fix(v0.2.0): finalize structural integrity and clean boot

- Fixed memory.org source blocks to ensure persistence functions are tangled. - Improved extract-tangle-target to handle complex Elisp expressions. - Corrected opencortex.sh initialization paths to prevent setup loops. - Reordered variable definitions in policy and standards skills to eliminate forward-reference warnings.
2026-04-27 18:54:18 -04:00
parent 75b7d5e710
commit 2e8e79a193
31 changed files with 390 additions and 459 deletions
--- a/skills/org-skill-bouncer.org
+++ b/skills/org-skill-bouncer.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-bouncer.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       bouncer-agent-skill
 :CREATED:  [2026-04-11 Sat 15:20]
@@ -38,7 +39,7 @@ When something is blocked, the logs clearly show which layer blocked it and why.

 * Package Context

-#+begin_src lisp :tangle (expand-file-name "org-skill-bouncer.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)
 #+end_src

@@ -58,7 +59,7 @@ The Bouncer implements the 5-Vector security model:

 The vault stores sensitive credentials. This check scans action text for vault secrets to prevent accidental exposure.

-#+begin_src lisp :tangle (expand-file-name "org-skill-bouncer.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun bouncer-scan-secrets (text)
  "Scans TEXT for known secrets from the vault.

@@ -91,7 +92,7 @@ The vault stores sensitive credentials. This check scans action text for vault s

 Detects when shell commands try to send data to untrusted network destinations.

-#+begin_src lisp :tangle (expand-file-name "org-skill-bouncer.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defvar *bouncer-network-whitelist*
  '("api.telegram.org" "matrix.org" "googleapis.com" "openai.com" "anthropic.com")
  "Domains that the Bouncer considers safe for outbound connections.
@@ -129,7 +130,7 @@ Detects when shell commands try to send data to untrusted network destinations.

 ** bouncer-check: Main Security Gate

-#+begin_src lisp :tangle (expand-file-name "org-skill-bouncer.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun bouncer-check (action context)
  "The 5-Vector security gate for high-risk actions.

@@ -213,7 +214,7 @@ Detects when shell commands try to send data to untrusted network destinations.

 When a flight plan is approved in Emacs, the Bouncer detects it and re-injects the action.

-#+begin_src lisp :tangle (expand-file-name "org-skill-bouncer.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun bouncer-process-approvals ()
  "Scans the object store for APPROVED flight plans and re-injects them.

@@ -269,7 +270,7 @@ When a flight plan is approved in Emacs, the Bouncer detects it and re-injects t

 When the Bouncer intercepts a high-risk action, it creates a flight plan node for manual approval.

-#+begin_src lisp :tangle (expand-file-name "org-skill-bouncer.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun bouncer-create-flight-plan (blocked-action)
  "Creates an Org node representing a pending flight plan for manual approval.

@@ -306,7 +307,7 @@ When the Bouncer intercepts a high-risk action, it creates a flight plan node fo

 ** Main Gate Function

-#+begin_src lisp :tangle (expand-file-name "org-skill-bouncer.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun bouncer-deterministic-gate (action context)
  "Main deterministic gate for the Bouncer skill.

@@ -345,7 +346,7 @@ When the Bouncer intercepts a high-risk action, it creates a flight plan node fo

 ** Skill Registration

-#+begin_src lisp :tangle (expand-file-name "org-skill-bouncer.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defskill :skill-bouncer
  :priority 150
  :trigger (lambda (ctx) (declare (ignore ctx)) t)
--- a/skills/org-skill-cli-gateway.org
+++ b/skills/org-skill-cli-gateway.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-cli-gateway.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       cli-gateway-skill
 :CREATED:  [2026-04-13 Mon 17:00]
@@ -11,7 +12,7 @@ The *CLI Gateway* is the primary sensory and actuating interface for human inter

 * Implementation

-#+begin_src lisp :tangle (expand-file-name "org-skill-cli-gateway.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp

 (defvar *cli-port* 9105)
 (defvar *cli-server-socket* nil)
--- a/skills/org-skill-credentials-vault.org
+++ b/skills/org-skill-credentials-vault.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-credentials-vault.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       credentials-vault-skill
 :CREATED:  [2026-04-09 Thu]
@@ -33,7 +34,7 @@ Securely manage all authentication tokens required for the opencortex to operate
 The vault provides a secure lookup table in RAM, backed by the persistent Memory. Access is restricted to internal kernel requests and explicitly authorized deterministic gates.

 ** 2. Semantic Interfaces
-#+begin_src lisp :tangle (expand-file-name "org-skill-credentials-vault.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun vault-get-secret (provider &key type)
  "Retrieves a secret (api-key or session) for a provider.")

@@ -61,13 +62,13 @@ Tests in `tests/vault-tests.lisp` will verify:
 * Phase D: Build (Implementation)

 ** Package Context
-#+begin_src lisp :tangle (expand-file-name "org-skill-credentials-vault.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 #+end_src

 ** Vault State
 We maintain an in-memory hash table for secrets, which is hydrated from and persisted to the Memory.

-#+begin_src lisp :tangle (expand-file-name "org-skill-credentials-vault.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defvar opencortex::*vault-memory* (make-hash-table :test 'equal)
  "In-memory cache of sensitive credentials.")
 #+end_src
@@ -75,7 +76,7 @@ We maintain an in-memory hash table for secrets, which is hydrated from and pers
 ** Helper: Secret Masking
 The `vault-mask-string` function ensures that diagnostic output never contains the full plaintext of a sensitive token.

-#+begin_src lisp :tangle (expand-file-name "org-skill-credentials-vault.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun vault-mask-string (str)
  "Returns a masked version of a sensitive string."
  (if (and str (> (length str) 8))
@@ -86,7 +87,7 @@ The `vault-mask-string` function ensures that diagnostic output never contains t
 ** Retrieval (vault-get-secret)
 This function is the secure getter for all system secrets. It prioritizes the Vault (Memory) and falls back to environment variables for legacy compatibility.

