[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KKXYCDKDGGEKE2R8TDF69K":3,"skill-same:01M6KKXYCDKDGGEKE2R8TDF69K":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M6KKXYCDKDGGEKE2R8TDF69K","tools-aggregate-coverage-by-interface",null,"Render the ONE combined per-component scoring page (`\u003Ccomponent>_scoring.html`) from the reconciled `unified_properties.yaml` — per-tool KPI cards, a combined Creusot|Kani scorecard over the public-method bundles, property-bundle and spec-vs-each-tool tables, unproved-causes, measurement, anti-vacuity, and provenance. Consumes the Role-1 property set + Role-2 per-tool status blocks that already live in `unified_properties.yaml`; attaches nothing new. Does NOT extract, bundle, or prove — the inventory owns the property set and the bundles, Role 2 owns the status. This is Role 3.","AI-native-Systems-Research\u002Fai-native-storage-certus","AI-native-Systems-Research","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F270755458?v=4","01M6KKQWSJX0D4X33E0KKSR4WM","AI-native Systems Research","01M6KKQWXTKR6MYVQMPKVJ5WD5",3,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002F.claude\u002Fskills\u002Ftools-aggregate-coverage-by-interface\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"tools aggregate coverage by interface","Tools","interface","coverage","properties","new","combined","scorecard","tables","measurement","blocks","render","name","live","scoring","spec","html","page","tool","inventory","provenance","SET","kpi","yaml","status","component","2026-11-10 10:12:30",false,"---\nname: tools-aggregate-coverage-by-interface\ndescription: Render the ONE combined per-component scoring page (`\u003Ccomponent>_scoring.html`) from the reconciled `unified_properties.yaml` — per-tool KPI cards, a combined Creusot|Kani scorecard over the public-method bundles, property-bundle and spec-vs-each-tool tables, unproved-causes, measurement, anti-vacuity, and provenance. Consumes the Role-1 property set + Role-2 per-tool status blocks that already live in `unified_properties.yaml`; attaches nothing new. Does NOT extract, bundle, or prove — the inventory owns the property set and the bundles, Role 2 owns the status. This is Role 3.\nargument-hint: \"[component-name]\"\n---\n\n> **Frozen 2026-10-09.** This skill moved to [ai-native-storage-workbench](https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-workbench) (`fv\u002Fskills\u002F`). Edit it there; this copy is not updated. Install the current version with `fv\u002Finstall.sh \u003Cthis-repo>`.\n\n\n## Purpose\n\nGiven a component whose verifiable properties are extracted, agreed (Role 1), and proved\u002Fattempted\n(Role 2) — all captured in `unified_properties.yaml` — produce **one presentation-ready scoring page** whose\nscorecard aggregation unit is fixed: the **public methods of the `I\u003Ccomponent>` trait** (the\n`define_interface!` block). The page folds the earlier three thin slides into a single superset:\n- the **scorecard** (\"How many public methods did we verify?\") — one row per public method,\n  `Creusot | Kani`, headline *\"Out of N public methods, Creusot proved X and Kani proved Y\"*;\n- the **bundle view** (\"to verify a method, we verify every property in its bundle\") — per-`id` rows;\n- the **assumptions \u002F spec-vs-tool view** — what is proved vs. proved-against-an-abstraction (`★`), where\n  the Creusot-ghost-mirror ↔ Kani-real-type distinction is disclosed from each property's `fidelity`.\n\nThis skill **does not extract properties and does not run a prover.** It renders `unified_properties.yaml`.\nAn **incomplete** input (some properties not yet scored — their tool blocks carry no `status` key) is\n**not** an error: render it, mark the unscored cells **pending `·`**, and show a prominent INCOMPLETE\nbanner. Only a **structurally inconsistent** input — a tool block citing an `id` absent from the property\nset, or a scored value that contradicts the shared obligation — makes it stop and ask for reconciliation.\nThis lets a dry run or a partial (one-tool, mid-flight) run render honestly without crashing and without\noverclaiming.\n\n## The model (match the deck exactly)\n\n- **Unit of coverage = public method.** The scorecard denominator is the **number of public methods**\n  (`counts.methods`, e.g. 16\u002F20, 12\u002F20), NOT a property count.\n- **A method is `✓` for a tool** when every property in its bundle reaches a terminal covered state and\n  that tool proved (`✓`\u002F`★`) at least one of them; `–` when every property is scored but the tool proved\n  nothing for it, or a scored proof-lane property of its bundle is `⊘`; and `·` (pending) when any bundle\n  property is not yet scored. (Full rule under **Method verdict**.)