skillwiki 0.10.75 → 0.10.77

package/dist/{chunk-4XCBKPKD.js → chunk-5XT6MBWA.js}

@@ -3360,6 +3360,7 @@ function buildCliSurface() {
   program.command("project-page");
   program.command("write-preflight").option("--command <name>").option("--dirty-threshold <n>").option("--skip-dirty").option("--prior-artifact-file <path>").option("--prior-artifact-text <text>").option("--consecutive-no-decision <n>").option("--no-decision-threshold <n>").option("--human-allow").option("--mission-kind <kind>").option("--skip-mission").option("--project <slug>").option("--capture-day <date>").option("--capture-budget <n>").option("--severity <level>").option("--skip-budget").option("--checks <list>").option("--wiki <name>");
   program.command("mcp");
+  program.command("mcp-auth");
   const graphCmd = program.commands.find((c) => c.name() === "graph");
   graphCmd.command("build").option("--out <path>").option("--wiki <name>");
   const vectorsCmd = program.commands.find((c) => c.name() === "vectors");
@@ -3436,6 +3437,8 @@ function buildCliSurface() {
   fleetCmd.command("validate");
   fleetCmd.command("context").option("--file <path>").option("--host-id <id>");
   fleetCmd.command("health").option("--file <path>").option("--host-id <id>").option("--json");
+  const mcpAuth = program.commands.find((c) => c.name() === "mcp-auth");
+  mcpAuth.command("issue-host").requiredOption("--host-id <id>").option("--map <path>").option("--write");
   const surface = /* @__PURE__ */ new Map();
   const rootFlags = new Set(program.options.map((o) => o.long ?? o.short).filter((f) => f != null));
   function walk(cmd, prefix, parentFlags) {

package/dist/{chunk-WAUWBPIQ.js → chunk-CLF6DZ6C.js}

@@ -40,7 +40,7 @@ import {
   snapshotterAliasForLocalHost,
   toUndirectedWeighted,
   writeDotenv
-} from "./chunk-4XCBKPKD.js";
+} from "./chunk-5XT6MBWA.js";
 import {
   atomicWriteText,
   prepareTypedPage

package/dist/cli.js

@@ -50,7 +50,7 @@ import {
   snapshotterHealthChecks,
   upsertIndexEntry,
   vectorIndexStatus
-} from "./chunk-WAUWBPIQ.js";
+} from "./chunk-CLF6DZ6C.js";
 import {
   normalizeDistTag,
   readCache,
@@ -151,7 +151,7 @@ import {
   supersedeStaleReviewRequiredJournals,
   taxonomyCommentForPage,
   writeDotenv
-} from "./chunk-4XCBKPKD.js";
+} from "./chunk-5XT6MBWA.js";
 import {
   assertTargetInsideVault,
   atomicWriteText,
@@ -10293,8 +10293,119 @@ async function postCommit(vault, exitCode) {
   clearLastOp(vault);
 }
 
