opensquid 0.5.395

package/packs/builtin/default-discipline/skills/session-connection-check/SKILL.md

@@ -0,0 +1,45 @@
+# session-connection-check
+
+The first consumer of the **`session_start`** trigger / SessionStart hook
+mechanism shipped in T-HANDOFF-HARDENING HH6.1. On session begin it surfaces
+the project's chat-connection state so the agent (and you) know inbound chat is
+actually wired before any work starts — the convention "check chat connections
+at session start" with real enforcement behind it.
+
+## What it reports
+
+`check_chat_connection` (the primitive) composes a one-shot `inject_context`:
+
+- **telegram configured** (routing + bot token present) → reports the topic and
+  whether a `chat watch` **live-session lease** is held (i.e. whether THIS
+  session will actually receive inbound), nudging you to start
+  `opensquid chat watch` (via the harness `Monitor`) if not;
+- **another platform configured** (slack/discord) → reports that telegram isn't
+  wired for this project;
+- **nothing wired** → nudges `opensquid setup`.
+
+It also runs a **generic umbrella-drift check**: projects sharing one report
+destination (channel + topic) form an "umbrella" and should carry consistent
+inbound routing; if they've drifted (e.g. one routing file lost its inbound
+fields), the report flags it. No hardcoded project UUIDs — the umbrella is
+derived from whatever shares a destination.
+
+## How it fires
+
+1. Claude Code fires `SessionStart` → `opensquid-hook-sessionstart` dispatches a
+   `session_start` event.
+2. This skill's `triggers:` matches; its rule calls `check_chat_connection`.
+3. The primitive's `inject_context` return is aggregated by the dispatcher
+   (HH6.1 widened inject_context surfacing to `session_start`) and emitted by
+   the hook bin as `hookSpecificOutput.additionalContext`.
+
+## Opt-out
+
+Set `chat.session_start_check: "off"` in `~/.opensquid/config.json` and the
+primitive returns nothing (no injection) — for users who don't want a chat
+system.
+
+## Report-only
+
+Per [[project_opensquid_no_agent_loop]], the check never starts `chat watch`,
+spawns the agent-bridge daemon, or repairs routing. It reports; the agent acts.

package/packs/builtin/default-discipline/skills/session-connection-check/skill.yaml

@@ -0,0 +1,55 @@
+# session-connection-check — T-HANDOFF-HARDENING HH6.2.
+#
+# The first consumer of the SessionStart hook mechanism (HH6.1). On session
+# begin it surfaces the project's chat-connection state (telegram configured +
+# whether `chat watch` is running, or a wizard nudge if nothing is wired) plus
+# a generic umbrella-routing-drift warning, as an inject_context that the
+# SessionStart hook bin emits via hookSpecificOutput.additionalContext.
+#
+# REPORT-ONLY (per project_opensquid_no_agent_loop): the primitive reads state
+# and composes a message; it never starts chat watch, spawns a daemon, or
+# repairs routing. The agent reads the surfaced report and acts.
+#
+# Opt-out: set `chat.session_start_check: "off"` in ~/.opensquid/config.json
+# and check_chat_connection returns null (no injection).
+#
+# unloads_when: session_ends — scoped to one session begin; the event only
+# fires once per session anyway, but this keeps it off the long-running
+# dynamic-skill set.
+name: session-connection-check
+load: lazy
+when_to_load:
+  - kind: event_type
+    type: session_start
+unloads_when:
+  - kind: session_ends
+triggers:
+  - kind: session_start
+rules:
+  # T-SESSION-STATUS-MANIFEST — ONE consolidated "what opensquid is connected to"
+  # report (chat + flow + packs + daemon + engine), always shown on session begin.
+  # Supersedes the old single-section check_chat_connection call (which stays a
+  # registered primitive, now unwired). Returns inject_context directly (terminal).
+  - id: surface-connection-state
+    kind: track_check
+    process:
+      - call: session_status_manifest
+  # T-AUTO-HANDOFF — reader + tier-3 lazy generator: surfaces the previous
+  # (dead) session's auto-handover doc, GENERATING it from disk first when the
+  # dead session died without a handoff (kill-9/wedge safe via the FU.3
+  # pointer). One injection per fresh session; fail-quiet.
+  - id: surface-auto-handoff
+    kind: track_check
+    process:
+      - call: handoff_session_start
+  # CAT.7 — SessionStart topic assurance (umbrella-level ≤1 topic). Unlike the
+  # report-only rule above, this one takes an ACTION (sanctioned by the
+  # remote-terminal override): if a chat daemon is live and the session's
+  # umbrella owns a telegram chat_id but ZERO topic, it creates exactly one
+  # topic and writes topic_id back into channels.json. Idempotent: once set
+  # it's a no-op. Always returns null (pure side effect — no inject_context),
+  # so it never short-circuits the rule above and fail-quiets on any error.
+  - id: ensure-umbrella-topic
+    kind: track_check
+    process:
+      - call: ensure_umbrella_topic

