chore(skill-lib): refresh root skill-lib snapshot to 1b1a947 (#120)

.github/workflows/backend.yml

@@ -0,0 +1,40 @@
+name: backend fresh-making tests
+
+on:
+  pull_request:
+    paths:
+      - 'backend/**'
+      - 'frontend/cli/**'
+      - 'skill-lib/msdmd/**'
+      - '.github/workflows/backend.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'backend/**'
+      - 'frontend/cli/**'
+      - 'skill-lib/msdmd/**'
+      - '.github/workflows/backend.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  unittest:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the event source with GitHub PR isolation
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python (the backend's minimum, 3.11)
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+      # PostgreSQL integration tests skip without STACK_TEST_DATABASE_URL; they
+      # remain VM deployment gates (backend/deploy/VM_SETUP.md).
+      - name: Run backend unit tests
+        run: |
+          set -euo pipefail
+          bash -n backend/ops/*.sh
+          PYTHONDONTWRITEBYTECODE=1 python -m unittest discover -s backend/tests -t . -v

AGENTS.md

@@ -154,8 +154,6 @@ coherence; it does not replace workspace behavioral tests.
   lives in `research/weave/native_binary.py`; UCNS geometry is consumed, not
   redefined. UCHC binary graduation has not occurred. Private/public lifting,
   authentication/state and full-cipher security remain `hmmm`.
-- The complete root `skill-lib/` snapshot refresh remains separate because the current
-  provenance-bound fresh-making doctrine is newer than the local generator snapshot.
 - Project graduation automation remains unimplemented.
 
 URPCS provenance boundary: the immutable public intended-design transcript identity

README.md

@@ -239,15 +239,13 @@ Pinned and vendored components keep their own licenses:
 | `libs/pcea/` | MIT | `libs/pcea/LICENSE` (Copyright (c) 2026 Erin Patrick Spencer) |
 | `libs/ptcna/` | MPL-2.0 | `libs/ptcna/LICENSE`, pinned from The-Interdependency/ptcna |
 | `libs/ucns/` | `hmmm`: no `LICENSE` at pinned commit `828c0b8` | Upstream ucns carries MPL-2.0 again from 2026-09-11; a refresh of this pin would bring it in |
-| `skill-lib/` | MPL-2.0, plus Apache-2.0 imports | `skill-lib/LICENSE` (MPL-2.0). The Apache-2.0 skills imported from anthropics/knowledge-work-plugins (`sql-queries/`, `statistical-analysis/`, `explore-data/`, `validate-data/`, `data-visualization/`) are listed in `skill-lib/ATTRIBUTION.md`; the Apache-2.0 text is in [`skill-lib/LICENSES/Apache-2.0.txt`](skill-lib/LICENSES/Apache-2.0.txt) |
-
-The Apache-2.0 text now sits inside the snapshot, at
-[`skill-lib/LICENSES/Apache-2.0.txt`](skill-lib/LICENSES/Apache-2.0.txt). It came in
-through a licensing-only sync from The-Interdependency/skill-lib `e6e3e5c` (the
-skill-lib#110 merge). That sync copied only `skill-lib/LICENSES/Apache-2.0.txt` and
-`skill-lib/ATTRIBUTION.md`. Every other file in `skill-lib/` is unchanged, and the
-doctrine and MSDMD generator pin stays at `fb3b53a` (see `stack-manifest.json` and
-`backend/fresh-making-provenance.json`). The root
+| `skill-lib/` | MPL-2.0, plus Apache-2.0 imports | `skill-lib/LICENSE` (MPL-2.0). The Apache-2.0 skills imported from anthropics/knowledge-work-plugins (`sql-queries/`, `statistical-analysis/`, `explore-data/`, `validate-data/`, and `data-visualization/SKILL.md` only) are listed in `skill-lib/ATTRIBUTION.md`. The other files in `skill-lib/data-visualization/` are original to skill-lib under MPL-2.0. The Apache-2.0 text is in [`skill-lib/LICENSES/Apache-2.0.txt`](skill-lib/LICENSES/Apache-2.0.txt) |
+
+The whole `skill-lib/` snapshot, including
+[`skill-lib/LICENSES/Apache-2.0.txt`](skill-lib/LICENSES/Apache-2.0.txt) and
+`skill-lib/ATTRIBUTION.md`, is an exact copy of The-Interdependency/skill-lib
+`1b1a947`. The doctrine and MSDMD generator pin is that same commit (see
+`stack-manifest.json` and `backend/fresh-making-provenance.json`). The root
 [`LICENSES/Apache-2.0.txt`](LICENSES/Apache-2.0.txt) is the same text.
 
