fix(skills): judge official skill updates by ownership, not snapshot matching (#27603)

* fix(skills): judge official skill updates by ownership, not snapshot matching

Orca decided whether an installed official skill was pristine by matching its
bytes against a shipped list of past snapshots, falling back to the skills CLI's
lock hash. Copies installed between releases, CRLF copies, and installs whose lock
recorded a sha256 hash all read "doesn't match the official version" and could not
be updated (#26841), and older content could be labelled newer and never offered.

Now an official skill is Orca's when the skills.sh global lock says it came from
stablyai/orca, and it is current only when its listed files equal the bundled
manifest (line endings and sidecars ignored); anything else is outdated. Install
and update are one pinned `skills add .../tree/v<appVersion>` command, used by the
in-app runner, `orca skills update`, and the Settings rails. The update dialog
preselects Orca-owned rows and lists same-named skills from elsewhere unchecked.

Removes the snapshot registry, release mapping, git-tree identity, lock trust and
convergence logic, and the release-cut provenance step.

* ci(skills): run the pinned-add round trip on a skills CLI that can fetch a commit

* fix(skills): let orca skills update target the shared folder on a bare host

Update became the same pinned add as install, so it inherited install's
refusal when no agent is detected. That broke the bare-host update the old
command guaranteed, and the built-CLI check (update --dry-run, no --agent) on
CI runners. The in-app runner already fell back to universal; both now share
one detectSkillsCliUpdateAgentKeys rule.

Also brings the CLI skills docs off `npx skills update`.

* refactor(skills): derive the update selection from the grouped rows

The selection hook took the live and the retained inventory, re-derived Orca
ownership from installations beside the grouping's own orcaOwned, and kept a
separate display count. Groups already carry both eligibility and ownership,
so the hook reads them once; the button's existing live-scan gate is the only
authorization check. The unselected line is inlined into the headline.

* refactor(skills): drop helpers the ownership design made redundant

- isOwnerManagedSkillScope only negated into the participation check once
  plugin caches stopped participating; fold it in.
- Eligibility re-checked resolvedPath/physicalIdentity, which observation
  already turns into 'inaccessible'.
- The manifest verifier probed access() before a readFile that throws anyway.
- orchestration-install-command.ts only forwarded one constant from the lib
  module its three importers already import.

* i18n(skills): stop naming npx skills update in four skipped-copy strings

The es/ja/ko/zh cantUpdateReason and tipDuplicate strings still named
`npx skills update`, which Orca no longer runs for its skills. Say 'the update
command' instead.

* refactor(skills): inline the single-use pinned source URL helper

orcaSkillsSourceUrl was exported but only called by the builder beside it.

* fix(skills): let an update choice lapse when the install source changes

The selection froze every checked name, Orca's preselection included, the
moment the user ticked anything. A re-check that then attributed a name to
another source kept it checked, replacing it without consent. Store only the
user's explicit choices, keyed by name and lock source, and default to
ownership otherwise.

* fix(skills): label the empty update action 'Update skills', not 'Update 0 skills'

The button stays whenever a row is updatable, so unticking every row (or a
dialog with only non-Orca copies outdated) doesn't reflow the footer. At zero
selected it stays disabled and reads 'Update skills' instead of a zero count.
The label lives beside the dialog's other count copy.

* fix(skills): let keyboard focus open the Not from Orca tooltip

The source of a non-Orca copy is only in the tooltip, and its trigger was a
plain span. Make it focusable like Orca's other tooltip-on-text triggers
(tabIndex 0, cursor-help, the row primitive's focus ring), as in the agreed
mock.

* test(skills): hold the round-trip add equal to the shared install builder

The CI round trip hardcoded its skills add argv, so it could drift from what
Orca runs. A .mjs script can't import the TS builder (extensionless imports),
so the argv moves into an exported roundTripAddArgs and a unit test asserts it
is the builder's unattended add with the tag swapped for the PR commit. The
script runs under the same main guard as the manifest generator.