\n- **Terminal covered states come from `unified_properties.yaml`:** `proved` (`✓`), `proved-against-abstraction`\n  (`★` — ghost-mirror \u002F trusted-boundary), or `delegated` (`⤴` — owned by another component, or covered\n  by a non-proof lane such as Loom\u002FSpin concurrency or a targeted fault-injection\u002Fhardware test named in\n  the property's `note`). A `⤴`-delegated property does **not** block a proof tool's `✓` **iff** its\n  delegation names a real owner\u002Ftest — exactly as `create_memory_tier_entry` stays `✓` for Creusot while\n  its SSD-atomicity property is delegated to a targeted test.\n- **A Creusot\u002FKani-lane property that is a scored `⊘` (tool boundary), or still pending (unscored), DOES\n  block that method's `✓`.** A scored-`⊘` bundle is unfinished, reported honestly as `–`; a bundle with any\n  unscored property is pending, reported as `·` — never relabel either one covered.\n- **Footnotes (keep them):** `*` = this tool is the better-fit prover for the method; `**` = the\n  method's logic lives in other components (those rows are `– \u002F –`).\n- **The scorecard is two terminal states `✓\u002F–` plus a pending marker `·` — no `◐`.** `✓` and `–` are the\n  only *scored* verdicts (`★` still reads as `✓` at the method level; the abstraction\u002Ffidelity detail\n  surfaces in the bundle & spec-vs-tool sections, never as a third scored state). `·` is **not** a third\n  verdict — it is the \"not yet scored\" placeholder for a method whose bundle still has properties the scorer\n  hasn't reached. `·` never counts toward `✓` and never toward the definitive `–`; it just means the run is\n  incomplete for that cell. A fully scored run shows no `·`.\n- **Display grouping by capability area is allowed** (Reference-counting, Tier-transitions, …) — it is\n  *visual* only. The counting unit stays the public method. The renderer keeps one column per tool in\n  `counts.tools`, so adding Loom\u002FSpin later is a column, not a rewrite.\n\n## Inputs (consume; do NOT re-extract, do NOT re-bundle)\n\n**Primary input: `components\u002F\u003Ccomponent>\u002Fverif\u002Funified_properties.yaml`** — the reconciled single source of truth\nRole 1 built and Role 2 filled in. It carries, per property: the id-keyed obligation with its `methods`\nbundle, `object_fn`, `kind`, `global`, `attachments`, `origin`, `source`, `statement` (owned by Role 1),\n**and** the per-tool `creusot:`\u002F`kani:` blocks (`status`, `symbol`, `fidelity`, `evidence`, `miss_class`,\n`note`) written by Role 2. It also carries `counts:` (N methods, spec_total, code_total, unified M,\nattachments, not_verifiable) and the `NV-*` ledger. **This skill renders from `unified_properties.yaml`; it does not\nre-derive any of those fields.** There is **no `.md` backing file** — this HTML is the only human-readable\nform, and every value it shows comes from `unified_properties.yaml`.\n\nTwo distinct conditions, two distinct responses:\n- **Not-yet-scored (pending) is normal, render it.** A tool block with **no `status` key** means the scorer\n  has not reached that property. Render it as pending `·` and raise the INCOMPLETE banner — do **not** stop.\n- **Structural inconsistency STOPS.** A `creusot:`\u002F`kani:` block that cites an `id` absent from the property\n  set, or a scored status that disagrees with the shared obligation, is a real defect — **STOP and flag it**;\n  never paper over divergence, invent a property, or re-bundle.\nReconciliation of the property *set* already happened in Role 1; the *status* is written by the scorer, and\na run where the scorer has not yet covered every property is a legitimate partial render, not a failure.\n\n## The property record (all fields owned upstream; this skill renders, it does not overlay)\n\nEvery field comes from `unified_properties.yaml` — **read, never re-derive.** From Role 1:\n`id`, `subject`, `methods` (the bundle), `object_fn`, `kind`, `global`, `attachments`, `origin`, `source`,\n`statement`. The per-tool `creusot:`\u002F`kani:` block has **two classes of field with two different writers**\nunder the reproduction gate — the renderer must respect the split:\n```\n  # SCORER-WRITTEN (by scorer_{creusot,kani}.py, by reproducing the proof — never by an agent):\n  status:     proved | delegated | tool-boundary       # NOTE: no \"not-attempted\" — see below\n  symbol:     \"✓\" | \"★\" | \"⤴\" | \"⊘\"    # ✓ native · ★ ghost-mirror\u002Ftrusted-boundary · ⤴ delegated · ⊘ tool boundary\n  evidence:   {vcs, coma, wall_clock_s, peak_rss_mb}  (Creusot) | {harness, result, unwind, wall_clock_s, peak_rss_mb}  (Kani)\n  _scored_by: scorer_creusot | scorer_kani             # provenance stamp the scorer leaves\n  # AGENT-SUPPLIED (advisory only; Role 2 may fill; the renderer shows them but they never set the verdict):\n  fidelity:   \u003Creal-type | ghost-mirror | trusted-boundary>  (Creusot) | \u003Creal-type-bounded | representative | arithmetic-core>  (Kani)\n  miss_class: TOOL | AGENT | null\n  note:       \u003Cwhat the proof actually covers>\n  delegate_to: \u003Cthe owning component\u002Ftest, when the agent proposes a delegation>\n```\n**Key-absence is the pending state.