merge: resolve main conflicts in PR #200 (issue #173)

Author: SIN CI

AGENTS.md

@@ -13,6 +13,8 @@
 > `github-skills/` category added; 34 bundled skills embedded in the
 > binary. Branch protection on `main` permanently relaxed to
 > `required_approving_review_count: 0` for solo-maintainer workflow.
+> `sin-code install` (issue #170) — new 40th subcommand; root `install.sh`
+> rewritten to a 27-line curl|bash shim; matching `install.ps1` for Windows.
 
 ---
 
@@ -231,7 +233,8 @@ SIN-Code/
 │   ├── ceo-audit.yml          ← n8n delegation (mandate M1)
 │   ├── sin-code-release.yml   ← goreleaser + brew tap
 │   └── ecosystem-sync.yml     ← prevents registry/permission/ECOSYSTEM drift
-├── install.sh
+├── install.sh                    ← 27-line curl|bash shim → `sin-code install` (issue #170)
+├── install.ps1                   ← PowerShell equivalent shim (issue #170)
 ├── profiles/                   ← v3.4.0: agent profile TOML files
 │   ├── fireworks.toml
 │   └── qwen-relay.toml
@@ -242,7 +245,7 @@ SIN-Code/
 │   └── mcp.json.example
 │
 ├── cmd/
-│   ├── sin-code/              ← MAIN BINARY (39 subcommands — v3.13.0)
+│   ├── sin-code/              ← MAIN BINARY (40 subcommands — v3.18.0)
 │   │   ├── main.go            ← cobra root; AddCommand for all subcommands
 │   │   ├── tui.go, webui_cmd.go
 │   │   ├── chat_cmd.go        ← v3.4.0: chat + -p headless
@@ -260,8 +263,9 @@ SIN-Code/
 │   │   ├── hub_cmd.go           ← v3.12.0: tool catalog hub subcommand
 │   │   ├── ledger_cmd.go        ← v3.13.0: ledger query subcommand
 │   │   ├── summary_cmd.go       ← v3.13.0: summary builder subcommand
+│   │   ├── install_cmd.go       ← v3.18.0: `sin-code install` (issue #170, single-binary installer)
 │   │   ├── permission_defaults.go ← C4: default rules + MCP prefix policy
-│   │   └── internal/          ← 17 packages (v3.8.0)
+│   │   └── internal/          ← 18 packages (v3.18.0)
 │   │       ├── agentloop/     ← PLAN→ACT→VERIFY→DONE loop
 │   │       ├── session/       ← SQLite-backed resumable sessions
 │   │       ├── permission/    ← allow/ask/deny engine
@@ -272,6 +276,30 @@ SIN-Code/
 │   │       ├── lessons/       ← v3.4.0: closed learning loop
 │   │       ├── autonomy/      ← v3.5.0: goal queue + triggers
 │   │       ├── skillmgr/      ← v3.5.0: install/verify skills
+│   │       ├── skilldist/     ← v3.17.0: marker-fenced skill distribution (issue #169)
+│   │       ├── loopbuilder/   ← v3.4.0: shared factory (DRY)
+│   │       ├── vane/          ← v3.8.0: HTTP bridge to ItzCrazyKns/Vane (internal/vane)
+│   │       ├── stack/         ← v3.8.0: unified install/doctor across 3 layers
+│   │       ├── hub/           ← v3.12.0: static tool catalog
+│   │       ├── ledger/        ← v3.13.0: semantic session ledger (SQLite)
+│   │       ├── summary/       ← v3.13.0: deterministic session summary builder
+│   │       ├── install/       ← v3.18.0: pure-stdlib release install + SHA256 verify + atomic place (issue #170)
+│   │       ├── llm/           ← provider layer
+│   │       ├── style/         ← v3.17.0: verbosity / compression mode system-prompt renderer (issue #167)
+│   │       ├── orchestrator/  ← DAG, critic, adversary, governor, ...
+│   │       ├── memory/        ← (existing) store/search/embed
+│   │       ├── lsp/, notifications/, todo/, plugins/, sandbox/, attachments/, webui/
+│   │       ├── agentloop/     ← PLAN→ACT→VERIFY→DONE loop
+│   │       ├── session/       ← SQLite-backed resumable sessions
+│   │       ├── permission/    ← allow/ask/deny engine
+│   │       ├── verify/        ← mandatory PoC/Oracle gate
+│   │       ├── mcpclient/     ← external MCP consumption
+│   │       ├── hooks/         ← 24 lifecycle events
+│   │       ├── commands/      ← custom slash commands
+│   │       ├── lessons/       ← v3.4.0: closed learning loop
+│   │       ├── autonomy/      ← v3.5.0: goal queue + triggers
+│   │       ├── skillmgr/      ← v3.5.0: install/verify skills
+│   │       ├── skilldist/     ← v3.18.0: marker-fenced skill distribution (issue #169)
 │   │       ├── loopbuilder/   ← v3.4.0: shared factory (DRY)
 │   │       ├── vane/          ← v3.8.0: HTTP bridge to ItzCrazyKns/Vane (internal/vane)
 │   │       ├── stack/         ← v3.8.0: unified install/doctor across 3 layers
@@ -280,6 +308,7 @@ SIN-Code/
 │   │       ├── summary/       ← v3.13.0: deterministic session summary builder
 │   │       ├── mcpcompress/   ← v3.19.0: ponytail-tag compressor for `serve --compress-tools`
 │   │       ├── llm/           ← provider layer
+│   │       ├── style/         ← v3.17.0: verbosity / compression mode system-prompt renderer (issue #167)
 │   │       ├── orchestrator/  ← DAG, critic, adversary, governor, ...
 │   │       ├── memory/        ← (existing) store/search/embed
 │   │       ├── lsp/, notifications/, todo/, plugins/, sandbox/, attachments/, webui/
@@ -323,6 +352,25 @@ Goal Queue DB: `~/.local/share/sin-code/goals.db` (SQLite, modernc).
 Ledger DB: `~/.local/share/sin-code/ledger.db` (SQLite, modernc), overridable
 via `SIN_CODE_LEDGER`.
 