 `hmmm` (not yet decided): the license status of `ahbg/`, `research/`, `media/` and
@@ -295,9 +293,6 @@ a licensing map, not legal advice.
 - A GitHub-hosted executor remains optional and unimplemented; VM-local execution is the
   resilience baseline.
 - Organization aggregate and website-projection derivation specs are not yet registered.
-- The root `skill-lib/` snapshot predates the merged `fresh-making` skill; the runtime
-  pins that doctrine separately in `backend/fresh-making-provenance.json` because a full
-  snapshot refresh would also import unrelated doctrine changes.
 
 URPCS provenance boundary: the immutable public intended-design transcript identity
 and detailed design attribution remain unresolved; see

STACK_MANIFEST.md

@@ -17,7 +17,7 @@ Provenance and authority-boundary record for `The-Interdependency/stack`.
 - English four-view complete-corpus audit UTC: `2026-09-22`, exact view source `1f9a35eb355296fc88d09784c7a3e2e95511ca31`; all 164,864 words, native and independent agreement.
 - Stack-manifest schema: `the-interdependency.stack-manifest` version `1.1.0`
 - Work-graph digest (SHA-256 over canonical `repositories` + `research_participants` + `boundaries` JSON):
-  `dc2cac5ac1d609f7f72434514ec95a55e8020b0b9326c17883b1ef25e86baaa3`
+  `7e2aeaee9aa9589b79471f1b43dbc9d3cbfb017455e3d5b462be582695a7a6c1`
 - Weave workspace creation UTC: `2026-09-28`; new specification-first research starts from the intended multi-arity interleaving mechanism without URPCS inheritance
 - Machine-readable copy: [`stack-manifest.json`](stack-manifest.json)
 
@@ -44,7 +44,7 @@ meaning used by that repository.
 
 | Repository | Exact source commit | Source branch | Authority | Stack relation |
 |---|---|---|---|---|
-| `The-Interdependency/skill-lib` | `fb3b53a7629f7f03ecf255167d52c13abef1a979` | main | organization-wide build and evidence doctrine | operational snapshot at `skill-lib/` |
+| `The-Interdependency/skill-lib` | `1b1a9473fcbaab16965af9907e4aafd12853a704` | main | organization-wide build and evidence doctrine | operational snapshot at `skill-lib/` |
 | `The-Interdependency/metapat` | `34d954aa1e2092e615b03a180500f6b6977f501e` | main | semantic authority (Meta Energy Theory) | canon view `libs/metapat/`; research `research/metapat/` |
 | `The-Interdependency/ucns` | `828c0b8bbcfc267efb5701da714191c1f73a81ff` | main | geometry and mathematical representation | canon view `libs/ucns/`; research `research/ucns/` |
 | `The-Interdependency/edcm` | `7951ca32ba0f2494dc68ff9b7f6a80151918a56d` | main | measurement and evaluation of text-domain outputs | canon view `libs/edcm/`; measurement research `research/edcm/`; English Gonol construction is separate at `research/english-gonol/` |

ahbg/integration/work-graph.json

@@ -60,12 +60,12 @@
     {
       "repository": "The-Interdependency/skill-lib",
       "reviewed_commit": "516933d98f9de376f4e498f44059043dc0d96470",
-      "consumed_commit": "fb3b53a7629f7f03ecf255167d52c13abef1a979",
+      "consumed_commit": "1b1a9473fcbaab16965af9907e4aafd12853a704",
       "relevant_advance_commit": "284ebefad76a6589788ce8d16d47ad75bbfaa333",
       "authority": "build, evidence, metadata, and cross-repository coordination doctrine",
       "relation": "evidence-doctrine-peer",
       "integration": "drift-visible",
-      "decision": "Native-first MSDMD readers are reviewed but are not copied into AHBG while stack still consumes the older skill-lib snapshot. Integration waits for a coherent snapshot refresh."
+      "decision": "Native-first MSDMD readers are reviewed but are not copied into AHBG. Stack's root skill-lib/ snapshot now consumes 1b1a947, which carries them; whether AHBG adopts them is a separate AHBG integration decision (hmmm) that this snapshot refresh does not make."
     },
     {
       "repository": "The-Interdependency/epac",
@@ -89,7 +89,7 @@
     "Advance the stack UCNS pin only through a coherent stack transaction before consuming native Mobius comparison/lift state in AHBG.",
     "Define and test the exact EDCM-to-TIWCG/AHBG conflict-state mapping before EDCM readouts can alter committed game state.",
     "Exercise the current-A0 HTTP adapter against a deployed exact A0 commit and preserve the resulting live provider/tool provenance receipt.",
-    "Refresh the stack skill-lib snapshot before AHBG depends on the native-first MSDMD reader implementation.",
+    "Decide, as a separate AHBG integration change, whether AHBG adopts the native-first MSDMD readers now carried by the stack skill-lib snapshot.",
     "The benchmark can produce evidence relevant to theories of nonhuman consciousness; no repository currently supplies a validated rule that turns AHBG behavior into a consciousness determination."
   ]
 }

