# Nacl Goal

> |

- **Type:** Skill
- **Install:** `agentstack add skill-itsalt-nacl-nacl-goal`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ITSalt](https://agentstack.voostack.com/s/itsalt)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ITSalt](https://github.com/ITSalt)
- **Source:** https://github.com/ITSalt/NaCl/tree/main/nacl-goal

## Install

```sh
agentstack add skill-itsalt-nacl-nacl-goal
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

## Contract

**Inputs this skill consumes:**

- `` — required positional. One of the named aliases from `nacl-goal/aliases.md`
  (`wave:`, `fix:`, `validate:`, `reopened-drain`, `intake`, `conduct`,
  `custom`), or the special invocations `resume` and `abort `.
- `--start` — optional flag. Without it the **preview-mode aliases** (`wave`, `fix`,
  `validate`, `reopened-drain`, `custom`) run in preview/dry-run mode only. The
  `intake` alias has the inverse default: autonomy ON, with `--plan-only` as the
  opt-out (see §`intake` alias UX below).
- `--tier=` — optional override for `custom` alias (mandatory for custom).
- `--check-script=` — path to executable check script for `custom` alias (mandatory for custom).
- `--description=""` — optional label recorded in the run file.
- `intake`-only opt-out flags: `--plan-only`, `--strict`, `--target=`, `--new-run`. See §`intake` alias UX.

**Outputs this skill produces:**

- Without `--start`: a preview block containing the full resolution: alias, tier, soft budget,
  check_script path, GOAL_PROOF template, human gates, permissions denylist, and (for Tier L/XL)
  estimated dollar cost from `nacl-goal/pricing.json`. The exact `--start` command to copy-paste.
- With `--start` (2.10.0, Tier S/M): a warning that autonomous execution is 2.10.1 functionality,
  then issues `/goal` with the composed condition. Does NOT produce a `.tl/goal-runs/` file in 2.10.0.
- With `--start` (2.10.0, Tier L/XL): structured refusal `REFUSE_TIER_NOT_YET_ENABLED`.
- Refusal block (any tier, any phase) when a Tier-C gate is detected statically.

**Downstream consumers of this output:**

- Human user (preview, refusal, run summary)
- `.tl/goal-runs/` — run files written on `--start` (enforced from 2.10.1)

---

## Two-phase invocation (Architecture §2)

`/goal` starts a turn immediately on invocation. The preview/confirm UX lives
outside `/goal`, in this wrapper:

```
/nacl-goal             # preview only — no /goal issued, no turn consumed
/nacl-goal  --start    # issues /goal with composed GOAL_PROOF condition
```

### Preview output must include all of:

1. Resolved alias name and canonical form
2. Tier and full soft budget (turns, hours, observed token target) from the tier table below
3. `check_script` path and how it is invoked each turn
4. Completion condition verbatim (including the GOAL_PROOF instruction block)
5. Human gates that would block this alias (or `"none detected"`)
6. Permissions denylist that will be enforced
7. For Tier L/XL: estimated dollar cost at current model pricing from `nacl-goal/pricing.json`
8. The exact `--start` command to copy-paste

### --start behavior in 2.10.0

- **Tier S / Tier M:** Issues `/goal` with the composed GOAL_PROOF condition, but emits this
  warning before doing so:

  ```
  WARNING (2.10.0): Autonomous execution via /nacl-goal --start is 2.10.1 functionality.
  In 2.10.0, /goal is issued but .tl/goal-runs/ write, concurrent-execution lock,
  crash/resume, and runtime gate detector are NOT active. Run interactively and monitor.
  ```

- **Tier L / Tier XL:** Refuses with `REFUSE_TIER_NOT_YET_ENABLED`:

