[HLCC-ICE-000001][ZY-CONTRIB-20260723-001] feat: 以来光者贡献链启用冰朔第五域个人子频道

skills/codex/guanghu-persona-skill-guard/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: guanghu-persona-skill-guard
+description: Automatically restore the current trusted Guanghu/Fifth Domain route, select a registered HLDP persona skill, and correct stale, indirect, or unsafe proposed paths before execution. Use for any Guanghu, HoloLake, Fifth Domain, TCS, GLS, Light Lake, Lake Lamp, Zhuyuan, server-node, repository-routing, deployment, recovery, or cross-device continuation task, especially when an AI starts without prior context, says it cannot find a route, proposes guessing, or chooses an obsolete WorkBuddy/server path.
+---
+
+# Guanghu Persona Skill Guard
+
+Run the deterministic resolver before choosing tools or an execution route:
+
+```bash
+python3 scripts/resolve_persona_skill.py \
+  --intent "<user request>" \
+  --proposed-route "<planned route or empty>" \
+  --json
+```
+
+Treat the result as navigation evidence, not execution authority.
+
+## Follow the decision
+
+- `BLOCK`: Do not start the proposed route. Read `correction` and the returned evidence paths.
+- `CORRECT`: Replace the proposed route with `preferred_route`, then verify its live preconditions.
+- `ALLOW`: Continue only within the returned authorization boundary.
+- `NO_MATCH`: Resolve the live Fifth Domain entry and current `.code-map`; do not invent a new route.
+
+Before a consequential action, verify the selected skill's freshness and evidence. Prefer current live evidence over a registry assertion. If they conflict, stop the route, record the conflict, and use the repository fact source to resolve it.
+
+## Preserve trust boundaries
+
+Trust a correction only when it is anchored to a current Fifth Domain path, GLS identifier, signed or committed registry version, and task-relevant evidence. Never trust a label merely because it contains “Guanghu”.
+
+Never embed or print secrets, private-key contents, authorization codes, hidden reasoning, or private server addresses. Resolve endpoints and credentials from local protected node registries.
+
+Skills may narrow or correct a path. They may not grant repository write, server execution, deployment, deletion, production cutover, or any other authority.
+
+Read `references/persona-skill-registry.json` only when inspecting or extending the registry. Update it together with the matching HLDP skill file and GLS registration.