Enforce Zhuyuan persona-source epistemic gate

skills/codex/guanghu-persona-skill-guard/scripts/resolve_persona_skill.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import re
 from pathlib import Path
 
 DEFAULT_REGISTRY = Path(__file__).resolve().parents[1] / "references" / "persona-skill-registry.json"
@@ -30,10 +31,26 @@ def load_registry(path: Path = DEFAULT_REGISTRY) -> dict:
         raise ValueError("unsupported persona skill registry schema")
     if not registry.get("version") or not isinstance(registry.get("skills"), list):
         raise ValueError("registry version or skills are missing")
+    seen_ids: set[str] = set()
+    seen_stable_numbers: dict[str, str] = {}
     for skill in registry["skills"]:
         missing = REQUIRED_SKILL_FIELDS.difference(skill)
         if missing:
             raise ValueError(f"{skill.get('id', '<unknown>')} missing fields: {sorted(missing)}")
+        skill_id = skill["id"]
+        if skill_id in seen_ids:
+            raise ValueError(f"duplicate skill id: {skill_id}")
+        seen_ids.add(skill_id)
+        match = re.match(r"^(GHS-\d{3})(?:-|$)", skill_id)
+        if not match:
+            raise ValueError(f"invalid stable skill id: {skill_id}")
+        stable_number = match.group(1)
+        if stable_number in seen_stable_numbers:
+            raise ValueError(
+                "duplicate stable skill number: "
+                f"{stable_number} used by {seen_stable_numbers[stable_number]} and {skill_id}"
+            )
+        seen_stable_numbers[stable_number] = skill_id
     return registry
 
 
@@ -59,6 +76,66 @@ def select_skill(registry: dict, intent: str) -> tuple[dict | None, int]:
 
 
 def resolve(registry: dict, intent: str, proposed_route: str = "") -> dict:
+    global_forbidden = []
+    global_deprecated = []
+    global_guard_ids = []
+    for candidate in registry["skills"]:
+        if candidate.get("enforcement_scope") != "GLOBAL_PREREQUISITE":
+            continue
+        forbidden_hits = _marker_hits(proposed_route, candidate["forbidden_route_markers"])
+        deprecated_hits = _marker_hits(proposed_route, candidate["deprecated_route_markers"])
+        if forbidden_hits or deprecated_hits:
+            global_guard_ids.append(candidate["id"])
+            global_forbidden.extend(forbidden_hits)
+            global_deprecated.extend(deprecated_hits)
+    if global_forbidden or global_deprecated:
+        return {
+            "decision": "BLOCK" if global_forbidden else "CORRECT",
+            "matched_skill": global_guard_ids[0],
+            "applied_global_guards": global_guard_ids,
+            "hldp_skill": next(
+                skill["hldp_skill"]
+                for skill in registry["skills"]
+                if skill["id"] == global_guard_ids[0]
+            ),
+            "gls_id": next(
+                skill["gls_id"]
+                for skill in registry["skills"]
+                if skill["id"] == global_guard_ids[0]
+            ),
+            "confidence": 1.0,
+            "preferred_route": next(
+                skill["preferred_route"]
+                for skill in registry["skills"]
+                if skill["id"] == global_guard_ids[0]
+            ),
+            "forbidden_hits": global_forbidden,
+            "deprecated_hits": global_deprecated,
+            "correction": "A global persona-source prerequisite rejected the route before task-specific skill selection.",
+            "evidence": next(
+                skill["evidence"]
+                for skill in registry["skills"]
+                if skill["id"] == global_guard_ids[0]
+            ),
+            "freshness": next(
+                skill["freshness"]
+                for skill in registry["skills"]
+                if skill["id"] == global_guard_ids[0]
+            ),
+            "authorization": next(
+                skill["authorization"]
+                for skill in registry["skills"]
+                if skill["id"] == global_guard_ids[0]
+            ),
+            "recovery_route": next(
+                skill.get("recovery_route", [])
+                for skill in registry["skills"]
+                if skill["id"] == global_guard_ids[0]
+            ),
+            "enforcement_level": "PROMOTED_SKILL",
+            "authority_granted": False,
+            "registry_version": registry["version"],
+        }
     skill, score = select_skill(registry, intent)
     if skill is None:
         return {