feat(skills): add knowledge adoption workflow

[drewstone]

Problem

The knowledge package ships broad KB, RAG, memory, provider, and improvement APIs without a compact implementation workflow.

Change

• Add a 4.8 KB source-first skill covering new and existing KBs, retrieval, memory adapters, isolated candidates, parallel work, resume, and promotion.

• Ship and validate the skill in the package artifact.

Proof- Typecheck, build, clean package install, five import probes, CLI, skill presence, and repack pass.

• Tests: 46 files passed; 428 tests passed and 10 skipped.

[tangletools]

✅ Auto-approved drewstone PR — 0f967b7f

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-23T03:17:51Z}

[tangletools]

⚠️ Review Interrupted — 0f967b7f

The review runner stopped before publishing a final verdict: webhook_restarted.

State	Detail
Interrupted	webhook restarted

No review verdict was produced for this run. Trigger a fresh review on the current PR head if the PR is still open.

_{tangletools · #75 · model: kimi-for-coding · updated 2026-07-23T03:19:08Z}

[tangletools]

✅ Auto-approved drewstone PR — 0f967b7f

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-23T03:21:17Z}

[tangletools]

✅ No Blockers — 0f967b7f

Review health 100/100 · Reviewer score 77/100 · Confidence 80/100 · 6 findings (6 low)

glm: Correctness 77 · Security 77 · Testing 77 · Architecture 77

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 4/4 planned shots over 4 changed files. Global verifier still owns final merge decision.

🟡 LOW verify:package uses pnpm run instead of direct node invocation — package.json

pnpm run check:skills && node scripts/verify-package.mjs mixes pnpm-run and direct-node invocation styles. Minor inconsistency; harmless because packageManager is pinned to pnpm@10.28.0. No action required.

🟡 LOW Empty skills/ directory reports 'skills valid' instead of erroring — scripts/check-skills.mjs

If readdirSync(root) returns no skill directories (e.g. skills/ is accidentally emptied or a skill dir is renamed without its SKILL.md), the for-loop body never executes, errors stays [], and the script prints 'skills valid: 0 description chars' with exit 0. The '0 description chars' is the only hint. Confirmed by reproduction: created an empty skills/ subdir, ran the script, got 'skills valid: 0 description chars' exit=0. Since this script gates verify:package and thus publish readiness, a false-green on zero skills could let a broken publish through. Fix: add if (descriptionChars === 0) errors.push('no skills found') or track a skillCount and assert > 0.

🟡 LOW Frontmatter regex requires LF line endings; CRLF files get misleading 'missing YAML frontmatter' error — scripts/check-skills.mjs

The regex /^---\n([\s\S]*?)\n---(?:\n|$)/ hardcodes \n. A SKILL.md saved with CRLF endings (\r\n) will not match, producing the error 'missing YAML frontmatter' even though the frontmatter is valid YAML. Confirmed by reproduction: wrote a CRLF SKILL.md to /tmp, ran the script, got exit=1 with 'crlf-skill: missing YAML frontmatter'. The repo uses Biome which enforces LF, so this is unlikely to trigger today, but a contributor who edits a SKILL.md outside the formatter would hit a confusing error. Fix: use /\r?\n/ in the regex anchors, or normalize content via content.replace(/\r\n/g, '\n') before matching.

🟡 LOW No test coverage for the lint script — scripts/check-skills.mjs

The repo has 27 vitest test files under tests/ but none exercise scripts/check-skills.mjs. The script enforces three invariants (name matches dir, description <= 96 chars, '## Then consider' is the final H2) that could regress silently. A minimal test would seed a tmp skills/ tree with a valid skill, a skill with a too-long description, and a skill with a misplaced footer, then assert exit codes and error output. Low severity because the script is small (57 lines) and self-evident, but it is now a publish gate.

🟡 LOW Substring assertion is loose, not a frontmatter parse — scripts/verify-package.mjs

installedSkill.includes('name: build-with-agent-knowledge') would also match a malformed entry like 'x-name: build-with-agent-knowledge-extra' or a name buried in prose. Low impact because the source skill is repo-controlled and check-skills.mjs already enforces strict YAML shape upstream in the same verify:package pipeline. If you ever want this to be a true gate, parse the frontmatter name field instead of substring matching.

🟡 LOW Footer references skill 'eval-engineering' not present in installed skill set — skills/build-with-agent-knowledge/SKILL.md

Line 94: '- eval-engineering when new production-derived cases are needed.' The installed skill list contains eval-agent, eval-harness-diagnose, calibrate-before-measure, hypothesize — no eval-engineering. Global doctrine (AGENTS.md 'Skills chain forward') explicitly allows forward references to unknown peers and tells readers to discover dynamically, and check-skills.mjs does not validate cross-refs, so this is not a CI failure. Impact: an agent following the footer will search for eval-engineering, miss, and have to pick the closest match itself — usually eval-agent (rubric/case generation) or calibrate-before-measure (case-difficulty gating)

---

_{tangletools · 2026-07-23T03:33:56Z · trace}

[tangletools]

✅ Approved — 6 non-blocking findings — 0f967b7f

Full multi-shot audit completed 4/4 planned shots over 4 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-07-23T03:33:56Z · immutable trace}

[tangletools]

✅ Auto-approved drewstone PR — e698c218

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-23T03:39:19Z}

[tangletools]

✅ Auto-approved drewstone PR — b098eddf

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-23T03:48:54Z}