fix: address two Codex P2 findings on PR #56

1. Pass temporal filters to semantic fact recall in the in-process
   reflective MCP server. phantom_memory_search was building a temporal
   RecallOptions for episodes when days_back was set, but recallFacts
   was being called with only { limit }. Reflective skills like mirror
   that ask for a 7-day window were leaking older facts into the result
   set. Fix is one word: pass the same opts object to recallFacts. The
   downstream semantic.recall already honors timeRange via a Qdrant
   range filter on valid_from.

2. Permit the x-phantom-source provenance marker in the SKILL.md
   frontmatter schema. The Zod schema was strict and detectSource() in
   src/skills/storage.ts read frontmatter['x-phantom-source'] without
   the field being declared, so any built-in skill that set the marker
   would have been rejected at parse time. Added the field to the
   schema as an optional enum of "built-in" | "agent" | "user", added
   the marker to all six built-in SKILL.md files (echo, mirror,
   overheard, ritual, show-my-tools, thread), and added tests for both
   the schema acceptance and the source classification.

Quality gates: bun test 1044 pass / 0 fail (+4 new tests), bun run
lint clean, bun run typecheck clean.

Author: mcheemaa

skills-builtin/echo/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: echo
+x-phantom-source: built-in
 description: Before answering a substantive question, quietly check whether the user has already resolved this question in the past.
 when_to_use: Use when the user asks a substantive question that might have been asked and resolved before. Substantive questions are things like "how should I do X", "what is the right way to Y", "which approach is better", "what did we decide about Z". Do NOT fire on greetings, small talk, status checks, or operational queries like "what time is it" or "are you online". Before deriving a new answer, run a memory similarity check. If a strong prior match exists, surface it inline and ask whether anything has changed.
 allowed-tools:

skills-builtin/mirror/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: mirror
+x-phantom-source: built-in
 description: Weekly self-audit playback. Surface patterns from the user's past week that they probably cannot see themselves.
 when_to_use: Use when the user says "mirror", "weekly review", "show me my week", "what did I actually do this week", "reflect on last week", "how did my week go", or any similar reflective request. Also fires automatically on a Friday evening schedule if the user has enabled the mirror ritual.
 allowed-tools:

skills-builtin/overheard/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: overheard
+x-phantom-source: built-in
 description: Find commitments the user made in the last two weeks and did not follow through on. A promises audit.
 when_to_use: Use when the user says "overheard", "what did I promise", "what am I behind on", "promises audit", "am I dropping balls", "what did I commit to", "what do I owe people", or any similar commitment-check phrase. Also runs automatically once per day at a user-configured time if enabled.
 allowed-tools:

skills-builtin/ritual/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: ritual
+x-phantom-source: built-in
 description: Discover recurring behaviors from memory and offer to formalize them as scheduled jobs.
 when_to_use: Use when the user says "ritual", "what are my patterns", "turn this into a routine", "make this recurring", "what do I do regularly", "what should I schedule", "automate this for me", or any similar pattern-formalization phrase. Also fires on a monthly cadence if enabled.
 allowed-tools:

skills-builtin/show-my-tools/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: show-my-tools
+x-phantom-source: built-in
 description: List the agent's current skills, memory files, and dashboard URLs. The user-facing discovery path for everything the operator can edit.
 when_to_use: Use when the user says "what can you do", "what skills do you have", "show me your skills", "what can I edit", "how do I customize you", "what memory files do you have", "what is in your .claude", "where is the dashboard", or any similar discovery question.
 allowed-tools:

skills-builtin/thread/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: thread
+x-phantom-source: built-in
 description: Show how the user's thinking on a specific topic has evolved over time. A chronological narrative with turning-point callouts.
 when_to_use: Use when the user says "thread <topic>", "how has my thinking on X evolved", "show me the arc on X", "what have I said about X", "take me through X from the start", "where am I with X", or when the user needs to re-ground in a long-running decision.
 allowed-tools:

src/agent/in-process-reflective-tools.ts

@@ -86,7 +86,9 @@ Each episode includes summary, detail, outcome, started_at, tools_used, and less
 					results.episodes = await memory.recallEpisodes(input.query, opts).catch(() => []);
 				}
 				if (input.memory_type === "semantic" || input.memory_type === "all") {
-					results.facts = await memory.recallFacts(input.query, { limit }).catch(() => []);
+					// Same opts so days_back also bounds semantic facts; otherwise a
+					// weekly mirror leaks 6-month-old preferences into the result.
+					results.facts = await memory.recallFacts(input.query, opts).catch(() => []);
 				}
 
 				const total = Object.values(results).reduce((sum, arr) => sum + arr.length, 0);

src/skills/__tests__/frontmatter.test.ts

@@ -63,6 +63,55 @@ describe("parseFrontmatter", () => {
 		const result = parseFrontmatter(raw);
 		expect(result.ok).toBe(false);
 	});
+
+	test("accepts x-phantom-source marker for built-in skills", () => {
+		const raw = `---
+name: mirror
+x-phantom-source: built-in
+description: weekly self-audit
+when_to_use: Use on Friday evening.
+---
+
+# Mirror
+body
+`;
+		const result = parseFrontmatter(raw);
+		expect(result.ok).toBe(true);
+		if (!result.ok) return;
+		expect(result.parsed.frontmatter["x-phantom-source"]).toBe("built-in");
+	});
+
+	test("accepts x-phantom-source marker for agent-authored skills", () => {
+		const raw = `---
+name: mirror
+x-phantom-source: agent
+description: weekly self-audit
+when_to_use: Use on Friday evening.
+---
+
+# Mirror
+body
+`;
+		const result = parseFrontmatter(raw);
+		expect(result.ok).toBe(true);
+		if (!result.ok) return;
+		expect(result.parsed.frontmatter["x-phantom-source"]).toBe("agent");
+	});
+
+	test("rejects invalid x-phantom-source values", () => {
+		const raw = `---
+name: mirror
+x-phantom-source: bogus
+description: weekly self-audit
+when_to_use: Use on Friday evening.
+---
+
+# Mirror
+body
+`;
+		const result = parseFrontmatter(raw);
+		expect(result.ok).toBe(false);
+	});
 });
 
 describe("serializeSkill", () => {

src/skills/__tests__/storage.test.ts

@@ -41,6 +41,19 @@ describe("listSkills", () => {
 		const result = listSkills();
 		expect(result.skills.length).toBe(1);
 		expect(result.skills[0].name).toBe("mirror");
+		expect(result.skills[0].source).toBe("user");
+	});
+
+	test("classifies a skill with x-phantom-source: built-in as built-in", () => {
+		const skillDir = join(tmp, "mirror");
+		mkdirSync(skillDir);
+		writeFileSync(
+			join(skillDir, "SKILL.md"),
+			"---\nname: mirror\nx-phantom-source: built-in\ndescription: weekly\nwhen_to_use: Use on Friday.\n---\n\n# Mirror\n",
+		);
+		const result = listSkills();
+		expect(result.skills.length).toBe(1);
+		expect(result.skills[0].source).toBe("built-in");
 	});
 
 	test("skips directories with bad names", () => {

src/skills/frontmatter.ts

@@ -32,6 +32,7 @@ export const SKILL_NAME_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
 export const MAX_BODY_BYTES = 50 * 1024; // 50 KB
 
 export const SkillContextSchema = z.enum(["inline", "fork"]);
+export const SkillSourceSchema = z.enum(["built-in", "agent", "user"]);
 
 export const SkillFrontmatterSchema = z
 	.object({
@@ -46,6 +47,11 @@ export const SkillFrontmatterSchema = z
 		arguments: z.array(z.string().min(1)).optional(),
 		context: SkillContextSchema.optional(),
 		"disable-model-invocation": z.boolean().optional(),
+		// Provenance marker. Omitted on user-authored skills (default treats
+		// missing as "user"). Built-in skills shipped under skills-builtin/ set
+		// this to "built-in" so the dashboard can group and badge them.
+		// detectSource() in src/skills/storage.ts reads this field.
+		"x-phantom-source": SkillSourceSchema.optional(),
 	})
 	.strict();