Skip to main content

ARCH-27 governed specialist CLI skills

ARCH-27 implements the specialist-skill follow-up from ARCH-23. Tyrum's native runtime remains the only conversation-turn executor. Claude Code, Codex, OpenCode, and later coding-agent CLIs remain ordinary child processes behind generic governed process tools.

Quick orientation​

  • Read this if: you operate or change bundled coding-agent CLI guidance, skill requirements, or skill trust.
  • Skip this if: you only need the underlying process contract; use ARCH-24 or ARCH-26.
  • Go deeper: use Skills, Tools, and WorkBoard delegation.

Decision​

Tyrum bundles two advisory skills:

  • coding-agent-cli covers bounded foreground work and requires process.run.
  • coding-agent-cli-background covers a durable background lifecycle and requires all of process.start, process.get, process.logs, and process.cancel.

The runtime enforces requires.tools as an all-of condition against the complete effective tool inventory for each turn. That inventory is resolved after agent configuration, state mode, exact match-target registration, process availability, execution profile, and required confinement. Message-selected tool filtering does not suppress otherwise valid guidance.

requires.mcp and requires.nodes are not enforced in ARCH-27. Their enforcement needs a follow-up change before either field can be described as an availability boundary.

Executable exposure and reachability​

Skills never grant tools. Every executable process tool still needs both an exact agent opt-in and an exact execution profile entry; wildcards, permissive defaults, bundles, and tiers do not enable it.

Foreground process.run is deliberately subagent-only. The reachable recipe is a WorkBoard-dispatched subagent with execution_profile: executor_rw whose agent configuration contains exact tools.allow: ["process.run"]. A grant on an agent used only for a main interaction turn exposes neither the foreground tool nor its guidance. Background guidance remains independently reachable in interaction when all four lifecycle tools are explicitly and effectively exposed.

Approval, policy, exact argv/cwd/environment identity, workspace leasing, timeouts, output limits, redaction, audit, state-mode restrictions, and confinement checks remain below the prompt. Revocation is observed at the next enforcement point.

Skill loading and trust compatibility​

AgentSkillConfig.workspace_trusted now defaults to false at the schema boundary. Modern and legacy omitted forms agree. This intentionally changes compatibility for existing configuration that relied on omitted trust meaning trusted; operators must persist explicit true to accept workspace guidance.

Local precedence is workspace when trusted, then managed, user, and bundled. This order is prompt provenance, not confinement:

  • workspace guidance is model-writable whenever workspace mutation tools are exposed;
  • user guidance under the Tyrum home is same-UID writable and can shadow bundled guidance;
  • a same-UID child may alter either writable tier;
  • identity and provenance follow the manifest meta.id, which is not required to equal the directory name.

Setting workspace_trusted: true accepts workspace guidance, including on turns where process authority is separately opted in. It does not protect persistent files from a compromised child.

Manifest identity is also a residual path risk: discovery reads meta.id, while later tier lookup uses that ID as a directory segment. Because validation does not bind the manifest ID to the directory name, a mismatch can cause surprising fallback or shadow selection.

Reporting and packaging​

Turn reports distinguish loaded_skills inventory from post-requirement enabled_skills. Runtime status skills and skills_detailed remain loaded, not effective, because status has no selected execution profile or trustworthy background-supervisor availability snapshot. Tool and skill availability is a per-turn snapshot: already-rendered advisory text is not retracted mid-turn, while later tool calls and the next turn still use current enforcement.

The gateway npm package includes skills/. Bundled resolution is bound to a package root whose package.json name is exactly @tyrum/gateway; an arbitrary ancestor skills/ directory is rejected. Tarball inclusion of all bundled manifests is locally proven. Reference deployment inclusion is enforced by the CI container smoke through the gateway status path; that production container smoke was not executed locally.

The repository semantic gate parses strict fenced JSON invocation examples and rejects shell wrappers, shell metacharacters, vendor escalation flags, installation or authentication actions, and publication actions. It also scans full skill bodies for literal vendor bypass tokens. This is defense in depth over shipped guidance, not a runtime argv denylist. Runtime authority remains process exposure, exact policy and approval identity, and process governance.

Guidance and unsupported behavior​

Examples use direct executable plus ordered argv, workspace-relative cwd, and bounded runtime/output. Prompts are single argv elements. Child output, diffs, and claimed checks are untrusted evidence; the native agent inspects artifacts and reruns relevant checks.

The skills do not install or upgrade CLIs, perform login or credential bootstrap, provide PTY/stdin interaction, resume vendor continuity, or grant commit, push, pull request, release, deploy, or other publication authority.

Residual risks include ambient HOME credentials and configuration, network access, repository hooks and rules, same-UID filesystem access, model-supplied environment values, user-skill shadowing, and the lack of strong filesystem/network/resource confinement. Vendor sandboxing is additive and does not replace Tyrum controls.

Rollback​

Remove process.run from executor_rw to disable foreground reachability, and remove the two bundled skill directories to remove guidance. Reverting workspace_trusted to an implicit-true default is a security-posture rollback and must be called out explicitly. Persisted explicit trust values require no migration.