rewritable 0.9.0 → 0.10.0

package/bin/rwa.mjs

@@ -77,6 +77,10 @@ Usage:
                               skill into the frozen #rwa-skills zone. Requires --yes
                               (no dialog to consent in); gate failures are final.
                               --json emits {skillId,name,kind,verified,status}.
+  rwa skill publish <file>    publish a SIGNED .rwa-skill.json to the marketplace
+                              index (POST /skills/publish). The envelope is already
+                              signed — no key needed. Online; --url overrides the
+                              service, --json emits {skillId,registryUrl,verified}.
   rwa skin <path> <name>      apply a named style preset to a rewritable in
                               place (deterministic, offline, model-free). Names:
                               notion-clean, linear-dark, editorial-serif,
@@ -721,6 +725,60 @@ function detectProductKind(fileText) {
       return;
     }
 
+    // `rwa skill publish <file.rwa-skill.json> [--url base] [--json]` — publish a SIGNED skill
+    // envelope to the marketplace index (POST /skills/publish, I6 §11). The envelope is already
+    // signed (no key needed). Online by design; exit 4 labeled `publish_error` (like `publish`).
+    if (verb === 'skill') {
+      const sub = rest[0];
+      const subRest = rest.slice(1);
+      if (sub !== 'publish') {
+        process.stderr.write("rwa skill: unknown subcommand '" + (sub || '') + "' (try: rwa skill publish <file>)\n");
+        process.exitCode = 1;
+        return;
+      }
+      const jsonMode = subRest.includes('--json');
+      const urlFlag = getFlag('--url', subRest);
+      const urlIdx = subRest.indexOf('--url');
+      const skip = urlIdx >= 0 ? urlIdx + 1 : -1;
+      const filePath = subRest.find((a, i) => !a.startsWith('-') && i !== skip);
+      const emitSP = (payload) => {
+        if (jsonMode) { process.stderr.write(JSON.stringify(payload) + '\n'); return; }
+        const parts = [payload.code, payload.subcode].filter(Boolean);
+        let line = 'rwa skill publish: ' + parts.join('/');
+        if (payload.details && Object.keys(payload.details).length) line += ' ' + JSON.stringify(payload.details);
+        process.stderr.write(line + '\n');
+      };
+      if (!filePath) { emitSP({ code: 'usage_error', subcode: 'missing_file_arg' }); process.exitCode = 1; return; }
+      if (urlFlag.present && (urlFlag.value === undefined || urlFlag.value.startsWith('-'))) {
+        emitSP({ code: 'usage_error', subcode: 'missing_flag_value', details: { flag: '--url' } }); process.exitCode = 1; return;
+      }
+      const baseUrl = urlFlag.value || process.env.RWA_PUBLISH_URL || undefined;
+      const { skillPublishCmd } = await import('../src/skill-publish.mjs');
+      let result;
+      try {
+        result = await skillPublishCmd(filePath, { baseUrl });
+      } catch (e) {
+        if (e && typeof e.exitCode === 'number') {
+          const code = e.exitCode === 4 ? 'publish_error' : codeName(e.exitCode);
+          emitSP({ code, subcode: e.subcode, details: e.details });
+          process.exitCode = e.exitCode;
+          return;
+        }
+        throw e;
+      }
+      if (jsonMode) {
+        process.stdout.write(JSON.stringify(result) + '\n');
+      } else {
+        process.stdout.write(
+          '✓ Published skill to the index!\n' +
+          `  skillId:  ${result.skillId}\n` +
+          `  URL:      ${result.registryUrl}\n` +
+          `  verified: ${result.verified}\n`,
+        );
+      }
+      return;
+    }
+
     // `rwa publish-site <file> [--host h] [--path p] [--url base] [--json]` —
     // copy a rewritable VERBATIM onto a static site over scp; print the live URL.
     // Durable counterpart to `rwa publish` (ephemeral share). Online by design.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rewritable",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "CLI for re-writeable: emit and import single-file rwa documents.",
   "type": "module",
   "bin": {

package/seeds/rewritable.html

@@ -6426,22 +6426,59 @@ function runtimeSetView(name) {
     sessionStorage.setItem(rwaViewKey(), '');
   } else {
     const spec = providers.view;
-    if (!spec || spec.name !== name) throw new Error('no registered view named ' + name);
-    validateViewOutput(spec.render(currentDocCache, viewCtx()), spec); // throws → never activates
-    releaseAnchor();
-    if (rwaMode !== 'document') {
-      hideEditTransients();
-      closeRuntimePanels();
-      rwaMode = 'document';
-      emitRuntimeEvent('mode', { mode: rwaMode });
+    if (spec && spec.name === name) {
+      validateViewOutput(spec.render(currentDocCache, viewCtx()), spec); // throws → never activates
+      releaseAnchor();
+      if (rwaMode !== 'document') {
+        hideEditTransients();
+        closeRuntimePanels();
+        rwaMode = 'document';
+        emitRuntimeEvent('mode', { mode: rwaMode });
+      }
+      activeView = spec;
+      sessionStorage.setItem(rwaViewKey(), name);
+    } else {
+      // I7 (v0.9 §8) — an INSTALLED view skill (by skillId or name). Resolve SYNCHRONOUSLY so an
+      // unknown name still throws (unchanged behavior); only a genuine installed view goes async.
+      // Its render() runs in a Worker, so we invoke once, validate the returned HTML main-side (same
+      // contract as a first-party view — no <script>, no reserved ids), and activate a SNAPSHOT
+      // overlay whose sync render() returns the cached HTML. A view never commits (read-only);
+      // re-activate to refresh (auto-refresh-on-change is the deferred `observe` opt-in).
