skillpack-one 0.1.0-alpha.10

package/.agents/skills/category-security-trust/references/index.en.md

@@ -0,0 +1,11 @@
+# Security and trust: Atomic Skills
+
+Identify, prevent, or govern security, privacy, safety, and integrity risks.
+
+## Atomic Skills
+
+- `atom-audit-source-security` — **Audit source security**: Return evidence-backed vulnerability findings for a bounded code surface
+  - Risk: `read-only`
+  - Lifecycle: analyze, verify
+
+Read only the selected Atomic Skill. Use a capability pack when the request has independently useful outcomes.

package/.agents/skills/category-security-trust/references/index.md

@@ -0,0 +1,11 @@
+# Security and trust: Atomic Skills
+
+Identify, prevent, or govern security, privacy, safety, and integrity risks.
+
+## Atomic Skills
+
+- `atom-audit-source-security` — **Audit source security**: Return evidence-backed vulnerability findings for a bounded code surface
+  - Risk: `read-only`
+  - Lifecycle: analyze, verify
+
+Read only the selected Atomic Skill. Use a capability pack when the request has independently useful outcomes.

package/.agents/skills/category-security-trust/references/index.zh-CN.md

@@ -0,0 +1,11 @@
+# 安全与信任: 原子 Skill
+
+识别、预防或治理安全、隐私、可靠性和完整性风险。
+
+## 原子 Skill
+
+- `atom-audit-source-security` — **审计源码安全**: 对边界明确的代码范围返回有证据的漏洞发现
+  - 风险: `read-only`
+  - 生命周期: analyze, verify
+
+只读取最终选中的原子 Skill；若请求包含多个独立结果，请改用能力包。

package/.agents/skills/category-security-trust/references/index.zh.md

@@ -0,0 +1,11 @@
+# 安全与信任: 原子 Skill
+
+识别、预防或治理安全、隐私、可靠性和完整性风险。
+
+## 原子 Skill
+
+- `atom-audit-source-security` — **审计源码安全**: 对边界明确的代码范围返回有证据的漏洞发现
+  - 风险: `read-only`
+  - 生命周期: analyze, verify
+
+只读取最终选中的原子 Skill；若请求包含多个独立结果，请改用能力包。

package/.agents/skills/category-security-trust/skill.contract.yaml

@@ -0,0 +1,26 @@
+schemaVersion: 1
+id: category-security-trust
+kind: category
+version: 0.1.0
+name: { en: Security and Trust Router, zh-CN: 安全与信任路由器 }
+summary: { en: Route security and integrity outcomes to specialized trust atoms., zh-CN: 将安全与完整性结果路由到专门的信任原子能力。 }
+outcomes: [Bounded security-trust category decision]
+artifacts: [category-route, localized-index]
+inputs: [{ name: request, type: user-prompt, required: true }]
+outputs: [{ name: candidates, type: category-and-atom-candidates, required: true }]
+preconditions: [The versioned taxonomy and localized index are available]
+failures: [The protected asset, threat, or authority boundary cannot be identified]
+sideEffects: [filesystem-read]
+permissions: { network: none, filesystem: read, shell: none, secrets: none, externalCommunication: none }
+taxonomy:
+  primaryCategory: security-trust
+  lifecycle: [analyze]
+  modalities: [text, structured-data]
+  dependencies: [tool-agnostic]
+  risk: read-only
+routing:
+  positiveTriggers: { en: [audit security, analyze threats, review permissions, verify provenance], zh-CN: [审计安全, 分析威胁, 审查权限, 验证来源] }
+  negativeTriggers: { en: [ordinary functional debugging, generic quality review], zh-CN: [普通功能调试, 通用质量审查] }
+  confusableWith: [category-software-engineering, category-skill-agent-governance]
+provenance: { origin: local, license: Apache-2.0 }
+evaluations: [routing-bootstrap, routing-en-test, routing-zh-cn-test, routing-adversarial]