+// src/commands/mcp-auth.ts
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync8 } from "fs";
+
+// src/utils/mcp-token-map.ts
+import { createHash as createHash7, randomBytes } from "crypto";
+import yaml from "js-yaml";
+var HOST_ID_RE = /^[a-z][a-z0-9-]{1,62}$/;
+function parseMcpTokenMap(yamlText) {
+  const parsed = yaml.load(yamlText);
+  const map = /* @__PURE__ */ new Map();
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return map;
+  }
+  const records = parsed;
+  const nested = records.tokens;
+  const source = nested && typeof nested === "object" && !Array.isArray(nested) ? nested : records;
+  for (const [hash, hostId] of Object.entries(source)) {
+    if (hash === "tokens") continue;
+    if (typeof hostId !== "string" || hostId.length === 0) continue;
+    const normalized = hash.trim().toLowerCase();
+    if (!/^[0-9a-f]{64}$/.test(normalized)) continue;
+    map.set(normalized, hostId);
+  }
+  return map;
+}
+function generateHostBearer(rng) {
+  const bytes = (rng ?? (() => randomBytes(32)))();
+  const raw = bytes.toString("base64url");
+  const hashHex = createHash7("sha256").update(raw, "utf8").digest("hex");
+  return { raw, hashHex };
+}
+function appendHostHash(yamlText, hashHex, hostId) {
+  if (!HOST_ID_RE.test(hostId)) {
+    return { error: "INVALID_HOST_ID" };
+  }
+  const map = parseMcpTokenMap(yamlText);
+  const normalizedHash = hashHex.trim().toLowerCase();
+  if ([...map.values()].includes(hostId)) {
+    return { error: "DUPLICATE_HOST_ID" };
+  }
+  if (map.has(normalizedHash)) {
+    return { error: "DUPLICATE_HASH" };
+  }
+  return { yaml: yamlText.replace(/\s*$/, "") + `
+${normalizedHash}: ${hostId}
+` };
+}
+
+// src/commands/mcp-auth.ts
+function isEnoent(error) {
+  return error.code === "ENOENT";
+}
+function preflight(error) {
+  return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err(error) };
+}
+async function runMcpAuthIssueHost(input) {
+  const isTty = input.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const readFile22 = input.readFile ?? readFileSync17;
+  const writeFile10 = input.writeFile ?? writeFileSync8;
+  const stderrWrite = input.stderrWrite ?? ((s) => {
+    process.stderr.write(s);
+  });
+  const write = Boolean(input.write);
+  const mapPath = input.mapPath;
+  const hostId = input.hostId;
+  if (!mapPath) return preflight("MAP_PATH_REQUIRED");
+  if (!HOST_ID_RE.test(hostId)) return preflight("INVALID_HOST_ID");
+  if (write && !isTty) return preflight("NO_TTY");
+  let yamlText = "";
+  try {
+    yamlText = readFile22(mapPath, "utf8");
+  } catch (error) {
+    if (!isEnoent(error)) throw error;
+  }
+  const map = parseMcpTokenMap(yamlText);
+  if ([...map.values()].includes(hostId)) return preflight("DUPLICATE_HOST_ID");
+  if (!write) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        host_id: hostId,
+        hash_prefix: "",
+        map_path: mapPath,
+        wrote: false
+      })
+    };
+  }
+  const { raw, hashHex } = generateHostBearer(input.rng);
+  const appended = appendHostHash(yamlText, hashHex, hostId);
+  if ("error" in appended) return preflight(appended.error);
+  try {
+    writeFile10(mapPath, appended.yaml, { encoding: "utf8", mode: 416 });
+  } catch (error) {
+    if (isEnoent(error)) {
+      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND") };
+    }
+    throw error;
+  }
+  stderrWrite(`issued host_id=${hostId} copy once: ${raw}
+`);
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      host_id: hostId,
+      hash_prefix: hashHex.slice(0, 8),
+      map_path: mapPath,
+      wrote: true
+    })
+  };
+}
+
 // src/commands/write-preflight.ts
-import { existsSync as existsSync15, readFileSync as readFileSync17, statSync as statSync5 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync18, statSync as statSync5 } from "fs";
 async function runWritePreflightCommand(input) {
   if (!existsSync15(input.vault) || !statSync5(input.vault).isDirectory()) {
     return {
@@ -10310,7 +10421,7 @@ async function runWritePreflightCommand(input) {
         result: err("FILE_NOT_FOUND", { path: input.priorArtifactFile })
       };
     }
-    priorText = readFileSync17(input.priorArtifactFile, "utf8");
+    priorText = readFileSync18(input.priorArtifactFile, "utf8");
   }
   const checkList = input.checks ? input.checks.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
   const result = runWritePreflight({
@@ -10431,7 +10542,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-KCFPPZNF.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-LSG2Y24X.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -11656,6 +11767,15 @@ vectorsCmd.command("prune-page [vault]").description("prune deleted pages from t
 program.command("mcp").description("start stdio Model Context Protocol server (read-only vault tools)").action(async () => {
   await runSkillwikiMcpStdio();
 });
+var mcpAuthCmd = program.command("mcp-auth").description("attended HTTP MCP host-id bearer issuance (metal)");
+mcpAuthCmd.command("issue-host").description("append a host-id hash to the metal map; print raw once on a TTY").requiredOption("--host-id <id>", "host identity to bind").option("--map <path>", "hash map file (defaults to SKILLWIKI_MCP_TOKEN_MAP)").option("--write", "append the hash (default is dry-run)", false).action(async (opts) => {
+  const mapPath = opts.map || process.env.SKILLWIKI_MCP_TOKEN_MAP || "";
+  emit(await runMcpAuthIssueHost({
+    hostId: String(opts.hostId),
+    mapPath,
+    write: !!opts.write
+  }));
+});
 for (const w of getDeprecatedWarnings(process.env.HOME ?? "")) {
   process.stderr.write(w + "\n");
 }

