[tommy-ca]

Scope and base

Stacked on planning PR #878; implement part of #874. Avoid unreviewed wiki-engine migration.

Changes

• In scripts/llm_wiki.py, enforce write-once xb raw-source capture, reject basename conflicts and symlink source/log directories, make exact replay idempotent, enforce local link confinement and schema-config shape, recursively index nested pages, and atomically replace generated index.md.
• Add tests/test_llm_wiki_safety.py with negative controls for conflict, replay, concurrently contested same basename, symlink and link escape, nested pages and CLI error reporting.
• Add bounded real-code state explorer scripts/verify_llm_wiki_model.py with 39 ordered traces plus a deliberate overwrite mutant; tests/test_llm_wiki_bounded_model.py.
• Project-local Codex verify-llm-wiki and verify-llm-wiki-formal skills, feature maps, bounded driver and optional TLA+ model. Wire real CLI drive into offline CI.

Verification truthfulness

New CI must run against the actual PR head and pass before this stack is considered ready. No claims of TLC execution, concurrency proof, SDK/provider-backed compilation, Geronimo runtime or independent multi-model Swarm/Arena/Interrogate evidence. TLA+ model is NOT RUN. Bounded serial traces are not a proof of process/interleaving crash safety. The raw file + human log.md are still two separate writes and cannot be called transactional.

Rollback

Revert this PR; the old PStack wiki data is unchanged and no new mandatory dependency or daemon is introduced. Keep #874 open for independent review, formal checker qualification and remaining safety contracts.

Source-reviewed documentation delta and CI settlement (2026-10-31)

• The stack also reconciles .llm-wiki/WIKI_SCHEMA.md and .llm-wiki/wiki/concepts/llm-wiki-project-knowledge.md to reflect structural-only validation, untrusted optional engines, the write-once CLI boundary and non-transactional human log.
• Exact PR HEAD 0029b35fad97aa19fd67c42f35bd0ff3ec6f15ce: Portable offline CI run 41215096803 SUCCESS. Earlier head 674b2bf: run 41214985678 SUCCESS, with separate inspected wiki step showing 9 passed existing, 11 passed safety, 3 passed bounded tests, 39 traces and detected overwrite mutant; structural skill scaffold PASS.
• CI provides reproducible offline Python evidence only. Formal TLC checked model, hostile-concurrency attack verification, LLM-backed compiler and Geronimo benchmark, authentic multi-model Swarm/Arena/Interrogate and independent Thermos reviewer receipts are not provided. Keep PR DRAFT; follow up [LLM-Wiki-v2][S0] Exact-head inventory, security audit, and schema authority crosswalk #872/[LLM-Wiki-v2][A0] Arena decision: keep vs optional adapters vs migration with pinned corpus #873/[LLM-Wiki-v2][F2] Optional upstream engine adapters: candidate-only parity pilot and fallback #875/[LLM-Wiki-v2][V0] Exact-head Thermos, adversarial review and migration acceptance #877 before final migration approval.