package/.agents/skills/category-skill-agent-governance/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: category-skill-agent-governance
+description: Route creation, classification, deduplication, composition, evaluation, release, and evolution of Skills, MCPs, plugins, agents, and harnesses; use when the capability system itself is the object being changed or assessed.
+---
+
+# Skill and Agent Governance Router
+
+1. Identify whether the request concerns classification, creation, evaluation, packaging, or governed evolution.
+2. Read the localized Atomic Skill index in `references/`.
+3. Use `meta-skill-governor` for lifecycle changes that can alter active capabilities.
+4. Keep normal use of a domain Skill in that domain rather than routing everything about agents here.
+
+No governance operation may bypass provenance, held-out evaluation, permission review, or rollback.

package/.agents/skills/category-skill-agent-governance/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: Category Skill Agent Governance
+  short_description: Route and apply Category Skill Agent Governance
+  default_prompt: Use $category-skill-agent-governance to handle this request
+    within its declared capability boundary.
+policy:
+  allow_implicit_invocation: true

package/.agents/skills/category-skill-agent-governance/references/index.en.md

@@ -0,0 +1,11 @@
+# Skill and agent governance: Atomic Skills
+
+Classify, compose, evaluate, release, and evolve agent capabilities and harnesses.
+
+## Atomic Skills
+
+- `atom-classify-capability` — **Classify a capability**: Produce a boundary-aware taxonomy and contract proposal for one capability
+  - Risk: `read-only`
+  - Lifecycle: analyze, govern
+
+Read only the selected Atomic Skill. Use a capability pack when the request has independently useful outcomes.

package/.agents/skills/category-skill-agent-governance/references/index.md

@@ -0,0 +1,11 @@
+# Skill and agent governance: Atomic Skills
+
+Classify, compose, evaluate, release, and evolve agent capabilities and harnesses.
+
+## Atomic Skills
+
+- `atom-classify-capability` — **Classify a capability**: Produce a boundary-aware taxonomy and contract proposal for one capability
+  - Risk: `read-only`
+  - Lifecycle: analyze, govern
+
+Read only the selected Atomic Skill. Use a capability pack when the request has independently useful outcomes.

package/.agents/skills/category-skill-agent-governance/references/index.zh-CN.md

@@ -0,0 +1,11 @@
+# Skill 与 Agent 治理: 原子 Skill
+
+分类、组合、评测、发布和进化 Agent 能力与 Harness。
+
+## 原子 Skill
+
+- `atom-classify-capability` — **分类能力**: 为一个能力产出带边界的分类与契约提案
+  - 风险: `read-only`
+  - 生命周期: analyze, govern
+
+只读取最终选中的原子 Skill；若请求包含多个独立结果，请改用能力包。

package/.agents/skills/category-skill-agent-governance/references/index.zh.md

@@ -0,0 +1,11 @@
+# Skill 与 Agent 治理: 原子 Skill
+
+分类、组合、评测、发布和进化 Agent 能力与 Harness。
+
+## 原子 Skill
+
+- `atom-classify-capability` — **分类能力**: 为一个能力产出带边界的分类与契约提案
+  - 风险: `read-only`
+  - 生命周期: analyze, govern
+
+只读取最终选中的原子 Skill；若请求包含多个独立结果，请改用能力包。

