feat(autonomi): land the task-routed prototype (0.1.4 install/freshness repair)

[JimCollinson]

Summary

Replaces the June operator-only skill with the autonomi prototype (0.1.4): one task-routed skill for reading and storing data, setting up the CLI, building on Autonomi, and running nodes. The retired operator skill remains archived under docs/archive/operator-skill-v0/.

This head also reconciles the prototype with the policy and current-state corrections from merged PR #12: channel-owned updates, default-deny remit, source provenance, platform truth, security wording, and the renamed ADR-0013. Merge commit 8fde1cbeb727fb94625419c1de4a1c5c687241f5 changed no shipped skill or plugin file, so all version surfaces correctly remain at 0.1.4.

Prototype surface

• skills/autonomi/SKILL.md: task routing, identity-checked setup/removal, key and spend boundaries, tool freshness, and source table.
• skills/autonomi/VERSION: 0.1.4 release metadata.
• Four bundled references: install/verify, wallet/tokens, run nodes, and build on Autonomi.
• .claude-plugin/ manifests: both at 0.1.4; the repository root is the physical plugin package while only skills/autonomi/ is loaded as skill instructions.
• Supported routes: skills.sh, Claude Code plugin, and direct/manual installation. OpenClaw/ClawHub remains future work.

Security boundaries

• The agent never asks for, accepts, reads, prints, transmits, or generates a private key.
• Nodes receive a public rewards address only.
• Paid writes use a SECRET_KEY provisioned outside the conversation, or the person runs the command.
• Spending is quote-show-wait unless the person explicitly waives that pause within a stated limit.
• Installation is detect-first and read-before-run; the manual route verifies the release checksum. Script installers do not yet verify checksums/signatures, so universally verified delivery is a target rather than a current claim.
• Uninstall is binary-only by default and never treats testing or one-off installation as cleanup authority.
• The installed skill makes no request solely to check its own version and never inspects or modifies its installation.

Verification at exact head

Current head: 5c2f3bb9f5bc05aff228ed958a0f0f728b703330.

• Local ADR governance passed for all 14 ADRs; every ADR remains Proposed and no Accepted ADR changed.
• Exact-head GitHub ADR Governance passed.
• Branch-wide git diff --check origin/main...HEAD passed.
• npx skills add ./ --list discovered exactly one autonomi skill.
• Equivalent frontmatter validation passed: description 1,021 characters, compatibility 332 characters. skills-ref is unavailable in this environment.
• All four version surfaces report 0.1.4; plugin manifests parse as JSON.
• SKILL.md is 253 lines and every reference is below 200 lines.
• Vocabulary lint found only the accepted product phrase permanence tier.
• Local copied install passed in an isolated Git project and home; SKILL.md, VERSION, and bundled references were present and byte-identical.
• Private GitHub branch install passed at parent 54662fd36ea3f13e8a2f10f1f07046ce0ebbf9dc from autonomi-skill-prototype in a second isolated project/home, using the runner's existing GitHub token only for clone authentication; copied skill and version were byte-identical to that checkout. The final commit changes only the two evidence notes; skills/ and .claude-plugin/ are byte-identical to the tested parent.
• Checksum-verified disposable install of ant 0.3.6 passed on macOS arm64.
• Scenario A's free-read path connected to 5 peers and downloaded the example as a valid 135.7 KB JPEG in 17.5 seconds (SHA-256 98f657d987d339c302295e79907e7a4abc1564bd6b42300ea8d59ccd2148fd17).

No real-home, wallet-key, spend, paid write, or node action occurred. One initial free-read attempt using only an existing binary stopped safely because the isolated home had no bootstrap file; completing the documented manual install supplied it. The first copied-install invocation also targeted the worktree by mistake; it created only untracked test files, which were removed before the clean isolated rerun. Neither event changed tracked files or weakened a check.

Snyk, Fable, a new broad adversarial review, Craft Review, trigger evaluation, Windows, paid-write, and node scenarios were intentionally excluded by the approved reconciliation packet. Earlier repair/review evidence remains in planning/evidence/2026-Sep-04-pr13-repair.md; the current work packet is planning/packets/PACKET-pr13-post-pr12-reconciliation.md.

ADR and design state

All ADRs remain Proposed. Jim directed that broader contradictions between this prototype and the operator-era ADR/design set be revised from prototype evidence rather than blocking this merge. Binary-only uninstall remains an explicit temporary divergence from Proposed ADR-0008 and DESIGN §6.

The intended later direction is now preserved: a bundled operational core with optional external depth, and a declared recovery path at creation for every future agent-created wallet. No agent-created wallet path exists in this prototype.

Remaining gates

• Manual Hermes review of this exact head.
• Jim's human merge decision.
• Do not merge, publish, or change repository visibility without Jim's explicit approval.

Older-copy channel updates, broader live scenarios, Snyk, trigger evaluation, Windows testing, the public flip, website changes, and Proposed-ADR revision remain later work, not hidden passes.

Review focus

• Start with README.md, skills/autonomi/SKILL.md, planning/HANDOFF.md, and docs/CURRENT.md.
• Confirm PR docs(adr): reconcile freshness, authority, and current state #12 policy survived without changing the prototype's task-routed behavior, key/spend boundaries, or binary-only uninstall.
• Confirm docs/adr/ADR-0013-skill-freshness-and-channel-owned-updates.md is the sole ADR-0013 and every ADR is still Proposed.

Agent-authored with Jim directing the product, safety, and review-scope decisions. Ready for manual Hermes review, not merge.