update skills

Author: icecrasher321

.agents/skills/add-integration/SKILL.md

@@ -147,12 +147,13 @@ and leave the field unannotated.
   `mode: 'private-provenance'` when there is no textual projection. The route must call
   `validateOpaqueModelInputProvenance` before downloading or sending content to the model and must
   apply the workspace-file provenance guard before reading a persisted workspace file.
-- **Sim-owned durable storage** that can later re-enter a workflow/model (table cells, Agent
-  memory, knowledge documents/chunks, and workspace-file contents): transport encrypted
-  field-scoped provenance with
-  `request.secretProvenance`, persist it through the shared sidecar service, and load/import it at
-  every re-entry boundary. Preserve shared legacy behavior for rows/files whose provenance marker
-  is `NULL`; never invent a tool-local migration rule.
+- **Sim-owned durable storage or internal execution handoff** that can later enter a workflow/model
+  (table cells, Agent memory, knowledge documents/chunks, workspace-file contents, or child-workflow
+  input): transport encrypted field-scoped provenance with `request.secretProvenance`. The
+  authenticated receiver validates the exact selection and scope, strips the private envelope, and
+  persists, imports, or propagates it at the owning boundary. Preserve shared legacy behavior for
+  headerless internal calls and rows/files whose provenance marker is `NULL`; never invent a
+  tool-local migration rule.
 
 Hard rules:
 
@@ -592,7 +593,7 @@ If creating V2 versions (API-aligned outputs):
 - [ ] Created `index.ts` barrel export
 - [ ] Registered all tools in `tools/registry.ts`
 - [ ] Ran `bun run tool-metadata:generate` and committed the regenerated artifacts
-- [ ] Classified every model-visible, opaque, and Sim-durable request field
+- [ ] Classified every model-visible, opaque, Sim-durable, and internal-execution request field
 - [ ] Added shared model-input projection, centralized opaque rejection, or private provenance only
       where required
 - [ ] Confirmed ordinary third-party tool results are not generically sanitized

.agents/skills/add-tools/SKILL.md

@@ -145,6 +145,22 @@ export const {serviceName}{Action}Tool: ToolConfig<
 - Always explicitly set `required: true` or `required: false`
 - Optional params should have `required: false`
 
+## Resolved Secrets and Provenance Boundaries
+
+- Leave ordinary external API inputs and third-party results unchanged. Add provenance handling only
+  when an exact field is proven to cross a Sim model, durable-storage, or internal-execution boundary.
+- Project AI-consumed text/structured fields with the smallest exact `request.modelInput` selector.
+- Reject resolved secrets in opaque model input sent directly to an external provider with
+  `request.opaqueModelInput`; never attach private metadata to an external URL or `directExecution`.
+- For authenticated internal routes, use `privateProvenance` for opaque model input or
+  `request.secretProvenance` for durable writes and execution handoffs. Authenticate first, validate
+  the exact selection and scope, strip the private envelope, then import or propagate provenance at
+  the receiving boundary. Preserve documented headerless legacy behavior.
+- Never substitute secret plaintext into source, serialize plaintext provenance, hand-roll private
+  headers, or blanket-sanitize tool results.
+- Add focused tests for named projection, identical unproven public text, malformed/incomplete
+  metadata, metadata stripping, scope isolation, and legacy compatibility where applicable.
+
 ## Critical Rules for Outputs
 
 ### Output Types
@@ -456,6 +472,9 @@ All tool IDs MUST use `snake_case`: `{service}_{action}` (e.g., `x_create_tweet`
 - [ ] Tools registered in `tools/registry.ts`
 - [ ] `bun run tool-metadata:generate` run and the regenerated artifacts committed
 - [ ] Block wired: `tools.access`, dropdown options, subBlocks, `tools.config`, outputs, inputs
+- [ ] Model, durable-storage, and internal-execution boundaries use the shared provenance mechanisms
+      only where a concrete Sim `{{...}}` resolution path requires them
+- [ ] Ordinary third-party inputs/results remain unchanged and private metadata never leaves Sim
 
