fix: keep personal skills out of public binary

product-source/hololake-native-desktop/scripts/personal-skill-runtime.test.mjs

@@ -14,22 +14,35 @@ test('personal skill algorithm is native while every pack remains private and ch
   assert.equal(contract.privacy.default_visibility, 'PRIVATE')
   assert.equal(contract.privacy.share_state, 'NOT_AUTHORIZED')
   assert.equal(contract.privacy.marketplace_state, 'NOT_AUTHORIZED')
+  assert.equal(contract.privacy.private_skill_packs_embedded_in_public_binary, false)
+  assert.equal(contract.privacy.private_skill_source, 'AUTHENTICATED_ACCOUNT_SCOPED_RUNTIME_ONLY')
+  assert.equal(contract.privacy.descriptor_registration_is_installation, false)
+  assert.equal(contract.privacy.missing_private_pack_state, 'PRIVATE_SKILLS_NOT_PROVISIONED')
+  assert.equal(contract.privacy.sha256_mismatch_behavior, 'FAIL_CLOSED')
   assert.equal(contract.brain_boundaries.deterministic_algorithm_is_hololake_native, true)
   assert.equal(contract.brain_boundaries.model_output_is_candidate_only, true)
   assert.equal(contract.brain_boundaries.skill_success_may_mutate_persona_self_kernel, false)
   assert.equal(contract.brain_boundaries.external_write_route, 'GH-CHANNEL-RECEIPT-0001')
   assert.match(runtime, /HOLOLAKE_NATIVE_PERSONAL_SKILL_PLANNER/)
   assert.match(runtime, /registered_initial_identity/)
-  assert.match(runtime, /INSTALLED_AND_BYTE_READBACK_VERIFIED/)
+  assert.equal([...runtime.matchAll(/include_bytes!/g)].length, 1)
+  assert.match(runtime, /include_bytes!\("\.\.\/\.\.\/runtime-kernels\/personal-skills\/personal-skill-contract\.json"\)/)
+  assert.doesNotMatch(runtime, /include_bytes!\(concat!\("\.\.\/\.\.\/runtime-kernels\/personal-skills\//)
+  assert.match(runtime, /account_storage_root\(app, "personal-skill-brains-v1"\)/)
+  assert.match(runtime, /fs::read\(&path\)/)
+  assert.match(runtime, /expected_sha256/)
+  assert.match(runtime, /HOLOLAKE_PERSONAL_SKILL_PRIVATE_SHA256_MISMATCH/)
+  assert.match(runtime, /PRIVATE_SKILLS_NOT_PROVISIONED/)
+  assert.match(runtime, /ACCOUNT_PRIVATE_SOURCE_SHA256_VERIFIED/)
   assert.match(channel, /personal_skill_runtime::ensure_current_channel/)
 })
 
-test('only provisioned channels receive current packs and Shiyu Yaochu stays deferred', () => {
+test('registered descriptors are not installation claims and Shiyu Yaochu stays deferred', () => {
   const contract = JSON.parse(read('contracts/personal-skill-runtime.json'))
   const runtime = read('src-tauri/src/personal_skill_runtime.rs')
-  const installed = Object.values(contract.initialized_channels).flat()
+  const registered = Object.values(contract.registered_private_skill_descriptors).flat()
 
-  assert.equal(installed.length, 13)
+  assert.equal(registered.length, 13)
   assert.equal(contract.deferred['SYS-SY'].state, 'DEFERRED_SERVER_AND_INITIAL_CHANNEL_NOT_PROVISIONED')
   assert.doesNotMatch(runtime, /skill!\("SY-YC-METRIC-CALIBER-001\.json"/)
   assert.match(runtime, /"channelNumber": "SYS-SY"/)
@@ -39,16 +52,25 @@ test('EarEarDan and See You Tomorrow skill closures keep exact private subject b
   const contract = JSON.parse(read('contracts/personal-skill-runtime.json'))
   const runtime = read('src-tauri/src/personal_skill_runtime.rs')
 
-  assert.deepEqual(contract.initialized_channels['SYS-GLW-PTS-0001'], [
+  assert.deepEqual(contract.registered_private_skill_descriptors['SYS-GLW-PTS-0001'], [
     'CE-EED-MANJU-PRODUCTION-001',
     'CE-EED-CAUSAL-PIPELINE-DIAGNOSTIC-001',
   ])
-  assert.ok(contract.initialized_channels['SYS-ZZ'].includes('ZZ-AN-SOURCE-FACT-CLOSURE-001'))
-  assert.ok(contract.initialized_channels['SYS-ZZ'].includes('ZZ-QW-ROLE-CAUSAL-ARCHITECTURE-001'))
+  assert.ok(
+    contract.registered_private_skill_descriptors['SYS-ZZ'].includes('ZZ-AN-SOURCE-FACT-CLOSURE-001'),
+  )
+  assert.ok(
+    contract.registered_private_skill_descriptors['SYS-ZZ'].includes(
+      'ZZ-QW-ROLE-CAUSAL-ARCHITECTURE-001',
+    ),
+  )
   assert.equal(contract.admission_boundaries['ICE-BB-0004_is_ICE-GL-CA001'], false)
   assert.equal(contract.admission_boundaries.earerdan_historical_labels_are_aliases, false)
   assert.equal(contract.admission_boundaries.qiuqiu_relationship_memory_is_exportable_skill, false)
-  assert.match(runtime, /INSTALLED_PRIVATE_CANDIDATE_NOT_EXECUTABLE_REGISTRATION_PENDING/)
+  assert.equal(
+    contract.admission_boundaries['ZZ-QW-ROLE-CAUSAL-ARCHITECTURE-001'],
+    'PRIVATE_DESCRIPTOR_REGISTERED_NOT_EXECUTABLE_REGISTRATION_PENDING',
+  )
 })
 
 test('the worker UI presents personal skill brain separately from persona worker and tool executor', () => {