ADR-214: Approved skill versions instruct, load on demand and run processes 

Status

Accepted (item 10 amended: the API shape and the lineage store; a running process governs sequence and answer structure — see the amendment of 2026-10-22; "keep" is a third denial reason — see the amendment of 2026-10-24; a proposal carries a length only against a configured range — see the amendment of 2026-10-30; the reads beside a question run before a process pauses — see the amendment of 2026-10-31)

Date

2026-10-08

Amended

2026-10-18 by ADR-228; 2026-10-25 by ADR-229 (items 1 and 3: the frontmatter's page is stored and editable like the process marker, but is not part of the version)

Amends

ADR-036 (item 3 and the tail drop of item 5, for skills approved as instructions; item 6: the integrity check compares a version digest over body and frontmatter fields, kept in a new column); ADR-035 (items 4 and 5: change detection compares that version digest, so a frontmatter-only change is a change); ADR-061 (items 1 and 4: the trust level also decides the framing, and backend-authored skills are admitted by their source's level); ADR-038 (item 5: the allow-list is resolved once per run over every effective attached skill); ADR-031 (a caller's system message keeps snippet text an administrator marked, on configurations that opt in); ADR-200 (a denial carries an enumerated reason); ADR-165 (resume also re-reads the invoked skill and intersects the stored allow-list); ADR-169 (section 4: the exclude list grows by the skill and skill-source fields of item 3); ADR-084 (in a run holding a process pin, in a turn that suspends for approval, the turn's non-remote reads that need no approval execute before the suspend and every other call is refused); ADR-105 (in such a run, a turn that pauses for input settles the calls beside the question the same way); ADR-136 (an approval-bound write tool also returns its pending target as structured values next to the preview); ADR-130 (the approve grant does not open a run holding a process pin); ADR-172 (on such a run the four-eyes pin rule is checked before the self-approval refusal and stops the run); ADR-182 (withWriteTarget() takes a completeness, and the write step carries it and a hook-failure flag); ADR-150

Authors

Netresearch DTT GmbH

Approved skill versions may supply instructions, load on demand and pin a process across runs. Approval applies to a version digest over body and frontmatter; a manifest body fingerprint alone is not approval or a publisher signature. Later amendments refine lineage and process precedence.

Use these current guides:

• Approve or revoke a version: Approving a skill version as an instruction.
• Attach and load skills: Attaching skills and injecting them into prompts.
• Start, resume, cancel or end a process: Persisted agent runtime.
• Review write proposals and partial results: Running tools.
• Integrate stored conversations: Stored conversations.

The runtime rechecks the acting user, configuration, skills and tool policy. A process pin does not bypass permissions. Token admission uses a local estimate, not a guarantee that a provider will accept a request. AgentRuntimeInterface::endProcess() explicitly ends a process pin; this is no longer an open product question.

The appendices retain the original context, detailed decisions, amendments and alternatives so that existing section links and reasoning remain usable.