 ## Final Validation (Required)
 

.agents/skills/validate-integration/SKILL.md

@@ -151,8 +151,9 @@ search, extraction, or "AI-powered" marketing terminology.
 - [ ] Persisted workspace-file contents are checked with the shared provenance guard only when
       their bytes or decoded content cross into a model/tool-result boundary; ordinary file APIs
       remain unchanged. Unsupported secret-bearing file paths are rejected at `file_write`
-- [ ] Sim-owned durable writes that can re-enter workflows/models use field-scoped
-      `request.secretProvenance` and the shared sidecar/load/import services
+- [ ] Sim-owned durable writes and internal execution handoffs that can enter workflows/models use
+      field-scoped `request.secretProvenance`; authenticated receivers validate the exact selection
+      and scope, strip private metadata, and persist, import, or propagate it at the owning boundary
 - [ ] Private provenance is never attached to external URLs or `directExecution`; those paths use
       centralized `opaqueModelInput` rejection when their opaque values are model-bound
 - [ ] No tool performs raw secret plaintext/source substitution or serializes plaintext provenance
@@ -170,9 +171,10 @@ search, extraction, or "AI-powered" marketing terminology.
       or I/O with safe-byte preservation, headerless legacy requests, metadata stripping, and
       durable legacy/stale/scope cases when applicable
 
-Treat a missing or bypassed model/durable provenance boundary as **critical**. Do not fix it with a
-tool-specific string replacer or by sanitizing every provider result; repair the shared request,
-authenticated internal-route, persistence, or re-entry boundary that owns the data.
+Treat a missing or bypassed model, durable, or internal-execution provenance boundary as
+**critical**. Do not fix it with a tool-specific string replacer or by sanitizing every provider
+result; repair the shared request, authenticated internal-route, persistence, or re-entry boundary
+that owns the data.
 
 ## Step 4: Validate Block
 
@@ -349,7 +351,8 @@ Group findings by severity:
 - AI-consumed request fields bypass the shared projection, centralized opaque rejection, or
   private-provenance boundary
 - Opaque model input is downloaded or sent before provenance and workspace-file checks
-- A Sim-owned durable sink/re-entry path drops encrypted provenance or breaks legacy `NULL` data
+- A Sim-owned durable sink or internal execution handoff drops encrypted provenance or breaks
+  legacy headerless/`NULL` data
 - A tool substitutes secret plaintext into source, leaks private metadata, or generically sanitizes
   unrelated third-party results
 
@@ -426,7 +429,8 @@ After fixing, confirm:
 - [ ] Validated memory load safety using `.agents/skills/memory-load-check/SKILL.md` when tools list/search/download/import/export/batch data
 - [ ] Validated error handling (error checks, meaningful messages)
 - [ ] Validated registry entries (tools and block, alphabetical, correct imports)
-- [ ] Validated model-visible/opaque inputs and Sim-durable provenance at their owning boundaries
+- [ ] Validated model-visible/opaque inputs and Sim-durable/internal-execution provenance at their
+      owning boundaries
 - [ ] Confirmed legacy persisted data keeps working and tracked invalid provenance fails closed
 - [ ] Confirmed ordinary third-party results remain unchanged absent activated Sim provenance
 - [ ] Validated `{Service}BlockMeta` exported with at least 7 templates

.claude/commands/add-integration.md

@@ -146,12 +146,13 @@ and leave the field unannotated.
   `mode: 'private-provenance'` when there is no textual projection. The route must call
   `validateOpaqueModelInputProvenance` before downloading or sending content to the model and must
   apply the workspace-file provenance guard before reading a persisted workspace file.
-- **Sim-owned durable storage** that can later re-enter a workflow/model (table cells, Agent
-  memory, knowledge documents/chunks, and workspace-file contents): transport encrypted
-  field-scoped provenance with
-  `request.secretProvenance`, persist it through the shared sidecar service, and load/import it at
-  every re-entry boundary. Preserve shared legacy behavior for rows/files whose provenance marker
-  is `NULL`; never invent a tool-local migration rule.
+- **Sim-owned durable storage or internal execution handoff** that can later enter a workflow/model
+  (table cells, Agent memory, knowledge documents/chunks, workspace-file contents, or child-workflow
+  input): transport encrypted field-scoped provenance with `request.secretProvenance`. The
+  authenticated receiver validates the exact selection and scope, strips the private envelope, and
+  persists, imports, or propagates it at the owning boundary. Preserve shared legacy behavior for
+  headerless internal calls and rows/files whose provenance marker is `NULL`; never invent a
+  tool-local migration rule.
 
