Measure daily native skill use and test the security-audit trigger cue - #970

…tration landscape on the command-center page

The owner asked for the whole ecosystem on one page, so the command center
grows from six sections to nine, still from existing producers only:

- Orchestration: the CC's recorded orchestration-frameworks resolution and
  the same slot in cc-native-practice slots-final.json, the landing queue,
  the co-op's GPT read queue (read-queue-now.json) and the Adoption
  snapshot's orchestration tool calls by role.
- Resolution landscape: each matrix winner's component, pin, evidence class,
  lifecycle stages and platforms, with the W6 final columns (verdict, run
  pin, upstream E2E at the pin, invoke evidence) as recorded or "not
  recorded". Each winner's repository is matched to cc-now.json
  mirrors.pins by the version its tag names or a commit prefix, and a
  winner without a mirror says so. Terminal states come only from
  final-stack.json and read "pending #1008/#1007" until it exists. The
  committed north-star readiness layers follow with the same columns; the
  CC's program, mirrors, rulings and ten-layer plan render as given.
- SOTA skill invoke rates: one row per skill pinned in
  adoption/skills/manifest.json (source@ref, linked only for https, and
  path), joined with the 7-day counts per client from skill_usage.py and
  child-usage.mjs, or from #970's skill-invoke-rate-daily/1 projection when
  it is current. Zero calls flag "wiring defect"; a pinned skill with no
  install record is "not installed" (unknown while /skill-doctor is
  unmeasured); a called skill the manifest does not pin is "unpinned". The
  practice-slot table marks the orchestration-frameworks row. An unmeasured
  value never reads as zero.
- Tokens saved: tools/local-pages/token_tools_now.py runs each token tool's
  own report command (rtk gain, headroom agent-savings and output-savings,
  context-mode doctor) and records its exit code, run time, version and
  own estimate in token-tools-now.json. The page shows each beside its
  command, labels the token-window counters as client counters, and never
  sums across tools, evidence classes or windows.
- Research queue: research-queue.tsv rows and research-state.json's resume
  order.

The #1012 Claude read's fixes are folded in. B1: the email mask moves into
the shared sanitizer and matches after its per-token decoding (CPython
html.unescape and urllib.parse.unquote, cited at v3.13.16), so @, an
encoded dot (%2E or .), %2540 and a semicolon-less &#64 are omitted on
every page; the old page-local mask left all five readable. B2: each
section's label follows what it renders, and every partial section names
its reason. B3: each section and the count strip render in their own guard,
so a scalar codex_top_lanes_M or an integer above 1e308 degrades only its
own section. The receipt lists only the not-wired inputs the page rendered.

source_policy.json gains a command_center role map with sixteen exact repo
and state paths, read through CommandCenterReads, which extends the
Architecture reader (bounded, no-follow, protected names, no user root).
Reports past their limit read "stale" with their age; times recorded as a
time of day stay as recorded.

tools/skill-usage/render_units.py renders reviewed user units that keep the
three skill reports current: hourly, the host report (91 s measured,
including the $0 zero-turn claude -p /skill-doctor, with --claude-timeout
120 because the 30 s default expired once under load) and the Claude lanes
sweep (198 s and a 1.9 GB peak, projected from 181 MB to 26 KB by
systemd/claude-lanes.jq); daily, the Codex lanes report, which had not
finished after 25 minutes, so its completion time is unmeasured. Each step
renames a finished report into place.

The evidence manifest records the new hashes of source_policy.json and the
skill-usage README. Tests cover each section, unknown versus zero,
staleness, hostile types and strings, privacy (eight email forms, decoded
twice) and the exact grants; 33 fail-before mutations of this change each
fail them. The unit tests round-trip each ExecStart through systemd quoting
and pass systemd-analyze verify.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…tration landscape on the command-center page

The owner asked for the whole ecosystem on one page, so the command center
grows from six sections to nine, still from existing producers only:

- Orchestration: the CC's recorded orchestration-frameworks resolution and
  the same slot in cc-native-practice slots-final.json, the landing queue,
  the co-op's GPT read queue (read-queue-now.json) and the Adoption
  snapshot's orchestration tool calls by role.
- Resolution landscape: each matrix winner's component, pin, evidence class,
  lifecycle stages and platforms, with the W6 final columns (verdict, run
  pin, upstream E2E at the pin, invoke evidence) as recorded or "not
  recorded". Each winner's repository is matched to cc-now.json
  mirrors.pins by the version its tag names or a commit prefix, and a
  winner without a mirror says so. Terminal states come only from
  final-stack.json and read "pending #1008/#1007" until it exists. The
  committed north-star readiness layers follow with the same columns; the
  CC's program, mirrors, rulings and ten-layer plan render as given.
- SOTA skill invoke rates: one row per skill pinned in
  adoption/skills/manifest.json (source@ref, linked only for https, and
  path), joined with the 7-day counts per client from skill_usage.py and
  child-usage.mjs, or from #970's skill-invoke-rate-daily/1 projection when
  it is current. Zero calls flag "wiring defect"; a pinned skill with no
  install record is "not installed" (unknown while /skill-doctor is
  unmeasured); a called skill the manifest does not pin is "unpinned". The
  practice-slot table marks the orchestration-frameworks row. An unmeasured
  value never reads as zero.
- Tokens saved: tools/local-pages/token_tools_now.py runs each token tool's
  own report command (rtk gain, headroom agent-savings and output-savings,
  context-mode doctor) and records its exit code, run time, version and
  own estimate in token-tools-now.json. The page shows each beside its
  command, labels the token-window counters as client counters, and never
  sums across tools, evidence classes or windows.
- Research queue: research-queue.tsv rows and research-state.json's resume
  order.