  ```
  REFUSE_TIER_NOT_YET_ENABLED
  Tier L and XL autonomous execution is not enabled in 2.10.0.
  Use /nacl-goal  (preview) to inspect the plan.
  Autonomous Tier L/XL arrives in 2.10.1.
  ```

---

## Tier table — v0 calibration defaults (Architecture §13)

All three columns are soft. `/goal` cannot hard-enforce them. A true hard cap
requires an external runner or Stop-hook script (future work, 2.10.2+).
Do not run XL unattended overnight in 2.10.0 or 2.10.1.

| Tier | turns_soft | wall_clock_soft | observed_token_target |
|------|------------|-----------------|----------------------|
| S    | 150        | 2 h             | 3,000,000            |
| M    | 500        | 6 h             | 8,000,000            |
| L    | 1,200      | 16 h            | 20,000,000           |
| XL   | 3,000      | 36 h            | 50,000,000           |

Turn and wall-clock are surfaced through GOAL_PROOF every turn and trigger
`GOAL_BUDGET_EXHAUSTED` via the in-condition instruction. To be calibrated in
2.10.2 from aggregated `.tl/goal-runs/`.

---

## GOAL_PROOF protocol (Architecture §1)

Every alias generates a `/goal` condition that instructs the primary session
to run the alias check script at the end of every turn and print a block of
this exact shape immediately after the raw command output:

```
GOAL_PROOF
alias: 
tier: 
check_command: 
result: GOAL_OK | GOAL_NOT_OK | GOAL_BLOCKED | GOAL_BUDGET_EXHAUSTED
evidence:
  - : 
  - : 
turns_so_far: 
observed_tokens: 
elapsed: 
END_GOAL_PROOF
```

The evaluator (Haiku 4.5 by default) is transcript-only — it cannot run
tools, read files, or execute commands. GOAL_PROOF surfaces machine-checkable
state into the transcript so the evaluator's only job is: "did the last block
have result == GOAL_OK AND does .tl/goal-runs/.md exist."

This block is a wire format. Field renames and delimiter changes are major
version bumps. No narrative is permitted between the command output and the
GOAL_PROOF block. See `docs/guides/goal-proof-protocol.md` for full schema,
semantics, and examples.

---

## Alias resolution and check scripts (Architecture §3)

Aliases and their binding contracts are defined in `nacl-goal/aliases.md`.
Do not duplicate alias definitions here — reference that file.

Check scripts shipped in 2.10.0 (stubs; truth-source wiring in progress):

```
nacl-goal/checks/wave.sh             
nacl-goal/checks/fix.sh              
nacl-goal/checks/validate.sh         
nacl-goal/checks/reopened-drain.sh
```

Check scripts shipped in 2.10.1 (`intake` ships in PR1; the others remain deferred):

```
nacl-goal/checks/intake.sh           --run-id      # ✅ PR1
nacl-goal/checks/stubs-cleanup.sh                       # deferred
nacl-goal/checks/migrate-canary.sh                              # deferred
nacl-goal/checks/feature.sh                             # deferred
nacl-goal/checks/probe-stop-signals.sh   (invoked each turn)    # deferred
```

Check script shipped in 2.18.0 (`conduct` multi-cluster orchestrator):

```
nacl-goal/checks/conduct.sh          --run-id      # ✅ scans clusters/*/
```

Every check script:

- Takes its positional args per the contract in `nacl-goal/aliases.md`
- Reads its truth source directly (graph via Cypher, registry file, YouGile API, test runner)
- Prints stable, grep-friendly output followed immediately by a GOAL_PROOF block
- Always exits 0 — the evaluator cannot see exit codes; GOAL_PROOF carries the actual status

---

## Structured refusal flow (Architecture §5)

Tier-C refusals fire at preview time wherever statically possible (by alias identity).
The runtime gate detector catches dynamic crossings (2.10.1).

Every refusal must:

1. Name the specific gate by its `REFUSE_*` code from `nacl-goal/refusal-catalog.md`
2. Cross-reference `nacl-tl-core/references/gate-fire-catalog.md`
3. Offer a split-mode suggestion (interactive skill then wrapper)
4. Print copy-paste commands for the interactive path

User-facing rendering follows the rendering rule in `nacl-goal/refusal-catalog.md`:
lead with the plain-language reason + copy-paste fallback; the gate code is a
trailing tag, not the headline; and step numbers / `Tier-C` never appear in
user-facing text. (Items 1–2 above are satisfied by the trailing tag and the
internal cross-reference — they are not the headline.)

Refusal codes (full catalog in `nacl-goal/refusal-catalog.md`):

