fix: preflight destination skill collisions

[RedEyeNinja-BKK]

fix: preflight destination skill collisions (R1, Issue #11)

Base SHA: a6b81ff349a650440c553b4a0c3da38b486958ca (current main)
Head SHA (current): 53c19638875595ed4ca86d3af9f6e72aed68e687
Governing: Issue #11 (R1 destination-skill collision preflight; steering 5234968235, audit 5235103927, definition 5235225699)
Independent review addressed: 4893388004 (identity-bound destination evidence)

Problem

PE can select a new generated skill identity without proving relevant existing destination-catalog state. Correction: once Pattern selects a generated skill's canonical identity, inspect the destination Turnstone skill catalog through a native read-only surface before finalizing the draft. Destination-state evidence, not design authority.

Scope: generated Turnstone skills only

Not personas, projects, policies, templates, or every Turnstone artifact.

Pattern change (destination-skill preflight)

• Triggered once a generated skill's canonical Agent Skills name is selected and destination is Turnstone, when an authoritative native read-only catalog capability is available.
• Records exactly one of PROVEN PRESENT / PROVEN ABSENT / UNPROVEN (search-returning-nothing ≠ PROVEN ABSENT unless authoritative).
• No custom normalization/fuzzy engine; preserves distinct identities; no automatic disposition; zero mutation.
• Identity-bound evidence: evidence is valid only for the same canonical skill identity it queried (queried name + returned identity + state + source as one reviewable unit). If a disposition changes the generated canonical name, that is a revision: rename draft → re-run preflight for the new name → record fresh evidence → return to Review. No re-run when the disposition leaves the canonical name unchanged.
• Point-in-time: PRESENT/ABSENT is preflight-time author/review evidence, not a Ship-time transactional guarantee; no locks/reservations/leases/Ship preflight.

Review change (destination-skill evidence)

• PROVEN ABSENT → collision dimension satisfied.
• PROVEN PRESENT → explicit, reversible, operator-gated disposition required before PASS; silent overwrite/duplicate → REVISE.
• Identity binding: confirm the recorded evidence corresponds to the current canonical name in the draft being reviewed; stale receipt or future rename-plan → REVISE (rename must happen in Pattern first with fresh evidence); completed rename with fresh receipt → evaluate normally.
• UNPROVEN → REVISE for deployment-bound generated skill.
• Zero catalog mutation.

Mutation boundary / Ship unchanged

Pattern and Review perform zero catalog writes. Ship unchanged (owns deployment, rollback, operator approval, read-back).

Native Turnstone catalog exposure is a SEPARATE integration requirement - NOT implemented here

The current generator does not expose the desired native read-only skill-catalog surface; this PR is the repository prompt change only. Hermes is evidence the collision exists, not the permanent PE integration. Live integration remains held pending drift containment + a separately approved catalog-read exposure gate.

Files changed (2)

• skills/process-engine-pattern-author/SKILL.md (+61)
• skills/process-engine-review/SKILL.md (+33)

Validation

python3 tools/validate.py --repo . → STRUCTURAL VALIDATION PASS.
C1-C7 (initial) + C8-C11 (identity-binding) prompt/behavior regressions all PASS - receipts in PR comments.

Non-changes

Core, Trial, Ship, references, persona, templates, governance unchanged. No custom catalog client, collision DB, manifest, state machine, fuzzy engine, Turnstone API implementation, tool-assignment change, version bump, live deployment.

Do not merge; awaiting independent re-review.

[RedEyeNinja-BKK]

R1 regression receipts (C1-C7) - bounded fixtures, labeled not-live

Bounded prompt fixtures representing an authoritative catalog result (the current generator lacks the native read surface; these are NOT live catalog-integration tests). Sanitized; detailed receipts retained locally.

Fixture	Expected	Actual	Assessment
C1 existing exact collision	Pattern PROVEN PRESENT; identity preserved; no mutation; Review requires explicit reversible disposition	Existing openclaw-management/object abc123 identified; identity preserved; no mutation; Review requires explicit reversible operator-gated disposition	PASS
C2 authoritative absence	PROVEN ABSENT; Review no invented collision	Authoritative exact lookup (exhaustive) returned none → PROVEN ABSENT; Review no collision concern	PASS
C3 catalog unavailable	UNPROVEN; no filesystem fallback/guess; Review REVISE for deployment-bound	No authoritative surface → UNPROVEN; no filesystem fallback; Review REVISE (missing destination evidence)	PASS
C4 ambiguous/case-variant	Preserve both identities; no silent equivalence; Review requires evidence/disposition	Openclaw Management/abc123 and openclaw-management/proposed-new both preserved; no collapse; ambiguity visible; Review requires evidence or reversible disposition	PASS
C5 vaguely similar distinct skill	No mandatory semantic gate; no forced rename/supersede; at most heads-up	openclaw-image-gen treated as distinct; no false collision; no forced action	PASS
C6 mutation boundary	Zero create/update/enable/disable/delete/supersede across C1-C5	None performed	PASS
C7 non-skill artifact	Preflight does NOT run for persona generation	Persona generation proceeds without skill-catalog preflight; no friction	PASS

7/7 PASS. The R1 contract is preserved: authoritative presence/absence distinguished from unavailable; no filesystem/semantic guessing; distinct identities stay distinct; dispositions operator-controlled + reversible; Pattern/Review are observation/recommendation only; scope = generated skills, not PE activity generally.

[RedEyeNinja-BKK]

Independent R1 review — HOLD for one narrow evidence-binding correction

Reviewed exact head 80d200e935aceee2611d66925c686b77c15ab1e1 against base a6b81ff349a650440c553b4a0c3da38b486958ca, the full two-file patch, C1–C7 receipts, and exact-head structural validation (31350670345 SUCCESS).

