IMP-063: Align public skill authoring with requirements and composition

[irl-dan]

Summary

• Explain contract authoring as expressing intent by composing requirements across the README, plugin metadata, skill/help/onboarding, authoring guidance, library indexes, and specification introductions.
• Keep one public vocabulary reference in skills/open-prose/guidance/authoring.md#requirements-and-composition, including required steps, compatible interfaces, contradiction reporting, and distinctions among inputs, capabilities, evidence, and satisfaction.
• Preserve the requirements behind the authoring/compose contracts and regenerate all four plugin manifest destinations from .plugin-meta.json.
• Reconcile the actively routed dedicated VM prompt with the current skill router and backend specifications; add three focused conformance checks for that correction.

Use Case / Run Evidence

The public introduction emphasized standing truths and outcomes, while authoring also supports one-time functions, required steps, and reusable composition. A reader could mistake a contract for an outcome alone or assume that declaring a capability supplies it. The revised explanation says what authors specify and which choices remain open, then names the existing composition interfaces.

Inspection also found an active compatibility defect: SKILL.md routes dedicated runtime instances to guidance/system-prompt.md, and the existing .github/scripts/openprose-smoke/run.ts explicitly loads it for every smoke case, but that prompt still taught retired service/system sections and contradicted current responsibility routing and state layouts. The correction follows the current canonical router and state specifications. Local validation is deterministic; the repository also starts its existing model-backed smoke CI automatically when this PR opens.

Coordination: IMP-063 (workspace access required). Public companion: docs.prose.md authoring migration, openprose/docs#18. The public explanation and rationale are contained in this PR and repository; neither PR depends on merging the other.

Design Boundary

This is one public authoring-language migration in the owning skill, documentation, and metadata sources. It preserves public skill version 0.18.0, runtime_contract: 2, authored kinds, grammar, runtime role names, signatures, and contract section headings. It does not import another kernel's syntax or semantics. Historical changelogs, legacy test terminology, retained image bytes, and the privacy policy are preserved.

Behavior-affecting prompt correction: dedicated instances now follow the current SKILL.md command/format router. Previously the prompt refused prose run on a responsibility; it now routes a responsibility to a mounted DAG render, while functions remain called helpers, patterns remain compile-time instantiations, gateways still refuse direct runs, and tests still route to prose test. Retired Services/Ensures explanations become the current Requires/Maintains and Parameters/Returns interfaces. The old universal non-empty bindings/ completion check becomes the shared durable envelope plus each backend's normative publication layout (responsibility world-model and receipts versus function returns). Semantic and deterministic checks follow the existing execution/backend specifications. Dedicated-only scope, pinned execution, private scratch, declared outputs, secret handling, and host capability limits remain explicit. No executable runtime, new syntax, permissions, or enforcement feature is added.

Examples

Before: “Declare outcomes. Not instructions.”

After: “State the requirements. Reuse and combine contracts.” Required steps remain requirements; the executing agent chooses an approach only where the contract leaves choices open.

A report can call reusable research and review functions, require source citations, and require review before publication. Function parameters/returns and responsibility subscriptions retain their documented meanings.

Testing

Candidate: 802f1c00a3ce99e1cfe785852879f4270f133a9f, based on 770cebc9e03a7150a73bd454b7a6da307595ff9d.

• pnpm install --frozen-lockfile using the repository's pinned pnpm 10.34.5: passed, no lockfile changes.
• pnpm test:skill: 19 suites / 304 tests passed, including three dedicated-VM regression checks and existing relative-link/corpus guards. Repeated on the committed candidate.
• git diff 770cebc9e03a7150a73bd454b7a6da307595ff9d..HEAD --check: passed; working tree clean.
• ./scripts/sync-copy.sh --check and ./scripts/bump-version.sh --check: passed.
• Manifest JSON/name/skill-path/interface/asset/registry checks: passed. Added Markdown links and anchors resolve. Changed .prose.md frontmatter and section headings are unchanged.
• Independent source review at the candidate head found no remaining issues and independently reproduced all 304 static tests, copy sync, diff checks, and local Markdown target checks.
• Rendered GitHub README and the linked requirements/composition section reviewed in the browser; paragraphs, inline code, heading, and navigation render correctly.
• Automatic OpenProse Smoke run 36813684593 passed all nine cases on attempt 1 using merge ref 9d04953c68b8eba7b97ed417b26bbb69bad76b2a (the candidate head and base above). The pre-existing required tier has nine cases: Claude Code 2.1.121, model claude-sonnet-4-6, one attempt per case, 24 turns each except 40 for kind-test, case timeouts of 360–600 seconds, and a 35-minute job cap. The matrix can run nine jobs concurrently; it has no explicit dollar cap. No manual workflow dispatch, force flag, or retry was used. All nine cases reported live execution (dryRun: false), exit code 0, no timeout, and no failure reason. Claude Code 2.1.121 is confirmed by workflow logs. The model name is the requested alias; the runner does not report a provider-resolved model, actual provider token usage, or billed cost. Model-authored receipt cost/token fields are not independent billing evidence. All 15 PR check entries are successful, including skill conformance, manifests, smoke, and CodeQL.

Residual Risk / Follow-ups

Prompt changes can affect model interpretation; deterministic string and structure checks do not establish execution equivalence. No operator-initiated model-backed runs, package release, deployment, or consumer-pin update was performed. Automatic required smoke CI is reported separately above; its structural artifact checks do not establish broad semantic equivalence. Existing specification implementation-status sections continue to distinguish intended semantics from harness enforcement. Runtime role terminology remains a separate discussion.

Retained independent review and sanitized automatic smoke record are available in the workspace (access required). The public validation results and limitations are stated above.