[Knapp-Kevin]

Scope and live base

Independent 22-manifest non-pulse first-party macro sweep found four additional genuine scheduling/privacy authority defects outside #478/#480 and #415/#416. Base main 4f2098346022705df74c908b43f10724a87f192a. Initial branch head a56b2b9f2d60c24ecd3cc85ce3e627d2f9e02ae0; current correction head 408784222e37b6d24e157b7aaeaedbe52c2a408f.

Implemented: learning-plan, permissions-review, standup-writer, week-in-review now default to one-shot work and require separate explicit host approval for recurring scheduling, future private data access, delivery/recipients, retention, cost and revocation. Optional connectors/schedulers are not mandatory infrastructure; missing sources produce disclosed partial coverage. Credential values remain out of reports. No repository-owned runner, scanner, script, CI or scheduler.

Evidence: four changed SKILL.md files, four exact-version provenance records, four individual verification records, one reconciled 44-entry consolidated first-party registry and static macro review. All four exact blob fingerprints independently read back and matched both companion and consolidated registry. Manifest revision 16110dd942aa2ad231c04d8a145297b0ef3de6a4. Scores 18/20, 17/20, 17/20, 17/20. Static VERIFIED only; behavioral not-run, package-security not-run.

Accounting: 44/44 first-party remains unchanged; third-party reviews 826, total verification YAML 870, admitted-source denominator delta 0, source admissions 0. No material five-surface count change while this branch remains draft. No discovery source admitted.

DRAFT / HOLD, do not merge yet

1. Obtain complete pinned external NVIDIA SkillSpector v2.12.0 reports and digests for the four final exact package identities, with findings resolved and no incomplete coverage.
2. Obtain independent executed adversarial/integration acceptance for the ten scenarios in the review. Static scenarios are not behavioral evidence.
3. Reconcile shared registry/local-verification.json with concurrently owned PRs fix: require explicit host authority for five recurring review skills (#478) #480 and fix: consolidate 16 passive pulse repairs and 5 security hardenings #416, and with feat: add passive trust-boundary and data-lifecycle review skills (#406) #412/feat: add passive behavioral evaluation and release-evidence protocols (#406) #413 if subsequently admitted. Preserve all unique changes, recheck all 44 fingerprints.
4. Recheck current main, review threads, checks/runs, mergeability and all five public accounting surfaces. Use expected-head protection only once gates pass.

Closes #481 only after qualified changes merge.

2026-10-29 P1 #483 authority-taxonomy correction

permissions-review was independently found to rely on nonexistent permission tiers in the current evaluation framework, despite its earlier recurrence repair. The final corrected manifest is dcaf7ff96c832c69bb5be1c7cd8f4c3ed418b707 (manifest commit c5d1c139fb547e696e621a068239c6dcf94d9bd7). It now inventories each tool using the controlled registry/taxonomy.yaml authority categories, separately identifies consequential identity/cost/destructive/private-data risks, treats unknown tool coverage as uncertainty, and refuses untrusted instructions in logs/config. The output table and risk ranking no longer use historical permission tiers. Provenance, individual verification, the consolidated registry and the existing review document were refreshed. Independent GitHub readback checked all 44/44 first-party manifest blobs against the branch registry, with zero mismatches. Static score remains 17/20; behavioral validation and pinned external security scan are not-run.

Still DRAFT / HOLD. Four final exact-package SkillSpector reports and independent executed adversarial acceptance are missing; the shared registry also overlaps #416/#480/#485 and prospective #412/#413. Do not merge based on mergeability or the static readback alone. Issue #483 also tracks mcp-vetting in draft #485; neither fix is on main.

[Knapp-Kevin]

Cross-lane current-governance defect (issue #483): skills/permissions-review/SKILL.md at main blob 60e1d546e713cfa5b289def082dd73e8b326f029 still classifies MCP servers by “permission tiers in docs/evaluation-framework.md.” That current framework defines no such tiers; the eight-tier vocabulary survives only in historical registry/candidates.yaml comments. The controlled authority taxonomy is read-only, generate-only, mutating, external-side-effect in registry/taxonomy.yaml, with identity/cost/destructive/private-data risks characterized separately. Since #482 already owns the permissions-review manifest for scheduling, please incorporate this correction in that same branch rather than racing another writer. Recheck private config/credential metadata authorization, exact manifest fingerprint, provenance, individual verification and the shared 44-entry registry; security and behavioral gates remain not-run. I did not modify #482.

[Knapp-Kevin]

Independent current-head review: #483 remains an actionable blocker on permissions-review (PR head a56b2b9f2d60c24ecd3cc85ce3e627d2f9e02ae0, manifest blob 6ad5d97a3e2f964c087a5477036087f007148d79). The scheduling/privacy repair is useful, but the candidate still directs Step 1 to classify MCP servers by permission tiers in docs/evaluation-framework.md, which defines no such tiers; Step 5 still ranks destructive/identity as if they were current controlled tiers; the output inventory still has a Tier column. The current controlled authority vocabulary is read-only, generate-only, mutating, external-side-effect in registry/taxonomy.yaml, with identity, destructive impact, cost and sensitive-data exposure recorded separately as consequential risk findings. This is not a semantic nit: it asks the host to produce classifications without a current governing standard.

Required before acceptance: replace Step 1, Step 5 and the output table with an action-by-action authority/side-effect inventory and separate risk flags; keep authorized metadata-only inspection, no secret values, and separate recurring-host approval; refresh permissions-review exact provenance/verification and the shared 44-entry registry against the final changed manifest blob, preserving behavioral not-run and security not-run. Reconcile against concurrently owned #416/#485 registry edits. This is the second half of open issue #483; the one-package mcp-vetting correction in #485 does not fix this branch. No scanner/behavioral pass is claimed here.

[Knapp-Kevin]

Superseded by draft #489, integration head 7c05bb6826d4382326a03aa4691107d10cd1f79c. All four recurring-authority skill manifests and exact-version evidence were integrated, including the later permissions-review taxonomy correction (blob dcaf7ff96c832c69bb5be1c7cd8f4c3ed418b707).

Independent integration readback confirmed 44/44 consolidated first-party manifest fingerprints and 29/29 individual verification fingerprints, with all 29 provenance companions present. This closure is lifecycle consolidation only, not a merge or acceptance of the fixes. The integrated 29 distinct final packages still require complete externally executed pinned SkillSpector evidence and independent behavioral/adversarial acceptance; issues #402/#415/#478/#481/#483 remain open. The original branch and historical review evidence are preserved.