phronesis 1.0.0 → 1.1.0

package/src/layout.js

@@ -26,13 +26,13 @@ export const DEFAULT_SKILLS = Object.freeze([
   Object.freeze({ name: 'research', version: '0.1.0' }),
   Object.freeze({ name: 'recall', version: '0.1.0' }),
   Object.freeze({ name: 'lint', version: '0.1.0' }),
-  Object.freeze({ name: 'onboard', version: '0.2.0' }),
+  Object.freeze({ name: 'onboard', version: '0.3.0' }),
   Object.freeze({ name: 'prep-extraction', version: '0.1.0' }),
   Object.freeze({ name: 'extract-gold-dust', version: '0.1.0' }),
   Object.freeze({ name: 'meeting-prep', version: '0.1.1' }),
   Object.freeze({ name: 'stakeholder-update', version: '0.1.0' }),
   Object.freeze({ name: 'decision-log', version: '0.1.0' }),
-  Object.freeze({ name: 'prd-draft', version: '0.1.0' }),
+  Object.freeze({ name: 'prd-draft', version: '0.2.0' }),
 ]);
 
 export function defaultSkillsSection() {
@@ -324,11 +324,11 @@ export function installationGitignore() {
 // the Level-2 skill-lifecycle close, PARTIAL on Codex (no invocation_id minted — no
 // fabricated events, change 0021).
 export const CODEX_ADAPTER_HOOKS = [
-  { event: 'SessionStart', launcher: 'session-start.sh', script: 'session-start.sh', role: 'due-check', tier: 'reinforcement' },
-  { event: 'UserPromptSubmit', launcher: 'recall-guard.sh', script: 'recall-guard.sh', role: 'recall-guard', tier: 'reinforcement' },
-  { event: 'Stop', launcher: 'session-sweep.sh', script: 'session-sweep.sh', role: 'capture-sweep', tier: 'reinforcement' },
-  { event: 'SubagentStop', launcher: 'session-sweep-subagent.sh', script: 'session-sweep.sh', role: 'subagent-lifecycle-close', tier: 'lifecycle' },
-  { event: 'PreCompact', launcher: 'session-sweep-precompact.sh', script: 'session-sweep.sh', role: 'compaction-reminder', tier: 'reinforcement' },
+  { event: 'SessionStart', launcher: 'session-start.sh', hookEvent: 'session-start', role: 'due-check', tier: 'reinforcement' },
+  { event: 'UserPromptSubmit', launcher: 'recall-guard.sh', hookEvent: 'recall-guard', role: 'recall-guard', tier: 'reinforcement' },
+  { event: 'Stop', launcher: 'session-sweep.sh', hookEvent: 'session-sweep', role: 'capture-sweep', tier: 'reinforcement' },
+  { event: 'SubagentStop', launcher: 'session-sweep-subagent.sh', hookEvent: 'session-sweep-subagent', role: 'subagent-lifecycle-close', tier: 'lifecycle' },
+  { event: 'PreCompact', launcher: 'session-sweep-precompact.sh', hookEvent: 'session-sweep-precompact', role: 'compaction-reminder', tier: 'reinforcement' },
 ];
 const CODEX_SURFACE_HOOKS = CODEX_ADAPTER_HOOKS.map((h) => h.launcher);
 // Every file under codex-surface/hooks/ that init emits: the per-event launchers plus the
@@ -372,6 +372,50 @@ export function templateCopies(slug = DEFAULT_DOMAIN) {
   ];
 }
 