+      const rec = installedSkills.get(name) || Array.from(installedSkills.values()).find(s => s.name === name && s.kind === 'view');
+      if (!rec || rec.kind !== 'view' || !(rec.manifest && rec.manifest.output && rec.manifest.output.kind === 'html-render')) throw new Error('no registered view named ' + name);
+      runtimeActivateInstalledView(rec);
+      return;
     }
-    activeView = spec;
-    sessionStorage.setItem(rwaViewKey(), name);
   }
   if (typeof syncModeChrome === 'function') syncModeChrome();
   if (typeof syncViewChrome === 'function') syncViewChrome();
   getDoc().then(d => renderDoc(canonLF(d)));
 }
+async function runtimeActivateInstalledView(rec) {
+  try {
+    const d = canonLF(await getDoc());
+    const html = String(await runtimeInvokeSkill(rec.skillId, { doc: d, ctx: viewCtx() }));
+    validateViewOutput(html, { name: rec.name }); // throws → never activates (fail-loud, same as first-party)
+    releaseAnchor();
+    if (rwaMode !== 'document') { hideEditTransients(); closeRuntimePanels(); rwaMode = 'document'; emitRuntimeEvent('mode', { mode: rwaMode }); }
+    activeView = { name: rec.name, label: rec.name, skillId: rec.skillId, __provenance: 'installed', __html: html, render() { return this.__html; } };
+    if (typeof syncModeChrome === 'function') syncModeChrome();
+    if (typeof syncViewChrome === 'function') syncViewChrome();
+    renderDoc(d);
+  } catch (e) {
+    setStatus('err', '✗ ' + ((e && e.message) || 'view failed'));
+  }
+}
+// I7 (v0.9 §8) — invoke an INSTALLED edit-surface skill: its run() returns an rwa-edit/1 envelope
+// (a deterministic, model-free transform), which is applied through the SAME validated commit path
+// the agent/lens use (frozen-zone + structural-shape guards, one ⌘Z), attributed to the skill.
+async function runtimeInvokeEditSurface(skillId, input) {
+  const rec = installedSkills.get(skillId);
+  if (!rec || rec.kind !== 'edit-surface') throw new Error('not an edit-surface skill');
+  const envelope = await runtimeInvokeSkill(skillId, input || {});
+  if (!envelope || typeof envelope !== 'object' || envelope.version !== 'rwa-edit/1') throw new Error('invalid_transform_output');
+  return runtimeApplyEnvelope(envelope, { surface: 'skill:edit-surface', actor: 'skill:transform:' + String(skillId).slice(0, 8) });
+}
 function rwaViewKey() { return 'rwa_view_active_' + DOC_UUID; }
 function rwaSlideKey() { return 'rwa_view_slide_' + DOC_UUID; }
 
@@ -6655,6 +6692,43 @@ async function _skSourceGet(pubkey) {
   if (!pubkey) return null;
   try { return (await idbGet(RWA.SOURCES, pubkey)) || null; } catch (_) { return null; }
 }
+// I6 (v0.9 §11) — TOFU author identity. Fingerprint = sha256(pubkey).hex[:16] (mirrors the
+// service's skillFingerprint). The per-author install count + first_seen come from rwa_sources (I5),
+// so the dialog can say "first time seeing this author" vs "trusted, N installs".
+async function _skFingerprint(pubkey) {
+  const h = await _skSha256(_skUtf8(String(pubkey)));
+  let s = ''; for (const b of h) s += b.toString(16).padStart(2, '0');
+  return s.slice(0, 16);
+}
+async function _skTofu(pubkey) {
+  const rec = await _skSourceGet(pubkey);
+  const installs = (rec && rec.count) || 0;
+  return { fingerprint: await _skFingerprint(pubkey), firstTime: installs === 0, installs };
+}
+// I6 (v0.9 §11) — marketplace discovery (opt-in network, like the ↗ share panel). discover →
+// GET /skills/index (paginated/filterable). fetch → GET /skills/index/:id → the full envelope,
+// VERIFIED client-side (WebCrypto Ed25519 via _skVerify) before any install; a revoked skill returns
+// {revoked:true}. The index only informs — install still runs the dialog + gates (the trust anchor).
+const SKILLS_INDEX_DEFAULT = 'https://rewritable.ikangai.com';
+async function runtimeDiscoverSkills(opts) {
+  opts = opts || {};
+  const base = (opts.baseUrl || SKILLS_INDEX_DEFAULT).replace(/\/+$/, '');
+  const qs = new URLSearchParams();
+  for (const k of ['kind', 'author', 'search', 'verified_only', 'page', 'limit']) if (opts[k] != null) qs.set(k, String(opts[k]));
+  const res = await fetch(base + '/skills/index' + (qs.toString() ? '?' + qs.toString() : ''));
+  if (!res.ok) throw new Error('discover_failed:' + res.status);
+  return res.json(); // { entries, total, page, limit }
+}
+async function runtimeFetchSkillFromIndex(skillId, opts) {
+  opts = opts || {};
+  const base = (opts.baseUrl || SKILLS_INDEX_DEFAULT).replace(/\/+$/, '');
+  const res = await fetch(base + '/skills/index/' + encodeURIComponent(skillId));
+  if (res.status === 410) return { revoked: true, envelope: null, verified: false };
+  if (!res.ok) throw new Error('fetch_failed:' + res.status);
+  const data = await res.json();
+  const verified = await _skVerify(data.envelope); // client-side: never trust the index's `verified`
+  return { envelope: data.envelope, metadata: data.metadata, verified, revoked: false };
+}
 // Append (name, now) for a key, creating the record if absent. Idempotent per distinct name.
