Plugin skill identity: a plugin's skill is listed under its own name whatever skillOverrides says, so each of the two doubly delivered skills keeps one copy per client (CPA-V-07) - #1074

Scope

• What this PR changes, in one or two sentences: CPA-V-07 of the Claude-family practice audit (claude-practice-audit-converged-20261012, P2): typesafe-ai and claude-api are each delivered to Claude Code by two routes and listed twice with one description, and skillOverrides cannot hide a plugin's skill (measured on 2.1.296 and documented), which the practice page did not say. The manifest rows name their twin, scripts/skills_status.py reports duplicate_listing where the plugin is present and the other copy is not hidden, the usage tracker counts both listings (the most recent use), a globally disabled bundled twin is one copy, the practice page states the exception, and the claude-api currency comparison is recorded. The host's own skillOverrides entries are the command center's act (the diff is in the decision record and below).
• Base commit: 24a209016178de9850f9b36d351dc72f5b1b0a26 (main after fix(trading): share strict paper URL normalization across credential gates #1080; rebased for landing from 993cc890b3ff3fc95fa7cdba51edd726565f9ace, main after Keep lane-A journal continuity for session-only config changes #1068, the head when this was rebased for opening).
• Lane: lane:foundation
• Owned paths touched: adoption/skills/manifest.json, scripts/skills_status.py, tools/skill-usage/skill_usage.py, .claude/skills/claude-native-practice/reference/ (instructions-skills.md, slots.json), docs/decisions/ (one new record), evidence/artifacts/plugin-skill-identity-20261013/, catalogs/foundation/ (two line citations of the manifest that the added lines shifted), evidence/artifacts/claude-native-practice-20261009/claude-native-slot-manifest.json (the snapshot label's hash of slots.json), tests/test_skills_manifest.py, tests/test_skills_status.py, tests/test_skill_usage_daily.py, manifests/evidence.json.
• Commits: five: the change (2dae97511), round 1 after the reads of that head (48e083e88, below, a fast-forward of it), the advisory delta for the reads that round 1 removes (f7e0cd703, below), round 2 (7c7d667f1, below, a fast-forward of f7e0cd703) and round 3, the final bounded commit of the local review of the rebased head (below). On 24a209016 (the rebase below) they are 3ec111b26, e3469d5dc, 013459679, 5a6635370 and f92f1eeec; the reads and rounds above name the earlier heads.

The change

SOTA sources

• code.claude.com/docs/en/skills.md L909 ("Plugin skills are not affected by skillOverrides. Manage those through /plugin instead."), L928 and L333, fetched 2026-10-13T10:29:20Z (107,130 bytes, sha256 35fd2c11f870fbe1497a53796de31b2a6b760645e724bda58894525356d4602a; receipts/docs-skills-md-excerpt.txt).
• anthropics/claude-code@3deb8736 CHANGELOG.md L5319: "skillOverrides setting now works: off hides from model and /, user-invocable-only hides from model only, name-only collapses description".
• The installed Claude Code 2.1.296: the init record's skill list under --settings overlays (receipts/listing-init-records.json) and the folder it unpacks for the bundled claude-api skill (receipts/claude-api-currency.txt).
• typesafe-ai/skills@65a39f393687 README.md: the Claude Code plugin route (claude plugin install typesafe@typesafe-ai) and the skills.sh route for other agents.
• anthropics/skills@dbd4588f9e1033efb41dad4bef2f7947c8993d44 .claude-plugin/marketplace.json L46: the claude-api plugin entry the manifest row pins; its claude-api folder is the plugin side of the currency comparison.
• This repository: docs/decisions/2026-09-30-skills-llm-native-listing.md (the listing budget), docs/decisions/2026-10-10-daily-skill-invoke-rate.md (the usage tracker's claude_skill_name), the audit's CPA-V-07 text.