+// The D9 hook-refresh partition is derived from the same copies createInstallation()
+// emits. Keep the selection here, beside templateCopies(), so refresh/upgrade code
+// never grows a second hand-maintained path manifest. The Claude settings file is a
+// Class-C entry: only its Phronesis hook entries are managed. The two hook directories
+// are closed only for reporting purposes — unknown siblings are extra-unknown and are
+// never refresh targets.
+export function hookManifestCopies(slug = DEFAULT_DOMAIN) {
+  return templateCopies(slug).flatMap((copy) => {
+    if (copy.from === 'claude/settings.json') {
+      return [{
+        ...copy,
+        kind: 'claude-hook-entries',
+        shippedTemplate: `templates/${copy.from}#phronesis-hook-entries`,
+        scanUnknownSiblings: false,
+      }];
+    }
+    if (copy.from.startsWith('phronesis-hooks/')) {
+      return [{
+        ...copy,
+        kind: 'file',
+        shippedTemplate: `templates/${copy.from}`,
+        scanUnknownSiblings: true,
+      }];
+    }
+    if (copy.from === 'codex-surface/hooks.json') {
+      return [{
+        ...copy,
+        kind: 'file',
+        shippedTemplate: `templates/${copy.from}`,
+        scanUnknownSiblings: false,
+      }];
+    }
+    if (copy.from.startsWith('codex-surface/hooks/')) {
+      return [{
+        ...copy,
+        kind: 'file',
+        shippedTemplate: `templates/${copy.from}`,
+        scanUnknownSiblings: true,
+      }];
+    }
+    return [];
+  });
+}
+
 // Default V1 skills copied from repo-root skills/ into operator installs. The
 // rubric is runtime-referenced by every SKILL.md body; golden cases and dev notes
 // deliberately stay out of installs.

package/src/profile.js

@@ -9,6 +9,7 @@
 
 import { join } from 'node:path';
 import { readFile, writeFile } from 'node:fs/promises';
+import { resolveInstall, resolveDomain } from '@phronesis/core';
 