The #1012 Claude read's fixes are folded in. B1: the email mask moves into
the shared sanitizer and matches after its per-token decoding (CPython
html.unescape and urllib.parse.unquote, cited at v3.13.16), so @, an
encoded dot (%2E or .), %2540 and a semicolon-less &#64 are omitted on
every page; the old page-local mask left all five readable. B2: each
section's label follows what it renders, and every partial section names
its reason. B3: each section and the count strip render in their own guard,
so a scalar codex_top_lanes_M or an integer above 1e308 degrades only its
own section. The receipt lists only the not-wired inputs the page rendered.

source_policy.json gains a command_center role map with sixteen exact repo
and state paths, read through CommandCenterReads, which extends the
Architecture reader (bounded, no-follow, protected names, no user root).
Reports past their limit read "stale" with their age; times recorded as a
time of day stay as recorded.

tools/skill-usage/render_units.py renders reviewed user units that keep the
three skill reports current: hourly, the host report (91 s measured,
including the $0 zero-turn claude -p /skill-doctor, with --claude-timeout
120 because the 30 s default expired once under load) and the Claude lanes
sweep (198 s and a 1.9 GB peak, projected from 181 MB to 26 KB by
systemd/claude-lanes.jq); daily, the Codex lanes report, which had not
finished after 25 minutes, so its completion time is unmeasured. Each step
renames a finished report into place.

The evidence manifest records the new hashes of source_policy.json and the
skill-usage README. Tests cover each section, unknown versus zero,
staleness, hostile types and strings, privacy (eight email forms, decoded
twice) and the exact grants; 33 fail-before mutations of this change each
fail them. The unit tests round-trip each ExecStart through systemd quoting
and pass systemd-analyze verify.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Both rendered services now set CPUWeight=idle, Nice=19 and
IOSchedulingClass=idle, the CC's host-capacity T2 result: test and
measurement runs yield to interactive work. IOSchedulingPriority=7 goes,
because the idle I/O class takes no priority level.

systemd 259 systemd.resource-control(5) maps CPUWeight=idle to the cgroup
v2 cpu.idle attribute, and systemd.exec(5) documents Nice= (-20 to 19) and
IOSchedulingClass= (realtime, best-effort or idle). On this host (cgroup v2;
the user manager delegates cpu, memory and pids), a transient user service
with these properties read cpu.idle 1, nice 19 and the idle I/O class,
against 0, 0 and "none: prio 0" for a default service.

tests/test_skill_usage_units.py asserts the three settings in both
services; the assertion failed on the previous templates. The skill-usage
README states the idle class and now names every command_center_skills
input (the three reports, #970's skill-invoke-rate-latest.json and the
practice slots); its evidence.json entry is rehashed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…tration landscape on the command-center page

The owner asked for the whole ecosystem on one page, so the command center
grows from six sections to nine, still from existing producers only:

- Orchestration: the CC's recorded orchestration-frameworks resolution and
  the same slot in cc-native-practice slots-final.json, the landing queue,
  the co-op's GPT read queue (read-queue-now.json) and the Adoption
  snapshot's orchestration tool calls by role.
- Resolution landscape: each matrix winner's component, pin, evidence class,
  lifecycle stages and platforms, with the W6 final columns (verdict, run
  pin, upstream E2E at the pin, invoke evidence) as recorded or "not
  recorded". Each winner's repository is matched to cc-now.json
  mirrors.pins by the version its tag names or a commit prefix, and a
  winner without a mirror says so. Terminal states come only from
  final-stack.json and read "pending #1008/#1007" until it exists. The
  committed north-star readiness layers follow with the same columns; the
  CC's program, mirrors, rulings and ten-layer plan render as given.
- SOTA skill invoke rates: one row per skill pinned in
  adoption/skills/manifest.json (source@ref, linked only for https, and
  path), joined with the 7-day counts per client from skill_usage.py and
  child-usage.mjs, or from #970's skill-invoke-rate-daily/1 projection when
  it is current. Zero calls flag "wiring defect"; a pinned skill with no
  install record is "not installed" (unknown while /skill-doctor is
  unmeasured); a called skill the manifest does not pin is "unpinned". The
  practice-slot table marks the orchestration-frameworks row. An unmeasured
  value never reads as zero.
- Tokens saved: tools/local-pages/token_tools_now.py runs each token tool's
  own report command (rtk gain, headroom agent-savings and output-savings,
  context-mode doctor) and records its exit code, run time, version and
  own estimate in token-tools-now.json. The page shows each beside its
  command, labels the token-window counters as client counters, and never
  sums across tools, evidence classes or windows.
- Research queue: research-queue.tsv rows and research-state.json's resume
  order.

The #1012 Claude read's fixes are folded in. B1: the email mask moves into
the shared sanitizer and matches after its per-token decoding (CPython
html.unescape and urllib.parse.unquote, cited at v3.13.16), so @, an
encoded dot (%2E or .), %2540 and a semicolon-less &#64 are omitted on
every page; the old page-local mask left all five readable. B2: each
section's label follows what it renders, and every partial section names
its reason. B3: each section and the count strip render in their own guard,
so a scalar codex_top_lanes_M or an integer above 1e308 degrades only its
own section. The receipt lists only the not-wired inputs the page rendered.

source_policy.json gains a command_center role map with sixteen exact repo
and state paths, read through CommandCenterReads, which extends the
Architecture reader (bounded, no-follow, protected names, no user root).
Reports past their limit read "stale" with their age; times recorded as a
time of day stay as recorded.

tools/skill-usage/render_units.py renders reviewed user units that keep the
three skill reports current: hourly, the host report (91 s measured,
including the $0 zero-turn claude -p /skill-doctor, with --claude-timeout
120 because the 30 s default expired once under load) and the Claude lanes
sweep (198 s and a 1.9 GB peak, projected from 181 MB to 26 KB by
systemd/claude-lanes.jq); daily, the Codex lanes report, which had not
finished after 25 minutes, so its completion time is unmeasured. Each step
renames a finished report into place.

