Preserve bundled Codex metadata during skill sync

[rudijetson]

Summary

rudi skills sync codex --force regenerates agents/openai.yaml from SKILL.md and discards bundle-owned Codex metadata. For explicit-only skills, this removes policy.allow_implicit_invocation: false.

The CLI should preserve a bundled agents/openai.yaml verbatim and retain synthesized metadata only as the fallback for flat or legacy skills without that file.

Evidence

• Registry source: catalog/skills/codex-tasks/agents/openai.yaml contains policy.allow_implicit_invocation: false.
• Registry contract tests assert that policy.
• Current CLI native lifecycle passes only SKILL.md content to buildCodexSkillFiles, creates interface-only YAML, and writes it over the Codex target.
• A behavior-level test reproduces the overwrite during exact-force reconciliation.

Affected Area

• src/native-skills/lifecycle.js
• src/__tests__/unit/native-skill-lifecycle.test.js
• Generated dist/index.cjs
• docs/swe-compliance/2026-09-02-codex-skill-metadata-sync.md

Invariants

• Bundle-owned agents/openai.yaml is the authoritative Codex metadata when present.
• Metadata is preserved byte-for-byte, including interface, dependency, policy, and future supported fields.
• Flat and bundled skills without metadata retain generated fallback behavior.
• Codex-specific metadata is not copied into Claude, Gemini, or Antigravity projections.
• Non-regular or symbolic-link metadata inputs fail closed.
• No install, activation, release, or cross-machine synchronization is part of this issue.

Risk Tier

Medium. This changes persistent, user-visible host metadata and invocation policy. It requires fresh-context independent review and human review of the affected boundary before merge.

SWE Checklist

• Phase 0: Baseline and manual lookup
• Phase 1: Scope lock
• Phase 2: Red test
• Phase 3: Implementation
• Phase 4: Green tests and refactor
• Phase 5: Full verification
• Phase 6: Docs, contracts, and pre-merge closure

Acceptance Criteria

• Forced Codex skill sync replaces stale target metadata with the exact bundled agents/openai.yaml.
• policy.allow_implicit_invocation: false survives sync.
• Existing generated-metadata fallback tests remain green.
• Focused test, full CLI suite, build, package dry-run, and JS/TS debt scan pass.
• Fresh-context review reports no unresolved blocking Standards, Spec, or Proof finding.
• A human reviews the metadata precedence boundary before merge.

Required Evidence

• Red and unchanged green commands with results.
• Full test-suite result.
• Build and npm pack --dry-run --json results.
• Focused debt scan result.
• Temporary-root smoke proof against the actual codex-tasks bundle.
• Independent-review verdict.
• Repository checklist path and final file list.

Delivery State

• Implementation PR: Fix Codex skill metadata projection #43 at pushed HEAD 15161ff744c3010f4a34bb2d3d0cfa50b084ecaf.
• Required quality workflow: passed on the final HEAD.
• Independent review: Standards pass, Spec pass, Proof pass, Overall pass, no findings.
• Repo Steward closeout: codex-skill-metadata-sync-20260902-closeout, retained version 3.
• Merge remains intentionally pending human review.

Notes / Out Of Scope

• No YAML parser or new dependency.
• No metadata schema redesign.
• No registry source change beyond using its existing bundle as proof.
• No live ~/.codex sync.
• Merge, release, installation, activation, deployment, and branch cleanup require separate authorization or a later gate.

[rudijetson]

Persistent SWE checklist: docs/swe-compliance/2026-09-02-codex-skill-metadata-sync.md. Current-main ownership is src/native-skills/lifecycle.js; the horizontal scan found no competing renderer, so the implementation will remain at that boundary.

[rudijetson]

Authorized issue-loop execution is complete at the pre-merge boundary. PR #43 is at pushed HEAD 15161ff744c3010f4a34bb2d3d0cfa50b084ecaf; final-head Quality run 33673475844 passed. Independent review returned Standards, Spec, Proof, and Overall pass with no findings. Repo Steward receipt codex-skill-metadata-sync-20260902-closeout is retained at version 3 with cleanup ineligible. Merge remains intentionally pending human review.