+### Verbosity / compression mode (issue #167)
+
+| Config key | Allowed values | Default |
+|---|---|---|
+| `llm.style` | `default` \| `verbose` \| `normal` \| `terse` \| `ultra` | `default` |
+
+The setting is read at startup and forwarded into
+`internal/style.RenderRules` via `wiring.Deps.Style` and
+`learning.Learner.BeforeTurn`. The renderer is dependency-free
+(contributes bytes only) and is byte-stable per `(mode, skillBody)`
+pair — a prerequisite for the system-prompt hash metric (issue #2).
+`default` and `verbose` are pass-throughs (no ruleset injected);
+`normal`, `terse`, `ultra` emit the caveman-derived ruleset that
+drops pleasantries, hedging, and tool-call narration while preserving
+every byte of code, URLs, paths, error strings, and `func`/`var`/
+`const` names. Every ruleset carries the **auto-clarity** clause
+that drops to normal prose around destructive, security-relevant, or
+order-sensitive actions (mandate M3, the verification gate is sacred).
+
 Headless JSON contract (stable API — never break without major bump):
 
 ```json
@@ -353,6 +401,9 @@ Headless JSON contract (stable API — never break without major bump):
 | v3.16.0 | ✅ SHIPPED | Forge integration (#37): `sin forge` command, `sin status` detection, 16th MCP tool in `mcp_config` |
 | v3.19.0 | ✅ SHIPPED | `sin-code serve --compress-tools` (issue #173): ponytail-tag compressor in `internal/mcpcompress/` shrinks the 47-tool manifest on the wire. Tag set `delete|stdlib|native|yagni|shrink`, subset via `--compress-tags`, savings reported via `--print-stats`. Tool names, schemas, and behavior are unchanged (AGENTS.md §10). Closing #173. |
 
+| v3.18.0 | ACTIVE | `sin-code install` + curl|bash shim + PowerShell (issue #170): new 40th subcommand + internal/install/ package, 27-line install.sh mirror + 35-line install.ps1, SHA256-verified single-binary downloads from goreleaser assets |
+| (next)  | TBD    | eval/trace infra hardening + first-party golden-dataset CI gate (issue #75 phase 2) |
+
 Each release tag ⇒ goreleaser builds linux/darwin/windows × amd64/arm64,
 updates `homebrew-sin` formula, and ships to GitHub Releases.
 
@@ -402,19 +453,57 @@ Each skill **must** contain:
 Skills ported from external repos (e.g. `Infra-SIN-OpenCode-Stack`) must include
 `lifecycle: external` and `sources:` in their metadata.
 
+### Skill distribution to external agents (issue #169)
+
+`sin-code skill install <name> --agent <target>` distributes a bundled
+Skill artifact to one of eight registered agent families. The single
+source of truth is `cmd/sin-code/internal/skilldist/Targets`:
+
+| Target | Format | Install path template (relative to `$SIN_CODE_HOME`) |
+|---|---|---|
+| `claude-code` | `dir` | `.claude/skills/<skill>` |
+| `opencode` | `dir` | `.config/opencode/skills/<skill>` |
+| `gemini` | `dir` | `.gemini/skills/<skill>` |
+| `codex` | `rule` | `.codex/rules/<skill>.md` |
+| `cursor` | `rule` | `.cursor/rules/<skill>.mdc` |
+| `windsurf` | `rule` | `.windsurf/rules/<skill>.md` |
+| `cline` | `rule` | `.clinerules/<skill>.md` |
+| `copilot` | `marker` | `.github/copilot-instructions.md` |
+
+**Marker-fence contract.** Every write for `rule` and `marker` Formats
+goes through `ParseMarkers` so a subsequent install with the same
+`(target, skill)` pair replaces the previously written block in place:
+
+```
+<!-- SIN-CODE-SKILL-START: <skill> -->
+… rendered body …
+<!-- SIN-CODE-SKILL-END:   <skill> -->
+```
+
+The leading/trailing ASCII prefix `SIN-CODE-SKILL` is the rg-friendly
+anchor. The trailing whitespace before `<skill>` on the END marker is
+visual alignment only — `ParseMarkers` strips it on lookup, so any
+strict matcher outside this package works too.
+
+**Public API surface.** `(Target.Name, Target.DisplayName)` is exposed
+via the `--agent <name>` flag. Adding a target is non-breaking; renaming
+or removing one is a major bump. The `sin-code skill list --json`
+output schema is also a public API — preferred-format changes go through
+the same major-bump policy.
+
 ### CLI subcommands (verified `cmd/sin-code/main.go`, v3.5.0)
 