** A tool block with **no `status` key** (the null-placeholder Role 1\nwrote, `{evidence: null, fidelity: null, note: null}`) means the scorer has not scored this property yet —\nrender it as **pending `·`**, never as covered and never as a failure. There is no `not-attempted` status\nanymore; \"not yet scored\" is signalled by the *absence* of `status`. This skill computes only the **derived\nrollups** (per-method verdicts, counts, headlines) from `status`\u002F`symbol`; it writes nothing back into\n`unified_properties.yaml`.\n\n### Bundle ownership (read from the inventory — do not recompute)\n\n- The `methods` bundle of each property, the per-method bundle sizes, and both counts (*distinct\n  properties* M, *method→property attachments*) are **already computed in the inventory**. Read them.\n- A shared-helper property (e.g. `align_up`) is already attached to every dependent method there — carry\n  that through unchanged; it is expected for one property to sit in many bundles.\n- The counting unit stays the public method. If you feel a need to reassign an owner, that is an\n  inventory fix (Role 1), not something this skill does silently.\n\n## Method verdict (per tool)\n\nFor public method `m` and tool `T` (Creusot or Kani), reading each property's `T` block from `unified_properties.yaml`.\nFirst classify each property in `m`'s bundle for `T`: **scored** (has a `status`) or **pending** (no\n`status` key yet). Then:\n- `·` **(pending)** if **any** property in `m`'s bundle is still pending for `T` — the run has not finished\n  scoring this method, so no terminal verdict is honest yet. Pending dominates: never resolve a method to\n  `✓` or `–` while a bundle property is unscored.\n- `✓` if **every** property in `m`'s bundle is scored to a terminal covered state — proved (`✓`\u002F`★`) by\n  some tool, or `delegated` (`⤴`) across a real interface boundary — **and** `T` itself proved (`✓`\u002F`★`) at\n  least one of `m`'s properties.\n- `–` otherwise: every property is scored (none pending) but `T` proved nothing for `m`, or some property of\n  `m`'s bundle is a scored `tool-boundary` (`⊘`). A `⊘` proof-lane property blocks the method's `✓` — report\n  it honestly, never relabel; and never render a scored `–` for a method that is really still pending.\n\nComponent score: `Creusot X \u002F N`, `Kani Y \u002F N`, where **N = number of public methods** (`counts.methods`).\nWhen any method is pending, also report the pending count and keep the INCOMPLETE banner up — `X` and `Y`\ncount only methods that are fully scored to `✓`, never pending ones.\nAlso report the net: **methods whose whole bundle is covered (done) vs incomplete**. `★` counts toward\n`✓` at the method level but its fidelity (ghost-mirror \u002F trusted-boundary) is disclosed in the scorecard\nand the assumptions\u002Fspec-vs-tool sections — never hidden.\n\n## Required output — ONE combined scoring page\n\nEmit a **single** self-contained `\u003Ccomponent>_scoring.html` rendered from `unified_properties.yaml` — the superset\npage that replaces the old three thin slides (8\u002F9\u002F11). One page per component, extensible to more tool\ncolumns (Loom\u002FSpin can be added one at a time later — the renderer is N-tool-ready, not hard-wired to two).\nSections, in order (this mirrors the hand-curated `SEPT_2026\u002FSEPT_14\u002F*_scoring.html` reference layout):\n1. **Title + sub-line** — interface, N, `.coma`\u002FVC totals (Creusot), Kani harness count, run pin + date.\n2. **Banner callout** — the three end-states (Proved \u002F Delegated ⤴ \u002F Tool-boundary ⊘) and the anti-vacuity note.\n3. **FROM_SPEC callout** — links `spec_properties.yaml`\u002F`code_properties.yaml`, states `spec_total` \u002F `code_total` \u002F unified `M`,\n   and explains they differ from M (spec∩code).\n4. **Per-tool KPI cards** — Creusot and Kani each: `X\u002FN` methods, VCs\u002F`.coma` (Creusot) or harness count (Kani),\n   wall-clock + peak RSS.\n5. **Combined scorecard** — the one table with columns **Props | Method | Creusot | Kani | Boundaries\u002Fnotes**;\n   per-method rows grouped by capability area; per-tool cell shows the method verdict symbol; `*`\u002F`**` footnotes\n   (`*` = better-fit prover; `**` = logic lives in other components → `–\u002F–`).\n6. **Property-bundles table** — **Property | What it requires | Creusot | Kani | Owner\u002Fnote**, per `id`, each\n   tool cell showing its `symbol` and (on hover\u002F'★') its `fidelity`.\n7. **Spec-vs-each-tool table** — **Spec property | What Kani proves | What Creusot proves | The weakening** —\n   this is where the abstraction↔real finding surfaces from the `fidelity` fields (Creusot ghost-mirror\u002F★ vs\n   Kani real-type-bounded).\n8. **Unproved rows and their causes** — narrative over the `⊘` properties with their `miss_class`\n   (TOOL vs AGENT) and reproducible signatures from `note`\u002F`evidence`.\n9. **Measurement table** — **Tool\u002Frun | Wall-clock | Peak RSS | Discharged** (VCs\u002F`.coma` or harnesses).