-#+begin_src lisp :tangle (expand-file-name "org-skill-credentials-vault.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun vault-get-secret (provider &key (type :api-key))
  "Retrieves a credential. Type can be :api-key or :session."
  (let* ((key (format nil "~a-~a" provider type))
@@ -112,7 +113,7 @@ This function is the secure getter for all system secrets. It prioritizes the Va
 ** Persistence (vault-set-secret)
 When a secret is updated, we immediately snapshot the Memory to ensure the credential change is versioned and durable.

-#+begin_src lisp :tangle (expand-file-name "org-skill-credentials-vault.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun vault-set-secret (provider secret &key (type :api-key))
  "Securely stores a secret and triggers a Merkle snapshot."
  (let ((key (format nil "~a-~a" provider type)))
@@ -125,7 +126,7 @@ When a secret is updated, we immediately snapshot the Memory to ensure the crede
 ** Onboarding Logic
 Retained from the legacy Google skill, this provides the instructions for the autonomous cookie handshake.

-#+begin_src lisp :tangle (expand-file-name "org-skill-credentials-vault.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun vault-onboard-gemini-web ()
  "Instructions for the Autonomous Cookie Handshake."
  (harness-log "--- GEMINI WEB ONBOARDING ---")
@@ -137,7 +138,7 @@ Retained from the legacy Google skill, this provides the instructions for the au
 #+end_src

 ** Registration
-#+begin_src lisp :tangle (expand-file-name "org-skill-credentials-vault.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (progn
  (defskill :skill-credentials-vault
    :priority 200 ; High priority, foundational
--- a/skills/org-skill-emacs-edit.org
+++ b/skills/org-skill-emacs-edit.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       emacs-edit-skill
 :CREATED:  [2026-04-23 Thu]
@@ -58,14 +59,14 @@ Single entry point `emacs-edit-modify` takes a file path, operation, and paramet
 * Phase D: Build (Implementation)

 ** Package Context
-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)
 #+end_src

 ** ID Generation
 Generate unique IDs for headlines.

-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun emacs-edit-generate-id ()
  "Generates a unique ID for org-mode headlines.
 Format: 8-char hex + timestamp for uniqueness."
@@ -84,7 +85,7 @@ Format: 8-char hex + timestamp for uniqueness."
 ** Org Printer (AST → Org Format)
 Converts AST back to org format, preserving structure.

-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun emacs-edit-print-headline (ast &key indent-level)
  "Converts a HEADLINE AST node to org text.
 INDENT-LEVEL is number of leading asterisks."
@@ -154,7 +155,7 @@ Preserves structure including #+begin_src blocks."
 ** Read Operation
 Parse org file to AST.

-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defvar *org-parser-cache* (make-hash-table :test 'equal)
  "Cache for parsed org files.")

@@ -180,7 +181,7 @@ Returns the parsed AST. Uses cache for performance."
 ** Write Operation
 Write AST back to file preserving structure.

-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun emacs-edit-write-file (file-path ast)
  "Writes AST back to FILE-PATH, preserving org structure.
 Clears cache after write."
@@ -195,7 +196,7 @@ Clears cache after write."
 ** Add Headline Operation
 Add a new headline to an existing AST.

-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun emacs-edit-add-headline (ast title &key todo properties)
  "Adds a new headline to AST.
 Returns modified AST."
@@ -224,7 +225,7 @@ Returns modified AST."
 ** Set Property Operation
 Set a property on an existing headline (by ID or TITLE).

-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun emacs-edit-find-headline-by-id (ast target-id)
  "Recursively finds headline with matching :ID: property."
  (when (eq (getf ast :type) :headline)
@@ -268,7 +269,7 @@ Returns modified AST."
 ** Set TODO State Operation
 Change TODO state (TODO → DONE → etc).

-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun emacs-edit-set-todo (ast target new-state)
  "Sets TODO state on headline matching TARGET.
 NEW-STATE should be 'TODO', 'DONE', 'IN-PROGRESS', etc."
@@ -279,7 +280,7 @@ NEW-STATE should be 'TODO', 'DONE', 'IN-PROGRESS', etc."
 ** Unified Entry Point
 Main operation dispatcher.

-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun emacs-edit-modify (file-path operation &key params)
  "Main entry point for org-mode file manipulation.
 OPERATIONS:
@@ -322,7 +323,7 @@ OPERATIONS:
 ** Cognitive Tools
 Exposes operations to the Probabilistic Engine.

-#+begin_src lisp :tangle (expand-file-name "org-skill-emacs-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (def-cognitive-tool :org-read
  "Reads an org-mode file and parses it to structured AST.
 Use this BEFORE modifying org files to understand their structure."
--- a/skills/org-skill-engineering-standards.org
+++ b/skills/org-skill-engineering-standards.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-engineering-standards.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       37f2b59f-4537-4cca-ac7f-5c24b9e2e773
 :CREATED:  [2026-03-30 Mon 21:16]
@@ -105,16 +106,16 @@ You are forbidden from considering a task complete without updating ~gtd.org~. R

 The engineering standards skill is a HARD BLOCK gate. Violations are rejected, not warned.

-** Pre-Task Enforcement (Blocking)
+** Global Configuration

 #+begin_src lisp :tangle (expand-file-name "org-skill-engineering-standards.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 (in-package :opencortex)

-(defvar *engineering-std-*project-root* nil
+(defvar *engineering-std-project-root* nil
  "Path to the project root for enforcement checks.")