 ```
 Core:      discover, execute, map, grasp, scout, harvest, orchestrate,
            ibd, poc, sckg, adw, oracle, efm
 Agents:    chat, sessions, mcp, goal, daemon, skill, superpowers,
-           vane, stack, gh
+           vane, stack, gh, install
 Frontend:  serve, tui, webui
 Lifecycle: memory, knowledge, todo, notifications, orchestrator_run,
            orchestrator_agents, orchestrator_plan, update
 Utility:   read, write, edit, lsp, plugin, index, security, sbom,
            config, self-update, hub, ledger, summary
-``` (v3.13.0: 39 subcommands, up from 36 in v3.9.0)
+``` (v3.18.0: 40 subcommands; `install` is the v3.18.0 single-binary installer from issue #170)
 
 ### Hook events (verified `internal/hooks/hooks.go`, v3.5.0)
 
@@ -503,9 +592,14 @@ and inspect trajectories visually (Langfuse / Jaeger / Arize Phoenix).
 | `cmd/sin-code/internal/dataset/runner.go` | Executes TestCases against the existing `agentloop.Loop` |
 | `cmd/sin-code/internal/eval/judge.go` | LLM-as-a-Judge via `internal/llm.Client` |
 | `cmd/sin-code/internal/eval/metrics.go` | Summary aggregation + JSON envelope for CI |
-| `cmd/sin-code/eval_cmd.go` | `sin-code eval run` + `sin-code eval list` |
+| `cmd/sin-code/internal/evalharness/arms.go` | v3.18.0 four-arm constructors (baseline / terse / lazy / `<skill>`) for issue #171 |
+| `cmd/sin-code/internal/evalharness/comparator.go` | v3.18.0 `Compare` runner producing per-arm aggregates |
+| `cmd/sin-code/internal/evalharness/prices.go` | v3.18.0 self-pricing price book (USD/1k tokens per model) |
+| `cmd/sin-code/internal/evalharness/snapshot.go` | v3.18.0 deterministic snapshot round-trip (caveman evals/README.md §3) |
+| `cmd/sin-code/eval_cmd.go` | `sin-code eval run` + `eval compare` + `eval snapshot` + `eval diff` (issue #171) |
 | `cmd/sin-code/trace_cmd.go` | `sin-code trace doctor` — exporter-only sanity check |
 | `evals/critical.json` | Example Golden Dataset (3 cases, no LLM needed) |
+| `evals/three-arm-example.json` | v3.18.0 four-arm bench, 3 cases (issue #171) |
 
