[iililiiilili]

What Problem This Solves

Fixes an issue where installed Skill Hub skills could remain unavailable in a managed Knox room when its installation record or existing sandbox mounts were stale.

Why This Change Was Made

Skill Hub now verifies the catalog artifact and workspace files before repairing a legacy installation record. Recovery accepts parent directories materialized from archive paths and rejects unrecorded workspace directories. New room installs record the archive revision after the Gateway confirms the committed artifact digest. At dispatch, a managed room can refresh an idle Docker sandbox when container identity and configuration establish that only the skill mounts changed.

User Impact

Room members can inspect disabled installs with /skillhub installed. A dispatch competing with active room work receives a retry notice. A later idle dispatch can refresh stale mounts while continuing to exclude unverified or policy-blocked skills.

Evidence

• 240 focused cases passed across catalog installation, SQLite and filesystem recovery, workspace policy, sandbox admission and mount reconciliation, and Knox replies. Docker and Knox boundaries used test doubles.
• The final Skill Hub rerun passed 33 tests with one existing skip. The new regression cases cover implicit ZIP parent directories and an unrecorded workspace directory.
• Main-based Codex autoreview passed after the archive-directory repair and its fixture recheck.
• Patch whitespace, focused formatting and lint, the max-lines ratchet, and SDK export checks passed.
• The operations runbook includes a read-only catalog query and rootless Docker mount checks for post-deployment verification.
• Local Docker/WSL was unavailable for a live rootless deployment check. Hosted CI will verify the reviewed commit's supported Linux checks.