backend/README.md

@@ -56,7 +56,10 @@ JSON receipts under `STACK_RECEIPT_DIR` are projections for inspection/recovery.
 - Python 3.11+ and `psycopg`.
 - `git`.
 - target checkouts directly under `STACK_REPO_ROOT`.
-- a pinned skill-lib checkout at `STACK_SKILL_LIB_ROOT`.
+- a pinned skill-lib checkout at `STACK_SKILL_LIB_ROOT`, with its MSDMD native
+  reader runtimes installed (`backend/ops/install_msdmd_runtime.sh`: the
+  `msdmd/requirements.txt` packages in the worker venv and
+  `npm ci --ignore-scripts --prefix $STACK_SKILL_LIB_ROOT/msdmd`; Node and npm required).
 - an independent mounted filesystem/device for the verified backup mirror.
 
 Prefer local PostgreSQL Unix-socket/peer authentication. The worker should not need a
@@ -76,9 +79,25 @@ python3 -m venv .venv
 set -a
 . /etc/stack-orchestrator.env
 set +a
+sudo -E env STACK_VENV=/srv/stack/.venv backend/ops/install_msdmd_runtime.sh
 /srv/stack/.venv/bin/python -m frontend.cli.stackctl db migrate
 ```
 
+The generator identity is the collector's own `--print-generator-identity`. It
+covers collector sources plus the Python minor, reader package, Node and
+TypeScript versions and the reader modules that actually resolve, so it is
+environment-bound: it is observed only where the collector executes (the worker,
+or a local `fresh make`), never by a queueing or read-only operator shell. Every
+collector process runs with `cwd` at the generator root and `python -P`, so an
+inspected target cannot shadow the pinned collector. A collector that cannot
+report the identity fails closed, and a mismatch names the components that
+differ (for example `node: v24.15.0 -> absent`). The collector exits 3 when a reader runtime is missing, 4 when a
+target's vendored schema helper is older than the schema-2 output, and 5 when git
+cannot list the target's visible files or the target root is git-ignored. Each
+fails the attempt closed in the ledger (`failed`, with the exit code and an
+operator action in `hmmm`); nothing is published and any prior accepted artifact
+stays authoritative.
+
 ## Fresh-making usage
 
 Register current identities and make one repository's MSDMD collection fresh:
@@ -89,6 +108,13 @@ python -m frontend.cli.stackctl fresh make-msdmd ucns \
   --source-sha <40-hex-commit>
 ```
 
+Operator-shell `make-msdmd`, `fresh make`, `fresh run` and `fresh retry` never
+record the shell's generator identity. A `worker-pending` target is only queued
+for the worker; otherwise the job runs here and holds, naming the differing
+components, unless this environment reproduces the worker-recorded identity.
+On a host with no worker, where the shell is the executor, add
+`--record-identity-here` to `make-msdmd` or `fresh make`.
+
 Inspect or repair a registered derivation:
 
 ```bash
@@ -112,6 +138,14 @@ python -m frontend.cli.stackctl worker once
 python -m frontend.cli.stackctl worker run
 ```
 
+`--queue-only`, `fresh status` and `fresh explain` never probe the generator
+identity. A first queue records it as `worker-pending`; the worker observes its
+own identity, records it with its components, and supersedes that job once
+under the observed key (so the first `worker once` reports `superseded` and the
+next one makes the target fresh). Later queues reuse the worker-recorded
+identity. To compare or verify in the worker's exact environment, run the
+command through `sudo backend/ops/worker_sandbox_run.sh -- ...`.
+
 The old `stackctl msdmd ...` namespace is removed. MSDMD is an adapter under one
 fresh-making architecture, not a parallel job system.
 
