feat(skills): add memory governance

[SebastienElet]

Summary

• add a source-backed memory governance skill for hard-to-derive durable invariants
• reject owned-defect workarounds, volatile incident state, and memory that replaces primary authority
• deploy the pilot only to Codex user scope and cover the deployment and text gates

Validation

• cargo test --manifest-path tooling/arnes/Cargo.toml
• bun test: 369 passed, 4 skipped, 0 failed
• bun run lint
• bun run typecheck
• bun run format:typescript:check
• Prettier, cspell, local skill doctor, and git diff check

Review

Independent pre-PR review found no remaining Critical or Important finding.

[SebastienElet]

Repair record

Review completed on e1ffc64a7dff80c0b74a74d6b055ee3705dffda6: the shipped Node upgrade still pins the current LTS and installs its exact resolved version, covered independently by 10/10 Node installation tests.

Corrections pushed:

• Removed the stale version-specific assertion from the legacy Shell integration test — mechanism: the project pin changed from 24.19.0 to 24.20.0, while the duplicated literal remained 24.19.0, so both Shell jobs rejected correct output; proof: tooling/upgrade-test reproduced the failure before the correction, then passed, while the independent Node contract and installation suites passed 21/21 targeted tests.

Not repaired:

• Atomic publication, stable identity, retry idempotence, and source-revision validation for memory records — reason: pre-existing product and architecture contract outside the authorized CI repair.
• Fresh-context behavioral evidence for skill activation and refusal paths — reason: pre-existing evaluation gap that this test-only correction cannot establish.

Barrier: no-observable-behavior tier; ShellCheck covered 8/8 scripts, tooling/upgrade-test passed, TypeScript formatting covered 112 files, lint and typecheck reported 0 errors and 0 warnings, Bun passed 370/373 tests with 3 skipped, Rust passed 512/512 tests, and GitHub reported 23/23 checks successful across macOS and Ubuntu, including both Shell jobs and Install all. Limits: local evidence came from macOS 26.6.2 arm64; actionlint, luacheck, Linux, and real installation were not reproduced locally, while GitHub covered their configured runners; three integration tests remained skipped.

[SebastienElet]

Repair record

Review completed on 4ca15f5509f9509457c4d4b09027441dd65379b7: the candidate-only contract and freshness-at-consumption wording remain unchanged, and an independent review found no blocking defect in the repair delta.

Corrections pushed:

• Replaced the unrecognized word repersist with persist — mechanism: the text-configuration job passed Prettier but CSpell rejected harness/skills/memory-governance/SKILL.md:73, leaving both push and pull-request lint runs red; proof: the same local CSpell 10.1.1 command failed on 1 file before the change, then checked 54 files with 0 issues after it, and both GitHub Text configuration jobs passed.

Not repaired:

• None.

Barrier: documentation tier plus the reached contract gates — Prettier checked 29 paths, CSpell checked 54 files with 0 issues, TypeScript lint and typecheck passed, targeted deployment tests passed 8/8, Bun passed 360/364 tests with 4 explicit skips and 0 failures, and all 26 GitHub checks passed. Limits: the four opt-in integration tests remained skipped; the previously documented behavioral-evaluation limits for rejection and freshness scenarios remain unchanged.