The evidence manifest records the new hashes of source_policy.json and the
skill-usage README. Tests cover each section, unknown versus zero,
staleness, hostile types and strings, privacy (eight email forms, decoded
twice) and the exact grants; 33 fail-before mutations of this change each
fail them. The unit tests round-trip each ExecStart through systemd quoting
and pass systemd-analyze verify.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Both rendered services now set CPUWeight=idle, Nice=19 and
IOSchedulingClass=idle, the CC's host-capacity T2 result: test and
measurement runs yield to interactive work. IOSchedulingPriority=7 goes,
because the idle I/O class takes no priority level.

systemd 259 systemd.resource-control(5) maps CPUWeight=idle to the cgroup
v2 cpu.idle attribute, and systemd.exec(5) documents Nice= (-20 to 19) and
IOSchedulingClass= (realtime, best-effort or idle). On this host (cgroup v2;
the user manager delegates cpu, memory and pids), a transient user service
with these properties read cpu.idle 1, nice 19 and the idle I/O class,
against 0, 0 and "none: prio 0" for a default service.

tests/test_skill_usage_units.py asserts the three settings in both
services; the assertion failed on the previous templates. The skill-usage
README states the idle class and now names every command_center_skills
input (the three reports, #970's skill-invoke-rate-latest.json and the
practice slots); its evidence.json entry is rehashed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…tration landscape on the command-center page

The owner asked for the whole ecosystem on one page, so the command center
grows from six sections to nine, still from existing producers only:

- Orchestration: the CC's recorded orchestration-frameworks resolution and
  the same slot in cc-native-practice slots-final.json, the landing queue,
  the co-op's GPT read queue (read-queue-now.json) and the Adoption
  snapshot's orchestration tool calls by role.
- Resolution landscape: each matrix winner's component, pin, evidence class,
  lifecycle stages and platforms, with the W6 final columns (verdict, run
  pin, upstream E2E at the pin, invoke evidence) as recorded or "not
  recorded". Each winner's repository is matched to cc-now.json
  mirrors.pins by the version its tag names or a commit prefix, and a
  winner without a mirror says so. Terminal states come only from
  final-stack.json and read "pending #1008/#1007" until it exists. The
  committed north-star readiness layers follow with the same columns; the
  CC's program, mirrors, rulings and ten-layer plan render as given.
- SOTA skill invoke rates: one row per skill pinned in
  adoption/skills/manifest.json (source@ref, linked only for https, and
  path), joined with the 7-day counts per client from skill_usage.py and
  child-usage.mjs, or from #970's skill-invoke-rate-daily/1 projection when
  it is current. Zero calls flag "wiring defect"; a pinned skill with no
  install record is "not installed" (unknown while /skill-doctor is
  unmeasured); a called skill the manifest does not pin is "unpinned". The
  practice-slot table marks the orchestration-frameworks row. An unmeasured
  value never reads as zero.
- Tokens saved: tools/local-pages/token_tools_now.py runs each token tool's
  own report command (rtk gain, headroom agent-savings and output-savings,
  context-mode doctor) and records its exit code, run time, version and
  own estimate in token-tools-now.json. The page shows each beside its
  command, labels the token-window counters as client counters, and never
  sums across tools, evidence classes or windows.
- Research queue: research-queue.tsv rows and research-state.json's resume
  order.

The #1012 Claude read's fixes are folded in. B1: the email mask moves into
the shared sanitizer and matches after its per-token decoding (CPython
html.unescape and urllib.parse.unquote, cited at v3.13.16), so @, an
encoded dot (%2E or .), %2540 and a semicolon-less &#64 are omitted on
every page; the old page-local mask left all five readable. B2: each
section's label follows what it renders, and every partial section names
its reason. B3: each section and the count strip render in their own guard,
so a scalar codex_top_lanes_M or an integer above 1e308 degrades only its
own section. The receipt lists only the not-wired inputs the page rendered.

source_policy.json gains a command_center role map with sixteen exact repo
and state paths, read through CommandCenterReads, which extends the
Architecture reader (bounded, no-follow, protected names, no user root).
Reports past their limit read "stale" with their age; times recorded as a
time of day stay as recorded.

tools/skill-usage/render_units.py renders reviewed user units that keep the
three skill reports current: hourly, the host report (91 s measured,
including the $0 zero-turn claude -p /skill-doctor, with --claude-timeout
120 because the 30 s default expired once under load) and the Claude lanes
sweep (198 s and a 1.9 GB peak, projected from 181 MB to 26 KB by
systemd/claude-lanes.jq); daily, the Codex lanes report, which had not
finished after 25 minutes, so its completion time is unmeasured. Each step
renames a finished report into place.

The evidence manifest records the new hashes of source_policy.json and the
skill-usage README. Tests cover each section, unknown versus zero,
staleness, hostile types and strings, privacy (eight email forms, decoded
twice) and the exact grants; 33 fail-before mutations of this change each
fail them. The unit tests round-trip each ExecStart through systemd quoting
and pass systemd-analyze verify.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Both rendered services now set CPUWeight=idle, Nice=19 and
IOSchedulingClass=idle, the CC's host-capacity T2 result: test and
measurement runs yield to interactive work. IOSchedulingPriority=7 goes,
because the idle I/O class takes no priority level.

systemd 259 systemd.resource-control(5) maps CPUWeight=idle to the cgroup
v2 cpu.idle attribute, and systemd.exec(5) documents Nice= (-20 to 19) and
IOSchedulingClass= (realtime, best-effort or idle). On this host (cgroup v2;
the user manager delegates cpu, memory and pids), a transient user service
with these properties read cpu.idle 1, nice 19 and the idle I/O class,
against 0, 0 and "none: prio 0" for a default service.