package/dist/{managed-write-preflight-KCFPPZNF.js → managed-write-preflight-LSG2Y24X.js}

@@ -6,7 +6,7 @@ import {
   runManagedWritePeerGate,
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-4XCBKPKD.js";
+} from "./chunk-5XT6MBWA.js";
 import "./chunk-BPJ5KWIT.js";
 import "./chunk-OMO45AHI.js";
 import "./chunk-HJ4ALQG6.js";

package/dist/skillwiki-mcp.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-WAUWBPIQ.js";
+} from "./chunk-CLF6DZ6C.js";
 import "./chunk-7I2TPIV5.js";
 import "./chunk-KFEOMMWK.js";
-import "./chunk-4XCBKPKD.js";
+import "./chunk-5XT6MBWA.js";
 import "./chunk-BPJ5KWIT.js";
 import "./chunk-NPTIYO2S.js";
 import "./chunk-OMO45AHI.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.75",
+  "version": "0.10.77",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.75",
+  "version": "0.10.77",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 21 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.75",
+  "version": "0.10.77",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 21 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.75",
+  "version": "0.10.77",
   "description": "Project-aware Karpathy-style knowledge base: 21 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp) backed by HTTP MCP wiki_capture.",
   "author": {
     "name": "karlorz"

package/skills/agents/proj-init.md

@@ -20,6 +20,8 @@ You are a project workspace bootstrapper specializing in creating the `projects/
 3. Render README.md from template
 4. Update vault index.md and log.md
 
+**Leaf-host rule (HTTP MCP):** If `$VAULT/.WIKI_GIT_FROZEN` exists, do not local-write. Bootstrap via MCP `wiki_workitem_write` (workspace families: `projects/{slug}/README.md`, `architecture/**`, `requirements/**`, `compound/**` — `.md` only; omit `base_sha256` on create). Use at most `wiki_log_append` for the log entry; never edit `index.md` locally on a leaf. If `wiki_workitem_write` is absent or the deployed server predates the workspace-family allowlist (`PATH_DENIED`), STOP — never rclone/wiki-push.
+
 **Execution Process:**
 
 1. **Resolve vault.** Run `skillwiki path`. If NO_VAULT_CONFIGURED, report failure and STOP.

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.10.75",
+  "version": "0.10.77",
   "private": true,
   "files": [
     "wiki-*",

package/skills/proj-init/SKILL.md

@@ -22,8 +22,15 @@ Standard four reads (vault SCHEMA, index, log) — no project context yet.
 4. Update vault `index.md` "Projects" section: add `- [[projects/{slug}]]`.
 5. Append vault `log.md` entry: "Project {slug} initialized."
 
