Hybrid Queued Skill-to-Daemon Dispatch with Staged, Human-Approved Application and a Read-Only Instruction/Exfiltration Scan

Defensive publication. Describes an architecture for a local-first personal knowledge system in which agent access to a notes database is mediated by a queued skill-to-daemon dispatch layer, all mutations are staged and require human approval to apply, and a read-only scanner flags instruction-, exfiltration-, and credential-shaped content. Covers: (a) queued skill-to-daemon dispatch with a read-only notes database; (b) staged, human-approved application with snapshot-based rollback; (c) read-only scanning of notes for instruction/exfiltration/credential shapes reported by source; and (d) a schema-validated skill registry with deterministic gates. Published as prior art.