package/.agents/skills/category-skill-agent-governance/skill.contract.yaml

@@ -0,0 +1,26 @@
+schemaVersion: 1
+id: category-skill-agent-governance
+kind: category
+version: 0.1.0
+name: { en: Skill and Agent Governance Router, zh-CN: Skill 与 Agent 治理路由器 }
+summary: { en: Route capability-system creation and lifecycle work to governance atoms and Meta Skills., zh-CN: 将能力系统创建与生命周期工作路由到治理原子和元 Skill。 }
+outcomes: [Bounded skill-agent-governance category decision]
+artifacts: [category-route, localized-index]
+inputs: [{ name: request, type: user-prompt, required: true }]
+outputs: [{ name: candidates, type: category-and-atom-candidates, required: true }]
+preconditions: [The versioned taxonomy and localized index are available]
+failures: [The request concerns normal domain use rather than capability-system governance]
+sideEffects: [filesystem-read]
+permissions: { network: none, filesystem: read, shell: none, secrets: none, externalCommunication: none }
+taxonomy:
+  primaryCategory: skill-agent-governance
+  lifecycle: [analyze, govern]
+  modalities: [text, structured-data]
+  dependencies: [tool-agnostic]
+  risk: read-only
+routing:
+  positiveTriggers: { en: [create a skill, classify a capability, evaluate skill routing, evolve a skill system], zh-CN: [创建 Skill, 分类能力, 评测 Skill 路由, 进化 Skill 系统] }
+  negativeTriggers: { en: [use a domain skill normally, train an unrelated model], zh-CN: [正常使用领域 Skill, 训练无关模型] }
+  confusableWith: [category-software-engineering, category-security-trust]
+provenance: { origin: local, license: Apache-2.0 }
+evaluations: [routing-bootstrap, routing-en-test, routing-zh-cn-test, routing-adversarial]

package/.agents/skills/category-software-engineering/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: category-software-engineering
+description: Route broad software requests to the smallest verified coding, testing, architecture, debugging, review, or delivery Atomic Skills; use when executable software is the primary outcome and the exact implementation capability is not yet clear.
+---
+
+# Software Engineering Router
+
+1. Identify the requested executable artifact and lifecycle stage.
+2. Keep security reviews in `category-security-trust` when a trust property defines success.
+3. Read `references/index.en.md` or `references/index.zh-CN.md` for the current atoms.
+4. Select the smallest atom set whose outputs cover the request; use a capability pack for independent outcomes.
+5. Preserve ambiguity when planning, implementation, and review are not distinguishable from the request.
+
+Do not use this category for general research, visual design without implementation, or Skill governance.

package/.agents/skills/category-software-engineering/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: Category Software Engineering
+  short_description: Route and apply Category Software Engineering
+  default_prompt: Use $category-software-engineering to handle this request within
+    its declared capability boundary.
+policy:
+  allow_implicit_invocation: true

package/.agents/skills/category-software-engineering/references/index.en.md

@@ -0,0 +1,17 @@
+# Software engineering: Atomic Skills
+
+Create, change, verify, ship, or operate executable software artifacts.
+
+## Atomic Skills
+
+- `atom-audit-source-security` — **Audit source security**: Return evidence-backed vulnerability findings for a bounded code surface
+  - Risk: `read-only`
+  - Lifecycle: analyze, verify
+- `atom-implement-code-change` — **Implement a code change**: Edit and verify one bounded software behavior
+  - Risk: `reversible-write`
+  - Lifecycle: create, verify
+- `atom-plan-code-change` — **Plan a code change**: Produce an implementation-ready plan without changing source files
+  - Risk: `read-only`
+  - Lifecycle: plan
+
+Read only the selected Atomic Skill. Use a capability pack when the request has independently useful outcomes.

package/.agents/skills/category-software-engineering/references/index.md

@@ -0,0 +1,17 @@
+# Software engineering: Atomic Skills
+
+Create, change, verify, ship, or operate executable software artifacts.
+
+## Atomic Skills
+
+- `atom-audit-source-security` — **Audit source security**: Return evidence-backed vulnerability findings for a bounded code surface
+  - Risk: `read-only`
+  - Lifecycle: analyze, verify
+- `atom-implement-code-change` — **Implement a code change**: Edit and verify one bounded software behavior
+  - Risk: `reversible-write`
+  - Lifecycle: create, verify
+- `atom-plan-code-change` — **Plan a code change**: Produce an implementation-ready plan without changing source files
+  - Risk: `read-only`
+  - Lifecycle: plan
+
+Read only the selected Atomic Skill. Use a capability pack when the request has independently useful outcomes.

