.227 → 0.5.232).
+#
+# On any inbound chat message reaching this session via the LL.3 watcher,
+# emit a surface verdict acknowledging receipt. Pack authors copy this as
+# the starting point for higher-value inbound handling (intent classification,
+# urgency triage, etc.).
+#
+# Posture per LL.5 risk callout: ships in default-discipline with `unloads_when:
+# session_ends` so it stays scoped to a single chat watch lifetime (won't pile
+# up across long-running sessions). Pack authors who want richer inbound
+# handling should COPY this skill into their own pack rather than enabling
+# the built-in one in production.
+#
+# Cross-references:
+#   - docs/pack-runtime.md §2.4 — `inbound_channel` filter semantics
+#   - docs/pack-runtime.md §7.5 — inbound anti-patterns (best-effort + passive)
+name: inbound-greeter
+load: lazy
+when_to_load:
+  - kind: event_type
+    type: inbound_channel
+unloads_when:
+  - kind: session_ends
+triggers:
+  - kind: inbound_channel
+    # Omitting `channel` accepts telegram + slack + discord.
+    sender_pattern: '^.+$' # accept all senders (replace with `^(alice|bob)$` etc. in production)
+rules:
+  - id: surface-acknowledgment
+    kind: track_check
+    process:
+      - call: verdict
+        args:
+          level: surface
+          message: '📨 Inbound message noted (will surface at next user turn)'