 (defun engineering-std-set-project-root (path)
-  (setf *engineering-std-*project-root* (uiop:ensure-directory-pathname path)))
+  (setf *engineering-std-project-root* (uiop:ensure-directory-pathname path)))

 (defstruct engineering-violation
  (phase nil)
@@ -133,12 +134,14 @@ The engineering standards skill is a HARD BLOCK gate. Violations are rejected, n
    (:post-task
     (:tests-pass "All tests must pass")
     (:no-artifacts "No orphaned .bak, .log, .tmp files"))))
+
+(defvar *engineering-std-initialized* nil)
 #+end_src

 ** Git Clean Check (Blocking)

 #+begin_src lisp :tangle (expand-file-name "org-skill-engineering-standards.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
-(defun verify-git-clean-p (&optional (dir *engineering-std-*project-root*))
+(defun verify-git-clean-p (&optional (dir *engineering-std-project-root*))
  "Returns T if the git repository at DIR has no uncommitted changes."
  (when dir
    (let ((status (uiop:run-program (list "git" "-C" (namestring dir) "status" "--porcelain")
@@ -146,7 +149,7 @@ The engineering standards skill is a HARD BLOCK gate. Violations are rejected, n
                                    :ignore-error-status t)))
      (string= "" (string-trim '(#\Space #\Newline #\Tab) status)))))

-(defun check-git-clean (&optional (dir *engineering-std-*project-root*))
+(defun check-git-clean (&optional (dir *engineering-std-project-root*))
  "Returns violation if git is dirty, nil if clean."
  (unless (verify-git-clean-p dir)
    (make-engineering-violation
@@ -156,11 +159,69 @@ The engineering standards skill is a HARD BLOCK gate. Violations are rejected, n
     :severity :blocker)))
 #+end_src

+** Blocking Gate (Hard Enforcement)

-** Test Suite
+#+begin_src lisp :tangle (expand-file-name "org-skill-engineering-standards.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+(defun engineering-standards-gate (action context)
+  "The deterministic HARD BLOCK gate for Engineering Standards.

-These tests verify the enforcement logic. Run with:
-~(fiveam:run! 'engineering-standards-suite)~
+  BLOCKING checks (return :LOG on violation):
+  - Git tree must be clean before file modifications
+
+  WARNING checks (log only):
+  - Skill catalog should be queried first
+
+  Returns modified action, or :LOG/:EVENT on violation."
+  (let* ((payload (getf action :payload))
+         (tool (getf payload :tool))
+         (file (getf payload :file))
+         (code (getf payload :code))
+         (modifies-files-p (or file code tool)))
+
+    ;; BLOCKING: Git clean required for file modifications
+    (when modifies-files-p
+      (let ((git-check (check-git-clean *engineering-std-project-root*)))
+        (when git-check
+          (harness-log "~a" (engineering-violation-message git-check))
+          (return-from engineering-standards-gate
+            (list :type :log
+                  :payload (list :text (engineering-violation-message git-check)))))))
+
+    action))
+#+end_src
+
+** Skill Registration
+
+The skill runs at highest priority (1000) to block violations before any other skill.
+
+#+begin_src lisp :tangle (expand-file-name "org-skill-engineering-standards.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+(defskill :skill-engineering-standards
+  :priority 1000
+  :trigger (lambda (ctx)
+             (declare (ignore ctx))
+             t)
+  :probabilistic nil
+  :deterministic #'engineering-standards-gate)
+#+end_src
+
+** Initialize Project Root
+
+#+begin_src lisp :tangle (expand-file-name "org-skill-engineering-standards.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+(defun engineering-std-init ()
+  "Initialize the enforcement system with project root."
+  (unless *engineering-std-initialized*
+    (let ((env-root (or (uiop:getenv "OPENCORTEX_ROOT")
+                       (uiop:getenv "MEMEX_DIR")
+                       "/home/user/memex/projects/opencortex")))
+      (engineering-std-set-project-root env-root)
+      (setf *engineering-std-initialized* t)
+      (harness-log "ENGINEERING STANDARDS: Initialized with root ~a" *engineering-std-project-root*))))
+
+;; Auto-initialize on load
+(engineering-std-init)
+#+end_src
+
+* Test Suite

 #+begin_src lisp :tangle (expand-file-name "engineering-standards-tests.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/tests"))
 (defpackage :opencortex-engineering-standards-tests
@@ -227,70 +288,6 @@ These tests verify the enforcement logic. Run with:
      (is (eq :request (getf result :type))))))
 #+end_src