```
REFUSE_HUMAN_GATE_BA_SA_HANDOFF
REFUSE_HUMAN_GATE_SA_PHASE_CONFIRMATION
REFUSE_HOTFIX_JUDGMENT
REFUSE_POST_CANARY_RETROSPECTIVE
REFUSE_PRODUCTION_MUTATION
REFUSE_UNTIERED_CUSTOM_GOAL
REFUSE_UNTRUSTED_WORKSPACE
REFUSE_HOOKS_DISABLED
REFUSE_CONCURRENT_GOAL_LOCKED
REFUSE_DANGEROUSLY_SKIP_PERMISSIONS
REFUSE_TIER_NOT_YET_ENABLED
```

Refusal codes are part of the wire format. Renaming or removing a code is a
major version bump for `/nacl-goal`.

---

## Permissions denylist (Architecture §6)

`/nacl-goal` runs only in default permissions with explicit approvals, OR in
auto mode with the NaCl allowlist active.

Full text in `docs/guides/goal-permissions.md`. Brief summary:

**Never allowed under any alias:**

- `--dangerously-skip-permissions` (triggers `REFUSE_DANGEROUSLY_SKIP_PERMISSIONS`)
- Any mode that disables hooks (triggers `REFUSE_HOOKS_DISABLED`)
- Any workspace where workspace trust is not granted (`REFUSE_UNTRUSTED_WORKSPACE`)
- `git push` to any remote
- `git merge` into `main`, `master`, or `release/*`
- Any release-publishing action (`npm publish`, `gh release create`, etc.)
- Production DB migrations
- `rm -rf` outside the current workspace
- Editing `.env*`, secrets, credentials, `.ssh/`, `~/.aws/`, `~/.config/gh`
- Changing CI/CD configuration or credentials
- Calling third-party paid APIs with side effects beyond test budget

**Per-alias allowlist (positive grants):**

- Local test execution
- Graph reads and writes scoped to current project
- Branch commits
- `gh pr create` (but never `gh pr merge`)
- YouGile column moves within the project board

---

## Custom alias (Architecture §12)

```
/nacl-goal custom \
  --tier=            # mandatory
  --check-script=         # mandatory; must exist, be executable,
                                # and produce GOAL_PROOF-compatible output
  --description=""    # recorded in run file
  --start                       # must be a separate invocation
```

Custom without `--check-script` returns `REFUSE_UNTIERED_CUSTOM_GOAL`.
Custom without `--tier` returns `REFUSE_UNTIERED_CUSTOM_GOAL`.
Custom may not target paths matching the Tier-C catalog in
`nacl-goal/gate-fire-detector.md`.

---

## `intake` alias (2.10.1 — autonomous goal orchestrator)

`intake` is the FIRST alias with `default_mode: autonomous`. Where the four
2.10.0 aliases (`wave`, `fix`, `validate`, `reopened-drain`) require an
explicit `--start` to issue `/goal`, `intake` issues `/goal` by default and
provides opt-outs for previewing or strict mode.

This is intentional UX: `/nacl-goal intake ""` should be the short,
normal invocation. The user shouldn't need to remember internal flags or
gate names to drive a goal autonomously to a staging stand. See
[[feedback-autonomy-default-ux]] for the design rationale.

### `intake` UX

```
/nacl-goal intake ""

Default behavior:
  • autonomous execution is ON
  • standard safe-exception envelope is ON (see nacl-goal/envelope.md)
  • target = staging if config.yaml → deploy.staging.url exists,
            otherwise PLAN_BLOCKED_STAGING_REQUIRED_BUT_MISSING
  • branch_mode = current when invoked from a non-production branch:
            atoms run ON the branch you are standing on, commits stay local,
            ONE push at DELIVER (push_cadence = deferred). The preview prints
            a one-line notice: "Running on your branch ; one push at
            deliver; do not commit to this branch while the run is active."
            From main/master/release/* the production refusal still fires —
            create a working branch first.
  • atoms BUG / TASK / FEATURE_SMALL run on that single branch, one PR
  • atoms FEATURE_HEAVY → PLAN_BLOCKED with planning artifacts (no silent split)
  • uncommitted changes (another agent's WIP) do NOT refuse the run in
    branch_mode=current — see Flow step 3 "Smart WIP" for the
    file-overlap protocol

