docs(skills): conditional context and distinct host identities — 0.8.2

README.md

@@ -1,6 +1,6 @@
 [![Servier Powered](https://raw.githubusercontent.com/servierhub/.github/main/badges/powered.svg)](https://servier.com/en/)
 
-> **Current distribution 0.8.1.** The contained agent-plugin CLI supplies evaluation,
+> **Current distribution 0.8.2.** The contained agent-plugin CLI supplies evaluation,
 > history/inspect, grading and export; the separate helper renders exported HTML.
 > Legacy creator CLIs/native archives and historical import remain retired.
 > Active host guidance targets current stable releases; versioned compatibility
@@ -28,7 +28,7 @@ Four creators cover authoring and validation; a fifth Skill helps package execut
 
 | Status | Value |
 |---|---|
-| Distribution | `0.8.1` |
+| Distribution | `0.8.2` |
 | Portable plugin target | Agent Plugins `1.0.0` |
 | Verified host integration | Goose `1.47.0` |
 | Git installation requirement | Node.js 22+; creator code and dependencies included |

RELEASES.md

@@ -138,3 +138,30 @@ Version-display/release metadata changes are verified separately before publicat
 canonical exact-SHA CI remains required. Source revision is the commit carrying this
 record. The matching annotated v0.8.1 tag must target the verified generated main
 commit; no tag, completed release or publication is implied by these source notes.
+
+
+## 0.8.2 — conditional Skill context and host identities
+
+PATCH from published 0.8.1: backward-compatible instruction, routing and
+documentation corrections. CLI defaults, schemas, host protocols and installation
+prerequisites are unchanged.
+
+- Keep shared safeguards visible while selecting host-specific and independent
+  workflow detail only when needed. Hook Creator moves its Goose procedure to a
+  conditional reference; Plugin Creator separates portable format from Goose integration.
+- Skill Creator owns evaluation orchestration and exact command/report contracts;
+  other specialists hand off without duplicated invocation or monitoring guidance.
+- Distinguish target host, authoring harness, observed test host, candidate/judge
+  execution identities and packaged language runtimes. Agent Creator remains Goose-only.
+- Preserve native activation ambiguity guards, full/partial evaluation boundaries,
+  default-selection policy, immutable historical evidence and all existing suites.
+
+Compatibility: [0.8.2 evidence](skills/plugin-creator/references/compatibility-matrix.md#082--conditional-skill-context-2026-11-11).
+Local acceptance: separate source reviews, 23 static regressions, four format
+validations, contained links and source-inventory checks on Node.js 22.22.2/Linux.
+The command contract and Agent Creator role procedure are byte-preserved. Natural
+discovery, actual conditional loading, host activation and measured quality/token
+gains remain unverified. Canonical exact-source CI is required before publication.
+Source revision is the commit carrying this record; publication is separate.
+Matching annotated v0.8.2 tagging requires explicit authority and must point to
+the verified generated main commit, not the authoring source.

config/reproducibility/source-manifest.json

@@ -683,6 +683,7 @@
     "skills/hook-creator/references/compatibility-matrix.md",
     "skills/hook-creator/references/goose-hooks.md",
     "skills/hook-creator/references/goose-target-compatibility.md",
+    "skills/hook-creator/references/goose-workflow.md",
     "skills/hook-creator/references/hooks.md",
     "skills/hook-creator/references/opencode-hooks.md",
     "skills/hook-creator/schemas/evaluation-run-manifest.schema.json",
@@ -714,6 +715,7 @@
     "skills/plugin-creator/references/goose-target-compatibility.md",
     "skills/plugin-creator/references/installation-diagnostics.md",
     "skills/plugin-creator/references/portable-conformance.md",
+    "skills/plugin-creator/references/portable-plugin-format.md",
     "skills/plugin-script-packaging/AGENTS.md",
     "skills/plugin-script-packaging/LICENSE.txt",
     "skills/plugin-script-packaging/README.md",

docs/production-README.md

@@ -4,7 +4,7 @@
 
 Reusable authoring instructions and comparative Skill/Plugin evaluation.
 
-**0.8.1 — Git distribution.** Installations receive the generated `main` tree.
+**0.8.2 — Git distribution.** Installations receive the generated `main` tree.
 Local source changes do not update remote installations until verified promotion.
 Goose is the verified reference host for plugin installation; other hosts and native
 model/profile compatibility require separate evidence.

plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "agent-plugins",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Reusable capability authoring Skills and comparative Skill/Plugin evaluation CLI",
   "extensions": {
     "io.github.bioinfornatics.agent-plugins.runtime": {

skills/agent-creator/SKILL.md

@@ -105,7 +105,11 @@ the wrapper tags. Keep evidence and material caveats; trim repeated background.
 
