Add Prolog-owned automatic skill activation (linear replacement) #197

Merged

lost-rob0t merged 1 commit from feature/117-prolog-skill-activation-linear into main

2026-08-25 06:38:51 +00:00

lost-rob0t commented

2026-08-25 06:37:14 +00:00

(Migrated from github.com)

Closes #117.

This is the linear-history replacement for #122. It carries the same reviewed
tree as #122 at 7840e7a8a9f1dc784eb9592f572133a94154cc8a; #122 remains open
because the repository QA ruleset permits rebase merges only and its history
contains merge commits.

Runtime invariant

SKILL.md is confined inert package data. It normalizes into the existing
prompt_unit{unit:skill(...)} IR; the one rlm_prompt_compiler owns routing,
dependency closure, conflicts, packing, explanations, and fingerprints. Skill
content never grants capabilities, authority, handlers, or execution rights.

What changed

adds bounded standard-compatible SKILL.md discovery and a closed
metadata.prolog-rlm JSON adapter;
preserves Claude disable-model-invocation compatibility without treating
package metadata as host policy;
rejects descendant symlinks, path traversal, changed admitted bodies and
resources, oversized files/catalogs, excessive depth, and excessive visited
entries;
indexes bodies/resources progressively and reads only selected skill bodies;
removes the competing skill_compile/4 selector, prompt renderer, and
completion predicate wrapper from the old branch;
adds generic host-owned activation:always to rlm_prompt_compiler, outside
candidate limits and resistant to user-text negation;
makes always/always conflicts and supersession structural configuration
errors while preserving trusted host denial;
adds four concise default RLM operating skills: rlm-operate, rlm-recurse,
rlm-facts, and rlm-constraints;
compiles those skills into one bounded system message on the exact root
planner request, reused without duplication across planner retries;
supports trusted global/per-skill disable and explicit selection, failing
closed on unknown or rejected explicit skills;
keeps raw standalone llm_query/3 unchanged;
retains the pinned Matt Pocock collection as an optional inert third-party
catalog rather than ambient core behavior.

Host policy boundary

Only trusted host options may assign activation(always), mandatory context,
provider visibility, availability overrides, or capability requirements.
Natural-language instructions and package-authored metadata cannot pin, unpin,
authorize, or execute a skill.

Verification

focused prompt compiler: 33/33;
focused skill loader: 30/30;
symlink confinement: 2/2;
focused completion provider projection: 40/40;
planner tool-schema visibility regression: 1/1;
focused subagent budget contracts: 12/12;
complete deterministic corpus: 867/867 across 78 suites;
runtime/load-all checks;
deterministic benchmark and depth experiment;
CLI JSON demo smoke;
deterministic runner integrity and main-ownership probes;
copied SWI pack install/load, including all four default skills;
git diff --check.

GitHub Actions on exact head 563d298f291840e295431ef093b16a8c61024703
is the authoritative merge gate.

Non-goals and follow-up

#176 retains unified tool/MCP provider projection and projection
observability;
#176/#183 retain broader RLM-internal leaf/repair request propagation and
compaction reconstitution;
#183 retains behavioral live-model evaluation beyond deterministic exact
request evidence.

Closes #117. This is the linear-history replacement for #122. It carries the same reviewed tree as #122 at `7840e7a8a9f1dc784eb9592f572133a94154cc8a`; #122 remains open because the repository QA ruleset permits rebase merges only and its history contains merge commits. ## Runtime invariant `SKILL.md` is confined inert package data. It normalizes into the existing `prompt_unit{unit:skill(...)}` IR; the one `rlm_prompt_compiler` owns routing, dependency closure, conflicts, packing, explanations, and fingerprints. Skill content never grants capabilities, authority, handlers, or execution rights. ## What changed - adds bounded standard-compatible `SKILL.md` discovery and a closed `metadata.prolog-rlm` JSON adapter; - preserves Claude `disable-model-invocation` compatibility without treating package metadata as host policy; - rejects descendant symlinks, path traversal, changed admitted bodies and resources, oversized files/catalogs, excessive depth, and excessive visited entries; - indexes bodies/resources progressively and reads only selected skill bodies; - removes the competing `skill_compile/4` selector, prompt renderer, and completion predicate wrapper from the old branch; - adds generic host-owned `activation:always` to `rlm_prompt_compiler`, outside candidate limits and resistant to user-text negation; - makes always/always conflicts and supersession structural configuration errors while preserving trusted host denial; - adds four concise default RLM operating skills: `rlm-operate`, `rlm-recurse`, `rlm-facts`, and `rlm-constraints`; - compiles those skills into one bounded system message on the exact root planner request, reused without duplication across planner retries; - supports trusted global/per-skill disable and explicit selection, failing closed on unknown or rejected explicit skills; - keeps raw standalone `llm_query/3` unchanged; - retains the pinned Matt Pocock collection as an optional inert third-party catalog rather than ambient core behavior. ## Host policy boundary Only trusted host options may assign `activation(always)`, mandatory context, provider visibility, availability overrides, or capability requirements. Natural-language instructions and package-authored metadata cannot pin, unpin, authorize, or execute a skill. ## Verification - focused prompt compiler: 33/33; - focused skill loader: 30/30; - symlink confinement: 2/2; - focused completion provider projection: 40/40; - planner tool-schema visibility regression: 1/1; - focused subagent budget contracts: 12/12; - complete deterministic corpus: 867/867 across 78 suites; - runtime/load-all checks; - deterministic benchmark and depth experiment; - CLI JSON demo smoke; - deterministic runner integrity and main-ownership probes; - copied SWI pack install/load, including all four default skills; - `git diff --check`. GitHub Actions on exact head `563d298f291840e295431ef093b16a8c61024703` is the authoritative merge gate. ## Non-goals and follow-up - #176 retains unified tool/MCP provider projection and projection observability; - #176/#183 retain broader RLM-internal leaf/repair request propagation and compaction reconstitution; - #183 retains behavioral live-model evaluation beyond deterministic exact request evidence.