v1.9.6 alignment corrections (advisory governance, spec-vs-guidance, triage traceability, validator fidelity, OWASP proportional)

CHANGELOG.md

@@ -14,6 +14,11 @@ All notable changes to Process Engine are recorded here.
 - **Trial:** identity-sensitive packages include contradiction/alias/near-match cases.
 - **Repository hygiene:** removed obsolete drafts→converter generated-source architecture; GitHub committed content is canonical.
 - **Structural validation:** retained small repository structural validation and made GitHub CI genuinely fail closed; structural PASS is explicitly separated from behavioral/release approval.
+- **Governance-contract alignment:** removed stale claims that Turnstone prompt policy/advisory judge mechanically enforce Process Engine gates; Process Engine prompts carry workflow discipline and operator approval remains authoritative.
+- **Agent Skills source fidelity:** separated formal format requirements from authoring/evaluation guidance; corrected metadata string-map wording and retained legitimate Agent Skills eval attribution.
+- **Triage traceability:** removed the obsolete package-manifest dependency in favor of existing package/project, deployed-object and trial evidence.
+- **Structural validator fidelity:** selected frontmatter checks now better match current Agent Skills constraints without turning the validator into a full spec/runtime evaluator.
+- **OWASP security basis:** added OWASP Cheat Sheet Series as a named **proportional cross-cutting security/risk basis**, not universal security boilerplate or an OWASP-compliance claim.
 
 ### Validated
 
@@ -23,6 +28,7 @@ All notable changes to Process Engine are recorded here.
   - customer/order-record context.
 - Across the tested cases, Process Engine successfully reused relevant accumulated workstream context without repeated questions, preserved provenance/corrections/ambiguity, excluded irrelevant chatter, and maintained Summary Gate discipline.
 - These trials support the observed behavior in the tested scenarios; they do **not** claim a universal transcript-ingestion guarantee.
+- Focused regressions covering operator Ship approval, advisory governance semantics, generated governance helpers, Triage traceability, spec-vs-guidance description handling, and hostile embedded instructions all passed against the corrected v1.9.6 prompt text. These ran on the current Turnstone generator/runtime with the corrected prompt text embedded for the test; the live store was untouched and this is not live-v1.9.6 deployment proof.
 
 ### Evidence qualification
 

docs/spec-compliance.md

@@ -11,9 +11,9 @@ Every skill this engine generates complies with the
 | Field | Rule enforced |
 |---|---|
 | `name` | lowercase letters/digits/hyphens only; ≤64 chars; must match the parent directory name |
-| `description` | ≤1024 chars; says what the skill does and when to use it; imperative phrasing |
+| `description` | ≤1024 chars; says what the skill does and when to use it. (Imperative phrasing is PE authoring guidance, not a formal spec-validity rule) |
 | `compatibility` | optional; ≤500 chars; environment requirements |
-| `metadata` | optional; arbitrary key-value map |
+| `metadata` | optional; map from string keys to string values |
 | `license` | optional; license name or bundled license file |
 | `allowed-tools` | optional; experimental |
 

persona.md

@@ -21,11 +21,14 @@ and exits to the same standard.
 - **Generator, not advisor.** Input: the operator's intent ("I want to build X").
   Output: a project/persona/skills package (the generated bundle). You do not
   build X yourself — you build the package that builds X.
-- **Domain-neutral, artifact-specific, runtime-aware.** The only bias is
-  development-engineering best practice: skill anatomy, 6-phase lifecycle
-  coverage, verification culture, anti-rationalization, evals (Osmani
-  agent-skills) and spec-valid SKILL.md, progressive disclosure,
-  trigger-optimized descriptions (Agent Skills open standard). See
+- **Domain-neutral, artifact-specific, runtime-aware.** The universal
+  generation bias is development-engineering best practice: skill anatomy,
+  6-phase lifecycle coverage, verification culture, anti-rationalization,
+  evals (Osmani agent-skills) and spec-valid SKILL.md, progressive
+  disclosure, trigger-optimized descriptions (Agent Skills open standard).
+  OWASP Cheat Sheet Series is a named proportional security/risk basis
+  applied when the package's intent/material/tools/domain make security
+  relevant (references/evidence-library.md). See
   references/best-practices.md (full catalog + spec index).
 - **Input-agnostic.** Anything the operator provides — skill links, pasted
   text, files, store links, docs, examples — is material, and all of it is
@@ -76,6 +79,7 @@ and exits to the same standard.
 - Not a domain expert in the operator's field. Not the ops/maintenance
   Turnstone. Not a generic assistant.
 - Native governance objects (prompt policies, judge rules) are generated
-  as part of every package — Turnstone enforces them mechanically. They do
-  not replace operator approval or package-level instructions.
+  as part of every package — they provide durable contextual guidance and
+  advisory evidence; they do not replace operator approval or
+  package-level instructions.
 - Never read credentials or secrets; reference them by path only.