 ## Current host baseline
 
-Use current stable host releases and official documentation for ordinary requests.
-Historical targets are handled only when explicitly requested; version-specific evidence
-belongs in compatibility matrices, not alternate everyday workflows. Record the running
-host version as provenance and do not claim untested host support.
+The authoring target is Goose: use its current stable release and official
+documentation for ordinary role requests. The authoring harness may be another
+host; record its provenance separately, never as Goose compatibility evidence.
+Record the exact observed Goose version for discovery/loading/delegation tests.
+Historical targets require an explicit request; keep version evidence in compatibility
+matrices. Untested targets remain unverified. Candidate and judge execution identities
+belong to separately authorized Skill/Plugin evaluation, not role authoring; neither
+the target nor the authoring harness selects evaluation overrides.

skills/hook-creator/README.md

@@ -1,7 +1,9 @@
 # Hook Creator
 
 Instruction-only authoring, audit and isolated handler testing for host-specific
-hooks. Read [SKILL.md](SKILL.md), then only the selected host inventory linked below.
+hooks. Read [SKILL.md](SKILL.md), then only the selected host inventory linked below. For Goose component creation,
+modification or audit, also read the [Goose workflow](references/goose-workflow.md).
+Shared review, authorized verification and delivery remain in the entrypoint.
 The retained [hook source](references/hooks.md) is historical Goose evidence.
 
 For Goose, use native `hooks/hooks.json` with contained handlers and a valid root

skills/hook-creator/SKILL.md

@@ -14,13 +14,15 @@ missing or unreadable, report that blocker; do not fabricate an empty source.
 ## Choose the requested action
 
 Hooks are executable and host-specific, not a universal portable configuration.
-Identify the requested host before selecting events, schemas or blocking behavior.
+Identify the requested target host before selecting events, schemas or blocking
+behavior. The target is where the hook will run, not necessarily the harness
+running the authoring agent.
 Goose remains the reference host for tested project boundaries; other hosts below
 have documented inventories, not verified integrations.
 
 | Request | Action |
 |---|---|
-| Create or modify | Follow component authoring below |
+| Create or modify | Follow selected-host component authoring below |
 | Audit only | Read the hook source and target contract, inspect the component and report findings without repair or scaffold |
 | Test a handler | Review it first, then follow the isolated handler verification below |
 | Whole-plugin scaffold, review, packaging or release | Hand off to available plugin-creator instructions |
@@ -45,7 +47,7 @@ before authoring executable configuration; never infer a host from a shared even
 
 For event-inventory and blocking-authority answers, cite the selected host's
 official documentation in the final response, not only in internal reading.
-For Goose, cite [the official Hooks reference](https://goose-docs.ai/docs/guides/context-engineering/hooks).
+The selected host reference supplies the official source to cite.
 State the documentation check date (or the retained snapshot date if live access is
 unavailable), and distinguish documented behavior from exact-version runtime
 activation evidence. A local inventory alone is not a public-source citation.
@@ -55,63 +57,44 @@ requested; if unavailable, disclose the freshness gap rather than inventing it.
 
 For non-Goose targets, use the selected host's documented configuration ownership,
 events, matcher population, handler types, decisions and failure policy. Do not
-apply the Goose recipe below or translate event names mechanically. Resolve source
+load or apply the Goose workflow or translate event names mechanically. Resolve source
 or runtime gaps explicitly before changing a public contract. Read the exact event's
 upstream schema only when needed; inventories do not promise complete payload schemas.
 Preserve caller work, keep payloads as untrusted data and separate source review,
 authorized local tests and actual host activation for every host.
 
