software-defence-factory 0.12.0 → 0.13.0

package/{operator-skills → .agents/skills}/factory-foundation/SKILL.md

@@ -10,7 +10,7 @@ instructions, existing source and session decisions. Preserve useful work and
 licenses. Assessment-only requests stay read-only. A method-only adoption needs
 no runtime, Docker host or model account.
 
-The [setup plan](../../docs/setup.md) owns supported commands and checkpoints.
+The [setup plan](../../../docs/setup.md) owns supported commands and checkpoints.
 Read the relevant sections rather than inventing a host-specific setup recipe.
 Choose this skill explicitly when adopting Factory. Project preparation tools
 need no knowledge of Factory and do not invoke this transition automatically.
@@ -24,7 +24,7 @@ Use the actual host's OS, service manager, hardware and private network; do not
 assume a machine model, a VPN provider, a cloud, Git forge, issue tracker, CI
 provider or particular harness. Inspect the configured remote and actual provider
 capabilities. GitHub is one adapter; an unsupported host keeps local execution
-without guessed API calls. Use [integration ownership](../../docs/integrations.md).
+without guessed API calls. Use [integration ownership](../../../docs/integrations.md).
 
 Use the existing task/issue record for missing obligations and evidence. Avoid a
 second project registry or a template conversion of an existing application.
@@ -38,9 +38,9 @@ Continue authorized repairs; ask only for decisions or authority actually missin
   repository instructions. Adapt the staged method to the
   project; do not overwrite its files. Reconcile the chosen provider’s issue forms/labels (where supported), CI triggers,
   required checks, protection rules and the intended PR/release path using
-  [repository readiness](../../kit/repository.md). Before trusted GitHub PR
+  [repository readiness](../../../kit/repository.md). Before trusted GitHub PR
   delivery, confirm active candidate-triggered workflows fit the bounded
-  qualification in [recovery](../../docs/recovery.md#trusted-pr-delivery);
+  qualification in [recovery](../../../docs/recovery.md#trusted-pr-delivery);
   unsupported workflows keep delivery patch-only. Organization hooks and
   external CI remain operator-owned. File presence is not proof.
 - **Infrastructure:** choose a private state directory, loopback port, host and

package/README.md

@@ -39,9 +39,12 @@ The runtime supplies policy and six focused skills to its isolated jobs. `init`
 
 ## How the factory works
 
-[![Factory setup, execution and delivery](https://raw.githubusercontent.com/arcitai/software-and-defence-factory/main/docs/architecture.svg)](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/architecture.excalidraw)
+<a href="docs/architecture.md"><img src="docs/diagrams/deployment.svg" width="720" alt="Factory setup: operator access to a private execution host with Docker, a chosen harness and inference; application deployment remains in its own CI/CD."></a>
 
-[Architecture and boundaries](docs/architecture.md) · [Editable Excalidraw source](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/architecture.excalidraw)
+[Architecture and boundaries](docs/architecture.md). Editable views:
+[Setup / deployment](docs/diagrams/deployment.excalidraw) ·
+[Runtime layers / ownership](docs/diagrams/architecture.excalidraw) ·
+[Work lifecycle](docs/diagrams/lifecycle.excalidraw)
 
 Each result belongs to a specific candidate commit and policy. A failed check blocks delivery. Changing the candidate or check policy invalidates earlier evidence. Approval records a handoff; publishing, merging and deployment follow the application's separate authority.
 
@@ -58,8 +61,8 @@ Start setup with `factory foundation` and the [Factory Foundation plan](docs/set
 | `bin/` | CLI entry point |
 | `factory/` | Queue, HTTP API, isolation, evidence, updates and bundled dashboard assets |
 | `dashboard/` | Dashboard source and UI tests |
-| `kit/`, `.agents/skills/` | Portable method, adoption records and six job skills |
-| `operator-skills/` | Factory Foundation setup guidance; never mounted into jobs |
+| `kit/`, `kit/skills/` | Portable method, adoption records and the canonical six job skills |
+| `.agents/skills/` | Repository/operator guidance, including explicit Factory Foundation adoption; outside the job catalog |
 | `scripts/`, `tests/` | Packaging, qualification, release checks and behavioral tests |
 | `docs/` | Setup, architecture, recovery, proof and ownership |
 

package/docs/npm.md

@@ -104,8 +104,8 @@ installation or retained attempt needs them.
 