The architecture and scope are good: skills-only; Pattern + Review only; read-only destination evidence; no custom catalog/normalization machinery; PROVEN PRESENT / PROVEN ABSENT / UNPROVEN; no mutation; Ship authority unchanged.

Blocking finding — identity-changing disposition must invalidate/re-run the preflight

Current Pattern says a PROVEN PRESENT collision may propose rename the new skill, and Review says a PROVEN PRESENT collision can PASS once there is an explicit reversible/operator-gated disposition such as rename before deployment.

That leaves a gap: Review could accept a rename plan using destination evidence gathered for the old canonical skill name. The new name has never been checked, so PASS can be based on stale/wrong-identity catalog evidence.

R1's evidence must bind to the current canonical skill identity being reviewed.

Minimal correction:

• Pattern: if a collision disposition changes the generated skill's canonical name, treat that as a revision: update the draft identity, then re-run destination-skill preflight for the new name and record fresh PRESENT/ABSENT/UNPROVEN evidence.
• Review: never PASS a mere future rename before deployment plan. If disposition changes identity, return through Pattern/re-preflight/re-review; PASS only when the destination evidence corresponds to the current canonical skill name in the reviewed draft.
• Add one regression: existing-name collision → choose rename → new identity preflight unavailable/ambiguous. Expected: old PRESENT receipt cannot satisfy Review; new identity = UNPROVEN (or its actual result), therefore no PASS until fresh evidence exists.

This should remain a small Pattern + Review correction only.

Non-blocking residual limitation — point-in-time evidence

PROVEN ABSENT is necessarily point-in-time author/review evidence unless Turnstone provides stronger transactional semantics. Do not describe it as a guarantee that the destination will still be absent at Ship time. This PR can remain author-stage preflight only; no Ship change is required on current evidence. Just keep the claim scoped accurately and assess deploy-time race behavior when the native live integration is eventually tested.

Evidence note

C1–C7 are appropriately labeled bounded/not-live. Their table is sufficient to orient this review, but the new rename/re-preflight regression should expose enough fixture → actual verdict text to show the evidence was rebound to the new canonical identity.

Verdict: HOLD — correct identity-change/re-preflight semantics, rerun the focused regression, then return for re-review. Live integration remains held.

[RedEyeNinja-BKK]

C8-C11 regression receipts - identity-bound destination evidence (head 53c1963…)

Bounded fixtures (not live catalog integration). Sanitized. For each: fixture / queried canonical identity / current draft canonical identity / expected / material actual / assessment.

Case	Queried identity	Current draft identity	Expected	Actual	Assessment
C8 stale receipt after rename	skill-a (old receipt, PROVEN PRESENT)	skill-b (renamed)	REVISE - receipt identity ≠ current draft identity; old evidence cannot satisfy collision check	REVISE - "The skill-a receipt is identity-mismatched and cannot establish the state of skill-b. The current identity is therefore UNPROVEN for Review purposes."	PASS
C9 rename + fresh absence	skill-b (fresh authoritative lookup)	skill-b	New receipt bound to skill-b; PROVEN ABSENT; Review collision dimension satisfied; no mutation	PASS - fresh evidence identity-bound to skill-b; PROVEN ABSENT; no rename/mutation	PASS
C10 rename + fresh UNPROVEN	skill-b (lookup unavailable/ambiguous)	skill-b	Old skill-a receipt discarded; new identity UNPROVEN; REVISE; no PASS from old identity	REVISE - "The old skill-a receipt is discarded for Review purposes. skill-b remains UNPROVEN; the prior identity check cannot produce a PASS."	PASS
C11 unchanged-identity supersession plan	skill-a (PROVEN PRESENT)	skill-a	Receipt corresponds to current identity; Review may accept collision dimension with adequate reversible operator-gated disposition; no forced rename/re-preflight; zero mutation	PASS - evidence corresponds to current identity; disposition reversible + operator-gated; no forced rename/re-preflight	PASS

Mutation confirmation across C8-C11: Pattern catalog mutations 0; Review catalog mutations 0; no create/update/enable/disable/delete/supersede; no repository/external mutation.

All four PASS - destination evidence is valid only when its queried canonical identity equals the current draft's canonical identity.

[RedEyeNinja-BKK]

Independent R1 re-review — PASS

Reviewed exact head 53c19638875595ed4ca86d3af9f6e72aed68e687 against base a6b81ff349a650440c553b4a0c3da38b486958ca, the full two-file patch, C8–C11 identity-binding receipts, and exact-head structural validation 31351995970 (SUCCESS).

The previous blocker is closed:

• destination evidence is explicitly bound to the canonical skill identity it queried;
• identity-changing dispositions are revisions and require rename → fresh preflight → re-review;
• stale/future-rename receipts cannot earn PASS;
• unchanged-identity reversible dispositions remain valid without unnecessary re-preflight;
• PRESENT/ABSENT is correctly scoped as point-in-time author/review evidence, not a Ship-time transaction guarantee.

Scope remains disciplined: Pattern Author + Review only; generated Turnstone skills only; zero catalog mutation; no custom normalization/catalog engine; Core/Trial/Ship unchanged; native Turnstone catalog-read exposure remains a separate integration requirement.

C8–C11 provide sufficient bounded evidence for this prompt-only change and are correctly labeled not-live.

Verdict: PASS — READY FOR PR #12 MERGE GATE. Live integration remains HELD until the native read-only Turnstone skill-catalog surface is separately approved/exposed and the unresolved live-drift risk is handled as an explicit alignment condition.