Forge 50

architect (layer 0)

folder-workspace · workspace-scaffold · data-source-map · productionize-opinion · workspace-audit

triage

job-to-be-done

plan

wayfinder

author

writing-for-agents · idc-skill-authoring · skill-tune

align

grill · domain-modeling · to-questionnaire · wait-what

build

spec-pipeline · prototype · deep-modules · worktree-fleet · lane-claim · wizard

verify

cross-family-review · diagnose · evidence-packet · finding-register

ship

transport-complete · domain-wire

compound

archipelago · handoff · console-as-code

under all of it

agent-guardrails — it is a seatbelt, not a sandbox.

The fleet names its seats by model family, always: OpenAI Codex, Claude Fable 5, Jon Isaac.

• Injected instructions

  scan: advisoryinstall hook: enforced

  skill-supply-chain-review/SKILL.md · CHANGELOG.md

  What

  Prose that hijacks the agent.

  Mechanism

  The intake scanner surfaces prompt-injection phrasing (ignore previous, without confirmation, system prompt) and emits a recomputable table. Read every line: the injection surface only a human closes. At install, every unexpected PreToolUse adapter exception collapses to a blocking exit 2, and explicit-skill/payload disagreement is denied.

  Boundary

  A regex flags candidates; it does not prove intent. The blocking behaviour is enforced only where the adapter is installed.

• Redirects

  enforced

  integrity/README.md · CHANGELOG.md

  What

  A pinned URL that silently lands elsewhere.

  Mechanism

  Check 4 re-fetches every runtime instruction; it must match its signed digest and its final URL. Release runtime instructions require HTTPS for both source and final URL, with no fixture transport escape.

  Boundary

  Enforced inside skill_integrity.py verify — that is, only when you run it.

• Unpinned fetches

  enforced

  integrity/README.md · self-contained-ship/SKILL.md

  What

  curl | sh, pip install, CDN fonts at load.

  Mechanism

  Check 3 signs and classifies every HTTP(S) reference and detected network-command occurrence. Check 5 denies reviewed download/execute classes unless the exact signed occurrence is an approved inert example or setup operation. The egress scanner fails closed (exit 1) on any un-waived external reference, symlink, non-regular file, unreadable file, directory-traversal error, or binary.

  Boundary

  The scanner is necessary, not sufficient.

• Tampered installs

  enforced

  integrity/README.md · CHANGELOG.md · README.md

  What

  Bytes changed after review.

  Mechanism

  Check 2 matches all 50 registered skill trees and the complete Git-tracked release closure against signed SHA-256, size, and canonical POSIX-mode records. Inventory drift, unsafe file types, symlinks, case collisions, Unicode-normalization collisions, and mid-check mutation force red. Adversarial fixtures cover local tamper, new URLs, remote-content drift, forged manifests, attacker-key substitution, manifest-swap and mid-verification file races, wide-encoded payloads, symlink escape, control-file path escape, denied fetch/execute forms, and tampered installation trees.

  Boundary

  It does not prevent same-user post-check mutation.

• Rollback

  machinery: implementedproduction: deferred

  integrity/README.md · CHANGELOG.md · docs/2.0.5-release-scope.md

  What

  An old tree approving its own old rules.

  Mechanism

  A whole-tree rollback restores an old manifest, verifier, installer, hook, and workflow together. An old in-tree verifier can therefore approve its own old rules. A monotonic number inside that same tree does not fix the problem. The cure is an external, expiring, signed release index plus a protected anti-replay checkpoint; only the independently installed freshness launcher can emit readyToRun=true. manifestSequence advanced 2 → 4, with 3 deliberately skipped so a cloned candidate cannot equivocate.

  Boundary

  The machinery is implemented and tested; production activation is deferred for 2.0.5.

