align skills with additive project policy

2026-08-16 22:14:57 +02:00
parent f6d0efdfc0
commit 92a2849376
5 changed files with 25 additions and 7 deletions
@@ -194,7 +194,9 @@ exits, environment/config precedence, credential timing, dependencies, pattern
 semantics, and one realistic pipeline. Explicit help succeeds on stdout; usage
 errors fail on stderr. Selector help gives value grammar, canonicalization, and a
 least-authority policy row, including AND within one row and alternatives across
-rows.
+approved global and ancestor-project rows. Project rows are not automatically
+trusted: Ink freezes the normalized effective policy and requires digest approval;
+child/session policy and the host floor may only narrow it.

 Keep argv unsurprising: options before operands, `--` ends options, `-` denotes a
 natural stream, secrets never enter argv, and unknown, incompatible, or trailing