stack/agents/sage/work/queue-64/probe.md

Row 64 probe: how a managed session gets its skills (2026-10-19)

Sage, 18:50Z to 18:53Z. Claude Code 2.1.303 (~/.local/bin/claude), pi from the pinned @earendil-works/pi-coding-agent. Every Claude Code run was a short -p with --model haiku, in an empty workspace, with --restricted --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode dontAsk --debug-file <log> and a probe plug-in passed as --plugin-dir plug:

plug/.claude-plugin/plugin.json   {"name":"mosaic-skills",...}
plug/skills/probe-alpha/SKILL.md  name probe-alpha; "The probe word is ZEBRA-4471."

The operator's own ~/.claude/skills holds the ms-* skills, so a leak would have shown up.

Claude Code

Run	Tools	Settings	Skills offered	Result
A	--tools ""	none	none	model: "I don't see any skills". Debug: Loaded 1 skills from plugin mosaic-skills, user: 0
B	--tools Skill	none	14: probe-alpha plus Claude Code's own (loop, run, update-config, init, claude-api, dataviz, ...)	read the skill, printed ZEBRA-4471
C1	--tools Skill	disableBundledSkills, disableSkillShellExecution	2: probe-alpha, plugin-authoring
C2	--tools Skill	env CLAUDE_CODE_DISABLE_BUNDLED_SKILLS=1	2: same
D	--tools Skill	C1 plus skillOverrides: {"plugin-authoring": "off"}	1: probe-alpha	printed ZEBRA-4471. Debug still: getSkills returning: ... 2 bundled skills, 1 builtin plugin skills, Sending 1 skills via attachment
E	as D	as D	asked to call plugin-authoring, loop, update-config, run, init, claude-api, dataviz	all 7 refused at validation (Skill tool validation error: code=7 twice, code=2 five times); none loaded

What it shows:

• --restricted keeps user skills out (user: 0 in every run).
• A --plugin-dir skill works only with the Skill tool on. With it on, "only the contracted skills" holds only through settings that name Claude Code's own skills (plugin-authoring), and two bundled skills stay loaded under names the log doesn't give. That list belongs to the Claude Code version.
• The Skill tool would be a new built-in on --tools, so the gate hook (PreToolUse *) would see it.

Pi

docs/skills.md:67-69 in the pinned package: at startup pi puts each skill's name and description in the prompt, and "when a task matches, the agent uses read, or bash when read is unavailable, to load the full SKILL.md". packages/harness/src/gate.mjs:3-4: "every path argument of a file tool must resolve inside the workspace". The bundle is in the run directory, outside the workspace, so a --skill copy can't be read.

Choice

The skill text goes into prompt.md on both harnesses, rendered from the bundle copies. Pi keeps --no-skills, Claude Code keeps --disable-slash-commands and --restricted. Neither harness discovers a skill, nothing new passes the gate, and the manifest's digests cover what the model reads. The cost is the skill text in every turn's prompt: by wc -c over the repo's skills/ copies, coder 16.9 KB, reviewer 16.3 KB, cto 35.9 KB, pm 29.1 KB.