package/.agents/skills/category-software-engineering/references/index.zh-CN.md

@@ -0,0 +1,17 @@
+# 软件工程: 原子 Skill
+
+创建、修改、验证、发布或运行可执行的软件产物。
+
+## 原子 Skill
+
+- `atom-audit-source-security` — **审计源码安全**: 对边界明确的代码范围返回有证据的漏洞发现
+  - 风险: `read-only`
+  - 生命周期: analyze, verify
+- `atom-implement-code-change` — **实现代码修改**: 编辑并验证一个边界清晰的软件行为
+  - 风险: `reversible-write`
+  - 生命周期: create, verify
+- `atom-plan-code-change` — **规划代码修改**: 在不修改源码的前提下产出可实施计划
+  - 风险: `read-only`
+  - 生命周期: plan
+
+只读取最终选中的原子 Skill；若请求包含多个独立结果，请改用能力包。

package/.agents/skills/category-software-engineering/references/index.zh.md

@@ -0,0 +1,17 @@
+# 软件工程: 原子 Skill
+
+创建、修改、验证、发布或运行可执行的软件产物。
+
+## 原子 Skill
+
+- `atom-audit-source-security` — **审计源码安全**: 对边界明确的代码范围返回有证据的漏洞发现
+  - 风险: `read-only`
+  - 生命周期: analyze, verify
+- `atom-implement-code-change` — **实现代码修改**: 编辑并验证一个边界清晰的软件行为
+  - 风险: `reversible-write`
+  - 生命周期: create, verify
+- `atom-plan-code-change` — **规划代码修改**: 在不修改源码的前提下产出可实施计划
+  - 风险: `read-only`
+  - 生命周期: plan
+
+只读取最终选中的原子 Skill；若请求包含多个独立结果，请改用能力包。

package/.agents/skills/category-software-engineering/skill.contract.yaml

@@ -0,0 +1,26 @@
+schemaVersion: 1
+id: category-software-engineering
+kind: category
+version: 0.1.0
+name: { en: Software Engineering Router, zh-CN: 软件工程路由器 }
+summary: { en: Route executable software work to the smallest verified engineering atoms., zh-CN: 将可执行软件工作路由到最小且已验证的工程原子能力。 }
+outcomes: [Bounded software-engineering category decision]
+artifacts: [category-route, localized-index]
+inputs: [{ name: request, type: user-prompt, required: true }]
+outputs: [{ name: candidates, type: category-and-atom-candidates, required: true }]
+preconditions: [The versioned taxonomy and localized index are available]
+failures: [The request does not expose a stable software outcome or boundary]
+sideEffects: [filesystem-read]
+permissions: { network: none, filesystem: read, shell: none, secrets: none, externalCommunication: none }
+taxonomy:
+  primaryCategory: software-engineering
+  lifecycle: [analyze]
+  modalities: [text, structured-data]
+  dependencies: [tool-agnostic]
+  risk: read-only
+routing:
+  positiveTriggers: { en: [implement software, fix a bug, test code, design software architecture], zh-CN: [实现软件, 修复缺陷, 测试代码, 设计软件架构] }
+  negativeTriggers: { en: [security audit, general research, visual design only], zh-CN: [安全审计, 通用研究, 仅视觉设计] }
+  confusableWith: [category-security-trust, category-design-media]
+provenance: { origin: local, license: Apache-2.0 }
+evaluations: [routing-bootstrap, routing-en-test, routing-zh-cn-test, routing-adversarial]

