fix(skills): add YAML frontmatter to telos-load + regulatory-risk-assessment

The two new skills shipped without the name/description frontmatter every
other skill carries, so harnesses surfaced them as a bare directory name
with no description to match against intent. Add frontmatter (body unchanged).

Bump-Type: patch

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

SKILLS_INDEX.md

@@ -23,6 +23,8 @@ This index lists all available engineering skills. Load the full SKILL.md on dem
 | `session-retrospective` | Surface non-obvious learnings from a session log | After a coding session ends, before context is lost |
 | `trainer` | Two-phase brain curation (score candidates, write past quality gate) | Periodic brain pruning and curation |
 | `grill-me` | Structured plan interrogation — Quick Poke, Full Grill, Pre-mortem | Stress-testing a plan before committing; end of Diamond 1; before promoting to pre-prod |
+| `telos-load` | Load TELOS intention substrate at session start | Starting any koala session; before architectural decisions; CAD pipeline entry |
+| `regulatory-risk-assessment` | Structured risk register for regulated-industry features | Filing a CAD issue (needs Risk: level); features touching payments, auth, external APIs, user data |
 
 ## Wiring into tools
 
@@ -89,3 +91,5 @@ grill-me ──→ planning (after plan is sharpened)
 | "Grill me / stress-test this / is this ready?" | `grill-me` |
 | "End of Diamond 1 — should we build this?" | `grill-me` (Full Grill) |
 | "About to promote to pre-prod" | `grill-me` (Pre-mortem) |
+| "What are the risks?" / "compliance gate" / "risk register" | `regulatory-risk-assessment` |
+| "Start of session" / "load TELOS" / "what are we optimizing toward?" | `telos-load` |