-** Blocking Gate (Hard Enforcement)
-
-#+begin_src lisp :tangle (expand-file-name "org-skill-engineering-standards.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
-(defun engineering-standards-gate (action context)
-  "The deterministic HARD BLOCK gate for Engineering Standards.
-
-  BLOCKING checks (return :LOG on violation):
-  - Git tree must be clean before file modifications
-
-  WARNING checks (log only):
-  - Skill catalog should be queried first
-
-  Returns modified action, or :LOG/:EVENT on violation."
-  (let* ((payload (getf action :payload))
-         (tool (getf payload :tool))
-         (file (getf payload :file))
-         (code (getf payload :code))
-         (modifies-files-p (or file code tool)))
-
-    ;; BLOCKING: Git clean required for file modifications
-    (when modifies-files-p
-      (let ((git-check (check-git-clean *engineering-std-*project-root*)))
-        (when git-check
-          (harness-log "~a" (engineering-violation-message git-check))
-          (return-from engineering-standards-gate
-            (list :type :log
-                  :payload (list :text (engineering-violation-message git-check)))))))
-
-    action))
-#+end_src
-
-** Skill Registration
-
-The skill runs at highest priority (1000) to block violations before any other skill.
-
-#+begin_src lisp :tangle (expand-file-name "org-skill-engineering-standards.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
-(defskill :skill-engineering-standards
-  :priority 1000
-  :trigger (lambda (ctx)
-             (declare (ignore ctx))
-             t)
-  :probabilistic nil
-  :deterministic #'engineering-standards-gate)
-#+end_src
-
-** Initialize Project Root
-
-#+begin_src lisp :tangle (expand-file-name "org-skill-engineering-standards.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
-(defvar *engineering-std-initialized* nil)
-
-(defun engineering-std-init ()
-  "Initialize the enforcement system with project root."
-  (unless *engineering-std-initialized*
-    (let ((env-root (or (uiop:getenv "OPENCORTEX_ROOT")
-                       (uiop:getenv "MEMEX_DIR")
-                       "/home/user/memex/projects/opencortex")))
-      (engineering-std-set-project-root env-root)
-      (setf *engineering-std-initialized* t)
-      (harness-log "ENGINEERING STANDARDS: Initialized with root ~a" *engineering-std-*project-root*))))
-
-;; Auto-initialize on load
-(engineering-std-init)
-#+end_src
-
 * See Also
 - [[file:org-skill-literate-programming.org][Literate Programming Skill]] - Structural validation and tangle rules
 - [[file:org-skill-policy.org][Policy Skill]] - Constitutional constraints
--- a/skills/org-skill-gardener.org
+++ b/skills/org-skill-gardener.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-gardener.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       gardener-skill
 :CREATED:  [2026-04-13 Mon 18:50]
@@ -37,14 +38,14 @@ The Gardener runs on a low-priority heartbeat. It performs a "Deep Audit" of the
 * Phase D: Build (Implementation)

 ** Package Context
-#+begin_src lisp :tangle (expand-file-name "org-skill-gardener.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)
 #+end_src

 ** State: Maintenance Cycle
 We track the last audit time to ensure the Gardener doesn't over-consume resources.

-#+begin_src lisp :tangle (expand-file-name "org-skill-gardener.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defvar *gardener-last-audit* 0
  "The universal-time of the last full Memex audit.")
 #+end_src
@@ -52,7 +53,7 @@ We track the last audit time to ensure the Gardener doesn't over-consume resourc
 ** Audit: Broken Links
 Scans the content of all objects for `id:` links and verifies the targets exist.

-#+begin_src lisp :tangle (expand-file-name "org-skill-gardener.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun gardener-find-broken-links ()
  "Returns a list of broken ID links found in the Memex."
  (let ((broken nil))
@@ -69,7 +70,7 @@ Scans the content of all objects for `id:` links and verifies the targets exist.
 ** Audit: Orphaned Nodes
 Identifies nodes that are not linked to and do not link to anything else.

-#+begin_src lisp :tangle (expand-file-name "org-skill-gardener.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun gardener-find-orphans ()
  "Returns a list of IDs for headlines that are structurally isolated."
  (let ((inbound (make-hash-table :test 'equal))
@@ -95,7 +96,7 @@ Identifies nodes that are not linked to and do not link to anything else.
 ** Skill Logic: The Audit Pass
 The Gardener's deterministic gate performs the actual analysis and logs the results. In future versions, it will generate probabilistic repair proposals.

-#+begin_src lisp :tangle (expand-file-name "org-skill-gardener.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun gardener-deterministic-gate (action context)
  "Main gate for the Gardener skill. Audits graph integrity."
  (declare (ignore action context))
@@ -118,7 +119,7 @@ The Gardener's deterministic gate performs the actual analysis and logs the resu
 #+end_src

 ** Skill Registration
-#+begin_src lisp :tangle (expand-file-name "org-skill-gardener.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defskill :skill-gardener
  :priority 40
  :trigger (lambda (ctx)
--- a/skills/org-skill-homoiconic-memory.org
+++ b/skills/org-skill-homoiconic-memory.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-homoiconic-memory.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       homoiconic-memory-skill
 :CREATED:  [2026-04-10 Fri]
@@ -11,7 +12,7 @@ The *Homoiconic Memory* skill provides the core persistence layer for OpenCortex

 * Implementation

-#+begin_src lisp :tangle (expand-file-name "org-skill-homoiconic-memory.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp

 (defun memory-org-to-json (source)
  "Converts Org-mode source to JSON AST."
--- a/skills/org-skill-lisp-utils.org
+++ b/skills/org-skill-lisp-utils.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-lisp-utils.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       lisp-utils-skill
 :CREATED:  [2026-04-23 Thu]
@@ -16,7 +17,7 @@ The *Lisp Utils* skill provides general-purpose Lisp utilities for the entire sy

 * Phase D: Build (Implementation)

-#+begin_src lisp :tangle (expand-file-name "org-skill-lisp-utils.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)

 (defun count-char (char string)
--- a/skills/org-skill-literate-programming.org
+++ b/skills/org-skill-literate-programming.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-literate-programming.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       literate-programming-skill-2026
 :CREATED:  [2026-04-25 Sat]
@@ -57,7 +58,7 @@ Code without surrounding prose is a bug report waiting to happen.

 ** Block Balance Checker

-#+begin_src lisp :tangle (expand-file-name "org-skill-literate-programming.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)

 (defun literate-check-block-balance (code-string)
@@ -94,7 +95,7 @@ Code without surrounding prose is a bug report waiting to happen.

 ** File-Level Balance Audit

-#+begin_src lisp :tangle (expand-file-name "org-skill-literate-programming.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun literate-audit-org-file (filepath)
  "Audits all tangled lisp blocks in an Org file for structural balance.

@@ -145,7 +146,7 @@ Code without surrounding prose is a bug report waiting to happen.

 Verifies that tangled `.lisp` files are in sync with their Org source. Violation: edited .lisp directly instead of through Org.