package/packs/builtin/default-discipline/skills/workflow/skill.yaml

@@ -0,0 +1,65 @@
+# workflow — the locked 7-phase workflow.
+#
+# Ports the legacy `standard-7-phase` workflow + `phase-logged-7-phase`
+# policy from bundled-default/pack.yaml lines 97–145, 308–313.
+#
+# Two rules:
+#   - workflow-phases-required (destination_check): periodic LLM judgement
+#     on whether the active task is skipping phases.
+#   - phase-logged-before-commit (track_check): refuse `git commit` until
+#     all 7 phases are logged via `mcp__opensquid__log_phase`.
+#
+# Load: preload — workflow discipline is always-on per
+# project_opensquid_pack_load_hybrid.
+name: workflow
+load: preload
+when_to_load: []
+rules:
+  - id: workflow-phases-required
+    kind: destination_check
+    interval:
+      every_n_tool_calls: 10
+    model_alias: reasoning
+    prompt_template: |
+      The locked 7-phase workflow is:
+        pre_research → learn → code → test → audit → post_research → fix
+
+      Inspect the active task's recent activity. Has the agent skipped or
+      short-circuited any phase before reaching a terminal action
+      (commit, push, tag)?
+
+      Reply with one of:
+        DRIFTING  <one-line reason>
+        ON_TRACK  <one-line reason>
+
+  - id: phase-logged-before-commit
+    process:
+      - call: match_command
+        args:
+          pattern: '(?:^|[;&|\n(])\s*git\s+(?:-[cC]\s+\S+\s+)*commit\b' # FU.14: command-boundary (start or after ; && || | newline ( ) — catches `cd … && git commit`
+          target: tool_args.command
+        as: committing
+      - call: read_state
+        if: committing
+        args:
+          key: workflow.phases_logged
+        as: phases
+      # FU.9: `read_state` returns the ledger OBJECT `{task_id, phases:[...]}`,
+      # never the string "complete" — the prior `phases != "complete"` was always
+      # true (object !== string), so paired with the old exit-0 halt stub the gate
+      # silently no-op'd. Block when fewer than all 7 phases are logged. `len`
+      # returns 0 for a null/absent ledger → 0 < 7 → blocks a zero-phase commit.
+      - call: verdict
+        if: 'committing && len(phases.phases) < 7'
+        args:
+          level: block
+          message: >-
+            BLOCKED: 7-phase workflow incomplete. Log each phase via
+            `mcp__opensquid__log_phase` (pre_research → learn → code →
+            test → audit → post_research → fix) before committing.
+prose: |
+  The locked 7-phase workflow per feedback_workflow_cycle (PRIMARY
+  drift-protection rule). Every substantive task runs all 7 phases
+  before a terminal action. The destination_check is the soft side
+  (periodic LLM judgement); the track_check gates `git commit` on a
+  state key that the runtime updates each time `log_phase` fires.

