A fifth skill, ktl-prose, rewords a bundle’s agent-written concepts in plain English. It rewords only a body an agent wrote and no person confirmed, and changes no fact and no frontmatter byte, so generated keeps naming the librarian. Its prose-check.py reports dashes, long sentences and stock phrases, and proves a rewording changed only wording. Check 18 exercises it.
docs/wikiskill.md reads the WikiSkill paper (Tang et al., Google Research, 2026) against this design, part by part. The captured docent answers in docs/examples/docent.md now link the concept behind each question, so the link checker fails the build when that concept is renamed or deleted.
knowledge-apply.sh, the librarian’s only pen. ktl-librarian describes each change as one of seven operations in .lokf/patch.yaml (references/patch.md), and the script writes the files. It stamps generated, keeps each description equal to its two index bullets, files the log line, and refuses a human: actor, a rewrite of a person’s text, or the deletion of a confirmed concept. Nothing is written unless every operation passes. Check 19 exercises it.
Changed
ktl-librarian writes in plain English, and offers a plain-prose pass in a live session. A paragraph in its section 1 gives the rules for every body, description and index bullet, so a new concept needs no rewording. Before it opens its pull request in a live session it offers the ktl-prose pass, whose time is before a person confirms. An unattended run skips the offer.
ktl-librarian reads the curator’s verdicts before it derives, and closes the loop on a reader’s miss. It re-derives a sent-back concept from the source the note names. A miss that an existing concept answers is a description defect, fixed in the description and both index bullets, never with a twin. A run handles at most ten feedback entries. Rule 3 reaches a Person or Organization through author or publisher, not source.
Fixed
A concept edited after a person confirmed it is no longer read as confirmed. ktl-docent and the Copilot docent gain the label edited since a person last confirmed it, which the curator and the Obsidian plugins already show. The docent says the edit first, gives both dates, and treats the concept as unconfirmed.
ktl-curator compares the two times of “edited since” whole.references/trust-fields.md told it to cut both to the day first, so a concept confirmed in the morning and rewritten that afternoon did not count as edited. The Obsidian plugins and the SPARQL query already compared whole times.
The skills no longer claim a SHACL check that nothing runs. ktl-librarian, ktl-sidecar and docs/three-lines.md said the bundle was validated with JSON Schema and SHACL. The toolkit generates the shapes and neither ships nor runs them, so the wording now names what runs: lokf validate (JSON Schema) and --check-refs.
Security
The scheduled librarian never writes the bundle itself. The agent’s one output is .lokf/patch.yaml; knowledge-librarian.sh applies it with knowledge-apply.sh and refuses a run that touched any other file, so the refusals above hold in the unattended run and not only in prose. The threat model’s hardening list names it.
