feat(#235): 删除 downstream skill-degradation runtime watch(共识 A) (#240)

design-consensus r5 3/3 unanimous(framing A):删 downstream/plugin-installed host 的 skill-degradation runtime watch(concurrency.py hook + peek lens + host.env 三旋钮 + runtime-exceptions #66 mirror + SKILL.md 改写 + degradation.py runtime markers),保留 source-repo static checker + CI skill-degradation job + release gate required check。
根因:degradation.py 单一 repo_root 把 downstream host root 当 source repo root,plugin-installed host 必误报。
targeted: test_concurrency_monitor test_check_skill_degradation test_peek_status_lens test_host_env_surface_matrix test_package_checks test_runtime_exception_authorization_sources = 71 OK.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: loning

skills/codex-refactor-loop/SKILL.md

@@ -80,9 +80,6 @@ This matrix is the only manually maintained host.env contract. `host.env.example
 | `$RELEASE_ROLLUP_COOLDOWN_SECONDS` | defaulted | sync helpers | `21600` | default to `21600` seconds before duplicate release-rollup event for the same integration SHA | sync helpers | `test_sync_dev.py` |
 | `$CI_GUARDS` | optional-noop | prompt templates | empty or host guard script | empty skips with reported noop reason `guards skipped: CI_GUARDS unset` | prompt templates | `test_skill_entrypoint_contract.py` |
 | `$CODEX_FLOOR` | defaulted | concurrency floor | `5` | missing or invalid defaults to `5`; values below hard min `2` clamp to `2` | concurrency monitor, wakeup plan | `test_concurrency_monitor.py`, `test_wakeup_plan.py` |
-| `$DEGRADATION_WATCH_INTERVAL_SECONDS` | defaulted | degradation watch | `1800` | missing or invalid defaults to `1800`; `0` disables runtime hook | concurrency monitor | `test_concurrency_monitor.py`, `test_check_skill_degradation.py` |
-| `$DEGRADATION_WATCH_TIMEOUT_SECONDS` | defaulted | degradation watch | `30` | missing or invalid defaults to `30`; values below `1` clamp to `1` | concurrency monitor | `test_concurrency_monitor.py`, `test_check_skill_degradation.py` |
-| `$DEGRADATION_ALERT_TAIL_LINES` | defaulted | degradation watch | `10` | missing defaults to `10` alert tail lines for degradation status surfaces | peek, degradation check | `test_check_skill_degradation.py`, `test_peek_status_lens.py` |
 | `$SOURCE_GLOBS` | optional-noop | review prompts | host source glob hints | empty means review from actual diff and project evidence; do not invent host source layout | review prompts | `test_host_env_surface_matrix.py` |
 | `$MAINTAINER_WHITELIST` | conditional-fail-closed | comment-monitor | host GitHub handles | optional for hosts without comment-monitor/direct-mention intake; when that surface runs, empty fails closed | comment-monitor | `test_comment_monitor.py` |
 | `$HOST_TEST_FILE_GLOBS` | prompt-empty-infer | prompt templates | empty | infer from existing tests; fail closed if unsafe to locate writable tests | prompt templates | `test_host_env_surface_matrix.py` |
@@ -226,7 +223,8 @@ Authorization source: `skills/codex-refactor-loop/authorizations/runtime-excepti
 Authorization mirror: `skills/codex-refactor-loop/authorizations/runtime-exceptions.md#integration-sync-release-rollup-65`. It records the existing-review-base pending-event boundary. **Narrow allowlist**: release-rollup detection and existing-format pending-event emission only; event facts include `integration_branch`, `review_base_branch`, `integration_sha`, `review_base_sha`, `ahead_count`, `detected_at`, and `reason`.
 **No lifecycle authority**: the daemon must not run `gh pr create`; it must not create PRs, edit PRs, label PRs, close PRs, approve PRs, merge PRs, or push directly to `$REVIEW_BASE_BRANCH`. Controller pending-event sweep re-checks open head/base PRs, writes the Chinese PR body, and calls `open_release_rollup_pr_from_pending_event`, which first pushes a throwaway `rollup/<integration_sha>` head and then delegates to `open_pr_with_label`; the rollup PR head must not be `$INTEGRATION_BRANCH` itself. Behavior/source-regression tests cover event emission, suppression, cooldown, missing integration ref alerts, throwaway rollup heads, and forbidden daemon lifecycle tokens.
 