 async function _skSourceRecord(pubkey, name, at) {
   if (!pubkey || !name) return;
@@ -6766,6 +6840,64 @@ async function runtimeVaultNamespaces() {
   for (const k of Object.keys(rec.entries)) { const i = k.indexOf('\0'); if (i > 0) set.add(k.slice(0, i)); }
   return Array.from(set);
 }
+// ── I13 (v0.9 §14) — portable vault EXPORT/IMPORT (offline; escrow + account service deferred to
+// v1). A version-tagged, self-contained `rwa-vault-export/1` file: selected namespaces re-encrypted
+// under a SEPARATE transport passphrase (PBKDF2-200k + AES-256-GCM, per-namespace salt + check), so
+// it decrypts on another machine with only the passphrase — no server. The machine-local vault stays
+// the default; this travels ONLY on an explicit user action. Requires the vault unlocked (to read
+// plaintext to re-wrap). Never logs the passphrase. CLI/Worker have no access (UI/runtime action only).
+async function runtimeVaultExport(passphrase, namespaces) {
+  if (!_vaultKey) throw new Error('vault_locked');
+  if (!passphrase) throw new Error('vault_bad_passphrase');
+  const rec = await _vaultLoadRec();
+  const allNs = await runtimeVaultNamespaces();
+  const sel = (Array.isArray(namespaces) && namespaces.length) ? namespaces.filter(n => allNs.includes(n)) : allNs;
+  const out = { rwa: 'rwa-vault-export/1', containerUuid: DOC_UUID, exportedAt: Date.now(), namespaces: sel, entries: {} };
+  for (const ns of sel) {
+    const salt = _skB64(crypto.getRandomValues(new Uint8Array(16)));
+    const ekey = await _vaultDeriveKey(passphrase, salt);
+    const enc = async (text) => { const iv = crypto.getRandomValues(new Uint8Array(12)); const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, ekey, _skUtf8(text))); return { iv: _skB64(iv), ct: _skB64(ct) }; };
+    const items = [];
+    for (const k of Object.keys(rec.entries)) {
+      const i = k.indexOf('\0'); if (i <= 0 || k.slice(0, i) !== ns) continue;
+      const plain = await _vaultDec(rec.entries[k]); // decrypt under the LOCAL vault key…
+      items.push(Object.assign({ key: k.slice(i + 1) }, await enc(plain))); // …re-encrypt under the export key
+    }
+    out.entries[ns] = { salt, check: await enc('rwa-vault-export-ok'), items };
+  }
+  return out;
+}
+async function runtimeVaultImport(exportObj, passphrase, opts) {
+  opts = opts || {};
+  if (!_vaultKey) throw new Error('vault_locked'); // need the local key to re-wrap imported items
+  if (!exportObj || exportObj.rwa !== 'rwa-vault-export/1' || !exportObj.entries || typeof exportObj.entries !== 'object') throw new Error('account_export_malformed');
+  const rec = await _vaultLoadRec();
+  const result = { imported: 0, skipped: 0, namespaces: [], containerMismatch: exportObj.containerUuid !== DOC_UUID };
+  for (const ns of Object.keys(exportObj.entries)) {
+    const e = exportObj.entries[ns];
+    if (!e || typeof e.salt !== 'string' || !Array.isArray(e.items)) throw new Error('account_export_malformed');
+    const ekey = await _vaultDeriveKey(passphrase, e.salt);
+    const dec = async (entry) => new TextDecoder().decode(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: _skFromB64(entry.iv) }, ekey, _skFromB64(entry.ct)));
+    if (e.check) { try { await dec(e.check); } catch (_) { throw new Error('vault_decrypt_failed'); } } // wrong passphrase fails here, before any write
+    for (const it of e.items) {
+      let plain; try { plain = await dec(it); } catch (_) { throw new Error('vault_decrypt_failed'); }
+      const dk = ns + '\0' + it.key;
+      if (rec.entries[dk] && !opts.overwrite) { result.skipped++; continue; } // don't clobber without explicit overwrite
+      rec.entries[dk] = await _vaultEnc(plain); // re-encrypt under the LOCAL vault key (usable immediately)
+      result.imported++;
+    }
+    result.namespaces.push(ns);
+  }
+  try { await idbPut(RWA.VAULT, rec); } catch (_) { throw new Error('vault_storage_error'); }
+  return result;
+}
+// I13 — live-only account identity (opt-in, sessionStorage rwa_account; default null). Never stamped
+// into the file; never exposed to skill code (UI/describe only). Escrow/account-service deferred to v1.
+function runtimeAccountIdentity() {
+  let raw = null; try { raw = sessionStorage.getItem('rwa_account'); } catch (_) { return null; }
+  if (!raw) return null;
+  try { const a = JSON.parse(raw); return a && a.mode ? { mode: a.mode, accountId: a.accountId || null, lastSync: a.lastSync || null } : null; } catch (_) { return null; }
+}
 // §6 — the bridge's per-call vault gate (mirror of cli/src/skill-manifest.mjs vaultNamespaceAllowed).
 function _skVaultAllowed(skill, ns) {
   const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
@@ -6776,6 +6908,9 @@ function _skBusAllowed(skill, topic) {
   const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
   return perms.indexOf('bus:' + topic) !== -1;
 }
+// §5 (I1b) — per-message subscribe filter. true for all today; I12 wires a peer-allowlist here
+// (defense-in-depth — a declared bus: perm can't be further runtime-restricted; Shape B holds).