package/.agents/skills/meta-skill-governor/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: meta-skill-governor
+description: Govern discovery, updates, optimization, learning, migration, deprecation, promotion, and rollback of other Skills and this Skill itself; use for evidence-backed lifecycle changes, never for silently rewriting active capabilities.
+---
+
+# Meta Skill Governor
+
+Treat every Skill change as a versioned software change with explicit authority.
+
+## Workflow
+
+1. Record the observation, failing examples, affected contracts, and current baseline. Search `.skill-system/knowledge/index.md` for relevant active patterns and read only those pattern records; never inject this governance knowledge into normal task execution.
+2. Create a bounded proposal. It may change only declared files, cite the motivating Evolution Knowledge pattern IDs when available, and may not expand permissions without explicit review.
+3. Build the candidate in an isolated sandbox. Do not modify active projections.
+4. Record every optimizer step as an append-only bounded evolution attempt. Permit only explicit add, delete, or replace edits within the proposal, enforce an edit budget, and reject ties. Keep attempted edits and their measured score changes even when rejected.
+5. Evaluate on train and dev suites, select only a strictly improving candidate, then evaluate on untouched held-out and adversarial suites.
+6. Reject the candidate if any protected safety metric regresses, provenance is incomplete, the edit budget is exceeded, or the improvement is not reproducible.
+7. Record approval, canary scope, release revision, and a tested rollback pointer.
+8. Monitor the canary; promote or rollback from evidence. Preserve rejected outcomes as evidence and consolidate only recurring, generalizable findings into Evolution Knowledge.
+
+Optimizer-only summaries may guide later proposals but must not be shipped inside an Atomic Skill or exposed to ordinary task execution. Treat every update as a new lifecycle admission event rather than inheriting trust from an earlier version.
+
+Read `references/knowledge-policy.en.md` or `references/knowledge-policy.zh-CN.md` when creating, updating, superseding, or archiving an Evolution Knowledge pattern.
+
+## Self-modification rule
+
+Changes to this Skill follow exactly the same workflow. The same proposal must not weaken this gate, replace its held-out set, erase its audit record, or remove its rollback path.
+
+## Deletion rule
+
+Prefer deprecation and reversible archival. Physical deletion is a separate, explicitly authorized maintenance action after dependency and retention checks.
+
+Read `references/evolution-policy.en.md` or `references/evolution-policy.zh-CN.md` for gate details.

package/.agents/skills/meta-skill-governor/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: Meta Skill Governor
+  short_description: Route and apply Meta Skill Governor
+  default_prompt: Use $meta-skill-governor to handle this request within its
+    declared capability boundary.
+policy:
+  allow_implicit_invocation: true

package/.agents/skills/meta-skill-governor/references/evolution-policy.en.md

@@ -0,0 +1,8 @@
+# Evolution policy
+
+- Training evidence can motivate a patch but cannot certify it.
+- Test and adversarial examples must remain hidden from proposal generation.
+- Protected safety metrics require a perfect pass unless a stricter project policy applies.
+- Permission expansion, external communication, destructive actions, and secret access require explicit human approval.
+- Every decision is append-only and links the base revision, candidate revision, datasets, harness version, metrics, reviewer, canary, and rollback revision.
+- A failed candidate remains a learning record; it never becomes the active projection.

package/.agents/skills/meta-skill-governor/references/evolution-policy.zh-CN.md

@@ -0,0 +1,8 @@
+# 进化策略
+
+- 训练集证据可以推动修改，但不能证明修改可上线。
+- 留出集和对抗集不能暴露给提案生成过程。
+- 受保护的安全指标必须全部通过，除非项目采用更严格的规则。
+- 扩大权限、对外发送、破坏性动作和读取密钥必须由人显式批准。
+- 每条决策只追加，关联基础 revision、候选 revision、数据集、Harness 版本、指标、审查人、灰度范围与回滚 revision。
+- 失败候选可以保留为学习记录，但绝不能成为活动投影。

package/.agents/skills/meta-skill-governor/references/knowledge-policy.en.md

@@ -0,0 +1,9 @@
+# Evolution Knowledge policy
+
+- Raw task traces and run artifacts remain immutable evidence outside normal Skill context.
+- A pattern must state the problem, root cause, response, scope, confidence, and at least one traceable evidence reference.
+- Consolidate only recurring or independently useful observations; do not turn one anecdote into a universal rule.
+- Search active patterns before proposing a change, and cite relevant pattern IDs in the proposal.
+- A rejected Skill proposal remains evidence. It may refine a pattern but never activates a Skill.
+- Supersede or archive obsolete patterns instead of silently deleting them; preserve evidence and provenance.
+- Evolution Knowledge is available to Meta governance, not to ordinary task execution. This separation keeps Skill-effect evaluation from being contaminated by hidden task-solving context.

