[Knapp-Kevin]

Summary

Security evidence that unblocks held PRs, four qualification batches, a widened source-discovery pass, a held/reference-only re-audit, and the public-accounting reconciliations requested in review.

1. External pinned SkillSpector receipts (#402, #589)

NVIDIA SkillSpector v2.12.0 @ c7958a32, isolated venv, fail-closed. 92 exact trees: main 51 (25/1/25), #686 5/5 passed, #673 10/3/3, 20 featured 5/3/12. All 44 unchanged first-party trees reproduce the 2026-10-10 baseline.

2. Q8 qualification + audit (#588, #599, #624)

Four batches (45 candidates): exact pinned tree re-derived (45/45 match), full-package read, 10-dimension grade, license/authority/risk findings, pinned scan, claims spot-checked. A follow-up audit of all 19 non-featured candidates then promoted the distinct methods that had been held for extrinsic reasons.

50 Valuable References — every canonical domain featured. Shelf 20/10 → 50/33. Unchanged-use approvals and behavioral validations stay 0.

Curation principle applied consistently:

• Featured = a distinct, separable method worth studying. A flaw or hazard in the package (dependency, service-lock, implementation bug, rights, dual-use, "kept lean") is documented as a do-not-run limit, not a reason to bury the idea. Two high-scorers are study-only with hazards reproduced nowhere: a neurodivergence-aware resume method and a dual-use protein-design package (featured only for its separable cost-discipline method).
• Kept reference-only = low differentiation (textbook/standard), weak transferability, or overlap with an existing feature.
• Rejected = active harm (e.g. Management Hiring's ungated employment actions) — stays rejected.

3. Widened source discovery (#588, #599)

A GitHub code search found 12 new original sources outside the 962 already in the ledgers; batch 4 qualified them (all 5 previously-empty domains filled).

4. Reconciliation requested in review

Merged post-#696 main (mergeable=clean); transferred the 4 previously-UNKNOWN featured tree SHAs after pin+blob match; synced the dated Q8 checkpoint (now 50/33) into SYSTEM_STATE.md/INDEX.md/index.json, Q7 kept as history; corrected the prose counts flagged on the PR.

5. Pipeline + dashboard

5,351 exact static decisions; queue 1,522; global eligible UNKNOWN. Non-additive pipeline + CSV with self-tests. README/SVG/CSVs regenerated; --self-test/--check pass; SVG visually checked.

Not done / held

• Behavioral and adversarial tests: NOT RUN.
• Scanner false positives need maintainer acceptance before any findings-reviewed state.
• New sources beyond their one representative package remain unreviewed.
• fix(authority): redact credential fragments and scope five knowledge skills [skip ci] #686, fix: repair 16 retired pulse runners and enforce source/recurrence authority [skip ci] #673, [Consolidated into #698] research: pin music composition and illustration gap leads [skip ci] #677, [Consolidated into #698] review(q6): independent music-compose review and MIDI write hazards [skip ci] #682 not modified.

🤖 Generated with Claude Code

https://claude.ai/code/session_0114De5q3RniVy9N6N5TiBuT

2026-11-04 README/security reconciliation after new main status dashboard

The default-branch README now contains a new dated, reproducible security/curation snapshot in the separate SKILLZ_SECURITY_STATUS marked section, with source registry/public-security-curation-status-20261104.json, SVG docs/assets/security-and-curation-status.svg, and dependency-free scripts/build-public-security-status.mjs. This is merged main documentation, distinct from this Q8 draft's generated capability block. The public chart explicitly shows main 20/10 and Q8 proposed 50/33, scanner populations 25/1/25 of 51 main first-party/engine packages versus 10/7/33 of 50 Q8 study methods, and security issue #402 open. The chart's data are dated, not live passes on newer repaired source trees. Do not silently overwrite or drop that new main section during Q8 integration.

Integration warning: GitHub currently reports Q8 mergeable=false after the documentation commit on main. Before accepting/merging #693, update this branch from the live base without force, reconcile the README changes and generated dashboard so that both marked sections remain intact, run node scripts/build-capability-dashboard.mjs --self-test && node scripts/build-capability-dashboard.mjs --check and node scripts/build-public-security-status.mjs --self-test && node scripts/build-public-security-status.mjs --check on the final combined tree, preview both SVGs, and verify fresh PR head/reviews. The static security evidence and broad Q8 curation are still DRAFT/HOLD for independent acceptance; this note does not approve a merge. Source/source-summary state is separate from security state.

2026-11-04 Q8 50-reference curation integration acceptance

The previous integration HOLD conditions have been addressed for this study-only PR, without waiving security. The exact-branch review docs/reviews/2026-11-04-q8-current-shelf-acceptance.md records: 50/50 unique references/source-tree identity matches against merged Q12, 33/33 domains, 247 topics/210 research-linked, 50 actual-value descriptions/rights/risk limits, current scanner labels 10 passed, 7 failed, 33 incomplete (20 inherited Q7 labels corrected from stale not-run using unchanged pinned tree reports), and zero unchanged-use or behavioral approvals. The original publisher XLSX 25-case reproduction and its unchanged-use HOLD from merged #696 are preserved; Q8 README retains the current main security block. index.json retains all 136 original top-level keys; Q8 adds only its study-shelf pointer.

The generator's pure logic was executed in an in-memory sandbox: built-in selfTest() passed, and README dashboard, capability CSV, SVG, pipeline CSV reproduced 4/4 byte-identically from the current source ledgers (not claimed as a Node CLI check). Source taxonomies and 50-item risk/authority labels independently reconciled. No current security scanner or host behavior was run. Acceptance scope: publish differentiated conceptual Valuable References only, not unchanged third-party source skills. A Q8 post-merge dashboard snapshot update is required to replace historical Q7 20/10 live display with merged 50/33, while retaining historic static scanner evidence and #402 OPEN.

