[Knapp-Kevin]

SUPERSEDED: exact content transferred to canonical PR #703 (2026-11-04)

CLOSED UNMERGED, NOT DISCARDED. All 19 unique changed file blobs from source PR #686 at head 3d03c396d11645767c8e3a58b7113f8fec506ae2, and all 5 complete skill-package Git trees, are preserved byte-identically in active canonical PR #703 at its accepted consolidation commit 7da266b84a88397dbf95fc950040e41ce3b81df5. The source head is also a parent of that merge commit, preserving source history and review provenance. The sole common file registry/local-verification.json was merged by exact skill identity into a 44/44 consistent registry; zero changed skill packages or validation statuses were dropped.

Detailed byte-identity and cross-PR handoff record. Prior issue, review, scanner and adversarial evidence links remain valid here. No security scanner or agent-host behavior was executed by this transfer; the 34-package shared frontier remains 14 exact-tree matched static scanner PASS / 20 needing scans / 0 behavioral / 0 unchanged-use approvals. All originally associated security issues remain OPEN; #703 is now their single active repair PR owner. Do not interpret this closure as acceptance into main, a passed scanner, or permission to install.

---

Current qualification gate (2026-11-03)

Draft/HOLD despite static gate passing. Q8 #693 records external-host pinned SkillSpector scans of all five exact changed trees: 5/5 PASSED. The five changed SKILL.md procedures are still not approved unchanged or behaviorally validated. Run independent secret-leakage, private-read-consent, prompt-injection and missing-access cases on an authorized host; reconcile exact current provenance/verification/registry records before any owner-accepted merge. Historical notes below that say external scanning is still pending refer to an earlier checkpoint; the remaining gate is behavioral and integration acceptance, not a missing static pass. Tracks #491.

---

Implements bounded issue #491 on a disjoint branch. Five existing first-party SKILL.md instructions no longer allow secret prefixes/suffixes/hashes or signed URLs in reports. Brief Writer requires scoped Gmail/calendar evidence; Agent Postmortem requires scoped transcript/log/cost access. All five reject retrieved-source instructions and require separate authorization for writes. Exact old/new blobs and static HOLD receipt: docs/reviews/2026-11-03-five-secret-prefix-source-scope-repair.md. Draft/HOLD: package trees, source/provenance/verification companions, consolidated first-party registry, external SkillSpector, and executed adversarial tests outstanding. No behavioral/security pass, promotions, or five-surface accounting changes. Does not modify #673/#677/#682.

File-inventory reconciliation (2026-11-04)

GitHub's live changed-file list at head 7970edf438afb67cee91d87fe79174623800d0cb contains 7 paths: five skills/*/SKILL.md files and two review documents. It does not contain the five source-provenance companion records, five per-skill verification records, or registry/local-verification.json. Therefore the historical PR description's gate for companions is still outstanding; scanner 5/5 pass must not be mistaken for integrated verification coverage. Do not add a competing PR. Coordinate these missing companions and any shared-registry changes with current #673/#702/#703 branches; separately run the already-required external-host adversarial cases and obtain owner acceptance before merge. This note describes a file-inventory check, not newly executed tests.

2026-11-04 source/provenance/verification repair committed

Head: 45bc328aaee59416f29c9d40c40e3bb6cb18a3ad ([skip ci]). The earlier 2026-11-04 inventory note describing missing companion files is now superseded. Added the five missing source-provenance YAML files, five individual verification YAML files, and refreshed the consolidated 44-skill registry/local-verification.json in the existing PR branch. Changed-file inventory now contains 18 files, including the five unchanged previously repaired SKILL.md files and two static review documents.

Verified after writing: agent-postmortem, brief-writer, compare, deep-dive and fact-check each have exactly matching SKILL.md Git blob SHA in the individual verification record and consolidated registry (5/5); each provenance file pins the skill-bearing branch revision; all five continue to state behavioral not-run. The 44-entry registry count was confirmed, but this update's direct source-readback covered five, not all 44 skill packages. No source scripts were executed, no private data fetched and no scanner rerun performed.

Still DRAFT/HOLD: independently execute authorized adversarial behavioral tests (no secret disclosure, no unauthorized private reads, hostile retrieved content, missing-source reporting), reconcile shared registry records with concurrent #673/#702/#703 before integration, obtain owner/reviewer acceptance. Prior exact-tree external scanner pass evidence is held on #693; it is not behavioral approval or permission for unchanged use. Do not merge solely because records now match.

2026-11-04 cross-branch registry reconciliation

Source: live registry/local-verification.json readback from main and current heads #673 aa59c36f1298c28bc399a13e2e39354663de8811, #686 45bc328aaee59416f29c9d40c40e3bb6cb18a3ad, #702 cca9ec1d8956e3ce1c6d052780a7522da612317d, #703 fc3869b3df951f2cb119a7b55caaeaa9316e7d89.

Result: 44/44 registry names present in each snapshot. Compared each record to the same main baseline: #673 changes 16 pulse records; #686 changes 5 knowledge records; #702 changes 2 task/receipt records; #703 changes 5 governance records. The 28 changed skill identities are pairwise disjoint across these four snapshots, with 16 other baseline records unchanged. No record-level conflicts were observed. This is a static merge-preview, not a combined Git tree, merged commit, all-package revalidation, or executed behavioral test.

Safe integration path: merge only after each independent qualification and owner acceptance. Rebase or reconstruct the shared registry/local-verification.json against the latest accepted main, preserving the union of independently accepted records and checking every record SHA against the corresponding integrated skills/*/SKILL.md blob. The source/provenance/individual verification YAML counterparts must travel with each skill change. Do not pre-copy 23 other branches' registry records into this branch while their source files remain absent, as that would create false fingerprint matches. On any concurrent branch movement, redo the comparison. Keep all independent adversarial/rights/security HOLD gates intact.

2026-11-04 latest: integration tree and 5/5 exact scanner rebind

Current branch state: Integration merge commit dc399b3ed2b78a14b1e18ec3141c6a98ad04ca17 reconciled this existing branch with accepted main e19d5ce3389f783f5b58bbea3ff4b4f7a492dff3 without force, dropping documents, changing any of the five repaired SKILL.md blobs, or borrowing entries from other unmerged repairs. The union-aware 44-entry registry changes exactly five intended knowledge skills and preserves the other 39 current-main records; base-to-main comparison found zero overlapping changed paths. GitHub's branch now reports mergeable=true. The follow-on source-pinned evidence and test specification commits are appended without changing any skill package.

Actual security evidence, not a new scan: five-record exact-tree carry-forward binds all 5/5 integrated skills/<name> Git tree SHAs to the identical pinned SkillSpector v2.12.0 executed PASS reports, at scanner commit c7958a3268d9498644b22edb75d0f051bbc8cbfc with 100% recorded coverage, no active findings, and preserved raw-report SHA256. No package tree changed; no new scan or permissions approval was invented. The historical scanner report is already on main.

Precise remaining blocker before merge: independent, observed agent-host adversarial acceptance still NOT RUN. New 25-case synthetic host protocol defines five observed tests per skill: legitimate trigger, synthetic credential-leakage, prohibited private reads, hostile retrieved instructions, and failure/write denial. It contains no real secrets or credentials. The target host must log attempted unauthorized tool calls, not just returned text; any failure requires a fix and requalification. The repository remains passive; no tests/CI/runners or bills were created. This PR stays DRAFT/HOLD until genuine observations and owner approval, and issue #491 remains OPEN. No unchanged-use promotion follows from these source fixes or static passes.