 ### CLI surface
 
@@ -523,10 +617,51 @@ sin-code eval run --dataset evals/critical.json \
 sin-code eval run --dataset evals/critical.json \
     --judge-model gpt-4o --judge-endpoint https://api.openai.com/v1
 
+# Four-arm comparator (issue #171) — baseline / terse / lazy_skill / <user-skill>
+sin-code eval run --dataset evals/three-arm-example.json \
+    --arm baseline,terse,lazy_skill,skill-code-create
+sin-code eval compare --dataset evals/three-arm-example.json
+sin-code eval snapshot --dataset evals/three-arm-example.json --out /tmp/snap.json
+sin-code eval diff --snapshot /tmp/snap-base.json --snapshot-b /tmp/snap-head.json
+
 # Sanity-check the OTel exporter setup without a full eval
 sin-code trace doctor --exporter stdout --emit-sample-span
 ```
 
+### 12.1 Four-arm comparator (issue #171)
+
+The comparator runs the same dataset against the four arms
+identified in the issue body:
+
+| Arm | Reserved ID | SystemPrompt |
+|---|---|---|
+| baseline | `__baseline__` | empty (legacy single-arm behaviour) |
+| terse | `__terse__` | `"Answer concisely."` |
+| lazy skill | `__lazy_skill__` | terse-prefixed body of `skill-code-lazy` (issue #178) |
+| user skill | `<user-supplied>` | terse-prefixed body of the bundled skill named by `--skill` |
+
+The **honest delta** between any candidate arm and the `terse`
+arm is what reviewers grade on. Comparing a skill directly to the
+baseline conflates the skill's content with the generic "be
+terse" instruction; the four-arm harness isolates them.
+
+The output matrix mirrors ponytail's
+`benchmarks/README.md:34-58`:
+
+| column | meaning |
+|---|---|
+| `pass_rate` | `Passed / TotalCases` |
+| `med_LOC` | median lines of output across cases |
+| `med_latency_ms` | median wall-clock per (case, arm) |
+| `med_usd` | median USD cost (using `prices.go` price book) |
+| `med_tokens` | median prompt + completion tokens |
+| `med_score` | median `Result.Score` per arm |
+
+Snapshots are deterministic JSON: the comparator sorts every arm,
+median-recomputes every cell, and writes the same bytes for the
+same input on every CI run (caveman evals/README.md §3 promise:
+"snapshot committed to git so CI runs are deterministic and free").
+
 ### Hard mandates honored
 
 - **M2 (single static binary, CGO_ENABLED=0):** pure-Go OTel SDK at
@@ -539,7 +674,7 @@ sin-code trace doctor --exporter stdout --emit-sample-span
   `github.com/OpenSIN-Code/SIN-Code/cmd/sin-code/...` everywhere.
   No `SIN-Code-Bundle` references.
 - **M7 (race-free):** every new test passes
-  `go test -race -count=1 ./cmd/sin-code/internal/{trace,dataset,eval}/...`.
+  `go test -race -count=1 ./cmd/sin-code/internal/{trace,dataset,eval,evalharness}/...`.
 
 ### Reference documentation
 
@@ -556,4 +691,8 @@ sin-code trace doctor --exporter stdout --emit-sample-span
   vs reference `Loop.Run(ctx, sessID, prompt, RunOptions)`).
 - `cmd/sin-code/internal/eval/eval.doc.md` — judge prompt + JSON
   contract; `JudgeResult` schema.
+- `cmd/sin-code/internal/evalharness/comparator.doc.md` — four-arm
+  `Compare` runner, arm constructors, snapshot round-trip (issue #171).
+- `cmd/sin-code/internal/evalharness/snapshot.doc.md` — deterministic
+  matrix + diff (issue #171).