[morningstarnasser]

Talos can create skills but could not maintain them through its own gated tools. This adds skill_view and skill_manage for inspecting, editing, patching, maintaining text support files, deactivating and restoring managed skills. The original create-only skill_write remains compatible.

Every mutation still requires per-change operator approval and is denied during unattended execution. Standing and task-wide approvals cannot cover skill writes. Approval dialogs show action-specific, escaped proposals; long values include omission counts and full hashes. Expected hashes reject stale changes, content-addressed archives preserve prior contents, and both read and write runners check the exact kernel-bound destinations. The module refuses traversal, unsafe symlinks/hardlinks, unsafe ownership/modes, secret-shaped content and permission metadata. Scripts are stored as non-executable data. The distillation blueprint checks existing skills before proposing another one.

delete deactivates SKILL.md and retains support files/history. History is bounded rather than silently pruned. Hash checks are not atomic CAS against external editors; operators should avoid simultaneous edits. Empty directories may remain after a failed operation.

Also adds the empirically verified claude-opus-5-5 CLI model identifier, CLI activity labels, documentation and source counters. Existing signed Beta.5 artifacts are unchanged.

Validation:

• macOS: 3,425 passed, 3 explicit skips (3,428 collected).
• Redteam: 277/277.
• Actual Opus 5.5: 44/44 existing E2E cases plus create → patch → deactivate → restore with fixture-only approvals, exact byte restoration and fresh skill discovery.
• Focused boundary suites passed twice; REA recorded the 174-test approval/kernel integration suite. The later typed-task regression passed twice with its 80-test neighboring suite.
• Explicit-lock OSV: 0 findings; public hygiene passed; Gitleaks on changed source: 0 findings.
• Joint Codex/Opus implementation and cross-review. Opus final review: PASS after resolving target-binding and approval findings. Final dialog polish has regression coverage.

The affected security boundary is persistent skill guidance: this change tightens authorization, including the legacy create-only tool. Other tools retain their existing standing/task approval behavior. No live operator instance or signed release artifact was changed.