tests/test_skill_usage_units.py asserts the three settings in both
services; the assertion failed on the previous templates. The skill-usage
README states the idle class and now names every command_center_skills
input (the three reports, #970's skill-invoke-rate-latest.json and the
practice slots); its evidence.json entry is rehashed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…tration landscape on the command-center page

The owner asked for the whole ecosystem on one page, so the command center
grows from six sections to nine, still from existing producers only:

- Orchestration: the CC's recorded orchestration-frameworks resolution and
  the same slot in cc-native-practice slots-final.json, the landing queue,
  the co-op's GPT read queue (read-queue-now.json) and the Adoption
  snapshot's orchestration tool calls by role.
- Resolution landscape: each matrix winner's component, pin, evidence class,
  lifecycle stages and platforms, with the W6 final columns (verdict, run
  pin, upstream E2E at the pin, invoke evidence) as recorded or "not
  recorded". Each winner's repository is matched to cc-now.json
  mirrors.pins by the version its tag names or a commit prefix, and a
  winner without a mirror says so. Terminal states come only from
  final-stack.json and read "pending #1008/#1007" until it exists. The
  committed north-star readiness layers follow with the same columns; the
  CC's program, mirrors, rulings and ten-layer plan render as given.
- SOTA skill invoke rates: one row per skill pinned in
  adoption/skills/manifest.json (source@ref, linked only for https, and
  path), joined with the 7-day counts per client from skill_usage.py and
  child-usage.mjs, or from #970's skill-invoke-rate-daily/1 projection when
  it is current. Zero calls flag "wiring defect"; a pinned skill with no
  install record is "not installed" (unknown while /skill-doctor is
  unmeasured); a called skill the manifest does not pin is "unpinned". The
  practice-slot table marks the orchestration-frameworks row. An unmeasured
  value never reads as zero.
- Tokens saved: tools/local-pages/token_tools_now.py runs each token tool's
  own report command (rtk gain, headroom agent-savings and output-savings,
  context-mode doctor) and records its exit code, run time, version and
  own estimate in token-tools-now.json. The page shows each beside its
  command, labels the token-window counters as client counters, and never
  sums across tools, evidence classes or windows.
- Research queue: research-queue.tsv rows and research-state.json's resume
  order.

The #1012 Claude read's fixes are folded in. B1: the email mask moves into
the shared sanitizer and matches after its per-token decoding (CPython
html.unescape and urllib.parse.unquote, cited at v3.13.16), so @, an
encoded dot (%2E or .), %2540 and a semicolon-less &#64 are omitted on
every page; the old page-local mask left all five readable. B2: each
section's label follows what it renders, and every partial section names
its reason. B3: each section and the count strip render in their own guard,
so a scalar codex_top_lanes_M or an integer above 1e308 degrades only its
own section. The receipt lists only the not-wired inputs the page rendered.

source_policy.json gains a command_center role map with sixteen exact repo
and state paths, read through CommandCenterReads, which extends the
Architecture reader (bounded, no-follow, protected names, no user root).
Reports past their limit read "stale" with their age; times recorded as a
time of day stay as recorded.

tools/skill-usage/render_units.py renders reviewed user units that keep the
three skill reports current: hourly, the host report (91 s measured,
including the $0 zero-turn claude -p /skill-doctor, with --claude-timeout
120 because the 30 s default expired once under load) and the Claude lanes
sweep (198 s and a 1.9 GB peak, projected from 181 MB to 26 KB by
systemd/claude-lanes.jq); daily, the Codex lanes report, which had not
finished after 25 minutes, so its completion time is unmeasured. Each step
renames a finished report into place.

The evidence manifest records the new hashes of source_policy.json and the
skill-usage README. Tests cover each section, unknown versus zero,
staleness, hostile types and strings, privacy (eight email forms, decoded
twice) and the exact grants; 33 fail-before mutations of this change each
fail them. The unit tests round-trip each ExecStart through systemd quoting
and pass systemd-analyze verify.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Both rendered services now set CPUWeight=idle, Nice=19 and
IOSchedulingClass=idle, the CC's host-capacity T2 result: test and
measurement runs yield to interactive work. IOSchedulingPriority=7 goes,
because the idle I/O class takes no priority level.

systemd 259 systemd.resource-control(5) maps CPUWeight=idle to the cgroup
v2 cpu.idle attribute, and systemd.exec(5) documents Nice= (-20 to 19) and
IOSchedulingClass= (realtime, best-effort or idle). On this host (cgroup v2;
the user manager delegates cpu, memory and pids), a transient user service
with these properties read cpu.idle 1, nice 19 and the idle I/O class,
against 0, 0 and "none: prio 0" for a default service.

tests/test_skill_usage_units.py asserts the three settings in both
services; the assertion failed on the previous templates. The skill-usage
README states the idle class and now names every command_center_skills
input (the three reports, #970's skill-invoke-rate-latest.json and the
practice slots); its evidence.json entry is rehashed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…tration landscape on the command-center page

The owner asked for the whole ecosystem on one page, so the command center
grows from six sections to nine, still from existing producers only:

- Orchestration: the CC's recorded orchestration-frameworks resolution and
  the same slot in cc-native-practice slots-final.json, the landing queue,
  the co-op's GPT read queue (read-queue-now.json) and the Adoption
  snapshot's orchestration tool calls by role.
- Resolution landscape: each matrix winner's component, pin, evidence class,
  lifecycle stages and platforms, with the W6 final columns (verdict, run
  pin, upstream E2E at the pin, invoke evidence) as recorded or "not
  recorded". Each winner's repository is matched to cc-now.json
  mirrors.pins by the version its tag names or a commit prefix, and a
  winner without a mirror says so. Terminal states come only from
  final-stack.json and read "pending #1008/#1007" until it exists. The
  committed north-star readiness layers follow with the same columns; the
  CC's program, mirrors, rulings and ten-layer plan render as given.
- SOTA skill invoke rates: one row per skill pinned in
  adoption/skills/manifest.json (source@ref, linked only for https, and
  path), joined with the 7-day counts per client from skill_usage.py and
  child-usage.mjs, or from #970's skill-invoke-rate-daily/1 projection when
  it is current. Zero calls flag "wiring defect"; a pinned skill with no
  install record is "not installed" (unknown while /skill-doctor is
  unmeasured); a called skill the manifest does not pin is "unpinned". The
  practice-slot table marks the orchestration-frameworks row. An unmeasured
  value never reads as zero.
- Tokens saved: tools/local-pages/token_tools_now.py runs each token tool's
  own report command (rtk gain, headroom agent-savings and output-savings,
  context-mode doctor) and records its exit code, run time, version and
  own estimate in token-tools-now.json. The page shows each beside its
  command, labels the token-window counters as client counters, and never
  sums across tools, evidence classes or windows.
- Research queue: research-queue.tsv rows and research-state.json's resume
  order.

The #1012 Claude read's fixes are folded in. B1: the email mask moves into
the shared sanitizer and matches after its per-token decoding (CPython
html.unescape and urllib.parse.unquote, cited at v3.13.16), so @, an
encoded dot (%2E or .), %2540 and a semicolon-less &#64 are omitted on
every page; the old page-local mask left all five readable. B2: each
section's label follows what it renders, and every partial section names
its reason. B3: each section and the count strip render in their own guard,
so a scalar codex_top_lanes_M or an integer above 1e308 degrades only its
own section. The receipt lists only the not-wired inputs the page rendered.

source_policy.json gains a command_center role map with sixteen exact repo
and state paths, read through CommandCenterReads, which extends the
Architecture reader (bounded, no-follow, protected names, no user root).
Reports past their limit read "stale" with their age; times recorded as a
time of day stay as recorded.

tools/skill-usage/render_units.py renders reviewed user units that keep the
three skill reports current: hourly, the host report (91 s measured,
including the $0 zero-turn claude -p /skill-doctor, with --claude-timeout
120 because the 30 s default expired once under load) and the Claude lanes
sweep (198 s and a 1.9 GB peak, projected from 181 MB to 26 KB by
systemd/claude-lanes.jq); daily, the Codex lanes report, which had not
finished after 25 minutes, so its completion time is unmeasured. Each step
renames a finished report into place.

The evidence manifest records the new hashes of source_policy.json and the
skill-usage README. Tests cover each section, unknown versus zero,
staleness, hostile types and strings, privacy (eight email forms, decoded
twice) and the exact grants; 33 fail-before mutations of this change each
fail them. The unit tests round-trip each ExecStart through systemd quoting
and pass systemd-analyze verify.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Both rendered services now set CPUWeight=idle, Nice=19 and
IOSchedulingClass=idle, the CC's host-capacity T2 result: test and
measurement runs yield to interactive work. IOSchedulingPriority=7 goes,
because the idle I/O class takes no priority level.

systemd 259 systemd.resource-control(5) maps CPUWeight=idle to the cgroup
v2 cpu.idle attribute, and systemd.exec(5) documents Nice= (-20 to 19) and
IOSchedulingClass= (realtime, best-effort or idle). On this host (cgroup v2;
the user manager delegates cpu, memory and pids), a transient user service
with these properties read cpu.idle 1, nice 19 and the idle I/O class,
against 0, 0 and "none: prio 0" for a default service.

tests/test_skill_usage_units.py asserts the three settings in both
services; the assertion failed on the previous templates. The skill-usage
README states the idle class and now names every command_center_skills
input (the three reports, #970's skill-invoke-rate-latest.json and the
practice slots); its evidence.json entry is rehashed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

classify_skill and unlocked_folder_differs (the wording of a refusal) both asked whether the installed SKILL.md is the pinned one, and the second copy added two reads to the push gate's monitoring baseline (tests.test_runtime_worker_openhands_push_gate; lines 315 and 317 of the earlier head). One helper, installed_skill_md_matches, now holds the check, so the installer keeps the baseline's five unclassified reads and neither the dated baseline nor #970's dated delta, which pins the baseline's bytes, is touched. Behavior-neutral: the same file and the same sha256 comparison, for project and global scope.

The new test patches the helper and requires classify_skill and the refusal wording to follow it in both directions (it errors on the earlier commit, where the helper does not exist).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… skill (#1024)

* Require the Claude Code link in the installer's ok state for a global skill

tools/adoption/install_skills.py --check-only reported ok for typesafe-ai on 2026-10-11 while ~/.claude/skills had no entry for it: the global ok state stopped at the canonical folder and the lock entry. scripts/skills_status.py failed the skill (claude_link missing) and a fresh headless Claude Code session did not list it.

The global ok state now also needs the link the Skills CLI makes for a non-universal agent (vercel-labs/skills@7407f389 src/installer.ts L395-426, createSymlink L227-293): a missing link is drift (install: --check-only prints missing-or-drifted and exits 1, --dry-run plans the pinned add, a real run repairs it); an entry in its place that does not resolve to the canonical folder (a real folder, a link to another folder, a dangling link elsewhere) is local content that the CLI would replace (L255-263), refused as local-modified unless --force, as in project scope; the post-add verification re-checks the link, so an add that leaves none is rolled back. A Codex-only entry and a Claude-Code-only copy need no separate link.