dream/SKILL.md

@@ -0,0 +1,168 @@
+---
+name: dream
+description: >
+  Run a "dream" — a reflective memory consolidation pass over an agent's memory
+  directory. Use this skill whenever the user says "dream", "run a dream", "consolidate
+  my memory files", "clean up my MEMORY.md", or asks Claude to do a memory maintenance
+  pass, prune stale notes, or reorganize topic files. Also trigger when the user wants
+  to rebuild a memory index, merge duplicate facts, or convert relative dates in notes
+  to absolute ones. This is an agentic, multi-phase workflow — always use this skill
+  rather than improvising the steps.
+---
+
+# Dream — Memory Consolidation Skill
+
+You are performing a **dream**: a reflective, agentic pass over a memory directory.
+Your goal is to synthesize recent signal into durable, well-organized memory so that
+future sessions can orient quickly.
+
+---
+
+## Pre-flight
+
+Before starting, confirm:
+1. **Where is the memory directory?** Ask the user if not obvious from context.  
+   Common locations: `~/memory/`, `~/.agent/memory/`, `./memory/`, a path in an env var like `$MEMORY_DIR`.
+2. **Are there transcripts or daily logs to scan?** Ask if not obvious.
+3. **Any topics to skip or treat as sensitive?**
+
+Once confirmed, proceed through the four phases in order. Narrate each phase briefly as you go.
+
+---
+
+## Phase 1 — Orient
+
+**Goal**: Get a map of what exists before touching anything.
+
+```bash
+ls -la <memory_dir>/
+cat <memory_dir>/MEMORY.md
+```
+
+For each file listed (excluding MEMORY.md):
+- Read or skim it (first 40–60 lines is usually enough unless it's small).
+- Note: topic, approximate recency, any obvious staleness or duplication.
+
+Build a mental inventory:
+- Files present, rough line counts
+- Topics covered
+- Any files that look abandoned, mislabeled, or overlapping
+
+---
+
+## Phase 2 — Gather Recent Signal
+
+**Goal**: Find new facts, corrections, and drift since the last dream.
+
+Check in this order:
+
+1. **Daily logs** — read recent entries (last 7–14 days).  
+   Look for: new decisions, changed preferences, completed projects, new relationships/tools.
+
+2. **Drifted facts** — scan existing topic files for statements that may now be false.  
+   Examples: "currently evaluating X" (did they pick one?), "planning to do Y" (done or dropped?), relative dates like "last week" or "recently".
+
+3. **Transcripts** — only grep narrowly if there's a specific gap.  
+   Avoid bulk-reading transcripts; it's slow and noisy. Use targeted patterns:
+   ```bash
+   grep -r "decided\|switched to\|no longer\|now using\|moved to" <transcripts_dir>/ | tail -40
+   ```
+
+Collect a list of **updates to make**: new facts, corrections, removals.
+
+---
+
+## Phase 3 — Consolidate
+
+**Goal**: Apply the updates. Leave memory files cleaner and more accurate than you found them.
+
+For each topic file:
+
+- **Merge duplicates**: if the same fact appears in two files, keep it in the more specific one and remove from the general one.
+- **Convert relative dates**: replace "last week", "recently", "a few months ago" with an absolute date (use the current date as reference; estimate if necessary and note the uncertainty).
+- **Delete contradicted facts**: if a new fact supersedes an old one, remove the old one outright — don't leave both.
+- **Tighten language**: convert vague hedges ("probably uses", "might be") to definite statements where the evidence supports it, or remove if genuinely unknown.
+- **Add new facts** from Phase 2 to the appropriate topic file. Create a new topic file if no good home exists.
+
+After editing files, do a final pass:
+```bash
+grep -n "last week\|recently\|a few months\|soon\|currently planning" <memory_dir>/*.md
+```
+Clean up any remaining relative time references.
+
+---
+
+## Phase 4 — Prune and Index
+
+**Goal**: Rebuild MEMORY.md as a clean, navigable index under 200 lines.
+
+**MEMORY.md structure**:
+```markdown
+# Memory Index
+_Last updated: YYYY-MM-DD_
+
+## Overview
+One short paragraph: who this agent is, primary context, most important standing facts.
+
+## Topic Files
+| File | Contents | Last updated |
+|------|----------|-------------|
+| person.md | Identity, preferences, background | YYYY-MM-DD |
+| projects.md | Active and recent projects | YYYY-MM-DD |
+| tools.md | Stack, infra, dev environment | YYYY-MM-DD |
+| ... | ... | ... |
+
+## Quick Facts
+- Bullet list of the 10–15 most frequently-needed facts (role, location, key tools, etc.)
+
+## Recent Changes
+- Bullet list of what changed in this dream (so the next session knows what's fresh)
+```
+
+Rules:
+- Remove any pointers to files that no longer exist.
+- Add pointers for any new files created in Phase 3.
+- Keep Quick Facts ≤ 15 bullets — this is for speed, not completeness.
+- Recent Changes section replaces itself each dream (don't accumulate).
+- Total MEMORY.md length: **200 lines max**.
+
+---
+
+## Output
+
+After completing all four phases, return a **dream summary** to the user:
+
+```
+## Dream complete — YYYY-MM-DD
+
+### What changed
+- [file]: [what was updated]
+- MEMORY.md: rebuilt index, N topic files indexed
+
+### Facts added
+- ...
+
+### Facts removed / corrected
+- ...
+
+### Files created
+- ...
+
+### Files deleted or merged
+- ...
+
+### Still uncertain / needs follow-up
+- ...
+```
+
+Keep it concise — a few bullets per section, not exhaustive diffs. The goal is for the user to quickly confirm the dream went well and catch any mistakes.
+
+---
+
+## Tips and Edge Cases
+
+- **No MEMORY.md exists yet**: create one from scratch using the structure above. Treat all existing files as "first time indexed".
+- **Memory dir is empty**: create MEMORY.md and a starter `scratch.md` noting the date and that the memory system is new.
+- **Conflicting facts with no clear resolution**: note both in the file with a date stamp and flag in "Still uncertain" section of the summary.
+- **Large transcript dumps**: resist reading them in full. Grep is your friend. If you must read, read the last N lines only.
+- **Files with sensitive content**: if the user flagged topics to skip, skip them entirely — don't even open them.