+## Leaf hosts (HTTP MCP)
+On a leaf host (vault has `.WIKI_GIT_FROZEN` or the HTTP MCP server is the writer), bootstrap goes through MCP instead of local file creation:
+- Write `projects/{slug}/README.md` and any initial `requirements/` or `architecture/` markdown via `wiki_workitem_write` (CAS: omit `base_sha256` on create). Directories materialize implicitly with the first file.
+- The `index.md` "Projects" line and the structural log stay projection/snapshotter-owned: use at most `wiki_log_append` for the init entry. Never edit `index.md` locally on a leaf.
+- If `wiki_workitem_write` is absent from the live tool list or the deployed server predates the workspace-family allowlist (`PATH_DENIED`), STOP — do not local-write, rclone, or wiki-push.
+
 ## Stop conditions
 - `projects/{slug}/` already exists.
+- Leaf host without a usable `wiki_workitem_write` (fail closed; capture the intent via `wiki_capture` instead).
 
 ## Forbidden
 - Modifying any other project's files.

package/skills/skills/proj-init/SKILL.md

@@ -22,8 +22,15 @@ Standard four reads (vault SCHEMA, index, log) — no project context yet.
 4. Update vault `index.md` "Projects" section: add `- [[projects/{slug}]]`.
 5. Append vault `log.md` entry: "Project {slug} initialized."
 
+## Leaf hosts (HTTP MCP)
+On a leaf host (vault has `.WIKI_GIT_FROZEN` or the HTTP MCP server is the writer), bootstrap goes through MCP instead of local file creation:
+- Write `projects/{slug}/README.md` and any initial `requirements/` or `architecture/` markdown via `wiki_workitem_write` (CAS: omit `base_sha256` on create). Directories materialize implicitly with the first file.
+- The `index.md` "Projects" line and the structural log stay projection/snapshotter-owned: use at most `wiki_log_append` for the init entry. Never edit `index.md` locally on a leaf.
+- If `wiki_workitem_write` is absent from the live tool list or the deployed server predates the workspace-family allowlist (`PATH_DENIED`), STOP — do not local-write, rclone, or wiki-push.
+
 ## Stop conditions
 - `projects/{slug}/` already exists.
+- Leaf host without a usable `wiki_workitem_write` (fail closed; capture the intent via `wiki_capture` instead).
 
 ## Forbidden
 - Modifying any other project's files.

package/skills/skills/skillwiki-mcp/SKILL.md

@@ -16,6 +16,8 @@ SkillWiki captures are HTTP MCP only (`type: http`). Claude/Grok use `SKILLWIKI_
 - Resolve the installed plugin root from `GROK_PLUGIN_ROOT`, falling back to `CLAUDE_PLUGIN_ROOT`, and run `python3 "$PLUGIN_ROOT/scripts/check_readiness.py" --apply --json` before the first SkillWiki MCP call.
 - **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. It pins `https://wiki.karldigi.dev/mcp`. Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
 - `missing_prereq` means `SKILLWIKI_MCP_TOKEN` is absent from process environment; stop and ask for a bearer. Do not invent a stdio MCP.
+- A new host (a machine that should write the wiki for the first time) needs an issued host-id bearer before handshake can pass. The operator runs `skillwiki mcp-auth issue-host --host-id <id> --write` on metal (TTY required). The client pastes the printed value into process env or host Configure. Do not auto-write `mcp.env`, `mcp.json`, or Grok `config.toml`. Do not invent a second admin skill. A local vault/FUSE mirror is optional.
+- First-run order: install plugin/CLI → operator issues on metal → paste into process env or Configure → **new session** → `skillwiki doctor --check-mcp` → one write (`wiki_capture`, work-item write, or page publish).
 - `in_sync` means the probe has a usable URL/token decision.
 - A 401 is an MCP handshake failure, not a readiness-probe status. Report that the token is missing or rejected and stop.
 - Grok SessionStart cannot inject the parent MCP environment. A restart cannot supply a missing token.
@@ -33,9 +35,10 @@ On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/`
 1. Call MCP `wiki_capture` with `kind` (`task` | `idea` | `bug` | `note`), `project`, `title`, and `content`. Optional `agent_note`.
 2. Call MCP `wiki_log_append` when a structural `log.md` line is needed. Pass append-only `content`. Do not rewrite log history.
 3. **Feature-detect work-item and page-publish tools**:
-   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once.
+   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`, and to save Layer-3 workspace markdown: `projects/<slug>/README.md`, `projects/<slug>/architecture/**/*.md`, `projects/<slug>/requirements/**/*.md`, `projects/<slug>/compound/**/*.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once. Deployed servers that predate the workspace-family allowlist deny those paths — treat that `PATH_DENIED` as "server predates this release"; STOP, do not fall back.
    - When the server advertises `wiki_page_publish`: use it to publish typed Layer-2 pages (`entities/`, `concepts/`, `comparisons/`, `queries/`, `meta/`) using the same CAS protocol.
    - When those tools are **absent** from the live tool list (e.g. server is captures-only): do not call them or claim they exist. If `$VAULT/.WIKI_GIT_FROZEN` exists, fall back to capturing a close note via `wiki_capture` or STOP. Work-item close remains unavailable on the frozen leaf without `wiki_workitem_write`. Do not `git commit` / `wiki-push` against `~/wiki`.
+4. **`PATH_DENIED` means STOP.** Paths outside the allowlist (`projects/<slug>/history/**`, non-`.md` files such as `fleet.yaml` or `.canvas`, `AGENTS.md`/`CLAUDE.md`, raw edits, index/projection rebuilds) have no agent write path over MCP. wiki-push / `rclone copy` is **not** an agent writer: it bypasses the daemon working copy, so `wiki_read_page` cannot see those bytes until the sg01 snapshot. Never report an S3-only copy as "saved to wiki". Capture the blocked intent via `wiki_capture` and report the denial instead.
 