Evidence-class table

Local commands run

$ python3 -m unittest tests.test_skills_manifest tests.test_skills_status tests.test_skill_usage_daily  ->  Ran 142 tests, OK (38 + 88 + 16)
$ the same three files against the sources of 3f1a921d  ->  22 tests fail or raise (3 + 11 + 8; receipts/fail-before.txt)
$ python3 -E -s -B <mutation script over scripts/skills_status.py and tools/skill-usage/skill_usage.py, in a scratch copy, idle-class>  ->  41 of 41 mutants killed
$ python3 scripts/skills_status.py  ->  on the first host today: fail  claude-api ... twin=duplicate_listing; fail  typesafe-ai ... listing=mismatch(on) twin=duplicate_listing (the two rows of this change; the other rows pass)
$ <the status with skillOverrides.typesafe-ai and skillOverrides.claude-api substituted by "off" in memory>  ->  result ok
$ python3 -m unittest <the modules that name a changed file, one process each, idle-class>  ->  168 modules, one process each, idle-class: the last run of every module exit 0 except test_token_e2e_grader (1 of 624 tests: git clone --local across devices into the scratch tmp, an environment failure that names no changed file; the first two sweeps' failures in test_architecture_pin_source, test_native_practice_snapshot_provenance, test_upstream_surface_watch and test_new_wsl_handbook were this change's derived files, fixed and rerun green); at the rebased head the 12 modules that name a changed file or a derived family reran exit 0 (test_skills_manifest 38, test_skills_status 88, test_skill_usage_daily 16, test_skill_usage 221, test_architecture_pin_source 4, test_native_practice_snapshot_provenance 9, test_upstream_surface_watch 116, test_new_wsl_handbook 88, test_evidence_manifest 5, test_runtime_worker_openhands_push_gate 127, test_adoption_docs_consistency 39, test_validate 86)
$ python3 scripts/validate.py  ->  exit 0 (11,893 files hashed); python3 scripts/evidence_manifest.py --check  ->  passed; git merge-tree --write-tree origin/main HEAD  ->  clean against main 993cc890; the push-gate advisory derivation adds no read for the changed scripts (the 4 reads it lists belong to #1057, which landed with its own delta; the module passes at the head); the privacy scan of the added lines: 0 account, host, home-path, e-mail or token hits

Review round 1 (one fast-forward commit on 2dae97511): Astra's read (two P1, one P2) and the local codex review (three P2)

Astra's read of 2dae97511 is CHANGES_REQUESTED (verdict file full1-pr1074-2dae97511/VERDICT.md, sha256 50828557...) and the local codex review said "patch is incorrect" (three P2). The command center asked for one commit for the six; each was reproduced on 2dae97511 and has a test that fails there. 2dae97511 merges clean against main ba6afd8d7 (exit status read directly): a plain fast-forward.

The cases were reproduced on 2dae97511 and pass on this head (receipts/fail-before-round1.txt: 14 tests fail or raise there); the original fail-first tests replayed at the exact base 993cc890b give the same 22 of 142 (receipts/fail-before-at-main-993cc890b.txt, Astra's P3 6, which also relabels receipts/fail-before.txt); 30 of 30 mutants of the round's changes are killed (receipts/mutants-round1-30.txt). The new helper sits beside claude_row, so no line number cited by another decision record moves (the first version put it near the top: test_skill_usage caught the shift of ledger_path_issue, and #1043's round 8 moves the same file by five lines).

Checks at 48e083e88 (idle-class, read at this head): python3 scripts/validate.py exit 0 (11,899 files); tests.test_skills_manifest 38, tests.test_skills_status 98, tests.test_skill_usage_daily 18, tests.test_plugin_skill_identity_receipts 3 OK; the 16 modules that name a changed file or a derived family (test_skill_usage 221, test_upstream_surface_watch 116, test_adoption_docs_consistency 39, test_new_wsl_handbook 88, test_validate 86, test_published_digest_privacy 15, test_architecture_pin_source, test_native_practice_snapshot_provenance, test_rtk_receipt_locators, test_skill_correction_claims, test_evidence_manifest, test_skill_routing) rerun exit 0 at the final tree after a 74-module sweep whose only failures were test_skill_usage (the locator shift above, fixed) and test_token_e2e_grader (a test clone hard-links across devices: the same failure at every earlier head); git merge-tree --write-tree origin/main HEAD clean against main ba6afd8d7 (exit status read directly); the digest audit of the added lines: 19 occurrences, 15 registered files, 1 manifest pin, 3 public-page digests, 0 unresolved; gitleaks on the commit: no leaks; the privacy scan of the added lines: 0 account, host, home-path, e-mail, non-ASCII or token hits.

