@ccoalm/ccl-skills 0.13.0 → 0.14.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh

@@ -492,6 +492,337 @@ out="$(run_part --base "$PART_BASE")"; rc=$?
 check "the passing partition state still passes after the probes" \
   '[ "$rc" = 0 ]'
 
+# Chain: an integration branch accumulates several reviewed rounds, each merged
+# with its own ledger bound at its own base, and is then promoted as one pull
+# request. No single ledger binds the promotion candidate, and a path partition
+# cannot either when two rounds append to the same file: that file's promotion
+# diff is the sum of both appends and no round ever froze that sum. Every byte
+# of the promotion reached the branch through a first-parent merge whose second
+# parent is a reviewed head, so the gate walks that chain and rebinds each round
+# in a detached checkout at the round's own base, requiring every merge to be
+# exactly the automatic merge of its parents.
+CHAIN="$WORK/chain-repo"
+mkdir -p "$CHAIN/skills/code-review/scripts" "$CHAIN/skills/skill-extraction-workflow/scripts" "$CHAIN/specs"
+cp "$CONTROLLER" "$CHAIN/skills/code-review/scripts/review_gate.py"
+# This stub has a rule, unlike the accept-all stubs above, so a round can forge a
+# ledger the real validator would reject and the suite can tell whose validator
+# judged it.
+STRICT_VALIDATOR='import json, sys
+payload = json.load(open(sys.argv[1], encoding="utf-8"))
+if payload.get("closeout_state") == "ready_for_human_decision":
+    print("extraction_review_state_ok: stub accepted")
+    sys.exit(0)
+print("extraction_review_state_invalid: stub rejected")
+sys.exit(1)
+'
+printf '%s' "$STRICT_VALIDATOR" >"$CHAIN/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py"
+git -C "$CHAIN" init -q -b main .
+git -C "$CHAIN" config user.email t@example.invalid
+git -C "$CHAIN" config user.name tester
+printf 'baseline\n' >"$CHAIN/skills/skill-extraction-workflow/SKILL.md"
+printf '| row | owner |\n' >"$CHAIN/skills/skill-extraction-workflow/register.md"
+printf 'baseline\n' >"$CHAIN/README.md"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm baseline
+CHAIN_BASE="$(git -C "$CHAIN" rev-parse HEAD)"
+git -C "$CHAIN" checkout -q -b dev
+
+run_chain() { python3 "$GATE" --repo-root "$CHAIN" "$@" 2>&1; }
+
+# Land one reviewed round on the integration branch: branch, edit, ledger bound
+# to the round's own candidate (its base is the integration tip it forked from),
+# then a non-fast-forward merge so the round is one first-parent step.
+land_round() {
+  local name="$1" ledger="$2"; shift 2
+  git -C "$CHAIN" checkout -q -b "round-$name" dev
+  "$@"
+  git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round $name"
+  if [ "$ledger" = with-ledger ]; then
+    local digest
+    digest="$(run_chain --base dev --print-candidate)"
+    mkdir -p "$CHAIN/specs/$name/evidence"
+    write_closeout "$CHAIN/specs/$name/evidence/closeout.json" "$digest"
+    git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round $name ledger"
+  fi
+  git -C "$CHAIN" checkout -q dev
+  git -C "$CHAIN" merge -q --no-ff -m "merge round $name" "round-$name"
+}
+edit_round_a() {
+  printf 'baseline\nround a\n' >"$CHAIN/skills/skill-extraction-workflow/SKILL.md"
+  printf '| round a | owner |\n' >>"$CHAIN/skills/skill-extraction-workflow/register.md"
+}
+edit_round_b() {
+  mkdir -p "$CHAIN/lane"
+  printf 'round b\n' >"$CHAIN/lane/file.txt"
+  printf '| round b | owner |\n' >>"$CHAIN/skills/skill-extraction-workflow/register.md"
+}
+land_round a with-ledger edit_round_a
+land_round b with-ledger edit_round_b
+CHAIN_TWO="$(git -C "$CHAIN" rev-parse HEAD)"
+
+worktrees_before="$(git -C "$CHAIN" worktree list --porcelain)"
+tree_before="$(git -C "$CHAIN" status --porcelain --ignored)"
+out="$(run_chain --base "$CHAIN_BASE")"; rc=$?