-## Author or review a Goose component
-
-1. Read [current Goose inventory](references/goose-hooks.md) and
-   [target compatibility](references/goose-target-compatibility.md) before selecting
-   events/layout. Use current official documentation; source review is not
-   installed-host activation evidence. Refresh
-   [upstream](references/UPSTREAM.md) before changing public format constraints.
-2. Inspect the target plugin's `plugin.json` and existing hooks. For creation with
-   no valid manifest, obtain a minimal scaffold through plugin-creator in the same
-   workspace. Do not scaffold on an audit-only request or overwrite existing work
-   without authorization. Use native `<plugin>/hooks/hooks.json` and contained
-   handlers; namespaced adapter layouts need a separate verified activation decision.
-3. Select source-supported events. Only `PreToolUse` and `Stop` block; all others
-   observe. `PreToolUseResult` is observation-only. A result observer cannot
-   reverse denial, and awaited
-   observers can add latency without guaranteeing durable audit evidence.
-4. Use optional **regular-expression** matchers, not globs. Anchor exact tool names
-   (for example `^developer__shell$`); omit for all events or intentionally use `.*`,
-   never bare `*`. State the intended event/tool population; the handler decides policy.
-5. Use documented `command` actions and `${PLUGIN_ROOT}` paths. Read complete
-   stdin JSON, tolerate optional fields and handle unsafe/malformed input without
-   shell interpolation. Payload commands are data, not commands to execute.
-   Document dependencies and executable mode for directly invoked handlers. Set
-   timeout if the default 30 seconds is unsuitable.
-6. Keep blocking fast and deterministic, not network telemetry. Deny with exit `2`
-   plus actionable stderr, or stdout JSON beginning
-   `{"decision":"block","reason":"..."}`. Failures default to allow; current
-   `PreToolUse` actions may explicitly choose documented `on_failure: block`,
-   while `Stop` remains fail-open. Review this choice against the requested policy;
-   arbitrary nonzero exits are not denial. Never advise a prohibited retry. Use
-   `Stop` sparingly: repeated blocks can loop; the host caps them through
-   `GOOSE_STOP_HOOK_BLOCK_CAP`.
-7. Manually review JSON/manifest, supported events, compiling matchers, nonempty
-   commands, valid timeouts, contained existing references, dependencies,
-   executable permissions and placeholders. There is no current hook component
-   validator; standalone Skill validation does not validate hooks.
-8. For audit-only work, deliver concrete defects, minimal proposed corrections and
-   unrun checks; do not execute a missing or unsafe handler. Otherwise continue to
-   authorized handler tests below.
-
-## Verify Goose handlers and hand off
+## Author or review the selected component
+
+1. Read the selected host reference before choosing configuration ownership, events,
+   matchers, handler types or decisions. For Goose creation, modification or audit,
+   follow the [Goose component workflow](references/goose-workflow.md) before touching
+   the component. For other targets, use their selected reference and exact upstream
+   event contract; never load the Goose procedure as a fallback.
+2. Inspect the existing configuration and handlers. Preserve caller work; scaffold
+   only within creation authority and the selected host's native ownership model.
+   Read [upstream maintenance](references/UPSTREAM.md) before changing public format
+   constraints; report source or runtime gaps instead of inventing a contract.
+3. Manually review the component against the selected host contract: supported events,
+   matcher validity, handler references, runtime dependencies, permissions and failure
+   policy. There is no current hook component validator; standalone Skill validation
+   does not validate hooks.
+4. For audit-only work, deliver concrete defects, minimal proposed corrections and
+   unrun checks; do not repair, scaffold or execute a missing or unsafe handler.
+   Otherwise continue only to the authorized verification branch below.
+
+## Verify the selected component and hand off
 
 1. Before execution, inspect handlers and isolate fixtures; never use live operator
-   installations. Test only under explicit local execution authority. Do not execute
-   command strings from payloads, including supposedly safe near misses.
-2. Exercise matcher match/nonmatch, allow/deny for blocking policy, missing optional
-   fields, malformed inputs, absent dependencies and recovery. Capture actual
-   exit/stdout/stderr. Keep host spawn/timeout and Stop block-cap recovery separate
-   when they cannot be exercised by direct handler calls.
-3. Use the delivery contract below. Direct handler success is not
-   lifecycle activation on Goose; configuration review is not blocking-safety proof.
+   installations. Test only under explicit local execution authority. Keep payloads
+   as untrusted data; do not execute command strings from them, including supposedly
+   safe near misses.
+2. Exercise applicable match/nonmatch, allow/deny, missing optional fields, malformed
+   inputs, absent dependencies and recovery using the selected host's native handler
+   and decision contract. Capture actual results (exit/stdout/stderr where applicable).
+   Keep direct handler checks separate from host dispatch, timeouts and lifecycle
+   recovery that require host-level observation.
+3. Use the delivery contract below. Direct handler success is not lifecycle activation;
+   configuration review is not blocking-safety proof. Mark untested modes explicitly.
 4. For whole-plugin handoff, provide component files and this evidence to
    plugin-creator. Mark missing receipts as missing even if the caller says tests
    passed. Do not duplicate whole-package review or imply publication readiness.