The advisory delta of round 1 (f7e0cd703)

Round 1 moved the registry read of the native plugin checker into plugin_status and removed the twin check's own registry reader, so the OpenHands push gate's derivation counts two reads fewer in scripts/skills_status.py (346 against the 348 that main's newest delta expects); no read is added. tests.test_runtime_worker_openhands_push_gate derives its reads from the committed tree and I had run it on the working tree: it passed there and failed on the committed 48e083e88, so the delta is its own commit: blueprints/runtime-workers/openhands/evidence/unclassified-gate-reads-20261013-pr1074-delta.json and its index entry (removed_by_script: scripts/skills_status.py 2; the four tools/credentials/set_credential.py reads are #1057's, restated because the newest delta is cumulative). At f7e0cd703: python3 scripts/validate.py exit 0 (11,900 files), tests.test_runtime_worker_openhands_push_gate 127 OK on the committed tree, gitleaks no leaks. The statement above that the push-gate inventory is unchanged held for the first commit only. Another pull request that appends a delta to the same index (#1062 does) is re-derived by whichever lands second.

Review round 2 (one fast-forward commit on f7e0cd703): the local codex review (one P2) and Astra's read of 48e083e8 (one P2 blocker, answered; one adjacent P2)

The local codex review of f7e0cd70 said "patch is incorrect" (one P2) and Astra's read of 48e083e8 (verdict file fix1-pr1074-48e083e88/VERDICT.md, sha256 32f16c49...) is CHANGES_REQUESTED on one P2 that f7e0cd703 had already answered and one adjacent P2. The co-op asked for one commit for the two visibility cases; each was reproduced on f7e0cd703 and has a test that fails there.

receipts/fail-before-round2.txt (2 tests fail on f7e0cd703, 16 failing subtests), receipts/mutants-round2.txt (14 of 14 killed). Declined with the reason: Astra's P3 5 (a regression for abbreviated digests): a fixture naming a prefix of the removed digest would publish that prefix, which the standing rule forbids; the receipt test holds every 64-hex value and the removed digest's absence is checked by the reviewer's scan.

Checks at 7c7d667f1 (idle-class, read at this head): python3 scripts/validate.py exit 0 (11,903 files); tests.test_skills_manifest 38, tests.test_skills_status 100, tests.test_skill_usage_daily 18, tests.test_plugin_skill_identity_receipts 3 OK; tests.test_runtime_worker_openhands_push_gate 127 OK; the digest audit of the added lines: 7 occurrences, 7 registered files, 0 unresolved; gitleaks on the commit: no leaks; the privacy scan of the added lines: 0 hits. Main moved after the round was written (df3a477c8 #1070 and 77cc7ef42 #1075): this branch now conflicts with it on manifests/evidence.json and the delta index (#1070 appended a delta), so the landing rebase re-derives the cumulative delta, as #1057's landing required of #1062.

Landing rebase onto 24a209016 and review round 3 (the local review of the rebased head, two P2; one final bounded commit, pushed with the rebase)

The pull request went DIRTY on manifests/evidence.json and the advisory delta index as main moved (#1070 appended a delta of its own for scripts/validate.py, #1075, #1080). It was rebased once with the owning tools and no hand edit of a derived file: each commit is cherry-picked onto main; a conflict in the registry or the index takes main's file and the pull request's part is re-derived (host_receipts.register_file for the rows the commit changed; the delta of the one commit that carried one is re-derived with the native GitTree and derive_ci_protected over the tree that now holds #1057's and #1070's reads). The local review of the rebased head then found two P2, and the command center ruled one final bounded commit, pushed together with the rebase as one push; any further P2 or P3 of the next reads goes to its adjudication as a follow-up, with no further commit.