 ## Reads
 

package/skills/skills/using-skillwiki/SKILL.md

@@ -171,6 +171,7 @@ If the vault has `.WIKI_GIT_FROZEN`:
 |---|---|---|
 | Capture note/idea/bug/task | Yes | HTTP MCP `wiki_capture` / `wiki_log_append` |
 | Close or mutate a work item (`projects/*/work/**`, `knowledge.md`) | Conditional | If live MCP tools include `wiki_workitem_write`, mutate/close via MCP CAS; if absent, capture a close note via MCP `wiki_capture` or STOP. Never local-write. |
+| Save project workspace file (`architecture/`, `README.md`, `requirements/`, `compound/` — `.md` only) | Conditional | Via `wiki_workitem_write` CAS. Feature-detect: if the tool is absent or the deployed server predates the workspace-family allowlist (`PATH_DENIED`), STOP. Never rclone/wiki-push as a fallback writer. |
 | Publish typed Layer-2 page (`concepts/`, `queries/`, etc.) | Conditional | If live MCP tools include `wiki_page_publish`, publish via MCP CAS; if absent, STOP. Do not run local `skillwiki page publish`. |
 | `wiki-sync` push/commit | **No** | Git fail-closed. GitHub is sg01 `wiki-snapshot`. |
 | Read local `~/wiki` | Yes | Mirror reads only |
@@ -242,11 +243,11 @@ for code changes.
 
