Adopt 7 upstream-delta rules across 5 skills (2026-07-24 mining pass)

README.md

@@ -506,7 +506,14 @@ This pack distills and adapts ideas from:
   adapted from Miguok/fable-harness), and ~10 judgment rules were absorbed
   into operational-rigor / delegation-and-review / skill-authoring. Reviewed
   in full; its always-loaded/nudge/template layer was deliberately not
-  adopted — same reasoning as dropped-item 5.
+  adopted — same reasoning as dropped-item 5. A 2026-07-24 delta pass over
+  its post-`8dea062` commits adopted three further ideas: the explicit-model
+  + labeled-dispatch rule and the ceiling-inversion ladder (`delegation-
+  and-review` §1/§4, the latter from their 「Fable 起手」mechanism), and the
+  forged-tool-output defense (`operational-rigor` §4, from their hard-rule
+  #15 and its two logged incidents); the same pass ported their upstream's
+  (Miguok) fail-open-telemetry fix idea into our `verify-before-stop` hook
+  (landed separately as PR #74).
 - **echo-of-machines** —
   [`echo-of-machines/fable-advisor`](https://github.com/echo-of-machines/fable-advisor);
   the advice-mode consult (a stronger tier recommends, the current tier keeps
@@ -527,7 +534,8 @@ This pack distills and adapts ideas from:
 - **2026-07 security-skill audit** — a 12-source sweep of community
   "security" skills preceding the 2026-07-12 doctrine batch. Idea-level
   adoptions only, no code: **eddygk/skill-vetting** (anti-override rule →
-  `delegation-and-review` §7), **UnitOneAI/SecuritySkills** (load-time
+  `delegation-and-review` §7; original GitHub repository URL unavailable
+  as of 2026-07-24 — attribution retained as eddygk/skill-vetting, GitHub), **UnitOneAI/SecuritySkills** (load-time
   execution audit → `operational-rigor` §2),
   **mukul975/Anthropic-Cybersecurity-Skills** (JWT `kid`/`jku`/`x5u` item,
   zero-width/bidi sweep), **gitgoodordietrying** (SCA-in-CI),
@@ -563,7 +571,11 @@ This pack distills and adapts ideas from:
 - **Matt Pocock's Grill-me pattern; Superpowers (obra); OpenSpec** — the
   grill/decision-note layer of public spec-isolation and brainstorming
   workflows, adapted as `operational-rigor`'s §1 grill pass and §5
-  decisions-note. Ideas only; no code taken.
+  decisions-note. Ideas only; no code taken. A 2026-07-24 delta pass over
+  Superpowers v6.2.0 adopted three more ideas (MIT, ideas only): the
+  compression-pressure-probe discipline and the verbatim-move map for
+  probe-tuned prose (`skill-authoring` §7), and the change-detector /
+  decision-vs-bug clause (`ground-truth-gates` rule 2).
 - **Design-pack sources (2026-07-19 survey of 14 design repos)** — text
   adapted under MIT with notices (see `THIRD-PARTY-NOTICES.md`):
   **Emil Kowalski** ([`emilkowalski/skills`](https://github.com/emilkowalski/skills)),
@@ -588,7 +600,10 @@ This pack distills and adapts ideas from:
   patterns, noted for future eval work). Every embedded agent-directed
   marketing directive in mined sources was stripped per skill-authoring §6.
 - **fable-agent-orchestration** @ `935e4a3` (git.wearein.space/elias, Apache-2.0)
-- **agent-standard-oss** @ `3786c4c` (github.com/anmoln7, MIT)
+- **agent-standard-oss** @ `3786c4c` (github.com/anmoln7, MIT); a
+  2026-07-24 delta pass over its post-anchor commits adopted the capability
+  triangle (`security-architect`) and co-sourced the quota/effort dispatch
+  rule (`delegation-and-review` §1).
 - `security-architect` and `product-roadmap` were built from reference drafts
   supplied directly by the pack's owner.
 

