The registry packagePath points at versions/<version>/, but the root
SKILL.md copy makes it easy to hash the package root instead. Hashing
the root pulls the entire versions/ subtree into the digest and still
returns a value, so the mistake surfaces only as a failing gate later.
Records BUG-459 and corrects the task brief's D-2 table, which listed
the root SKILL.md as the hash target.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVapmh2oGNyr6ECHKjPJY8
The engine receipt says acceptance_allowed/selection_allowed false with
reasons insufficient_events and insufficient_domain_diversity, yet the
top-level projection flips both to true and renders adoptable candidates
after a single piece of evidence. Records the four structural causes:
dual decision authority where overlayPublicDecision lets TS override the
engine, insufficient-evidence sharing an exit with exhausted, capability
flags hardcoded across eleven branches, and several fail-open paths
including holdout "unavailable" granting adoption.
Also folds in the skill bump (D-2) after verifying that existing cases
bind their own skill_version and deprecated packages still resolve, so
no case migration is required.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVapmh2oGNyr6ECHKjPJY8
Jesse_Chen