\n10. **Anti-vacuity** statement and **Provenance** (pin, sources, generator).\n\nHTML must be **self-contained and theme-aware**; deliverables are read in-repo and may be cut onto plain\nwhite slides (keep backgrounds light, avoid heavy colored bands). Reference implementation: the\nhand-curated `SEPT_2026\u002FSEPT_14\u002F\u003Ccomponent>_scoring.html`.\n\n(Optional) if a machine-readable rollup is wanted, it is already `unified_properties.yaml` — do **not** re-emit a\nhand-formatted `.md` rollup; the YAML is the structured artifact and the HTML is the presentation.\n\n## Honesty rules (non-negotiable)\n\n- **A method is `✓` only when its whole bundle is covered.** A scored `⊘` proof-lane property makes the\n  method `–`; a still-pending (unscored) one makes it `·`. Either way it is not `✓` — do not inflate the\n  method count by ignoring unfinished or unscored properties.\n- **N = number of public methods** (`counts.methods`), fixed by the trait. Never shrink N to improve the ratio.\n- Every `proved` claim traces to a real artifact (VC\u002F`.coma` or harness) via the property `id` and `evidence`.\n- **`★` is disclosed, not hidden.** A method whose `✓` rests on a ghost-mirror\u002Ftrusted-boundary property\n  still shows `✓` at the method level, but the scorecard\u002Fbundle\u002Fspec-vs-tool sections must surface the\n  `fidelity` so the abstraction is visible. Under-claim, never over-claim.\n\n## Procedure\n\n1. Read `unified_properties.yaml`: the public methods, N (`counts.methods`), the `methods` bundles, and each\n   property's `creusot:`\u002F`kani:` blocks (do not recompute any Role-1\u002FRole-2 field).\n2. **Consistency gate (not a completeness gate):** stop and flag ONLY on a structural defect — a tool block\n   citing an `id` absent from the property set, or a scored status contradicting the shared obligation.\n   Properties with **no `status` key are pending, not errors** — render them `·` and raise the INCOMPLETE\n   banner; do not stop. (A dry run or a one-tool partial run is expected to be all- or mostly-pending.)\n3. Compute each method's `✓\u002F–\u002F·` per tool (verdict rule above — pending dominates), the score X\u002FN and Y\u002FN\n   over fully-scored methods, the pending count, and the done\u002Fincomplete split. Pull `fidelity`, `evidence`,\n   `miss_class`, and `note` straight through for display.\n4. Render the single `\u003Ccomponent>_scoring.html` (sections above) from `unified_properties.yaml`.\n5. Report: `\u003Ccomponent> — Creusot X\u002FN, Kani Y\u002FN public methods proved; Z methods have complete bundles,\n   P methods still pending (unscored), (N−Z−P) scored-but-incomplete (list the blocking ⊘ properties with\n   their signatures)`. If P > 0, say so plainly — the run is a partial render, not a final score.\n\n## Anti-patterns (the rabbit holes)\n\n- ❌ Counting **properties** as the scorecard denominator. (Denominator = public methods.)\n- ❌ Using `◐` on the scorecard. (Scored verdicts are two-state ✓\u002F–; `★`\u002Ffidelity detail lives in the bundle\n  & spec-vs-tool sections. Pending `·` is legitimate but is *not* a verdict — it marks a not-yet-scored cell.)\n- ❌ Marking a method `✓` while a proof-lane property is still `⊘`, or resolving it to `✓`\u002F`–` while any\n  bundle property is still **pending** (unscored). Pending dominates — render `·` and keep the banner up.\n- ❌ Treating a not-yet-scored property (no `status` key) as a failure and STOPping. Absence of `status` is\n  pending, not an error; only a structural inconsistency stops the render.\n- ❌ Re-extracting, re-bundling, or re-deriving status. (Everything comes from `unified_properties.yaml`.)\n- ❌ Emitting the old three thin slide files or a hand-formatted `.md` rollup. (One combined HTML; YAML is the data.)\n- ❌ Guessing a round property\u002Fmethod count to fit a table.\n\n## Routing\n\nGeneral methodology → `unstable` (promote via PR; don't leave siloed on a verif branch).\nDeliverables (`spec_properties.yaml`, `code_properties.yaml`, `unified_properties.yaml`, `\u003Ccomponent>_scoring.html`) → written under\n**`formal-verification\u002F\u003Ccomponent>\u002F`** and shipped to `unstable` via PR. Under the `component-verify`\norchestrator, the orchestrator performs that commit\u002FPR (gated to `formal-verification\u002F\u003Ccomponent>\u002F`); run\nstandalone, open the PR yourself. **No Box, no scp** — the repo folder is the shareable home.\n","> **Frozen 2026-10-09.** This skill moved to [ai-native-storage-workbench](https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-workbench) (`fv\u002Fskills\u002F`). Edit it there; this copy is not updated. Install the current version with `fv\u002Finstall.sh \u003Cthis-repo>`.\n\n\n## Purpose\n\nGiven a component whose verifiable properties are extracted, agreed (Role 1), and proved\u002Fattempted\n(Role 2) — all captured in `unified_properties.yaml` — produce **one presentation-ready scoring page** whose\nscorecard aggregation unit is fixed: the **public methods of the `I\u003Ccomponent>` trait** (the\n`define_interface!