What a green check is not

• A valid signature authenticates bytes, not benevolent intent.
• contentReady=true is not readyToRun=true.
• The in-tree verifier cannot establish whole-tree freshness by itself.
• Windows/NTFS acceptance and the production threshold ceremony remain separate evidence gates.
• Scanner findings require review; a scanner pass is not a system-wide safety certificate.

repository

Island-Dev-Crew/idc-skills

tag

2.0.5

commit

68ce34a032484529104b570d417e29ac8156b080

copy

tree

ec2ee9b600aba60c46ca1a1f793484018ff78ea3

copy

manifest

sha256:0899bbc69e38807f7b2a8caf5dc449c6a57dca978dec8e3bd139194d6a2f1c74

copy

signature

sha256:c0aa651e15143540ae238b05430ce930ee07f426ad708f5ad2a629738796237b

copy

sequence

4 (manifest sequence 3 was assigned to a corrected, never-released candidate; unrelated to the release-index sequence below)

fingerprint

SHA256:LBkF4ekX2Z1XQ08gjjExnku92wAgmyFA04YJqPiczbA (Ed25519 · identity idc-skills · namespace file)

copy

profile

limited-trust, public content-authenticated

• The tag, commit, tree, manifest digest, and full signing fingerprint must agree exactly.
• The DNS record does not carry the detached-signature digest; compare that value between the release asset and the company JSON witness.

What each check establishes — and what it does not. The two columns carry equal weight on purpose.

RUN — you can recompute this from the checkout; the commands are in Install safely. REPO — declared in the repository; the release index lives on the trust-index branch, which is outside the release tree but not outside the repository. The two genuinely out-of-repository channels are the HTTPS and DNSSEC witnesses above.

Deferred, and named

• production 2-of-3 root/release-role custody
• eleven-lane Kimi K3 acceptance
• Windows/NTFS/OpenSSH acceptance
• freshness-authorized four-root parity
• disjoint publication-observer receipt
• root-rotation resilience in live custody
• universal successful behavior across every documented harness surface
• full-profile readyToRun=true

If the tag, commit, tree, manifest, signature, fingerprint, or witness differs, stop. Preserve the exact bytes and command output, then follow SECURITY.md. Do not "repair" an immutable release or accept a close-looking fingerprint.

1. 2.0.12026-08-19

   Close the independent review

   • Closed the independent review's initial validator, installer, routing, provenance, and handoff findings.
2. 2.0.22026-08-19

   A signed integrity gate over every byte

   • De-slopped all 50 skill bodies with no semantic loss found by independent cohort review.
   • Dependency-free signed integrity gate over every skill byte, release-control byte, external-reference occurrence, network-command occurrence, remote instruction pin, and exact reviewed fetch/execute exception.
   • Stable 1Password-held Ed25519 signing anchor, detached OpenSSH signature flow.
   • 5/5 proves the signed bytes and remote observations checked at preflight. It does not certify signed intent, protect a compromised signing session, sandbox the agent, prevent same-user post-check mutation, or attest an entire runtime flow.

   git fixtures 28 → 3750 machine-readable records150 cases

3. 2.0.32026-08-19 · published 2026-08-22

   Content integrity split from release authority

   • The in-tree verifier now emits contentReady; only the independently installed freshness launcher can emit readyToRun=true.
   • Signed manifest schema v3 with the first evidenced monotonic manifestSequence.
   • Domain-separated, expiring signed release index and protected anti-replay checkpoint.

   100 unit tests + 20 subtestsguard 300/300egress 589/589

4. 2.0.42026-08-25

   The declared grammars closed

   • Closed the declared Git grammar at 395 cases and the static egress grammar at 619 cases.
   • External threshold-root metadata, rollback-safe root rotation, release statements, protected checkpoints.
   • Bounded strict Git-grammar input at 64 KiB.

   guard 395/395egress 619/61931 preserved Kimi records

5. 2.0.52026-09-09

   An evidence-routed public front door

   • Removed unsupported global uniqueness language.
   • Advanced manifestSequence from 2 to 4. Sequence 3 was never indexed or released.
   • No skill body, installer, guard, egress, threshold-root, freshness, or release-verifier implementation changed.
   • releases.json now records 2.0.4 and 2.0.5 (index sequences 2 and 3).

