amr/memex
1
0
Fork 0
Code Issues 12 Pull Requests Actions Packages Projects 1 Releases Wiki Activity
Files
dcf6c793715f488f0b5e6e55f5749210febd7569
memex/notes/v1-0-skill-audit-track.org

11 KiB
Raw Blame History

AUDIT: V1.0 Comprehensive Core Skill Audit

Overview

This audit systematically reviews the 39 core skills of the Org-Agent for compliance with the V1.0 standards:

  1. Safety: Prevention of code injection, proper sandboxing, and actuator safety.
  2. Merkle-Tree Integration: Proper use of the native Lisp Merkle-Tree versioning for undo/rollback.
  3. Core Invariants: Adherence to Sovereignty, Mastery, Zero-Bloat, Transparency, and Sustainability.

Audit Progress [6/28]

DONE org-skill-agent.org [X]

  • COMPLIANT: Correctly defines and enforces Core Invariants.
  • SAFETY: High. Implements baseline symbolic gating.
  • MERKLE: N/A (Read-only/Policy only).

DONE org-skill-llm-gateway.org [X]

  • COMPLIANT: Consolidates 6 providers into a single high-integrity gate.
  • SAFETY: HIGH. Fixed URL key leaks, standardized headers, and centralized credential masking.
  • MERKLE: N/A (Stateless dispatch).

DONE org-skill-credentials-vault.org [X]

  • COMPLIANT: Unified high-security enclave for API keys and cookies.
  • SAFETY: HIGH. Mandatory credential masking in logs and secure Object Store persistence.
  • MERKLE: COMPLIANT. Setting secrets triggers Merkle snapshots.

DONE org-skill-homoiconic-memory.org [X]

  • COMPLIANT: Unified grammar, bridge, and normalization.
  • SAFETY: HIGH. recursive AST walker for ID injection and structural validation.
  • MERKLE: COMPLIANT. Normalization occurs during ingest/save, which are Merkle-versioned events.

DONE org-skill-state-persistence.org [X]

  • COMPLIANT: Unified local SBCL image dumps with decentralized IPFS checkpointing.
  • SAFETY: HIGH. Implements safe restoration paths and credential masking.
  • MERKLE: COMPLIANT. This is the primary persistence layer for the Merkle-Tree object store.

DONE org-skill-event-orchestrator.org [X]

  • COMPLIANT: Unified Cron, Hooks, and Routing into a single central control unit.
  • SAFETY: HIGH. Implements error isolation for automated tasks and hooks.
  • MERKLE: COMPLIANT. Registering hooks or tasks triggers Merkle snapshots.

DONE org-skill-cron.org [X] (CONSOLIDATED -> org-skill-event-orchestrator.org)

DONE org-skill-hook-manager.org [X] (CONSOLIDATED -> org-skill-event-orchestrator.org)

DONE org-skill-router.org [X] (CONSOLIDATED -> org-skill-event-orchestrator.org)

DONE org-skill-memory-archivist.org [X] (CONSOLIDATED -> org-skill-state-persistence.org)

DONE org-skill-object-store-persistence.org [X] (CONSOLIDATED -> org-skill-state-persistence.org)

DONE org-skill-ast-normalization.org [X] (CONSOLIDATED -> org-skill-homoiconic-memory.org)

DONE org-skill-org-json-bridge.org [X] (CONSOLIDATED -> org-skill-homoiconic-memory.org)

DONE org-skill-org-mode.org [X] (CONSOLIDATED -> org-skill-homoiconic-memory.org)

DONE org-skill-auth-api-key.org [X] (CONSOLIDATED -> org-skill-credentials-vault.org)

DONE org-skill-auth-google-oauth.org [X] (CONSOLIDATED -> org-skill-credentials-vault.org)

DONE org-skill-provider-anthropic.org [X] (CONSOLIDATED -> org-skill-llm-gateway.org)

DONE org-skill-provider-gemini.org [X] (CONSOLIDATED -> org-skill-llm-gateway.org)

DONE org-skill-provider-groq.org [X] (CONSOLIDATED -> org-skill-llm-gateway.org)

DONE org-skill-provider-ollama.org [X] (CONSOLIDATED -> org-skill-llm-gateway.org)

DONE org-skill-provider-openai.org [X] (CONSOLIDATED -> org-skill-llm-gateway.org)

DONE org-skill-provider-openrouter.org [X] (CONSOLIDATED -> org-skill-llm-gateway.org)

DONE org-skill-chaos.org [ ]

  • STATUS: NON-COMPLIANT (Safety/Sovereignty Violation)
  • ISSUE: Lacks an "Active Production" gate to prevent accidental chaos during real work. No Merkle-Tree checkpoints before/after stress tests to allow for full-system rollback.
  • SAFETY: MEDIUM (Adversarial by design, but ungated).
  • MERKLE: FAILED.

DONE org-skill-chat.org [ ]

  • STATUS: NON-COMPLIANT (Safety/Technical Mastery Violation)
  • ISSUE: Uses `read-from-string` on unverified LLM output, risking reader macro injection. No Merkle-Tree integration for chat history persistence or rollbacks.
  • SAFETY: LOW (Vulnerable to injection).
  • MERKLE: FAILED.