 // AGENTS.md §1 is always-loaded and ≤8192 bytes; per-field caps bound the worst case so a
 // pathological --name can't blow the budget (the budget check in fillOperatorProfile is the backstop).
@@ -114,3 +115,171 @@ export async function fillOperatorProfile(installRoot, domain, profile = {}) {
   await writeFile(userPath, userNext);
   if (agentsNext !== null) await writeFile(agentsPath, agentsNext);
 }
+
+// core-0062 D1: in-place, NON-DESTRUCTIVE update of the stamped operator profile — the repair
+// verb for the F2 friction (non-interactive `init` ships `[Name]`/`[Role]` and today's only
+// remedy is a destructive `--force` re-init). Unlike fillOperatorProfile (a one-time placeholder
+// fill), this updates the FIELDS whatever their current value. It touches only the stamped field
+// lines, never surrounding operator prose; if a field line cannot be located UNIQUELY the file
+// has diverged and it FAILS CLOSED with the manual path (refuse, never guess). Both files are
+// computed before either is written (the fillOperatorProfile atomicity lesson).
+function replaceUniqueLine(text, re, value, label, file) {
+  const hits = text.match(new RegExp(re.source, 'gm'));
+  if (!hits || hits.length !== 1) {
+    throw new Error(
+      `could not locate a unique "${label}" line in ${file} (found ${hits ? hits.length : 0}) — the file has diverged; edit it by hand.`,
+    );
+  }
+  return text.replace(re, () => value); // function replacer: value is literal (the $-token lesson from fill)
+}
+
+export async function updateOperatorProfile(installRoot, domain, profile = {}) {
+  const { name, role, company, workingStyle } = profile;
+  if (name === undefined && role === undefined && company === undefined && workingStyle === undefined) {
+    throw new Error('nothing to update — pass at least one of --name, --role, --company, --working-style.');
+  }
+
+  const userPath = join(installRoot, 'domains', domain, 'USER.md');
+  const agentsPath = join(installRoot, 'domains', domain, 'AGENTS.md');
+
+  let userNext;
+  try {
+    userNext = await readFile(userPath, 'utf8');
+  } catch {
+    throw new Error(`${userPath} not found — run this inside an install (\`phronesis init\`).`);
+  }
+
+  // Fail-closed completeness (Codex F3): validate the WHOLE stamped block before any change, not
+  // just the fields being set. Required anchors must each appear exactly once (so a later
+  // first-match read of an UNMODIFIED field, or the optional-append `- Role:` anchor, can never
+  // silently pick the wrong one); optional lines at most once. A diverged file is refused whole.
+  for (const [label, re] of [
+    ['# USER —', /^# USER — .*$/gm],
+    ['- Name:', /^- Name: .*$/gm],
+    ['- Role:', /^- Role: .*$/gm],
+  ]) {
+    const n = (userNext.match(re) || []).length;
+    if (n !== 1) {
+      throw new Error(`expected exactly one "${label}" line in ${userPath}, found ${n} — the file has diverged; edit it by hand.`);
+    }
+  }
+  for (const [label, re] of [['- Company:', /^- Company: .*$/gm], ['- Working style:', /^- Working style: .*$/gm]]) {
+    const n = (userNext.match(re) || []).length;
+    if (n > 1) {
+      throw new Error(`expected at most one "${label}" line in ${userPath}, found ${n} — the file has diverged; edit it by hand.`);
+    }
+  }
+
+  if (name !== undefined) {
+    userNext = replaceUniqueLine(userNext, /^# USER — .*$/m, `# USER — ${name}`, '# USER —', userPath);
+    userNext = replaceUniqueLine(userNext, /^- Name: .*$/m, `- Name: ${name}`, '- Name:', userPath);
+  }
+  if (role !== undefined) {
+    userNext = replaceUniqueLine(userNext, /^- Role: .*$/m, `- Role: ${role}`, '- Role:', userPath);
+  }
+  // company / working-style are USER.md-only (mirror init): update the line in place if present,
+  // else append after the "- Role:" line (init's insertion point). No new fields beyond init's set.
+  for (const [prefix, value] of [['- Company:', company], ['- Working style:', workingStyle]]) {
+    if (value === undefined) continue;
+    const lineRe = new RegExp(`^${prefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')} .*$`, 'm');
+    if (lineRe.test(userNext)) {
+      userNext = replaceUniqueLine(userNext, lineRe, `${prefix} ${value}`, prefix, userPath);
+    } else {
+      const withLine = userNext.replace(/^(- Role:.*)$/m, (m) => `${m}\n${prefix} ${value}`);
+      if (withLine === userNext) {
+        throw new Error(`the "- Role:" anchor to add a "${prefix}" line is missing in ${userPath} — edit it by hand.`);
+      }
+      userNext = withLine;
+    }
+  }
+