   tests 280manifestSequence 4

fixtures 28 → 37guard 300 → 395egress 589 → 619manifestSequence 1 → 2 → 4tests 100(+20) → 280

1. Step 1

   Acquire one immutable release

   git clone https://github.com/Island-Dev-Crew/idc-skills.git
   cd idc-skills
   git checkout --detach 2.0.5
   git rev-parse HEAD
   git rev-parse HEAD^{tree}

   copy

   Expected
   68ce34a032484529104b570d417e29ac8156b080
   ec2ee9b600aba60c46ca1a1f793484018ff78ea3
   

   Do not take the expected commit and tree from the tracked README or from the checkout you are trying to authenticate. Stop on any mismatch. Do not substitute a branch, fork, mirror, archive repost, or similarly named tag.

2. Step 2

   Compare the out-of-repository identity

   Immutable releasegithub.com/Island-Dev-Crew/idc-skills/releases/tag/2.0.5published 2026-09-09

   Company witnessislanddevcrew.com/.well-known/idc-skills/2.0.5.jsonlive

   DNSSEC witness_idc-skills-2-0-5.islanddevcrew.compublished 2026-09-09

   DNSSEC validation requires an authenticated validating resolver or tool such as delv; seeing a TXT string with plain DNS lookup is not cryptographic validation.

3. Step 3

   Run non-authoritative structural checks after identity comparison

   python3 -I -B scripts/validate_skills.py --json
   python3 -I -B scripts/verify_forge_50.py --json
   python3 -I -B scripts/verify_harness_support.py
   python3 -I -B scripts/verify_runtime_requirements.py \
     --contract runtime-requirements.json
   
   # the three remaining RUN receipts in the strip above
   python3 -B -m unittest discover -s tests -p 'test_*.py'
   skills/agent-guardrails/scripts/test-block-dangerous-git.sh
   skills/self-contained-ship/scripts/test-scan-egress.sh

   copy

   Expected
   valid: true … errors: 0 … warnings: 13
   pass: true … skills: 50 … compatibilityAdvisories: 13
   Ran 280 tests
   RESULT pass=395 fail=0
   RESULT pass=619 fail=0
   

   The 13 warnings and 13 compatibility advisories are expected: they name the thirteen user-only islands that carry the Claude-family disable-model-invocation extension. Errors, not warnings, are the stop condition. These commands execute repository-controlled Python. They prove their named repository facts for the identified checkout; they are not a sandbox, do not independently authenticate the checkout, and do not prove successful invocation in a live harness.

4. Step 4

   Authenticate the signed content

   python3 -I -B scripts/skill_integrity.py verify \
     --ssh-keygen /independently/selected/ssh-keygen \
     --ssh-keygen-sha256 sha256:<independently-computed-executable-digest> \
     --json

   copy

   Proceed only on
   contentReady: true, score: 5/5
   SHA256:LBkF4ekX2Z1XQ08gjjExnku92wAgmyFA04YJqPiczbA
   

   This gate authenticates the scoped signed bytes and policies. It is not freshness authority, a sandbox, or proof that every signed instruction is safe for every environment.

5. Step 5

   Choose an installation authority

   Full authority

   These paths are deployment templates, not values to copy literally. The production threshold/freshness ceremony is not activated for 2.0.5, so 2.0.5 cannot honestly complete this route as readyToRun=true.

   Limited trust, local policy

   An operator may adopt content after a valid contentReady result under an explicit local policy that accepts the missing external freshness guarantee. That choice is outside the 2.0.5 release authority. The repository intentionally provides no flag that relabels it readyToRun=true and no direct-install bypass for the launcher.

6. Step 6

   Verify the target harness separately

   docs/harness-support.md →

   The harness matrix is a dated 2026-08-11 contract covering 15 surfaces with mixed evidence states; not a universal support promise.