+function _skBusMessageAllowed(_skill, _envelope) { return true; }
 // §6 (I3) — the bridge's per-call fs gate: the (already traversal-checked) path must fall under
 // a declared fsa:<scope> subtree (left-anchored prefix, no wildcards).
 function _skFsAllowed(skill, path) {
@@ -6955,6 +7090,13 @@ function _skValidateInstall(skill, vr) {
   if (skill.kind === 'compute' && perms.length > 0) errors.push('compute_with_permissions');
   // §9 (I8): a hook is compute-only — only hook:<event> perms; any other tier → compute_with_permissions.
   if (skill.kind === 'hook' && perms.some(p => { try { return _skParsePermission(p).tier !== 'hook'; } catch (_) { return false; } })) errors.push('compute_with_permissions');
+  // §8 (I7): view/edit-surface are zero-capability DOM authors — reject any permission + require a
+  // matching typed output contract (view → html-render, edit-surface → dom-transform).
+  if (skill.kind === 'view' || skill.kind === 'edit-surface') {
+    if (perms.length > 0) errors.push('output_skill_with_permissions');
+    const want = skill.kind === 'view' ? 'html-render' : 'dom-transform';
+    if (!skill.output || skill.output.kind !== want) errors.push('invalid_output_kind');
+  }
   if (!vr.signed && perms.length > 0) errors.push('unsigned_with_permissions');
   // Tools AND hooks carry capability (a hook runs autonomously) → must be signed+verified.
   if ((skill.kind === 'tool' || skill.kind === 'hook') && !vr.verified) errors.push('unsigned_capability');
@@ -7004,6 +7146,8 @@ async function runtimeReviewSkill(envelope) {
   } catch (_) { /* a malformed name/id can't match an install → treat as fresh; gates reject it downstream */ }
   // I5 — per-author name_history: surface a same-key rename so identity reads across name changes.
   const nameInfo = await _skNameChange(skill.author_pubkey, skill.name);
+  // I6 — TOFU author identity (fingerprint + per-author install count) for the install dialog.
+  const tofu = await _skTofu(skill.author_pubkey);
   return {
     name: skill.name, version: skill.version, kind: skill.kind,
     purpose: skill.description || '(no description provided)',
@@ -7011,7 +7155,7 @@ async function runtimeReviewSkill(envelope) {
     permissions: perms.map(p => ({ perm: p, prose: _skPermProse(p) })),
     compoundRisk: _skCompoundRisk(perms), scanNotes: _skCapabilityScan(skill.code),
     lookalike, lookalikeKind, lookalikeBlock,
-    priorNames: nameInfo.priorNames, nameChange: nameInfo.nameChange,
+    priorNames: nameInfo.priorNames, nameChange: nameInfo.nameChange, tofu,
     gates: _skValidateInstall(skill, vr), update,
   };
 }
@@ -7070,6 +7214,7 @@ async function runtimeInstallSkill(envelope) {
   // I5 — record this (key, name) in the per-author name_history (best-effort; never fails the
   // install). On a same-key rename the new name is appended; identity stays anchored on the key.
   await _skSourceRecord(skill.author_pubkey, skill.name);
+  _skEvictPool(id); // I2 — an install/update may change the code → drop any stale pooled Workers
   return { ok: true, skillId: id };
 }
 // §7 — remove a skill + persist the emptied/updated zone (same rollback discipline).
@@ -7077,6 +7222,7 @@ async function runtimeUninstallSkill(skillId) {
   const prev = installedSkills.get(skillId);
   if (!prev) return { ok: false, errors: ['not_installed'] };
   installedSkills.delete(skillId);
+  _skEvictPool(skillId); // I2 — drop any pooled Workers for the removed skill
   try {
     await runtimeRegionCommit({ regions: [_skSkillsRegion()], actor: 'skill:uninstall', reachability: 'frozen' });
   } catch (e) {
@@ -7253,6 +7399,8 @@ function showSkillInstallDialog(envelope) {
       '<h2 style="margin:0 0 .2em;font-size:1.25rem">Install ' + _skEsc(rv.name) + '?</h2>' +
       '<p style="margin:.2em 0 1em;color:#444"><strong>What it claims to do:</strong> ' + _skEsc(rv.purpose) + '</p>' +
       '<p style="margin:.2em 0"><strong>Author.</strong> ' + authorHtml + '</p>' +
+      // I6 — TOFU author identity: the key fingerprint + whether you've installed from this author before.