-#+begin_src lisp :tangle (expand-file-name "org-skill-literate-programming.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defvar *tangle-targets*
  '(("skills/org-skill-engineering-standards.org" . "library/gen/org-skill-engineering-standards.lisp")
    ("skills/org-skill-literate-programming.org" . "library/gen/org-skill-literate-programming.lisp")
@@ -184,7 +185,7 @@ This detects direct .lisp edits (which violate the LP workflow)."

 The LP skill runs at priority 1100 (just below engineering-standards at 1000).

-#+begin_src lisp :tangle (expand-file-name "org-skill-literate-programming.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defskill :skill-literate-programming
  :priority 1100
  :trigger (lambda (ctx)
@@ -218,7 +219,7 @@ The LP skill runs at priority 1100 (just below engineering-standards at 1000).

 ** Initialize Project Root

-#+begin_src lisp :tangle (expand-file-name "org-skill-literate-programming.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defvar *lp-initialized* nil)

 (defun lp-init ()
--- a/skills/org-skill-llama-backend.org
+++ b/skills/org-skill-llama-backend.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-llama-backend.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       llama-backend-skill
 :CREATED:  [2026-04-17 Fri 20:00]
@@ -21,12 +22,12 @@ This skill acts as a proxy between the OpenCortex kernel and the Lisp-agnostic `
 * Phase D: Build (Implementation)

 ** Package Context
-#+begin_src lisp :tangle (expand-file-name "org-skill-llama-backend.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)
 #+end_src

 ** The Inference Engine (llama-inference)
-#+begin_src lisp :tangle (expand-file-name "org-skill-llama-backend.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun llama-inference (prompt system-prompt &key (model "local-model"))
  "Sends a completion request to the local llama.cpp server."
  (let ((endpoint (uiop:getenv "LLAMACPP_ENDPOINT")))
@@ -51,7 +52,7 @@ This skill acts as a proxy between the OpenCortex kernel and the Lisp-agnostic `
 #+end_src

 ** Registration
-#+begin_src lisp :tangle (expand-file-name "org-skill-llama-backend.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (progn
  (register-probabilistic-backend :llama #'llama-inference)
  (harness-log "LLAMA: Local backend registered and active."))
--- a/skills/org-skill-llm-gateway.org
+++ b/skills/org-skill-llm-gateway.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-llm-gateway.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       llm-gateway-skill
 :CREATED:  [2026-04-09 Thu]
@@ -19,7 +20,7 @@ The gateway utilizes a functional dispatch pattern. A single entry point, `execu
 * Phase D: Build (Implementation)

 ** Implementation
-#+begin_src lisp :tangle (expand-file-name "org-skill-llm-gateway.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp

 (defun get-nested (alist &rest keys)
  "Recursively extracts nested values from an alist, handling both objects and arrays."
--- a/skills/org-skill-peripheral-vision.org
+++ b/skills/org-skill-peripheral-vision.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-peripheral-vision.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       org-skill-peripheral-vision
 :CREATED:  [2026-04-12 Sun 14:15]
@@ -39,10 +40,10 @@ Move context pruning and rendering logic out of `context.lisp` to allow for more


 * Package Context
-#+begin_src lisp :tangle (expand-file-name "org-skill-peripheral-vision.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)
 #+end_src
-\n#+begin_src lisp :tangle (expand-file-name "org-skill-peripheral-vision.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+\n#+begin_src lisp
 (defun context-render-to-org (obj &key depth foveal-id semantic-threshold foveal-vector)
  "Recursively renders an org-object with foveal-peripheral pruning.")

@@ -53,7 +54,7 @@ Move context pruning and rendering logic out of `context.lisp` to allow for more
 * Phase D: Build (Implementation)

 ** Foveal-Peripheral Pruning
-#+begin_src lisp :tangle (expand-file-name "org-skill-peripheral-vision.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp

 (defun context-render-to-org (obj &key (depth 1) (foveal-id nil) (semantic-threshold 0.75) (foveal-vector nil))
  "Recursively renders an org-object and its children to an Org string using a Foveal-Peripheral Hybrid model."
@@ -117,7 +118,7 @@ Move context pruning and rendering logic out of `context.lisp` to allow for more
 #+end_src

 * Registration
-#+begin_src lisp :tangle (expand-file-name "org-skill-peripheral-vision.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defskill :skill-peripheral-vision
  :priority 90
  :dependencies ("org-skill-embedding")
--- a/skills/org-skill-policy.org
+++ b/skills/org-skill-policy.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       47425a43-2be0-423c-8509-22592cfe9c9e
 :CREATED:  [2026-04-07 Tue 12:57]
@@ -44,23 +45,11 @@ Therefore, Policy encodes not just rules, but *values*:

 Every skill executes within its own jailed package namespace, inheriting core harness symbols while maintaining isolation from other skills.