README.zh-Hant.md

@@ -338,16 +338,16 @@ hooks(不得有 `hooks/hooks.json`、`plugin.json` 不得有 hooks 欄位)——
 - **firaen22**(公開身分前以「朋友 A」記名)— 私人 Discord 筆記(checks/-harness 設計筆記,及一份實測 harness 匯出),由維護者取得並改作為 `ground-truth-gates`、`operational-rigor`、`delegation-and-review` 與 `skill-authoring`;來源原文不隨發佈散佈。後續透過 GitHub PR 貢獻 cost-asymmetric golden runner 與第一版結構化 commit-hook parser。
 - **pro_ai.news** — Threads 貼文;五步驟目標教練 protocol,改作為 `personal-goal-planning`:
   <https://www.threads.com/@pro_ai.news/post/DadQkGHjxq->
-- **Curtis Chou** — [`curtischoutw/claude-institution`](https://github.com/curtischoutw/claude-institution) @ `8dea062`,MIT License,Copyright (c) 2026 Curtis Chou。`verify-before-stop` hook 改作自其 `verify_gate.py`(該檔又改作自 Miguok/fable-harness),另有約 10 條判斷規則吸收進 operational-rigor / delegation-and-review / skill-authoring。已通讀審查;其常載/每回合提醒/罐頭模板層刻意不採——理由同捨棄清單第 5 項。
+- **Curtis Chou** — [`curtischoutw/claude-institution`](https://github.com/curtischoutw/claude-institution) @ `8dea062`,MIT License,Copyright (c) 2026 Curtis Chou。`verify-before-stop` hook 改作自其 `verify_gate.py`(該檔又改作自 Miguok/fable-harness),另有約 10 條判斷規則吸收進 operational-rigor / delegation-and-review / skill-authoring。已通讀審查;其常載/每回合提醒/罐頭模板層刻意不採——理由同捨棄清單第 5 項。2026-07-24 對其 `8dea062` 之後的 commits 做了一輪 delta 掃描,再採三個意念:顯式指定模型+派工標示規則與「頂級模型起手」倒轉階梯(`delegation-and-review` §1/§4,後者改作自其「Fable 起手」機制)、偽造工具輸出防禦(`operational-rigor` §4,源自其 hard-rule #15 與兩筆事故記錄);同輪並把其上游(Miguok)的 fail-open 遙測修法意念移植進我們的 `verify-before-stop` hook(另以 PR #74 落地)。
 - **echo-of-machines** — [`echo-of-machines/fable-advisor`](https://github.com/echo-of-machines/fable-advisor);顧問模式諮詢(更強一階出建議、目前一階續執行),以 tier-relative 形式改作進 `delegation-and-review` §4;與 Anthropic 官方 [advisor tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool) 同一模式。只採意念,未取任何程式碼。
 - **TheColliny** — [`TheColliny/FableClaudeMDForOpus`](https://github.com/TheColliny/FableClaudeMDForOpus);事件措辭路由,改作為 `skill-authoring` §5 的狀態措辭觸發規則。只採意念,未取任何程式碼。
 - **hamanpaul** — [`hamanpaul/testpilot-core`](https://github.com/hamanpaul/testpilot-core);其 tier-2 環境復原設計——升級計數由 orchestrator 自己的 verify gate 驅動,而非 worker 的自報;且「介入」標記與「gate 通過」分開——改作進 `delegation-and-review` §4。MIT,只採意念,未取任何程式碼。
-- **2026-07 安全 skill 稽查** — 對 12 個社群「安全」skill 的通盤審查,先於 2026-07-12 的 doctrine 批次。只採意念、未取任何程式碼:**eddygk/skill-vetting**(anti-override 規則 → `delegation-and-review` §7)、**UnitOneAI/SecuritySkills**(載入時執行稽核 → `operational-rigor` §2)、**mukul975/Anthropic-Cybersecurity-Skills**(JWT `kid`/`jku`/`x5u` 檢查項、零寬/雙向 Unicode 清查)、**gitgoodordietrying**(SCA 進 CI)、**jgarrison929**(magic-byte 上傳驗證)。同次稽查判定 12 個中 3 個為活體木馬——全部自稱安全工具;未從中採用任何內容,此發現本身成為 doctrine(`operational-rigor` §2:自稱安全工具受更嚴檢視,而非更寬)。
+- **2026-07 安全 skill 稽查** — 對 12 個社群「安全」skill 的通盤審查,先於 2026-07-12 的 doctrine 批次。只採意念、未取任何程式碼:**eddygk/skill-vetting**(anti-override 規則 → `delegation-and-review` §7;其 GitHub repo 網址 2026-07-24 起不可用——致謝以 eddygk/skill-vetting(GitHub)保留)、**UnitOneAI/SecuritySkills**(載入時執行稽核 → `operational-rigor` §2)、**mukul975/Anthropic-Cybersecurity-Skills**(JWT `kid`/`jku`/`x5u` 檢查項、零寬/雙向 Unicode 清查)、**gitgoodordietrying**(SCA 進 CI)、**jgarrison929**(magic-byte 上傳驗證)。同次稽查判定 12 個中 3 個為活體木馬——全部自稱安全工具;未從中採用任何內容,此發現本身成為 doctrine(`operational-rigor` §2:自稱安全工具受更嚴檢視,而非更寬)。
