fix: reject non-synth skill writes

Author: T0UGH

src/codex_self_evolution/skill_synthesis/inventory.py

@@ -91,6 +91,19 @@ def snapshot_synth_skills(skills_root: Path) -> dict[str, dict[str, Any]]:
     return snapshot
 
 
+def snapshot_skill_docs(skills_root: Path) -> dict[str, dict[str, Any]]:
+    snapshot: dict[str, dict[str, Any]] = {}
+    if not skills_root.is_dir():
+        return snapshot
+    for child in sorted(skills_root.iterdir()):
+        if not child.is_dir():
+            continue
+        meta = read_skill_metadata(child)
+        if meta is not None:
+            snapshot[str(child / "SKILL.md")] = meta
+    return snapshot
+
+
 def changed_paths(before: dict[str, dict[str, Any]], after: dict[str, dict[str, Any]]) -> list[str]:
     paths = set(before) | set(after)
     return sorted(

src/codex_self_evolution/skill_synthesis/runner.py

@@ -17,7 +17,7 @@
     materialize_evidence_workspace,
     update_evidence_index,
 )
-from .inventory import changed_paths, read_skills_inventory, snapshot_synth_skills, write_published_index
+from .inventory import changed_paths, read_skills_inventory, snapshot_skill_docs, snapshot_synth_skills, write_published_index
 from .paths import build_skill_synthesis_paths, resolve_real_skills_root
 from .validation import clear_invalid_marker, mark_invalid, validate_synth_skill
 
@@ -106,8 +106,10 @@ def _run_locked(
         evidence_index=evidence_index,
     )
     real_before = snapshot_synth_skills(real_skills_root)
+    real_all_before = snapshot_skill_docs(real_skills_root)
     skills_root = Path(tempfile.mkdtemp(prefix=f"csep-skill-synthesis-{run_id}-")) / "skills" if dry_run else real_skills_root
     before = snapshot_synth_skills(skills_root)
+    all_before = snapshot_skill_docs(skills_root)
     inventory = read_skills_inventory(real_skills_root)
     materialize_evidence_workspace(
         paths,
@@ -141,15 +143,19 @@ def _run_locked(
 
     after = snapshot_synth_skills(skills_root)
     real_after = snapshot_synth_skills(real_skills_root)
+    all_after = snapshot_skill_docs(skills_root)
+    real_all_after = snapshot_skill_docs(real_skills_root)
     detected = changed_paths(before, after)
+    namespace_violations = _non_synth_changed_paths(changed_paths(all_before, all_after))
     changed_real = changed_paths(real_before, real_after) if dry_run else []
+    changed_real_all = changed_paths(real_all_before, real_all_after) if dry_run else []
     valid, invalid, retired = _validate_changed(run_id, detected)
     result_missing = bool(agent_result.get("result_missing"))
     result_invalid = bool(agent_result.get("result_invalid"))
     mismatch = _reported_written(agent_result) != detected
     dry_run_leak = dry_run and bool(changed_real)
     status = "success"
-    if error or dry_run_leak:
+    if error or dry_run_leak or namespace_violations:
         status = "error"
     elif invalid or mismatch or result_missing or result_invalid:
         status = "partial"
@@ -166,7 +172,8 @@ def _run_locked(
         "seen_before_count": sum(1 for item in evidence if item.get("seen_before")),
         "reported_written": _reported_written(agent_result),
         "detected_changed": detected,
-        "changed_real_paths": changed_real,
+        "changed_real_paths": changed_real_all or changed_real,
+        "namespace_violations": namespace_violations,
         "valid": valid,
         "invalid": invalid,
         "retired": retired,
@@ -193,6 +200,13 @@ def _reported_written(agent_result: dict[str, Any]) -> list[str]:
     return sorted(out)
 
 
+def _non_synth_changed_paths(paths: list[str]) -> list[str]:
+    return sorted(
+        path for path in paths
+        if not Path(path).parent.name.startswith("csep-synth-")
+    )
+
+
 def _validate_changed(run_id: str, changed: list[str]) -> tuple[list[dict[str, Any]], list[dict[str, Any]], list[dict[str, Any]]]:
     valid: list[dict[str, Any]] = []
     invalid: list[dict[str, Any]] = []

tests/test_skill_synthesis_runner.py

@@ -99,3 +99,23 @@ def fake_agent(**kwargs):
     assert result["status"] == "error"
     assert result["dry_run_leak"] is True
     assert result["changed_real_paths"] == [str(real_root / "csep-synth-leak" / "SKILL.md")]
+
+
+def test_run_skill_synthesis_rejects_non_synth_skill_writes(tmp_path: Path) -> None:
+    _write_config(tmp_path)
+
+    def fake_agent(**kwargs):
+        skill = Path(kwargs["skills_root"]) / "manual-skill" / "SKILL.md"
+        skill.parent.mkdir(parents=True)
+        skill.write_text(
+            "---\nname: manual-skill\ndescription: Use when wrong namespace repeats.\n---\n\nBad write.\n",
+            encoding="utf-8",
+        )
+        out = Path(kwargs["run_output_dir"]) / "result.json"
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(json.dumps({"schema_version": 1, "run_id": kwargs["run_id"], "actions": []}), encoding="utf-8")
+
+    result = run_skill_synthesis(home=tmp_path, mode="incremental", lookback_hours=24, lookback_days=None, dry_run=True, agent_invoker=fake_agent)
+
+    assert result["status"] == "error"
+    assert result["namespace_violations"]