Internal skill runtime (Ghost / ZigZagZig)

Not the agent skill. Agents install and follow the public skill via bobby install --skill (bobby-browser under ~/.agents/skills/, sourced from skill/SKILL.md in the repo). That skill drives MCP tools. Ghost and ZigZagZig (Rust: SkillGhost / SkillZigZagZig) below are an in-process recovery router used by runtime tests — they are not MCP tools and are not part of the public HTTP/SDK surface.

Ghost, ZigZagZig, and related recovery tactics shape browser preparation and recovery inside crates/skill-runtime. They do not bypass the normal command lifecycle, policy checks, deadlines, or evidence rules.

Not a public API today

Internal skills are not exposed as commands on:

• HTTP (/v1/*)
• MCP tools (command_execute and friends)
• @cavi-ai/bobby-browser

Do not treat skill router aliases (/ghost, /zigzagzig) as public user commands for application integrations. Those aliases exist in the in-process skill router for runtime tests (for example bobby_skill_recovery), not as broker routes.

The ladder itself is reachable in production one way: create the session with zigzagzig: true (POST /v1/sessions, TypeScript SDK CreateSessionRequest.zigzagzig, or MCP session_create / workflow_start with zigzagzig: true — advertised only to principals holding both browser:fingerprint and browser:humanize). A godmode session runs every page-bound command under the ladder below — no slash command needed.

Public clients automate with primitives and intents via HTTP, MCP tools, or the TypeScript SDK. Recovery for public surfaces is inspect (recovery_status / GET /v1/recovery/{id} / recoveryStatus) plus mutate (checkpoint + recover) — see Events and recovery.

Internal skill router (contributor / runtime tests)

When exercising the skill runtime, the in-process router recognizes:

Ghost

Use /ghost on|off|status (/ghost is equivalent to on). Ghost negotiates a coherent browser profile before launch, reports the effective engine and supported capabilities, and freezes that profile for the session. Required capabilities fail closed; explicitly optional capabilities may degrade and remain visible in status. Turning Ghost off stops applying it to new work, but a live browser may report restartRequired until the next safe launch boundary.

Ghost reports what the selected browser actually supports. It does not disguise one engine as another or inject contradictory page-visible values.

ZigZagZig

Use /zigzagzig run|status|stop (/zigzagzig is equivalent to run). ZigZagZig applies a bounded recovery ladder to the original postcondition:

1. retry read-only observation;
2. resolve the semantic target again;
3. change the interaction method;
4. solve a blocking human-verification challenge in place (the vision

solveChallenge loop, gated on the session's proven capabilities — a session without vision assist declines this rung and climbs on);

1. reconcile the verified checkpoint;
2. start a fresh Ghost session;
3. choose another compatible engine;
4. restart from the last durable boundary.

Each tactic consumes the existing workflow deadline and tactic budget. A mutation with an unknown effect is never blindly replayed: Bobby inspects or reconciles it first, returning effectUncertain when safety cannot be proven. Durable recovery receipts bind the issued decision, command identity, evidence, and terminal result so an interrupted finalization can settle exactly once.

Failure and evidence contract

Skill outcomes use typed failures such as unsupportedCapability, targetDrift, checkpointMismatch, strategyExhausted, and engineUnavailable. Status and retained evidence are redacted: they may include effective profile digests, tactic decisions, checkpoint identity, timing, and attempt lineage, but not raw credentials, cookies, authentication headers, or unrestricted host paths.