F168: harness skill operating discipline

[fall-out-bug]

Summary

• Adds research synthesis from the harness/agent-skills market scan and pi/Socratic review evidence.
• Applies Phase 1 cleanup from the synthesis: skill authoring requirements, tool-risk/degraded-evidence vocabulary, and anti-rationalization tables for build/review.
• Regenerates Codex/OpenCode/Pi skill adapters and records workstream 00-168-09 plus Beads issue sdplab-4cxu.

Review

Local review found and fixed one merge blocker before PR creation: docs/reference/skill-authoring.md still described .agents/skills as canonical, while sdp.manifest.yaml and .agents/skills/README.md make prompts/skills/<name>/SKILL.md the structured source and .agents/skills the runtime alias/stub surface. Commit f1e83f17 fixes that inconsistency.

Verification

• go run ./cmd/sdp manifest validate — PASS
• go run ./cmd/sdp generate-adapters --check — PASS
• go run ./cmd/sdp-protocol-check --lint-skills — PASS, 0 errors, 4 pre-existing warnings
• go run ./cmd/sdp-protocol-check --format json — PASS, pre-existing warnings only
• git diff --check — PASS
• go run ./cmd/sdp-doc-sync --mode check --strict — FAIL on 56 pre-existing repo-wide docs/backlog issues outside this PR scope

Merge Notes

• sdplab-4cxu remains in_progress until merge per repo policy.
• No runtime permission enforcement or model-routing measurement is claimed in this PR; those remain future phases.

[github-actions]

SDP Auto-Attestation

Field	Value
Branch	codex/harness-skill-synthesis
Commit	f1e83f17
Changed files	22
Tests	✅ pass (6129 passed, 0 failed)
Lint	✅
Scope	✅ no linked workstreams — auto-attested from CI observation
Attestation generation	✅
Coverage	⚠️ 65.28571428571429%
Signed	✅ Sigstore bundle
Beads	none

Full attestation report

{
  "all_lint_pass": true,
  "all_tests_pass": true,
  "attestation_id": "ci-auto-154-f1e83f17",
  "beads_ids": [],
  "branch": "codex/harness-skill-synthesis",
  "changed_files": 22,
  "coverage_ok": false,
  "coverage_pct": 65.28571428571429,
  "coverage_threshold": 80,
  "generated_at": "2026-05-15T09:12:12Z",
  "head_commit": "f1e83f17a94292366982a35037bd3e234358e992",
  "lint_results": [
    {
      "name": "go-vet",
      "status": "pass"
    },
    {
      "name": "golangci-lint",
      "status": "pass"
    }
  ],
  "out_of_scope": [],
  "scope_compliance": {
    "ok": true,
    "reason": "no linked workstreams — auto-attested from CI observation"
  },
  "test_results": [
    {
      "name": "go-test",
      "status": "pass (6129 passed, 0 failed)"
    }
  ],
  "type": "ci-auto-attestation"
}

Generated by SDP auto-attestation