From 4a6c54be1aadb206a767437f5fc7ac9d7b3c6840 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Wed, 22 Jul 2026 00:42:37 +0800 Subject: [PATCH 1/5] =?UTF-8?q?skill-authoring=20=C2=A76:=20name=20the=20d?= =?UTF-8?q?eployment=20runtime=20before=20the=20review=20concludes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A skill reviewed and finalized against the author's local macOS was rebuilt wholesale the same week when its real target — a sandboxed Linux VM — surfaced after sign-off: host identity, launcher mechanism, and machine-local MCP tool-name assumptions all failed there. §6's lenses check the file against the author's world; none asks where it will run. This adds that question as a review input plus the sweep list for machine-bound assumptions (absolute paths, OS launchers, host identity, clock/timezone, hard-coded MCP tool prefixes). Ships unprobed per the README covenant; Provenance records the probe shape as debt. --- skills/skill-authoring/SKILL.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index f9bc110..3a22838 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -229,6 +229,22 @@ The sharpest usability probe is behavioral: give a fresh weaker-tier behavior down first, then patch the gaps the probe surfaces — not the ones you imagine. +**Name the deployment runtime before the review concludes** (`unprobed` — +private incident as shape; see Provenance). A skill or plugin verified only +on the author's machine can pass every lens above and still be wrong where +it will actually run: one reviewed-and-finalized skill was reworked +wholesale when its real target — a sandboxed Linux VM, not the author's +macOS — surfaced only after sign-off. Ask where it will run as a review +input, not a deploy-time discovery, then sweep the file for assumptions +that silently bind it to the author's machine: absolute paths (§2's rule), +OS-specific launchers and helpers (URL-scheme opens, clipboard or +notification tools), host identity, wall-clock and timezone, and +hard-coded MCP tool names — a connector's tool prefix can be unique to the +author's instance, so a distributable skill discovers its tools at runtime +instead of naming one machine's. Done when the review names the target +runtime(s) and each machine-bound assumption is either portable or labeled +with the runtime it requires. + Fix what blocks, then read back the final files to confirm they landed complete. When mining sessions or external material into skills, strip names/slogans first and keep a procedure only if it still has an apply-when, @@ -397,4 +413,14 @@ marker per the README covenant: the external measurement is of one skill's one gate, and whether placement generalizes across gate types is exactly what an in-house probe would test — that probe has not been run; the marker records the debt. +The §6 deployment-runtime rule (2026-07-21) comes from a private incident: +a skill was authored, reviewed through the lenses above, and finalized for +the author's local macOS environment, then rebuilt wholesale the same week +when the user mentioned it would run inside a sandboxed Linux VM — host +identity, launcher mechanism, and machine-local MCP tool-name assumptions +all failed on the real target (contributor-reported; the private repo is +verifiable by the contributor, not linkable here). Ships `unprobed` per the +README covenant's second branch: no in-repo probe has run; the probe shape +(give a weak-tier reviewer a machine-bound skill plus a named foreign +runtime, observe whether the sweep fires) is recorded as debt. Stable method; no environment facts to re-verify. From 360c89d332a331f6e0f810c53e4a0d3d3ed1be34 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:49:41 +0800 Subject: [PATCH 2/5] skill-authoring: rework the deployment-runtime rule per r1 dual review PR #52 round-1 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1-5). Reproduced and addressed: - unknown/unaskable runtime -> mark user-must-provide, conclude without a portability verdict, never default to the authoring host (grok F1) - MCP clause made executable and bounded to instance-specific identifiers: verified portable name, or a runtime/instance label; no invented discovery mechanism (grok F2 / codex F5) - Done now requires compatibility with every NAMED target - a labeled incompatibility blocks completion or explicitly shrinks the supported scope (codex F1, F4) - S2 citation restored to its qualified form: hard-coded machine-absolute paths (codex F2) - pos/neg pair added at the portable-vs-labeled boundary (codex F4 / grok n4); sweep categories glossed with concrete cues (grok n3); lead state-phrased (grok n5) - codex F3 rejected-with-reason: single-incident rules with unprobed markers are this repo's documented covenant and settled precedent (silent-clobber, fan-in, interactive-runtime all shipped on one