phronesis 1.0.0

package/vendor/core/src/skill-registry.js

@@ -0,0 +1,524 @@
+// The skill registry layer (core-0015 / T3.1; specs/skills.md §"Frontmatter contract" /
+// §"Skill registry" / §"Runtime-free invocation"; change 0013 D3 deterministic half;
+// per-packet decisions S1–S10 in harness/tasks/core-0015-skill-registry.md).
+//
+// `.phronesis/registry.json`'s `skills` section (RESERVED since core-0011, CONSUMED
+// here) declares installed skills and versions: name → { version }. The skill file
+// path is DERIVED — `skills/{name}/SKILL.md` — a fixed contract like target_layout,
+// never a config field. This module loads registered skills and validates each against
+// the published frontmatter contract, plus the deterministic half of the runtime-free
+// portability gate (change 0013 D3):
+//
+//   - the body carries a "Without the runtime" section (degrade instructions travel in
+//     the skill body, never the runtime);
+//   - that section declares a degrade target that PARSES to the canonical capture
+//     pattern domains/{domain}/raw/degraded/YYYY-MM-DD-{skill}-{slug}.md;
+//   - the read path names no runtime invocation (reads are plain path globs — a skill
+//     readable runtime-free cannot depend on `phronesis <cmd>` to read).
+//
+// Failure policy (S2, the G3 lineage): an ABSENT skills section means no skills
+// registered (additive-optional — absence can never loosen anything; no schema_version
+// bump). A PRESENT-but-invalid section, or any invalid registered skill, fails closed
+// ALL-OR-NOTHING with errors naming the file and field. The skills layer is a SEPARATE
+// failure domain from the action layer: no skill execution exists in the act pipeline,
+// so invalid skills never disable `act` — but `skills status` is loud and total.
+//
+// Every validation here looks up names with Object.hasOwn / own-property iteration
+// (core-0011 rule: a skill or action type named `constructor` must fail closed, never
+// resolve up the prototype chain), and `null` is PRESENT-and-invalid, never "absent"
+// (core-0008 rule — agents fill optional JSON/YAML fields with null constantly).
+
+import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import yaml from 'js-yaml';
+import { RE_SLUG, SLUG_SOURCE, DATE_RE } from './contract.js';
+import { REGISTRY_SCHEMA_VERSIONS } from './action-registry.js';
+import { matchFrontmatterBlock } from './workspace-scan.js';
+
+export const SKILL_WEIGHTS = ['light', 'heavy'];
+export const MODEL_TIERS = ['standard', 'large', 'frontier'];
+
+const SKILL_ENTRY_KEYS = ['version'];
+const FM_KEYS = [
+  'name',
+  'version',
+  'invocation',
+  'weight',
+  'reads',
+  'writes',
+  'sub_agents',
+  'requires_model_tier',
+  'prompt_pin',
+];
+// sub_agents is the contract's one optional field; everything else is required.
+const REQUIRED_FM_KEYS = FM_KEYS.filter((k) => k !== 'sub_agents');
+const INVOCATION_KEYS = ['explicit', 'suggested', 'woven'];
+
+// SemVer (major.minor.patch, optional prerelease/build) — the spec's `version` grammar.
+const RE_SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+// Path-glob grammar for reads/direct-write declarations (S5) — the deterministic
+// "read path names no runtime invocation" half. Whitespace and backticks are what a
+// command invocation needs and a path never does; the charset closes the rest.
+const RE_PATH_GLOB = /^[A-Za-z0-9_.\-*/{}]+$/;
+// Placeholders the path grammar admits. A typo'd placeholder ({active_domian}) is
+// silent intent-drop — nothing would ever expand it — so membership is checked.
+const PATH_PLACEHOLDERS = ['{active_domain}', '{domain}', '{skill}', '{slug}', '{name}'];
+
+export function skillFilePath(name) {
+  return `skills/${name}/SKILL.md`;
+}
+
+function isPlainObject(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+// --- Registry section (S1) -------------------------------------------------------------
+
+// Validate the top-level `skills` section: name → { version }. Absent ⇒ no skills
+// registered. Present-but-invalid ⇒ the caller fails the skills layer all-or-nothing.