` block). The page folds the earlier three thin slides into a single superset:\n- the **scorecard** (\"How many public methods did we verify?\") — one row per public method,\n  `Creusot | Kani`, headline *\"Out of N public methods, Creusot proved X and Kani proved Y\"*;\n- the **bundle view** (\"to verify a method, we verify every property in its bundle\") — per-`id` rows;\n- the **assumptions \u002F spec-vs-tool view** — what is proved vs. proved-against-an-abstraction (`★`), where\n  the Creusot-ghost-mirror ↔ Kani-real-type distinction is disclosed from each property's `fidelity`.\n\nThis skill **does not extract properties and does not run a prover.** It renders `unified_properties.yaml`.\nAn **incomplete** input (some properties not yet scored — their tool blocks carry no `status` key) is\n**not** an error: render it, mark the unscored cells **pending `·`**, and show a prominent INCOMPLETE\nbanner. Only a **structurally inconsistent** input — a tool block citing an `id` absent from the property\nset, or a scored value that contradicts the shared obligation — makes it stop and ask for reconciliation.\nThis lets a dry run or a partial (one-tool, mid-flight) run render honestly without crashing and without\noverclaiming.\n\n## The model (match the deck exactly)\n\n- **Unit of coverage = public method.** The scorecard denominator is the **number of public methods**\n  (`counts.methods`, e.g. 16\u002F20, 12\u002F20), NOT a property count.\n- **A method is `✓` for a tool** when every property in its bundle reaches a terminal covered state and\n  that tool proved (`✓`\u002F`★`) at least one of them; `–` when every property is scored but the tool proved\n  nothing for it, or a scored proof-lane property of its bundle is `⊘`; and `·` (pending) when any bundle\n  property is not yet scored. (Full rule under **Method verdict**.)\n- **Terminal covered states come from `unified_properties.yaml`:** `proved` (`✓`), `proved-against-abstraction`\n  (`★` — ghost-mirror \u002F trusted-boundary), or `delegated` (`⤴` — owned by another component, or covered\n  by a non-proof lane such as Loom\u002FSpin concurrency or a targeted fault-injection\u002Fhardware test named in\n  the property's `note`). A `⤴`-delegated property does **not** block a proof tool's `✓` **iff** its\n  delegation names a real owner\u002Ftest — exactly as `create_memory_tier_entry` stays `✓` for Creusot while\n  its SSD-atomicity property is delegated to a targeted test.\n- **A Creusot\u002FKani-lane property that is a scored `⊘` (tool boundary), or still pending (unscored), DOES\n  block that method's `✓`.** A scored-`⊘` bundle is unfinished, reported honestly as `–`; a bundle with any\n  unscored property is pending, reported as `·` — never relabel either one covered.\n- **Footnotes (keep them):** `*` = this tool is the better-fit prover for the method; `**` = the\n  method's logic lives in other components (those rows are `– \u002F –`).\n- **The scorecard is two terminal states `✓\u002F–` plus a pending marker `·` — no `◐`.** `✓` and `–` are the\n  only *scored* verdicts (`★` still reads as `✓` at the method level; the abstraction\u002Ffidelity detail\n  surfaces in the bundle & spec-vs-tool sections, never as a third scored state). `·` is **not** a third\n  verdict — it is the \"not yet scored\" placeholder for a method whose bundle still has properties the scorer\n  hasn't reached. `·` never counts toward `✓` and never toward the definitive `–`; it just means the run is\n  incomplete for that cell. A fully scored run shows no `·`.\n- **Display grouping by capability area is allowed** (Reference-counting, Tier-transitions, …) — it is\n  *visual* only. The counting unit stays the public method. The renderer keeps one column per tool in\n  `counts.tools`, so adding Loom\u002FSpin later is a column, not a rewrite.\n\n## Inputs (consume; do NOT re-extract, do NOT re-bundle)\n\n**Primary input: `components\u002F\u003Ccomponent>\u002Fverif\u002Funified_properties.yaml`** — the reconciled single source of truth\nRole 1 built and Role 2 filled in. It carries, per property: the id-keyed obligation with its `methods`\nbundle, `object_fn`, `kind`, `global`, `attachments`, `origin`, `source`, `statement` (owned by Role 1),\n**and** the per-tool `creusot:`\u002F`kani:` blocks (`status`, `symbol`, `fidelity`, `evidence`, `miss_class`,\n`note`) written by Role 2. It also carries `counts:` (N methods, spec_total, code_total, unified M,\nattachments, not_verifiable) and the `NV-*` ledger. **This skill renders from `unified_properties.yaml`; it does not\nre-derive any of those fields.** There is **no `.md` backing file** — this HTML is the only human-readable\nform, and every value it shows comes from `unified_properties.yaml`.\n\nTwo distinct conditions, two distinct responses:\n- **Not-yet-scored (pending) is normal, render it.