• Per file (git patch-id --verbatim of the -U0 --binary diff against each side's own merge base: old head 7c7d667f1 against 993cc890b, rebased head 5a6635370 against 24a209016): 35 files before and after, none only on one side; 33 have the same patch; the 2 that differ are the ones that had to: manifests/evidence.json and the advisory delta (re-derived). The delta index has the same patch (the entry appended after main's). Per commit, with the registry, the index and the delta left out: 4 of 4 have the same patch-id.
• Registry rows: 34 PR-owned rows at the old head, 0 missing at the rebased head, 0 not current (each row's sha256 and byte count are those of the file there); only the delta's row and the index's differ from the old head's; the other 11,873 rows are main's, unchanged; no row is added beyond main's and the pull request's.
• The advisory delta was re-derived over main's tree: 347 reads against the 344 of the baseline snapshot (tools/credentials/set_credential.py 4 and scripts/validate.py 1, with the scopes those deltas gave them; scripts/skills_status.py 2 removed); source_commit is null as before (derived from the local commit that precedes the delta; the published head holds the same scripts).

The cases were reproduced on 7c7d667f1 and pass on this head (receipts/fail-before-round3.txt); 12 of 12 mutants of the commit are killed (receipts/mutants-round3-12.txt; the first run left an array read as its first element only, and the test now holds the measured multi-element spellings). The decision record has a "Review round 3" section.

Checks at f92f1eeec (idle-class, read at that head): python3 scripts/validate.py --registration-base origin/main --registration-before 7c7d667f1 exit 0 (11,910 files hashed); the 62 modules that name a changed file of the commit or gate the registry, one process each: 3,745 tests, 61 exit 0 (tests.test_skills_status 102, tests.test_skills_manifest 38, tests.test_skill_usage_daily 18, tests.test_skill_usage 221, tests.test_plugin_skill_identity_receipts 3, tests.test_adoption_status 141, tests.test_adoption_docs_consistency 39, tests.test_validate 86, tests.test_registry_rows 25 and tests.test_runtime_worker_openhands_push_gate 127 among them); the one other, tests.test_workflow_hardening, fails in a nested fixture test of the secret scanner (2nd pipe should have enough spare: the kernel's pipe-page limit under this host's load) and passes on a rerun of that test and on a clean origin/main checkout, and the workflow files are not changed by this pull request; the local premerge check (a throw-away merge of the head onto main 04f64a056): git merge-tree --write-tree exit status 0, the push-gate, skills-status and registry-rows modules 254 OK under GITHUB_ACTIONS=true, scripts/validate.py exit 0; gitleaks on the five commits: no leaks; identities all the no-reply one; the privacy scan of the added lines: 0 account, host, home-path, e-mail, non-ASCII or token hits (47 digests before the rebase and 50 now: the three registry rows of the new receipts).

Registry-only rebase onto 329985de1 (the command center's ruling on the re-review; no content change)

Main moved again (#1062 landed, with the two pull requests before it) and the pull request went DIRTY on manifests/evidence.json and the advisory delta index. It was rebased once, pushed with a lease on f92f1eeec, by the same procedure and tools as the rebase above (each commit cherry-picked onto main; a conflict in the registry or the index takes main's file and the pull request's part is re-derived: host_receipts.register_file for the rows the commit changed, the delta re-derived with the native GitTree and derive_ci_protected over the tree that now holds #1062's reads). The merge-tree check before the rebase conflicted in those two files and no other.

