Load the user skills folder and write approved skills there

[AVADSA25]

What

Mickael (7 Oct): "point approve at ~/.codec/skills". On this Mac every skill registry read one folder, SKILLS_DIR (the repo's skills/, as config has no skills_dir), so ~/.codec/skills was never loaded and /api/skill/approve wrote approved skills into the live git tree. Design: docs/USER-SKILLS-DIR-DESIGN.md (approved by Mickael, "As designed").

• codec_config.USER_SKILLS_DIR: CODEC_USER_SKILLS_DIR env, else config.json:user_skills_dir, else ~/.codec/skills.
• SkillRegistry(skills_dir, user_dir=None): reads the built-ins, then the user folder. A built-in name always wins; a user file is never trusted by the manifest (every load runs the AST gate); _ files and sub-folders are skipped. All six registries (dispatch, MCP, voice, agents, autopilot, slash commands) pass the user folder.
• /api/skill/approve writes to the user folder: 0700 folder, 0600 file, atomic write. Built-in-name refusal and the write-time AST gate unchanged; audit skill_approved gains dir: "user".
• Settings > Learning's installed check and codec_self_improve's existing-name scan include the user folder; page text names ~/.codec/skills.
• Tests: conftest points CODEC_USER_SKILLS_DIR at a temp folder; tests/test_skills.py no longer imports the owner's user skills (it used to run their module code on every suite run).
• AGENTS.md §4 documents the two folders. Known issue marked fixed.

No change to the manifest, the built-in folder, the AST gate, the security lists or MCP exposure rules.

Migration (done on the Mac, approved)

The 6 old files in ~/.codec/skills (Mar-Apr 2026, never loaded here; 5 fail the gate, lucy.py passes) moved to ~/.codec/skills/_dormant-2026-10-07/ before deploy. Nothing deleted.

Checks

• tests/test_user_skills_dir.py: 8 passed; negative control on main's code: 8 failed. Empty HOME: passed.
• Touched tests (approve, reviews, Learning, test_skills): 43 passed. Full suite on the Mac: 3323 passed, 0 failed. ruff clean, skill manifest unchanged (--check).

Deploy

Restart codec-dashboard and open-codec. codec-mcp-http, codec-agent-runner and codec-autopilot read the user folder after Mickael restarts them.

🤖 Generated with Claude Code