+export function resolveSkillsSection(registry) {
+  const errors = [];
+  if (!isPlainObject(registry)) {
+    return { errors: ['.phronesis/registry.json must be a JSON object'], section: {} };
+  }
+  const section = registry.skills;
+  if (section === undefined) return { errors, section: {} };
+  // Version discipline (core-0011 rule; tightened by the core-0015 adversarial
+  // review): this loader is a standalone export, so it cannot lean on the action
+  // layer's version check having run first — an unknown version fails closed HERE,
+  // and version 0 contradicts the section's existence (it predates it).
+  if (!REGISTRY_SCHEMA_VERSIONS.includes(registry.schema_version)) {
+    errors.push(
+      `schema_version ${JSON.stringify(registry.schema_version)} is not a known registry version (${REGISTRY_SCHEMA_VERSIONS.join(', ')}) — the skills section cannot be interpreted under an unknown shape`,
+    );
+  } else if (registry.schema_version === 0) {
+    errors.push(
+      'skills requires schema_version 1 — a version-0 registry predates the section (bump the version, or remove the section: absent means no skills registered)',
+    );
+  }
+  if (!isPlainObject(section)) {
+    errors.push('skills: must be an object mapping skill name → { version } (skills.md §"Skill registry")');
+    return { errors, section: {} };
+  }
+  for (const [name, entry] of Object.entries(section)) {
+    if (!RE_SLUG.test(name)) {
+      errors.push(`skills.${name}: skill names are kebab-case slugs (the name is the directory under skills/)`);
+      continue;
+    }
+    if (entry === null) {
+      errors.push(`skills.${name}: null is not "absent" — remove the entry instead (removal unregisters the skill)`);
+      continue;
+    }
+    if (!isPlainObject(entry)) {
+      errors.push(`skills.${name}: must be an object with a version field`);
+      continue;
+    }
+    const unknown = Object.keys(entry).filter((k) => !SKILL_ENTRY_KEYS.includes(k));
+    if (unknown.length) {
+      errors.push(
+        `skills.${name}: unknown key(s): ${unknown.join(', ')} (the registry declares installed skills and versions — the file path is derived from the name, never configured)`,
+      );
+    }
+    if (typeof entry.version !== 'string' || !RE_SEMVER.test(entry.version)) {
+      errors.push(`skills.${name}: version must be a SemVer string (got ${JSON.stringify(entry.version)})`);
+    }
+  }
+  if (errors.length) return { errors, section: {} };
+  return { errors, section };
+}
+
+// --- Field validators ------------------------------------------------------------------
+
+export function parsePromptPin(value) {
+  if (typeof value !== 'string') return null;
+  const at = value.lastIndexOf('@');
+  if (at <= 0 || at === value.length - 1) return null;
+  const model = value.slice(0, at);
+  const date = value.slice(at + 1);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(model)) return null;
+  if (!DATE_RE.test(date)) return null;
+  return { model, date };
+}
+
+// One path-glob entry (S5). `field` names the declaration in the error. Returns the
+// error string or null.
+function pathGlobError(field, entry) {
+  if (typeof entry !== 'string' || entry === '') {
+    return `${field}: each entry must be a non-empty path string`;
+  }
+  // KNOWN LIMIT: the runtime-invocation refusal is first-segment (after a stripped
+  // leading ./) — `bin/phronesis` passes as a path. A deeper `phronesis` segment can
+  // be a legitimate workspace path (raw/research/phronesis/…), so the check stays
+  // narrow; the whitespace/backtick refusals below close the actual command shapes.