• Per file (git patch-id --verbatim of the -U0 --binary diff against each side's own merge base: old head f92f1eeec against 24a209016, new head c17f820d9 against 329985de1): 38 files before and after, none only on one side; 36 have the same patch; the 2 that differ are the ones that had to: manifests/evidence.json and the advisory delta (re-derived). The delta index has the same patch (the entry appended after main's). Per commit, with the registry, the index and the delta left out: 5 of 5 have the same patch-id.
• Registry rows: 37 PR-owned rows at the old head, 0 missing at the new head, 0 not current (each row's sha256 and byte count are those of the file there); 3 differ from the old head's row: the delta's and the index's, and catalogs/foundation/upstream-surface-dispositions.json, whose file main changed too (Detect drift between the installed Claude agent definitions and the repository's (CPA-V-10) #1062, one line; the two changes merged without a conflict and the row is the merged file's); the other 11,905 rows are main's, unchanged; no row is added beyond main's and the pull request's.
• The advisory delta was re-derived over main's tree: 351 reads (main's 353 less the 2 reads of scripts/skills_status.py that this change removes); source_commit is null as before (derived from the local commit that precedes the delta; the published head holds the same scripts).
• Checks at c17f820d9 (idle-class): python3 scripts/validate.py --registration-base origin/main --registration-before f92f1eeec exit 0 (11,942 files hashed); python3 scripts/evidence_manifest.py --write changes nothing; git merge-tree --write-tree origin/main HEAD exit 0; tests.test_runtime_worker_openhands_push_gate 127, tests.test_registry_rows 25, tests.test_skills_status 102, tests.test_skills_manifest 38 and tests.test_validate 86 tests, each OK; the privacy scan of the added lines (2,563): 0 account, host, home-path, e-mail, non-ASCII or token hits.

Decision record

docs/decisions/2026-10-13-plugin-skill-identity.md: the context, the measurement, the claude-api currency comparison, the decision (six parts), the alternatives, what is not covered and the conditions that overturn it.

Host evidence

Only relevant when this PR adds or changes files under evidence/hosts/. This PR changes none.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no floating tags). None changed.
• New/changed workflows declare top-level permissions: {} and grant each job only what it needs. None changed.
• No secrets are printed, logged or committed; no new required secret was added without a documented owner. The status check reads plugin ids and states, never an install path or a credential, and its report holds ids and states only.
• No new paid hosting, subscription or billing surface was introduced. The listing runs were killed before any model call; the ten preload probes cost 0.075 USD in all.
• Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

Host step for the command center (nothing is applied by this PR)

1. In the first host's ~/.claude/settings.json, skillOverrides: set "typesafe-ai": "off" (it is "on") and add "claude-api": "off". The simulated result is ok for the whole status; python3 scripts/skills_status.py shows twin=ok for both rows afterwards, and the client lists one copy of each (75 skills in the measured run).
2. Re-applying the profile template with tools/adoption/apply_claude_settings.py sets typesafe-ai back to on (the template wins on shared keys), and the status then reports the duplicate again; repeat step 1, or see the follow-up.