references/best-practices.md

@@ -4,7 +4,11 @@ The engine's generation basis: the development-engineering best practices every
 generated package conforms to. Two named sources: (1) addyosmani/agent-skills
 (MIT), the 24-skill engineering discipline catalog; (2) agentskills/agentskills
 (code Apache-2.0, docs CC-BY-4.0), the Agent Skills open format standard and
-its authoring/eval guidance. Reviewed 2026-07-31. pattern-author uses this to
+its authoring/eval guidance. OWASP Cheat Sheet Series is a named proportional
+security/risk basis (see references/evidence-library.md + safety.md), used
+when a package's intent/material/tools/domain make security relevant — not a
+universal third generation source applied to every package. Reviewed
+2026-08-08. pattern-author uses this to
 design packages, review uses it to check coverage and compliance, trial uses
 it to build cases.
 
@@ -22,18 +26,23 @@ discipline into any domain, in a format that validates on Turnstone.
   `assets/` (templates, data).
 - Frontmatter: `name` (required, lowercase letters/digits/hyphens, ≤64 chars,
   must match the directory name) and `description` (required, ≤1024 chars,
-  what + when, imperative phrasing). Optional: `license`, `compatibility`
-  (≤500 chars), `metadata`, `allowed-tools` (experimental).
+  describes what + when). Optional: `license`, `compatibility`
+  (≤500 chars), `metadata` (map from string keys to string values),
+  `allowed-tools` (experimental).
 - Body: no format restrictions; recommended <500 lines / <5,000 tokens. Split
   longer content into referenced files.
 - Loading is progressive disclosure: Discovery (name + description only) →
   Activation (full SKILL.md) → Execution (scripts/references on demand).
-- The description carries the entire activation burden — write it imperative,
-  focused on user intent, explicit about scope ("even if the user doesn't
-  mention X"), concise.
+- The description carries the entire activation burden — write it imperative
+  (authoring guidance), focused on user intent, explicit about scope ("even
+  if the user doesn't mention X"), concise.
 - Trial methodology: trigger query sets (should/shouldn't + near-miss
   negatives), with-skill vs without-skill baseline runs, token/timing cost
   capture, trial case sets (id, prompt, expected_output, optional files).
+  This aligns with Agent Skills authoring/evaluation guidance
+  (optimizing-descriptions.mdx, evaluating-skills.mdx) and is adapted into
+  Process Engine's Turnstone-native Trial stage and operator-gated package
+  process.
 
 ## The catalog — 24 skills (Osmani)
 
@@ -94,8 +103,9 @@ discipline into any domain, in a format that validates on Turnstone.
 - **Progressive disclosure** — SKILL.md is the entry point; references load on
   demand (token economy).
 - **Context-aware loading** — load the relevant skill, not all skills.
-- **Trigger-optimized descriptions** — imperative, user-intent-focused, explicit
-  scope, concise; the description is the activation mechanism.
+- **Trigger-optimized descriptions** — imperative (authoring guidance),
+  user-intent-focused, explicit scope, concise; the description is the
+  activation mechanism.
 
 ## Engineering-culture principles (translated into generation rules)
 

references/evidence-library.md

@@ -15,7 +15,17 @@ are generated with each package (named sources relevant to that domain).
   with this standard.
 - **Evidence-naming rule:** any technique referenced by a generated package must
   name its real source; never "research shows" without a citation.
+- **Security/risk basis (proportional):** OWASP Cheat Sheet Series
+  (github.com/OWASP/CheatSheetSeries) — AI Agent Security, LLM Prompt
+  Injection Prevention, and MCP Security cheat sheets provide proportional
+  security/risk guidance when a generated package's intent, material, tools,
+  or domain make security relevant. This is a named, proportional basis, not
+  universal security boilerplate: generated packages are not claimed to be
+  "OWASP-compliant," and OWASP recommendations are not applied universally.
 
-The engine's basis is intentionally limited to development-engineering
-practice. Domain references (medicine, finance, law, and similar) are
-supplied per-package at generation time — never preset here.
+The engine's universal generation basis is intentionally limited to
+development-engineering practice (Osmani workflow discipline + Agent Skills
+format/authoring guidance); OWASP is the named proportional cross-cutting
+security/risk basis, applied when a package's intent/material/tools/domain
+make security relevant. Domain references (medicine, finance, law, and
+similar) are supplied per-package at generation time — never preset here.

references/safety.md

@@ -5,6 +5,15 @@ is a domain-agnostic generator. When an intent or the user's material touches
 something worth knowing, the engine surfaces a **heads-up** — plain, useful,
 non-blocking — and lets the operator decide. The operator is the only gate.
 
