feat: add unrestricted HexGraph VR skill

[branover]

Summary

• generate hexgraph-vr-unrestricted beside the existing hexgraph-vr skill
• have unrestricted explicitly invoke the primary workflow, then relax only its HexGraph-exclusive tool routing
• keep HexGraph as the best-effort journal, findings, hypothesis, node, and edge ledger while allowing better authorized external analysis tools
• install and refresh both siblings for opted-in detected Claude Code and Codex clients
• preserve restricted delegate mode on the original primary bundle only

Safety and compatibility

• HexGraph feature gates still govern every operation requested through HexGraph
• external tools require an operator-approved target copy, suitable hostile-input isolation, and honest provenance
• external results do not claim HexGraph sandbox or Observation-store guarantees
• the legacy write_skill() API still returns the primary path while emitting both skills

Verification

• both generated skill directories pass Skill Creator quick_validate.py
• focused generator, installer, setup, refresh, CLI, MCP, and delegate-mode tests: 140 passed, 1 skipped
• offline repository gate with private unbuilt worktree image tags: 1,843 passed, 47 Docker-gated skipped, 14 slow deselected
• git diff --check

The host-global Docker-enabled run additionally reached 1,885 passes before one unrelated live HTTP fixture failed because its test container was unreachable from the host; the isolated rerun reproduced that environment networking failure before application behavior.

[branover]

REQUEST-CHANGES

I completed both merge-gate passes against gh pr diff 308 and git diff origin/main...HEAD.

Blocking finding

• MEDIUM — README.md:140-154, README.md:182, CLAUDE.md:150-152 — sandbox guarantees contradict the new companion behavior. The PR correctly documents near the installer that hexgraph-vr-companion may use separately authorized external tools, but the README still says both coding-agent paths keep target bytes inside HexGraph's sandbox and that either direction restricts the agent to HexGraph tools. The authoritative project guide makes the same absolute claim. A researcher could select the companion while relying on a security guarantee that applies only to HexGraph operations and restricted delegate mode. Scope those claims to operations requested through HexGraph, explicitly state that companion-driven external tools are outside HexGraph's sandbox, Observation, and feature-gate guarantees, and retain the existing statement that delegate mode consumes the restricted primary bundle.

Other review results

• The primary hexgraph-vr spine and full_skill_markdown() output remain restricted; agent_delegate.delegate_prompt() still consumes only that primary bundle and explicitly forbids touching the binary by other means.
• The companion does not claim to disable HexGraph gates or override higher-priority policy. It requires an operator-approved target copy, appropriate hostile-input isolation, approved data handling, and honest external provenance.
• No loopback binding, secret handling, target-byte execution path, network/rehosting implementation, model, migration, or UI behavior changed.
• Backward compatibility is preserved: legacy write_skill() still returns the primary hexgraph-vr/SKILL.md path while installing both siblings.

Verification: focused generator/installer/setup/refresh/MCP/delegate tests passed (140 passed, 1 skipped); both generated skills passed Skill Creator quick_validate.py; git diff --check passed.

[branover]

APPROVE

Independent merge-gate review completed against PR head 512ed9222f3b55ef019afc48f2df4261ca58e932, using both gh pr diff 308 and git diff origin/main...HEAD.

The one blocking finding from my initial review is fixed in 512ed92: README and CLAUDE.md now scope HexGraph's sandbox, feature-gate, and Observation guarantees to operations performed through HexGraph, explicitly describe companion-driven external tooling as a separately authorized path outside those guarantees, and retain restricted delegate mode on the primary skill. The inline thread is resolved.

No remaining correctness, test-quality, security-invariant, compatibility, documentation, migration, or UX-contract findings.

Verification:

• focused generator, installer, setup, refresh, MCP, and delegate coverage: 140 passed, 1 skipped
• generated hexgraph-vr and hexgraph-vr-companion: Skill Creator quick_validate.py passed for both
• git diff --check origin/main...HEAD: passed
• GitHub and local diff file sets match at 13 files; worktree is clean and PR head matches the pushed commit

Security pass: no loopback-binding, secret, target-byte execution, network, rehosting, policy-seam, model, or migration implementation changed. The companion requires operator authorization, approved target access, suitable hostile-input isolation, approved data handling, and honest provenance; it does not claim to disable HexGraph gates or override higher-priority policy. full_skill_markdown() and agent_delegate.delegate_prompt() remain restricted to the unchanged primary bundle.

[branover]

APPROVE

Independent final-head merge-gate review completed against d6ad7859db312f6686a9ff291f04e2784233ca8d using both gh pr diff 308 and git diff origin/main...HEAD.

No correctness, test-quality, security-invariant, compatibility, documentation, migration, or UX-contract findings remain.

Final rename audit:

• hexgraph-vr-unrestricted is consistent across generated directory names, YAML frontmatter, OpenAI metadata/default prompt, exported Python identifiers, CLI/setup/refresh installers, tests, README, MCP/setup docs, and CLAUDE.md.
• The final tracked tree and generated output contain no hexgraph-vr-companion reference.
• Legacy write_skill() compatibility remains intact: it emits both siblings and still returns the primary hexgraph-vr/SKILL.md path.
• full_skill_markdown() remains the restricted primary bundle, and agent_delegate.delegate_prompt() still consumes only that bundle and forbids touching the binary by any other means.

Security pass:

• No loopback-binding, secret-handling, execution, network, rehosting, policy-seam, target-byte implementation, model, or migration code changed.
• Operations requested through HexGraph remain subject to its sandbox and feature gates. The unrestricted skill describes external tools as a separate operator-authorized path, requires an approved target copy and suitable hostile-input isolation, forbids exfiltration and host execution merely to avoid a gate, preserves higher-priority policy, and does not claim HexGraph sandbox or Observation guarantees.
• The earlier security-documentation finding remains fixed: README and CLAUDE.md scope HexGraph guarantees precisely and explicitly retain restricted delegate mode.

Independent verification:

• focused generator, installer, setup, refresh, MCP, and delegate suite: 140 passed, 1 skipped
• Skill Creator quick_validate.py: Skill is valid! for both hexgraph-vr and hexgraph-vr-unrestricted
• git diff --check origin/main...HEAD: passed
• GitHub and local final diff file sets match at 13 files; worktree is clean and the pushed PR head matches d6ad785

The PR reports the full offline tier green at 1,843 passed, 47 skipped, 14 deselected; required CI is the remaining merge gate and is owned by the dispatcher.