+      (rv.tofu ? '<p style="margin:.2em 0;color:#555">🔑 Author fingerprint: <code>' + _skEsc(rv.tofu.fingerprint) + '</code>. ' + (rv.tofu.firstTime ? 'First time seeing this author.' : 'Trusted — ' + rv.tofu.installs + ' previous install' + (rv.tofu.installs === 1 ? '' : 's') + '.') + '</p>' : '') +
       lookalikeHtml +
       nameChangeHtml +
       updHtml +
@@ -7346,13 +7494,13 @@ const SKILL_WORKER_PROLOGUE = `(function(){
   'use strict';
   var REMOVE = ['importScripts','Worker','SharedWorker','ServiceWorkerContainer','XMLHttpRequest','WebSocket','EventSource','indexedDB','eval','Function','fetch','WebAssembly'];
   for (var i=0;i<REMOVE.length;i++){ try { Object.defineProperty(self, REMOVE[i], { value: undefined, writable: false, configurable: false }); } catch(_e){} }
-  var IDENTITY=null, BRIDGED=false, _seq=0, _pending=new Map(), RUNTIME={};
+  var IDENTITY=null, BRIDGED=false, _seq=0, _pending=new Map(), RUNTIME={}, _subs={};
   function _bridge(type, payload){ return new Promise(function(res,rej){ var id=++_seq; _pending.set(id,{res:res,rej:rej}); self.postMessage({ type:type, id:id, identity_tag:IDENTITY, payload:payload }); }); }
   function _serializeOpts(o){ if(!o||typeof o!=='object') return undefined; var out={}; if(o.method) out.method=String(o.method); if(typeof o.body==='string') out.body=o.body; if(o.headers&&typeof o.headers==='object') out.headers=o.headers; return out; }
   function _installBridge(){
     RUNTIME.fetch=function(url,opts){ return _bridge('bridge:fetch',{ url:String(url), opts:_serializeOpts(opts) }); };
     RUNTIME.vault={ get:function(ns,k){ return _bridge('bridge:vault',{op:'get',ns:ns,key:k}); }, set:function(ns,k,v){ return _bridge('bridge:vault',{op:'set',ns:ns,key:k,val:v}); }, has:function(ns,k){ return _bridge('bridge:vault',{op:'has',ns:ns,key:k}); } };
-    RUNTIME.bus={ publish:function(topic,message){ return _bridge('bridge:bus:publish',{ topic:String(topic), message:message }); } };
+    RUNTIME.bus={ publish:function(topic,message){ return _bridge('bridge:bus:publish',{ topic:String(topic), message:message }); }, subscribe:function(topic,cb){ var t=String(topic); return _bridge('bridge:bus:subscribe',{ topic:t }).then(function(){ (_subs[t]=_subs[t]||[]).push(cb); return function(){ var a=_subs[t]||[], i=a.indexOf(cb); if(i>=0) a.splice(i,1); try{ _bridge('bridge:bus:unsubscribe',{ topic:t }); }catch(_e){} }; }); } };
     RUNTIME.fs={ read:function(p){ return _bridge('bridge:fs',{op:'read',path:String(p)}); }, write:function(p,d){ return _bridge('bridge:fs',{op:'write',path:String(p),data:d}); }, del:function(p){ return _bridge('bridge:fs',{op:'del',path:String(p)}); }, list:function(p){ return _bridge('bridge:fs',{op:'list',path:String(p)}); } };
     RUNTIME.db={ get:function(s,k){ return _bridge('bridge:idb',{op:'get',store:String(s),key:k}); }, put:function(s,k,v){ return _bridge('bridge:idb',{op:'put',store:String(s),key:k,value:v}); }, del:function(s,k){ return _bridge('bridge:idb',{op:'del',store:String(s),key:k}); }, all:function(s){ return _bridge('bridge:idb',{op:'all',store:String(s)}); } };
   }
@@ -7366,10 +7514,85 @@ const SKILL_WORKER_PROLOGUE = `(function(){
         .catch(function(err){ self.postMessage({ type:'result', id:msg.id, identity_tag:IDENTITY, ok:false, error:String(err&&err.message||err) }); });
       return;
     }
+    if(msg.type==='bus:message'){ var env=msg.envelope||{}, subs=_subs[env.topic]||[]; for(var i=0;i<subs.length;i++){ try{ subs[i](env); }catch(_e){} } return; } // I1b — deliver to skill-side subscribers
+    if(msg.type==='shutdown'){ try{ self.postMessage({ type:'shutdown_ack', identity_tag:null }); }catch(_e){} return; } // I2 — pool drain handshake
   };
 })();
 `;
 
+// ── I2 (v0.9 §10) — optional compute-Worker POOL. DISABLED BY DEFAULT: only an explicit
+// poolingHint {pooling:'enabled'} on a COMPUTE skill (no role) takes this path; every other invoke
+// (tools, agent-role, no-hint) rides the byte-unchanged spawn→invoke→terminate path below. Pooled
+// Workers are compute-only (bridgeless, same worker-scoped CSP), keyed by skillId+code-hash (a code
+// change evicts the pool), bounded by an idle timeout + a hard cap, and drained on shutdown. Per-
+// invocation isolation is unchanged: each invoke re-inits a fresh identity_tag and races the 5s
+// timeout; a timeout/error terminates the Worker (never returns it to the pool). Statelessness is
+// the author's responsibility (Inv 25; no global reset between invokes — documented "pool only if pure").