 Hard rules:
 
@@ -591,7 +592,7 @@ If creating V2 versions (API-aligned outputs):
 - [ ] Created `index.ts` barrel export
 - [ ] Registered all tools in `tools/registry.ts`
 - [ ] Ran `bun run tool-metadata:generate` and committed the regenerated artifacts
-- [ ] Classified every model-visible, opaque, and Sim-durable request field
+- [ ] Classified every model-visible, opaque, Sim-durable, and internal-execution request field
 - [ ] Added shared model-input projection, centralized opaque rejection, or private provenance only
       where required
 - [ ] Confirmed ordinary third-party tool results are not generically sanitized

.claude/commands/add-tools.md

@@ -144,6 +144,22 @@ export const {serviceName}{Action}Tool: ToolConfig<
 - Always explicitly set `required: true` or `required: false`
 - Optional params should have `required: false`
 
+## Resolved Secrets and Provenance Boundaries
+
+- Leave ordinary external API inputs and third-party results unchanged. Add provenance handling only
+  when an exact field is proven to cross a Sim model, durable-storage, or internal-execution boundary.
+- Project AI-consumed text/structured fields with the smallest exact `request.modelInput` selector.
+- Reject resolved secrets in opaque model input sent directly to an external provider with
+  `request.opaqueModelInput`; never attach private metadata to an external URL or `directExecution`.
+- For authenticated internal routes, use `privateProvenance` for opaque model input or
+  `request.secretProvenance` for durable writes and execution handoffs. Authenticate first, validate
+  the exact selection and scope, strip the private envelope, then import or propagate provenance at
+  the receiving boundary. Preserve documented headerless legacy behavior.
+- Never substitute secret plaintext into source, serialize plaintext provenance, hand-roll private
+  headers, or blanket-sanitize tool results.
+- Add focused tests for named projection, identical unproven public text, malformed/incomplete
+  metadata, metadata stripping, scope isolation, and legacy compatibility where applicable.
+
 ## Critical Rules for Outputs
 
 ### Output Types
@@ -455,6 +471,9 @@ All tool IDs MUST use `snake_case`: `{service}_{action}` (e.g., `x_create_tweet`
 - [ ] Tools registered in `tools/registry.ts`
 - [ ] `bun run tool-metadata:generate` run and the regenerated artifacts committed
 - [ ] Block wired: `tools.access`, dropdown options, subBlocks, `tools.config`, outputs, inputs
+- [ ] Model, durable-storage, and internal-execution boundaries use the shared provenance mechanisms
+      only where a concrete Sim `{{...}}` resolution path requires them
+- [ ] Ordinary third-party inputs/results remain unchanged and private metadata never leaves Sim
 
 ## Final Validation (Required)
 

.claude/commands/validate-integration.md

@@ -150,8 +150,9 @@ search, extraction, or "AI-powered" marketing terminology.
 - [ ] Persisted workspace-file contents are checked with the shared provenance guard only when
       their bytes or decoded content cross into a model/tool-result boundary; ordinary file APIs
       remain unchanged. Unsupported secret-bearing file paths are rejected at `file_write`
-- [ ] Sim-owned durable writes that can re-enter workflows/models use field-scoped
-      `request.secretProvenance` and the shared sidecar/load/import services
+- [ ] Sim-owned durable writes and internal execution handoffs that can enter workflows/models use
+      field-scoped `request.secretProvenance`; authenticated receivers validate the exact selection
+      and scope, strip private metadata, and persist, import, or propagate it at the owning boundary
 - [ ] Private provenance is never attached to external URLs or `directExecution`; those paths use
       centralized `opaqueModelInput` rejection when their opaque values are model-bound
 - [ ] No tool performs raw secret plaintext/source substitution or serializes plaintext provenance
@@ -169,9 +170,10 @@ search, extraction, or "AI-powered" marketing terminology.
       or I/O with safe-byte preservation, headerless legacy requests, metadata stripping, and
       durable legacy/stale/scope cases when applicable
 
-Treat a missing or bypassed model/durable provenance boundary as **critical**. Do not fix it with a
-tool-specific string replacer or by sanitizing every provider result; repair the shared request,
-authenticated internal-route, persistence, or re-entry boundary that owns the data.
+Treat a missing or bypassed model, durable, or internal-execution provenance boundary as
+**critical**. Do not fix it with a tool-specific string replacer or by sanitizing every provider
+result; repair the shared request, authenticated internal-route, persistence, or re-entry boundary
+that owns the data.
 
 ## Step 4: Validate Block
 
@@ -348,7 +350,8 @@ Group findings by severity:
 - AI-consumed request fields bypass the shared projection, centralized opaque rejection, or
   private-provenance boundary
 - Opaque model input is downloaded or sent before provenance and workspace-file checks
-- A Sim-owned durable sink/re-entry path drops encrypted provenance or breaks legacy `NULL` data
+- A Sim-owned durable sink or internal execution handoff drops encrypted provenance or breaks
+  legacy headerless/`NULL` data
 - A tool substitutes secret plaintext into source, leaks private metadata, or generically sanitizes
   unrelated third-party results
 