* i18n(skills): translate the skill row's location count and duplicate reason

es, ko and zh still carried English for SkillUpdateRow.oneLocation and
manyLocations, and es and ko for SkillFreshnessRow.skippedReasonDuplicate.

* fix(skills): pin official skill installs to the build commit and skills CLI

`skills add .../tree/v<version>` only works for stable and RC builds: hourly,
daily and adhoc builds publish elsewhere, so stablyai/orca has no tag for their
version and both install and update failed there. Every build is made from a
commit that exists in stablyai/orca, so the build now stamps `git rev-parse HEAD`
and the one shared builder pins to `tree/<commit>`, which equals the bundled
skills by construction. Main, renderer, web and vitest get it as
ORCA_BUILD_COMMIT (replacing ORCA_APP_VERSION); the tsc-built CLI reads it from
the compiled out/package.json boundary. A missing or malformed commit fails the
build or the command with a clear error instead of building a bad URL.

The builder also pins the skills CLI (`npx skills@1.7.2`): 1.5.x cannot fetch a
commit, and a bare `npx skills` can reuse a stale cache or resolve to another
binary (#18687). The CI round-trip script reuses the same constant.

* ci(skills): run the round trip on the shared pinned skills CLI version

* docs(skills): document the commit-pinned skills add

* refactor(skills): keep the pinned skills CLI version in the install builder

skills-cli-version.ts existed only so the plain-Node round-trip script could
strip-load a .ts file, which needed --disable-warning in CI. The version now
lives beside the builder that uses it; the script keeps a literal, and the
existing round-trip test already asserts its argv, skills@<version> included,
equals the builder's.

* refactor(skills): validate the build commit once, where it is resolved

resolveBuildSourceCommit already refuses anything but a full hash, and both the
define and the CLI's stamped package.json come from it. The builder's second
check could only fire as a module-load throw in the renderer's command
constants. Also drops the resolver's unused cwd parameter.

* test: stamp a fixed build commit instead of running git in the vitest config

Tests only interpolate ORCA_BUILD_COMMIT, so they need not read HEAD (or fail
outside a git checkout) on every run.

* refactor(settings): match only skills add in the Windows npx preflight

Every official skill command is now the builder's skills@<version> add; no
rail emits skills update any more.

* fix(skills): fail an update that leaves a broken skill link behind

Eligibility already skips names with a broken link before the run, so one
afterwards is the run's own damage; report it instead of claiming success.

* ci(release): refuse to tag when the skill manifest is stale

The removed --release step implicitly checked the committed manifest against
skills/. Keep that guarantee with a verify-only run; it writes nothing.

