Skills path parity: install_skills, skills_status and skill_usage join global paths as skills 1.7.0 does - #482

Scope

This finishes the path-resolution parity that #467 started. Every global path that tools/adoption/install_skills.py, scripts/skills_status.py and tools/skill-usage/skill_usage.py read now matches the pinned skills 1.7.0 CLI. A rollback read-back or a status report can therefore no longer look somewhere other than where the CLI wrote.

• Lane: lane:foundation. manifests/evidence.json is only re-registered.
• install_skills.py:
  • lock_file_path and the global canonical_skill_dir now follow Node path.join semantics through one shared node_path_join.
  • project_containment_problem compares the CLI's lexical home, not the physically resolved --home.
• skills_status.py:
  • The lock, canonical folder and Claude link folder are joined the way the CLI joins them.
  • The Claude link folder honours CLAUDE_CONFIG_DIR, trimmed with the JS trim set.
  • settings.json follows Claude Code's own relocation rule.
  • config.toml follows CODEX_HOME as Codex 0.157.1 resolves it.
• skill_usage.py: any non-empty XDG_STATE_HOME is used, as the CLI uses it, joined with node_path_join.
• evidence/artifacts/skills-listing-restore-20260928/README.md gets an appended dated erratum only. tree_drift_check.py and its recorded outputs stay byte-identical.
• catalogs/foundation/manifest.json: the M6 gate's drifted docs/secret-storage.md citations are repaired.
• Not touched: blueprints/runtime-workers/*, docs/secret-storage.md, the PR-H: E2E preregistration for the token-save-practice stack (frozen tasks, metrics, gate, procedure) #381 artifacts and every dated receipt. The Runtime-worker skills program: project-scoped installs and a 137-skill manifest #429 program owner (token-save-practice-e2e-status) was told before this PR opened and confirmed there's no collision, because its resolver calls the installer only in project mode.

SOTA sources

• The skills 1.7.0 CLI as installed (dist/cli.mjs, sha256 fde68534…):
  • L1396-1399: codexHome and claudeHome, with CLAUDE_CONFIG_DIR?.trim();
  • L1511: the claude-code globalSkillsDir;
  • L2208-2210: getCanonicalSkillsDir;
  • L3746-3750: getSkillLockPath, which uses any truthy XDG_STATE_HOME, untrimmed, through path.join.
• The same code upstream: vercel-labs/skills@7407f389 src/skill-lock.ts L67-72 and src/installer.ts L128-131.
• Claude Code's CLAUDE_CONFIG_DIR behaviour: the settings and env-vars pages at code.claude.com, read 2026-09-28, and a review of the installed 2.1.284 bundle for the untrimmed, empty-counts and NFC details.
• Codex CODEX_HOME: openai/codex rust-v0.157.1 (@36650394) codex-rs/utils/home-dir/src/lib.rs L13-51, and the Codex config-advanced docs page.
• Precedent: install_skills: read back a global rollback like #429's project path; M4 host removal receipt #467's claude_skills_dir, and the JS trim set that node --version v24.21.0 measured.

Evidence-class table

Review loop

• Round 1: two Claude reviewers (a verifier and an evidence-reviewer) and a GPT-6 cross-family review (codex exec -s read-only -m gpt-6-astra, effort max). GPT-6 said MERGE-AFTER-FIXES with 3 majors and 1 minor, and the Claude reviewers independently agreed on the same items.
• One repair round (4caf5611) closed all of them, plus the Claude nits and the same-contract skill_usage.py gap.
• Delta checks on the repaired head:
  • The GPT-6 re-check found F1-F3 FIXED, each with a regression test that fails when reverted, and no new defects. F4 was partial: "set" should read "non-empty". That is fixed in 17c5aee1.
  • The Claude verifier confirmed 9 of 9 claims.

Residuals (recorded, not fixed here)

• An empty-string HOME: node's homedir() returns "", so the CLI's canonical folder becomes relative to its working folder, while Python's Path.home() gives /. The --home default in both scripts is affected. This is low severity and pathological.
• A CLAUDE_CONFIG_DIR set only in a settings file's env block is invisible to the checker.
• With CLAUDE_CODE_SUBPROCESS_ENV_SCRUB on, a checker run from inside Claude Code reads the default location.
• The untrimmed, empty-counts and NFC settings rules are mirrored from the 2.1.284 bundle; no live run observed them.
• cowork_settings.json isn't read.
• A relative --home in project mode is untested (this predates the PR).
• The report doesn't say which location it read.
• The changed checker was not run against this host's real configuration. All evidence is fixtures plus source review.

Local commands run

• python3 -m unittest tests.test_install_skills tests.test_skills_status tests.test_skill_usage: exit 0, Ran 219 tests … OK.
• python3 scripts/validate.py: exit 0, "receipts": 165, "status": "passed".

Decision record

No new decision; this closes the parity gap the #467 addendum names. The erratum records the behaviour change for the dated tree_drift_check.py re-runs.

Host evidence

None. Tests and source review only.

Checklist

• One review, one repair round and one delta check. Main was merged in, and registration is current.

🤖 Generated with Claude Code