+  const head = entry.replace(/^(?:\.\/)+/, '').split('/')[0];
+  if (head === 'phronesis' || /(^|\s)phronesis\s/.test(entry)) {
+    return `${field}: "${entry}" names a runtime invocation — runtime-free reads are plain file reads over plain Markdown, never a phronesis command (skills.md §"Runtime-free invocation")`;
+  }
+  if (/\s/.test(entry) || entry.includes('`')) {
+    return `${field}: "${entry}" is not a plain path glob (whitespace/backticks) — declarations name files, never commands`;
+  }
+  if (entry.startsWith('/') || entry.startsWith('~')) {
+    return `${field}: "${entry}" must be a workspace-relative path (the workflow travels with the export — absolute paths do not)`;
+  }
+  if (entry.includes('\\')) {
+    return `${field}: "${entry}" must be a POSIX path`;
+  }
+  if (entry.split('/').includes('..')) {
+    return `${field}: "${entry}" contains a ".." segment — declarations never escape the workspace`;
+  }
+  if (!RE_PATH_GLOB.test(entry)) {
+    return `${field}: "${entry}" is not a plain path glob (allowed: letters, digits, _ . - * / and {placeholder})`;
+  }
+  const residue = entry.replace(/\{[^{}]*\}/g, (tok) => (PATH_PLACEHOLDERS.includes(tok) ? '' : tok));
+  if (residue.includes('{') || residue.includes('}')) {
+    return `${field}: "${entry}" uses an unknown placeholder (known: ${PATH_PLACEHOLDERS.join(', ')}) — a placeholder nothing expands is silent intent-drop`;
+  }
+  return null;
+}
+
+// A direct-write path additionally never targets compiled/ or codex/ — a skill never
+// writes those directly, with or without the runtime (skills.md Principle).
+function directWriteError(entry) {
+  const err = pathGlobError('writes', entry);
+  if (err) return err;
+  // Case-INSENSITIVE: the primary install target (macOS APFS) is case-insensitive,
+  // so Compiled/ IS compiled/ at write time (adversarial review of core-0015 — the
+  // gate condition must match the invariant, not the byte-exact spelling).
+  const segments = entry.split('/').map((s) => s.toLowerCase());
+  if (segments.includes('compiled') || segments.includes('codex')) {
+    return `writes: "${entry}" targets ${segments.includes('codex') ? 'codex/' : 'compiled/'} — canonical mutation flows through action types only; a skill never writes compiled/ or codex/ directly (skills.md Principle)`;
+  }
+  return null;
+}
+
+// --- Degrade section (S6 — the change-0013 D3 deterministic half) -----------------------
+
+const DEGRADE_HEADING_RE = /^(#{2,4})[ \t]+Without the runtime[ \t]*$/;
+const FENCE_RE = /^ {0,3}(?:```|~~~)/;
+
+// Extract the "Without the runtime" section's text: from its heading to the next
+// heading of the same or higher level, or EOF. FENCE-AWARE, both directions
+// (adversarial review of core-0015): a `## Without the runtime` line inside a fenced
+// code block must not SATISFY the check (a quoted example is not a section), and a
+// `#`-prefixed line inside a fence within the real section must not TERMINATE it
+// early (degrade sections plausibly carry fenced capture-template examples). Fenced
+// lines INSIDE the section stay in the returned text — a target declared in a fenced
+// example still counts as declared.
+function degradeSection(body) {
+  const lines = body.split('\n');
+  let fenced = false;
+  let level = null;
+  let start = -1;
+  for (let i = 0; i < lines.length; i += 1) {
+    if (FENCE_RE.test(lines[i])) {
+      fenced = !fenced;
+      continue;
+    }
+    if (fenced) continue;
+    if (level === null) {
+      const m = lines[i].match(DEGRADE_HEADING_RE);
+      if (m) {
+        level = m[1].length;
+        start = i + 1;
+      }
+      continue;
+    }
+    if (new RegExp(`^#{1,${level}}[ \\t]+`).test(lines[i])) {
+      return lines.slice(start, i).join('\n');
+    }
+  }
+  if (level === null) return null;
+  return lines.slice(start).join('\n');
+}
+
+// The canonical capture pattern the declared target must parse to (skills.md
+// §"Runtime-free invocation"): domains/{domain}/raw/degraded/YYYY-MM-DD-{skill}-{slug}.md.
+// The domain segment may be the {domain}/{active_domain} placeholder or a literal slug;
+// the skill segment may be the {skill} placeholder or this skill's own name.