+const SKILL_POOLS = new Map(); // skillId → { codeHash, idle:[Worker], lastUsed:Map<Worker,ts> }
+const SKILL_POOL_CAP = Math.min(4, (typeof navigator !== 'undefined' && navigator.hardwareConcurrency) || 1);
+let SKILL_POOL_IDLE_MS = 60000; // mutable so the browser proof can shorten it
+async function _skCodeHash(skillId, code) {
+  return _skB64url(await _skSha256(_skConcat(_skUtf8(String(skillId)), _skNUL, _skUtf8(String(code || '')))));
+}
+function _skSpawnComputeWorker(skill) {
+  const blob = new Blob([SKILL_WORKER_PROLOGUE + '\n' + String(skill.code || '')], { type: 'text/javascript' });
+  const url = URL.createObjectURL(blob);
+  const w = new Worker(url); w.__rwaUrl = url; return w;
+}
+function _skKillWorker(w) { try { w.terminate(); } catch (_) {} try { URL.revokeObjectURL(w.__rwaUrl); } catch (_) {} }
+function _skEnforcePoolCap(pool) {
+  while (pool.idle.length > SKILL_POOL_CAP) {
+    let oi = 0; for (let i = 1; i < pool.idle.length; i++) if ((pool.lastUsed.get(pool.idle[i]) || 0) < (pool.lastUsed.get(pool.idle[oi]) || 0)) oi = i;
+    const [w] = pool.idle.splice(oi, 1); pool.lastUsed.delete(w); _skKillWorker(w); // evict oldest-idle
+  }
+}
+function _skEvictPool(skillId) { // code-hash may change on install/update/uninstall → drop stale Workers
+  const pool = SKILL_POOLS.get(skillId);
+  if (pool) { pool.idle.forEach(_skKillWorker); SKILL_POOLS.delete(skillId); }
+}
+function _skPoolEvictIdle() { // background sweep: terminate Workers idle ≥ SKILL_POOL_IDLE_MS
+  const now = Date.now();
+  for (const pool of SKILL_POOLS.values())
+    pool.idle = pool.idle.filter(w => { if (now - (pool.lastUsed.get(w) || 0) >= SKILL_POOL_IDLE_MS) { pool.lastUsed.delete(w); _skKillWorker(w); return false; } return true; });
+}
+async function _skPoolShutdown() { // send shutdown, 500ms grace, terminate (idempotent)
+  const all = [];
+  for (const pool of SKILL_POOLS.values()) for (const w of pool.idle) all.push(w);
+  for (const w of all) { try { w.postMessage({ type: 'shutdown', identity_tag: null }); } catch (_) {} }
+  await new Promise(r => setTimeout(r, 500));
+  for (const w of all) _skKillWorker(w);
+  SKILL_POOLS.clear();
+}
+function runtimePoolStats() {
+  const pools = {}; let live = 0;
+  for (const [id, pool] of SKILL_POOLS) { pools[id] = pool.idle.length; live += pool.idle.length; }
+  return { live, cap: SKILL_POOL_CAP, idleMs: SKILL_POOL_IDLE_MS, pools };
+}
+// Run ONE invocation on a pooled compute Worker (reuse-or-spawn). Success → return to pool; timeout
+// or error → terminate (never pool). Compute skills have no bridge, so a pooled Worker only ever
+// emits `result` — the onmessage here is the full message contract for the pooled path.
+async function _skPooledInvoke(skillId, skill, input) {
+  const codeHash = await _skCodeHash(skillId, skill.code);
+  let pool = SKILL_POOLS.get(skillId);
+  if (pool && pool.codeHash !== codeHash) { _skEvictPool(skillId); pool = null; }
+  if (!pool) { pool = { codeHash, idle: [], lastUsed: new Map() }; SKILL_POOLS.set(skillId, pool); }
+  const w = pool.idle.pop() || _skSpawnComputeWorker(skill);
+  const tag = crypto.randomUUID();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const done = (fn, arg, keep) => {
+      if (settled) return; settled = true; clearTimeout(timer); w.onmessage = null; w.onerror = null;
+      if (keep) { pool.lastUsed.set(w, Date.now()); pool.idle.push(w); _skEnforcePoolCap(pool); }
+      else { pool.lastUsed.delete(w); _skKillWorker(w); }
+      fn(arg);
+    };
+    const timer = setTimeout(() => done(reject, new Error('timeout'), false), 5000); // per-invocation, not per-tenure
+    w.onmessage = (e) => { const m = e.data; if (!m || m.identity_tag !== tag) return; if (m.type === 'result') m.ok ? done(resolve, m.result, true) : done(reject, new Error(m.error || 'runtime_error'), false); };
+    w.onerror = () => done(reject, new Error('runtime_error'), false);
+    w.postMessage({ type: 'init', identity_tag: tag, bridged: false }); // re-init each invoke: fresh tag, never bridged
+    w.postMessage({ type: 'invoke', id: 1, input });
+  });
+}
 // §5a — invoke an installed skill in an isolated Worker. compute = bridgeless; tool =
 // bridged fetch/vault with per-call origin/namespace enforcement on THIS (main) thread.
 // Per-invocation identity_tag binds responses; 5s timeout; spawn -> invoke -> terminate.
@@ -7397,6 +7620,9 @@ function runtimeInvokeSkill(skillId, input, opts) {
   // skills (which never passed through runtimeInstallSkill's gate), every kind.
   const forbidden = _skCodeForbidden(skill.code);
   if (forbidden) return Promise.reject(new Error(forbidden));
+  // I2 — opt-in compute-Worker pool. Only a compute skill with an explicit pooling hint and no
+  // agent-role takes the warm path; everything else falls through to the byte-unchanged fresh spawn.
+  if (opts && opts.pooling === 'enabled' && skill.kind === 'compute' && !agentRole) return _skPooledInvoke(skillId, skill, input);
   const identity_tag = crypto.randomUUID();
   const blob = new Blob([SKILL_WORKER_PROLOGUE + '\n' + String(skill.code || '')], { type: 'text/javascript' });
   const url = URL.createObjectURL(blob);
@@ -7405,8 +7631,9 @@ function runtimeInvokeSkill(skillId, input, opts) {
   // F6: cancel an in-flight bridge fetch when the 5s timeout (or any settle)
   // fires, so a slow request doesn't keep running after the skill is finished.