 ## Protected evidence compatibility
 
-Factory 0.12.0 recognizes version-1 execution profiles emitted by native
-**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1, 0.11.2 and 0.12.0**. This is an exact allowlist in
+Factory 0.13.0 recognizes version-1 execution profiles emitted by native
+**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1, 0.11.2, 0.12.0 and 0.13.0**. This is an exact allowlist in
 `factory/execution-profile.mjs`, independent of the installed package version;
 it is not a semver range or an automatic promise for later releases. Unknown
 runtime strings, unknown profile formats and incomplete legacy acceptance
@@ -153,6 +153,20 @@ Version 0.12.0 adds the all-work Inbox read model and restores the retained
 overview. Protected execution writers and acceptance/publication guards are
 unchanged; the explicit compatible-writer entry preserves all checks above.
 
+Version 0.13.0 relocates byte-identical runtime skill instructions to
+`kit/skills/` and adds a read-only alias of that catalog for Codex discovery.
+The audit covers `execution-profile.mjs`, `processes.mjs`, executor candidate,
+check, review and acceptance writers, `execution-evidence.mjs` and both delivery
+capability/validation paths. The v1 schema, candidate reconstruction, current
+policy checks, isolation and model credential rules are unchanged. Foundation
+is outside the job catalog. Supported old immutable evidence remains subject
+to every existing guard; unknown later versions receive no automatic trust.
+
+Old installed releases retain their own files and mount paths until an idle,
+reviewed update. No installed catalog, execution profile or historical hash is
+rewritten by this layout change. Qualify the exact updated package/image before
+resuming work; retained releases/evidence stay available for recovery.
+
 New publication still requires the current remote target to equal the original
 accepted base; reviewed-candidate continuation preserves that baseline, while
 target refresh remains #72. See [the verification map](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/proof.md) for delivered

package/docs/setup.md

@@ -1,7 +1,13 @@
 # Factory Foundation: repository and execution setup
 
-The operator skill is available through `factory foundation`.
+The operator skill is available through `factory foundation`, including from
+an installed npm package without a source checkout. Its canonical source is
+[.agents/skills/factory-foundation/SKILL.md](../.agents/skills/factory-foundation/SKILL.md).
+Use it explicitly for adoption; it is independent of AIOS. Repository/operator
+guidance stays outside the runtime catalog at `kit/skills/`.
 See [Factory concepts](concepts.md) for host, worker, harness and agent roles.
+The [setup/deployment view](architecture.md#setup-and-deployment) shows operator
+access, the private execution host and the separate application delivery boundary.
 
 Use this plan for a new installation or when moving an existing Factory to an
 execution host. Complete the applicable checkpoints in order and record the
@@ -36,7 +42,19 @@ this plan.
 
 For method-only adoption, run `factory kit --output NEW_DIRECTORY`
 and follow [the adoption guide](../kit/README.md). The remaining host/runtime
-steps apply only when using Factory's optional controller.
+steps apply only when using Factory's optional controller. Export maps the six
+job skills into staged `.agents/skills/`; it never changes the application's
+AGENTS.md or installs global skills. Foundation stays in the installed package.
+
+Runtime jobs receive only the reviewed catalog as read-only `/factory-skills`.
+Codex agent phases also discover that same catalog at `/etc/codex/skills`; Pi
+uses `--skill /factory-skills`. Verify discovery on the exact installed image
+without credentials or inference (Codex native listing and Pi RPC
+`get_commands`), then qualify inference separately when authorized. Custom
+harness discovery remains operator-owned. A directory listing alone is not
+native discovery proof. Bundled instructions install no model, browser, Docker
+or provider access. Repository guidance remains readable project context and
+cannot expand job permissions.
 
 ## 2. Establish host access and boot prerequisites
 

package/docs/workflows.md

@@ -15,12 +15,16 @@ Defence currently runs **Investigate** against supplied scoped evidence and
 produces a private draft. It is not production monitoring, exploitation or
 verified recovery. See [Defence integration](defence-integration.md).
 
