feat: skill_routing role-capability conformance axis (ORRO #91, Depone-first) - #104
Merged
Conversation
…skills, ORRO #91) Co-Authored-By: Codex (gpt-5.5) <noreply@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First half of ORRO #91 (spec: ORRO
docs/superpowers/specs/2026-07-21-skill-routing-conformance-design.md). Adds skill_routing as a third role-capability conformance axis, peer totool_callsandwrite_scope.A run declares
role_capability_skill_routing: {forbidden_skills, preferred_skills, enforcement}; witnessd (later PR) emits a boundobserved-skills.txt; Depone verifies the binding and re-derives whether any observed skill matches a forbidden entry, emittingERR_ROLE_CAPABILITY_SKILL_ROUTING_VIOLATION.Mirrors
role_capability_write_scopeexactly — new schemav110.role_capability_skill_routing, the SAME bound-observation/signature/trust-anchor machinery (_load_bound_run_intent+_validate_bound_observation), and the full fixture set (pass, pass_bound_observation, fail, fail_observation_unbound, fail_observation_tampered, fail_unsigned, fail_bad_signature, fail_no_trust_anchor). Trust lives in the tamper-evident binding, never a self-reported value.enforcement:
block(default) → violation blocks like write_scope;advisory→ violation still reported (RoleCapabilityConformance status=fail) but filtered from the blocking set. A0/A1/A2 unchanged (conformance axis, not an assurance input).Verification (independent, Opus): full suite 449 tests, only the 1 pre-existing failure, 0 new; forbidden matching (exact + glob), advisory non-blocking, v110-schema-required, unbound/tampered refutation all tested; mutation-checked (neutering the forbidden-match reddens the fail tests; neutering the bound-observation guard reddens the unbound/tampered refutation tests).
🤖 Generated with Claude Code