@@ -183,9 +217,9 @@ Skipped PostgreSQL tests are deployment gates, not passes.
 ## Provenance
 
 `fresh-making-provenance.json` binds this runtime to exact `skill-lib` fresh-making
-doctrine. The root `skill-lib/` snapshot remains older because refreshing it would
-also import unrelated doctrine changes; the comparison records that the MSDMD
-generator tree did not change across that gap.
+doctrine. The root `skill-lib/` snapshot and the doctrine pin are the same skill-lib
+commit; the comparison records that `fresh-making/SKILL.md` is unchanged from the
+previous doctrine pin.
 
 ## hmmm
 
@@ -199,4 +233,3 @@ generator tree did not change across that gap.
   registered; the generic affected-closure logic is present.
 - Automatic commit/PR materialization of regenerated collection points remains
   separate from freshness verification and acceptance.
-- The complete root `skill-lib/` snapshot refresh remains a separate bounded change.

backend/deploy/VM_SETUP.md

@@ -68,12 +68,62 @@ cd /srv/stack
 python3 -m venv .venv
 .venv/bin/pip install --upgrade pip
 .venv/bin/pip install -r backend/requirements.txt
+# MSDMD native reader runtimes for the default STACK_SKILL_LIB_ROOT (/srv/stack/skill-lib);
+# backend/ops/install_msdmd_runtime.sh below does the same for a configured root.
+.venv/bin/pip install -r skill-lib/msdmd/requirements.txt
+npm ci --ignore-scripts --prefix skill-lib/msdmd
 
 sudo install -m 0600 backend/deploy/stack-orchestrator.env.example \
   /etc/stack-orchestrator.env
 sudo editor /etc/stack-orchestrator.env
 ```
 
+### MSDMD native reader runtimes
+
+The skill-lib collector at `STACK_SKILL_LIB_ROOT` needs its pinned Python reader
+packages in the worker venv and its TypeScript compiler installed beside the
+worker script. Without them the collector exits 3 and fresh-making fails closed.
+Run this as root after every skill-lib snapshot refresh, before restarting the
+worker (Node and npm must already be installed; Node version on the VM: hmmm):
+
+```bash
+set -a
+. /etc/stack-orchestrator.env
+set +a
+sudo -E env STACK_VENV=/srv/stack/.venv backend/ops/install_msdmd_runtime.sh
+```
+
+The script sets `umask 022` so the worker user (`STACK_WORKER_USER`, default
+`stackorchestrator`, which must exist) can read what it installs, runs
+`pip install -r $STACK_SKILL_LIB_ROOT/msdmd/requirements.txt` into the venv and
+`npm ci --ignore-scripts --prefix $STACK_SKILL_LIB_ROOT/msdmd`, then probes
+`python -P -m msdmd.collect --print-generator-identity --json` twice: in the
+calling shell, and inside the worker unit's sandbox through
+`backend/ops/worker_sandbox_run.sh` (systemd-run with the unit's `User`,
+`EnvironmentFile` and sandbox properties, including `MemoryDenyWriteExecute`,
+read with `systemctl show` from the installed unit, drop-ins included). Install
+the unit file and run `systemctl daemon-reload` first (see Worker below; enabling
+it can wait). The wrapper refuses to run (exit 2) unless the unit is loaded,
+runs as `STACK_WORKER_USER` and has `MemoryDenyWriteExecute=yes`.
+It fails (exit 3) if either probe fails or reports `node` or `typescript` as
+`absent`, and exits 4 if the sandboxed probe cannot run (not root, or no
+systemd-run). The sandboxed identity is the one the worker records, so a
+runtime upgrade re-keys every MSDMD derivation. pip hash-checking is not used
+(hmmm: skill-lib publishes pinned versions without hashes).
+
+Targets that still vendor the schema-1 `.agents/skills/msdmd/collection.ts` helper
+make the collector exit 4 (helper older than the schema-2 output). Those targets
+need a skill-lib propagation before they can be made fresh. A target where git is
+missing from the worker's PATH, or whose root an enclosing repository ignores,
+makes it exit 5. The worker records each refusal as a failed attempt with an
+operator action rather than writing an artifact.
+
+`stack-orchestrator-worker.service` keeps `MemoryDenyWriteExecute=true`. V8's
+JIT cannot run under it: Node dies with a V8 fatal error (SIGTRAP). The pinned
+skill-lib snapshot (`1b1a947`, after The-Interdependency/skill-lib#120) runs
+Node with `--jitless`, so the sandboxed probe and TypeScript extraction work
+under MDWE. `node` must also be on the unit's default PATH.
+
 Create `/var/lib/stack-orchestrator/receipts` and
 `/var/backups/stack-orchestrator/postgres` owned by the service account after that
 account is created using the VM's native administration path.
@@ -112,7 +162,10 @@ not require hosted CI or outbound network access.
 
 ## First fresh-making vertical slice
 
-Register and queue an exact MSDMD derivation:
+Register and queue an exact MSDMD derivation. Queueing from the operator shell
+never probes the generator identity (that shell's PATH, Node or venv may differ
+from the worker's); the derivation is recorded as `worker-pending`, or keeps the
+identity a worker already recorded:
 