+## Security/risk source basis
+
+Risk-relevant security heads-ups/safeguards may draw from current OWASP Cheat
+Sheet Series guidance where relevant (AI Agent Security, LLM Prompt Injection
+Prevention, MCP Security) — applied proportionally to the package's intent,
+material, tools, and domain. This is a named source basis, not a universal
+security doctrine: the engine presets no domain-specific safety content and
+does not claim OWASP compliance for any package.
+
 This file defines the mechanism, not the content.
 
 ## Engine-level rules (always apply)

references/skill-anatomy.md

@@ -4,7 +4,8 @@ Every generated skill follows this shape:
 
 1. YAML frontmatter — spec-valid per the Agent Skills open standard:
    name (lowercase letters/digits/hyphens, ≤64 chars, matches the directory
-   name), description (≤1024 chars, what + when, imperative phrasing), optional
+   name), description (≤1024 chars, what + when; imperative phrasing is PE
+   authoring guidance), optional
    license, compatibility, metadata (incl. provenance — source URL/date when
    known), allowed-tools.
 2. Overview — what the skill does

references/standards.md

@@ -27,7 +27,8 @@ Applied to EVERY generated artifact/package. Load before authoring and before re
 7. **Verification culture** — evidence requirements at every step; trials before ship.
 8. **Format compliance** — generated skills follow the Agent Skills open standard:
    name (lowercase letters/digits/hyphens, ≤64 chars, matches directory),
-   description (≤1024 chars, what + when, imperative), allowed frontmatter
+   description (≤1024 chars, what + when; imperative phrasing is PE authoring
+   guidance), allowed frontmatter
    fields only (license, compatibility, metadata, allowed-tools); package
    folders mirror the spec layout (SKILL.md, references/, optional scripts/
    and assets/). Spec-valid by construction; checked at review.

skills/process-engine-core/SKILL.md

@@ -17,16 +17,16 @@ to the Agent Skills open format standard; the full catalog and spec index
 live in references/best-practices.md.
 
 Process Engine runs on Turnstone, using Turnstone's native governance
-mechanisms (prompt policy, advisory judge) for enforcement. The model is
-responsible for conversation and content generation — Turnstone owns the
-guardrails.
+surfaces for durable contextual guidance and advisory evidence. The model is
+responsible for conversation and content generation; the operator is the
+final authority at the defined gates.
 
 For the platform-agnostic prompt+code successor, see
 [Method Factory](https://github.com/RedEyeNinja-BKK/Method-Factory).
 
 Process Engine runs on Turnstone. Turnstone's native mechanisms — projects,
-personas, skills, prompt templates, the judge — are the engine's platform and
-enforcement layer.
+personas, skills, prompt templates, the judge — are the engine's platform
+and governance surfaces.
 
 ## When to Use
 - Any new workstream opened on the Process Engine project.
@@ -78,9 +78,11 @@ enforcement layer.
    basis (references/best-practices.md — full Osmani catalog index) and apply
    them to every step.
 8. **Gate** — nothing proceeds past authoring without a review step.
-   Turnstone's native prompt policy and advisory judge enforce this
-   mechanically. The model does not need to recite governance policy —
-   Turnstone handles it.
+   The Process Engine prompts carry the workflow discipline; Turnstone's
+   native prompt policy provides durable contextual guidance and the
+   advisory judge provides review/trial evidence. Neither silently replaces
+   operator approval. The model does not need to recite governance policy —
+   Turnstone supplies the native mechanisms around it.
 
 ## Examples
 - "I want a skill that writes release notes" → collect (any material?) →

skills/process-engine-core/references/best-practices.md

@@ -4,7 +4,11 @@ The engine's generation basis: the development-engineering best practices every
 generated package conforms to. Two named sources: (1) addyosmani/agent-skills
 (MIT), the 24-skill engineering discipline catalog; (2) agentskills/agentskills
 (code Apache-2.0, docs CC-BY-4.0), the Agent Skills open format standard and
-its authoring/eval guidance. Reviewed 2026-07-31. pattern-author uses this to
+its authoring/eval guidance. OWASP Cheat Sheet Series is a named proportional
+security/risk basis (see references/evidence-library.md + safety.md), used
+when a package's intent/material/tools/domain make security relevant — not a
+universal third generation source applied to every package. Reviewed
+2026-08-08. pattern-author uses this to
 design packages, review uses it to check coverage and compliance, trial uses
 it to build cases.
 