+function degradeTargetRe(name) {
+  const domain = `(?:\\{domain\\}|\\{active_domain\\}|${SLUG_SOURCE})`;
+  const skill = `(?:\\{skill\\}|${name})`;
+  return new RegExp(`^domains/${domain}/raw/degraded/YYYY-MM-DD-${skill}-\\{slug\\}\\.md$`);
+}
+
+function checkDegradeContract(name, body, errors) {
+  const section = degradeSection(body);
+  if (section === null) {
+    errors.push(
+      'body carries no "Without the runtime" section — degrade instructions travel in the skill body, never the runtime (skills.md §"Runtime-free invocation", change 0013)',
+    );
+    return null;
+  }
+  // Candidate targets: every path-shaped token mentioning raw/degraded/, with
+  // trailing sentence punctuation trimmed (an un-backticked target ending a sentence
+  // must not refuse on its own full stop). At least one must parse to the canonical
+  // capture pattern; bare directory mentions are fine prose.
+  const candidates = (section.match(/[A-Za-z0-9_.\-*/{}]*raw\/degraded\/[A-Za-z0-9_.\-*/{}]*/g) || []).map(
+    (c) => c.replace(/[.,]+$/, ''),
+  );
+  if (!candidates.length) {
+    errors.push(
+      'the "Without the runtime" section declares no degrade target — captures must be declared to land in domains/{domain}/raw/degraded/YYYY-MM-DD-{skill}-{slug}.md (skills.md §"Runtime-free invocation")',
+    );
+    return null;
+  }
+  const re = degradeTargetRe(name);
+  const parsed = candidates.find((c) => re.test(c));
+  if (!parsed) {
+    errors.push(
+      `the declared degrade target "${candidates[0]}" does not parse — expected domains/{domain}/raw/degraded/YYYY-MM-DD-{skill}-{slug}.md (the {skill} segment may be the literal skill name)`,
+    );
+    return null;
+  }
+  return parsed;
+}
+
+// --- One skill file (S3–S7) --------------------------------------------------------------
+
+// Validate one SKILL.md source against the frontmatter contract + the deterministic
+// portability half. Pure over its arguments. `registeredActionTypes` is the EFFECTIVE
+// action-type name set (resolveActionTypes(registry).effective keys) — a declared
+// via_action_type outside it is a write nothing would ever run (silent intent-drop).
+// Returns { errors, skill } — skill is null unless errors is empty.
+export function validateSkillSource({ name, declaredVersion, source, registeredActionTypes }) {
+  const errors = [];
+  const registered = new Set(registeredActionTypes || []);
+
+  // The name is the registry key, slug-validated in resolveSkillsSection — but this
+  // is a standalone export, and the name is interpolated into the degrade-target
+  // regex below: a non-slug must REFUSE here, never crash the validator (adversarial
+  // review of core-0015 — fail-closed means returning errors, not throwing).
+  if (typeof name !== 'string' || !RE_SLUG.test(name)) {
+    return {
+      errors: [`skill name (registry key) ${JSON.stringify(name)} is not a kebab-case slug`],
+      skill: null,
+    };
+  }
+
+  const block = matchFrontmatterBlock(source);
+  if (!block) {
+    return {
+      errors: ['no YAML frontmatter block — a skill is a Markdown file opening with --- frontmatter (skills.md §"Skill format")'],
+      skill: null,
+    };
+  }
+  let fm;
+  try {
+    fm = yaml.load(block[1], { schema: yaml.JSON_SCHEMA });
+  } catch (err) {
+    return { errors: [`frontmatter is not valid YAML: ${err.message}`], skill: null };
+  }
+  if (!isPlainObject(fm)) {
+    return { errors: ['frontmatter must be a YAML mapping of contract fields'], skill: null };
+  }
+
+  const unknown = Object.keys(fm).filter((k) => !FM_KEYS.includes(k));
+  if (unknown.length) {
+    errors.push(`unknown frontmatter key(s): ${unknown.join(', ')} (the contract is skills.md §"Frontmatter contract")`);
+  }
+  for (const key of FM_KEYS) {
+    if (Object.hasOwn(fm, key) && fm[key] === null) {
+      errors.push(`${key}: null is not "absent" — omit the field instead`);
+    }
+  }
+  for (const key of REQUIRED_FM_KEYS) {
+    if (!Object.hasOwn(fm, key)) {
+      errors.push(`${key}: required (skills.md §"Frontmatter contract")`);
+    }
+  }
+  // Anything missing or null above makes per-field checks below noise; report the
+  // presence errors alone first — they are the clearest version of the failure.
