feat: make self-hosting the standing delivery practice (phases 6–7 + plan 25)

.claude/skills/sdp-agent-surface/SKILL.md → .agents/skills/sdp-agent-surface/SKILL.md

@@ -15,18 +15,38 @@ evaluation sink. There is no verb wall — you script the graph.
 
 For any corpus question, **query the graph before reading spec files**.
 
+In an adopter, use the repository's package runner or its documented wrapper script. Select that
+repository's root and repeat only the exclusions its corpus needs:
+
 ```sh
-sdp q 'return g.specs().length' --exclude explorations --exclude examples --exclude test/fixtures/import/parity
-sdp q 'return g.specContext("spec:consumers.reader")' --exclude explorations --exclude examples --exclude test/fixtures/import/parity --json
+pnpm exec sdp q 'return g.specs().length' --root PATH --exclude PATH
+pnpm exec sdp q 'return g.specContext("spec:example.id")' --root PATH --exclude PATH --json
 ```
 
-Those three exclusions are this repository's own and they are **required here**: the corpus carries
-deliberate duplicate-id and carrier-parity fixtures, so without them the graph does not derive and
-the sink refuses to run the body. They are the same list `npm run generate:self-hosting` passes.
+`PATH` is a placeholder, not a universal exclusion. For example, the origin adopter uses its
+`pnpm sdp:q` wrapper and excludes only `deps-packages`.
+
+When working in the **Protocol source checkout itself**, use its repository script, which supplies
+the exact three fixture exclusions:
+
+```sh
+pnpm --silent sdp:q 'return g.specs().length'
+pnpm --silent sdp:q 'return g.specContext("spec:consumers.reader")' --json
+```
 
-The catalog of ready-made bodies is `docs/agent-surface/recipes.md` — build backlog, drift alarm,
-per-Spec guarantees and verifiers, blast radius, Pack review backbone, concept search, readiness
-divergence, warn-level signals. Every body there runs verbatim and a test proves it. Start from a
+Those exclusions are required only for the Protocol source tree: it carries deliberate
+duplicate-id and carrier-parity fixtures. They are the same list `npm run generate:self-hosting`
+passes. Run `npm run build` first if `dist/` is absent. Do not use `pnpm exec` in this source
+checkout: `exec` resolves dependency binaries, while this package does not link itself into its
+own `node_modules/.bin`; an unresolved `sdp` can select macOS's unrelated binary. Do not invoke a
+global `sdp` either.
+
+The catalog contains eleven ready-made bodies in `docs/agent-surface/recipes.md` in the Protocol
+repository and
+`node_modules/@libar-dev/software-delivery-protocol/docs/agent-surface/recipes.md` in an adopter —
+build backlog, drift alarm, per-Spec guarantees and verifiers, blast radius, Pack review backbone,
+concept search, readiness divergence, warn-level signals, promotion preflight, declared-versus-enabled
+verifiers, and the lower ladder. Every body there runs verbatim and a test proves it. Start from a
 recipe; adapt it in place.
 
 Reach for the files only when you need the authored prose itself — the exact words to edit.
@@ -74,6 +94,9 @@ read the carrying Spec.
   Pass, fail, skip, and quarantine are CI's.
 - **Do not read `implemented` as "it is live."** It says a code anchor binds to the Spec. Runtime
   evidence would be `observed`, which is not tracked.
+- **Do not use raw `ready ∧ ¬implemented` as the operational backlog.** Under the example realization
+  posture it also includes ready example evidence; recipe 1 excludes examples and reports their
+  verifier health without inventing inherited implementation.
 - **Do not collapse the claim taxonomy.** `declared` is authored intent, `anchored` is a human
   binding from source, `inferred` is machine-derived structure. Carry the claim into your answer.
 - **Do not treat stated readiness as derived readiness.** `statedReadiness` is the author's

