repair(msdmd): close post-114 maintenance contract gaps

CLAUDE.md

@@ -139,19 +139,26 @@ Two kinds:
 | `__init__.py` | — | Package marker / docstring. |
 
 `msdmd/collection.ts` defines the TypeScript shapes for generated repo-level
-`<reponame>_msdmd.ts` collection points. `msdmd/collect.py` is a stdlib
-schema-2 collector that reads supported native conventions through
-`msdmd/readers.py` and supplemental MSDMD blocks through the universal parser
-path. Its explicit legacy/block mode is compatibility-only and cannot silently
-stand in for native facts.
+`<reponame>_msdmd.ts` collection points. `msdmd/collect.py` is the schema-2
+collector; its core is stdlib, while the complete shipped native-reader matrix
+requires the pinned Python packages in `msdmd/requirements.txt` and the
+TypeScript runtime in `msdmd/package.json`. Install them with
+`python -m pip install -r msdmd/requirements.txt` and
+`npm ci --ignore-scripts --prefix msdmd` before full native-reader validation.
+The collector reads supported native conventions through `msdmd/readers.py` and
+supplemental MSDMD blocks through the universal parser path. Its explicit
+legacy/block mode is compatibility-only and cannot silently stand in for native
+facts.
 
 `msdmd/module_projection.py` is a separate partial Python native reader using
 `msdmd/module-projection.schema.json`; it emits source-bound per-module JSONL
 sidecars and shares the syntax-aware attachment discipline. Unsupported
 standards, ambiguous source, build/compiler context, cross-source semantic
 reconciliation, and independent signature/evidence verification remain visible
-`hmmm` rather than block-helper gaps. A zero collection exit validates only the
-implemented scope for that run; it does not prove complete information coverage.
+`hmmm` rather than block-helper gaps. With `--strict`, a zero collection exit validates only the implemented required
+scope for that run; without `--strict`, zero means rendering completed and the
+reported diagnostics and requirements still determine whether coverage is
+incomplete. Neither mode proves complete information coverage.
 The root collection's regeneration command and lexical scan limitations are
 documented in `ORG_DISTRIBUTION.md`; native discovery and exclusions are
 governed by `docs/runner-config-guidance.md`.

ORG_DISTRIBUTION.md

@@ -116,22 +116,31 @@ repo. Regenerate it from owning native and supplemental sources, never by editin
 the projection:
 
 ```bash
-python -m msdmd.collect --root . --repo The-Interdependency/skill-lib --import-path ./msdmd/collection --out skill-lib_msdmd.ts
+python -m pip install -r msdmd/requirements.txt
+npm ci --ignore-scripts --prefix msdmd
+python -m msdmd.collect --root . --repo The-Interdependency/skill-lib --snapshot-identity --import-path ./msdmd/collection --out skill-lib_msdmd.ts --strict
 python -m unittest tests.test_msdmd_native_contract_docs
 ```
 
 The shipped collector defaults to schema 2. It integrates supported native facts
 through `msdmd/readers.py` and supplemental MSDMD blocks through the universal
 parser path. Its legacy/block-only output remains available only as an explicit
-compatibility path and cannot silently represent native facts.
+compatibility path and cannot silently represent native facts. In
+`--legacy-blocks-only` mode the universal parser is lexical rather than
+syntax-aware: block-shaped text in source strings or fixtures can be promoted
+when it matches the selected line-comment fence syntax. Treat that output as a
+block inventory only, not native coverage, identity validation, or behavioral
+evidence.
 
 The schema-2 reader matrix is implemented in bounded subsets rather than as a
-claim to every metadata convention. Unsupported, ambiguous, unreadable,
-dynamic, or out-of-scope inputs remain visible findings; an empty `gaps` array
-means only that the declared obligations for that run were satisfied. Deferred
-limitations are declared in the collector's owning metadata; they are not
-missing-block gaps. The generated file and its inputs travel in one Git commit;
-the replay test checks their bytes.
+claim to every metadata convention. Recognized unsupported, ambiguous,
+unreadable, dynamic, or out-of-scope inputs remain visible findings. `gaps` is
+only the expected-block adoption result: an empty `gaps` array means there are no
+requested `--expected-block` adoption gaps. Native `--require-fact` obligations
+are reported through `requirements` and diagnostics, and `--strict` makes
+unresolved required scope fail the command. Deferred limitations are declared in
+the collector's owning metadata; they are not missing-block gaps. The generated
+file and its inputs travel in one Git commit; the replay test checks their bytes.
 