** A tool block with **no `status` key** means the scorer\n  has not reached that property. Render it as pending `·` and raise the INCOMPLETE banner — do **not** stop.\n- **Structural inconsistency STOPS.** A `creusot:`\u002F`kani:` block that cites an `id` absent from the property\n  set, or a scored status that disagrees with the shared obligation, is a real defect — **STOP and flag it**;\n  never paper over divergence, invent a property, or re-bundle.\nReconciliation of the property *set* already happened in Role 1; the *status* is written by the scorer, and\na run where the scorer has not yet covered every property is a legitimate partial render, not a failure.\n\n## The property record (all fields owned upstream; this skill renders, it does not overlay)\n\nEvery field comes from `unified_properties.yaml` — **read, never re-derive.** From Role 1:\n`id`, `subject`, `methods` (the bundle), `object_fn`, `kind`, `global`, `attachments`, `origin`, `source`,\n`statement`. The per-tool `creusot:`\u002F`kani:` block has **two classes of field with two different writers**\nunder the reproduction gate — the renderer must respect the split:\n```\n  # SCORER-WRITTEN (by scorer_{creusot,kani}.py, by reproducing the proof — never by an agent):\n  status:     proved | delegated | tool-boundary       # NOTE: no \"not-attempted\" — see below\n  symbol:     \"✓\" | \"★\" | \"⤴\" | \"⊘\"    # ✓ native · ★ ghost-mirror\u002Ftrusted-boundary · ⤴ delegated · ⊘ tool boundary\n  evidence:   {vcs, coma, wall_clock_s, peak_rss_mb}  (Creusot) | {harness, result, unwind, wall_clock_s, peak_rss_mb}  (Kani)\n  _scored_by: scorer_creusot | scorer_kani             # provenance stamp the scorer leaves\n  # AGENT-SUPPLIED (advisory only; Role 2 may fill; the renderer shows them but they never set the verdict):\n  fidelity:   \u003Creal-type | ghost-mirror | trusted-boundary>  (Creusot) | \u003Creal-type-bounded | representative | arithmetic-core>  (Kani)\n  miss_class: TOOL | AGENT | null\n  note:       \u003Cwhat the proof actually covers>\n  delegate_to: \u003Cthe owning component\u002Ftest, when the agent proposes a delegation>\n```\n**Key-absence is the pending state.** A tool block with **no `status` key** (the null-placeholder Role 1\nwrote, `{evidence: null, fidelity: null, note: null}`) means the scorer has not scored this property yet —\nrender it as **pending `·`**, never as covered and never as a failure. There is no `not-attempted` status\nanymore; \"not yet scored\" is signalled by the *absence* of `status`. This skill computes only the **derived\nrollups** (per-method verdicts, counts, headlines) from `status`\u002F`symbol`; it writes nothing back into\n`unified_properties.yaml`.\n\n### Bundle ownership (read from the inventory — do not recompute)\n\n- The `methods` bundle of each property, the per-method bundle sizes, and both counts (*distinct\n  properties* M, *method→property attachments*) are **already computed in the inventory**. Read them.\n- A shared-helper property (e.g. `align_up`) is already attached to every dependent method there — carry\n  that through unchanged; it is expected for one property to sit in many bundles.\n- The counting unit stays the public method. If you feel a need to reassign an owner, that is an\n  inventory fix (Role 1), not something this skill does silently.\n\n## Method verdict (per tool)\n\nFor public method `m` and tool `T` (Creusot or Kani), reading each property's `T` block from `unified_properties.yaml`.\nFirst classify each property in `m`'s bundle for `T`: **scored** (has a `status`) or **pending** (no\n`status` key yet). Then:\n- `·` **(pending)** if **any** property in `m`'s bundle is still pending for `T` — the run has not finished\n  scoring this method, so no terminal verdict is honest yet. Pending dominates: never resolve a method to\n  `✓` or `–` while a bundle property is unscored.\n- `✓` if **every** property in `m`'s bundle is scored to a terminal covered state — proved (`✓`\u002F`★`) by\n  some tool, or `delegated` (`⤴`) across a real interface boundary — **and** `T` itself proved (`✓`\u002F`★`) at\n  least one of `m`'s properties.\n- `–` otherwise: every property is scored (none pending) but `T` proved nothing for `m`, or some property of\n  `m`'s bundle is a scored `tool-boundary` (`⊘`). A `⊘` proof-lane property blocks the method's `✓` — report\n  it honestly, never relabel; and never render a scored `–` for a method that is really still pending.\n\nComponent score: `Creusot X \u002F N`, `Kani Y \u002F N`, where **N = number of public methods** (`counts.methods`).\nWhen any method is pending, also report the pending count and keep the INCOMPLETE banner up — `X` and `Y`\ncount only methods that are fully scored to `✓`, never pending ones.\nAlso report the net: **methods whose whole bundle is covered (done) vs incomplete**. `★` counts toward\n`✓` at the method level but its fidelity (ghost-mirror \u002F trusted-boundary) is disclosed in the scorecard\nand the assumptions\u002Fspec-vs-tool sections — never hidden.