-## Named runtime exception — skill degradation watch(per #66) — Authorization source: `skills/codex-refactor-loop/authorizations/runtime-exceptions.md#skill-degradation-watch-66`. Single-file checker/gates: `consensus-rnd-cli check-degradation`; CI required `skill-degradation` runs `<skill-root>/scripts/consensus-rnd-cli check-degradation --static`; `consensus-rnd-cli release-gate` requires it beside `contract-tests` and `manifest-version-sync`. **Narrow allowlist**: run `consensus-rnd-cli check-degradation`; write `.refactor-loop/.degradation-alert.log`; append existing-format pending events to `.refactor-loop/.controller-pending-events.log`; expose read-only `consensus-rnd-cli peek` status. **Forbidden actions**: no source mutation; no git reset/rebase/merge/push; no GitHub issue/PR/body/label lifecycle mutation; no codex dispatch; no standalone daemon creation; no WorkUnit/schema/envelope changes; no protocol/plugin registry; no auto-clean root garbage; no auto-fix API. Runtime hook: `consensus-rnd-cli concurrency` may run the checker on `$DEGRADATION_WATCH_INTERVAL_SECONDS`; failures alert-only, passing writes nothing, and the hook must not mutate source, run git, call GitHub lifecycle APIs, spawn codex, create a daemon, or change WorkUnit/event schema; details: [skill degradation watch details](#skill-degradation-watch-details).
+## Skill degradation source-repo validation
+`skill-degradation` is source-repo CI/release validation, not downstream host runtime authority. Source validation runs through `consensus-rnd-cli check-degradation --static`; CI required `skill-degradation` runs `<skill-root>/scripts/consensus-rnd-cli check-degradation --static`; `consensus-rnd-cli release-gate` requires it beside `contract-tests` and `manifest-version-sync`. A downstream host has no runtime watch, no alert log, no pending event, no peek lens, and no host.env knobs for skill-degradation. **Forbidden actions**: no source mutation; no git reset/rebase/merge/push; no GitHub issue/PR/body/label lifecycle mutation; no codex dispatch; no standalone daemon creation; no WorkUnit/schema/envelope changes; no protocol/plugin registry; no auto-clean root garbage; no auto-fix API. Details: [skill degradation source-repo validation details](#skill-degradation-source-repo-validation-details).
 
 ## Claude Code statusline(per #51 consensus)
 `skills/codex-refactor-loop/scripts/consensus-rnd-cli statusline` 是 fast (<200ms) read-only Claude Code statusline reader,显示本仓库 loop 实时状态(codex 计数、PR/issue 数、daemon 健康、P0 streak、freeze 指示)。
@@ -998,13 +996,12 @@ Semver bump is computed from `.refactor-loop/state/release-commits.json` entries
 
 dogfood 运行中固化的操作经验。host 注入的配置集中放 `$REPO_ROOT/.refactor-loop/host.env`(`export REPO_ROOT/GH_REPO_SLUG/INTEGRATION_BRANCH/REVIEW_BASE_BRANCH/BUILD_CMD/TEST_CMD/CI_GUARDS/SOURCE_GLOBS/MAINTAINER_WHITELIST` 等)。
 
-<a id="skill-degradation-watch-details"></a>
-### Skill degradation watch details
-The skill degradation watch(per #66) is authorized by `skills/codex-refactor-loop/authorizations/runtime-exceptions.md#skill-degradation-watch-66` and is intentionally delete-framed: no standalone watchdog, no seventh daemon, no `DegradationCheck` protocol, no plugin registry, no new event envelope, no auto-clean, no auto-fix, no GitHub lifecycle mutation, and no codex dispatch path.
-Static checker: `python3 skills/codex-refactor-loop/scripts/consensus-rnd-cli check-degradation --static`; CI job `.github/workflows/consensus-rnd-ci.yml` `skill-degradation`; release gate `consensus-rnd-cli release-gate:required_checks_recent_green` requires `skill-degradation` beside `contract-tests` and `manifest-version-sync`, mirrored by `release.yml`. The checker is read-only and returns nonzero on missing named exception text, CI/release wiring, forbidden runtime files, forbidden expansion surfaces, or missing runtime hook markers.
-Runtime hook: existing `consensus-rnd-cli concurrency`, no standalone daemon. `$DEGRADATION_WATCH_INTERVAL_SECONDS` controls throttle; unset or `0` disables and `host.env.example` opts in with `1800`. `$DEGRADATION_WATCH_TIMEOUT_SECONDS` defaults to `30`. Passing writes nothing; failing writes `.refactor-loop/.degradation-alert.log` and appends an existing-format pending event to `.refactor-loop/.controller-pending-events.log`.
-Alert formats: pending event `<UTC> skill-degradation-alert returncode=N log=.refactor-loop/.degradation-alert.log` or `<UTC> skill-degradation-alert checker-error log=.refactor-loop/.degradation-alert.log`; alert log `[UTC] skill-degradation-alert <summary> | detail=<json>` with `returncode`, `stdout_tail`, `stderr_tail`, or `error`. `DEGRADATION_ALERT_TAIL_LINES` controls `consensus-rnd-cli peek` display count for `.refactor-loop/.degradation-alert.log`, default `10`.
-Narrow allowlist: run `consensus-rnd-cli check-degradation`, write `.refactor-loop/.degradation-alert.log`, append existing-format pending events, and expose read-only `consensus-rnd-cli peek` status. Forbidden: no source mutation, git operations, GitHub issue/PR/body/label lifecycle mutation, codex dispatch, standalone daemon creation, WorkUnit/schema/envelope changes, protocol/plugin registry, auto-clean root garbage, and auto-fix API.
+<a id="skill-degradation-source-repo-validation-details"></a>
+### Skill degradation source-repo validation details
+The skill-degradation checker is intentionally source-repo scoped: no standalone watchdog, no seventh daemon, no `DegradationCheck` protocol, no plugin registry, no new event envelope, no auto-clean, no auto-fix, no GitHub lifecycle mutation, and no codex dispatch path.
+Static checker: `python3 skills/codex-refactor-loop/scripts/consensus-rnd-cli check-degradation --static`; CI job `.github/workflows/consensus-rnd-ci.yml` `skill-degradation`; release gate `consensus-rnd-cli release-gate:required_checks_recent_green` requires `skill-degradation` beside `contract-tests` and `manifest-version-sync`, mirrored by `release.yml`. The checker is read-only and returns nonzero on missing source-repo validation text, CI/release wiring, forbidden runtime files, forbidden expansion surfaces, or downstream runtime watch markers.
+Downstream plugin-installed hosts have no skill-degradation runtime watch, no degradation alert log, no degradation pending event, no degradation peek lens, and no degradation host.env knobs. `consensus-rnd-cli concurrency` must not invoke `check-degradation` as a runtime watch against a host repo root.
+Forbidden: no source mutation, git operations, GitHub issue/PR/body/label lifecycle mutation, codex dispatch, standalone daemon creation, WorkUnit/schema/envelope changes, protocol/plugin registry, auto-clean root garbage, and auto-fix API.
 ### Worktree 位置约定(强制)
 