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)
 #+end_src

-* The Override Hierarchy
-
-When two invariants conflict, resolution follows a strict priority order. This prevents the agent from freezing on ethical edge cases.
-
-| Priority | Invariant | Philosophy |
-|----------|-----------|------------|
-| 500 | Transparency | If you can't explain it, you can't do it |
-| 400 | Autonomy | Independence from proprietary control is the primary goal |
-| 300 | Zero-Bloat | Complexity must be earned, not imported |
-| 250 | Modularity | Complexity belongs at the edges, not the core |
-| 200 | Mentorship | Teaching increases capability; doing removes it |
-| 100 | Sustainability | Offline capability today enables 100-year survival |
-
+* Global Policy Configuration
 #+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 (defvar *policy-invariant-priorities*
  '((:transparency . 500)
@@ -76,6 +65,75 @@ When two invariants conflict, the higher priority wins.
 Example: Modularity (250) takes precedence over Mentorship (200),
 meaning a change that would fatten the harness is blocked
 even if it would be educational.")
+
+(defvar *proprietary-domain-watchlist*
+  '("googleapis.com" "api.openai.com" "anthropic.com" "api.groq.com" "openrouter.ai")
+  "Domains representing centralized, proprietary control.
+
+  Actions targeting these are logged as autonomy debt, not hard-blocked.
+  This is because tactical gateway usage (Telegram, Signal, OpenRouter)
+  is permitted under the strategic mandate for autonomy.
+
+  Strategic goal: Replace all proprietary APIs with local alternatives.
+  Tactical reality: Use what's available while building toward that goal.")
+
+(defvar *policy-max-skill-size-chars* 50000
+  "Maximum recommended size for a skill file tangled from an Org note.
+
+  This is a soft limit—the check warns but does not block.
+  A large, well-documented skill is acceptable; a small, poorly-documented
+  one that adds unnecessary complexity is not.")
+
+(defvar *modularity-protected-paths*
+  '("harness/" "opencortex.asd")
+  "Paths that constitute the unbreakable core of the system.
+
+  Any action targeting these paths must include a :modularity-justification
+  explaining why the change cannot be implemented as a skill.
+
+  The Thin Harness principle: What belongs in the harness?
+  - Core signal processing (Perceive-Reason-Act loop)
+  - Memory and persistence primitives
+  - Protocol definition and validation
+  - Skills register and dispatch
+
+  What belongs in skills?
+  - Policy and security
+  - LLM integration
+  - Domain-specific functionality
+  - New actuators")
+
+(defvar *mentorship-required-actions*
+  '(:create-skill :eval :modify-file :write-file :replace
+    :rename-file :delete-file :shell :create-note)
+  "Actions that trigger the Mentorship invariant.
+
+  These are high-impact actions that should come with explanations
+  not just for the user, but for future debugging and maintenance.")
+
+(defvar *cloud-only-backends* '(:openrouter :openai :anthropic :groq :gemini-api)
+  "Backends requiring internet connection and external infrastructure.
+
+  These are acceptable as fallbacks when local inference is unavailable,
+  but should be logged as sustainability debt for tracking purposes.")
+#+end_src
+
+
+* The Override Hierarchy
+
+When two invariants conflict, resolution follows a strict priority order. This prevents the agent from freezing on ethical edge cases.
+
+| Priority | Invariant | Philosophy |
+|----------|-----------|------------|
+| 500 | Transparency | If you can't explain it, you can't do it |
+| 400 | Autonomy | Independence from proprietary control is the primary goal |
+| 300 | Zero-Bloat | Complexity must be earned, not imported |
+| 250 | Modularity | Complexity belongs at the edges, not the core |
+| 200 | Mentorship | Teaching increases capability; doing removes it |
+| 100 | Sustainability | Offline capability today enables 100-year survival |
+
+#+begin_src lisp
+
 #+end_src

 * The Core Invariants
@@ -91,7 +149,7 @@ At the gate:
 - Every user-facing action must carry an `:explanation`
 - Log messages must include the triggering invariant

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun policy-check-transparency (action context)
 (defun policy-check-transparency (action context)
  "Ensures the action is inspectable and user-facing actions carry an explanation.
@@ -138,17 +196,8 @@ At the gate:

 Every action should increase the user's independence from centralized, proprietary platforms. When the system uses a proprietary API, it's logged as "autonomy debt"—acceptable tactically, but flagged for eventual replacement.

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
-(defvar *proprietary-domain-watchlist*
-  '("googleapis.com" "api.openai.com" "anthropic.com" "api.groq.com" "openrouter.ai")
-  "Domains representing centralized, proprietary control.
+#+begin_src lisp

-  Actions targeting these are logged as autonomy debt, not hard-blocked.
-  This is because tactical gateway usage (Telegram, Signal, OpenRouter)
-  is permitted under the strategic mandate for autonomy.
-
-  Strategic goal: Replace all proprietary APIs with local alternatives.
-  Tactical reality: Use what's available while building toward that goal.")

 (defun policy-scan-proprietary-references (action)
  "Scans ACTION text fields for proprietary domain references.
@@ -205,13 +254,8 @@ Every action should increase the user's independence from centralized, proprieta

 The system harness must remain minimalist. "Just-in-case" code is a security vulnerability. Complexity must be earned through demonstrated need, not anticipation of future use.

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
-(defvar *policy-max-skill-size-chars* 50000
-  "Maximum recommended size for a skill file tangled from an Org note.
+#+begin_src lisp

-  This is a soft limit—the check warns but does not block.
-  A large, well-documented skill is acceptable; a small, poorly-documented
-  one that adds unnecessary complexity is not.")

 (defun policy-check-bloat (action context)
  "Warns if a :create-skill action exceeds the bloat threshold.
@@ -256,25 +300,8 @@ This is the most important invariant for system stability. If the harness grows
 - Harder to debug when things go wrong
 - Harder to maintain across versions

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
-(defvar *modularity-protected-paths*
-  '("harness/" "opencortex.asd")
-  "Paths that constitute the unbreakable core of the system.
+#+begin_src lisp

-  Any action targeting these paths must include a :modularity-justification
-  explaining why the change cannot be implemented as a skill.
-
-  The Thin Harness principle: What belongs in the harness?
-  - Core signal processing (Perceive-Reason-Act loop)
-  - Memory and persistence primitives
-  - Protocol definition and validation
-  - Skills register and dispatch
-
-  What belongs in skills?
-  - Policy and security
-  - LLM integration
-  - Domain-specific functionality
-  - New actuators")

 (defun policy-check-modularity (action context)
  "Blocks modifications to the system's protected core unless justified.
@@ -323,14 +350,8 @@ This is the most important invariant for system stability. If the harness grows

 The agent's goal is not to "do it for the user," but to "empower the user." Every autonomous action must be explained at a level that increases the user's technical understanding.