\n\n## Required output — ONE combined scoring page\n\nEmit a **single** self-contained `\u003Ccomponent>_scoring.html` rendered from `unified_properties.yaml` — the superset\npage that replaces the old three thin slides (8\u002F9\u002F11). One page per component, extensible to more tool\ncolumns (Loom\u002FSpin can be added one at a time later — the renderer is N-tool-ready, not hard-wired to two).\nSections, in order (this mirrors the hand-curated `SEPT_2026\u002FSEPT_14\u002F*_scoring.html` reference layout):\n1. **Title + sub-line** — interface, N, `.coma`\u002FVC totals (Creusot), Kani harness count, run pin + date.\n2. **Banner callout** — the three end-states (Proved \u002F Delegated ⤴ \u002F Tool-boundary ⊘) and the anti-vacuity note.\n3. **FROM_SPEC callout** — links `spec_properties.yaml`\u002F`code_properties.yaml`, states `spec_total` \u002F `code_total` \u002F unified `M`,\n   and explains they differ from M (spec∩code).\n4. **Per-tool KPI cards** — Creusot and Kani each: `X\u002FN` methods, VCs\u002F`.coma` (Creusot) or harness count (Kani),\n   wall-clock + peak RSS.\n5. **Combined scorecard** — the one table with columns **Props | Method | Creusot | Kani | Boundaries\u002Fnotes**;\n   per-method rows grouped by capability area; per-tool cell shows the method verdict symbol; `*`\u002F`**` footnotes\n   (`*` = better-fit prover; `**` = logic lives in other components → `–\u002F–`).\n6. **Property-bundles table** — **Property | What it requires | Creusot | Kani | Owner\u002Fnote**, per `id`, each\n   tool cell showing its `symbol` and (on hover\u002F'★') its `fidelity`.\n7. **Spec-vs-each-tool table** — **Spec property | What Kani proves | What Creusot proves | The weakening** —\n   this is where the abstraction↔real finding surfaces from the `fidelity` fields (Creusot ghost-mirror\u002F★ vs\n   Kani real-type-bounded).\n8. **Unproved rows and their causes** — narrative over the `⊘` properties with their `miss_class`\n   (TOOL vs AGENT) and reproducible signatures from `note`\u002F`evidence`.\n9. **Measurement table** — **Tool\u002Frun | Wall-clock | Peak RSS | Discharged** (VCs\u002F`.coma` or harnesses).\n10. **Anti-vacuity** statement and **Provenance** (pin, sources, generator).\n\nHTML must be **self-contained and theme-aware**; deliverables are read in-repo and may be cut onto plain\nwhite slides (keep backgrounds light, avoid heavy colored bands). Reference implementation: the\nhand-curated `SEPT_2026\u002FSEPT_14\u002F\u003Ccomponent>_scoring.html`.\n\n(Optional) if a machine-readable rollup is wanted, it is already `unified_properties.yaml` — do **not** re-emit a\nhand-formatted `.md` rollup; the YAML is the structured artifact and the HTML is the presentation.\n\n## Honesty rules (non-negotiable)\n\n- **A method is `✓` only when its whole bundle is covered.** A scored `⊘` proof-lane property makes the\n  method `–`; a still-pending (unscored) one makes it `·`. Either way it is not `✓` — do not inflate the\n  method count by ignoring unfinished or unscored properties.\n- **N = number of public methods** (`counts.methods`), fixed by the trait. Never shrink N to improve the ratio.\n- Every `proved` claim traces to a real artifact (VC\u002F`.coma` or harness) via the property `id` and `evidence`.\n- **`★` is disclosed, not hidden.** A method whose `✓` rests on a ghost-mirror\u002Ftrusted-boundary property\n  still shows `✓` at the method level, but the scorecard\u002Fbundle\u002Fspec-vs-tool sections must surface the\n  `fidelity` so the abstraction is visible. Under-claim, never over-claim.\n\n## Procedure\n\n1. Read `unified_properties.yaml`: the public methods, N (`counts.methods`), the `methods` bundles, and each\n   property's `creusot:`\u002F`kani:` blocks (do not recompute any Role-1\u002FRole-2 field).\n2. **Consistency gate (not a completeness gate):** stop and flag ONLY on a structural defect — a tool block\n   citing an `id` absent from the property set, or a scored status contradicting the shared obligation.\n   Properties with **no `status` key are pending, not errors** — render them `·` and raise the INCOMPLETE\n   banner; do not stop. (A dry run or a one-tool partial run is expected to be all- or mostly-pending.)\n3. Compute each method's `✓\u002F–\u002F·` per tool (verdict rule above — pending dominates), the score X\u002FN and Y\u002FN\n   over fully-scored methods, the pending count, and the done\u002Fincomplete split. Pull `fidelity`, `evidence`,\n   `miss_class`, and `note` straight through for display.\n4. Render the single `\u003Ccomponent>_scoring.html` (sections above) from `unified_properties.yaml`.\n5. Report: `\u003Ccomponent> — Creusot X\u002FN, Kani Y\u002FN public methods proved; Z methods have complete bundles,\n   P methods still pending (unscored), (N−Z−P) scored-but-incomplete (list the blocking ⊘ properties with\n   their signatures)`. If P > 0, say so plainly — the run is a partial render, not a final score.