Governance isn't a brake. A read-only research skill runs a whole plan — recall, load governed sources, summarise, remember — at full speed with zero blocks, and every step still lands in the audit chain. When a skill is bounded, the adjudicator has nothing to stop, so the agent just runs — and you still get a receipt for every action. Each “allowed” is computed by the real checkConformance tools/paths logic from kcp-harness, and the run is signed & verified with genuine crypto.subtle.
Press ▶ Run research. The skill declares a read-only action_scope, so every step it plans is already in-bounds — watch it run clean, then read the audit chain. Flip let it try to write to see the one guardrail bite.
Every source you add lands under kcp/knowledge/ — inside the read-only scope. That's the point: within the skill's bounds, more work just means more clean receipts.
Station 10 of 11. Each step's verdict = the real checkConformance tools/paths logic from kcp-harness (verbatim: fail-closed hasScope → tool allowlist → path-prefix with normalizePath/matchesPrefix). A read-only skill's actions all fall inside its declared scope, so all pass — and every one is still checked, stamped, and signed. The write action is the lone out-of-scope tool; when attempted it's held. Run record signed & verified with genuine crypto.subtle.