+  // AGENTS.md §1 identity line — only when name/role changed (company/working-style are USER.md-only).
+  // Reconstruct the always-loaded line from USER.md's NOW-current fields (the source of truth), so
+  // an unchanged field is preserved without parsing the prose line. Then budget-check (≤8192).
+  let agentsNext = null;
+  if (name !== undefined || role !== undefined) {
+    let agents;
+    try {
+      agents = await readFile(agentsPath, 'utf8');
+    } catch {
+      throw new Error(`${agentsPath} not found — cannot update the always-loaded operator line.`);
+    }
+    const effName = (userNext.match(/^- Name: (.*)$/m) || [])[1];
+    const effRole = (userNext.match(/^- Role: (.*)$/m) || [])[1];
+    if (effName === undefined || effRole === undefined) {
+      throw new Error(`USER.md is missing a "- Name:"/"- Role:" line to derive the AGENTS.md operator line in ${agentsPath} — edit by hand.`);
+    }
+    const newLine = `${effName}, ${effRole}. Profile + preferences: \`USER.md\`.`;
+    // Fail-closed (Codex F2): require EXACTLY one "## 1. Operator" section, and that the line we
+    // would rewrite actually IS the identity line — it references `USER.md`. A note or comment an
+    // operator inserted right under the heading must not be silently overwritten.
+    const headingCount = (agents.match(/^##\s*1\.\s*Operator[ \t]*$/gm) || []).length;
+    if (headingCount !== 1) {
+      throw new Error(`expected exactly one "## 1. Operator" section in ${agentsPath}, found ${headingCount} — the file has diverged; edit it by hand.`);
+    }
+    const sectionRe = /(^##\s*1\.\s*Operator[ \t]*\n\n)([^\n]+)(\n)/m;
+    const sm = agents.match(sectionRe);
+    if (!sm || !/USER\.md/.test(sm[2])) {
+      throw new Error(`the "## 1. Operator" line in ${agentsPath} is not the stamped operator line (expected one referencing \`USER.md\`) — edit it by hand.`);
+    }
+    agentsNext = agents.replace(sectionRe, (full, pre, _line, post) => `${pre}${newLine}${post}`);
+    const byteLen = Buffer.byteLength(agentsNext, 'utf8');
+    if (byteLen > AGENTS_BUDGET) {
+      throw new Error(`update would push AGENTS.md to ${byteLen} bytes, over the ${AGENTS_BUDGET}-byte always-loaded budget — shorten --name/--role.`);
+    }
+  }
+
+  await writeFile(userPath, userNext);
+  if (agentsNext !== null) await writeFile(agentsPath, agentsNext);
+}
+
+// `phronesis profile set` — the CLI surface over updateOperatorProfile. Resolves the install +
+// domain (through the shared resolver, so a single-domain install works and a multi-domain one is
+// refused, never guessed), sanitizes with init's exact field caps, fails closed with the manual
+// path, and never touches an existing install without a value (no --force anywhere in the flow).
+export async function runProfileSet({ dir, domain, name, role, company, workingStyle } = {}) {
+  const installed = resolveInstall({ dir, cwd: process.cwd() });
+  if (installed.error) {
+    console.error(installed.error);
+    process.exitCode = 1;
+    return null;
+  }
+  const installRoot = installed.root;
+
+  // Domain resolution rides the ONE shared resolver — no profile-specific copy (the "one
+  // resolver, every verb inherits" rule). Since core-0061 that resolver defaults to the sole
+  // registered domain (whatever its slug) and refuses an ambiguous multi-domain install, so
+  // `profile set` inherits both behaviors for free.
+  let resolvedDomain;
+  try {
+    const registry = JSON.parse(await readFile(join(installRoot, '.phronesis', 'registry.json'), 'utf8'));
+    resolvedDomain = resolveDomain({ installRoot, registry, domain, cwd: process.cwd() });
+  } catch (err) {
+    console.error(`profile set: ${err.message}`);
+    process.exitCode = 1;
+    return null;
+  }
+
+  let profile;
+  try {
+    profile = {
+      name: sanitizeProfileField(name, FIELD_MAX.name),
+      role: sanitizeProfileField(role, FIELD_MAX.role),
+      company: sanitizeProfileField(company, FIELD_MAX.company),
+      workingStyle: sanitizeProfileField(workingStyle, FIELD_MAX.workingStyle),
+    };
+    await updateOperatorProfile(installRoot, resolvedDomain, profile);
+  } catch (err) {
+    console.error(`profile set: ${err.message}`);
+    process.exitCode = 1;
+    return null;
+  }
+
+  process.exitCode = 0;
+  const updated = Object.entries(profile).filter(([, v]) => v !== undefined).map(([k]) => k);
+  const touchesAgents = profile.name !== undefined || profile.role !== undefined;
+  console.log(
+    `profile set: updated ${updated.join(', ')} in domains/${resolvedDomain}/USER.md${touchesAgents ? ' + AGENTS.md' : ''}.`,
+  );
+  return { domain: resolvedDomain, updated };
+}