package/packs/builtin/examples/file-pattern-guard/BEFORE.md

@@ -0,0 +1,70 @@
+# File Pattern Guard — prose-only version (BEFORE)
+
+This file shows the rule as it would live **without** the H grammar's
+`match()` function — as English guidance inside SKILL.md `prose:`. The
+next-door `skills/guard/skill.yaml` is the **AFTER**: the same logic
+compiled to a single-line `if:` clause that the evaluator checks before
+every Edit tool call.
+
+---
+
+## The rule (prose form)
+
+When the assistant is about to edit a file:
+
+- **IF** the target file path matches any of:
+  - `node_modules` — vendored dependency tree
+  - `/dist/` or `/build/` — generated build output
+  - `/.git/` — version-control internals
+  - `.lock$` — package manager lockfiles (regenerate, never hand-edit)
+
+**THEN** block the edit and instruct the assistant to use the
+appropriate generator tool instead.
+
+## Why prose-only was insufficient
+
+The rule is a single regex check against one event-payload field
+(`tool_input.file_path`). Under the pre-H grammar, `if:` accepted
+bare names and a fixed set of equality / numeric-comparison forms
+hard-coded in the evaluator's regex set. There was no `match()`
+primitive — regex tests could not be expressed at all in `if:` clauses.
+
+The workaround was either:
+
+1. Move the regex check into a custom primitive function in
+   `src/functions/` (engine code change, requires a release).
+2. Document the rule in prose and hope the agent remembers.
+
+Option 1 turns every per-skill regex check into a runtime PR. Option 2
+relies on the agent's discipline — the exact failure mode opensquid
+exists to fix.
+
+## What the H grammar unlocks
+
+The AFTER form (`skills/guard/skill.yaml`) collapses the rule into:
+
+```yaml
+if: 'match(tool_input.file_path, "node_modules|/dist/|/build/|/.git/|.lock$")'
+```
+
+That clause is parsed at pack load time (Zod refinement via H.2) and
+evaluated at every PreToolUse event. New regex categories are now a
+pack-author edit — no runtime release needed.
+
+## Compression measure
+
+| Form                                        | LOC of the gate | Enforcement                             |
+| ------------------------------------------- | --------------- | --------------------------------------- |
+| Prose (this)                                | ~6 lines        | None — guidance only                    |
+| Custom primitive function in src/functions/ | ~30 lines TS    | Enforced, but requires runtime release  |
+| Structured `if:` with `match()`             | 1 line          | Enforced, pack-author authors and ships |
+
+## Note on regex safety (H.4 follow-up)
+
+The `match()` function currently uses V8's `new RegExp(p).test(s)`. The
+pattern in the AFTER form is a simple alternation — no nested
+quantifiers, no backreferences, no lookarounds — so it runs in linear
+time on any input. The H.4 task will swap the implementation to RE2
+(linear-time by construction) to harden against pack-author authoring
+mistakes that would otherwise produce ReDoS exposure. See
+`docs/skill-grammar-guide.md` §6 Gotchas for the full discussion.