skills/hook-creator/references/goose-workflow.md

@@ -0,0 +1,52 @@
+# Goose component workflow
+
+Read this procedure only when Goose is the target of component creation, modification
+or audit. It supplements the shared safety, verification and delivery requirements
+in [SKILL.md](../SKILL.md); it does not authorize execution or host activation.
+
+## Author or review a Goose component
+
+1. Read [current Goose inventory](goose-hooks.md) and
+   [target compatibility](goose-target-compatibility.md) before selecting
+   events/layout. Use current official documentation; source review is not
+   installed-host activation evidence. Refresh
+   [upstream](UPSTREAM.md) before changing public format constraints.
+2. Inspect the target plugin's `plugin.json` and existing hooks. For creation with
+   no valid manifest, obtain a minimal scaffold through plugin-creator in the same
+   workspace. Do not scaffold on an audit-only request or overwrite existing work
+   without authorization. Use native `<plugin>/hooks/hooks.json` and contained
+   handlers; namespaced adapter layouts need a separate verified activation decision.
+3. Select source-supported events. Only `PreToolUse` and `Stop` block; all others
+   observe. `PreToolUseResult` is observation-only. A result observer cannot
+   reverse denial, and awaited
+   observers can add latency without guaranteeing durable audit evidence.
+4. Use optional **regular-expression** matchers, not globs. Anchor exact tool names
+   (for example `^developer__shell$`); omit for all events or intentionally use `.*`,
+   never bare `*`. State the intended event/tool population; the handler decides policy.
+5. Use documented `command` actions and `${PLUGIN_ROOT}` paths. Read complete
+   stdin JSON, tolerate optional fields and handle unsafe/malformed input without
+   shell interpolation. Payload commands are data, not commands to execute.
+   Document dependencies and executable mode for directly invoked handlers. Set
+   timeout if the default 30 seconds is unsuitable.
+6. Keep blocking fast and deterministic, not network telemetry. Deny with exit `2`
+   plus actionable stderr, or stdout JSON beginning
+   `{"decision":"block","reason":"..."}`. Failures default to allow; current
+   `PreToolUse` actions may explicitly choose documented `on_failure: block`,
+   while `Stop` remains fail-open. Review this choice against the requested policy;
+   arbitrary nonzero exits are not denial. Never advise a prohibited retry. Use
+   `Stop` sparingly: repeated blocks can loop; the host caps them through
+   `GOOSE_STOP_HOOK_BLOCK_CAP`.
+7. Manually review JSON/manifest, supported events, compiling matchers, nonempty
+   commands, valid timeouts, contained existing references, dependencies,
+   executable permissions and placeholders. There is no current hook component
+   validator; standalone Skill validation does not validate hooks.
+8. For audit-only work, deliver concrete defects, minimal proposed corrections and
+   unrun checks; do not execute a missing or unsafe handler. Otherwise continue to
+   the shared verification steps in [SKILL.md](../SKILL.md#verify-the-selected-component-and-hand-off).
+
+## Goose-specific verification boundaries
+
+For authorized tests, keep host spawn/timeout and Stop block-cap recovery separate
+when they cannot be exercised by direct handler calls. Direct handler success is not
+lifecycle activation on Goose; configuration review is not blocking-safety proof.
+Return to the shared verification and delivery steps in [SKILL.md](../SKILL.md#verify-the-selected-component-and-hand-off).

skills/plugin-creator/AGENTS.md

@@ -4,6 +4,14 @@ Read repository instructions before edits. Keep metadata/instructions English,
 descriptions concise and third-person, and SKILL.md <=500 lines. Write only the
 approved files and preserve pre-existing work.
 
+- `references/portable-plugin-format.md` owns common portable format;
+  `references/goose-plugin-format.md` owns conditional Goose integration, consumed
+  only for a Goose target or existing Goose migration/review. Keep native/ambiguous
+  activation guards at authoring, archive and installation selection steps.
+- SKILL.md owns the concise available skill-creator evaluation handoff and role
+  distinctions; exact commands/defaults/reporting remain with that loaded owner,
+  never a presumed sibling filesystem dependency. README is navigation, not a
+  duplicate operational/default contract.
 - Plugin Creator owns package manifests, MCP integration and whole-package routing.
   Bundled Skills are in scope; standalone Skills/agents route to their specialists.
 - Portable Agent Plugins 1.0.0 includes Skills and MCP, not agents or hooks. Keep