package/src/prompts.js

@@ -1,5 +1,7 @@
 import Enquirer from 'enquirer';
 
+export const PERSISTENCE_PROMPT = 'Install the `phronesis` command so automatic hooks work? [Y/n]';
+
 // Confirm replacing a non-empty target. Interactive surfaces only; non-TTY
 // callers (CI, the fitness probe) fail closed and require --force instead.
 export async function confirmOverwrite(targetDir) {
@@ -24,3 +26,89 @@ export async function promptProfile({ name, role } = {}) {
   const enquirer = new Enquirer();
   return enquirer.prompt(questions);
 }
+
+export function persistencePromptQuestion({ message = PERSISTENCE_PROMPT } = {}) {
+  return yesNoPromptQuestion({ name: 'persist', message, initial: 'y' });
+}
+
+export function yesNoPromptQuestion({ name = 'confirmed', message, initial = 'n' } = {}) {
+  return {
+    type: 'input',
+    name,
+    message,
+    initial,
+    format(value) {
+      return String(value ?? '').toLowerCase();
+    },
+    validate(value) {
+      return /^(?:y|yes|n|no)$/i.test(String(value ?? '').trim()) || 'Enter y or n.';
+    },
+    result(value) {
+      return !/^n/i.test(String(value ?? '').trim());
+    },
+  };
+}
+
+// D4 persistence consent. The caller owns the TTY gate. The ratified string is
+// the actual Enquirer message; input formatting and result coercion use Enquirer's
+// supported prompt seams, so the visible [Y/n] text is neither inferred nor dropped.
+export async function confirmPersistence({ message = PERSISTENCE_PROMPT } = {}) {
+  const enquirer = new Enquirer();
+  const { persist } = await enquirer.prompt(persistencePromptQuestion({ message }));
+  return persist;
+}
+
+async function confirmYesNo(message) {
+  const enquirer = new Enquirer();
+  const { confirmed } = await enquirer.prompt(yesNoPromptQuestion({ message, initial: 'n' }));
+  return confirmed;
+}
+
+export function hookRestampPromptMessage(entry) {
+  if (entry.status === 'current' && entry.disposition === 'unstamped') {
+    return `UNSTAMPED CURRENT: record hook provenance for ${entry.path} without rewriting its bytes? [y/N]`;
+  }
+  if (entry.disposition === 'operator-modified') {
+    return `OPERATOR-MODIFIED: re-stamp only ${entry.path} from ${entry.shippedTemplate}, discarding its reviewed hook-file edit? [y/N]`;
+  }
+  if (entry.disposition === 'unstamped') {
+    return `UNSTAMPED: re-stamp only ${entry.path} from ${entry.shippedTemplate}? [y/N]`;
+  }
+  return `Re-stamp ${entry.path} from ${entry.shippedTemplate}? [y/N]`;
+}
+
+// D9 consent has two distinct authorities: the all-files offer covers only
+// stamped, safely-attributable engine updates; every unstamped/conflicted path
+// requires its own visibly dispositioned confirmation. Default no is fail-closed.
+export async function confirmHookRestamp({ entries = [], confirm = confirmYesNo } = {}) {
+  if (!entries.length) return { blanket: [], targeted: [] };
+  const safe = entries.filter(({ disposition }) => disposition === 'safe');
+  const blanket = [];
+  const targeted = [];
+  let allSafe = false;
+  if (safe.length) {
+    allSafe = await confirm(
+      `Re-stamp all ${safe.length} safely attributable Phronesis hook paths from current shipped templates? [y/N]`,
+    );
+    if (allSafe) blanket.push(...safe.map(({ path }) => path));
+  }
+
+  for (const entry of entries) {
+    if (allSafe && entry.disposition === 'safe') continue;
+    const accepted = await confirm(hookRestampPromptMessage(entry));
+    if (accepted) targeted.push(entry.path);
+  }
+  return { blanket, targeted };
+}
+
+export async function confirmPathAppend({ profilePath } = {}) {
+  const enquirer = new Enquirer();
+  const { append } = await enquirer.prompt({
+    type: 'confirm',
+    name: 'append',
+    message: `Append the disclosed PATH line to ${profilePath}?`,
+    initial: true,
+    default: '[Y/n]',
+  });
+  return append;
+}