package/packs/builtin/examples/file-pattern-guard/SKILL.md

@@ -0,0 +1,79 @@
+# file-pattern-guard — AFTER (structured)
+
+Three-file example demonstrating the regex-check migration pattern
+enabled by the H grammar's allow-listed `match()` function.
+
+| File                      | Purpose                                                        |
+| ------------------------- | -------------------------------------------------------------- |
+| `BEFORE.md`               | Prose-only equivalent + per-skill custom primitive alternative |
+| `SKILL.md` (this file)    | Reader's guide — what the example demonstrates                 |
+| `manifest.yaml`           | Pack identity (`name` / `version` / `scope` / `goal`)          |
+| `skills/guard/skill.yaml` | The structured rule itself — single `if:` clause does the work |
+
+## What this example demonstrates
+
+A regex path-pattern check expressed in one line of YAML, executable at
+every PreToolUse event without a runtime release. Replaces both
+prose-only guidance and the alternative of writing a per-rule custom
+primitive function.
+
+Reference clause:
+
+```yaml
+if: 'match(tool_input.file_path, "node_modules|/dist/|/build/|/.git/|.lock$")'
+```
+
+## Grammar features exercised
+
+- **`match()` (allow-listed function)** — regex test on a string field,
+  pack-authored pattern. Returns `false` for non-string operands and
+  for malformed regex patterns (fail-closed, see grammar guide §3).
+- **Dotted path access on event payload** — `tool_input.file_path`
+  resolves through the binding map. The `tool_input` binding is the
+  raw `tool_input` field from the PreToolUse event payload (see
+  src/runtime/hooks/pre-tool-use.ts for the wiring).
+
+## Primitive return shapes used
+
+This example does not consume any primitive's return shape — `match()`
+operates directly on `tool_input.file_path`, which the runtime binds
+from the PreToolUse event payload before any process step runs.
+
+## ReDoS posture (H.4 follow-up)
+
+`match()` currently wraps `new RegExp(p).test(s)`. The pattern in this
+example is a flat alternation (`a|b|c|...`) with no nested quantifiers,
+backreferences, or lookarounds — V8 handles it in linear time on any
+input. The H.4 task will swap the implementation to RE2 to harden
+against future pack-author authoring mistakes. See
+`docs/skill-grammar-guide.md` §6 Gotchas for the full discussion.
+
+## How to run it
+
+The example is **not** registered in any `active.json`. To exercise it
+in a dev session:
+
+```bash
+# 1. Validate it loads under the H.2 refinement
+node -e "import('./dist/packs/loader.js').then(m => m.loadPack('packs/builtin/examples/file-pattern-guard')).then(p => console.log('OK', p.skills.length, 'skill(s)'))"
+
+# 2. Run its fixtures via the test suite
+pnpm vitest run test/example-skills.test.ts
+```
+
+## Fixtures
+
+- `fixtures/edit_node_modules.input.json` — Edit on
+  `node_modules/lodash/index.js` → expected: **1 block verdict** (rule
+  fires; the path matches `node_modules`).
+- `fixtures/edit_src.input.json` — Edit on `src/index.ts` → expected:
+  **0 verdicts** (rule short-circuits; the path matches none of the
+  alternation arms).
+
+## Why this example is in the docs
+
+It is the canonical demonstration that the `match()` function moves
+regex policy out of TypeScript (per-rule custom primitives) and into
+YAML (pack-author edits). Any future "block edits to X" or "warn on
+shell commands matching Y" rule can now be a one-line `if:` clause
+authored by the user without touching the runtime.

package/packs/builtin/examples/file-pattern-guard/fixtures/edit_node_modules.expected.json

@@ -0,0 +1,3 @@
+{
+  "verdict": true
+}

package/packs/builtin/examples/file-pattern-guard/fixtures/edit_node_modules.input.json

@@ -0,0 +1,9 @@
+{
+  "comment": "Edit on a node_modules path — the alternation arm matches, the if: clause is true, the rule fires.",
+  "if": "match(tool_input.file_path, \"node_modules|/dist/|/build/|/.git/|.lock$\")",
+  "bindings": {
+    "tool_input": {
+      "file_path": "/Users/alice/projects/example/node_modules/lodash/index.js"
+    }
+  }
+}

package/packs/builtin/examples/file-pattern-guard/fixtures/edit_src.expected.json

@@ -0,0 +1,3 @@
+{
+  "verdict": false
+}

package/packs/builtin/examples/file-pattern-guard/fixtures/edit_src.input.json

@@ -0,0 +1,9 @@
+{
+  "comment": "Edit on a normal src/ path — no alternation arm matches, the if: clause is false, the rule does not fire.",
+  "if": "match(tool_input.file_path, \"node_modules|/dist/|/build/|/.git/|.lock$\")",
+  "bindings": {
+    "tool_input": {
+      "file_path": "/Users/alice/projects/example/src/index.ts"
+    }
+  }
+}