+  if (errors.length) return { errors, skill: null };
+
+  if (typeof fm.name !== 'string' || !RE_SLUG.test(fm.name)) {
+    errors.push(`name: ${JSON.stringify(fm.name)} is not a kebab-case slug`);
+  } else if (fm.name !== name) {
+    errors.push(`name: "${fm.name}" does not match the registry key "${name}" (the registry key is the directory under skills/ and the skill's name)`);
+  }
+
+  if (typeof fm.version !== 'string' || !RE_SEMVER.test(fm.version)) {
+    errors.push(`version: ${JSON.stringify(fm.version)} is not a SemVer string`);
+  } else if (declaredVersion !== undefined && fm.version !== declaredVersion) {
+    errors.push(
+      `version: "${fm.version}" does not match the registry-declared "${declaredVersion}" — the registry declares installed skills and versions (skills.md §"Skill registry"); a mismatch means a stale or swapped file`,
+    );
+  }
+
+  if (!isPlainObject(fm.invocation)) {
+    errors.push('invocation: must be a mapping with explicit, suggested, and woven (skills.md §"Invocation modes")');
+  } else {
+    const unknownModes = Object.keys(fm.invocation).filter((k) => !INVOCATION_KEYS.includes(k));
+    if (unknownModes.length) {
+      errors.push(`invocation: unknown mode(s): ${unknownModes.join(', ')} (modes: ${INVOCATION_KEYS.join(', ')})`);
+    }
+    for (const mode of ['explicit', 'suggested']) {
+      const v = fm.invocation[mode];
+      if (!Array.isArray(v) || v.some((t) => typeof t !== 'string' || t.trim() === '')) {
+        errors.push(
+          `invocation.${mode}: must be a list of trigger phrases (declare [] for none — an absent mode is ambiguous between "none" and "forgot")`,
+        );
+      }
+    }
+    if (typeof fm.invocation.woven !== 'boolean') {
+      errors.push('invocation.woven: must be a boolean');
+    }
+    if (
+      Array.isArray(fm.invocation.explicit) &&
+      Array.isArray(fm.invocation.suggested) &&
+      fm.invocation.explicit.length === 0 &&
+      fm.invocation.suggested.length === 0 &&
+      fm.invocation.woven === false
+    ) {
+      errors.push(
+        'invocation: declares no mode at all — a skill nothing can ever trigger is silent intent-drop (declare a trigger phrase, or woven: true)',
+      );
+    }
+  }
+
+  if (!SKILL_WEIGHTS.includes(fm.weight)) {
+    errors.push(`weight: ${JSON.stringify(fm.weight)} is not in the weight vocabulary (${SKILL_WEIGHTS.join(' | ')})`);
+  }
+
+  if (!Array.isArray(fm.reads) || fm.reads.length === 0) {
+    errors.push('reads: must be a non-empty list of path globs the skill expects to read');
+  } else {
+    for (const entry of fm.reads) {
+      const err = pathGlobError('reads', entry);
+      if (err) errors.push(err);
+    }
+  }
+
+  // writes (S4): direct-write path strings plus EXACTLY ONE via_action_types entry.