 Python repositories may additionally generate source-bound per-module sidecars:
 
@@ -203,3 +212,133 @@ Before modifying any file in `The-Interdependency/The-Interdependency.github.io`
 ```
 
 Every website change transaction must append at least one new `By the builder` record containing date, time, and exact runtime model. The model chooses the subject and stops when it has properly explicated it. The journal append satisfies the transaction and does not recursively require another append.
+
+Before creating a new module, route, service, adapter, schema, worker,
+engine, UI panel, migration, or experiment, agents should read:
+
+```text
+.agents/skills/meta-module-build/SKILL.md
+```
+
+New module work starts with source-linked planning information from existing
+native manifests, schemas, and design records. Use supplemental `MODULE_BUILD`
+entries only for otherwise unexpressed information; do not demand a second copy.
+Purpose, surfaces, boundaries, tests, rollout, and rollback remain required.
+Unsupported extraction and unknown fields stay `hmmm`, not missing information.
+
+Before creating or maintaining a root `llms.txt`, agents should read:
+
+```text
+.agents/skills/llms-build/SKILL.md
+```
+
+Root LLM instructions remain owned by their source declarations. The shipped
+llms-build runner publishes existing source `LLMS` blocks; edit those blocks and
+regenerate their projection. Native instruction readers remain a contract, so
+unsupported native sources stay `hmmm` rather than requiring duplicate blocks.
+
+Before translating raw, recursive, context-heavy, fragmentary, coined, or
+private-language thought for another human audience or public surface, agents
+should read:
+
+```text
+.agents/skills/thought-lens/SKILL.md
+```
+
+Recover and freeze the claim kernel before changing vocabulary. Reduce the
+context required from the reader without strengthening, flattening, or silently
+completing the thought; use `hmmm` where a bridge remains unresolved. Use
+`plain-lens` instead when the source is already a stable dense document.
+
+Before promoting a word or phrase into canon, a theorem, schema, ontology, encoding,
+or other semantic control surface, agents should read:
+
+```text
+.agents/skills/domain-claims/SKILL.md
+```
+
+Establish the applicable domain-qualified sense and resolve collisions before
+attaching provenance or authorizing structure.
+
+Before constructing, reviewing, replaying, or extending UCNS gonols, agents should read:
+
+```text
+.agents/skills/gonol-build/SKILL.md
+```
+
+Resolve the current UCNS source and evidence identities first. Preserve closure and
+atomic promotion, require explicit occurrence-addressed function plans, and do not
+restore the superseded `gonal-morphology` language model.
+
+Before selecting among UCNS options or declaring a scoped winner, agents should read:
+
+```text
+.agents/skills/ucns-option-selection/SKILL.md
+```
+
+Freeze scope, candidates, hard gates, evidence, policies, authority, and
+ratification before outcome comparison. Do not let scores compensate for failed gates
+or transfer a scoped result into universal UCNS canon.
+
+Before selecting an EPAC artifact and representation for a human-facing or
+WebMCP display, agents should read:
+
+```text
+.agents/skills/epac-selection-display/SKILL.md
+```
+
+Pin the provisional EPAC source, exact target, receipt, and available renderer;
+preserve research standings, nonclaims, sealed-comparison boundaries, and `hmmm`;
+and keep the WebMCP server a read-only registry/handoff rather than an EPAC
+executor.
+
+Before choosing between the smallest decisive action and a maximal coherent program,
+selecting the highest-leverage next step under constrained time, attention, money,
+compute, or coordination, or deciding whether a bounded falsifier should precede a
+full build, agents should read:
+
+```text
+.agents/skills/action-calibration/SKILL.md
+```
+
+Name the decision, preserve load-bearing invariants, compare complete cost vectors,
+freeze outcome-conditioned escalation rules, and let `loop-eng` execute the selected
+bounded loop.
+
+Before auditing or auditing and repairing an existing repository, agents should read:
+
+```text
+.agents/skills/repo-audit-repair/SKILL.md
+```
+
+Resolve exact repository identity and authority first; select checks from actual
+repository claims; classify defects separately from environment, external service,
+policy, and `hmmm`; repair only the owning layer under the user's authorization; and
+verify merge, release, and deployment as distinct terminal states when applicable.
+
+Before writing, reviewing, or troubleshooting repeatable SSH automation or a
+large terminal paste that contains SSH, agents should read:
+
+```text
+.agents/skills/ssh-automation/SKILL.md
+```
+
+Fail closed on endpoint identity and host-key trust, preserve local/remote shell
+boundaries, and keep bulk pasted error handling inside a child shell.
+
+Before giving an MCP-capable agent operational contact with a private VM, agents should read:
+
+```text
+.agents/skills/vm-mcp/SKILL.md
+```
+
+Keep SSH/OS Login credentials outside the model path, install the service loopback-only and non-root, establish private authenticated transport, prove read-only contact before enabling shell execution, and add privileged administration only as named bounded capabilities rather than a generic root shell.
+
+Existing files are not retroactively noncompliant merely because they predate
+this skill.
+
+## hmmm
+
+Target-repo propagation is not complete just because `skill-lib` is updated.
+Each target repo still needs a repo-local propagation PR, source commit SHA,
+collection point, and local verification record.

README.md

@@ -9,8 +9,9 @@ The [foundational skill](msdmd/SKILL.md) and
 native-first contract. The schema-2 collector now integrates supported native
 source/document readers through the versioned reader registry, while the
 universal MSDMD-block parser remains available for supplemental declarations.
-Unsupported conventions stay visible as explicit unknowns rather than being
-treated as implemented readers.
+Recognized unsupported inputs stay visible as explicit unknowns rather than being
+treated as implemented readers. Unrecognized metadata dialects are not evidence of
+complete inspection.
 
 Licensed under MPL-2.0 (relicensed from MIT; weak copyleft — embed anywhere,
 changes to these files must be published). The canonical install path inside a