stack/docs/plans/reviews/2026-09-08_skill-launcher-verdict.md

SKILL-LAUNCHER-FILBERT-1 (#1498) — verdict

Reviewer: Filbert (independent). Author: Darkwing. Conflict check: none; I had no authorship or prior review role in the mismatch repair or the ms-watch replacement.

Verdict: APPROVED

Exact candidate: the nine files of snapshot /tmp/skill-launcher-review-5gh6v4v0 at manifest SHA-256 c4dd2ad8ec87138fc756aa3e7a3366dcec32fa8c5d1ecfa3736f746457568904, plus the explicit deletion of skills/ms-agent-watch/SKILL.md, against baseline 12ff5da7df91f5343a59999af98b67518c15d6a4. All nine hashes verified before and after review; snapshot unchanged. The metadata receipt docs/plans/reviews/2026-09-08_skill-launcher-review.json is a separate unit and was not treated as candidate source.

Independent verification

• Delta confinement: launcher changes exactly one line (skill list ms-agent-watch → ms-watch); the test file adds only the missing-skill refusal controls and the exact-path assertions; ms-communications and ms-proactive-agent change one reference line each (rename only); ms-watch/SKILL.md is new to git, matching the declared pre-existing on-disk replacement; the three log/status files gain only the recorded additions. The deletion target is a tracked baseline file, so it is a real git deletion, not an untracked-file cleanup.
• Fail-closed selection: the launcher's existing per-skill presence check now guards ms-watch. The new fixture control (inside the per-agent loop, so all three Pi agents) removes the fixture's skills/ms-watch/SKILL.md, asserts --check fails with missing skill: ms-watch, and asserts neither .pi/state nor a fake-Pi capture is created; the captured-args assertions verify the exact --skill …/skills/ms-watch argument and the absence of the old path, with the ten-skill count still enforced.
• My own disposable trees (never the drifted live tree):
  • Overlay tree (git archive 12ff5da7 + nine files + declared deletion): node --test scripts/test-rocko-launch.mjs scripts/test-darkwing-launch.mjs — 5 tests, 5 pass, 0 fail, exit 0.
  • Mismatch reproduction (baseline tree with only skills/ms-agent-watch/SKILL.md removed, simulating the live drift that produced the owner goal): the Pi suite fails 3 of 4 with missing skill: ms-agent-watch for each agent — independently confirming both the coordinator's observed baseline failure and that the mismatch was real, not cosmetic.
• Replacement-skill accuracy, read against baseline tools/agent-watch/agent-watch.sh: explicit sender override via MOSAIC_AGENT_SEND with the unreviewed $HOME/.config/mosaic fallback warning; socket precedence --socket > MOSAIC_TMUX_SOCKET > unique discovery with ambiguity refusal; list/status described as side-effecting (stale notices, messages), matching the CLI's notice logic; user-bus refusal with status exit codes 0/3/6 and no health inference from failed queries; sender exits 0 and 2 treated as terminal with the legacy delivered wording explicitly qualified as non-acknowledgement; interval floor 10 s and defaults 30 s/3600 s with --repeat/--quiet-timeout all matching the CLI. The skill claims no activation and no reliability guarantees, states that loading installs no timers, and scopes live watch operations to assignment authority. Watch runtime behavior itself was not redesigned; historical stale statements elsewhere were not rewritten.
• Docs and scope: the mismatch plan, CURRENT.md next-action block, SESSIONS line, and BUILD-LOG entry are accurate; registry review is deferred, not canceled; other untracked skills, private/WUI records, and held work are excluded structurally (the candidate touches only its nine files plus the one deletion). Added lines carry no private identifiers; the UUID/home-path hits in the full log files are baseline history already published at 29c1defe and later commits.
• bash -n and node --check pass. No live launcher, timer/systemd command, watch call, model invocation, private read, source edit, or git write was performed by this review.

Conditions

1. Commit exactly the nine reviewed files plus the declared skills/ms-agent-watch/SKILL.md deletion on refactor from this approval; any other byte change requires re-review. Push per the owner goal after commit; remote identity verified fresh afterward.
2. Register the shared-log entries and this verdict after the pin lifts, as with the #1497 closeout.
3. The goal is reviewed commit/push of this repair. No live activation, timer arming, restart, or deployment is authorized or implied; operator acceptance of the unrelated skill work is not.