DONE org-skill-consensus.org [ ]

  • STATUS: NON-COMPLIANT (Technical Mastery/Sovereignty Violation)
  • ISSUE: Implementation is a "stub" and lacks actual networking, state persistence, or Byzantine fault tolerance as claimed. No Merkle-Tree integration for cross-instance state synchronization.
  • SAFETY: LOW (Unverified consensus).
  • MERKLE: FAILED.

DONE org-skill-context-manager.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for context stack snapshots or rollbacks.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-delegation.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for delegation history or state rollbacks.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-environment-config.org [ ]

  • STATUS: NON-COMPLIANT (Safety/Technical Mastery Violation)
  • ISSUE: No validation or authorization gating for configuration changes. Direct hash-table modification skips the new Merkle-Tree versioning system in the Object Store.
  • SAFETY: MEDIUM (Risk of misconfiguration).
  • MERKLE: FAILED.

DONE org-skill-formal-verification.org [ ]

  • STATUS: NON-COMPLIANT (Technical Mastery/Sovereignty Violation)
  • ISSUE: Implementation is a "mock" and lacks actual integration with an SMT solver (Z3). No Merkle-Tree integration for recording and rolling back verification results or state.
  • SAFETY: LOW (Unverified verification).
  • MERKLE: FAILED.

DONE org-skill-function-calling.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for recording and rolling back tool-use history or state.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-inbound-gateway.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for recording and rolling back inbound message history or state.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-inbox-processor.org [ ]

  • STATUS: NON-COMPLIANT (Safety/Technical Mastery Violation)
  • ISSUE: Physical move logic is a "Simulation". No implementation of actual file refactoring. No Merkle-Tree integration for recording or rolling back inbox-related state changes.
  • SAFETY: MEDIUM (Simulation only).
  • MERKLE: FAILED.

DONE org-skill-latent-reflection.org [ ]

  • STATUS: NON-COMPLIANT (Safety/Technical Mastery Violation)
  • ISSUE: No validation or authorization gating for reflected state changes. Random sampling is inefficient. No Merkle-Tree integration for recording or rolling back reflected state changes.
  • SAFETY: MEDIUM (Risk of unintended modifications).
  • MERKLE: FAILED.

DONE org-skill-lisp-machine-bootstrap.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for recording or rolling back bootstrap-related state changes or ISA simulation history.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-log-aggregator.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for recording or rolling back log-related state changes or observability history.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-memex.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for recording or rolling back memex-related state changes or metadata audits.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-model-explorer.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code or blueprint. The skill is only a title and overview. No Merkle-Tree integration for model discovery or state changes.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-onboarding.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for recording or rolling back onboarding-related state changes or environment calibration.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-safety-harness.org [ ]

  • STATUS: NON-COMPLIANT (Safety/Technical Mastery Violation)
  • ISSUE: No validation or authorization gate for dynamic symbol registration. No Merkle-Tree integration for recording or rolling back safety-related state changes or verification history.
  • SAFETY: HIGH (The core of the system's safety).
  • MERKLE: FAILED.

DONE org-skill-self-fix.org [ ]

  • STATUS: NON-COMPLIANT (Safety/Technical Mastery Violation)
  • ISSUE: No validation or authorization gate for proposed self-fixes. Fixes are applied directly to files. No Merkle-Tree integration for recording or rolling back self-fix-related state changes or repair history.
  • SAFETY: LOW (Risk of unintended/malicious modifications).
  • MERKLE: FAILED.

DONE org-skill-shell-actuator.org [ ]

  • STATUS: NON-COMPLIANT (Safety/Sovereignty Violation)
  • ISSUE: No validation or authorization gate for synthesized script execution. Script synthesis bypasses the shell whitelist. No Merkle-Tree integration for recording or rolling back shell-related state changes or command history.
  • SAFETY: MEDIUM (Whitelisted, but script synthesis is a gap).
  • MERKLE: FAILED.

DONE org-skill-sub-agent-manager.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for recording or rolling back sub-agent-related state changes or concurrent thoughts.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-task-integrity.org [ ]

  • STATUS: NON-COMPLIANT (Critical Gap)
  • ISSUE: No implementation code in Phase D. The skill is only a blueprint. No Merkle-Tree integration for recording or rolling back task-related state changes or transition history.
  • SAFETY: N/A (Missing).
  • MERKLE: FAILED.

DONE org-skill-token-accountant.org [ ]

  • STATUS: NON-COMPLIANT (Safety/Sovereignty Violation)
  • ISSUE: Hot-patches the kernel's core variables (`*provider-cascade*`, `*model-selector-fn*`) directly, bypassing the skill registration system's safety. No Merkle-Tree integration for recording or rolling back provider-related state changes or pain history.
  • SAFETY: LOW (Direct kernel mutation).
  • MERKLE: FAILED.

Findings Log

Skill Issue Priority Status
Reference in New Issue View Git Blame Copy Permalink