+  const writePaths = [];
+  let viaActionTypes = null;
+  if (!Array.isArray(fm.writes)) {
+    errors.push(
+      'writes: must be a list of direct-write paths plus one via_action_types entry — a skill with no writes declaration cannot be reasoned about (skills.md anti-pattern; declare via_action_types: [] for a read-only skill)',
+    );
+  } else {
+    let viaCount = 0;
+    for (const entry of fm.writes) {
+      if (typeof entry === 'string') {
+        const err = directWriteError(entry);
+        if (err) errors.push(err);
+        else writePaths.push(entry);
+        continue;
+      }
+      if (isPlainObject(entry) && Object.keys(entry).length === 1 && Object.hasOwn(entry, 'via_action_types')) {
+        viaCount += 1;
+        if (viaCount > 1) {
+          errors.push('writes: more than one via_action_types entry — declare one list');
+          continue;
+        }
+        const via = entry.via_action_types;
+        if (!Array.isArray(via) || via.some((t) => typeof t !== 'string' || t === '')) {
+          errors.push('writes.via_action_types: must be a list of action-type names (empty list = read-only skill)');
+          continue;
+        }
+        const seen = new Set();
+        for (const type of via) {
+          if (seen.has(type)) {
+            errors.push(`writes.via_action_types: duplicate "${type}"`);
+            continue;
+          }
+          seen.add(type);
+          if (!registered.has(type)) {
+            errors.push(
+              `writes.via_action_types: "${type}" is not a registered action type — a write nothing would ever run is silent intent-drop (registered: ${[...registered].join(', ') || 'none'})`,
+            );
+          }
+        }
+        viaActionTypes = via;
+        continue;
+      }
+      errors.push(`writes: ${JSON.stringify(entry)} is neither a path string nor a via_action_types entry`);
+    }
+    if (viaCount === 0) {
+      errors.push(
+        'writes.via_action_types: required — which action types the skill may issue (empty list = read-only skill; skills.md §"Frontmatter contract")',
+      );
+    }
+  }
+
+  let subAgents = [];
+  if (Object.hasOwn(fm, 'sub_agents')) {
+    if (!Array.isArray(fm.sub_agents) || fm.sub_agents.some((s) => typeof s !== 'string' || s.trim() === '')) {
+      errors.push('sub_agents: must be a list of subagent names');
+    } else {
+      subAgents = fm.sub_agents;
+      if (subAgents.length && fm.weight !== 'heavy') {
+        errors.push('sub_agents: only heavy skills declare read-only gather subagents (skills.md §"Frontmatter contract")');
+      }
+    }
+  }
+
+  if (!MODEL_TIERS.includes(fm.requires_model_tier)) {
+    errors.push(
+      `requires_model_tier: ${JSON.stringify(fm.requires_model_tier)} is not in the tier vocabulary (${MODEL_TIERS.join(' | ')})`,
+    );
+  }
+
+  const pin = parsePromptPin(fm.prompt_pin);
+  if (!pin) {
+    errors.push(
+      `prompt_pin: ${JSON.stringify(fm.prompt_pin)} does not parse — expected {model_id}@{YYYY-MM-DD} (e.g. claude-opus-4-7@2026-04-01; eval-discipline.md)`,
+    );
+  }
+
+  const body = source.slice(block[0].length);
+  const degradeTarget = checkDegradeContract(name, body, errors);
+
+  if (errors.length) return { errors, skill: null };
+  return {
+    errors,
+    skill: {
+      name: fm.name,
+      version: fm.version,
+      invocation: { explicit: fm.invocation.explicit, suggested: fm.invocation.suggested, woven: fm.invocation.woven },
+      weight: fm.weight,
+      reads: fm.reads,
+      writes: { paths: writePaths, via_action_types: viaActionTypes },
+      sub_agents: subAgents,
+      requires_model_tier: fm.requires_model_tier,
+      prompt_pin: { raw: fm.prompt_pin, ...pin },
+      path: skillFilePath(name),
+      degrade_target: degradeTarget,
+    },
+  };
+}
+
+// --- The loader (S2) ---------------------------------------------------------------------
+
+// Load every REGISTERED skill from an install root. All-or-nothing: any error returns
+// { errors, skills: {} } — the skills layer is disabled until the registry and every
+// registered SKILL.md are valid (a config error is loud and total, never partial).
+// File errors are prefixed with the file path so the operator's next step is named.
+export async function loadSkills({ installRoot, registry, registeredActionTypes }) {
+  const { errors, section } = resolveSkillsSection(registry);
+  if (errors.length) return { errors, skills: {} };
+
+  const all = [];
+  const skills = {};
+  for (const [name, entry] of Object.entries(section)) {
+    const rel = skillFilePath(name);
+    let source;
+    try {
+      source = await readFile(join(installRoot, rel), 'utf8');
+    } catch (err) {
+      // ENOENT is the only "missing" — an EACCES/EISDIR misreported as missing pairs
+      // a wrong diagnosis with destructive advice (adversarial review of core-0015).