   const _skAc = (typeof AbortController !== 'undefined') ? new AbortController() : null;
+  const busSubs = []; // I1b — active bus subscriptions for THIS invoke; torn down on settle
   return new Promise((resolve, reject) => {
-    const finish = (fn, arg) => { if (settled) return; settled = true; clearTimeout(timer); if (_skAc) { try { _skAc.abort(); } catch (_) {} } try { w.terminate(); } catch (_) {} URL.revokeObjectURL(url); fn(arg); };
+    const finish = (fn, arg) => { if (settled) return; settled = true; clearTimeout(timer); if (_skAc) { try { _skAc.abort(); } catch (_) {} } for (const u of busSubs) { try { u(); } catch (_) {} } try { w.terminate(); } catch (_) {} URL.revokeObjectURL(url); fn(arg); };
     const timer = setTimeout(() => finish(reject, new Error('timeout')), 5000);
     const reply = (id, ok, extra) => w.postMessage(Object.assign({ type: 'bridge:response', id, identity_tag, ok }, extra));
     w.onmessage = async (e) => {
@@ -7451,6 +7678,22 @@ function runtimeInvokeSkill(skillId, input, opts) {
         catch (_) { reply(msg.id, false, { error: 'bus_error' }); }
         return;
       }
+      if (msg.type === 'bridge:bus:subscribe') {
+        const pl = msg.payload || {};
+        if (!_skBusAllowed(skill, pl.topic)) { reply(msg.id, false, { error: 'bus_topic_denied' }); return; } // §5 per-call gate
+        // I1b — forward each allowed envelope to the Worker until it settles (finish() tears these
+        // down). The 5s timeout bounds the subscribe CALL (the ok reply), not the subscription.
+        try {
+          const unsub = runtimeBusSubscribe(pl.topic, (env) => {
+            if (!_skBusMessageAllowed(skill, env)) return;
+            try { w.postMessage({ type: 'bus:message', id: msg.id, identity_tag, envelope: { topic: env.topic, from: env.from, at: env.at, message: env.message } }); } catch (_) {}
+          });
+          busSubs.push(unsub);
+          reply(msg.id, true, { result: true });
+        } catch (_) { reply(msg.id, false, { error: 'bus_error' }); }
+        return;
+      }
+      if (msg.type === 'bridge:bus:unsubscribe') { reply(msg.id, true, { result: true }); return; } // MVP: precise teardown deferred; finish() unsubscribes all on settle
       if (msg.type === 'bridge:fs') {
         const pl = msg.payload || {}, op = pl.op, p = pl.path;
         // Reject traversal/invalid paths BEFORE the scope check (mirror of assertUserFsPath); a
@@ -7558,6 +7801,9 @@ function runtimeDescribe() {
     // undo-only — there is no redo (re-write-able-spec Invariant 7).
     baseline: { edit: ['lens'], tools: ['apply_dsl_plan', 'apply_edits', 'replace_document'], export: ['html', 'print'], history: ['undo'] },
     activeView: activeView ? activeView.name : null,
+    // I13 (v0.9 §14) — opt-in account identity, LIVE-only (never stamped into the file). null unless
+    // the user linked an account this session (sessionStorage rwa_account); machine-local is the default.
+    accountIdentity: runtimeAccountIdentity(),
   };
 }
 
@@ -8741,12 +8987,16 @@ document.addEventListener('keydown', e => {
       describe: runtimeDescribe, // rwa-identity/1 — what this container is + can do
       listSkills: runtimeListSkills, // v0.8 §8 — installed skills (provenance:'installed')
       invokeSkill: runtimeInvokeSkill, // v0.8 §5a — run a skill in an isolated Worker
+      invokeEditSurface: runtimeInvokeEditSurface, // v0.9 §8 (I7) — run an edit-surface skill → apply its rwa-edit/1 transform
+      poolStats: runtimePoolStats, // v0.9 §10 (I2) — compute-Worker pool observability {live,cap,idleMs,pools}
       reviewSkill: runtimeReviewSkill, // v0.8 §1 — structured trust info for the install dialog
       installSkill: runtimeInstallSkill, // v0.8 §1/§7 — gates + verify + register + persist to the frozen zone (survives reload)
       uninstallSkill: runtimeUninstallSkill, // v0.8 §7 — remove + persist
       showInstallDialog: showSkillInstallDialog, // v0.8 §1 — render the consent dialog for an envelope → resolves with the choice
       promptInstall: runtimePromptInstall, // v0.8 §1.3 — pick a .rwa-skill.json → show the dialog
-      vault: { get: runtimeVaultGet, set: runtimeVaultSet, has: runtimeVaultHas, namespaces: runtimeVaultNamespaces, unlock: runtimeVaultUnlock, lock: runtimeVaultLock, isLocked: runtimeVaultIsLocked }, // v0.8 §6
+      discoverSkills: runtimeDiscoverSkills, // v0.9 §11 (I6) — GET the marketplace index (opt-in network)
+      fetchSkillFromIndex: runtimeFetchSkillFromIndex, // v0.9 §11 (I6) — fetch + client-side-verify an indexed skill
+      vault: { get: runtimeVaultGet, set: runtimeVaultSet, has: runtimeVaultHas, namespaces: runtimeVaultNamespaces, unlock: runtimeVaultUnlock, lock: runtimeVaultLock, isLocked: runtimeVaultIsLocked, export: runtimeVaultExport, import: runtimeVaultImport }, // v0.8 §6 + v0.9 §14 (I13) portable export/import
       agents: { list: runtimeListAgents, active: runtimeAgentActive, setActive: runtimeSetActiveAgent, install: runtimeInstallAgent, uninstall: runtimeUninstallAgent, message: runtimeAgentMessage, showInstallDialog: showAgentInstallDialog }, // v0.9 §12 — multi-agent roles
       hookLog: runtimeHookLog, // v0.9 §9 — the hook audit trail (rwa_hook_log)
     };
@@ -8764,6 +9014,10 @@ document.addEventListener('keydown', e => {
       configurable: false,
     });
     startWorkspacePresence();
+    // I2 (v0.9 §10) — background idle eviction (every 30s, terminate compute Workers idle ≥ idleMs)
+    // + drain the pool on unload (shutdown handshake + 500ms grace). No-op until a pooled invoke runs.