observation); S4's two-strike governs fix-log promotion in consuming projects, not this pack's covenant-governed rule adoption - codex n6 (in-packet checks.py unverifiability): standing disposition, gate-runner re-runs it each round Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 43 +++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 3a22838..35a478f 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -229,21 +229,34 @@ The sharpest usability probe is behavioral: give a fresh weaker-tier behavior down first, then patch the gaps the probe surfaces — not the ones you imagine. -**Name the deployment runtime before the review concludes** (`unprobed` — -private incident as shape; see Provenance). A skill or plugin verified only -on the author's machine can pass every lens above and still be wrong where -it will actually run: one reviewed-and-finalized skill was reworked -wholesale when its real target — a sandboxed Linux VM, not the author's -macOS — surfaced only after sign-off. Ask where it will run as a review -input, not a deploy-time discovery, then sweep the file for assumptions -that silently bind it to the author's machine: absolute paths (§2's rule), -OS-specific launchers and helpers (URL-scheme opens, clipboard or -notification tools), host identity, wall-clock and timezone, and -hard-coded MCP tool names — a connector's tool prefix can be unique to the -author's instance, so a distributable skill discovers its tools at runtime -instead of naming one machine's. Done when the review names the target -runtime(s) and each machine-bound assumption is either portable or labeled -with the runtime it requires. +**A skill or plugin is under review here and its target runtime(s) are +not yet named in the review record — name them before the review +concludes** (`unprobed` — private incident as shape; see Provenance). A +skill verified only on the author's machine can pass every lens above and +still be wrong where it will actually run: one reviewed-and-finalized +skill was reworked wholesale when its real target — a sandboxed Linux VM, +not the author's macOS — surfaced only after sign-off. Obtain the target +from the request or the user; when no answer is available, mark the +runtime `user-must-provide` and conclude without a portability verdict — +never default to the authoring host. Then sweep for assumptions that +silently bind the file to the author's machine: hard-coded +machine-absolute paths (§2's rule), OS-specific launchers and helpers +(URL-scheme opens, clipboard or notification tools), host identity (a +literal hostname or username), wall-clock or timezone assumptions (a +hard-coded TZ, a locale), and instance-specific tool identifiers — a +connector's tool prefix can be unique to the author's instance: keep a +verified portable name, or label the dependency with the runtime or +instance it requires; when no verified discovery mechanism or portable +form exists, that label is the honest outcome — never invent one. Done +when every named target runtime is compatible with every kept +assumption — a labeled incompatibility with a named target blocks +completion or explicitly shrinks the supported target scope — and +everything machine-bound carries its label. +✅ "target: sandboxed Linux VM; the notify helper is macOS-only — +replaced with a portable path; the connector prefix labeled +instance-specific." +❌ "labeled the launcher 'requires macOS' and concluded — while the +named target is a Linux VM." Fix what blocks, then read back the final files to confirm they landed complete. When mining sessions or external material into skills, strip From d913732e18bc0fbc4a445132adf422a9e7e3e129 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:01:55 +0800 Subject: [PATCH 3/5] skill-authoring: r2 rework of the deployment-runtime rule - always-sweep, authoring-time ask, adoption block PR #52 round-2 gate (grok-4.5 high: FIX 1,2,3,4; gpt-5.6-sol max: FIX 1,2,3,4,5,7). All reproduced and addressed: - the sweep now runs on every review; naming is a conditional first step, not the trigger - an already-named target no longer skips the whole rule (grok F1 / codex F2) - the runtime ASK moved to authoring start per the file's own gate-placement rule; this review verifies it landed (codex F1) - no-answer path: user-must-provide recorded, sweep still runs, adoption blocked until the owner resolves or explicitly defers (grok F2 / codex F4) - review record defined via S7's change-record shape; target runtime defined as execution environment + governing connector/tool instance (grok F3 / codex F7) - machine-absolute paths get S2's VCS-root remedy - a label never keeps one (grok F4) - scope shrink can only exclude an OPTIONAL target with the user's explicit say; labeled incompatibility with the actual deployment target blocks (codex F3) - pos example made concrete and