 - **Sahir619** — [`Sahir619/fable-method`](https://github.com/Sahir619/fable-method),MIT License;另一個平行的 Fable 退役蒸餾,附已發布的 trap-scenario eval 計畫(勝敗皆錄)。只採意念、未取任何檔案:`ground-truth-gates` 的行為層 trap-armed 條款(源自其已發布的負結果——安全結局可能只是從未遇上陷阱)、Evals 段的「附失敗測試才出貨」公約,其已公開 eval 計畫的 trap 機制——重新實作為本包私有套件的全新 fixtures,以及跨 `operational-rigor`、`delegation-and-review`、`skill-authoring` 三個 skill 的 authority-order、twin-sweep、ask-classification、prescribed-follow-up、completion-claim-audit 規則,加上 enforcement ladder、指針警示與 red-line 授權門檻(該批次的行為規則出貨前已在該批 fixtures 上 probe 驗證;其設計/規範性規則在本體標記 `unprobed`)。v1.4.0 增量與其後續批次——AUTH 逐字引述 artifact、owed-lines artifact gate、installed-skill 非授權向量、gate-placement 規則、`domain-evidence-discipline` skill(其 domain-adapter schema 濃縮為單一四名詞 pattern)與 declared-scope、orient-first、debris 三規則——全部在本體明標 `unprobed` 出貨(依 covenant),其已發布結果只述形狀(若轉述數字,必附對方自標的 smoke-grade 等級)。
-- **Matt Pocock 的 Grill-me 模式;Superpowers(obra);OpenSpec** — 公開 spec-isolation/brainstorming 工作流的 grill/決策筆記層,改作為 `operational-rigor` 的 §1 grill pass 與 §5 decisions-note。只採意念、未取程式碼。
+- **Matt Pocock 的 Grill-me 模式;Superpowers(obra);OpenSpec** — 公開 spec-isolation/brainstorming 工作流的 grill/決策筆記層,改作為 `operational-rigor` 的 §1 grill pass 與 §5 decisions-note。只採意念、未取程式碼。2026-07-24 對 Superpowers v6.2.0 做 delta 掃描,再採三個意念(MIT,只採意念):壓縮切割的壓力測試紀律與 probe-tuned 文字的逐字搬移表(`skill-authoring` §7)、change-detector/「bug 還是決策」條款(`ground-truth-gates` 規則 2)。
 - **設計包來源(2026-07-19 對 14 個設計 repo 的調查)** — 以 MIT 改作文字並附 notices(見 `THIRD-PARTY-NOTICES.md`):**Emil Kowalski**([`emilkowalski/skills`](https://github.com/emilkowalski/skills))、**Leonxlnx**([`Leonxlnx/taste-skill`](https://github.com/leonxlnx/taste-skill))、**LottieFiles**([`LottieFiles/motion-design-skill`](https://github.com/LottieFiles/motion-design-skill))、**Refero Design**([`referodesign/refero_skill`](https://github.com/referodesign/refero_skill))。**nexu-io/open-design**(Apache-2.0):意念——accent 預算、規則升級為 linter 的架構——外加兩處具名的 Apache-2.0 改作(五狀態表;誤引修正項),notice 見 `THIRD-PARTY-NOTICES.md`。只採意念、未取文字:**garrytan/gstack**(MIT;量測配對、表面分類器、修復迴圈形狀、anti-convergence 測試、偏好投毒防禦——其自承未量測的數值啟發式刻意不採)、**benjitaylor/agentation**(PolyForm Shield,source-available——依政策也依必要僅採意念:pitfall 表格式、critic/fixer 迴圈)、**tt-a1i/archify**(MIT;規則配 validator)、**creativetimofficial/ui**(MIT;微字級白名單技法)、**VoltAgent/awesome-design-md**(MIT;僅作研究語料指路,未 vendor)。調查後刻意不採:greensock/gsap-skills(函式庫用法教條、內嵌推銷導向)、ui-ux-pro-max(廣度分類學)、facebook/astryx(agent-infra 模式,記為未來 eval 參考)。被挖掘來源中所有內嵌的 agent 導向行銷指令依 skill-authoring §6 一律剝除。
 - **fable-agent-orchestration** @ `935e4a3`(git.wearein.space/elias,Apache-2.0)
-- **agent-standard-oss** @ `3786c4c`(github.com/anmoln7,MIT)
+- **agent-standard-oss** @ `3786c4c`(github.com/anmoln7,MIT);2026-07-24 對其 anchor 之後的 commits 做 delta 掃描,採納 capability triangle(`security-architect`)並共同溯源 quota/effort 派工規則(`delegation-and-review` §1)。
 - `security-architect` 與 `product-roadmap` 依本包擁有者直接提供的參考稿建構。
 