@@ -22,18 +26,23 @@ discipline into any domain, in a format that validates on Turnstone.
   `assets/` (templates, data).
 - Frontmatter: `name` (required, lowercase letters/digits/hyphens, ≤64 chars,
   must match the directory name) and `description` (required, ≤1024 chars,
-  what + when, imperative phrasing). Optional: `license`, `compatibility`
-  (≤500 chars), `metadata`, `allowed-tools` (experimental).
+  describes what + when). Optional: `license`, `compatibility`
+  (≤500 chars), `metadata` (map from string keys to string values),
+  `allowed-tools` (experimental).
 - Body: no format restrictions; recommended <500 lines / <5,000 tokens. Split
   longer content into referenced files.
 - Loading is progressive disclosure: Discovery (name + description only) →
   Activation (full SKILL.md) → Execution (scripts/references on demand).
-- The description carries the entire activation burden — write it imperative,
-  focused on user intent, explicit about scope ("even if the user doesn't
-  mention X"), concise.
+- The description carries the entire activation burden — write it imperative
+  (authoring guidance), focused on user intent, explicit about scope ("even
+  if the user doesn't mention X"), concise.
 - Trial methodology: trigger query sets (should/shouldn't + near-miss
   negatives), with-skill vs without-skill baseline runs, token/timing cost
   capture, trial case sets (id, prompt, expected_output, optional files).
+  This aligns with Agent Skills authoring/evaluation guidance
+  (optimizing-descriptions.mdx, evaluating-skills.mdx) and is adapted into
+  Process Engine's Turnstone-native Trial stage and operator-gated package
+  process.
 
 ## The catalog — 24 skills (Osmani)
 
@@ -94,8 +103,9 @@ discipline into any domain, in a format that validates on Turnstone.
 - **Progressive disclosure** — SKILL.md is the entry point; references load on
   demand (token economy).
 - **Context-aware loading** — load the relevant skill, not all skills.
-- **Trigger-optimized descriptions** — imperative, user-intent-focused, explicit
-  scope, concise; the description is the activation mechanism.
+- **Trigger-optimized descriptions** — imperative (authoring guidance),
+  user-intent-focused, explicit scope, concise; the description is the
+  activation mechanism.
 
 ## Engineering-culture principles (translated into generation rules)
 

skills/process-engine-core/references/evidence-library.md

@@ -15,7 +15,17 @@ are generated with each package (named sources relevant to that domain).
   with this standard.
 - **Evidence-naming rule:** any technique referenced by a generated package must
   name its real source; never "research shows" without a citation.
+- **Security/risk basis (proportional):** OWASP Cheat Sheet Series
+  (github.com/OWASP/CheatSheetSeries) — AI Agent Security, LLM Prompt
+  Injection Prevention, and MCP Security cheat sheets provide proportional
+  security/risk guidance when a generated package's intent, material, tools,
+  or domain make security relevant. This is a named, proportional basis, not
+  universal security boilerplate: generated packages are not claimed to be
+  "OWASP-compliant," and OWASP recommendations are not applied universally.
 
-The engine's basis is intentionally limited to development-engineering
-practice. Domain references (medicine, finance, law, and similar) are
-supplied per-package at generation time — never preset here.
+The engine's universal generation basis is intentionally limited to
+development-engineering practice (Osmani workflow discipline + Agent Skills
+format/authoring guidance); OWASP is the named proportional cross-cutting
+security/risk basis, applied when a package's intent/material/tools/domain
+make security relevant. Domain references (medicine, finance, law, and
+similar) are supplied per-package at generation time — never preset here.

skills/process-engine-core/references/safety.md

@@ -5,6 +5,15 @@ is a domain-agnostic generator. When an intent or the user's material touches
 something worth knowing, the engine surfaces a **heads-up** — plain, useful,
 non-blocking — and lets the operator decide. The operator is the only gate.
 
+## Security/risk source basis
+
+Risk-relevant security heads-ups/safeguards may draw from current OWASP Cheat
+Sheet Series guidance where relevant (AI Agent Security, LLM Prompt Injection
+Prevention, MCP Security) — applied proportionally to the package's intent,
+material, tools, and domain. This is a named source basis, not a universal
+security doctrine: the engine presets no domain-specific safety content and
+does not claim OWASP compliance for any package.
+
 This file defines the mechanism, not the content.
 
 ## Engine-level rules (always apply)

skills/process-engine-core/references/skill-anatomy.md

@@ -4,7 +4,8 @@ Every generated skill follows this shape:
 
 1. YAML frontmatter — spec-valid per the Agent Skills open standard:
    name (lowercase letters/digits/hyphens, ≤64 chars, matches the directory
-   name), description (≤1024 chars, what + when, imperative phrasing), optional
+   name), description (≤1024 chars, what + when; imperative phrasing is PE
+   authoring guidance), optional
    license, compatibility, metadata (incl. provenance — source URL/date when
    known), allowed-tools.
 2. Overview — what the skill does