[tournierjc]

Change

#99 is merged. This PR adds the session-server HTTP surface so Android and other HTTP clients can drive that skill workflow:

• POST /sessions/:id/skill-policy — mandatory / optional / forbidden dispositions and closed catalog
• GET /skills/proposals — list Skill/Memory drafts awaiting review. Query: status, kind, sessionId, limit (default 50, clamped to the store's 200 cap)
• POST /skills/proposals/:id/review — approve / reject (optional editedDraft, reviewNote). Reviewing an unknown proposal answers 404 and an already-reviewed one 409, so a client can tell a lost retry from a broken server

Also wires those methods onto TuiServerRuntime, documents them in docs/harness-integration.md and docs/tui-capabilities.md, and extends the server-http unit tests.

Supersedes #104: its head branch was renamed cursor/skill-http-after-99-9cd5 → feat/server-skill-review to match AGENTS.md, and GitHub closes a pull request whose head branch is renamed (docs; only base branches are repointed), so the old PR could not follow the rename. Same single commit ec67eed, same body — the review thread, the review follow-up comment and the gate results stay on #104, which itself replaced draft #102 (its branch still carried pre-merge #99 history).

Review fixes carried in this commit, each with a test: the proposals route is pinned to its two path shapes, limit is clamped to 200, and the knowledge-proposal domain errors map to 404/409 instead of a bare 500.

Validation

• Checks run and results: pnpm verify at ec67eed — 15 gates passed (linux aarch64, Node 26.5.1, pnpm 9.12.0); skipped test:windows and test:sandbox as not applicable on this platform, and test:release-package as it needs an npm release archive. packages/tui/test/unit/server-http.test.ts (24 tests) is declared in test/vitest-suites.json under capability.
• Negative checks: the two new boundary assertions fail against the pre-fix http.ts (500 instead of 404/409; limit=100000 forwarded unclamped), so they pin the fix rather than the fixture.
• Performance: basic (HTTP route/capability wiring only; no new per-turn prompt assembly beyond feat: skill management with prompt lookup, idle drafts, and human review #99). No perf:full label — nothing here touches the paths the performance rules cover.
• NOT RUN, platform limitations and live-service boundaries: no live-provider or live-service acceptance, no interactive TUI path, and this box is the only platform the gates ran on. GitHub CI is the platform record.

Publication and contribution checks

• I have permission to contribute these changes under the existing licenses applicable to the changed files/packages; imported material and its provenance are identified and existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included.
• Added/removed source files were reviewed before regenerating release/public-source.json; new tests are declared in test/vitest-suites.json where applicable. (No source file added or removed: the change edits five existing paths, so the inventory is unchanged and check:source/check:tsconfig are unaffected.)
• Shared English/Chinese documentation and capability/verification records are updated where applicable: the HTTP routes and their response shapes are in docs/harness-integration.md, and docs/tui-capabilities.md now points its capability record at the server surface. No localized product string changed, so no copy.zh-Hans entry applies. Mock/offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope or license changes (if any): none.

Shared-source port: not needed.