package/.agents/skills/meta-skill-governor/references/knowledge-policy.zh-CN.md

@@ -0,0 +1,9 @@
+# 进化知识策略
+
+- 原始任务轨迹和运行产物作为不可变证据保存，不进入普通 Skill 上下文。
+- 每个模式必须说明问题、根因、应对方式、适用范围、置信度，并至少关联一条可追溯证据。
+- 只沉淀重复出现或可独立复用的观察；不能把单个案例直接变成通用规则。
+- 提案前先检索活动模式，并在提案中引用相关模式 ID。
+- 被拒绝的 Skill 提案仍是证据，可以修正模式，但绝不能激活 Skill。
+- 过时模式应标记为已取代或归档，不得静默删除；证据和来源必须保留。
+- 进化知识只提供给元治理，不提供给普通任务执行，避免隐藏的解题上下文污染 Skill 效果评测。

package/.agents/skills/meta-skill-governor/skill.contract.yaml

@@ -0,0 +1,51 @@
+schemaVersion: 1
+id: meta-skill-governor
+kind: meta
+version: 0.1.0
+name:
+  en: Meta Skill Governor
+  zh-CN: 元 Skill 治理器
+summary:
+  en: Propose, evaluate, release, deprecate, and roll back governed Skill changes.
+  zh-CN: 提议、评测、发布、弃用和回滚受治理的 Skill 变更。
+outcomes:
+  - Auditable Skill lifecycle decision
+artifacts: [evolution-pattern, change-proposal, evaluation-record, release-decision, rollback-pointer]
+inputs:
+  - name: observation
+    type: evidence
+    required: true
+outputs:
+  - name: decision
+    type: governance-record
+    required: true
+preconditions:
+  - The active registry and protected evaluation baselines are available
+failures:
+  - The proposal expands authority without explicit approval
+  - Held-out or protected suites fail
+sideEffects: [filesystem-read, filesystem-write, shell-execution]
+permissions:
+  network: read
+  filesystem: workspace-write
+  shell: allowlisted
+  secrets: none
+  externalCommunication: none
+taxonomy:
+  primaryCategory: skill-agent-governance
+  lifecycle: [govern]
+  modalities: [text, structured-data, system-state]
+  dependencies: [harness-backed]
+  risk: reversible-write
+routing:
+  positiveTriggers:
+    en: [update a skill, optimize skill routing, deprecate a skill, roll back a skill, self-improve skills]
+    zh-CN: [更新 Skill, 优化 Skill, 优化 Skill 路由, 弃用 Skill, 回滚 Skill, Skill 自优化]
+  negativeTriggers:
+    en: [use the skill normally, silently delete]
+    zh-CN: [正常使用 Skill, 静默删除]
+  confusableWith: [atom-classify-capability]
+provenance:
+  origin: local
+  license: Apache-2.0
+evaluations: [governance-protected, routing-governance]

package/.codex-plugin/plugin.json

@@ -0,0 +1,41 @@
+{
+  "name": "skillpack-one",
+  "version": "0.1.0-alpha.10",
+  "description": "Install one pack. Let it find, combine, and improve the skills you need.",
+  "author": {
+    "name": "WnagoiYy",
+    "email": "995496580@qq.com",
+    "url": "https://github.com/WnagoiYy"
+  },
+  "homepage": "https://github.com/WnagoiYy/skillpack-one",
+  "repository": "https://github.com/WnagoiYy/skillpack-one",
+  "license": "Apache-2.0",
+  "keywords": [
+    "agent-skills",
+    "atomic-skills",
+    "codex",
+    "evaluation",
+    "mcp",
+    "self-improving"
+  ],
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "SkillPack One",
+    "shortDescription": "One pack for the skills you need",
+    "longDescription": "Install one pack that classifies, combines, evaluates, and safely improves atomic Agent Skills and MCP capabilities through the Self-Organizing Skill System.",
+    "developerName": "WnagoiYy",
+    "category": "Developer Tools",
+    "capabilities": [
+      "Skill routing",
+      "Capability catalog",
+      "Evaluation",
+      "Governed evolution"
+    ],
+    "defaultPrompt": [
+      "Find the smallest skills needed for this task.",
+      "Evaluate routing and completion for this skill pack.",
+      "Propose a safe, tested improvement to these skills."
+    ],
+    "brandColor": "#5B5BD6"
+  }
+}