.agents/skills/sdp-authoring/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: sdp-authoring
+description: Author and mature Protocol Specs through the graph-first workflow. Use when creating or editing `.sdp.md` carriers, deciding the honest readiness rung, promoting inline content, generating executable contracts, binding examples or implementation anchors, mutation-probing evidence, or preparing a Spec for human review and a `ready` statement.
+---
+
+# Author Specs through the graph
+
+Treat the canonical carrier as the write surface and the derived graph as the read model. Start every
+session with the build-backlog and drift-alarm recipes. In the Protocol repository the catalog is
+`docs/agent-surface/recipes.md`; in an adopter, read the same shipped catalog at
+`node_modules/@libar-dev/software-delivery-protocol/docs/agent-surface/recipes.md`.
+
+At this repository root, use the exact self-hosting exclusions:
+
+```sh
+pnpm --silent sdp:q 'const ready = g.specs().filter((spec) => spec.statedReadiness === "ready"); const backlog = ready.filter((spec) => spec.specKind !== "example" && !spec.deliveryFacts.includes("implemented")); const excludedExamples = ready.filter((spec) => spec.specKind === "example" && !spec.deliveryFacts.includes("implemented")); return {backlog: backlog.map((spec) => spec.id), excludedReadyExamples: excludedExamples.length, excludedWithoutVerifier: excludedExamples.filter((spec) => !spec.deliveryFacts.includes("has-verifier")).map((spec) => spec.id)}'
+pnpm --silent sdp:q 'return g.specs().filter((spec) => spec.deliveryFacts.includes("implemented") && spec.statedReadiness !== "ready").map((spec) => spec.id)'
+```
+
+For an adopter, select its root and exclusions explicitly:
+
+```sh
+pnpm exec sdp q 'return g.specs().map((spec) => spec.id)' --root PATH
+pnpm exec sdp q 'return g.specs().map((spec) => spec.id)' --root PATH --exclude PATH --exclude PATH
+```
+
+The Protocol wrapper supplies the root's three exclusions; run `npm run build` first if `dist/` is
+absent. Do not use `pnpm exec` in this source checkout: `exec` resolves dependency binaries, while
+the package does not link itself into its own `node_modules/.bin`; an unresolved `sdp` can select
+macOS's unrelated binary. Never rely on a global `sdp`. Adopters should use their chosen package
+runner.
+
+## Create and enrich
+
+1. Read `CONTEXT.md`, then query nearby Specs with recipe 3 or 6. Do not parse the corpus by hand.
+2. Create the Markdown carrier with one stable `spec:` id, title, kind, altitude, readiness, and
+   relations. The carrier law is `spec:decisions.carrier-ruling`; the envelope and section law is
+   `spec:model.spec-sections`.
+   A Spec carries one kind. If a fact straddles kinds, split it into two Specs and join them with
+   the relation that preserves their distinct intents, following `spec:model.core-model`.
+3. State only the rung the structure clears. Use recipe 9 for the current floor, recipe 11 for the
+   lower ladder, and read `spec:validation.readiness-floor` plus
+   `spec:validation.kind-evidence` for the clauses.
+4. Keep local detail inline. Promote it only when it needs shared identity, binding, or independent
+   review; follow `spec:decisions.content-only-sections`.
+5. Put unresolved durable questions under Intent. A blocking question honestly keeps the Spec
+   below `defined`.
+
+### Capture a cheap idea
+
+Run concept search (recipe 6) first and place the carrier beside the family it finds. In the
+Protocol repository that normally means `specs/<family>/`; an adopter follows its own canonical
+carrier root rather than inventing a second one. This is the complete cheap-capture shape:
+
+```md
+---
+id: spec:<family>.<name>
+kind: <kind>
+altitude: <altitude>
+readiness: idea
+relations: {}
+---
+
+# <Human-readable title>
+
+## Intent
+
+- outcome: <One durable intended outcome>
+```
+
+The `idea` floor is the whole shape: stable envelope coordinates plus either an outcome or a
+`refines` parent. The template states the outcome explicitly so the capture remains intelligible
+without its parent. Before every later human readiness edit, run promotion preflight (recipe 9);
+the reported floor never makes the edit on the author's behalf.
+
+## Make an example executable
+
+1. Put the typed `gwt-vocabulary` example space on the parent.
+2. Put one concrete `gwt` bound point on each example child, following
+   `spec:decisions.point-per-example`.
+3. Generate contracts from the adopter root:
+
+   ```sh
+   pnpm exec sdp build .
+   ```
+
+   Diagnose contract refusals from `sdp build`; `sdp q` receives graph-validation findings, not
+   codegen findings.
+
+4. In the verifier suite, colocate `bindExample(generatedContract, world, bindings)` with a
+   `specTest` anchor targeting that example. In this repository, registering every suite that
+   imports a generated contract in `contract-dependent-suites.mjs` is part of binding.
+5. Mutate one expected result and prove the new point goes red, then restore it. Keep runner
+   execution and pass state outside the graph.
+
+The graph can report a resolving `specTest` binding. It cannot detect a generated contract that no
+suite binds because `bindExample` call sites are not extracted graph data.
+
+Ready examples normally carry verification evidence rather than build-backlog work. The canonical
+backlog recipe excludes them while reporting their count and any missing verifier binding; it does
+not infer `implemented` through their parent.
+
+## Bind implementation and review
+
+Add a `codeAnchor` beside the code that realizes the Spec, following
+`spec:decisions.binding-not-liveness` and `spec:model.anchors`. An anchor states identity and one
+target only; it never carries intent, readiness, or runtime truth.
+
+Regenerate the Design Review, inspect the Spec in context, and run recipes 7–11. Tooling never
+confers `ready`: after the floor clears and the evidence is reviewed, a human may state it by
+editing the canonical carrier.
+
+The graph outranks this skill. If a recipe or instruction disagrees with current graph data or a
+carrying Spec, report the skill as drift and follow the graph and Spec.

