Record skill-state transitions with safe descriptors and profile views - #793

Scope

Record canonical skill changes without blocking a native session. This PR adds an inactive Tier A recorder with regular-file descriptor checks, journaled deduplication and separate native-profile views, so FIFO poisoning and profile switching cannot produce blocking opens or false removals from another view.

• Base commit: 0d5e6506434fab598dee861c749a22e628beb75a
• Lane: lane:foundation (exactly one label)
• Owned paths: tools/adoption/skill_state_recorder.py, tests/test_skill_state_recorder.py, the passive recorder proposal, dated decision and compact source/correction receipts; evidence registry rebuilt through the official helper and kept last.
• Draft until the command-center cross-family read. Hook registration, trust, host backfill and configuration apply remain separate command-center/user actions.

SOTA sources

• Claude's native audit example and async native hooks: metadata recording, native events and audit-only InstructionsLoaded. State deduplication fills the demonstrated local gap.
• Codex native hooks and trust; openai/codex@a956835d020762cb2b570053af06f643a11c0ecc, codex-rs/hooks/schema/generated/{post-tool-use,session-start}.command.{input,output}.schema.json.
• Claude's configuration-root override, Codex state locations and global AGENTS sources; the same Codex pin's codex-rs/utils/home-dir/src/lib.rs:13-49, codex-rs/ext/skills/src/host_roots.rs:103-112 and codex-rs/core-plugins/src/store.rs:87-94 bind native roots and plugin caches.
• vercel-labs/skills@7407f389, src/installer.ts:128-131: public lock and canonical symlink forms remain source metadata rather than reconstructed acceptance.
• Python descriptor operations, POSIX flock, atomic replacement and FIFO behavior.
• native-agent-stack@ecfa112764c664d35377dd66b8cfcb67e5a94d60: scripts/skills_status.py and docs/acceptance-evidence-policy.md; the S4 consumer adds the explicit metadata-only interface before activation.

Evidence-class table

Local commands run

Logs use owned durable private fixtures and bytecode is disabled. The source runtime stayed unchanged during the locator fixture correction.

$ python3 -m unittest tests.test_skill_state_recorder -v
Attempt 5: exit 1; 36 tests, 1 failure, 0 errors/skips, 2.379 s.
The fixture expected the old home-relative locator; updated it to the documented scope-stable locator.
Attempt 6: exit 0; 36 tests, 0 failures/errors/skips, 2.496 s.

$ python3 scripts/validate.py
Exit 0; 69 components, 10343 hashed files, 4 profiles, 214 receipts.
Final validation log SHA-256: 2e8050b72c4a65a7f1ea64c3f336e34c27fd1b36a62e5011b08a58559749f17d.

The passing log digest is 728bf1f7882c23d6d50150e524ad10a76a61afa9ba03f77e59024f01f988ebfe; the failed log remains retained. Real FIFO subprocess controls cover ledger/state/staging/lock/instruction/error paths, malformed input, reader-present rejection and recovery. Custom profile and same-alias controls retain distinct source identities while deduplicating one physical transition stream.

The parent ran the unchanged examples/omniroute-codex-sdk/worker.py with --model cx/gpt-6-astra-max --effort max --sandbox read-only --approval-mode deny_all --timeout 600 --base-url http://127.0.0.1:21128/v1 and the frozen private prompt. Exit 2 retained deadline_exceeded, model_inference_submitted=true, no returned judgment and null usage. Result digest: 217f21913ef63c654bef77312714ee1069f2ac762a32d945db52aa6b798ef2b7. This failure provides no model approval; source/tests and the required command-center read remain the review gates.

Decision record

docs/decisions/2026-10-06-tier-a-skill-state-recorder.md records alternatives, native sources and overturn conditions. The passive configuration is documented in adoption/hooks/claude/skill-state-recorder-proposal.md.

Native CLAUDE_CONFIG_DIR/CODEX_HOME overrides select only explicitly trusted public metadata roots. Prior profile views remain retained; a profile switch is not an uninstall. Supporting-file fingerprints are stat-only, source/activation/usage can remain unknown, and the metadata-only subprocess is mocked in the focused suite. Trusted/cooperating directories are required; final-component no-follow is not an ancestor sandbox, regular I/O/fsync latency is unbounded, and power-loss durability is not promised.

Fresh native hook firing, user-controlled Codex trust, upstream install/remove observations, live S4 integration and representative p95 latency remain prerequisites to activation. The PR applies no host hook, trust or client configuration.

Host evidence

No evidence/hosts/ files or host platform-status changes are added. Host receipt review checklist is not applicable.

Checklist

• Required publication validation and touched integration fixtures pass; no upstream native acceptance is inferred.
• Registry rebuilt through official register_file from main and kept last.
• New/changed GitHub Actions have full-SHA pins and scoped permissions (no workflows changed).
• No secrets are printed, logged or committed; no new required secret is added.
• No new paid hosting, subscription or billing surface is introduced.
• Peer-owned untracked files and worktrees are preserved.
• Command-center cross-family read completes before the draft leaves draft.