Follow-ups

• From the re-review of the rebased head (P2; past the command center's bound, ruled a follow-up): scripts/skills_status.py:518, env_switch strips the value with Python's str.strip(), where the client trims with JavaScript's trim(); the script already holds that set (JS_TRIM_CHARS, :130, whose copy the tests keep equal to the installer's). Measured at this head with the script's own function: a leading U+FEFF ("\ufeff1") reads as unset, though trim() removes it, and a trailing U+0085 ("1\^E") reads as set, though trim() keeps it. Not measured on the client for these two characters (the earlier padding measurements used ASCII spaces). On the next touch: strip with JS_TRIM_CHARS, with regressions both ways ("\ufeff1" sets the switch, "1\^E" does not).
• From the Claude read at c17f820d (a read-only evidence reviewer; the client facts come from the installed 2.1.296 binary, read without running it and cited by byte offset; adjudicated by the command center as Follow-ups, verdict PASS at c17f820d; record pr1074-claude-read-and-adjudication-f92f1eee.md, sha256 b1e923d153080faec0cbaf6bcf7890a802ea82ee9e4b69e46cf3498024812a10):
  • P2-1, a false ok in a non-default setup: scripts/skills_status.py reads plugins/installed_plugins.json under the config directory (claude_config_dir, :290-294; the reads at :775 and :784), where the 2.1.296 client resolves its plugin folder from CLAUDE_CODE_PLUGIN_CACHE_DIR (and a cowork variant and seed directories; the reader's offsets 211876595, about 219447753 and 211876705; the variable's name stands in the binary at offsets including 211876536). With that variable set and the plugin installed elsewhere, a doubly listed skill reports ok. None of these variables is set on this host's sessions, and the overall result still fails in that setup, but for the wrong reason. Follow-up: resolve the plugin folder exactly as the client does, or report an unsupported-root state, with a fail-first test.
  • P3 1, settings precedence: the checker reads user settings only; the client merges user, project, local, flag and policy settings and --add-dir folders; the record's not-covered list names installs only. Follow-up: document it or implement it.
  • P3 2, an unreadable settings file can leave the claude-api row passing. Follow-up: an explicit state for it.
  • P3 3, citations: some client-behaviour claims cite documentation only; cite the binary offsets instead (for example the enabled rule at about 219684603).
• From the local review of the rebased head: the two P2 above are answered by the final bounded commit; the command center's bound stands (any P2 or P3 of the next local review or Astra's delta goes to its adjudication as a follow-up, with no further commit). The same class stands in another script that this change does not own: scripts/adoption_status.py settings_env_text (:441-444) reads an env entry only as a string or an integer, so a JSON 1.0 for the depth variable reads as unset there where the client reads it as 1; it is not changed here (a separate reader, owned by Detect drift between the installed Claude agent definitions and the repository's (CPA-V-10) #1062; trigger: its next change, with the same measured reading as receipts/numeric-env-init-records.json).
• Moving the decision into the template (a template off plus the plugin's installation in the bootstrap, so that a re-application keeps one copy) needs a fresh-host design: the template cannot install the plugin, and off without the plugin would leave Claude Code without the typesafe skill. Trigger: the first time the applier resets the entry on a host that has the overlay.
• Plugin installs at project or managed scope are not counted as present (user scope only, the scope the vendor's README and the installer use). Trigger: a host that installs either plugin at another scope.
• Repeat receipts/claude-api-currency.txt at each re-pin of the claude-api row and when a client release changes the bundled skill (the overturn condition).
• Hostname text already stands in manifests/evidence.json (18 lines) and in the new-WSL handbook (two lines); none is added here (Astra's P3 8). A hygiene pull request owns it.
• From Astra's read of 2dae97511: (P2, adjacent; corrected in round 2: a disabled plugin with the bundled twin hidden is not_listed) the plugin row's own pass for a disabled plugin whose bundled copy is visible stays: one copy, the client's, and canonical is about the plugin's files, not its enablement; (P3) project and local scope installs and the profile replay (apply_claude_settings.py restores typesafe-ai: on) stay the recorded boundaries; (P3, inherited) catalogs/sota-convergence/manifest-20260926.json:6521 anchors a mutation-testing deferral at adoption/skills/manifest.json#L788-L791, already stale at the base (trigger: that catalog's next edit); (P3) the full skills-page capture, the pin JSONs of the cited upstream sources and the raw init streams and probe transcripts are not in the packet (the excerpt receipts carry the fetched page's size and sha256, the pins are readable at the local mirrors).
• From Astra's read of 48e083e8: (P3 4) the project-scope and profile-replay boundaries stay as recorded, with their triggers; (P3 7) the inherited catalog anchor and the hostname lines; (P3 8) the full skills-page and environment-page captures, the raw init streams and the capture and mutation drivers are not in the packet (the excerpt receipts carry the fetched pages' sizes and sha256; the drivers stay in the author's record).

🤖 Generated with Claude Code