+      if (err.code === 'ENOENT') {
+        all.push(`${rel}: missing — the registry declares "${name}" installed but the file does not exist (remove the skills.${name} entry to unregister)`);
+      } else {
+        all.push(`${rel}: unreadable (${err.code || err.message}) — the file exists but could not be read`);
+      }
+      continue;
+    }
+    const res = validateSkillSource({ name, declaredVersion: entry.version, source, registeredActionTypes });
+    for (const e of res.errors) all.push(`${rel}: ${e}`);
+    if (!res.errors.length) skills[name] = res.skill;
+  }
+  if (all.length) return { errors: all, skills: {} };
+  return { errors: all, skills };
+}

package/vendor/core/src/subscription.js

@@ -0,0 +1,84 @@
+// Subscription match criteria + matcher (specs/event-log.md §"Subscription contract";
+// core-0006 / T4.0 — moved from apps/cli to core in core-0013, when the in-pipeline hook
+// executor became its second consumer: ONE shared matcher, never a re-typed copy
+// (rules.md two-matchers drift), and apps→packages is the only legal import direction.
+// apps/cli/src/subscription.js re-exports these for the CLI surface.
+//
+// T4.0 defined + validated ONLY the event-side matching shape; the full hook declaration
+// (kind / classification / kill_switch / command / quota) is hooks.md's contract and
+// lives in hook-executor.js (core-0013 / T4.2).
+//
+// V1 shape: `subscribes_to` (an array of exact event types) + an optional named `filter`
+// (a { "payload.<field>": <value> } equality map). jq-expression filters
+// (event-log.md:138) are the V1.5 daemon superset of this field-equality subset.
+
+// Validate the matching shape only. Returns { ok, errors }. Does not validate hook fields.
+export function validateSubscription(sub) {
+  if (sub === null || typeof sub !== 'object' || Array.isArray(sub)) {
+    return { ok: false, errors: ['subscription must be an object'] };
+  }
+  const errors = [];
+  if (!Array.isArray(sub.subscribes_to) || sub.subscribes_to.length === 0) {
+    errors.push('subscribes_to must be a non-empty array of event types');
+  } else if (!sub.subscribes_to.every((t) => typeof t === 'string' && t !== '')) {
+    errors.push('subscribes_to entries must be non-empty strings');
+  }
+  if (sub.filter !== undefined) {
+    if (sub.filter === null || typeof sub.filter !== 'object' || Array.isArray(sub.filter)) {
+      errors.push('filter must be an object mapping payload.<field> to a value');
+    } else {
+      for (const key of Object.keys(sub.filter)) {
+        if (!key.startsWith('payload.')) {
+          errors.push(`filter key "${key}" must address a payload field (payload.<field>)`);
+        }
+      }
+    }
+  }
+  return { ok: errors.length === 0, errors };
+}
+
+// Walk a dotted path under an object; undefined if any hop is missing or non-object.
+// Own-property hops only (rules.md): a path segment named `constructor`/`__proto__`
+// must read as ABSENT, never resolve up the prototype chain — an inherited value
+// matching a filter would fire a hook on a field the event never carried.
+function getPath(obj, path) {
+  let cur = obj;
+  for (const key of path) {
+    if (cur === null || typeof cur !== 'object' || !Object.hasOwn(cur, key)) return undefined;
+    cur = cur[key];
+  }
+  return cur;
+}
+
+// Equality for a filter value: strict for primitives, structural (JSON) for arrays/objects so
+// `{ "payload.tags": ["a"] }` can match without a deep-equal dependency.
+function valueEquals(actual, expected) {
+  if (actual === expected) return true;
+  if (
+    actual !== null &&
+    expected !== null &&
+    typeof actual === 'object' &&
+    typeof expected === 'object'
+  ) {
+    return JSON.stringify(actual) === JSON.stringify(expected);
+  }
+  return false;
+}
+
+// Does `event` match `subscription`? Type membership (exact), then every filter entry as an
+// AND of payload-field equalities. A malformed filter key (not payload.<field>) cannot match.