Seven new tests (five fail on the unmodified installer, two are controls) and nine mutants, all killed; the one hand-built "already installed" fixture of the idempotent-skip test gets the link a finished add leaves. One paragraph of adoption/skills/lifecycle.md states the contract; the registrations come with the last commit.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Protect the Claude entry on every global install, name the causes, cite the CLI lines by function

The review wave of 114d539 (the Codex review in GitHub, three threads; the command center's Claude read, PASS_WITH_P3; Astra's first read, CHANGES_REQUESTED with one P1, the same protection gap):

P1, protection (Codex thread 1; the read's P3-1 and F1): the Claude entry check ran only for a locked entry, so a first install or an unlocked canonical folder at the pin could still make the CLI replace a folder or a foreign link at ~/.claude/skills/<name> (createSymlink, L255-263, a folder recursively) without --force. The check now comes before the lock: such an entry is local-modified for every global install, as in project scope. The resolve is no longer strict, so a dangling link that points at the canonical folder (the CLI's own, from a half-removed install) is not foreign.

P2, copy fallback (Codex thread 2, ruled not taken by the command center): when the CLI cannot create the symlink it copies the skill into the Claude folder (L428-440). scripts/skills_status.py fails that layout (not_a_symlink), so the installer keeps requiring the link; the rollback now names the cause (no link, or the copy fallback) instead of a generic mismatch.

P1, cited lines (Codex thread 3, false for the pinned blob): src/installer.ts at 7407f389 is git blob 71ebe2aa, 43,226 bytes, equal to the tree entry. The citations now also name the function and quote the statement, the files that decide Codex (universal, agents.ts L227, L910-912) and Claude Code (L158), and the dispatch that makes installSkillForAgent the function for every source of the manifest outside the vercel-labs ones (add.ts L1370-1392, L1978).

P3-2 of the read: the --force help text names the global Claude entry it now overwrites. P3-3: a refusal names every local content it protects (the Claude entry and an unlocked SKILL.md that differs from the pin).

Tests: this commit adds a protection matrix (six states: nothing installed, unlocked canonical folder at the pin or edited, a lock of an older tree, a lock at the pin with an edited or no canonical folder; three kinds of entry: a real folder, a foreign link, a dangling link; 18 subtests, 15 fail on 114d539; each asserts no add, the whole local entry intact, and --force replacing it), the own-link and unresolvable-link guards, the copy-fallback cause test, the refusal-reasons test and a help assertion. Against 114d539's installer the class's 12 tests give 18 failures, all in the tests this commit adds (15 matrix subtests, 2 refusal-reasons subtests, the copy-fallback cause test). Twenty mutants of the new code, none survives.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Share one SKILL.md check between classify_skill and the refusal wording

classify_skill and unlocked_folder_differs (the wording of a refusal) both asked whether the installed SKILL.md is the pinned one, and the second copy added two reads to the push gate's monitoring baseline (tests.test_runtime_worker_openhands_push_gate; lines 315 and 317 of the earlier head). One helper, installed_skill_md_matches, now holds the check, so the installer keeps the baseline's five unclassified reads and neither the dated baseline nor #970's dated delta, which pins the baseline's bytes, is touched. Behavior-neutral: the same file and the same sha256 comparison, for project and global scope.

The new test patches the helper and requires classify_skill and the refusal wording to follow it in both directions (it errors on the earlier commit, where the helper does not exist).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Refuse a canonical link in the installer's ok and install states

claude_link_problem took equal resolved paths of the Claude entry and the
canonical path as proof that the entry was the CLI's own link. When the
canonical path is itself a link onto a real Claude folder, the add removes
that link first (skills@7407f389 src/installer.ts L389) and createSymlink then
removes the Claude folder with the files in it (L263); the pinned CLI v1.7.0
deleted them in a scratch home.

A canonical path that is a link is now local content: local-modified without
--force whatever the lock says, and the refusal names it and the Claude entry.
A link on a parent folder (L240-250), Codex-only entries and Claude-only
copies are unchanged. Other files beside a pinned SKILL.md in the canonical
folder stay unprotected and are named as such (the next change of this lane).

The wording findings of the delta read fold in: the qualifier "an entry that
does not resolve to the canonical folder" in the docstring and lifecycle.md,
and the L428-440 anchor.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* Register the files of this change on the current main

The registry rows of tools/adoption/install_skills.py, tests/test_install_skills.py
and adoption/skills/lifecycle.md, recomputed against main after the rebase.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… measured limits, and run it from the live clone

CPA-C-002 of the Claude-family practice audit (claude-practice-audit-claude-20261012, finding G3-01) and the command center's ruling of 2026-10-12: the per-skill invoke record of #970 was not running, and
would not have run as templated. Three things failed, each measured on the host:

- The /skill-doctor capture hit the 30 s default of skill_usage.py (it takes about 19 s on a quiet host and about 60 s at three runnable threads per CPU) and the daily run had no way to give it more. The
  default is now 300 s (DEFAULT_CLAUDE_TIMEOUT) and the daily run takes --claude-timeout.
- The run exited 2 unless `git branch --show-current` printed `main`, and the clone the unit renders for, ~/code/native-agent-stack-live, is a detached worktree of origin/main
  (docs/decisions/2026-10-09-claude-review-worker.md). The test is now "HEAD is a commit of origin/main" (`git merge-base --is-ancestor HEAD origin/main`, git-merge-base.adoc at git/git@67ad42147a), for
  the collection and for --render-units alike: a feature branch, a commit of the clone's own and a clone with no origin/main are refused with a fixed message.
- One run held the Claude and the Codex scans behind one exit status: as a transient user unit it took 23 min 57 s and exited 1, because the Codex lanes scan alone takes 25 min 47 s. The daily run is now two
  halves, `--half claude` (the /skill-doctor capture and the Claude lanes sweep) and `--half codex` (the host report's Codex scan and the lanes report), each its own user unit with its own record
  (skill-invoke-rate-claude-latest.json, skill-invoke-rate-codex-latest.json), `measured` holding only its own keys and the exit status standing for them. After its record, a half refreshes the combined
  skill-invoke-rate-latest.json that the Fleet page reads, merged from its own record and the other half's newest (the older of the two stamps, a missing or foreign record is an absent half). A slow Codex scan
  can no longer leave the Claude half unmeasured, and a timeout marks only its own half.