package/src/skills-bump.js

@@ -179,8 +179,42 @@ export function aggregateFloor(perRunResults, {
 
   // Quality — collect per-criterion score vectors across every run.
   const perCriterion = new Map();
+  const applicabilityDeclared = runs.some((run) => Array.isArray(run?.rubric_criteria_exercised));
+  if (applicabilityDeclared && runs.some((run) => !Array.isArray(run?.rubric_criteria_exercised))) {
+    throw new Error('inconsistent rubric applicability: every run must declare rubric_criteria_exercised when any run does');
+  }
+  const keyByNumber = new Map();
   for (const run of runs) {
     const scores = extractCriterionScores(run.per_run_scores);
+    if (applicabilityDeclared) {
+      const declared = run.rubric_criteria_exercised.map(Number).sort((a, b) => a - b);
+      if (
+        declared.length === 0 ||
+        declared.some((n) => !Number.isInteger(n) || n < 1) ||
+        new Set(declared).size !== declared.length
+      ) {
+        throw new Error('inconsistent rubric applicability: declarations must be unique positive integers');
+      }
+      const scored = Object.keys(scores).map((key) => {
+        // House format is c{n}_{slug} (core-0066 item 7): require the underscore so this
+        // agrees with judge.py select_rubric_criteria (which matches `c(\d+)_`). A bare
+        // `cN` is rejected in BOTH surfaces rather than silently accepted on one.
+        const match = /^c(\d+)_/.exec(key);
+        if (!match) throw new Error(`criterion "${key}" has no numbered cN_ prefix`);
+        const number = Number(match[1]);
+        const prior = keyByNumber.get(number);
+        if (prior && prior !== key) {
+          throw new Error(`criterion ${number} changed key across runs (${prior} vs ${key})`);
+        }
+        keyByNumber.set(number, key);
+        return number;
+      }).sort((a, b) => a - b);
+      if (JSON.stringify(scored) !== JSON.stringify(declared)) {
+        throw new Error(
+          `inconsistent rubric scoring: declared criteria [${declared.join(', ')}] but judge scored [${scored.join(', ')}]`,
+        );
+      }
+    }
     for (const [crit, score] of Object.entries(scores)) {
       if (!perCriterion.has(crit)) perCriterion.set(crit, []);
       perCriterion.get(crit).push(score);
@@ -191,7 +225,7 @@ export function aggregateFloor(perRunResults, {
   const criteria = {};
   let qualityPasses = true;
   for (const [crit, vec] of perCriterion) {
-    if (vec.length !== runs.length) {
+    if (!applicabilityDeclared && vec.length !== runs.length) {
       throw new Error(
         `criterion "${crit}" scored in ${vec.length}/${runs.length} runs — inconsistent rubric scoring`,
       );
@@ -199,7 +233,13 @@ export function aggregateFloor(perRunResults, {
     const min = Math.min(...vec);
     const passes = min >= qualityFloor;
     if (!passes) qualityPasses = false;
-    criteria[crit] = { min, max: Math.max(...vec), scores: vec, passes };
+    criteria[crit] = {
+      min,
+      max: Math.max(...vec),
+      scores: vec,
+      applicable_runs: vec.length,
+      passes,
+    };
   }
 
   // Coverage — per-run hit-rate + fabrication tally. `asserted` is false when NO run
@@ -548,6 +588,7 @@ export async function bumpSkill(opts, deps) {
     k = DEFAULT_K,
     rebaseline = false,
     acceptRegression = false,
+    verifyCurrent = false,
     shapeChange = false,
     qualityFloor = DEFAULT_QUALITY_FLOOR,
     coverageFloor = DEFAULT_COVERAGE_FLOOR,
@@ -615,6 +656,20 @@ export async function bumpSkill(opts, deps) {
   const source = await readFile(skillPath, 'utf8');
   const currentVersion = readFrontmatterField(source, 'version');
   const currentPin = readFrontmatterField(source, 'prompt_pin');
+  if (verifyCurrent) {
+    if (rebaseline || acceptRegression || shapeChange) {
+      return {
+        status: 'invalid',
+        error: '--verify-current cannot be combined with --rebaseline, --accept-regression, or --shape-change',
+      };
+    }
+    if (pin.raw !== currentPin) {
+      return {
+        status: 'invalid',
+        error: `--verify-current requires --to to equal the deployed prompt_pin (${currentPin}); got ${pin.raw}`,
+      };
+    }
+  }
 