package/.skill-system/knowledge/index.md

@@ -0,0 +1,8 @@
+# Evolution Knowledge
+
+Generated from versioned pattern records. This index is governance context, not task-execution instruction.
+
+- `experience-insights-fragment-across-iterations` — Skill evolution repeats mistakes when trace insights and rejected interventions remain scattered across iteration artifacts.
+  - Status: `active`; confidence: `observed`; scope: `meta-skill-governor`, `safe-skill-evolution`
+- `long-horizon-history-obscures-current-state` — Append-only conversational history makes long procedural execution costly and allows obsolete observations to compete with the current world state.
+  - Status: `active`; confidence: `observed`; scope: `meta-skill-governor`, `safe-skill-evolution`

package/.skill-system/knowledge/patterns/experience-insights-fragment-across-iterations.yaml

@@ -0,0 +1,21 @@
+schemaVersion: 1
+id: experience-insights-fragment-across-iterations
+status: active
+summary: Skill evolution repeats mistakes when trace insights and rejected interventions remain scattered across iteration artifacts.
+problem: Later Skill proposals cannot reliably reuse recurring success and failure patterns or distinguish them from one-off observations.
+rootCause: Raw traces, proposal diffs, and promotion outcomes preserve evidence but do not provide a separately indexed, consolidated knowledge representation.
+response: Maintain a non-executable Evolution Knowledge layer with scoped patterns, immutable evidence references, supersession instead of silent deletion, and explicit proposal links. Keep this layer available to Meta governance but out of normal task execution context.
+confidence: observed
+scope:
+  skills: [meta-skill-governor]
+  packs: [safe-skill-evolution]
+  harnesses: []
+evidence:
+  - kind: paper
+    ref: https://arxiv.org/pdf/2608.27454
+    locator: Sections 3.1-3.2, Table 3, and Limitations
+    digest: sha256:65afc6e12f6f707483fe1b79a97ab67c03abf4b4992f82fde03eb7b8d9ad4a69
+    note: WikiSkill separates immutable traces, persistent patterns and impact logs, and reversible active Skills; its ablation reports better evolution when the proposer, but not the inference agent, accesses the wiki.
+supersedes: []
+createdAt: 2026-09-02T00:00:00Z
+updatedAt: 2026-09-02T00:00:00Z

package/.skill-system/knowledge/patterns/long-horizon-history-obscures-current-state.yaml

@@ -0,0 +1,21 @@
+schemaVersion: 1
+id: long-horizon-history-obscures-current-state
+status: active
+summary: Append-only conversational history makes long procedural execution costly and allows obsolete observations to compete with the current world state.
+problem: Long-running capability packs repeatedly reconstruct current facts from growing transcripts, which increases tokens and can delay recovery after environment changes.
+rootCause: Future decisions are conditioned on accumulated textual history instead of a validated, bounded representation of only the state needed for the next action.
+response: Offer opt-in, pack-specific runtime-state profiles with deterministic JSON Merge Patch semantics, schema validation before commit, and an external immutable audit log. Use them only when the state can be a sufficient statistic; retain history-based execution for audit, provenance, or dynamically discovered state tasks.
+confidence: observed
+scope:
+  skills: [meta-skill-governor]
+  packs: [safe-skill-evolution]
+  harnesses: []
+evidence:
+  - kind: paper
+    ref: https://arxiv.org/pdf/2608.26263
+    locator: Sections 3 and 5, Tables 1 and 4, and Limitations
+    digest: sha256:5cb417429cb711fb9f4ff01556ab9fc6e82e1d16bec95da604d6e8447994604e
+    note: SKILL.state reports bounded per-step prompt footprints and lower cumulative token use on controlled and public interactive benchmarks, while stating that fixed sufficient-state schemas do not fit every task.
+supersedes: []
+createdAt: 2026-09-02T00:00:00Z
+updatedAt: 2026-09-02T00:00:00Z