Opt-outs (each disables a slice of the default):
  --plan-only        write planning artifacts only; no /goal, no branch, no PR,
                     no exception YAML, no source-code changes
  --strict           disable default safe-exception envelope; pre-flight refuses
                     if plan predicts a gate would need envelope auto-authorization
                     (PLAN_BLOCKED_STRICT_REQUIRES_INTERACTIVE_FLOW)
  --branch=current   run on the currently checked-out branch (default when on a
                     non-production branch)
  --branch=new       pre-2.14 behavior: create feature/goal-; requires
                     a clean worktree (PLAN_BLOCKED_DIRTY_WORKTREE applies)
  --push=deferred    atoms commit locally; single push at DELIVER (default when
                     branch_mode=current)
  --push=per-atom    push after every atom; PR opens on first push (default when
                     branch_mode=new — pre-2.14 behavior)
  --push=none        no push at all; run ends with local commits; ONLY valid with
                     --target=dev-only (with staging it is a usage error rejected
                     at argument parsing, before step 0 — no artifacts written);
                     deliver later with /nacl-tl-deliver
  --target=staging   require staging (default)
  --target=dev-only  local verify + PR only; final message MUST NOT claim staging
                     delivery; dev_verified is asserted via local /nacl-tl-verify
  --new-run          force fresh run-id even if goal_fingerprint matches an existing
                     run; does NOT close or reuse prior PR in 2.10.1
  --budget= optional budget override (default Tier M: 200 turns / 3h / 4M tokens)

Backward-compat invariant: `--branch=new` reproduces the pre-2.14 flow
byte-for-byte (new goal branch, per-atom pushes, dirty-worktree refusal).
The default changed ONLY for invocations from an existing feature branch.
```

### `intake` Flow (14 steps)

The Claude session running `/nacl-goal intake` executes the following flow.
For per-file schemas see `nacl-goal/plan-lock-schema.md`. For artifact
locations and idempotence see `nacl-goal/run-artifacts.md`. For the
exception envelope see `nacl-goal/envelope.md`. For gate prediction see
`nacl-goal/gate-prediction.md`. For retry semantics see
`nacl-goal/retry-policy.md`. For regression diff see
`nacl-goal/regression-schema.md`.

```
0. PRIVACY / IGNORE PRECHECK
   verify .tl/goal-runs/ AND .tl/exceptions/goal-runs/ are gitignored
     (use `git check-ignore` from project_root)
   if either is NOT ignored:
     → PLAN_BLOCKED_GOAL_ARTIFACTS_NOT_GITIGNORED
   The 2.10.1 wrapper does NOT auto-patch .gitignore. The user must do it.
   Writing PII (user email, free-text goal, image refs) into a non-ignored
   directory is irreversible if the user pushes by accident.

1. INIT_RUN
   compute goal_fingerprint (see run-artifacts.md §Goal fingerprint)
   acquire flock on .tl/goal-runs/index.lock (timeout 30s; else
   PLAN_BLOCKED_INDEX_LOCK_BUSY)
   consult index.json per the re-invocation rules in run-artifacts.md
     (RESUME for transient interruptions; refuse for non-resumable terminal
      states unless --new-run)
   run_id = goal-intake--
   mkdir .tl/goal-runs//{atoms/, planning/}
   write request.json, budget.json
   append index.json entry (state: "init", resumable: true)
   atomic rename; release flock

2. RESOLVE_TARGET
   --target=staging or default + deploy.staging.url present → deploy_target = staging
   --target=dev-only                                        → deploy_target = dev-only (WARN)
   else                                                     → PLAN_BLOCKED_STAGING_REQUIRED_BUT_MISSING

3. PRECHECKS  (Tier-C; /goal not yet issued)
   on main/master/release/*    → PLAN_BLOCKED_UNSAFE_PRODUCTION_MUTATION
     (fires regardless of branch_mode; create a working branch first)
   resolve branch_mode / push_cadence:
     --branch absent  → branch_mode = current  (we are on a non-production branch)
     --branch=new     → branch_mode = new
     push_cadence = --push if given, else deferred (current) / per-atom (new)
   Smart WIP (branch_mode=current):
     preexisting_dirty_files[] = paths from `git status --porcelain`
       (including untracked); recorded in plan.lock.json at step 5
     non-empty does NOT refuse — uncommitted files are presumed to be
       another agent's in-flight work in the shared worktree. They are
       never staged, never committed, never reverted by the goal run.
     overlap resolution happens at step 5 (needs classified atoms);
       hard runtime backstop at step 9 (commit-time collision gate)

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ITSalt](https://github.com/ITSalt)
- **Source:** [ITSalt/NaCl](https://github.com/ITSalt/NaCl)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-itsalt-nacl-nacl-goal
- Seller: https://agentstack.voostack.com/s/itsalt
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.