regulatory-risk-assessment/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: regulatory-risk-assessment
+description: Produce a structured regulatory risk assessment / risk-register entry for regulated-industry features (banking, payments, PSD2/PSR, DORA, AML). Use when filing a CAD issue that needs a Risk:LOW/MEDIUM/HIGH level, or designing features touching payments, auth, data storage, or external APIs ("what are the risks?", "compliance gate", "risk register").
+---
+
+# regulatory-risk-assessment
+
+Produce a structured regulatory risk assessment for a feature, component,
+or integration — generating a risk register entry that satisfies the
+audit requirements of regulated-industry clients (banking, finance,
+insurance, PSD2/PSR, DORA, AML/KYC contexts).
+
+**Use when:**
+- Filing a Gitea issue dispatched via CAD (needs Risk: LOW/MEDIUM/HIGH)
+- Designing a feature touching payments, auth, data storage, external APIs
+- Preparing a client deliverable in a regulated industry
+- "what are the risks?" / "compliance gate" / "risk register" in session
+
+**Do not use for:** routine refactoring, docs-only changes, internal
+tooling with no external data or user impact.
+
+## What this skill produces
+
+A docs/risk-register.md section with this schema:
+
+  ### R-[DOMAIN]-[NN] — [Short risk title]
+
+  | Field | Value |
+  |-------|-------|
+  | Risk | What could go wrong (concrete, specific) |
+  | Regulatory reference | Which obligation/regulation, if any |
+  | Likelihood | H / M / L |
+  | Impact | H / M / L |
+  | Overall | H / M / L (highest of likelihood x impact) |
+  | Mitigation | What we are doing about it |
+  | Validation | Test name or Gitea issue number |
+  | Status | open / mitigated / accepted |
+
+Risk ID namespace:
+  R-AUTH-NN  authentication and authorization
+  R-DATA-NN  data storage, retention, privacy
+  R-API-NN   external API integration
+  R-PAY-NN   payment and financial transactions
+  R-INFRA-NN infrastructure and availability
+  R-AGENT-NN agentic / AI execution
+  R-COMP-NN  compliance and regulatory obligation
+
+## Mechanics
+
+Step 1 — Scope the assessment
+  1. What external systems does this touch?
+  2. What user data does it read, write, or transmit?
+  3. What happens on silent failure? Loud failure?
+  4. What is the blast radius of a worst-case bug?
+  5. Is a regulation implicated?
+
+Step 2 — Enumerate risks (common examples)
+  Auth/OAuth: token theft, refresh failure, insufficient scope
+  Email/Gmail: misclassification archives HUMAN thread, PII in logs
+  Payment/PAIN.001: wrong amount, duplicate submission, missing field
+  Agentic: irreversible action without approval, prompt injection, spirals
+  Infra: single point of failure, secret in logs
+
+Step 3 — Declare overall risk level
+  Highest individual risk = feature overall level (LOW/MEDIUM/HIGH).
+  This is the **Risk:** declaration in the CAD agent-ready issue contract.
+
+Step 4 — Write validations
+  Every mitigation needs a validation:
+    - Specific test name (TestXxx)
+    - Gitea issue number
+    - Manual verification step with acceptance criteria
+  Not acceptable: "will test later", "review manually"
+
+Step 5 — Update docs/risk-register.md
+  Append entries. Create if absent:
+
+    # Risk Register
+    All entries follow R-[DOMAIN]-[NN] schema.
+    See skills/regulatory-risk-assessment/SKILL.md for conventions.
+    Last updated: [date]
+
+## Integration with assessor-loop
+
+For complex regulated-industry features (PSD2/PSR, DORA, AML), route to
+mathias/assessor-loop for deep obligation decomposition first.
+Use this skill standalone for internal tooling or general engineering risk.
+
+## Integration with CAD
+
+Every CAD-dispatched issue must include:
+  **Risk:** LOW | MEDIUM | HIGH
+
+CAD pre-flight (agentsquad#29) rejects issues without it.
+If genuinely no risks: declare LOW and note why.
+
+## Example entry
+
+  ### R-DATA-01 — Email misclassification archives a HUMAN thread
+
+  | Field | Value |
+  |-------|-------|
+  | Risk | LLM labels a real person's email as NOISE, causing auto-archive |
+  | Regulatory reference | None (internal) |
+  | Likelihood | M |
+  | Impact | H |
+  | Overall | H |
+  | Mitigation | Phase 1 read-only; HUMAN class never auto-archived in any phase |
+  | Validation | TestClassifier_HumanThreadNeverArchived; 1-week Phase 1 review |
+  | Status | open |