 ## CLI Backbone
 All skills are backed by the `skillwiki` CLI — a deterministic tool with no LLM calls. It handles path resolution, config management, validation, health reporting, and linting. Skills invoke it via Bash for the mechanical parts and use the active agent for the creative parts.
-Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang`, `install`, `fleet context`, `fleet validate`, `graph build`, `query`, `vectors rebuild`, `vectors status`, `sources pending`, `sources compile`, `sources review`, `sources reviews`, `sources disposition`, `sources dispose`, `archive`, `remove`, `drift`, `dedup`, `compound`, `tag-sync`, `tag reconcile`, `page publish`, `sync status`, `seed`, `stale`, `claim`, `claims audit`, `observe`, `canvas generate`, `mcp`.
+Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang`, `install`, `fleet context`, `fleet validate`, `graph build`, `query`, `vectors rebuild`, `vectors status`, `sources pending`, `sources compile`, `sources review`, `sources reviews`, `sources disposition`, `sources dispose`, `archive`, `remove`, `drift`, `dedup`, `compound`, `tag-sync`, `tag reconcile`, `page publish`, `sync status`, `seed`, `stale`, `claim`, `claims audit`, `observe`, `canvas generate`, `mcp`, `mcp-auth`.
 Optional read-only MCP (`skillwiki mcp`) exposes pending/compile/review list tools. Do not use MCP for compile claim, publish, or review writes.
 `skillwiki claim` binds a transcript to a work item only through an exact `raw/transcripts/...` path in `source:` / `sources:` / `closes:`. A `--project` that contradicts the capture's explicit project is rejected. `skillwiki stale --project` uses exact normalized slugs, not substring matching. `skillwiki claims audit` is the read-only integrity report for duplicate, malformed, dangling, cross-project, and unbacked claims; it never rewrites captures or work items.
 
-Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
+Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. New hosts need an issued host-id bearer from metal `skillwiki mcp-auth issue-host` before handshake can pass. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
 
 ## Runtime Host Context and Fleet Freshness
 Resolve the active project vault with `skillwiki path` first. Then pass that exact path to `skillwiki --human fleet context <vault>` for host identity and safety guidance. `fleet context` is authoritative for host identity. It overrides stale injected SessionStart context, remembered workspace context, and prior conversation summaries. `fleet context` is local and network-free; it reports `identity_status`, resolver trace, warnings, and the fact that remote freshness was not checked.

package/skills/skills/using-skillwiki/activation.md

@@ -55,7 +55,7 @@ separate concerns.
 
 ## Fail-Closed Boundary
 
-Never write typed pages, `index.md`, or `log.md` directly. On leaf hosts, captures use HTTP MCP (`wiki_capture`), never local `raw/transcripts` or `log.md` writes. Never bare `rm` or `git rm` as a fleet delete (snapshot resurrects from S3). Never auto `npm install -g skillwiki` in headless/goal/satellite sessions. If `skillwiki page publish --help` is unavailable, fail closed.
+Never write typed pages, `index.md`, or `log.md` directly. On leaf hosts, captures use HTTP MCP (`wiki_capture`), never local `raw/transcripts` or `log.md` writes. Project workspace saves (`projects/<slug>/README.md`, `architecture/`, `requirements/`, `compound/` — `.md` only) go through MCP `wiki_workitem_write` CAS; feature-detect and STOP if the tool is absent or the deployed server predates the workspace-family allowlist (`PATH_DENIED`). wiki-push / rclone is never an agent writer — an S3-only copy is invisible to `wiki_read_page` until the sg01 snapshot; never report it as "saved to wiki". Never bare `rm` or `git rm` as a fleet delete (snapshot resurrects from S3). Never auto `npm install -g skillwiki` in headless/goal/satellite sessions. If `skillwiki page publish --help` is unavailable, fail closed.
 
