Alden: unified knowledge and live command terminal

.agents/skills/verify-alden-messenger-publication/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: verify-alden-messenger-publication
+description: Recheck messenger store/frontier/outbox commit ordering, current-version read authority and durable activity receipts after relevant Alden source changes.
+---
+
+# Verify messenger publication
+
+Read `docs/evaluation/messenger-stream-20261021/PUBLICATION_STATE.md` from the
+checkout. The property is that reads between separate database commits must
+neither expose a body before the frontier commits nor permanently lose its
+later refresh receipt. A wrong current membership/version must remain denied.
+
+Source coverage is `Frontier._prepare`, `_publish`, `_source_access`,
+`_release_activity`, `step` and `activity_releases` in
+`docs/evaluation/messenger-stream-20261021/messenger_candidate.py`, and
+`CollectionStore.ingest`, `release_activity`, `_event` and `activity_page` in
+`scripts/alden_collection.py`. The UI's history counts and terminal labels keep
+the readiness stage distinct from stored changes. Base inspected is
+`7d7a5149f8a05dbd913add6cf8e5cc5fa3f4adc6`; implementation aligned at
+`583bee9e54aa76721ac62e63fb5585cd0a8c014a`. Exact tested source hashes live in
+the verification/native receipts. Advance the sync revision only after checking
+that each modeled boundary still corresponds to a real commit in the source.
+
+Run `python3 -B scripts/verify_alden_messenger_publication.py` using the pinned
+menu Python3.11 interpreter for local delivery checks. Current source must pass
+all15 isolated SQLite/source-boundary cases, and all3 temporary broken variants
+must fail. The checker does not write native sources, send messages, grant
+consent, launch models or alter installed Resources. It removes its temporary
+mutants. Reconfirm the actual controlled trace and retain a genuine counterexample
+if the check fails; do not weaken body-withholding or cursor-delivery properties.
+
+These are bounded behavioral/mutation checks. No whole-system mathematical
+proof, complete source-visibility guarantee, installed UI/combat verification or
+unbounded liveness follows. Runtime/private native probes, external review and
+release gates remain separate. Source/claim mismatch is a modeling error;
+a real violated invariant remains a product finding.

.agents/skills/verify-alden-realtime-state/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: verify-alden-realtime-state
+description: Verify Alden watcher retry, gate ordering and pending-input preservation after changes to realtime collection, scheduler ownership or SQLite error handling.
+---
+
+# Verify Alden realtime state
+
+Read `docs/evaluation/messenger-stream-20261021/STATE_VERIFICATION.md` from the
+repository root. The property is that transient SQLite contention preserves
+durable work and returns to a fresh gate check after a bounded wait; non-contention
+errors stay visible. This protects against silently losing the realtime worker
+or collecting when current source/control state is unknown.
+
+Coverage: `scripts/alden_realtime_collection.py:watch`, its calls to
+`CollectionStore.open_existing`, scheduler pause/abort/voice/cycle and realtime
+policy/scan/heartbeat. Tests are `tests/test_alden_realtime_collection.py` and
+`tests/test_alden_realtime_state.py`. This does not verify the scheduler's full
+publication protocol, source arrival, native readers, UI/combat or installed app.
+
+Baseline inspected: `1eb223652533fb47c66a8e888716c1088c134569`.
+Aligned implementation: `04b854b9600046d6b7549a038de58b026ed6e163`;
+watcher SHA-256 `3bdda372a926c64fe1394371d746e4aeb690a827d801ce341ce61cf235a59043`.
+Current source alignment is additionally bound by the SHA-256 in the generated
+verification receipt. Update this record to the delivered source commit only
+after confirming that the modeled boundaries still match that implementation.
+
+Run `python3 -B scripts/verify_alden_realtime_state.py` from the repository root.
+Use the pinned menu Python 3.11 runtime for local delivery verification. The
+checker runs 84 generated busy/control traces, two periodic retry cases, eight
+fatal-error cases (two ticks maximum), a real private SQLite-lock journey and
+two temporary mutations of actual source. Current code must pass and both
+broken variants must fail. No product source, native DB, consent, model, queue
+or installed Resources is changed; temporary variants are removed automatically.
+
+If a mutation is not rejected, inspect source-to-property alignment rather than
+weakening the property. If an intended source change makes a mutation anchor
+obsolete, review the new transition, update the discriminating broken variant
+and rerun. Preserve a genuine counterexample. Source changes, bound changes and
+test-oracle errors are distinct findings. This is bounded generated-input
+verification, not an unbounded mathematical proof or whole-project certification.