+export function matchesSubscription(event, subscription) {
+  if (!event || typeof event !== 'object') return false;
+  const types = Array.isArray(subscription?.subscribes_to) ? subscription.subscribes_to : [];
+  if (!types.includes(event.type)) return false;
+
+  const filter = subscription?.filter;
+  if (filter && typeof filter === 'object' && !Array.isArray(filter)) {
+    for (const [key, expected] of Object.entries(filter)) {
+      if (!key.startsWith('payload.')) return false;
+      const path = key.slice('payload.'.length).split('.');
+      if (!valueEquals(getPath(event.payload, path), expected)) return false;
+    }
+  }
+  return true;
+}

package/vendor/core/src/validate-object.js

@@ -0,0 +1,62 @@
+// One object, fully checked — the per-file half of `phronesis validate`, extracted to
+// core (core-0008) because the action spine's stage→validate→rename writer must enforce
+// EXACTLY what the validator enforces: frontmatter contract (contract.js) plus link
+// existence against the filesystem. Two consumers → package (rules.md); if these ever
+// diverged, an action could commit an artifact `phronesis validate` then rejects.
+
+import { join, relative } from 'node:path';
+import yaml from 'js-yaml';
+import fse from 'fs-extra';
+import { validateFrontmatter } from './contract.js';
+import { splitFrontmatter, contextFor } from './workspace-scan.js';
+
+// Check one object's full source against the ontology contract. `relPath` locates the
+// object (its layer/type-dir/name context is derived from the path, contextFor); the
+// content is checked as given — callers validate staged bytes before they land.
+// `pending` (optional, a Set of install-relative paths) names sibling artifacts of the
+// SAME staged transaction: they count as existing for link checks, because the
+// multi-dest writer commits them before this artifact's links are ever walked
+// (core-0010's tombstone links to the codex object staged beside it). Returns the
+// error list ([] = valid). Error strings are the validator's own.
+export async function checkObjectContent({ installRoot, relPath, content, pending }) {
+  const ctx = contextFor(relPath);
+  if (!ctx) return [`"${relPath}" is not a typed-object path (domains/*/compiled/ or codex/)`];
+
+  const fmSrc = splitFrontmatter(content);
+  if (fmSrc === null) return ['no frontmatter block'];
+
+  let fm;
+  try {
+    // JSON_SCHEMA: no implicit type coercion — unquoted `2026-05-15` stays a string
+    // (the default schema would parse it into a Date), keeping the contract honest.
+    fm = yaml.load(fmSrc, { schema: yaml.JSON_SCHEMA });
+  } catch (err) {
+    return [`could not parse frontmatter: ${err.message}`];
+  }
+
+  const { errors, links } = validateFrontmatter(fm, ctx);
+
+  // Link existence — needs the filesystem. Grammar + forward-policy were already checked
+  // in validateFrontmatter. Resolve the path FIRST: a bare slug from a codex object (no
+  // domain) is unresolvable and errors even with forward:true — forward must not be able
+  // to bless a target that can never resolve.
+  for (const link of links) {
+    const targetRel = link.cls.relPath(ctx.domain);
+    if (targetRel === null) {
+      errors.push(`link "${link.target}": a bare-slug target has no domain to resolve against (codex objects must use a full path or codex/ ref)`);
+      continue;
+    }
+    if (link.forward && link.cls.domainObject) continue; // forward waives existence
+    const abs = join(installRoot, targetRel);
+    if (relative(installRoot, abs).startsWith('..')) {
+      errors.push(`link "${link.target}": target resolves outside the installation`);
+      continue;
+    }
+    if (pending && pending.has(targetRel)) continue; // staged in the same transaction
+    if (!(await fse.pathExists(abs))) {
+      errors.push(`link "${link.target}": target does not resolve to an existing file (add forward: true if it is not compiled yet)`);
+    }
+  }
+
+  return errors;
+}