 ## Sensitive Content
 

package/skills/skillwiki-mcp/SKILL.md

@@ -16,6 +16,8 @@ SkillWiki captures are HTTP MCP only (`type: http`). Claude/Grok use `SKILLWIKI_
 - Resolve the installed plugin root from `GROK_PLUGIN_ROOT`, falling back to `CLAUDE_PLUGIN_ROOT`, and run `python3 "$PLUGIN_ROOT/scripts/check_readiness.py" --apply --json` before the first SkillWiki MCP call.
 - **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. It pins `https://wiki.karldigi.dev/mcp`. Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
 - `missing_prereq` means `SKILLWIKI_MCP_TOKEN` is absent from process environment; stop and ask for a bearer. Do not invent a stdio MCP.
+- A new host (a machine that should write the wiki for the first time) needs an issued host-id bearer before handshake can pass. The operator runs `skillwiki mcp-auth issue-host --host-id <id> --write` on metal (TTY required). The client pastes the printed value into process env or host Configure. Do not auto-write `mcp.env`, `mcp.json`, or Grok `config.toml`. Do not invent a second admin skill. A local vault/FUSE mirror is optional.
+- First-run order: install plugin/CLI → operator issues on metal → paste into process env or Configure → **new session** → `skillwiki doctor --check-mcp` → one write (`wiki_capture`, work-item write, or page publish).
 - `in_sync` means the probe has a usable URL/token decision.
 - A 401 is an MCP handshake failure, not a readiness-probe status. Report that the token is missing or rejected and stop.
 - Grok SessionStart cannot inject the parent MCP environment. A restart cannot supply a missing token.
@@ -33,9 +35,10 @@ On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/`
 1. Call MCP `wiki_capture` with `kind` (`task` | `idea` | `bug` | `note`), `project`, `title`, and `content`. Optional `agent_note`.
 2. Call MCP `wiki_log_append` when a structural `log.md` line is needed. Pass append-only `content`. Do not rewrite log history.
 3. **Feature-detect work-item and page-publish tools**:
-   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once.
+   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`, and to save Layer-3 workspace markdown: `projects/<slug>/README.md`, `projects/<slug>/architecture/**/*.md`, `projects/<slug>/requirements/**/*.md`, `projects/<slug>/compound/**/*.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once. Deployed servers that predate the workspace-family allowlist deny those paths — treat that `PATH_DENIED` as "server predates this release"; STOP, do not fall back.
    - When the server advertises `wiki_page_publish`: use it to publish typed Layer-2 pages (`entities/`, `concepts/`, `comparisons/`, `queries/`, `meta/`) using the same CAS protocol.
    - When those tools are **absent** from the live tool list (e.g. server is captures-only): do not call them or claim they exist. If `$VAULT/.WIKI_GIT_FROZEN` exists, fall back to capturing a close note via `wiki_capture` or STOP. Work-item close remains unavailable on the frozen leaf without `wiki_workitem_write`. Do not `git commit` / `wiki-push` against `~/wiki`.
+4. **`PATH_DENIED` means STOP.** Paths outside the allowlist (`projects/<slug>/history/**`, non-`.md` files such as `fleet.yaml` or `.canvas`, `AGENTS.md`/`CLAUDE.md`, raw edits, index/projection rebuilds) have no agent write path over MCP. wiki-push / `rclone copy` is **not** an agent writer: it bypasses the daemon working copy, so `wiki_read_page` cannot see those bytes until the sg01 snapshot. Never report an S3-only copy as "saved to wiki". Capture the blocked intent via `wiki_capture` and report the denial instead.
 
 ## Reads
 

package/skills/using-skillwiki/SKILL.md

@@ -171,6 +171,7 @@ If the vault has `.WIKI_GIT_FROZEN`:
 |---|---|---|
 | Capture note/idea/bug/task | Yes | HTTP MCP `wiki_capture` / `wiki_log_append` |
 | Close or mutate a work item (`projects/*/work/**`, `knowledge.md`) | Conditional | If live MCP tools include `wiki_workitem_write`, mutate/close via MCP CAS; if absent, capture a close note via MCP `wiki_capture` or STOP. Never local-write. |
+| Save project workspace file (`architecture/`, `README.md`, `requirements/`, `compound/` — `.md` only) | Conditional | Via `wiki_workitem_write` CAS. Feature-detect: if the tool is absent or the deployed server predates the workspace-family allowlist (`PATH_DENIED`), STOP. Never rclone/wiki-push as a fallback writer. |
 | Publish typed Layer-2 page (`concepts/`, `queries/`, etc.) | Conditional | If live MCP tools include `wiki_page_publish`, publish via MCP CAS; if absent, STOP. Do not run local `skillwiki page publish`. |
 | `wiki-sync` push/commit | **No** | Git fail-closed. GitHub is sg01 `wiki-snapshot`. |
 | Read local `~/wiki` | Yes | Mirror reads only |
@@ -242,11 +243,11 @@ for code changes.
 
