fix: one output_dir boundary check for run_skill admission and recipe rules

[Trecek]

Refs #5256

Summary

Bundled recipes passed output_dir: . to skills whose write_paths is BOUNDED. run_skill correctly rejects those dispatches, because . would widen the grant to the whole worktree. The static rules never caught it: four places each answered "is this output_dir admissible for this skill?" on their own, and they had drifted apart. Since #5211 moved 12 bundled skills to BOUNDED scopes, 17 bundled steps have been rejected at runtime, while every static check stayed silent or even required the rejected value.

This PR gives that question one answer and fixes the dispatches.

Changes

• One boundary check. output_dir_widens_scope(scope, output_dir, project_dir) and the shared diagnostic widened_output_dir_message(...) now live in the stdlib-only write-scope authority, hooks/_write_scope.py.
  • run_skill admission (_extend_closure_write_scope) and the skill-write-path-recipe-alignment rule both decide through it.
  • bounded_scope_contains is registered in POLICY_FUNCTIONS, so this check stays its only caller.
• Runtime diagnostic. A rejected dispatch now names the skill, the requested output_dir, and the declared directories. Admission behavior and the closure union extension (Cook sessions cannot compose skills: write boundary intersects across loaded skills, and composable sub-skills like prepare-issue are unusable #5154 / feat: compose skill write scopes by union with typed write_paths declarations #5211) are unchanged.
• Alignment rule. The pre-filter that hid ., ${{ context.work_dir }} and slash-only values is gone.
  • Each value is resolved to the path run_skill will judge: ., slash-only, or rooted at the step's cwd.
  • Only values that can't be resolved statically stay silent: another template root, or an absolute path.
• Write-skill rule. write-skill-requires-source-output-dir now fires only for skills declared write_paths: unrestricted that omit output_dir. The duplicate test_write_skill_steps_have_output_dir is removed, since the real rule's bundled sweep covers it.
• Recipes. output_dir: . is dropped from the 17 BOUNDED dispatches in implementation, implementation-groups, remediation, merge-prs, research, research-implement and research-review. Those skills are make-plan, prepare-pr, prepare-research-pr and compose-research-pr. The default floor <cwd>/.autoskillit/temp/<skill> equals each one's declared scope.
• vis-lens fix.
  • vis_apply passed output_dir: run-vis-lenses to vis-lens-{slug} skills, so the runtime rejected every lens dispatch. It now passes no output_dir.
  • synthesize-vis-plan previously read a directory no skill writes. It now consumes the captured vis_lens_output_paths through a new optional lens_output_paths input.
  • The contract, SKILL.md and phoropter docs are updated to match.
• Regenerated files. Compiled recipe JSON, diagram recipe hashes, the pinned pre-delivery structure digests, and the pretty-output baseline maxima.

Drift guard

• tests/server/test_bundled_dispatch_write_scope_admission.py dry-runs every tracked bundled run_skill step through the real _resolve_dispatch_paths and _extend_closure_write_scope. It asserts that each step is admitted and that the alignment rule flags exactly the steps the runtime would reject.
  • Planner steps run through a reviewed probe value for ${{ context.planner_dir }}.
  • Templated-skill dispatches must pass no output_dir.
  • Positive controls keep the sweep non-vacuous.
• tests/server/test_attested_dispatch_write_scope_admission.py drives the real attested run_skill for implementation:plan and implementation:prepare_pr. It pins the narrowed write-watch directory.
• test_rule_is_exercised_not_vacuously_silent proves that the bundled zero-findings test is earned.

Verification

• Red before green. Before the fix, the new tests failed for the stated reasons: 17 runtime rejections that the rule did not flag, and both vis_apply templated-skill violations.
• Guards catch breakage. Each deliberate break failed the right test: removing the reviewed planner root, adding a bogus root key, restoring output_dir on vis_apply, and disabling the rule's step selection.
• User-recipe parity. A scratch copy of implementation.yaml with output_dir: . restored on plan reports one skill-write-path-recipe-alignment ERROR that carries the runtime's own diagnostic.
• Isolated Docker admission probe (the issue's probe, adapted to the shared check) on a9a8ed994 exits 0:
  • configured_output_dir: "" gives configured_output_dir_widens: false;
  • . gives dot_output_dir_widens: true.
• Targeted suites. tests/recipe, tests/arch, tests/hooks, tests/workspace, tests/infra, tests/contracts, tests/skills_extended and the recipe-loading tests/server files pass. pre-commit run --all-files and the complexity ratchet against develop pass.
• Not yet run. The full task test-local-gate has not been run.

Commissioning still pending (post-merge)

Per #5256, run the PR #5255 implementation E2E scenario on MiniMax twice against sandbox seed TalonT-Org/autoskillit-e2e-sandbox#1, and confirm that both pass plan and prepare_pr admission. Do that before claiming commissioning. This PR does not close the issue for that reason.

Notes for reviewers

• User-recipe impact. User recipes that pass ., /, or a cwd-equal template to a BOUNDED skill now get a static ERROR carrying the runtime's diagnostic. The git-excluded local .autoskillit/recipes/remediation-fable.yaml will report it on its make-plan, prepare-pr and compose-pr steps. Its owner should drop output_dir there.
• Narrowing. For the 17 steps, allowed_write_prefixes and the write-watch snapshot narrow from the worktree to the skill's own directory. Each skill's NEVER block already confines it there, and none of these skills is in WORKTREE_SKILLS.

🤖 Generated with Claude Code