feat(skills): deliver on every tier, record what agents receive, let them self-author

Three phases of the approved plan, plus a correction to what the last one
claimed.

CORRECTION: skills reached ONE tier, not all of them

The previous commit said "skills can now reach a mission agent". That was
true only for the container/ZeroClaw tier — the fall-through that queues a
topology_runs row for topology_worker, which drives the executor that was
patched. compose_turn_prompt/pinned_skills_text had exactly one production
caller, and phase_runner's three other paths (composed microVM, solo
microVM, direct session) never called it. CAPABILITY-REVIEW.md said the
broad thing too; both are corrected.

Those three tiers share one task string and have no per-turn alias, so
their skills resolve per PHASE from the mission's crew and are appended
there. The container tier deliberately still injects per turn, with the
running node's own role — appending in both places would put every crew
member's skills in every turn twice.

The behavioural tests prove phase_skills_text and compose_turn_prompt work.
They cannot prove the three launch_* calls pass the composed string, and
that substitution is a one-word edit that would silently return all three
tiers to delivering nothing with every test still green. So there is also a
source-level assertion on the call sites, following the precedent in
mission_events::the_cap_is_enforced_in_one_statement. Its negative control
names the exact tier.

PROVENANCE: what an agent received, and what it said it did

Both were unanswerable. The prompt was never stored anywhere on any tier —
re-deriving it later re-runs the skill lookup against a catalogue that has
since changed, and once agents author their own skills it certainly will
have. The reasoning rows were durably write-only: pushed live once, then
never read from the database again by anything except the GC that deletes
them.

  - prompt.composed records the exact bytes, on all four tiers
  - the session tier writes its checkpoint record and a reasoning row,
    instead of eprintln! and nothing — the same defect the solo microVM
    path was fixed for, in the last tier that still had it
  - narrative_for_mission reads both back

Found while doing it: the 400-event per-phase cap counted EVERY kind, so a
busy phase could push out its own phase.completed and its own provenance.
The cap now counts only the two unbounded kinds it was written for.
Negative control confirms the old behaviour dropped the prompt.

Retention is now a per-mission hold (0080) rather than a raised global —
with a test asserting unheld missions are still reaped, because an
exemption that applies to everything is not an exemption.

SELF-AUTHORING: agents apply their own skill drafts, no human click

By operator decision. level_up has generated complete drafts from a model
since it shipped; only a checkbox stood between propose and apply.

What replaces the gate is not another gate but four properties, each held
by a test:

  - workspace-scoped, so a hand-authored skill can never be modified
  - a draft cannot take a hand-authored skill's name. Ids are scoped and
    bindings resolve by skill_id, so it could not overwrite or shadow one
    anyway — but two procedures under one name means nobody reading a
    transcript can tell which the agent followed, and that ambiguity is
    fatal in a system where the skill is the standard being graded against
  - every revision appends a skill_versions row, so it can be reverted and
    a past run can be read against the text it was actually judged under
  - approved_by = NULL. An agent's decision is never attributed to a person
    who did not make it

Only skill_candidate applies autonomously. identity_refinement and
brain_consolidation still wait for a human: they change what an agent IS
rather than adding a procedure it can consult. State is announced at boot,
because a safety gate that changes silently is one nobody notices changed.
CLAWMATES_SKILL_SELF_AUTHORING=0 restores it.

Also: the test Postgres ran out of /dev/shm mid-suite (Docker's 64MB
default) and surfaced it during MIGRATIONS, which reads like a schema fault
and is not one. --shm-size=1g, and a pointer to the `clean` subcommand that
already existed for the 779 leaked test databases.

Full workspace suite green: 106 binaries, no failures.