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
-(defvar *mentorship-required-actions*
-  '(:create-skill :eval :modify-file :write-file :replace
-    :rename-file :delete-file :shell :create-note)
-  "Actions that trigger the Mentorship invariant.
+#+begin_src lisp

-  These are high-impact actions that should come with explanations
-  not just for the user, but for future debugging and maintenance.")

 (defun policy-check-mentorship (action context)
  "Blocks high-impact actions that lack a mentorship note.
@@ -380,12 +401,8 @@ The Memex should be functional even when:

 This means preferring local, energy-efficient architectures over cloud-dependent ones.

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
-(defvar *cloud-only-backends* '(:openrouter :openai :anthropic :groq :gemini-api)
-  "Backends requiring internet connection and external infrastructure.
+#+begin_src lisp

-  These are acceptable as fallbacks when local inference is unavailable,
-  but should be logged as sustainability debt for tracking purposes.")

 (defun policy-check-sustainability (action context)
  "Logs sustainability debt when action relies on cloud-only infrastructure.
@@ -417,7 +434,7 @@ This means preferring local, energy-efficient architectures over cloud-dependent

 When the policy gate blocks or modifies an action, it must tell the user *why*. This creates an auditable log of every policy decision.

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun policy-explain (invariant-key message &optional original-action)
  "Formats a policy decision into an auditable explanation plist.

@@ -446,7 +463,7 @@ When the policy gate blocks or modifies an action, it must tell the user *why*.

 ** Running Invariant Checks

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun policy-run-invariant-checks (action context)
  "Runs all invariant checks in priority order.

@@ -509,7 +526,7 @@ When the policy gate blocks or modifies an action, it must tell the user *why*.

 ** Main Policy Gate

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun policy-deterministic-gate (action context)
  "The main policy gate entry point.

@@ -541,7 +558,7 @@ When the policy gate blocks or modifies an action, it must tell the user *why*.

 * Skill Registration

-#+begin_src lisp :tangle (expand-file-name "org-skill-policy.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defskill :skill-policy
  :priority 500
  :trigger (lambda (ctx) (declare (ignore ctx)) t)
--- a/skills/org-skill-protocol-validator.org
+++ b/skills/org-skill-protocol-validator.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-protocol-validator.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       org-skill-communication-protocol-validator
 :CREATED:  [2026-04-12 Sun 14:35]
@@ -45,7 +46,7 @@ Decouple protocol parsing (framing/unframing) from semantic validation.
 * Phase D: Build (Implementation)

 ** Schema Enforcement
-#+begin_src lisp :tangle (expand-file-name "org-skill-protocol-validator.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)

 (defun validate-communication-protocol-schema (msg)
@@ -84,7 +85,7 @@ Decouple protocol parsing (framing/unframing) from semantic validation.
 #+end_src

 * Registration
-#+begin_src lisp :tangle (expand-file-name "org-skill-protocol-validator.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defskill :skill-communication-protocol-validator
  :priority 95
  :trigger (lambda (ctx) (member (getf (getf ctx :payload) :sensor) '(:protocol-received)))
--- a/skills/org-skill-scribe.org
+++ b/skills/org-skill-scribe.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-scribe.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       scribe-skill
 :CREATED:  [2026-04-13 Mon 18:40]
@@ -41,14 +42,14 @@ The Scribe reacts to the `:heartbeat` sensor. It maintains a state file (`scribe
 * Phase D: Build (Implementation)

 ** Package Context
-#+begin_src lisp :tangle (expand-file-name "org-skill-scribe.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)
 #+end_src

 ** State: Checkpoint Management
 We track the last processed universal time to avoid redundant distillation.

-#+begin_src lisp :tangle (expand-file-name "org-skill-scribe.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defvar *scribe-last-checkpoint* 0
  "The universal-time of the last successful distillation run.")

@@ -70,7 +71,7 @@ We track the last processed universal time to avoid redundant distillation.
 ** Filtering: Privacy & Relevance
 The Scribe only cares about non-personal, non-distilled headlines.

-#+begin_src lisp :tangle (expand-file-name "org-skill-scribe.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun scribe-get-distillable-nodes ()
  "Returns a list of org-objects from the daily/ folder that require distillation."
  (let ((results nil))
@@ -91,7 +92,7 @@ The Scribe only cares about non-personal, non-distilled headlines.
 ** Probabilistic: Extraction Prompt
 The LLM is tasked with identifying atomic concepts within the raw text.

-#+begin_src lisp :tangle (expand-file-name "org-skill-scribe.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun probabilistic-skill-scribe (context)
  "Generates the extraction prompt for the Scribe."
  (let* ((payload (getf context :payload))
@@ -122,7 +123,7 @@ TEXT:
 ** Deterministic: Note Committal
 The deterministic gate receives the list of proposed notes and writes them to the filesystem.

-#+begin_src lisp :tangle (expand-file-name "org-skill-scribe.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun scribe-commit-notes (proposals)
  "Writes proposed atomic notes to the notes/ directory. Appends if the note exists."
  (let ((notes-dir (uiop:merge-pathnames* "notes/" (asdf:system-source-directory :opencortex))))
@@ -159,7 +160,7 @@ The deterministic gate receives the list of proposed notes and writes them to th
 #+end_src

 ** Skill Registration
-#+begin_src lisp :tangle (expand-file-name "org-skill-scribe.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defskill :skill-scribe
  :priority 50
  :trigger (lambda (ctx)
@@ -174,6 +175,6 @@ The deterministic gate receives the list of proposed notes and writes them to th
 #+end_src

 ** Initialization
-#+begin_src lisp :tangle (expand-file-name "org-skill-scribe.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (scribe-load-state)
 #+end_src
--- a/skills/org-skill-self-edit.org
+++ b/skills/org-skill-self-edit.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       self-edit-001
 :END:
@@ -14,14 +15,14 @@ The *Self-Edit Agent* enables the agent to modify its own code and files with sa
 * Phase D: Build (Implementation)

 ** Package Context
-#+begin_src lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)
 #+end_src

 ** Deterministic Paren Repair
 Fast paren balancing for syntax errors.

-#+begin_src lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun self-edit-count-char (char string)
  "Counts occurrences of CHAR in STRING."
  (loop for c across string count (char= c char)))
@@ -41,7 +42,7 @@ Fast paren balancing for syntax errors.
 ** Parse Target Location
 Extract file and line info from error context.

