Update to NaCl

{
  "name": "nacl-diagnose",
  "description": "Diagnose NaCl project health, drift, status, reconciliation, or next work using read-only evidence and actionable closed outcomes.",
  "included_files": [
    {
      "relative_path": "resources/bootstrap/codex-config-contract.mjs",
      "size_in_bytes": 2664
    },
    {
      "relative_path": "resources/bootstrap/neo4j-mcp-supply.mjs",
      "size_in_bytes": 4292
    },
    {
      "relative_path": "resources/bootstrap/plan-project-graph.mjs",
      "size_in_bytes": 19639
    },
    {
      "relative_path": "resources/references/skills-only-runtime-contract.md",
      "size_in_bytes": 7181
    },
    {
      "relative_path": "resources/workflows/nacl-tl-diagnose/SKILL.md",
      "size_in_bytes": 4389
    },
    {
      "relative_path": "resources/workflows/references/verification-evidence.md",
      "size_in_bytes": 14769
    }
  ],
  "skill_md_contents": "---\nname: nacl-diagnose\ndescription: Diagnose NaCl project health, drift, status, reconciliation, or next work using read-only evidence and actionable closed outcomes.\n---\n\n# NaCl Diagnose\n\nRead [the Skills-only runtime contract](resources/references/skills-only-runtime-contract.md).\nBefore requiring MCP, invoke the bundle-relative\n[plan runner](resources/bootstrap/plan-project-graph.mjs) once with\n`--diagnose-only` and the explicit absolute project root. This inspection is\nfile-only: never call Docker, use the network, mutate a file, or infer graph\ntruth.\n\nPreserve its exact `status`, `code`, `initializationState`, canonical root, and\nper-file digest/absence evidence:\n\n- `NOT_RUN/PROJECT_MCP_NOT_CONFIGURED` + `UNINITIALIZED`: report the local\n  state and route to `nacl-init`; do not turn it into an error.\n- `BLOCKED/*` + `BLOCKED`: stop on malformed, unsafe, or partial local state.\n- `PARTIALLY_VERIFIED/PROJECT_MCP_VERIFICATION_REQUIRED` +\n  `INITIALIZED_LOCAL_FILES`: report that files exist but graph truth and\n  overall initialization remain unverified. If the project MCP is absent, ask\n  for a new task and stop without replacing this with\n  `BLOCKED/PROJECT_MCP_NOT_CONFIGURED`.\n\nOnly after local initialized files and a loaded project `nacl_neo4j` MCP are\nboth present, read\n[the diagnostic workflow](resources/workflows/nacl-tl-diagnose/SKILL.md)\nand [the evidence taxonomy](resources/workflows/references/verification-evidence.md).\nUse MCP reads for graph truth. If the initialization ceremony in `nacl-init`\nhas not completed, route there before ordinary diagnosis.\n\nRoute to one packaged diagnostic leaf. Keep the run read-only unless the user\nseparately requests an artifact. Use only project-local Neo4j MCP reads and\npreserve exact graph status. Never infer graph truth from a stale local status\nfile; missing named evidence is an honest closed non-success.\n"
}