 ```bash
 /srv/stack/.venv/bin/python -m frontend.cli.stackctl fresh make-msdmd ucns \
@@ -121,12 +174,25 @@ Register and queue an exact MSDMD derivation:
   --queue-only
 ```
 
-Then observe the worker and verify accepted freshness:
+The worker observes its own identity, records it with its components, and
+supersedes a `worker-pending` job once under the observed key. With the service
+running this happens on its own; by hand, the first `worker once` reports the
+`superseded` job and the second makes the target fresh. Run `worker once` in the
+worker's environment, not the operator shell:
+
+```bash
+sudo backend/ops/worker_sandbox_run.sh -- /srv/stack/.venv/bin/python -m frontend.cli.stackctl worker once
+sudo backend/ops/worker_sandbox_run.sh -- /srv/stack/.venv/bin/python -m frontend.cli.stackctl worker once
+```
+
+Then verify accepted freshness. `status` and `explain` never re-key the
+derivation, but their independent rerender compares the generator identity
+where they run, so use the same wrapper; from a different shell they report
+`verifier-unavailable` with the components that differ:
 
 ```bash
-/srv/stack/.venv/bin/python -m frontend.cli.stackctl worker once
-/srv/stack/.venv/bin/python -m frontend.cli.stackctl fresh status msdmd:ucns
-/srv/stack/.venv/bin/python -m frontend.cli.stackctl fresh explain msdmd:ucns
+sudo backend/ops/worker_sandbox_run.sh -- /srv/stack/.venv/bin/python -m frontend.cli.stackctl fresh status msdmd:ucns
+sudo backend/ops/worker_sandbox_run.sh -- /srv/stack/.venv/bin/python -m frontend.cli.stackctl fresh explain msdmd:ucns
 ```
 
 ## Independent backup

backend/fresh-making-provenance.json

@@ -3,25 +3,25 @@
   "version": "1.0.0",
   "doctrine": {
     "repository": "The-Interdependency/skill-lib",
-    "commit": "891dc0d13ee9d98d8ee6de3bf6ad5c309364bf92",
+    "commit": "1b1a9473fcbaab16965af9907e4aafd12853a704",
     "path": "fresh-making/SKILL.md",
     "relation": "exact governing fresh-making doctrine for the stack backend"
   },
   "local_generator_snapshot": {
     "repository": "The-Interdependency/skill-lib",
-    "commit": "fb3b53a7629f7f03ecf255167d52c13abef1a979",
+    "commit": "1b1a9473fcbaab16965af9907e4aafd12853a704",
     "path": "skill-lib/",
     "relation": "stack-local pinned snapshot used by the default MSDMD generator root"
   },
   "evidence": {
-    "skill_lib_compare": "fb3b53a7629f7f03ecf255167d52c13abef1a979..891dc0d13ee9d98d8ee6de3bf6ad5c309364bf92",
-    "msdmd_generator_changed_in_range": false
+    "skill_lib_compare": "38c64332b840b2bbe1c07e53aeee8996644548e9..1b1a9473fcbaab16965af9907e4aafd12853a704",
+    "fresh_making_doctrine_changed_in_range": false,
+    "msdmd_generator_changed_in_range": true,
+    "doctrine_and_snapshot_same_commit": true
   },
   "boundaries": {
     "authority_transfer": false,
     "doctrine_identity_transfer": false,
-    "hmmm": [
-      "the complete root skill-lib snapshot refresh is intentionally separate because the 12-commit range contains unrelated doctrine changes"
-    ]
+    "hmmm": []
   }
 }