.agents/skills/sdp-sessions/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: sdp-sessions
+description: Route delivery work through graph-first capture, design, implementation, review, and close shapes without workflow gates.
+---
+
+# Route delivery work from current graph state
+
+Use this skill when opening or handing off a delivery session. It realizes
+`spec:consumers.delivery-session-on-ramp`: one current graph serves every work shape, and the shape
+only selects the advisory preflight and the carrying reference to open. Shapes are not phases,
+statuses, or a required sequence.
+
+## Bootstrap the graph
+
+The runnable bodies live in `docs/agent-surface/recipes.md` in the Protocol repository and in
+`node_modules/@libar-dev/software-delivery-protocol/docs/agent-surface/recipes.md` in an adopter.
+In this source checkout use the repository wrapper, which supplies the required exclusions:
+
+```sh
+pnpm --silent sdp:q 'return g.specs().length'
+```
+
+If the active pnpm binary cannot run this package-lock-based checkout, the equivalent source
+wrapper is `npm run --silent sdp:q -- '<body>'`. Never fall through to a global `sdp`.
+
+An adopter selects its root and exclusions through its installed package runner:
+
+```sh
+pnpm exec sdp q '<body>' --root PATH
+pnpm exec sdp q '<body>' --root PATH --exclude PATH --exclude PATH
+```
+
+Open the catalog and substitute only the parameter line of a parameterized recipe. The recipe
+result informs the session; it never grants permission or records a verdict.
+
+## Choose an advisory work shape
+
+### Capture / refine
+
+Use concept search (recipe 6) to find the existing family and avoid duplicate intent. Use the
+lower ladder (recipe 11) to see current stated and derived readiness, then promotion preflight
+(recipe 9) before a human changes a rung. Follow `sdp-authoring` for the minimal lawful `idea`
+carrier and the one-kind rule.
+
+### Design
+
+Use promotion preflight (recipe 9) on the target and readiness divergence (recipe 7) across the
+corpus. Resolve blocking open questions and review the carrying Specs. A clear floor is evidence,
+not an automatic `ready` statement.
+
+### Implement
+
+Use the build backlog (recipe 1) to orient the available ready work and the target Spec context
+(recipe 3) to read guarantees, relations, implementation bindings, and verifiers. Bind anchors
+and executable examples through `sdp-authoring`; an `implemented` fact names a binding, not a
+passing or live system.
+
+### Review
+
+For a Pack, use the Pack review backbone (recipe 5) and warn-level signals (recipe 8). Without a
+Pack, use the target Spec context (recipe 3) with warn-level signals (recipe 8). Review findings
+and gaps as data; the review never becomes a workflow gate.
+
+### Close / slim
+
+Use the drift alarm (recipe 2) and changed-file blast radius (recipe 4) over the session diff.
+Slimming is optional judgment: remove obsolete implementation-sequencing scaffolding only when
+durable law and one prose owner remain. `spec:model.enrichment-lifecycle` deliberately leaves the
+universal distillation boundary unresolved.
+
+## Hand off for re-measurement
+
+Name the chosen shape, target Spec ids or Pack, changed files, stated and derived readiness,
+findings or blocking open questions, and the exact commands, commits, or artifact locations from
+which evidence can be re-derived. Never hand off a carried "verified" verdict: the next session
+re-runs the named evidence. Git remains the event log; no session state enters the graph.
+
+All preflights are advisory. They never authorize, block, scope, unlock, or advance delivery work,
+and they never create a process state machine.

.claude/skills

@@ -0,0 +1 @@
+../.agents/skills

.gitignore

@@ -4,6 +4,12 @@
 # User's scratchpad
 .tmp-scratch/
 
+# User-local editor state
+.vscode/
+
+# macOS Finder metadata
+.DS_Store
+
 # Tooling outputs
 node_modules/
 dist/
@@ -15,4 +21,4 @@ generated/
 .omo/
 
 # Pi state (used by taskplane)
-.pi/
+.pi/