Pack manifest as the single source: routing guidance, skills, scoped rules

[missingbulb]

Nothing in the corpus said where a piece of content belongs, so when a rule, doc, skill or check could plausibly live in more than one pack the decision defaulted to basics — which is exactly how the GitHub Actions cron doctrine landed there in this PR's first commit. Fixing that turned into making the pack manifest state what a pack is, and retiring the places that said it a second time.

The manifest spec (#559)

engine/pack_loader/pack-schema.mjs declares every field a pack.mjs may carry, which are required, and each one's constraints. The loader validates every manifest against it — canon and consumer local packs alike — so an incomplete declaration is a blocking config error at load, the same class as invalid JSON in .claudinite-checks.json. A required manifest field is part of the pack contract, not a conformance opinion about a repo's content: a check would have to be declared by a pack, run only when that pack is active, and re-derive the manifest by reading its source text.

• Reported, not fatal — the pack still loads and still runs its checks; silently disabling a repo's own rules is a worse failure than the one being reported.
• The vocabulary is closed, so a typo (rule:, skill:) fails loudly instead of being ignored forever.

ruleRoutingGuidance — what belongs here, and what does not

ruleRoutingGuidance: {
  belongs: 'workflow YAML and Actions runner platform behaviour: triggers, secrets, permissions, scheduling, artifacts, reusable workflows and their pitfalls',
  excludes: 'git and GitHub command procedure — git-github; release pipeline content for one product — its release pack',
},

Both sides required, each capped at 20 words — a session-context budget, not a style rule: inject-pack-prose emits the set as a routing table at session start, one row per pack, for every pack discovered (a consumer holds only what it vendored, so that set is already what it can route into). excludes names the pack that owns the other side, so the table routes rather than merely refuses; a boundary true of every pack carries no routing information and wastes the row. Filled in for all 27 canon packs and the home's two local packs.

worldRules / workRules — a rule's scope is its placement

The single rules array splits in two, so which list a rule sits in is what makes it world- or work-scoped. The loader flattens both into the rules array the runners walk, stamping each rule's scope from its list. A rule module may still carry scope — the runRule dispatch seam reads it off the rule object to hand work rules their fluent surface — but the two must agree, or it's a load error.

skills — the bundle, declared

skills: ['merge-to-main', ...], held to the skills/ tree in both directions: an undeclared directory is a skill nothing announces, a declared name with no directory is a manifest that lies. What each skill covers stays in its SKILL.md frontmatter rather than being copied.

Pack READMEs

With skills and scoped rules on the manifest, each pack README's checks table and skills table were a second copy — and had already drifted: basics/README.md listed a skill-ownership check the pack does not carry and omitted catalog-completeness and comment-classification. Both tables are stripped from every pack README, and the five files that were nothing else are deleted: github-actions plus the four stub packs, whose one non-derivable sentence (expected first source) moved into the manifest header comment.

The other 22 stay — provenance, design rationale, scope notes against sibling packs, an index of their RULES.md prose, none of it in the manifest. catalog-completeness now looks for the pack directory in the catalog rather than a README inside it.

The cron doctrine, rehomed (#556)

Out of packs/basics/scheduled-tasks.md and into packs/github-actions/skills/github-actions-scheduling/ — the pack that owns Actions platform behaviour. GitHub's schedule: trigger is a request to queue, not a promise to run: late fires, dropped fires with no failure and nothing in the run ledger, and the 60-day inactivity disable (Upptime's measurement). What follows: never let correctness depend on a firing happening or on when it happened; stay idempotent and self-catching; catch up the most recent slot only; keep off :00; say "about hourly, best-effort"; don't debug a late run as a bug before checking whether GitHub fired at all.

packs/basics/scheduled-tasks.md is unchanged from main — the scheduling doctrine stays put, only the platform truth moved.

Verification

• 945 tests, 945 pass across the CI test roots, including 12 new tests for the manifest spec and a corpus-wide assertion that every discovered pack loads clean through it.
• node engine/checks/check_the_world.mjs → 0 blocking, 8 advisory — the same pre-existing file-placement advisories in engine/, none new.
• Fixtures updated where the change reached them: fake-corpus test harnesses copy pack-schema.mjs beside the registry, the vendor set grew by that one file, and the demo local packs declare ruleRoutingGuidance.