\n\n## Anti-patterns (the rabbit holes)\n\n- ❌ Counting **properties** as the scorecard denominator. (Denominator = public methods.)\n- ❌ Using `◐` on the scorecard. (Scored verdicts are two-state ✓\u002F–; `★`\u002Ffidelity detail lives in the bundle\n  & spec-vs-tool sections. Pending `·` is legitimate but is *not* a verdict — it marks a not-yet-scored cell.)\n- ❌ Marking a method `✓` while a proof-lane property is still `⊘`, or resolving it to `✓`\u002F`–` while any\n  bundle property is still **pending** (unscored). Pending dominates — render `·` and keep the banner up.\n- ❌ Treating a not-yet-scored property (no `status` key) as a failure and STOPping. Absence of `status` is\n  pending, not an error; only a structural inconsistency stops the render.\n- ❌ Re-extracting, re-bundling, or re-deriving status. (Everything comes from `unified_properties.yaml`.)\n- ❌ Emitting the old three thin slide files or a hand-formatted `.md` rollup. (One combined HTML; YAML is the data.)\n- ❌ Guessing a round property\u002Fmethod count to fit a table.\n\n## Routing\n\nGeneral methodology → `unstable` (promote via PR; don't leave siloed on a verif branch).\nDeliverables (`spec_properties.yaml`, `code_properties.yaml`, `unified_properties.yaml`, `\u003Ccomponent>_scoring.html`) → written under\n**`formal-verification\u002F\u003Ccomponent>\u002F`** and shipped to `unstable` via PR. Under the `component-verify`\norchestrator, the orchestrator performs that commit\u002FPR (gated to `formal-verification\u002F\u003Ccomponent>\u002F`); run\nstandalone, open the PR yourself. **No Box, no scp** — the repo folder is the shareable home.\n",{"name":5,"description":7,"argument-hint":50},"[component-name]","unstable","dc564aa356769b7754391c9fa4fdaa0f179f476c",".claude\u002Fskills\u002Ftools-aggregate-coverage-by-interface",4,"https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research","https:\u002F\u002Fai-native-systems-research.github.io\u002Fai-native-systems-research\u002F","2026-11-12 06:08:32",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add AI-native-Systems-Research\u002Fai-native-storage-certus --skill tools-aggregate-coverage-by-interface",{"tool":65,"command":66},"bunx","bunx skills add AI-native-Systems-Research\u002Fai-native-storage-certus --skill tools-aggregate-coverage-by-interface",{"tool":68,"command":69},"pnpm","pnpm dlx skills add AI-native-Systems-Research\u002Fai-native-storage-certus --skill tools-aggregate-coverage-by-interface","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002F.claude\u002Fskills\u002Ftools-aggregate-coverage-by-interface\u002FSKILL.md",true,[],[74,91,106,116,133,145],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":45},"01M6KP29TWSNGADF3AJ47BR7TY","tools-spin-sync","Synchronize Spin\u002FPromela models with current source code and re-verify","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-spin-sync\u002FSKILL.md",[],[81,20,82,83,84,85,86,31,87,88,89,90],"tools spin sync","sync","code","verify","model","models","with","re","source","source code",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":45},"01M6KP277TDY3ZAJEBP5P6MDT8","tools-spin-model","Create a new Spin\u002FPromela formal verification model for a system property","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-spin-model\u002FSKILL.md",[],[98,85,20,99,100,101,102,103,24,104,105],"tools spin model","system","formal verification","number","for","prove","create","verification",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":45},"01M6KP250W406CEDSF02BRXT9D","tools-creusot-install","Install the Creusot Rust verification tool","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-install\u002FSKILL.md",[],[113,114,20,115,105,37],"tools creusot install","install","rust",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":45},"01M6KP22H28FQ1X0V7VJHEFWXD","tools-creusot-init","Prepare an existing Cargo project to use Creusot formal verification","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-init\u002FSKILL.md",[],[123,20,124,125,126,127,128,105,129,100,130,131,132],"tools creusot init","init","project","directory","components","prepare","use","cargo","manager","Existing",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":45},"01M6KP1V506J9YM8DKKVDG1NRE","tools-creusot-coq-install","Add Coq 8.20 as an additional prover to an existing Creusot installation, for verification conditions that SMT solvers cannot discharge","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-coq-install\u002FSKILL.md",[],[140,141,114,20,102,132,142,143,105,144],"tools creusot coq install","Coq","as","installation","add",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":45},"01M6KP1PQJF3H765TYZAZ7P3EF","tools-creusot-annotate-interfaces","Formally verify a component's properties with Creusot and annotate its interface definitions","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-annotate-interfaces\u002FSKILL.md",[],[20,152,153,87,31,23,84,44,21],"tools creusot annotate interfaces","annotate"]