merge: bring dev into wait tool branch

docs/14-skills-runtime.md

@@ -217,7 +217,7 @@ github:owner/repo[@tag]
 ```
 
 Admin-only, SHA256-verified, ELF-validated, with a release-picker UI. Binaries
-land in `/app/data/.runtime/bin/` (on `$PATH`). See
+land in `{runtimeDir}/bin/` (on `$PATH`). See
 [`docs/packages-github.md`](./packages-github.md) for syntax, configuration,
 security posture, and troubleshooting (especially musl/glibc compatibility).
 

docs/journals/260518-1741-beta-skill-grants-tenant-scope.md

@@ -0,0 +1,43 @@
+# Beta Skill Grants Tenant-Scope Hardening
+
+**Date**: 2026-05-18 17:41
+**Severity**: High
+**Component**: Skills grants, tenant isolation, skill management UI/API
+**Status**: Resolved
+
+## What Happened
+
+This beta ship started from PR #14, which added per-agent skill manage grants so an authorized agent can edit/delete skills even when `owner_id` no longer matches its current actor identity. The review caught the ugly part: the grant path could mutate skill visibility or grant records across tenant boundaries, and the UI/API exposed `owner_id` in skill responses where clients did not need it. Issue digitopvn/goclaw#15 tracks the hardening fallout.
+
+## The Brutal Truth
+
+This was a permission feature shipped close to a tenant-isolation fault line. That is always where mistakes hurt most. The exhausting part is that the baseline feature was useful, but the first version trusted grant inputs too much. A beta is exactly where this should be caught, but it still feels bad because cross-tenant mutation risk is not a cosmetic bug.
+
+## Technical Details
+
+- PG now validates grant scope before insert/update in `internal/store/pg/skills_grants.go:19` and `verifySkillGrantScope` rejects mismatched agent tenants as `agent not found`.
+- SQLite mirrors the same check in `internal/store/sqlitestore/skills_grants.go:25`.
+- Cleanup migration `migrations/000067_skill_agent_grants_scope_cleanup.up.sql:1` deletes `skill_agent_grants` rows where `sag.tenant_id <> a.tenant_id` or non-system skill tenant differs.
+- `internal/store/skill_store.go:19` hides `OwnerID` with `json:"-"`, stopping owner IDs from leaking through skill responses/UI.
+- Changelog updated under `CHANGELOG.md`.
+
+## What We Tried
+
+- Kept PR #14's per-agent `can_manage` model because it directly solves agent-owned skill maintenance without pretending `owner_id` is stable agent identity.
+- Rejected UI-only filtering because it would not protect HTTP, WebSocket, import, or future callers.
+- Added store-layer verification in both PG and SQLite because that is the point every grant mutation must cross.
+
+## Root Cause Analysis
+
+We shipped the first feature around ownership semantics without enforcing the tenant relationship at the same boundary as the write. The fundamental mistake was treating authorization and scope as already resolved by callers. In a multi-tenant system, that assumption is how one tenant ends up mutating another tenant's visibility state.
+
+## Lessons Learned
+
+Grant writes must prove both sides of the relationship: the skill and the agent. Do not rely on caller discipline. Also, response structs should not expose security-sensitive ownership fields just because the database row has them.
+
+## Next Steps
+
+- Owner: maintainers. Monitor digitopvn/goclaw#15 through beta.
+- Owner: release lead. Verify beta users receive migration `000067` and no stale cross-tenant rows survive upgrade.
+- Owner: reviewers. Treat future grant/import/export changes as tenant-scope sensitive by default.
+- Tests/build are passing for this ship; keep PG, SQLite, and Web UI build checks required before promoting beyond beta.

docs/packages-github.md

@@ -24,7 +24,7 @@ Examples:
 4. Verifies SHA256 if the publisher ships `checksums.txt` / `SHA256SUMS`
 5. Validates ELF magic bytes + 64-bit class + machine matches runtime arch
 6. Extracts archive safely (tar.gz / zip / raw binary) with path-traversal + zip-bomb guards
-7. Installs to `/app/data/.runtime/bin/` (prepended to `$PATH`)
+7. Installs to `{runtimeDir}/bin/` (prepended to `$PATH`)
 8. Persists a manifest for later listing + uninstall
 
 ## Usage
@@ -69,7 +69,7 @@ token in `config.json`.
 | `GOCLAW_PACKAGES_GITHUB_TOKEN` | `""` | Optional PAT: rate 60/hr → 5000/hr + private repo access |
 | `GOCLAW_PACKAGES_MAX_ASSET_SIZE_MB` | `200` | Applies to both download cap and 2× uncompressed cap |
 | `GOCLAW_PACKAGES_GITHUB_ALLOWED_ORGS` | `""` | Comma-separated allowlist (empty = all orgs allowed) |
-| `GOCLAW_PACKAGES_GITHUB_BIN_DIR` | `/app/data/.runtime/bin` | Where extracted binaries land |
+| `GOCLAW_PACKAGES_GITHUB_BIN_DIR` | `{runtimeDir}/bin` | Where extracted binaries land |
 | `GOCLAW_PACKAGES_GITHUB_MANIFEST` | `{bin_dir}/../github-packages.json` | Manifest path |
 
 Token scopes:
@@ -133,7 +133,7 @@ the release. Do not force-install; report upstream.
 ## Limitations (Phase 1)
 
 - Linux-only (Lite/Desktop editions not yet supported)
-- Docker edition only (runtime dir `/app/data/.runtime/bin`)
+- Docker and bare-metal gateway editions (default runtime dir resolves to `/app/data/.runtime/bin` in Docker or `/var/lib/goclaw/data/.runtime/bin` on bare-metal Linux)
 - Installs all top-level executables in an archive (no interactive picker if
   archive contains multiple binaries)
 - No version history / rollback — re-installing replaces in place

docs/project-changelog.md

@@ -6,6 +6,19 @@ Significant changes, features, and fixes in reverse chronological order.
 
 ## 2026-05-18
 
+### Packages: GitHub installer runtime path
+
+**Fixes**
+
+- Fixed GitHub Releases package installs on bare-metal gateways by defaulting the GitHub binary directory to `{runtimeDir}/bin` instead of Docker-only `/app/data/.runtime/bin`.
+- The fix covers installs such as `github:nextlevelbuilder/goclaw-cli@v0.4.1` on the VPS, where `/app` is not writable or present.
+
+**Tests**
+
+- Added default-path regression coverage and made Unix-socket apk helper tests skip cleanly on Windows environments that cannot bind Unix sockets.
+
+---
+
 ### Tools: built-in wait delay
 
 **Features**
@@ -56,6 +69,24 @@ Significant changes, features, and fixes in reverse chronological order.
 
 ## 2026-05-17
 
+### Skills: agent manage grants
+
+**Fixes**
+
+- Added explicit per-agent skill manage grants so agents can edit/delete skills they were authorized to maintain even when `owner_id` no longer matches their current actor identity.
+- Auto-granted manage permission to the creating/publishing agent for new managed skills.
+
+**UI**
+
+- Show custom skill owner IDs in the Skills table.
+- Added Skills page controls to grant agent skill access and edit/delete permission.
+
+**Tests**
+
+- Added PG/SQLite grant coverage and verified Go builds plus Web UI build.
+
+---
+
 ### Agents: provider switch save fix
 
 **Fixes**