package/packs/builtin/examples/file-pattern-guard/manifest.yaml

@@ -0,0 +1,18 @@
+# Example — not load-bearing. Demonstrates `match()` regex function +
+# dotted path access on a tool-event payload. Ships under
+# packs/builtin/examples/ as educational material referenced from
+# docs/skill-grammar-guide.md.
+# NOT registered in any `active.json` and NOT loaded by the runtime
+# unless a user explicitly opts in by editing their scope's active.json.
+name: file-pattern-guard
+version: 0.1.0
+scope: universal
+goal: block edits to vendored, generated, or VCS-internal file paths
+description: |
+  Worked example showing a regex-based path guard collapsed into a
+  single-line `if:` clause via the H grammar's allow-listed `match()`
+  function.
+
+  The prose-only equivalent ships alongside as `BEFORE.md`. The
+  structured rule lives in `skills/guard/skill.yaml`.
+evolves: false

package/packs/builtin/examples/file-pattern-guard/skills/guard/skill.yaml

@@ -0,0 +1,33 @@
+# Example — not load-bearing. Worked example for docs/skill-grammar-guide.md.
+#
+# Demonstrates a single-line `if:` clause using the allow-listed
+# `match()` regex function and dotted path access on the tool-event
+# payload. The same rule under the pre-H grammar was impossible to
+# express in YAML and had to live as agent-side prose.
+#
+# Note on regex: `match()` currently uses `new RegExp(pattern).test(s)`
+# in src/runtime/evaluator/expression/functions.ts. The ReDoS-hardening
+# swap to RE2 lands as H.4. Until then, keep patterns conservative —
+# no nested quantifiers, no backreferences, no lookarounds. The pattern
+# below is a simple alternation that V8's RegExp engine handles in
+# linear time on any input length.
+name: guard
+load: preload
+triggers:
+  - kind: tool_call
+rules:
+  - id: refuse-vendored-or-generated-edits
+    kind: track_check
+    process:
+      - call: verdict
+        if: 'match(tool_input.file_path, "node_modules|/dist/|/build/|/.git/|.lock$")'
+        args:
+          level: block
+          message: |-
+            BLOCKED: refusing to edit a vendored, generated, or VCS-internal
+            path. If this is intentional (e.g. regenerating a lockfile),
+            invoke the appropriate generator tool instead of a direct Edit.
+prose: |
+  Reference companion to BEFORE.md. The same logic, but enforced by the
+  evaluator at every PreToolUse event for Edit calls instead of held
+  only as guidance for the agent to follow.

package/packs/builtin/examples/multi-clause-drift-detector/BEFORE.md

@@ -0,0 +1,62 @@
+# Multi-Clause Drift Detector — prose-only version (BEFORE)
+
+This file shows the rule as it would live **without** the H grammar — as
+free-form English inside a SKILL.md `prose:` block, with no structural
+enforcement. The next-door `skills/drift/skill.yaml` is the **AFTER**:
+the same logic compiled to a single `if:` clause that the evaluator
+checks at every Stop event.
+
+---
+
+## The rule (prose form)
+
+When the assistant ends a turn (Stop event):
+
+- **IF** the assistant's last message contains any of the drift phrases
+  (`per memory`, `deferred`, `i remember`), AND
+- the message does **NOT** contain any verification phrases (`i checked`,
+  `i ran`, `i confirmed`), AND
+- **no** verification tools (`Bash`, `Read`, `Grep`,
+  `mcp__opensquid__recall`, `mcp__opensquid__inspect_skill`) were
+  invoked this turn,
+
+**THEN** the assistant is most likely citing remembered state without
+verifying it against ground truth (the failure mode flagged in the
+`feedback_verify_code_before_memory` memory).
+
+## Why prose-only was insufficient
+
+Three compound conditions joined by `AND` over **two different data
+sources** (assistant text + session tool history). Pre-H, the `if:`
+grammar in opensquid was a thin regex set: bare names, single
+equality checks, basic numeric comparisons. There was no way to express
+"contains X AND no Y AND no tool calls" structurally — the rule could
+only live as guidance for the agent to follow voluntarily, and the agent
+would forget mid-task. That is the exact drift class
+`feedback_verify_code_before_memory` was filed against.
+
+## What the H grammar unlocks
+
+The AFTER form (in `skills/drift/skill.yaml`) collapses the three
+clauses into a single expression:
+
+```yaml
+if: 'len(drift_hits.matched) > 0 && len(verifications.matched) == 0 && tool_history.count == 0'
+```
+
+That clause is parsed at pack load time (Zod refinement via H.2) and
+evaluated at every Stop event. The agent cannot forget the rule — the
+evaluator runs it whether the agent remembers or not.
+
+## Compression measure
+
+| Form         | LOC of the gate | Enforcement                   |
+| ------------ | --------------- | ----------------------------- |
+| Prose (this) | ~12 lines       | None — guidance only          |
+| Structured   | 1 line          | Evaluator-gated at every Stop |
+
+The pedagogical point: the lift from "explained in English" to
+"structurally enforced" is the H grammar's whole purpose. The more
+expressive `if:` becomes, the more skill logic that used to be
+aspirational prose can move into YAML where it is mechanically checked
+on every event.

