feat: harden fleet skill normalization workflow (E-00110)

[andrei-hasna]

Scope

• Todos task: E-00110 (d64671fb-1844-49a6-addd-020ee2b09ea2)
• Parent native plan: 8eadc06b-7276-4854-a6bc-b879866abf6f
• Parent goal: 32e0d30d-e05a-45ce-9034-dfc9afeefd1d
• Parent node: e7994834-cd3e-4416-80fc-9e82bb8b59e8
• Todos plan: a08dc545-512f-43ee-a553-6231a2131c50
• Initial worker goal: 1b706c44-e2b8-4b6e-acc8-3684921471e4 (completed provenance)
• Repair-cycle-1 goal: 2e1842e3-6b41-49bf-a8b4-07bccceae862 (completed provenance)
• Final repair-cycle-2 goal: 721ae018-1b08-4dd9-b29a-43aa524cccb3
• Repair run: b86f7aa9-ae2b-458b-93fe-c9aed332c2dc
• Predecessor: closed PR Add canonical task-to-PR lifecycle skill #36 / task c4256422-07de-4ac7-9b2a-e4af3be7fc9e
• Acceptance scope: skills-fleet-normalization-split-v1
• Risk tier: elevated
• Repair count: 2 (final allowed cycle; no third repair cycle exists)
• Previous rejected head: 3ef8d56474359d8dc8a61230872e9edf164badad
• Exact head: 3c7c8c6cc33bd1654db712a34df5ee111e0941d2

Changed files

• agent-skills/fleet-skill-normalization/SKILL.md
• agent-skills/README.md
• src/lib/fleet-skill-normalization-skill.test.ts

The cycle-2 repair itself changes only the tracked fleet skill and its dedicated test. README remains accurate and unchanged in this cycle.

Final-cycle reconciliation

Both exact repair-cycle-1 fail artifacts from account009 and account004 were admitted and replayed. Every child mutation now uses one fail-closed guarded operation whose admission and execution are one indivisible atomic transaction binding the exact lexical root entry and retained root identity, the exact selected-directory lexical entry and retained directory identity, and the exact allowlisted child state. A pre-check followed by mutation through a retained or displaced handle is forbidden; unavailable binding fails before mutation, and closure detection is explicitly insufficient.

The repeated selected-directory proof now covers both pre-existing and run-created directories before every child operation and at closure. Guarded absent-directory create and empty-directory rollback bind the root and selected lexical entries to returned or removed identities. Forward replacement/create, file identity and single-link checks, receipt creation, rollback compare-and-replace, and atomic compare-and-remove all execute inside the complete root-and-directory binding. Structural tests reject explicit displaced-root permission, displaced-existing-directory permission, and nearby pre-check wording that omits indivisible operation binding. All prior deterministic rendering, immutable provenance, exact allowlist/touched-ledger, returned-preimage, rollback receipt, secret-scan, and coordinator/worker separation guarantees remain intact.

The reviewer sandbox DNS gap was not treated as product scope. Live PR-head and provider-native CI are verified separately on the exact head.

Validation

• bun install --frozen-lockfile (no dependency or lockfile changes)
• bun test src/lib/fleet-skill-normalization-skill.test.ts — 15 pass, 151 assertions
• isolated bun test — 742 pass, 0 fail, 9,882 assertions
• bun run typecheck
• bun run build
• scripts/check_skill_corpus_drift.sh --base origin/main
• npm pack dry-run — 1,359 package-visible files
• bun run verify:release
• exact staged diff inspection and labeled repair-cycle-2 adversarial self-review — P0/P1/P2/P3 all zero
• non-printing staged, previous-rejected-head repair-range, and cumulative origin/main..HEAD gitleaks scans

Distribution and rollback

No live skill distribution, publish, release, Instructions edit, package/version/lockfile edit, generated-source edit, lifecycle-file edit, coordinator live-file edit, merge, or cleanup occurred. Before merge, rollback is closing this PR. After merge, revert exact commits 3c7c8c6cc33bd1654db712a34df5ee111e0941d2, 3ef8d56474359d8dc8a61230872e9edf164badad, and b21a7df26c58e11650584cef6cc53af4dcdd8d5c in reverse landing order if preserved individually. No live Codewith copy requires rollback because none was distributed. No third repair cycle exists.

[andrei-hasna]

Closed unmerged as blocked after the final allowed repair cycle (2/2). Exact head 3c7c8c6 has green CI, but elevated review did not produce two passes: one independent reviewer found that the structural validator accepts semantic permission variants for mutations through displaced root and selected-directory handles, violating frozen acceptance scope skills-fleet-normalization-split-v1. No third repair cycle will be started. Branch/worktree and review artifacts are preserved. Reopen only if the same frozen scope can be proven without a head change; otherwise use a separately scoped replacement task/PR with explicit semantic mutation coverage and fresh lineage.