verifiable: named replacement, run on the target image, instance named (codex F5 / grok n5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 62 +++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 26 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 35a478f..61a5ecb 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -229,32 +229,42 @@ The sharpest usability probe is behavioral: give a fresh weaker-tier behavior down first, then patch the gaps the probe surfaces — not the ones you imagine. -**A skill or plugin is under review here and its target runtime(s) are -not yet named in the review record — name them before the review -concludes** (`unprobed` — private incident as shape; see Provenance). A -skill verified only on the author's machine can pass every lens above and -still be wrong where it will actually run: one reviewed-and-finalized -skill was reworked wholesale when its real target — a sandboxed Linux VM, -not the author's macOS — surfaced only after sign-off. Obtain the target -from the request or the user; when no answer is available, mark the -runtime `user-must-provide` and conclude without a portability verdict — -never default to the authoring host. Then sweep for assumptions that -silently bind the file to the author's machine: hard-coded -machine-absolute paths (§2's rule), OS-specific launchers and helpers -(URL-scheme opens, clipboard or notification tools), host identity (a -literal hostname or username), wall-clock or timezone assumptions (a -hard-coded TZ, a locale), and instance-specific tool identifiers — a -connector's tool prefix can be unique to the author's instance: keep a -verified portable name, or label the dependency with the runtime or -instance it requires; when no verified discovery mechanism or portable -form exists, that label is the honest outcome — never invent one. Done -when every named target runtime is compatible with every kept -assumption — a labeled incompatibility with a named target blocks -completion or explicitly shrinks the supported target scope — and -everything machine-bound carries its label. -✅ "target: sandboxed Linux VM; the notify helper is macOS-only — -replaced with a portable path; the connector prefix labeled -instance-specific." +**A skill or plugin is under this section's review — verify its +deployment runtime before the review concludes** (`unprobed` — private +incident as shape; see Provenance). A skill verified only on the +author's machine can pass every lens above and still be wrong where it +will actually run: one reviewed-and-finalized skill was reworked +wholesale when its real target — a sandboxed Linux VM, not the author's +macOS — surfaced only after sign-off. The target question belongs at +authoring start (§1's gate placement: ask before the first +artifact-producing step); this review verifies the answer landed and +the sweep ran. Confirm the review record — the same artifact as §7's +change record (the PR description or commit message, else the +completion report) — names the target runtime(s): the execution +environment (OS, container, sandbox) and any governing connector or +tool instance. Not named → obtain it from the request or the user; no +answer → write `user-must-provide` in the record, and adoption stays +blocked until the owner resolves or explicitly defers it. Named or +not, always run the sweep for assumptions that silently bind the file +to the author's machine: hard-coded machine-absolute paths get §2's +remedy (anchor to the VCS root — a label never keeps one); OS-specific +launchers and helpers (URL-scheme opens, clipboard or notification +tools), host identity (a literal hostname or username), wall-clock or +timezone assumptions (a hard-coded TZ, a locale), and +instance-specific tool identifiers (a connector's tool prefix can be +unique to the author's instance) each keep a verified portable form or +carry a label naming the exact runtime or instance required; when no +verified portable form exists, that named label is the honest outcome +— never an invented mechanism. Done when every named target runtime is +compatible with every kept assumption — a labeled incompatibility with +the actual deployment target blocks completion, and shrinking the +supported scope can only exclude an optional target with the user's +explicit say — and everything machine-bound carries its named label in +the record. +✅ "target: sandboxed Linux VM plus the team's shared connector +instance; the macOS-only notify helper replaced with the project's CLI +logger and run once on the target image; the connector prefix labeled +'requires the shared instance'." ❌ "labeled the launcher 'requires macOS' and concluded — while the named target is a Linux VM." From 041b8531df82f5a3d0d50310d94f553be377bd45 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:13:12 +0800 Subject: [PATCH 