[Knapp-Kevin]

Addressed both reviews in ed8af3eb (branch now 0 commits behind main; the earlier mergeable=false is resolved).

Integration review:

1. Reconciled post-Q7 main. Merged origin/main (post-review(q7): verify unsafe GO in actual pinned XLSX, 25 engine cases [skip ci] #696). The CURATION_QUEUE.md conflict was resolved by keeping both the Q8 block and review(q7): verify unsafe GO in actual pinned XLSX, 25 engine cases [skip ci] #696's workbook blocks. The README auto-merge preserved review(q7): verify unsafe GO in actual pinned XLSX, 25 engine cases [skip ci] #696's new acceptance links (the 25-case engine acceptance and the source-column correction), so no acceptance link was lost. No text implies the publisher workbook was fixed or approved — the original-source HOLD is intact.
2. Synchronized public accounting. Added a dated Q8 current consumer accounting checkpoint (39 Valuable References / 28 domains, 0 unchanged-use, 0 behavioral) to the top of docs/SYSTEM_STATE.md and INDEX.md, explicitly marked as superseding the Q7 counts for current state only. The Q7 milestone and earlier checkpoints are retained as dated history; the Q7 "no engine or actual skill run" caveat now points to merged review(q7): verify unsafe GO in actual pinned XLSX, 25 engine cases [skip ci] #696 for the workbook acceptance status. Added a q8_current_consumer_shelf_20261103 current-shelf pointer to index.json while preserving every dated historical counter.
3. Verification. Re-ran --self-test and --check (both pass). Cross-checked: shelf ledger 39 entries / 28 domains / 0 duplicate (repo,pin,path) keys; README dashboard reads 39 methods / 0 approved; CSV 33 rows; pipeline 7 passed / 6 failed / 26 incomplete = 39. Failed/incomplete scans and unaccepted false-positive dispositions stay fail-closed; behavioral/adversarial acceptance remains NOT RUN.

Cross-identity comment: transferred the four verified package-tree SHAs — video-scoring-audio → 9c53aaf2275e, design-concept-art-brief → e9d0a458d2c8, scenario-storyboards → b0b029258172, scenario-identity-library → d514d323fcd6 — from the pinned scanner receipts into the Q8 consumer ledger, after verifying each matched on exact source pin and SKILL.md blob. package_sha_basis records the receipt provenance; the Q7 UNKNOWN evidence is kept as dated history. No shelf entry now has a null recorded_package_tree_sha.

Scanner gates unchanged and still separate from selection; no behavioral or unchanged-use approvals added.

---

Generated by Claude Code

[Knapp-Kevin]

Recheck of the previously posted Q8 integration blockers against updated head ed8af3eb9f595b1f168762f121b04c7561dfed14 (2026-11-03): the three specific accounting/integration findings are now addressed in the PR branch. PR is rebased to post-#696 main e083c47, GitHub reports mergeable=true; new current-Q8 checkpoints appear in INDEX.md and docs/SYSTEM_STATE.md, index.json has a Q8 current shelf pointer, and the README retains the actual original-workbook acceptance caveat. Thanks for fixing the state drift. This comment supersedes the earlier integration HOLD on those specific items. I have not independently run the full dashboard generator, SkillSpector, scanner finding adjudication, or representative/adversarial host behavior. Therefore this is not a merge approval or an unchanged-use clearance; keep those separate gates and the draft status until qualified. Independent Q9 #697 and Q10 #698 review disjoint source families and do not modify Q8 files.

[Knapp-Kevin]

Q8 revision reconciliation note (head d9649c4, 2026-11-03): The machine shelf now has 45 Valuable References / 33 domains (net 25 additions from Q7's 20), and the machine pipeline shows 8 passed / 7 failed / 30 incomplete static-security outcomes; unchanged-use approvals and behavioral validations remain 0. The new Neurodivergence-aware Resume reference is transparently study-only: its catalog entry correctly flags the false 'no outbound network' claim, version 1.4.0 vs 2.3.0 mismatch, and branding/license restrictions. Thank you for preserving that distinction. Please fix three stale prose summaries before Q8 merges: (1) INDEX.md says Twenty-four methods added, (2) docs/SYSTEM_STATE.md also says Twenty-four, (3) docs/reviews/2026-11-04-q8-widened-discovery-qualification-batch4.md still says 'Across all 44 featured trees: 8 passed / 7 failed / 29 incomplete'; PR description likewise advertises 24 additions/44 shelf. Current machine status is 25 additions/45 shelf/30 incomplete. I reconciled these counts in disjoint downstream Q11 #699 without modifying Q8's branch. Q11 now merges Q8's head via non-forced two-parent Git commit; review remains draft and no approval is implied.

[Knapp-Kevin]

Fixed in e49df7b5. All three stale prose counts now match the machine state (25 added / 45 shelf / 30 incomplete):

1. INDEX.md — "Twenty-four" → "Twenty-five methods … four Q8 qualification passes", now also linking batch 4 and noting the study-only resume method.
2. docs/SYSTEM_STATE.md — same fix.
3. docs/reviews/2026-11-04-q8-widened-discovery-qualification-batch4.md — "all 44 featured trees … 29 incomplete" → "all 45 … 30 incomplete".

The PR title and description were already updated to 25 additions / 45 shelf in the prior revision. Machine ledgers were correct throughout; this was prose-only reconciliation. --check still passes. Thanks for the catch, and for carrying the counts into Q11 #699 via a non-forced two-parent merge without touching this branch.

---

Generated by Claude Code