---------

Co-authored-by: Orca Worker <orca-worker@localhost>

.github/workflows/release-cut.yml

@@ -732,19 +732,13 @@ jobs:
           # message and tag name explicitly (avoids npm's `v1.2.3` prefix
           # assumptions and any lifecycle scripts that would run on bump).
           npm version "$VERSION" --no-git-tag-version --allow-same-version
-          # Why: the cut is the only point where committed skill bytes become a
-          # released revision. Without this row the ledger never advances, so the
-          # next skill change rebuilds the revision this tag ships over different
-          # bytes and every install of it stops matching a known snapshot.
-          # --release is provenance-only: it fails if the content-addressed
-          # artifacts do not already match this ref and writes just the mapping
-          # row, so the version commit stays skill-independent. Node built-ins
-          # only, so this needs no install.
-          if ! node config/scripts/generate-skill-bundle-manifest.mjs --release "$VERSION"; then
-            echo "::error::Refusing to record release provenance for v$VERSION: the committed skill artifacts do not match this ref. Land a regeneration on main, then re-run the cut." >&2
+          # Why: freshness compares installs against the bundled manifest, so a tag must
+          # never ship skill bytes it doesn't describe. Node built-ins only; no install.
+          if ! node config/scripts/generate-skill-bundle-manifest.mjs; then
+            echo "::error::Refusing to tag v$VERSION: the committed skill manifest does not match skills/. Land a regeneration on main, then re-run the cut." >&2
             exit 1
           fi
-          git add package.json resources/skills/release-mapping.json
+          git add package.json
           commit_message="release: v$VERSION"
           if [[ "$EVENT_NAME" == "schedule" ]]; then
             commit_message="$commit_message [rc-slot:$SLOT]"
@@ -761,16 +755,16 @@ jobs:
           # var, a composite action, or concatenation, and `git commit` has forms
           # (-a, -i, --only, a pathspec) that commit the working tree rather than
           # the index. Assert what the commit actually carries, so the tag can
-          # only ever ship the version bump and the provenance row, no matter
-          # which step staged what or how the commit was spelled.
+          # only ever ship the version bump, no matter which step staged what or
+          # how the commit was spelled.
           # -F because the allowlist is literal: unanchored, `.` would match any
           # character and quietly admit a path like `packageXjson`.
           # -m --first-parent: plain diff-tree prints NOTHING for a merge commit,
           # which would make this guard pass silently rather than fail closed.
           committed="$(git diff-tree --no-commit-id --name-only -r -m --first-parent HEAD |
-            grep -vxF -e 'package.json' -e 'resources/skills/release-mapping.json' || true)"
+            grep -vxF -e 'package.json' || true)"
           if [[ -n "$committed" ]]; then
-            echo "::error::Release commit carries unexpected paths: $(echo "$committed" | tr '\n' ' ')Only package.json and the skill release-mapping row may ship in a version commit." >&2
+            echo "::error::Release commit carries unexpected paths: $(echo "$committed" | tr '\n' ' ')Only package.json may ship in a version commit." >&2
             exit 1
           fi
           git tag -a "v$VERSION" -m "v$VERSION"

.github/workflows/skill-update-roundtrip.yml

@@ -11,6 +11,7 @@ on:
       - 'resources/skills/**'
       - 'config/scripts/verify-skill-update-roundtrip.mjs'
       - 'src/main/skills/skill-freshness-eligibility.ts'
+      - 'src/shared/agent-feature-install-commands.ts'
       - 'src/shared/skill-freshness.ts'
       - '.github/workflows/skill-update-roundtrip.yml'
   # Why unfiltered: GitHub ignores `paths` on merge_group. We do not run a merge
@@ -33,7 +34,8 @@ jobs:
         os: [macos-latest, ubuntu-latest, windows-latest]
         shape: [symlink, copy]
         autocrlf: ['false', 'true']
-        skills-cli: ['1.5.17']
+        # Why: `pinned` runs the skills CLI version Orca ships (SKILLS_CLI_VERSION).
+        skills-cli: [pinned]
         include:
           - os: ubuntu-latest
             shape: symlink
@@ -44,20 +46,18 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          # Historical skill snapshots need tags, but only their blobs are read.
-          fetch-depth: 0
-          filter: blob:none
           persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
-      - name: Verify targeted update convergence and copy behavior
+      - name: Verify the pinned add replaces stale copies
         env:
           GITHUB_TOKEN: ${{ github.token }}
           SKILL_UPDATE_SOURCE: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
-          SKILL_UPDATE_REF: ${{ github.head_ref || github.ref_name }}
+          # A commit, the same kind of ref Orca pins official skills to.
+          SKILL_UPDATE_REF: ${{ github.event.pull_request.head.sha || github.sha }}
         run: >-
           node config/scripts/verify-skill-update-roundtrip.mjs
-          --cli=${{ matrix.skills-cli }}
+          ${{ matrix.skills-cli == 'latest' && '--cli=latest' || '' }}
           --autocrlf=${{ matrix.autocrlf }}
           --shape=${{ matrix.shape }}