 所有被採用的來源皆已通讀檢查;未執行任何內嵌指令,2026-07 稽查判為惡意的來源亦未被採用任何內容。萃取只採意念。每個連結都附作者+平台,連結失效後 attribution 仍可考。

skills/delegation-and-review/SKILL.md

@@ -91,6 +91,26 @@ treat every returned result as a claim until verified.
   output → high-taste model; reviews and hard debugging → strongest available.
   Tie-break intelligence > taste > cost. Model lineups are volatile facts: read
   the environment at session time, not memory.
+- **A dispatch names its model; consumption signals weigh in only where
+  observable** (`unprobed` — two-source synthesis; see Provenance). Where
+  the harness exposes a per-dispatch model choice, choose it explicitly and
+  name agent type + model in the dispatch's visible description (where one
+  exists) — first read the current harness's unset-field semantics: where
+  blank means inherit, bulk work silently runs on the orchestrator's own
+  often-most-expensive model, and an unlabeled dispatch is unauditable (in
+  one source's harness, a scan agent silently billed the ceiling model
+  exactly this way). For cost, prefer the lowest-cost configuration —
+  model × effort tier — DEMONSTRATED CAPABLE for the role; a known-
+  incapable route is false economy (it burns the tokens anyway, failing),
+  and dialing a capable model's effort down is one such configuration, not
+  a universally preferred move. Where a quota/pressure signal is
+  OBSERVABLE (a provider's quota error naming a reset time, a dashboard
+  the user relays), treat it as a routing input; never estimate or
+  fabricate an unobservable quota. No dial and no signal → this rule is a
+  no-op, never a guess.
+  ✅ "scan repo (Explore + cheapest capable model)" in the visible description.
+  ❌ model field left blank "to keep the call short" — the orchestrator's
+  flagship quietly does grunt work.
 - **A pinned model string does not pin behavior** (`unprobed` — private
   incidents as shape; see Provenance). A routing or safety decision is
   about to rely on a previously measured behavioral property of a
@@ -570,6 +590,24 @@ reviewers that they silently absorb as implementers.
 5. Pattern solved → downgrade batch application to cheaper model with example;
    spot-check random ~20% (minimum 2) plus flagged items. One miss → verify all.
 