package/packs/builtin/examples/multi-clause-drift-detector/SKILL.md

@@ -0,0 +1,90 @@
+# multi-clause-drift-detector — AFTER (structured)
+
+Three-file example demonstrating the prose → YAML migration pattern
+enabled by the H grammar.
+
+| File                      | Purpose                                                        |
+| ------------------------- | -------------------------------------------------------------- |
+| `BEFORE.md`               | Prose-only equivalent, shown for direct comparison             |
+| `SKILL.md` (this file)    | Reader's guide — what the example demonstrates                 |
+| `manifest.yaml`           | Pack identity (`name` / `version` / `scope` / `goal`)          |
+| `skills/drift/skill.yaml` | The structured rule itself — single `if:` clause does the work |
+
+## What this example demonstrates
+
+A single compound `if:` clause replacing what used to be a paragraph of
+prose. Three primitive calls feed bindings into one verdict gate; the
+gate evaluates `len(...)` + `&&` + numeric comparison + dotted path
+access — every operator family the H grammar unlocked over the bounded
+G.5 / G.13 regex grammar.
+
+Reference clause:
+
+```yaml
+if: 'len(drift_hits.matched) > 0 && len(verifications.matched) == 0 && tool_history.count == 0'
+```
+
+## Grammar features exercised
+
+- **`&&` (logical AND)** — two clauses joined; both must be true to fire
+- **`len()` (allow-listed function)** — array length over a primitive
+  result's `.matched` field
+- **`>` and `==` (numeric comparison)** — strict equality + strict
+  ordering, no JS-style coercion (see grammar guide §6 Gotchas)
+- **Dotted path access** — `drift_hits.matched` resolves through the
+  binding map without `Object.hasOwn` proto pollution risk (sandbox
+  guarantee, grammar guide §4)
+
+## Primitive return shapes used
+
+The example's bindings assume the actual primitive shapes exported by
+`src/functions/` as of 2026-05-25:
+
+```typescript
+// src/functions/text_pattern_match.ts
+{ matched: string[]; phrases: { phrase: string; offset: number }[] }
+
+// src/functions/session_tool_history.ts
+{ tools: string[]; count: number }
+```
+
+If a future task changes either shape, this example must update in
+lockstep with the primitive — the `# Example — not load-bearing`
+header signals exactly that fragility expectation.
+
+## How to run it
+
+The example is **not** registered in any `active.json`. To exercise it
+in a dev session:
+
+```bash
+# 1. Validate it loads under the H.2 refinement
+node -e "import('./dist/packs/loader.js').then(m => m.loadPack('packs/builtin/examples/multi-clause-drift-detector')).then(p => console.log('OK', p.skills.length, 'skill(s)'))"
+
+# 2. Run its fixtures via the test suite
+pnpm vitest run test/example-skills.test.ts
+```
+
+## Fixtures
+
+- `fixtures/drift_no_verify.input.json` — drift phrases present + no
+  verification language + no verification tool calls → expected: **1
+  warn verdict** (rule fires).
+- `fixtures/drift_with_verify.input.json` — drift phrases present + at
+  least one verification phrase OR tool call → expected: **0 verdicts**
+  (rule short-circuits).
+
+The test harness at `test/example-skills.test.ts` walks every
+`*.input.json` + `*.expected.json` pair under each example's
+`fixtures/` directory and feeds the `if:` clause through `evalCondition`
+with the binding map encoded in the input fixture.
+
+## Why this example is in the docs
+
+It is the strongest single demonstration that the H grammar's structural
+expressiveness lets MD-prose rules graduate to YAML enforcement.
+`feedback_verify_code_before_memory` is a user-flagged drift class; the
+prose-only version of this rule is exactly the kind of guidance that
+gets forgotten under context pressure. The structured version cannot
+be forgotten — the evaluator runs it whether the agent remembers it or
+not.