 所有 daemon/codex/implement worktree 都在 `$REPO_ROOT/.worktrees/` 内,路径形如 `$REPO_ROOT/.worktrees/<name>/`。仓库根 `.gitignore` 必须包含 `/.worktrees/`,因此这些运行时 worktree 不进入发布产物。旧 sibling pattern `<repo>-wt-<name>/` 只作为历史兼容/清理线索出现,不得作为新 worktree 创建位置。

skills/codex-refactor-loop/authorizations/runtime-exceptions.md

@@ -72,19 +72,6 @@ schema, or source of new authority. The executable contract remains in
 - verification: `test_sync_dev.py`, `test_runtime_exception_authorization_sources.py`
 - no_new_runtime_authority: This mirror only replaces the missing ignored judge-log authorization path.
 
-<a id="skill-degradation-watch-66"></a>
-## skill-degradation-watch-66
-
-- surface: `skill degradation watch`
-- source_issue: `#66`
-- source_round: `r8`
-- source_marker: `META_JUDGE_DONE:consensus`
-- skill_anchor: `#named-runtime-exception--skill-degradation-watchper-66`
-- allowed: run `consensus-rnd-cli check-degradation`; write `.refactor-loop/.degradation-alert.log`; append existing-format pending events; expose read-only `consensus-rnd-cli peek` status.
-- forbidden: no source mutation, git reset, rebase, merge, push, GitHub issue lifecycle, PR lifecycle, body lifecycle, label lifecycle, codex dispatch, standalone daemon creation, WorkUnit schema changes, event envelope changes, protocol registry, plugin registry, auto-clean, or auto-fix API.
-- verification: `test_check_skill_degradation.py`, `test_package_checks.py`, `test_runtime_exception_authorization_sources.py`
-- no_new_runtime_authority: This mirror only replaces the missing ignored judge-log authorization path.
-
 <a id="statusline-51"></a>
 ## statusline-51
 

skills/codex-refactor-loop/host.env.example

@@ -69,15 +69,6 @@ export RELEASE_ROLLUP_COOLDOWN_SECONDS="21600"
 # Default: concurrency floor; unset means 5 and values below 2 are clamped to 2.
 export CODEX_FLOOR="5"
 
-# Default: degradation watch interval; 0 disables runtime hook, CI still checks.
-export DEGRADATION_WATCH_INTERVAL_SECONDS="1800"
-
-# Default: degradation checker timeout in seconds.
-export DEGRADATION_WATCH_TIMEOUT_SECONDS="30"
-
-# Default: degradation alert tail lines to include from .refactor-loop/.degradation-alert.log.
-export DEGRADATION_ALERT_TAIL_LINES="10"
-
 # ─── optional-empty-or-noop / compatibility / conditional-fail-closed ─
 
 # Compatibility/noop: owner used only when GH_REPO_SLUG is absent.