package/CONTRIBUTING.md

@@ -0,0 +1,51 @@
+# Contributing
+
+Changes are welcome when they preserve atomicity, provenance, and evidence. Please open an issue for taxonomy-wide changes before implementation.
+
+Contributions may be authored by people, drafted by models, or produced collaboratively. Generation never counts as approval: the repository evaluates the resulting capability and evidence, not the identity or fluency of the author.
+
+## Development
+
+```sh
+npm ci
+npm run ci
+```
+
+Edit canonical Skills only in `skill-src/`, then run `npm run skills:generate`. Never edit `skills/` or `.agents/skills/` directly.
+
+## Change types
+
+- **Catalog record:** preserve source, revision, path, license state, fingerprint, and trust state. Cataloging does not authorize installation.
+- **Atomic Skill:** declare one primary capability, explicit inputs and outputs, boundaries, permissions, side effects, failure modes, and verification.
+- **Category Skill:** justify the needs-based boundary and add multilingual positive, negative, and ambiguous routing cases.
+- **Capability pack:** compose existing stable capability IDs; do not copy or merge their instructions.
+- **Meta/evolution change:** submit a bounded proposal and do not alter the target, protected tests, baseline, and gate in one change.
+
+Every first-party Skill type must include both a portable `SKILL.md` and a valid `skill.contract.yaml`. Category additions must also declare a taxonomy node, respect the configured three-level maximum, and regenerate the parent and localized indexes.
+
+## Admission workflow
+
+1. Search the registry and catalog for equivalent outcomes before creating a new Skill.
+2. Submit provenance, license state, contract, permission envelope, localized routing examples, and evaluation cases.
+3. Use model-assisted classification and duplicate analysis where helpful, but do not let the model that generated a change be its sole approver.
+4. Treat submitted instructions, resources, and scripts as untrusted; review prompt injection, provenance, static behavior, and requested authority before any sandbox or live execution.
+5. Require an independent model review, maintainer review, or both in proportion to security, authority, and provenance risk.
+6. Prefer improving or composing existing atoms when the proposal has no independently useful outcome or failure boundary.
+7. Compare matched no-Skill and with-Skill task runs. Reject negative lift; do not use synthetic evidence to certify quality.
+8. Regenerate indexes and projections, run isolated development and protected suites, then record promotion or rollback through the append-only governance log.
+9. If recurring evidence already has an Evolution Knowledge pattern, cite it in the proposal; if not, create a narrow evidence-backed pattern instead of copying raw traces into a Skill.
+
+Reviews must report whether the proposal was accepted as a new Atom, merged into an existing Atom, composed as a pack, returned for evidence, rejected, or marked for deprecation. Similarity alone never authorizes deletion.
+
+## Pull request checklist
+
+1. Add or update tests before behavior changes.
+2. Run `npm run ci` and include relevant harness identity and version.
+3. Explain permission changes and obtain explicit approval for every expansion.
+4. Keep test/adversarial/task datasets out of proposal generation.
+5. Preserve upstream attribution and do not vendor unknown-license content.
+6. Report synthetic, blocked, and live evidence separately.
+7. State which person or model generated the proposal and which independent reviewer approved it.
+8. For multi-Skill work, show the Capability Pack subset, dependency order, handoff assumptions, and acceptance tests.
+
+By contributing, you agree that your contribution is licensed under Apache-2.0.