[Hendobox]

Description

Slice 4 of #439: finish the wallet_screening v2 milestone with provenance.report_hash (canonical SHA-256 over the report body) and final docs/test polish. Stays on 2.1.0 per #461 guidance (no version drift).

Acceptance criteria → diff:

• provenance.report_hash + generator via _attach_provenance / verify_report_hash → skills/finance/wallet_screening/skill.py; covered by execute success, offline-direct, Tornado vector, and test_verify_report_hash_detects_tamper
• Catalog Data Schema + limitations + TBD skill-history → docs/skills/finance/wallet_screening.md
• Directive: one-line audit note only (no schema lecture) → instructions.md
• Card fixture includes provenance → tests/fixtures/card_ui_schema/finance__wallet_screening.json
• CHANGELOG [Unreleased] note for slice 4

Closes the #439 milestone after merge (Ross on #461).

Type of Change

• New Skill — new registry bundle under skills/
• Skill Upgrade — changes to an existing skill under skills/
• Bug Fix — incorrect runtime or framework behavior
• Documentation — docs, README, CONTRIBUTING only
• Framework Feature — skillware/core/ loader, env, adapters
• CLI — skillware/cli.py, docs/usage/cli.md
• Examples — examples/*.py, agent loops, examples/README.md
• Packaging — PyPI wheel, pyproject.toml, MANIFEST.in
• RFC / meta — templates, labels, CI, or large design doc

Checklist (all PRs)

• Linked GitHub issue (Fixes #… or Refs #…)
• Scope matches the issue — no unrelated refactors
• Contribution complies with Legal notice and code ownership (original work, MIT license grant, no malicious logic)
• python -m black --check ., flake8, and ruff check . pass locally (or CI-equivalent subset)
• pytest skills/ and pytest tests/ pass locally when relevant
• CHANGELOG.md updated under [Unreleased] when user-visible behavior changes
• examples/README.md updated if this PR adds, renames, or removes a runnable script
• Ran pytest tests/test_registry_docs.py when skills, examples index, or agent-loops matrix changed
• Ran pytest tests/test_skill_docs.py when catalog Usage Examples or provider snippets changed

New or updated skill

Skip unless this PR adds or changes files under skills/.

Bundle and metadata

• Skill at skills/<category>/<skill_name>/ (from templates/python_skill/ or equivalent)
• manifest.yaml: name (full ID), version, description, parameters, constitution, real issuer
• Optional: short_description, issuer.github, issuer.org, requirements, env_vars

Effect, Directive, Assurance

• Deterministic skill.py (Effect; no ad-hoc LLM-generated execution paths)
• instructions.md (Directive) explains when and how to use the skill
• card.json (Presentation) issuer matches manifest when present
• test_skill.py (Assurance) covers execution and schema expectations
• SkillLoader.load_skill("<category>/<skill_name>") succeeds (or deps documented)

Documentation and catalog

• docs/skills/<category>/<skill_name>.md, category hub row, row in docs/skills/README.md, and docs/sitemap.md
• Usage Examples for Gemini, Claude, OpenAI, DeepSeek, Ollama per skill usage template

Constitution and safety (skills only)

Read-only screening. Provenance hash is integrity metadata only — no signing or broadcasting. Hosts should halt on DENY and require a person on REVIEW. Not legal advice.

Related Issues

Fixes #439

[rosspeili]

LGTM @Hendobox. This completes all the remaining of #439 cleanly.
Merging as is and will backfill the tbd commit sha in doc history.