-#+begin_src lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun self-edit-parse-location (context)
  "Extracts file and line from error context payload."
  (let* ((payload (getf context :payload))
@@ -58,7 +59,7 @@ Extract file and line info from error context.
 ** Apply Surgical Edit
 Apply a find/replace to a file with rollback on failure.

-#+begin_src lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun self-edit-apply (target-file old-code new-code)
  "Applies surgical edit to TARGET-FILE: replace OLD-CODE with NEW-CODE.
 Returns list with :status and :message keys."
@@ -90,7 +91,7 @@ Returns list with :status and :message keys."
 #+end_src

 ** Cognitive Tool: Edit File
-#+begin_src lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (def-cognitive-tool :self-edit
  "Applies a surgical code modification to a file with automatic rollback on failure."
  ((:file :type :string :description "Path to the target file")
@@ -106,7 +107,7 @@ Returns list with :status and :message keys."
 ** Skill Definition
 Hooks into syntax-error events for self-repair.

-#+begin_src lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defskill :skill-self-edit
  :priority 95
  :trigger (lambda (ctx)
@@ -146,7 +147,7 @@ Provide a fixed version of the code as a lisp form.")
 #+end_src

 ** Tool: Quick Paren Fix
-#+begin_src lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (def-cognitive-tool :balance-parens
  "Balances parentheses in a code string."
  ((:code :type :string :description "The code to balance"))
@@ -164,7 +165,7 @@ Provide a fixed version of the code as a lisp form.")
 ** Skill Hot-Reload
 Swap compiled skill files without breaking active sockets.

-#+begin_src lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defvar *self-edit-skills-backup* nil
  "Backup of skill registry before hot-reload.")

@@ -217,7 +218,7 @@ Swap compiled skill files without breaking active sockets.

 ** Cognitive Tool: Reload Skill

-#+begin_src lisp :tangle (expand-file-name "org-skill-self-edit.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (def-cognitive-tool :reload-skill
  "Hot-reloads a skill from its compiled source file without restarting the system."
  ((:skill-name :type :string :description "Name of the skill to reload (e.g. :skill-engineering-standards)")
--- a/skills/org-skill-self-fix.org
+++ b/skills/org-skill-self-fix.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-self-fix.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       65891ce2-a465-49e6-a0c1-be13d3288d55
 :CREATED:  [2026-03-30 Mon 21:16]
@@ -15,11 +16,11 @@ This skill enables self-editing by applying surgical fixes to files (including s
 * Phase D: Build (Implementation)

 ** Repair Logic
-#+begin_src lisp :tangle (expand-file-name "org-skill-self-fix.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)
 #+end_src

-#+begin_src lisp :tangle (expand-file-name "org-skill-self-fix.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defun self-fix-apply (action context)
  "Applies a surgical code fix and reloads the modified skill."
  (declare (ignore context))
@@ -66,7 +67,7 @@ This skill enables self-editing by applying surgical fixes to files (including s
 #+end_src

 ** Cognitive Tool
-#+begin_src lisp :tangle (expand-file-name "org-skill-self-fix.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (def-cognitive-tool :repair-file 
  "Applies a surgical code modification to a file and reloads the skill if applicable."
  ((:file :type :string :description "Path to the target file")
@@ -79,7 +80,7 @@ This skill enables self-editing by applying surgical fixes to files (including s
 #+end_src

 ** Skill Definition
-#+begin_src lisp :tangle (expand-file-name "org-skill-self-fix.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (defskill :skill-self-fix
  :priority 95
  :trigger (lambda (context) (eq (getf (getf context :payload) :sensor) :repair-request))
--- a/skills/org-skill-shell-actuator.org
+++ b/skills/org-skill-shell-actuator.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-shell-actuator.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       shell-actuator-skill
 :CREATED:  [2026-04-12 Sun]
@@ -11,7 +12,7 @@ The *Shell Actuator* provides a controlled interface for the OpenCortex to execu

 * Implementation

-#+begin_src lisp :tangle (expand-file-name "org-skill-shell-actuator.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp

 (defparameter *allowed-commands* '("ls" "git" "rg" "grep" "date" "echo" "cat" "node" "python3" "sbcl"))

--- a/skills/org-skill-tool-permissions.org
+++ b/skills/org-skill-tool-permissions.org
@@ -1,3 +1,4 @@
+#+PROPERTY: header-args:lisp :tangle (expand-file-name "org-skill-tool-permissions.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
 :PROPERTIES:
 :ID:       tool-permissions-skill-001
 :CREATED:   [2026-04-23 Thu]
@@ -27,7 +28,7 @@ Also provides vector embeddings via Ollama or llama.cpp.
 * Implementation
 Tool permissions and embedding generation via multiple providers.

-#+begin_src lisp :tangle (expand-file-name "org-skill-tool-permissions.lisp" (concat (or (getenv "INSTALL_DIR") ".") "/skills"))
+#+begin_src lisp
 (in-package :opencortex)

 (defvar *tool-permissions* (make-hash-table :test 'equal)