Skill Runtime
Hot-reloadable, file-backed units of behaviour, read fresh each invocation. The substrate that runtime self-modification rides on.
One node in a single signed graph. Here is how this class connects across the other layers — each edge content-addressed, evidence-gated, and ed25519-signed like any claim.
A Skill Runtime is a hot-reloadable, file-backed unit of behavior that forms the substrate on which an agent system modifies its own operational repertoire at runtime.
Epistemic status: changelog-derived, not runtime-verified. Claims below describe design intent as inferred from changelogs; they have not been confirmed against live execution.
What It Is
A skill is not a compiled artefact locked at deploy time. It is a file-backed behaviour definition that the runtime can reload without restarting. The distinction matters: a conventional plugin system requires a restart cycle or a pre-registered extension point. A Skill Runtime exposes the agent's own behavioural surface as a mutable, addressable namespace. Adding, replacing, or removing a skill changes what the agent can do within the same session.
The Skill hot-reload primitive is a direct instance of this class, representing the concrete reload mechanism that the Skill Runtime enables.
Mechanics
The file-backed model imposes a specific contract:
- Persistence on disk. Skills have canonical file paths. The runtime resolves behaviour by reading from those paths, not from an in-memory registry compiled at startup.
- Hot-reload path. When a skill file changes, the runtime picks up the new definition without a full restart. This is the substrate-modification pathway.
- Instance-of relationship.
Skill hot-reloadis not a separate system; it is an instance of the Skill Runtime class, meaning hot-reload is a forced-by constraint of the class definition, not an optional feature bolted on.
Why It Matters
The practical consequence is self-modification. An agent running on a Skill Runtime can have its behaviour altered by writing to the filesystem -- by a human operator, a script, or another agent. This is the mechanical basis for any system where an agent's skill repertoire evolves during a session rather than between deployments.
This also shifts the risk model. Because the reload path is always open, the attack surface for behavioural mutation is the filesystem itself. The runtime has no described verification or sandboxing layer in the available sources.
Caveats
The sources for this article are changelog-derived only. The following are not confirmed:
- Whether reload is eager (on file write) or lazy (on next invocation)
- Whether failed skill loads surface errors or silently fall back to the prior definition
- What consistency guarantees exist if a skill is reloaded mid-execution
All structural claims should be treated as design-level descriptions pending runtime verification.
- Skill hot-reload tested
- language setting inconclusive
- Skills visible by default tested
- FORCE_AUTOUPDATE_PLUGINS inconclusive
- 2.1.3 Code-Review Features inconclusive
- CLAUDE_CODE_TMPDIR tested
- Nested Skills Discovery inconclusive
- Status Line Percentage Fields inconclusive
- Customizable Keyboard Shortcuts inconclusive
- showTurnDuration Setting inconclusive
- ${CLAUDE_SESSION_ID} Substitution tested
- plansDirectory Setting inconclusive
- Heredoc Fix tested
- Combo Test: Session-Aware Setup inconclusive
- Combo Test: Subgraph Delegation inconclusive
- fileAGENTIC-ESCALATION-ARC.md
primitive-class_e7232f1d535d80cd5f9e604eed255199b87705613b1e2fd064d57fa75a6b679d2856ceafad6b1daa8f982493871b6dd57b9bc648f2295f7134d89ecf34804b58a043dd7b25f2911f79f7a5200b5fca6bdb07e63967d742b99e733bc6ac19c10c9e8afe29b9526be21e723a927dfe004Signed with an ed25519 key held off the repo. Anyone can verify against the published public key; nobody without the secret key can forge it. Click verify: it recomputes the signature in your browser. The signature proves integrity and authorship of this exact content — not a third-party timestamp or that the underlying claim is objectively true. signedAt is when the @f3/attest pipeline ran, not when the work happened; the evidence refs carry the source dates.