@@ -425,7 +428,8 @@ After fixing, confirm:
 - [ ] Validated memory load safety using `.agents/skills/memory-load-check/SKILL.md` when tools list/search/download/import/export/batch data
 - [ ] Validated error handling (error checks, meaningful messages)
 - [ ] Validated registry entries (tools and block, alphabetical, correct imports)
-- [ ] Validated model-visible/opaque inputs and Sim-durable provenance at their owning boundaries
+- [ ] Validated model-visible/opaque inputs and Sim-durable/internal-execution provenance at their
+      owning boundaries
 - [ ] Confirmed legacy persisted data keeps working and tracked invalid provenance fails closed
 - [ ] Confirmed ordinary third-party results remain unchanged absent activated Sim provenance
 - [ ] Validated `{Service}BlockMeta` exported with at least 7 templates

.cursor/commands/add-integration.md

@@ -141,12 +141,13 @@ and leave the field unannotated.
   `mode: 'private-provenance'` when there is no textual projection. The route must call
   `validateOpaqueModelInputProvenance` before downloading or sending content to the model and must
   apply the workspace-file provenance guard before reading a persisted workspace file.
-- **Sim-owned durable storage** that can later re-enter a workflow/model (table cells, Agent
-  memory, knowledge documents/chunks, and workspace-file contents): transport encrypted
-  field-scoped provenance with
-  `request.secretProvenance`, persist it through the shared sidecar service, and load/import it at
-  every re-entry boundary. Preserve shared legacy behavior for rows/files whose provenance marker
-  is `NULL`; never invent a tool-local migration rule.
+- **Sim-owned durable storage or internal execution handoff** that can later enter a workflow/model
+  (table cells, Agent memory, knowledge documents/chunks, workspace-file contents, or child-workflow
+  input): transport encrypted field-scoped provenance with `request.secretProvenance`. The
+  authenticated receiver validates the exact selection and scope, strips the private envelope, and
+  persists, imports, or propagates it at the owning boundary. Preserve shared legacy behavior for
+  headerless internal calls and rows/files whose provenance marker is `NULL`; never invent a
+  tool-local migration rule.
 
 Hard rules:
 
@@ -586,7 +587,7 @@ If creating V2 versions (API-aligned outputs):
 - [ ] Created `index.ts` barrel export
 - [ ] Registered all tools in `tools/registry.ts`
 - [ ] Ran `bun run tool-metadata:generate` and committed the regenerated artifacts
-- [ ] Classified every model-visible, opaque, and Sim-durable request field
+- [ ] Classified every model-visible, opaque, Sim-durable, and internal-execution request field
 - [ ] Added shared model-input projection, centralized opaque rejection, or private provenance only
       where required
 - [ ] Confirmed ordinary third-party tool results are not generically sanitized

.cursor/commands/add-tools.md

@@ -139,6 +139,22 @@ export const {serviceName}{Action}Tool: ToolConfig<
 - Always explicitly set `required: true` or `required: false`
 - Optional params should have `required: false`
 
+## Resolved Secrets and Provenance Boundaries
+
+- Leave ordinary external API inputs and third-party results unchanged. Add provenance handling only
+  when an exact field is proven to cross a Sim model, durable-storage, or internal-execution boundary.
+- Project AI-consumed text/structured fields with the smallest exact `request.modelInput` selector.
+- Reject resolved secrets in opaque model input sent directly to an external provider with
+  `request.opaqueModelInput`; never attach private metadata to an external URL or `directExecution`.
+- For authenticated internal routes, use `privateProvenance` for opaque model input or
+  `request.secretProvenance` for durable writes and execution handoffs. Authenticate first, validate
+  the exact selection and scope, strip the private envelope, then import or propagate provenance at
+  the receiving boundary. Preserve documented headerless legacy behavior.
+- Never substitute secret plaintext into source, serialize plaintext provenance, hand-roll private
+  headers, or blanket-sanitize tool results.
+- Add focused tests for named projection, identical unproven public text, malformed/incomplete
+  metadata, metadata stripping, scope isolation, and legacy compatibility where applicable.
+
 ## Critical Rules for Outputs
 
 ### Output Types
@@ -450,6 +466,9 @@ All tool IDs MUST use `snake_case`: `{service}_{action}` (e.g., `x_create_tweet`
 - [ ] Tools registered in `tools/registry.ts`
 - [ ] `bun run tool-metadata:generate` run and the regenerated artifacts committed
 - [ ] Block wired: `tools.access`, dropdown options, subBlocks, `tools.config`, outputs, inputs
+- [ ] Model, durable-storage, and internal-execution boundaries use the shared provenance mechanisms
+      only where a concrete Sim `{{...}}` resolution path requires them
+- [ ] Ordinary third-party inputs/results remain unchanged and private metadata never leaves Sim
 
 ## Final Validation (Required)