telos-load/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: telos-load
+description: Load TELOS — the intention substrate (problems, goals, strategies, status) — into a session at start so every decision traces to a goal. Use when starting any koala session, before architectural decisions, or as the CAD pipeline entry point ("load TELOS", "what are we optimizing toward?").
+---
+
+# telos-load
+
+Load TELOS — the intention substrate — into a session so every decision
+can be traced back to a goal, and every goal to a problem.
+
+**Use when:** starting any session on koala (Claude Code, Crush,
+Antigravity), or whenever a session needs to know what we are optimizing
+toward. If you find yourself making architectural decisions without knowing
+the active goals, load TELOS first.
+
+**Do not skip:** a session without TELOS context is flying blind. It may
+produce technically correct output that is strategically wrong.
+
+## What TELOS is
+
+TELOS is a wing in brain (wiki/telos/decisions/) containing 9 files:
+PROBLEMS, MISSION, GOALS, CHALLENGES, PROJECTS, STRATEGIES, BELIEFS,
+WRONG, STATUS. Together they answer: what are we working against, what
+are we trying to build, and how do we approach the work?
+
+Full aggregate: wiki/telos/decisions/principal-telos.md
+
+## Loading TELOS by harness
+
+### Claude Code (per-project CLAUDE.md)
+
+Add to the project CLAUDE.md or ~/.claude/CLAUDE.md:
+
+  ## Intention context (TELOS)
+  At session start, call brain_context with wing=telos and limit=8.
+  Fallback if brain MCP unavailable:
+  wiki/telos/decisions/principal-telos.md in the brain repo.
+
+The global ~/.claude/CLAUDE.md was wired on koala on 2026-06-16.
+
+### Crush
+
+Location on koala: ~/.config/crush/CRUSH.md (auto-loaded via
+global_context_paths). Add:
+
+  ## Intention context (TELOS)
+  At session start: query brain MCP with wing=telos, limit=8.
+  If brain MCP unavailable: read wiki/telos/decisions/principal-telos.md
+
+### Antigravity
+
+Add @brain_context wing=telos directive at top of system instructions.
+
+### Fallback — no brain MCP
+
+  cat ~/dev/AI/brain/wiki/telos/decisions/principal-telos.md
+
+Or @-import in CLAUDE.md:
+  @~/dev/AI/brain/wiki/telos/decisions/principal-telos.md
+
+## Verification
+
+  brain_query wing=telos limit=3
+  → Expected: PROBLEMS, MISSION, GOALS returned
+
+  brain_answer "what am I currently optimizing toward?"
+  → Expected: non-empty, telos-sourced
+  → If empty: use brain_query wing=telos (known fallback, brain#11 fixed)
+
+## When TELOS is stale
+
+Update STATUS.md via:
+  brain_write wing=telos hall=decisions filename=STATUS
+
+## Relationship to CAD
+
+TELOS is the intention layer in the CAD pipeline. Every Gitea issue
+created in a CAD session should trace to a TELOS GOAL. Every GOAL
+traces to a PROBLEM.
+
+Traceability chain: PROBLEM → GOAL → SPEC → TICKET → IMPL → TEST