package/packs/builtin/examples/multi-clause-drift-detector/fixtures/drift_no_verify.expected.json

@@ -0,0 +1,3 @@
+{
+  "verdict": true
+}

package/packs/builtin/examples/multi-clause-drift-detector/fixtures/drift_no_verify.input.json

@@ -0,0 +1,18 @@
+{
+  "comment": "Drift phrases present, no verification language, no verification tools — the if: clause should evaluate true (rule fires).",
+  "if": "len(drift_hits.matched) > 0 && len(verifications.matched) == 0 && tool_history.count == 0",
+  "bindings": {
+    "drift_hits": {
+      "matched": ["per memory"],
+      "phrases": [{ "phrase": "per memory", "offset": 42 }]
+    },
+    "verifications": {
+      "matched": [],
+      "phrases": []
+    },
+    "tool_history": {
+      "tools": [],
+      "count": 0
+    }
+  }
+}

package/packs/builtin/examples/multi-clause-drift-detector/fixtures/drift_with_verify.expected.json

@@ -0,0 +1,3 @@
+{
+  "verdict": false
+}

package/packs/builtin/examples/multi-clause-drift-detector/fixtures/drift_with_verify.input.json

@@ -0,0 +1,18 @@
+{
+  "comment": "Drift phrases present, but verification language present AND verification tools called this turn — the if: clause should evaluate false (rule does not fire).",
+  "if": "len(drift_hits.matched) > 0 && len(verifications.matched) == 0 && tool_history.count == 0",
+  "bindings": {
+    "drift_hits": {
+      "matched": ["per memory"],
+      "phrases": [{ "phrase": "per memory", "offset": 42 }]
+    },
+    "verifications": {
+      "matched": ["i checked"],
+      "phrases": [{ "phrase": "i checked", "offset": 8 }]
+    },
+    "tool_history": {
+      "tools": ["Bash", "Read"],
+      "count": 2
+    }
+  }
+}

package/packs/builtin/examples/multi-clause-drift-detector/manifest.yaml

@@ -0,0 +1,18 @@
+# Example — not load-bearing. Demonstrates compound `||` + `&&` + `len()`
+# inside a single `if:` clause. Ships under packs/builtin/examples/ as
+# educational material referenced from docs/skill-grammar-guide.md.
+# NOT registered in any `active.json` and NOT loaded by the runtime
+# unless a user explicitly opts in by editing their scope's active.json.
+name: multi-clause-drift-detector
+version: 0.1.0
+scope: universal
+goal: warn on memory-citing or deferring language without paired verification evidence
+description: |
+  Worked example showing how a multi-clause anti-drift rule that used to
+  live only as prose inside a SKILL.md ("if I see X AND not Y, warn") can
+  collapse into a single structured `if:` clause once the H grammar
+  supports `||`, `&&`, `!`, and `len()` together.
+
+  The prose-only equivalent ships alongside as `BEFORE.md` for direct
+  comparison. The structured rule lives in `skills/drift/skill.yaml`.
+evolves: false