+    setInterval(_skPoolEvictIdle, 30000);
+    window.addEventListener('pagehide', () => { _skPoolShutdown(); });
     // §5.10: the presentation render mode ships ONLY for presentation
     // containers. For every other kind this block is skipped entirely —
     // activeView stays null, no provider is registered, no chrome is built,

package/src/skill-manifest.mjs

@@ -348,6 +348,13 @@ export function validateInstall(envelope, { signed, verified } = {}) {
   // §9 (I8): a hook is compute-only — only hook:<event> perms are allowed; any other tier (a real
   // capability) is rejected as compute_with_permissions (no network/vault/escalation in a hook).
   if (skill.kind === 'hook' && perms.some((p) => { try { return parsePermission(p).tier !== 'hook'; } catch { return false; } })) errors.push('compute_with_permissions');
+  // §8 (I7): view/edit-surface are zero-capability DOM authors — any permission is rejected (no
+  // render→fetch encoding loop), and they MUST carry a matching typed output contract.
+  if (skill.kind === 'view' || skill.kind === 'edit-surface') {
+    if (perms.length > 0) errors.push('output_skill_with_permissions');
+    const want = skill.kind === 'view' ? 'html-render' : 'dom-transform';
+    if (!skill.output || skill.output.kind !== want) errors.push('invalid_output_kind');
+  }
   if (!signed && perms.length > 0) errors.push('unsigned_with_permissions');
   // Tools AND hooks carry capability (a hook runs autonomously on events) → must be signed+verified.
   if ((skill.kind === 'tool' || skill.kind === 'hook') && !verified) errors.push('unsigned_capability');

package/src/skill-publish.mjs

@@ -0,0 +1,59 @@
+// `rwa skill publish <file.rwa-skill.json>` — publish a signed skill envelope to the marketplace
+// index (`POST /skills/publish`, service/server.js, I6 §11) and return its registry URL.
+//
+// A THIN client: the envelope is ALREADY signed (no private key needed to publish — the signature
+// travels in the envelope). The local verify here is fail-fast only; the server re-validates
+// authoritatively (verifyEnvelope + validateInstall). Intentionally ONLINE (offline-first excludes
+// it, like `rwa publish`/`clone`). Failure surface mirrors `rwa publish`: exit 2 file_error, exit 3
+// for a gate failure (unsigned/compute_with_permissions), exit 4 for every remote/network failure.
+import { readFile } from 'node:fs/promises';
+import { CliError } from './edit.mjs';
+import { verifyEnvelope, validateInstall } from './skill-manifest.mjs';
+
+export const DEFAULT_SKILLS_URL = 'https://rewritable.ikangai.com';
+
+/**
+ * @param {string} filePath  a .rwa-skill.json envelope
+ * @param {{ baseUrl?: string, fetchImpl?: Function }} [opts]  fetchImpl is injected in tests
+ * @returns {Promise<{skillId:string, registryUrl:string, verified:boolean}>}
+ * @throws {CliError} 2 file_error · 3 gate failure · 4 publish_error
+ */
+export async function skillPublishCmd(filePath, { baseUrl, fetchImpl } = {}) {
+  const doFetch = fetchImpl || globalThis.fetch;
+  let bytes;
+  try { bytes = await readFile(filePath, 'utf8'); }
+  catch (e) {
+    if (e && e.code === 'ENOENT') throw new CliError(2, 'not_found', { path: filePath });
+    throw new CliError(2, 'read_error', { path: filePath, errno: e && e.code, message: e && e.message });
+  }
+  let env;
+  try { env = JSON.parse(bytes); } catch { throw new CliError(2, 'not_a_skill', { path: filePath, reason: 'invalid_json' }); }
+  if (!env || env.format !== 'rwa-skill/1' || !env.skill || typeof env.skill.name !== 'string') {
+    throw new CliError(2, 'not_a_skill', { path: filePath });
+  }
+  // Local fail-fast gate — the same codes the server returns (avoids a wasted round trip + works offline).
+  const { signed, verified } = verifyEnvelope(env);
+  const gate = validateInstall(env, { signed, verified });
+  if (!gate.ok) throw new CliError(3, gate.errors[0], { errors: gate.errors });
+
+  const base = (baseUrl || DEFAULT_SKILLS_URL).replace(/\/+$/, '');
+  const endpoint = `${base}/skills/publish`;
+  let res;
+  try { res = await doFetch(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(env) }); }
+  catch (e) { throw new CliError(4, 'network_error', { url: endpoint, message: (e && e.message) || String(e) }); }
+
+  const text = await res.text();
+  let payload = null;
+  if (text) { try { payload = JSON.parse(text); } catch { payload = null; } }
+
+  if (res.status === 201) {
+    if (!payload || typeof payload.skillId !== 'string') throw new CliError(4, 'server_error', { status: 201, error: 'malformed_success_response' });
+    return { skillId: payload.skillId, verified: !!payload.verified, registryUrl: base + (payload.registryUrl || '/skills/index/' + payload.skillId) };
+  }
+  const errName = payload && typeof payload.error === 'string' ? payload.error : null;
+  if (res.status === 422) throw new CliError(3, errName || 'validation_failed', { errors: payload && payload.errors });
+  if (res.status === 429 || errName === 'rate_limited') throw new CliError(4, 'rate_limited', { retryAfterSec: payload && payload.retryAfterSec });
+  if (res.status === 410) throw new CliError(4, 'revoked', {});
+  if (res.status >= 500) throw new CliError(4, 'server_error', { status: res.status, error: errName });
+  throw new CliError(4, 'unexpected_status', { status: res.status, error: errName });
+}