Limits per command, from transient-unit measurements on the host: the capture 19.9 s (limit 360 s with its margin), the Claude lanes sweep 2 min 18 s (600 s), the host report's Codex scan 1 min 10 s (600 s), the
Codex lanes scan 25 min 47 s (3,120 s, twice its wall, the command center's rule). TimeoutStartSec of each unit exceeds the sum of its half's limits by a minute (17 min and 63 min; a test pins it;
oneshot units have no start timeout unless one is set: systemd/systemd@e846bbad04 man/systemd.service.xml L682-L689). The units run at 09:30 and 10:00 UTC (OnCalendar with the literal UTC timezone,
man/systemd.time.xml L254-L256), inside the quietest span of the host's load by hour (08:00 to 13:00 UTC).

End to end, rendered from a detached worktree of origin/main and run as transient units: the Claude half 2 min 43.9 s (exit 0, host and claude measured), the Codex half 28 min 3.6 s (exit 0, codex measured), the
combined record measured for all three keys, mode 0600.

Fail-first: the 28 tests of tests.test_skill_usage_daily give FAILED (errors=23) on origin/main (d8f7e20; 23 of the 28 tests error there) and pass here; 34 of 34 mutants of the change killed. The unit templates skill-invoke-rate.service and
.timer, which were never installed, are replaced by skill-invoke-rate-{claude,codex}.{service,timer}; installing them is the command center's act. Two line locators that the eight added lines of
skill_usage.py moved are updated, and the evidence rows are written again.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… measured limits, and run it from the live clone

CPA-C-002 of the Claude-family practice audit (claude-practice-audit-claude-20261012, finding G3-01) and the command center's ruling of 2026-10-12: the per-skill invoke record of #970 was not running, and
would not have run as templated. Three things failed, each measured on the host:

- The /skill-doctor capture hit the 30 s default of skill_usage.py (it takes about 19 s on a quiet host and about 60 s at three runnable threads per CPU) and the daily run had no way to give it more. The
  default is now 300 s (DEFAULT_CLAUDE_TIMEOUT) and the daily run takes --claude-timeout.
- The run exited 2 unless `git branch --show-current` printed `main`, and the clone the unit renders for, ~/code/native-agent-stack-live, is a detached worktree of origin/main
  (docs/decisions/2026-10-09-claude-review-worker.md). The test is now "HEAD is a commit of origin/main" (`git merge-base --is-ancestor HEAD origin/main`, git-merge-base.adoc at git/git@67ad42147a), for
  the collection and for --render-units alike: a feature branch, a commit of the clone's own and a clone with no origin/main are refused with a fixed message.
- One run held the Claude and the Codex scans behind one exit status: as a transient user unit it took 23 min 57 s and exited 1, because the Codex lanes scan alone takes 25 min 47 s. The daily run is now two
  halves, `--half claude` (the /skill-doctor capture and the Claude lanes sweep) and `--half codex` (the host report's Codex scan and the lanes report), each its own user unit with its own record
  (skill-invoke-rate-claude-latest.json, skill-invoke-rate-codex-latest.json), `measured` holding only its own keys and the exit status standing for them. After its record, a half refreshes the combined
  skill-invoke-rate-latest.json that the Fleet page reads, merged from its own record and the other half's newest (the older of the two stamps, a missing or foreign record is an absent half). A slow Codex scan
  can no longer leave the Claude half unmeasured, and a timeout marks only its own half.

Limits per command, from transient-unit measurements on the host: the capture 19.9 s (limit 360 s with its margin), the Claude lanes sweep 2 min 18 s (600 s), the host report's Codex scan 1 min 10 s (600 s), the
Codex lanes scan 25 min 47 s (3,120 s, twice its wall, the command center's rule). TimeoutStartSec of each unit exceeds the sum of its half's limits by a minute (17 min and 63 min; a test pins it;
oneshot units have no start timeout unless one is set: systemd/systemd@e846bbad04 man/systemd.service.xml L682-L689). The units run at 09:30 and 10:00 UTC (OnCalendar with the literal UTC timezone,
man/systemd.time.xml L254-L256), inside the quietest span of the host's load by hour (08:00 to 13:00 UTC).

End to end, rendered from a detached worktree of origin/main and run as transient units: the Claude half 2 min 43.9 s (exit 0, host and claude measured), the Codex half 28 min 3.6 s (exit 0, codex measured), the
combined record measured for all three keys, mode 0600.

Fail-first: the 28 tests of tests.test_skill_usage_daily give FAILED (errors=23) on origin/main (d8f7e20; 23 of the 28 tests error there) and pass here; 34 of 34 mutants of the change killed. The unit templates skill-invoke-rate.service and
.timer, which were never installed, are replaced by skill-invoke-rate-{claude,codex}.{service,timer}; installing them is the command center's act. Two line locators that the eight added lines of
skill_usage.py moved are updated, and the evidence rows are written again.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… measured limits, and run it from the live clone

CPA-C-002 of the Claude-family practice audit (claude-practice-audit-claude-20261012, finding G3-01) and the command center's ruling of 2026-10-12: the per-skill invoke record of #970 was not running, and
would not have run as templated. Three things failed, each measured on the host:

- The /skill-doctor capture hit the 30 s default of skill_usage.py (it takes about 19 s on a quiet host and about 60 s at three runnable threads per CPU) and the daily run had no way to give it more. The
  default is now 300 s (DEFAULT_CLAUDE_TIMEOUT) and the daily run takes --claude-timeout.
- The run exited 2 unless `git branch --show-current` printed `main`, and the clone the unit renders for, ~/code/native-agent-stack-live, is a detached worktree of origin/main
  (docs/decisions/2026-10-09-claude-review-worker.md). The test is now "HEAD is a commit of origin/main" (`git merge-base --is-ancestor HEAD origin/main`, git-merge-base.adoc at git/git@67ad42147a), for
  the collection and for --render-units alike: a feature branch, a commit of the clone's own and a clone with no origin/main are refused with a fixed message.
- One run held the Claude and the Codex scans behind one exit status: as a transient user unit it took 23 min 57 s and exited 1, because the Codex lanes scan alone takes 25 min 47 s. The daily run is now two
  halves, `--half claude` (the /skill-doctor capture and the Claude lanes sweep) and `--half codex` (the host report's Codex scan and the lanes report), each its own user unit with its own record
  (skill-invoke-rate-claude-latest.json, skill-invoke-rate-codex-latest.json), `measured` holding only its own keys and the exit status standing for them. After its record, a half refreshes the combined
  skill-invoke-rate-latest.json that the Fleet page reads, merged from its own record and the other half's newest (the older of the two stamps, a missing or foreign record is an absent half). A slow Codex scan
  can no longer leave the Claude half unmeasured, and a timeout marks only its own half.

Limits per command, from transient-unit measurements on the host: the capture 19.9 s (limit 360 s with its margin), the Claude lanes sweep 2 min 18 s (600 s), the host report's Codex scan 1 min 10 s (600 s), the
Codex lanes scan 25 min 47 s (3,120 s, twice its wall, the command center's rule). TimeoutStartSec of each unit exceeds the sum of its half's limits by a minute (17 min and 63 min; a test pins it;
oneshot units have no start timeout unless one is set: systemd/systemd@e846bbad04 man/systemd.service.xml L682-L689). The units run at 09:30 and 10:00 UTC (OnCalendar with the literal UTC timezone,
man/systemd.time.xml L254-L256), inside the quietest span of the host's load by hour (08:00 to 13:00 UTC).

End to end, rendered from a detached worktree of origin/main and run as transient units: the Claude half 2 min 43.9 s (exit 0, host and claude measured), the Codex half 28 min 3.6 s (exit 0, codex measured), the
combined record measured for all three keys, mode 0600.

Fail-first: the 28 tests of tests.test_skill_usage_daily give FAILED (errors=23) on origin/main (d8f7e20; 23 of the 28 tests error there) and pass here; 34 of 34 mutants of the change killed. The unit templates skill-invoke-rate.service and
.timer, which were never installed, are replaced by skill-invoke-rate-{claude,codex}.{service,timer}; installing them is the command center's act. Two line locators that the eight added lines of
skill_usage.py moved are updated, and the evidence rows are written again.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… measured limits, and run it from the live clone

CPA-C-002 of the Claude-family practice audit (claude-practice-audit-claude-20261012, finding G3-01) and the command center's ruling of 2026-10-12: the per-skill invoke record of #970 was not running, and
would not have run as templated. Three things failed, each measured on the host:

- The /skill-doctor capture hit the 30 s default of skill_usage.py (it takes about 19 s on a quiet host and about 60 s at three runnable threads per CPU) and the daily run had no way to give it more. The
  default is now 300 s (DEFAULT_CLAUDE_TIMEOUT) and the daily run takes --claude-timeout.
- The run exited 2 unless `git branch --show-current` printed `main`, and the clone the unit renders for, ~/code/native-agent-stack-live, is a detached worktree of origin/main
  (docs/decisions/2026-10-09-claude-review-worker.md). The test is now "HEAD is a commit of origin/main" (`git merge-base --is-ancestor HEAD origin/main`, git-merge-base.adoc at git/git@67ad42147a), for
  the collection and for --render-units alike: a feature branch, a commit of the clone's own and a clone with no origin/main are refused with a fixed message.
- One run held the Claude and the Codex scans behind one exit status: as a transient user unit it took 23 min 57 s and exited 1, because the Codex lanes scan alone takes 25 min 47 s. The daily run is now two
  halves, `--half claude` (the /skill-doctor capture and the Claude lanes sweep) and `--half codex` (the host report's Codex scan and the lanes report), each its own user unit with its own record
  (skill-invoke-rate-claude-latest.json, skill-invoke-rate-codex-latest.json), `measured` holding only its own keys and the exit status standing for them. After its record, a half refreshes the combined
  skill-invoke-rate-latest.json that the Fleet page reads, merged from its own record and the other half's newest (the older of the two stamps, a missing or foreign record is an absent half). A slow Codex scan
  can no longer leave the Claude half unmeasured, and a timeout marks only its own half.

Limits per command, from transient-unit measurements on the host: the capture 19.9 s (limit 360 s with its margin), the Claude lanes sweep 2 min 18 s (600 s), the host report's Codex scan 1 min 10 s (600 s), the
Codex lanes scan 25 min 47 s (3,120 s, twice its wall, the command center's rule). TimeoutStartSec of each unit exceeds the sum of its half's limits by a minute (17 min and 63 min; a test pins it;
oneshot units have no start timeout unless one is set: systemd/systemd@e846bbad04 man/systemd.service.xml L682-L689). The units run at 09:30 and 10:00 UTC (OnCalendar with the literal UTC timezone,
man/systemd.time.xml L254-L256), inside the quietest span of the host's load by hour (08:00 to 13:00 UTC).

End to end, rendered from a detached worktree of origin/main and run as transient units: the Claude half 2 min 43.9 s (exit 0, host and claude measured), the Codex half 28 min 3.6 s (exit 0, codex measured), the
combined record measured for all three keys, mode 0600.

Fail-first: the 28 tests of tests.test_skill_usage_daily give FAILED (errors=23) on origin/main (d8f7e20; 23 of the 28 tests error there) and pass here; 34 of 34 mutants of the change killed. The unit templates skill-invoke-rate.service and
.timer, which were never installed, are replaced by skill-invoke-rate-{claude,codex}.{service,timer}; installing them is the command center's act. Two line locators that the eight added lines of
skill_usage.py moved are updated, and the evidence rows are written again.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>