sage: rows 64/66 brief, skills reach both harnesses as prompt text (pi read is workspace-confined, Claude Code Skill tool offers its own skills; probe in agents/sage/work/queue-64/probe.md)

2026-10-19 13:58:02 -05:00
parent c9f6e214f1
commit 228aeb5037
2 changed files with 82 additions and 6 deletions
@@ -0,0 +1,56 @@
+# Row 64 probe: how a managed session gets its skills (2026-10-19)
+
+Sage, 18:50Z to 18:53Z. Claude Code 2.1.303 (`~/.local/bin/claude`), pi
+from the pinned `@earendil-works/pi-coding-agent`. Every Claude Code run
+was a short `-p` with `--model haiku`, in an empty workspace, with
+`--restricted --strict-mcp-config --mcp-config '{"mcpServers":{}}'
+--permission-mode dontAsk --debug-file <log>` and a probe plug-in passed
+as `--plugin-dir plug`:
+
+```
+plug/.claude-plugin/plugin.json   {"name":"mosaic-skills",...}
+plug/skills/probe-alpha/SKILL.md  name probe-alpha; "The probe word is ZEBRA-4471."
+```
+
+The operator's own `~/.claude/skills` holds the ms-* skills, so a leak
+would have shown up.
+
+## Claude Code
+
+| Run | Tools | Settings | Skills offered | Result |
+|---|---|---|---|---|
+| A | `--tools ""` | none | none | model: "I don't see any skills". Debug: `Loaded 1 skills from plugin mosaic-skills`, `user: 0` |
+| B | `--tools Skill` | none | 14: probe-alpha plus Claude Code's own (loop, run, update-config, init, claude-api, dataviz, ...) | read the skill, printed ZEBRA-4471 |
+| C1 | `--tools Skill` | `disableBundledSkills`, `disableSkillShellExecution` | 2: probe-alpha, plugin-authoring | |
+| C2 | `--tools Skill` | env `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS=1` | 2: same | |
+| D | `--tools Skill` | C1 plus `skillOverrides: {"plugin-authoring": "off"}` | 1: probe-alpha | printed ZEBRA-4471. Debug still: `getSkills returning: ... 2 bundled skills, 1 builtin plugin skills`, `Sending 1 skills via attachment` |
+| E | as D | as D | asked to call plugin-authoring, loop, update-config, run, init, claude-api, dataviz | all 7 refused at validation (`Skill tool validation error: code=7` twice, `code=2` five times); none loaded |
+
+What it shows:
+- `--restricted` keeps user skills out (`user: 0` in every run).
+- A `--plugin-dir` skill works only with the `Skill` tool on. With it on,
+  "only the contracted skills" holds only through settings that name
+  Claude Code's own skills (`plugin-authoring`), and two bundled skills
+  stay loaded under names the log doesn't give. That list belongs to the
+  Claude Code version.
+- The `Skill` tool would be a new built-in on `--tools`, so the gate hook
+  (PreToolUse `*`) would see it.
+
+## Pi
+
+`docs/skills.md:67-69` in the pinned package: at startup pi puts each
+skill's name and description in the prompt, and "when a task matches, the
+agent uses `read`, or `bash` when `read` is unavailable, to load the full
+SKILL.md". `packages/harness/src/gate.mjs:3-4`: "every path argument of a
+file tool must resolve inside the workspace". The bundle is in the run
+directory, outside the workspace, so a `--skill` copy can't be read.
+
+## Choice
+
+The skill text goes into `prompt.md` on both harnesses, rendered from the
+bundle copies. Pi keeps `--no-skills`, Claude Code keeps
+`--disable-slash-commands` and `--restricted`. Neither harness discovers a
+skill, nothing new passes the gate, and the manifest's digests cover what
+the model reads. The cost is the skill text in every turn's prompt: by
+`wc -c` over the repo's `skills/` copies, coder 16.9 KB, reviewer 16.3 KB,
+cto 35.9 KB, pm 29.1 KB.
@@ -98,12 +98,32 @@ installed but not enabled.
  deactivate during the session doesn't change it. The manifest's
  `skills` lists each name, its bundle path and the sha256 of its
  `SKILL.md`.
- Pi gets the bundle copies through `MOSAIC_SKILLS`, which the adapter
-  already turns into `--skill` flags. Claude Code gets the same skills
-  and no others. Probe the way in first (a bundle-local plugin
-  directory, or the skill text in the generated system prompt are the
-  two candidates) with `--restricted` kept, and record the choice and
-  its evidence in the packet and in `adapters/README.md`.
+- Both harnesses get the skills as text in the generated `prompt.md`,
+  rendered from the bundle copies: each skill's files under its name, and
+  no other skill. Pi keeps `--no-skills` and Claude Code keeps
+  `--disable-slash-commands` and `--restricted`, so neither harness
+  discovers a skill of its own. Sage chose this on 2026-10-19 from a
+  probe (evidence in `agents/sage/work/queue-64/probe.md`, the choice in
+  `adapters/README.md`):
+  - Pi's `--skill` puts only each skill's name and description in the
+    prompt, and the model must `read` the SKILL.md itself
+    (`docs/skills.md:67-69` in the pinned pi package). The gate refuses
+    every file-tool path outside the workspace
+    (`packages/harness/src/gate.mjs:3-4`), so through `MOSAIC_SKILLS` a
+    session would see its skills and be unable to open them. Opening the
+    gate to the bundle changes a security boundary, which this row
+    doesn't do.
+  - Claude Code 2.1.303 loads a bundle-local `--plugin-dir` skill under
+    `--restricted`, but only with the `Skill` tool on, and then it also
+    offers its own bundled skills. `disableBundledSkills` and a
+    `skillOverrides` entry for its built-in `plugin-authoring` cut the
+    offer to the contracted skill, yet the debug log still counts two
+    bundled skills loaded. That list changes with the Claude Code
+    version, and the `Skill` tool would pass through the gate hook.
+  - The cost: a role's skill text is in every turn's prompt (17 to 36 KB
+    for the four lists below), where the other routes load a skill when
+    it's used.
+  The two harness modules and `MOSAIC_SKILLS` stay unchanged.
 - First skill lists. `ms-unslop` is on every list because Jason requires
  it on all output. `ms-tools` is on none: it documents the conductor's
  repository scripts, which a managed session can't run.