 ## CLI Backbone
 All skills are backed by the `skillwiki` CLI — a deterministic tool with no LLM calls. It handles path resolution, config management, validation, health reporting, and linting. Skills invoke it via Bash for the mechanical parts and use the active agent for the creative parts.
-Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang`, `install`, `fleet context`, `fleet validate`, `graph build`, `query`, `vectors rebuild`, `vectors status`, `sources pending`, `sources compile`, `sources review`, `sources reviews`, `sources disposition`, `sources dispose`, `archive`, `remove`, `drift`, `dedup`, `compound`, `tag-sync`, `tag reconcile`, `page publish`, `sync status`, `seed`, `stale`, `claim`, `claims audit`, `observe`, `canvas generate`, `mcp`.
+Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang`, `install`, `fleet context`, `fleet validate`, `graph build`, `query`, `vectors rebuild`, `vectors status`, `sources pending`, `sources compile`, `sources review`, `sources reviews`, `sources disposition`, `sources dispose`, `archive`, `remove`, `drift`, `dedup`, `compound`, `tag-sync`, `tag reconcile`, `page publish`, `sync status`, `seed`, `stale`, `claim`, `claims audit`, `observe`, `canvas generate`, `mcp`, `mcp-auth`.
 Optional read-only MCP (`skillwiki mcp`) exposes pending/compile/review list tools. Do not use MCP for compile claim, publish, or review writes.
 `skillwiki claim` binds a transcript to a work item only through an exact `raw/transcripts/...` path in `source:` / `sources:` / `closes:`. A `--project` that contradicts the capture's explicit project is rejected. `skillwiki stale --project` uses exact normalized slugs, not substring matching. `skillwiki claims audit` is the read-only integrity report for duplicate, malformed, dangling, cross-project, and unbacked claims; it never rewrites captures or work items.
 
-Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
+Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. New hosts need an issued host-id bearer from metal `skillwiki mcp-auth issue-host` before handshake can pass. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
 
 ## Runtime Host Context and Fleet Freshness
 Resolve the active project vault with `skillwiki path` first. Then pass that exact path to `skillwiki --human fleet context <vault>` for host identity and safety guidance. `fleet context` is authoritative for host identity. It overrides stale injected SessionStart context, remembered workspace context, and prior conversation summaries. `fleet context` is local and network-free; it reports `identity_status`, resolver trace, warnings, and the fact that remote freshness was not checked.

package/skills/using-skillwiki/activation.md

@@ -55,7 +55,7 @@ separate concerns.
 
 ## Fail-Closed Boundary
 
-Never write typed pages, `index.md`, or `log.md` directly. On leaf hosts, captures use HTTP MCP (`wiki_capture`), never local `raw/transcripts` or `log.md` writes. Never bare `rm` or `git rm` as a fleet delete (snapshot resurrects from S3). Never auto `npm install -g skillwiki` in headless/goal/satellite sessions. If `skillwiki page publish --help` is unavailable, fail closed.
+Never write typed pages, `index.md`, or `log.md` directly. On leaf hosts, captures use HTTP MCP (`wiki_capture`), never local `raw/transcripts` or `log.md` writes. Project workspace saves (`projects/<slug>/README.md`, `architecture/`, `requirements/`, `compound/` — `.md` only) go through MCP `wiki_workitem_write` CAS; feature-detect and STOP if the tool is absent or the deployed server predates the workspace-family allowlist (`PATH_DENIED`). wiki-push / rclone is never an agent writer — an S3-only copy is invisible to `wiki_read_page` until the sg01 snapshot; never report it as "saved to wiki". Never bare `rm` or `git rm` as a fleet delete (snapshot resurrects from S3). Never auto `npm install -g skillwiki` in headless/goal/satellite sessions. If `skillwiki page publish --help` is unavailable, fail closed.
 
 ## Sensitive Content