+- **At the ceiling, the ladder inverts** (`unprobed` — adapted external
+  design; see Provenance). The advice-mode rung above assumes a tier exists
+  above the executor. When the ORCHESTRATOR is observably the ceiling
+  model, the stronger-tier rung is unavailable (a model cannot serve as
+  its own stronger arbiter) — item 3's same-tier fresh-context retry
+  remains valid and unchanged — and
+  the ladder runs downward only — DELEGATEABLE BULK goes to cheaper tiers
+  as the first move rather than being executed at the ceiling, blank model
+  inheritance is at its most expensive (every subagent silently runs the
+  ceiling model — the §1 dispatch rule), and where a consumption/usage
+  signal is observable it is reported at phase ends so the user can call a
+  downgrade (no signal → no-op). The inversion does NOT override §1's
+  do-it-yourself triggers — a delta smaller than the prompt, a decision
+  needing full local context, a twice-failed agent finished manually — and
+  with no viable delegate (a solo session, a task not safely separable)
+  the ceiling model executes rather than deadlocking or performing
+  dispatch theater: the inversion governs the default for delegateable
+  bulk, not an absolute.
 - High-stakes open decisions: spawn 2–3 agents with different mandates and
   adjudicate only disagreement.
 - Blocked workers (sandbox, permission, write refusal) escalate, never bypass.
@@ -877,6 +915,19 @@ cross-checked against this pack's existing rules (this section's §3
 completion-claim audit; operational-rigor §2 two-failure and §5 completion
 honesty; ground-truth-gates rule 4), not probed on this pack's private
 fixtures.
+The §1 dispatch-naming rule and §4 ceiling-inversion rule (2026-07-24) come
+from a delta pass over two founding-era sources' post-anchor commits (both
+MIT, ideas only; see README acknowledgements): the dispatch rule is a
+two-source convergence — agent-standard-oss §8's quota-watching +
+reasoning-effort dial and curtischoutw/claude-institution's dispatch.md
+explicit-model + user-visible-labeling rules, whose changelog records the
+named incident (an Explore dispatch silently inheriting the commander's
+expensive model) — bounded here to observable signals only; the
+ceiling-inversion rule generalizes claude-institution's 「Fable 起手」
+mechanism (ladder inverts when the commander IS the ceiling model),
+model-agnostic with a bounded no-viable-delegate exception added at this
+pack's gate review. Both ship `unprobed` per the covenant; their probes
+join the private round-5 queue.
 Stable behavioral rules; re-check
 worktree/agent mechanics and any recorded hosted-endpoint behavioral
 claims against the current environment.

skills/ground-truth-gates/SKILL.md

@@ -131,7 +131,22 @@ A generic green test is not proof. A gate is real only if:
    broken arm fails, fixed arm passes — and prove a *negative* test can fail by
    running it against a known-bad arm. Instrument the failure's **own** signal,
    not a proxy: an unchanged field or intact-looking output can pass while the
-   failure still occurred. A suite that *grades* candidates is two-sided:
+   failure still occurred. **Arm polarity alone is insufficient — a change
+   detector can mimic it while guarding nothing** (`unprobed` — adapted
+   external design; see Provenance): a source-string presence check or a
+   private-structure snapshot fails on the old arm and passes on the new
+   one simply because the source changed — while firing on every future
+   redesign and sleeping through every future bug (it also fails this
+   rule's own-signal requirement above; the polarity just hides that).
+   Before writing the test body, answer: what production change should
+   make this test fail — and is that change a bug or a decision? If only
+   deliberate decisions can fail it, it is a change detector, not a gate —
+   asserting the source contains a line proves only that the source is the
+   source. Carve-out: pinning a representation is legitimate exactly where
+   that representation IS the declared contract (an error-message string
+   or output name with downstream consumers — operational-rigor §3's
+   output-text-is-an-interface); then a deliberate contract change
+   properly updates the test. A suite that *grades* candidates is two-sided:
    before it scores anything, show it PASSES on at least two structurally
    distinct valid solutions (a too-strict suite silently rejects valid
    alternatives — false collapse) **and** FAILS on a known-broken state (false
@@ -367,5 +382,12 @@ covenant's second branch; the executable probe — seed an
 invocation-shape mismatch against a two-sided-proven grader and observe
 whether reuse-time re-validation catches it before scoring — has not
 run; the in-body marker records that debt.
+Rule 2's decision-vs-bug clause (2026-07-24) adapts obra/superpowers
+v6.2.0's writing-good-tests rebuild (MIT, ideas only; see README
+acknowledgements): the string-presence trap ("the source is the source")
+and the change-detector trap — failure shapes the two-sided protocol alone
+cannot screen, since a source-echo test genuinely fails the old arm and
+passes the new one. Ships `unprobed` per the covenant; its probe joins the
+private round-5 queue.
 `template/` scripts are self-contained (Node + bash, zero deps) and were run
 green on 2026-07-06 with Node v23; re-verify with `bash template/run-all.sh`.