-The six bundled job skills cover triage, specification, implementation, review,
+The six bundled job skills in `kit/skills/` cover triage, specification, implementation, review,
 security and evaluation. They are instructions, not six running processes.
 All are mounted read-only for agent steps; the role prompt supplies the work
 boundary. Triage/specification prepare scope before admission; evaluation is a
 separately scoped comparison. Factory Foundation is an operator setup skill,
-kept outside those execution mounts.
+at `.agents/skills/factory-foundation/SKILL.md`, used explicitly for adoption
+and kept outside those execution mounts. CLI/API/Skills show actual installed
+paths, content and SHA-256. Codex additionally mounts the same runtime catalog at
+`/etc/codex/skills`; Pi uses `--skill /factory-skills`. Discovery on a particular
+image needs native qualification, and skills provide neither tools nor access.
 
 ## Start work
 

package/factory/definition.mjs

@@ -24,7 +24,7 @@ const skillRoles = {
 export function factoryDefinition(config) {
   const harness = harnessOf(config);
   const skills = Object.entries(skillRoles).map(([role, purpose]) => {
-    const id = `factory-${role}`, path = `.agents/skills/${id}/SKILL.md`;
+    const id = `factory-${role}`, path = `kit/skills/${id}/SKILL.md`;
     const content = readFileSync(join(ROOT, path), 'utf8');
     return { id, purpose, path, content, sha256: digest(content) };
   });
@@ -58,7 +58,7 @@ export function factoryDefinition(config) {
 }
 
 export function foundationSkill() {
-  const path = 'operator-skills/factory-foundation/SKILL.md';
+  const path = '.agents/skills/factory-foundation/SKILL.md';
   const content = readFileSync(join(ROOT, path), 'utf8');
   return { id: 'factory-foundation', purpose: 'Prepare a repository and host for bounded Factory work', path, content, sha256: digest(content) };
 }

package/factory/execution-profile.mjs

@@ -10,12 +10,14 @@ import { expectedWebStories, webPolicyHash } from './web-verification.mjs';
 // 0.9.1, 0.10.0, 0.11.0 and 0.11.1 (unchanged protected evidence writers),
 // 0.11.2 (exact patch bytes and pre-acceptance reconstruction; same v1 schema).
 // 0.12.0 restores the Inbox read model/presentation; protected writers and guards are unchanged.
+// 0.13.0 relocates identical job skills and adds a read-only Codex discovery alias.
+// Candidate/check/review/acceptance schemas, isolation and credential/permission guards are unchanged.
 // Older writers still require exact patch/tree reconstruction before publication.
 // Deliberately independent of VERSION: a release bump is not
 // evidence compatibility. Re-audit this list for every trust-relevant writer,
 // isolation or validation change; remove versions whose guarantees no longer
 // satisfy current policy. See docs/npm.md. This predicate alone grants no trust.
-const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2', '0.12.0']);
+const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2', '0.12.0', '0.13.0']);
 
 export function isSupportedExecutionProfile(profile) {
   return profile?.version === 1 && SUPPORTED_EXECUTION_RUNTIMES_V1.has(profile.runtimeVersion);

package/factory/executor.mjs

@@ -91,7 +91,10 @@ async function container(mode, input, command, options = {}) {
     '--mount',`type=bind,source=${join(workspace,'.git')},target=/workspace/.git,readonly`];
   args.push('--mount',`type=bind,source=${reportDir},target=/output`,
     '--mount',`type=bind,source=${join(ROOT,'kit')},target=/factory-policy,readonly`,
-    '--mount',`type=bind,source=${join(ROOT,'.agents/skills')},target=/factory-skills,readonly`);
+    '--mount',`type=bind,source=${join(ROOT,'kit/skills')},target=/factory-skills,readonly`);
+  // The same reviewed catalog supplies Codex native discovery; no operator skills.
+  if (mode !== 'verify' && harnessOf(config) === 'codex')
+    args.push('--mount',`type=bind,source=${join(ROOT,'kit/skills')},target=/etc/codex/skills,readonly`);
   if (scratch) args.push('--mount',`type=bind,source=${scratch},target=/scratch`);
   if (mode === 'verify') args.push('--env',`FACTORY_BASE_REVISION=${git('rev-parse',`${metadata().base}^{commit}`)}`);
   const logPath = join(folder, attempt, `${mode}.log`);