4/5] skill-authoring: r3 refinements to the deployment-runtime rule PR #52 round-3 gate (grok-4.5 high: FIX 1-5; gpt-5.6-sol max: FIX 1-8). All reproduced and addressed: - unknown-target semantics: requester supplies or records explicit risk-acceptance deferral; silence is neither; empty target list never satisfies Done vacuously (grok F1-analog / codex F1) - named-target attribution: obtained from the requester, not author-inferred presence of a string (grok r3 F1) - runtime-agnostic recorded outcome for doctrine-only files (grok F4) - compatibility judged per target over assumptions REACHABLE on it; verified target-scoped dispatch branches count compatible (codex F2) - S2 path remedy quoted verbatim incl. prefix verification, scoped to accidentally machine-local repo paths; target-defined absolute paths are ordinary machine-bound assumptions (codex F3, F6 / grok F2-analog) - S7 record-selection clause quoted verbatim (codex F7) - labels live IN the skill file beside the dependency, verified where reachable, marked unverified where not - a label records a limitation, never proves compatibility (codex F4, F8) - review-cannot-retro-place-the-ask stated; S6 is the blocking backstop, not a time machine (codex F5); target-image run dropped from the pos example (grok F3-analog) - optional-vs-required target pinned to the requester's explicit say (grok F5-analog) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 54 ++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 21 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 61a5ecb..2d3a436 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -237,34 +237,46 @@ will actually run: one reviewed-and-finalized skill was reworked wholesale when its real target — a sandboxed Linux VM, not the author's macOS — surfaced only after sign-off. The target question belongs at authoring start (§1's gate placement: ask before the first -artifact-producing step); this review verifies the answer landed and -the sweep ran. Confirm the review record — the same artifact as §7's -change record (the PR description or commit message, else the -completion report) — names the target runtime(s): the execution -environment (OS, container, sandbox) and any governing connector or -tool instance. Not named → obtain it from the request or the user; no -answer → write `user-must-provide` in the record, and adoption stays -blocked until the owner resolves or explicitly defers it. Named or +artifact-producing step); this review cannot retro-place that ask — it +verifies the answer exists and blocks adoption when it does not. +Confirm the review record — the same artifact as §7's change record, +verbatim: "the PR description or commit message when one is being +created, otherwise the completion report" — names the target +runtime(s): the execution environment (OS, container, sandbox) and any +governing connector or tool instance; a sweep that finds nothing +machine-bound may record `runtime-agnostic` as the named outcome. Not +named → obtain it from the requester; no answer → write +`user-must-provide` in the record, and adoption stays blocked until +the requester either supplies the target or records an explicit +risk-acceptance deferral — silence is neither, and an empty target +list never satisfies the compatibility check below vacuously. Named or not, always run the sweep for assumptions that silently bind the file -to the author's machine: hard-coded machine-absolute paths get §2's -remedy (anchor to the VCS root — a label never keeps one); OS-specific +to the author's machine: an accidentally machine-local repository path +gets §2's remedy, verbatim ("Anchor to the VCS root (`git rev-parse +--show-toplevel`) and verify the path prefix before reading"), while +an absolute path the target itself defines (a socket, device, or +mount) is a machine-bound assumption like the rest; OS-specific launchers and helpers (URL-scheme opens, clipboard or notification tools), host identity (a literal hostname or username), wall-clock or timezone assumptions (a hard-coded TZ, a locale), and instance-specific tool identifiers (a connector's tool prefix can be -unique to the author's instance) each keep a verified portable form or -carry a label naming the exact runtime or instance required; when no -verified portable form exists, that named label is the honest outcome -— never an invented mechanism. Done when every named target runtime is -compatible with every kept assumption — a labeled incompatibility with -the actual deployment target blocks completion, and shrinking the -supported scope can only exclude an optional target with the user's -explicit say — and everything machine-bound carries its named label in -the record. +unique to the author's instance) each keep a verified portable form, +or stay behind a verified target-scoped dispatch (an OS-conditional +branch counts as compatible with targets that never reach it), or +carry a label naming the exact runtime or instance required — written +IN the skill file beside the dependency (§2's embed-the-knowledge; the +review record points to it), verified against that instance where +reachable and marked `unverified` (§2) where not: a label records a +limitation, never proves compatibility. Done when every named target +runtime is compatible with every assumption reachable on it — a +labeled incompatibility with the actual deployment target blocks +completion, and shrinking the supported scope can only exclude an +optional target with the requester's explicit say — and everything +machine-bound carries its named label in the file. ✅ "target: sandboxed Linux VM plus the team's shared connector instance; the macOS-only notify helper replaced with the project's CLI -logger and run once on the target image; the connector prefix labeled -'requires the shared instance'." +logger; the connector prefix labeled in-file 'requires the shared +instance' and resolved against it." ❌ "labeled the launcher 'requires macOS' and concluded — while the named target is a Linux VM." From ae73e9b9bb97b4a31c18bdf1da89c108ae6d08c9 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:27:50 +0800 Subject: [PATCH 5/5] skill-authoring: r4 refinements to the deployment-runtime rule PR #52 round-4 gate (grok-4.5 high: FIX 1,2,3; gpt-5.6-sol max: FIX 1-6). Adjudication: - deferral terminal state unified: recorded risk acceptance by the deployment owner = alternate Done that still requires the sweep and in-file labels; no acceptance -> blocked; anti-vacuity clash removed (grok F1 / codex F1) - target-scoped dispatch satisfies a named target only when that target keeps a working path for every claimed capability - costume conditionals excluded (grok F2) - Done vocabulary unified on named-target-in-record (grok F3) - sweep list declared a floor; executable-dependency dimensions added (arch, interpreter/deps, versions, fs, permissions, network); runtime-agnostic restricted to pure instruction text (codex F2) - authoring-start requirement made answer-or-user-must-provide BEFORE first artifact-producing step; review = enforcement backstop (codex F4) - plugin branch narrowed to a plugin's instruction files, matching the frontmatter router (codex F6); repo-manifests-first discovery order (codex n7) - codex F3: this PR's own record gains its runtime line (body edit: runtime-agnostic, pure doctrine); codex n8: body Unicode claim corrected to include the arrow glyph - codex F5 rejected-with-reason (standing): single-incident rules with unprobed markers are this repo's covenant and precedent; S4 two-strike governs fix-log promotion in consuming projects Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 92 ++++++++++++++++++--------------- 1 file changed, 50 insertions(+), 42 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 2d3a436..97aeeee 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -229,49 +229,57 @@ The sharpest usability probe is behavioral: give a fresh weaker-tier behavior down first, then patch the gaps the probe surfaces — not the ones you imagine. -**A skill or plugin is under this section's review — verify its -deployment runtime before the review concludes** (`unprobed` — private -incident as shape; see Provenance). A skill verified only on the -author's machine can pass every lens above and still be wrong where it -will actually run: one reviewed-and-finalized skill was reworked -wholesale when its real target — a sandboxed Linux VM, not the author's -macOS — surfaced only after sign-off. The target question belongs at -authoring start (§1's gate placement: ask before the first -artifact-producing step); this review cannot retro-place that ask — it -verifies the answer exists and blocks adoption when it does not. -Confirm the review record — the same artifact as §7's change record, -verbatim: "the PR description or commit message when one is being -created, otherwise the completion report" — names the target -runtime(s): the execution environment (OS, container, sandbox) and any -governing connector or tool instance; a sweep that finds nothing -machine-bound may record `runtime-agnostic` as the named outcome. Not -named → obtain it from the requester; no answer → write -`user-must-provide` in the record, and adoption stays blocked until -the requester either supplies the target or records an explicit -risk-acceptance deferral — silence is neither, and an empty target -list never satisfies the compatibility check below vacuously. Named or -not, always run the sweep for assumptions that silently bind the file -to the author's machine: an accidentally machine-local repository path -gets §2's remedy, verbatim ("Anchor to the VCS root (`git rev-parse +**A skill — or a plugin's instruction files — is under this section's +review: verify the deployment runtime before the review concludes** +(`unprobed` — private incident as shape; see Provenance). A skill +verified only on the author's machine can pass every lens above and +still be wrong where it will actually run: one reviewed-and-finalized +skill was reworked wholesale when its real target — a sandboxed Linux +VM, not the author's macOS — surfaced only after sign-off. §1's gate +placement applies at authoring start: the target answer (or a recorded +`user-must-provide`) is required before the first artifact-producing +step; this review is the enforcement backstop, and it blocks adoption +when the answer is missing. Confirm the review record — the same +artifact as §7's change record, verbatim: "the PR description or commit +message when one is being created, otherwise the completion report" — +names the target runtime(s): the execution environment (OS, container, +sandbox) and any governing connector or tool instance. Not named → +read the repo's own deployment manifests and docs first, then obtain +what they cannot tell you from the requester; no answer → write +`user-must-provide` in the record; adoption then proceeds ONLY under a +recorded risk acceptance by whoever owns the deployment — that +acceptance is an alternate Done which still requires the sweep below +and every in-file label; without it the artifact stays blocked. +Named or not, always run the sweep for assumptions that silently bind +the file to the author's machine — this list is a floor, not the +ceiling: an accidentally machine-local repository path gets §2's +remedy, verbatim ("Anchor to the VCS root (`git rev-parse --show-toplevel`) and verify the path prefix before reading"), while -an absolute path the target itself defines (a socket, device, or -mount) is a machine-bound assumption like the rest; OS-specific -launchers and helpers (URL-scheme opens, clipboard or notification -tools), host identity (a literal hostname or username), wall-clock or -timezone assumptions (a hard-coded TZ, a locale), and -instance-specific tool identifiers (a connector's tool prefix can be -unique to the author's instance) each keep a verified portable form, -or stay behind a verified target-scoped dispatch (an OS-conditional -branch counts as compatible with targets that never reach it), or -carry a label naming the exact runtime or instance required — written -IN the skill file beside the dependency (§2's embed-the-knowledge; the -review record points to it), verified against that instance where -reachable and marked `unverified` (§2) where not: a label records a -limitation, never proves compatibility. Done when every named target -runtime is compatible with every assumption reachable on it — a -labeled incompatibility with the actual deployment target blocks -completion, and shrinking the supported scope can only exclude an -optional target with the requester's explicit say — and everything +an absolute path the target itself defines (a socket, device, mount) +is a machine-bound assumption like the rest; OS-specific launchers and +helpers (URL-scheme opens, clipboard or notification tools), host +identity (a literal hostname or username), wall-clock or timezone +assumptions (a hard-coded TZ, a locale), instance-specific tool +identifiers (a connector's tool prefix can be unique to the author's +instance), and — for anything that executes programs — architecture, +interpreter and dependency availability, runtime versions, filesystem +semantics, permissions, and network reach. `runtime-agnostic` may be +recorded only for pure instruction text with no executable dependency; +anything that runs programs names its dimensions instead. Each +machine-bound assumption keeps a verified portable form, or stays +behind a verified target-scoped dispatch — which satisfies a named +target only when that target ALSO keeps a working path for every +capability the file claims (a foreign-OS-only branch is not +compatibility) — or carries a label naming the exact runtime or +instance required, written IN the skill file beside the dependency +(§2's embed-the-knowledge; the review record points to it), verified +against that instance where reachable and marked `unverified` (§2) +where not: a label records a limitation, never proves compatibility. +Done when every target runtime named in the record is compatible with +every assumption reachable on it — a labeled incompatibility with a +named target blocks completion, and shrinking the supported scope can +only exclude an optional target with the requester's explicit say — or +when the recorded risk acceptance above stands in; and everything machine-bound carries its named label in the file. ✅ "target: sandboxed Linux VM plus the team's shared connector instance; the macOS-only notify helper replaced with the project's CLI