# Row 64 probe: how a managed session gets its skills (2026-10-19)

Sage, 18:50Z to 18:53Z. Claude Code 2.1.303 (`~/.local/bin/claude`), pi
from the pinned `@earendil-works/pi-coding-agent`. Every Claude Code run
was a short `-p` with `--model haiku`, in an empty workspace, with
`--restricted --strict-mcp-config --mcp-config '{"mcpServers":{}}'
--permission-mode dontAsk --debug-file <log>` and a probe plug-in passed
as `--plugin-dir plug`:

```
plug/.claude-plugin/plugin.json   {"name":"mosaic-skills",...}
plug/skills/probe-alpha/SKILL.md  name probe-alpha; "The probe word is ZEBRA-4471."
```

The operator's own `~/.claude/skills` holds the ms-* skills, so a leak
would have shown up.

## Claude Code

| Run | Tools | Settings | Skills offered | Result |
|---|---|---|---|---|
| A | `--tools ""` | none | none | model: "I don't see any skills". Debug: `Loaded 1 skills from plugin mosaic-skills`, `user: 0` |
| B | `--tools Skill` | none | 14: probe-alpha plus Claude Code's own (loop, run, update-config, init, claude-api, dataviz, ...) | read the skill, printed ZEBRA-4471 |
| C1 | `--tools Skill` | `disableBundledSkills`, `disableSkillShellExecution` | 2: probe-alpha, plugin-authoring | |
| C2 | `--tools Skill` | env `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS=1` | 2: same | |
| D | `--tools Skill` | C1 plus `skillOverrides: {"plugin-authoring": "off"}` | 1: probe-alpha | printed ZEBRA-4471. Debug still: `getSkills returning: ... 2 bundled skills, 1 builtin plugin skills`, `Sending 1 skills via attachment` |
| E | as D | as D | asked to call plugin-authoring, loop, update-config, run, init, claude-api, dataviz | all 7 refused at validation (`Skill tool validation error: code=7` twice, `code=2` five times); none loaded |

What it shows:
- `--restricted` keeps user skills out (`user: 0` in every run).
- A `--plugin-dir` skill works only with the `Skill` tool on. With it on,
  "only the contracted skills" holds only through settings that name
  Claude Code's own skills (`plugin-authoring`), and two bundled skills
  stay loaded under names the log doesn't give. That list belongs to the
  Claude Code version.
- The `Skill` tool would be a new built-in on `--tools`, so the gate hook
  (PreToolUse `*`) would see it.

## Pi

`docs/skills.md:67-69` in the pinned package: at startup pi puts each
skill's name and description in the prompt, and "when a task matches, the
agent uses `read`, or `bash` when `read` is unavailable, to load the full
SKILL.md". `packages/harness/src/gate.mjs:3-4`: "every path argument of a
file tool must resolve inside the workspace". The bundle is in the run
directory, outside the workspace, so a `--skill` copy can't be read.

## Choice

The skill text goes into `prompt.md` on both harnesses, rendered from the
bundle copies. Pi keeps `--no-skills`, Claude Code keeps
`--disable-slash-commands` and `--restricted`. Neither harness discovers a
skill, nothing new passes the gate, and the manifest's digests cover what
the model reads. The cost is the skill text in every turn's prompt: by
`wc -c` over the repo's `skills/` copies, coder 16.9 KB, reviewer 16.3 KB,
cto 35.9 KB, pm 29.1 KB.