Verify skill installers before execution and guide interactive setup

[calvin-archastro]

Review on ArchCode

Problem and author intent

Each public skill bootstraps ArchDev by running downloaded Bash or PowerShell installer code. The wrappers previously executed that code without a locally pinned digest and accepted an arbitrary ARCHDEV_INSTALLER_URL. The installer also inherited a release-origin override, allowing both the CLI archive and its checksum to come from another origin. Socket reported two bootstrap warnings on every skill and an additional runtime-trust warning on Rooms.

This change verifies installer bytes before execution and keeps public installation guidance interactive. It does not claim the external scanner has cleared its findings.

A separate Tasks review failure left feedback unread: the agent opened the browser review and ended its turn while the local server kept running. The human submitted notes and had to ask the agent to check them. The Tasks skill now makes active feedback monitoring part of the browser handoff and keeps it running through save verification or an explicit stop/blocker.

What changed

• Download-and-execute → download to temporary storage, compare a SHA-256 digest shipped with the skill, then execute. All five skills pin the same reviewed installer commit and remove temporary downloads on success/failure.

• Remove the installer URL override, force the official release origin, and retain archive verification. Compatible installed CLI binaries are still reused; existing feature probes and upgrades remain intact.

• README commands let npx skills prompt for tools and installation scope. Rooms documents the installer/runtime trust boundary.

• Add tampering, failed-download, hostile-environment, cleanup, and actual upstream digest coverage.

• Tasks review handoff now uses a progress update and enters polling in the same turn. Status questions keep monitoring active; resumed turns and resolved blockers read from the retained feedback cursor. Human approval still exclusively owns saving.

Scope, risk, and user impact

CLI/distribution-only; no application frontend or backend changes. Medium risk because this touches first installation and upgrades on Unix and Windows. Alternate installer/release origins are intentionally unavailable through skills. Users still trust the reviewed installer, published CLI release, and compatible binaries already on PATH; an archive checksum is not a runtime security audit. Socket may retain warnings after rescanning.

Testing

• Canonical Unix proofs: agents, jobs, reviews, rooms, and tasks, each script's packaging/bootstrap journey. All five pass. Real npx skills installs packaged instructions, then real Bash executes a copied bootstrap; only the download transport and trusted fixture digest are substituted. Assertions cover actual CLI files, compatibility behavior, rejected tampering, ignored hostile overrides, and cleanup. This does not exercise a real release binary or authentication.

• Canonical PowerShell proof: tests/skill-bootstrap.ps1, the all-five-skills loop. Passed under PowerShell 7.6.6 on macOS with a runnable CLI fixture, actual hash verification, rejected tampering/download errors, and cleanup. Native Windows execution remains CI verification.

• tests/bootstrap-pins.py passed against real HTTPS downloads of the pinned upstream scripts without executing them.

• Independent security review completed; downstream release-origin finding addressed. git diff --check passes.

• Automatic regression coverage: Installer Smoke Test, on every PR and push to main. Existing five Ubuntu skill jobs run the shell scripts; Rooms also checks upstream pins; the Windows installer job runs the PowerShell proof. No Aster configuration exists in this public distribution repository.

• Tasks monitoring instruction update: bash tests/tasks-skill.sh, skill-creator quick_validate.py skills/tasks, and git diff --check pass. The existing PR-triggered Tasks Skill Installation job covers packaging/bootstrap. No automated end-to-end proof establishes agent adherence to the revised instruction; a future real Tasks review session must verify feedback is picked up without a chat prompt. No runtime or test behavior changed in this follow-up.

Follow-up

Publish these changes and inspect fresh Socket results. Existing skill installations must update before receiving the hardened wrappers.

Related: companion PR.