   const rubricPath = join(skillDir, 'evals', 'rubric.md');
   if (!existsSync(rubricPath)) {
@@ -653,11 +708,17 @@ export async function bumpSkill(opts, deps) {
   const expectedIds = expectedGoldenIds(goldens);
   const perRun = [];
   for (let i = 0; i < k; i += 1) {
+    // A gate run uses one logical evaluation instant, but raw evidence files must be
+    // collision-proof even when two repeats produce byte-identical results. Offset the
+    // evidence timestamp by one millisecond per repeat without changing model context.
+    const evidenceNow = now instanceof Date ? new Date(now.getTime() + i) : now;
     const results = await runCandidates({
       goldens,
       skill: parsedSkill,
       promptBody,
       modelId: pin.modelId,
+      promptPin: pin.raw,
+      writeResults: true,
       judge,
       // Pass the judge model AND the exact rubric bytes the identity was hashed from, so
       // "the scores were produced under THIS judge + THIS rubric" is an enforced invariant,
@@ -665,7 +726,7 @@ export async function bumpSkill(opts, deps) {
       // default judge.py to sonnet and re-read the rubric from its own repo root).
       judgeOptions: { model: judgeModel, rubricText: rubric },
       activeDomain,
-      now,
+      now: evidenceNow,
     });
     // Verify the substrate returned EXACTLY one result per golden — no missing, duplicate,
     // or extraneous golden id. A partial substrate failure that silently dropped a hard
@@ -813,7 +874,7 @@ export async function bumpSkill(opts, deps) {
     }
 
     // --- Pass / override / rebaseline: write pin + version + PINS record -------
-    const newVersion = bumpVersion(currentVersion, component);
+    const newVersion = verifyCurrent ? currentVersion : bumpVersion(currentVersion, component);
     const kind = mode === 'rebaseline' ? 'rebaseline' : verdict.status === 'regression' ? 'override' : 'baseline';
 
     const record = {
@@ -824,6 +885,7 @@ export async function bumpSkill(opts, deps) {
       accepted_at: (now || new Date()).toISOString(),
       scores,
       identity: newIdentity,
+      ...(verifyCurrent ? { verified_current: true } : {}),
     };
     if (kind === 'override') {
       record.from_pin = currentPin;
@@ -842,21 +904,25 @@ export async function bumpSkill(opts, deps) {
     // same body and re-passes) rather than a pinned skill with no baseline (which the next
     // bump would mistake for a first bump and re-seed without a regression check — a
     // silent-regression hole).
-    const newSource = rewriteSkillFrontmatter(source, { pin: pin.raw, version: newVersion });
+    const newSource = verifyCurrent
+      ? source
+      : rewriteSkillFrontmatter(source, { pin: pin.raw, version: newVersion });
     await atomicWrite(pinsPath, appendPinsRecord(pinsText, record));
-    try {
-      await atomicWrite(skillPath, newSource);
-    } catch (err) {
-      return {
-        ...base,
-        status: 'error',
-        reason: 'pin-write-failed',
-        record,
-        written: { pins: pinsPath },
-        message:
-          `the PINS.md baseline for ${pin.raw} was recorded, but writing the pin to ${skillPath} failed ` +
-          `(${err.message}). Re-run the bump to complete it — the skill body is unchanged, so it will re-pass.`,
-      };
+    if (!verifyCurrent) {
+      try {
+        await atomicWrite(skillPath, newSource);
+      } catch (err) {
+        return {
+          ...base,
+          status: 'error',
+          reason: 'pin-write-failed',
+          record,
+          written: { pins: pinsPath },
+          message:
+            `the PINS.md baseline for ${pin.raw} was recorded, but writing the pin to ${skillPath} failed ` +
+            `(${err.message}). Re-run the bump to complete it — the skill body is unchanged, so it will re-pass.`,
+        };
+      }
     }
 
     const coverageNote = !aggregate.coverage.asserted
@@ -870,9 +936,11 @@ export async function bumpSkill(opts, deps) {
       kind,
       version: newVersion,
       record,
-      written: { skill: skillPath, pins: pinsPath },
+      written: verifyCurrent ? { pins: pinsPath } : { skill: skillPath, pins: pinsPath },
       message:
-        kind === 'override'
+        verifyCurrent
+          ? `verified ${skill} at its current deployment unit ${pin.raw} (v${newVersion}); baseline recorded in PINS.md${coverageNote}`
+          : kind === 'override'
           ? `bumped ${skill} to ${pin.raw} (v${newVersion}) — REGRESSION ACCEPTED; override recorded in PINS.md${coverageNote}`
           : kind === 'rebaseline'
             ? `rebaselined ${skill} to ${pin.raw} (v${newVersion}) under the new evaluation identity${coverageNote}`