Skillscript

Upgrade impact: none (additive), fully opt-in. No supervisor configured (the default) → nothing changes; the trace stays the pull surface. Configuring one requires scheduler tracing to be on (the CLI dashboard/serve path already sets this) — the runtime hard-refuses at boot otherwise, because the supervisor can't see failures it can't read from the trace.

An interactive execute_skill hands its result to a caller who can see it failed. A cron/event fire has no caller — a 3 a.m. run that errored, or one cut mid-effect leaving a mutation "outcome uncertain," was invisible unless someone went and queried the trace. This adds push: configure a supervisor and the runtime routes those failures to a handler skill you write.

• The trace-sweeper is the scheduler, not a new daemon. On each poll tick, after firing due triggers, the scheduler scans the durable trace for non-clean runs — errors[] non-empty, deadline_exceeded, or a non-empty uncertain_effects — since the last sweep, and routes each to your handler skill. If the scheduler is alive to fire crons, it's alive to sweep. It keys on completion time, so a long unbounded run is caught whenever it finishes — no run-length assumption.
• Detection is reliable; notification is your script. SKILLSCRIPT_SUPERVISOR_SKILL names an approved handler skill; the sweeper only detects + routes, the handler owns policy + delivery (agent, email, Slack, a webhook). Copy examples/skillscripts/supervisor-notify.skill.md, adapt, and approve it. The handler receives the failure as vars (FAILED_SKILL, OUTCOME, TRACE_ID, TRIGGER, ERROR_SUMMARY, UNCERTAIN_EFFECTS, DETECTED_AT_MS, RAN_AS, and SUPERVISOR_AGENT if set — the latter optional, for an agent-routed handler).
• Per-fire dedup + a loop-guard. At most one alert per failed run (a persistent notified-set survives restart). The handler writes its own trace; if it fails, the sweeper does not route that back through itself — it logs to the local stderr floor and stops. No "the notifier failed" loop.
• Config source-of-truth. SKILLSCRIPT_SUPERVISOR_SKILL / SKILLSCRIPT_SUPERVISOR_AGENT are boot-time config (present before the first fire, reachable on a headless host), not a runtime toggle — a safety control shouldn't be silently switchable from a web UI.
• Dashboard health surface. The skills list gains a Health (24h) column flagging a skill errored / uncertain-effect (loudest) / deadline; the skill detail breaks out deadline-cut + uncertain-effect counts. The uncertain-effect signal — "a mutation may have landed, reconcile it" — was previously invisible in the UI.