Co-Authored-By: Claude Opus 5 <[email protected]>

crates/cm-api/src/mission_events.rs

@@ -23,6 +23,36 @@ pub const PHASE_COMPLETED: &str = "phase.completed";
 pub const TOOL_CALL: &str = "tool.call";
 /// A tool touched a path. `target` is the path, repo-relative where known.
 pub const FILE_TOUCH: &str = "file.touch";
+/// The exact prompt text an agent was given. `detail.text` is the full string,
+/// `target` is the role or tier that composed it.
+///
+/// The durable answer to "what did this agent actually receive". Skills, the
+/// task, the evaluator's feedback and the tool preamble are assembled from four
+/// places across three tiers, so re-deriving the prompt after the fact means
+/// re-running that assembly against data that has since changed. Recording it
+/// is the only way the question stays answerable.
+pub const PROMPT_COMPOSED: &str = "prompt.composed";
+/// The agent's own narrative for a turn. `detail.text`.
+///
+/// Written by `topology_worker` and pushed live once by `live_bus`. Until the
+/// reader below existed, the stored row was never read again by anything: both
+/// database readers in `routes/world.rs` filter to `tool.call`/`file.touch`,
+/// and the only other statement touching the table is the GC that deletes it.
+pub const REASONING: &str = "reasoning";
+
+/// Kinds the per-phase cap applies to.
+///
+/// The cap exists to bound the two unbounded kinds: a coding phase can call
+/// thousands of tools and touch thousands of paths. The others are bounded by
+/// the phase's own structure — one start, one completion, one prompt per turn —
+/// and counting them against the same budget meant a busy phase could push out
+/// its OWN terminal event, leaving a phase that looks like it never finished.
+const CAPPED_KINDS: &[&str] = &[TOOL_CALL, FILE_TOUCH];
+
+/// Does this kind count against, and get dropped by, `PER_PHASE_CAP`?
+pub fn is_capped(kind: &str) -> bool {
+    CAPPED_KINDS.contains(&kind)
+}
 
 /// Most events one phase may record.
 ///
@@ -89,12 +119,17 @@ pub async fn record(pool: &PgPool, e: MissionEvent) {
     } else {
         e.detail
     };
+    // The cap is still decided INSIDE the insert (see the test below), and now
+    // only counts the kinds it is meant to bound.
+    let capped = is_capped(&e.kind);
     let res = sqlx::query(
         "INSERT INTO mission_events
              (mission_id, phase_id, run_id, agent_id, kind, target, detail)
          SELECT $1, $2, $3, $4, $5, $6, $7
           WHERE $2::uuid IS NULL
-             OR (SELECT count(*) FROM mission_events WHERE phase_id = $2) < $8",
+             OR NOT $9
+             OR (SELECT count(*) FROM mission_events
+                  WHERE phase_id = $2 AND kind = ANY($10)) < $8",
     )
     .bind(e.mission_id)
     .bind(e.phase_id)
@@ -104,6 +139,8 @@ pub async fn record(pool: &PgPool, e: MissionEvent) {
     .bind(&e.target)
     .bind(&detail)
     .bind(PER_PHASE_CAP)
+    .bind(capped)
+    .bind(CAPPED_KINDS)
     .execute(pool)
     .await;
     if let Err(err) = res {
@@ -112,6 +149,40 @@ pub async fn record(pool: &PgPool, e: MissionEvent) {
 }
 
 /// Record several events under one round trip's worth of intent.
+/// Every recorded prompt and narrative for a mission, oldest first.
+///
+/// The read side of `PROMPT_COMPOSED` / `REASONING`. Both kinds were write-only
+/// before this: the prompt was never stored at all, and the narrative was
+/// stored and then read by nothing. Together they answer "what did this agent
+/// receive, and what did it say it did", which is the question
+/// `docs/PROVENANCE-ASSESSMENT.md` records as unanswerable.
+pub async fn narrative_for_mission(
+    pool: &PgPool,
+    mission_id: Uuid,
+) -> Result<Vec<(String, Option<Uuid>, Option<String>, String)>, sqlx::Error> {
+    let rows: Vec<(String, Option<Uuid>, Option<String>, Value)> = sqlx::query_as(
+        "SELECT kind, agent_id, target, detail
+           FROM mission_events
+          WHERE mission_id = $1 AND kind = ANY($2)
+          ORDER BY id",
+    )
+    .bind(mission_id)
+    .bind(&[PROMPT_COMPOSED, REASONING][..])
+    .fetch_all(pool)
+    .await?;
+    Ok(rows
+        .into_iter()
+        .map(|(kind, agent, target, detail)| {
+            let text = detail
+                .get("text")
+                .and_then(|v| v.as_str())
+                .unwrap_or_default()
+                .to_string();
+            (kind, agent, target, text)
+        })
+        .collect())
+}
+
 pub async fn record_all(pool: &PgPool, events: Vec<MissionEvent>) {
     for e in events {
         record(pool, e).await;