Summary

Add an experimental Mural skill so DT Coach, RAI Planner, and UX/UI Designer agents can read and write Mural workspaces, rooms, murals, and widgets via the Mural REST API — exposed through both a Python CLI and an embedded stdio MCP server.

Motivation

Mural is the durable record of human conversation in DT/RAI/UX-UI workflows. Today agents have no programmatic way to seed murals from canonical artifacts or extract widget contents back into coaching state, so AI contributions are either invisible or risk silently authoring decisions that should remain human-owned.

Scope

• Python skill at .github/skills/experimental/mural/ with bash + PowerShell entry scripts, CLI, embedded stdio MCP server, fuzz harness, SECURITY.md, and .env.example.
• Cross-cutting instruction set under .github/instructions/experimental/mural/ covering destinations registry, human-record contract, log hygiene, seeding patterns, writeback hygiene, and asymmetric writing style.
• Agent integrations for dt-coach, rai-planner, and ux-ui-designer.
• Collection registration in hve-core-all and project-planning at experimental maturity.
• Mural credentials guide + Docusaurus sidebar entry; sixteen new threats (OA-1..OA-16) added to docs/security/security-model.md.
• validate:skills guard requiring the ruff isort (I) rule when a Python skill ships a tests/ directory.

Acceptance Criteria

• Skill, instructions, and agent integrations land at experimental maturity.
• Mural-as-human-record + log-hygiene contracts are documented and referenced from each consuming agent.
• All linters and validators pass (lint:all, validate:skills, lint:ai-artifacts).
• Mural python tests pass; new isort guard is exercised by Pester.

Status

Implemented in PR #1561.