+check "two rounds appending to one file bind through the first-parent chain where no single ledger or path partition can" \
+  '[ "$rc" = 0 ] && case "$out" in *"first-parent chain"*"2 rounds"*"specs/b/evidence/closeout.json"*"specs/a/evidence/closeout.json"*) true;; *) false;; esac'
+check "walking the chain leaves no detached checkout registered and the bound tree byte-identical" \
+  '[ "$(git -C "$CHAIN" worktree list --porcelain)" = "$worktrees_before" ] && [ "$(git -C "$CHAIN" status --porcelain --ignored)" = "$tree_before" ]'
+
+out="$(run_chain --base "$CHAIN_BASE" --paths skills)"; rc=$?
+check "a narrowed --paths scope does not evaluate the chain, because each round's ledger binds the whole round" \
+  '[ "$rc" = 1 ] && case "$out" in *"default path set"*) true;; *) false;; esac'
+
+# The promotion pull request is brought up to date with its target: the target
+# advanced, and the sync merge's second parent is already on the base. That step
+# owes no evidence, but it must still be exactly the automatic merge.
+git -C "$CHAIN" checkout -q main
+printf 'baseline\nfixed on the target\n' >"$CHAIN/README.md"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "target advances"
+CHAIN_MAIN="$(git -C "$CHAIN" rev-parse HEAD)"
+git -C "$CHAIN" checkout -q dev
+git -C "$CHAIN" merge -q --no-ff -m "sync target into dev" main
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a sync merge of the advanced target on top of the chain owes no evidence and still binds" \
+  '[ "$rc" = 0 ] && case "$out" in *"first-parent chain"*"2 rounds"*"sync"*) true;; *) false;; esac'
+CHAIN_GOOD="$(git -C "$CHAIN" rev-parse HEAD)"
+
+# A round the integration branch advanced past before it merged: its fork point
+# is not the merge's first parent, the merge is still the automatic one, and the
+# round's ledger was bound at its own fork point.
+git -C "$CHAIN" checkout -q -b round-late dev
+printf 'round late\n' >"$CHAIN/lane/late.txt"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round late"
+LATE_DIGEST="$(run_chain --base dev --print-candidate)"
+mkdir -p "$CHAIN/specs/late/evidence"
+write_closeout "$CHAIN/specs/late/evidence/closeout.json" "$LATE_DIGEST"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round late ledger"
+git -C "$CHAIN" checkout -q dev
+edit_round_c() { printf 'round c\n' >"$CHAIN/lane/c.txt"; }
+land_round c with-ledger edit_round_c
+git -C "$CHAIN" merge -q --no-ff -m "merge round late" round-late
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a round merged after the integration branch advanced still binds at its own fork point" \
+  '[ "$rc" = 0 ] && case "$out" in *"first-parent chain"*"4 rounds"*) true;; *) false;; esac'
+CHAIN_ADVANCED="$(git -C "$CHAIN" rev-parse HEAD)"
+
+# Every way a chain step can fail to be a reviewed round is refused for its own
+# reason. Each probe branches from the passing state so the cases stay independent.
+probe_chain() { git -C "$CHAIN" checkout -q -B dev "$CHAIN_GOOD"; }
+
+probe_chain
+edit_round_d() { printf 'round d\n' >"$CHAIN/lane/d.txt"; }
+land_round d no-ledger edit_round_d
+UNBOUND_MERGE="$(git -C "$CHAIN" rev-parse --short=12 HEAD)"
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a round with no accepted ledger at its own base refuses the whole chain, naming that round" \
+  '[ "$rc" = 1 ] && case "$out" in *"round $UNBOUND_MERGE"*"does not bind at its own base"*) true;; *) false;; esac'
+
+probe_chain
+printf 'pushed straight to the integration branch\n' >"$CHAIN/lane/direct.txt"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "direct commit on dev"
+DIRECT="$(git -C "$CHAIN" rev-parse --short=12 HEAD)"
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a non-merge commit on the integration branch is refused: nothing reviewed binds its content" \
+  '[ "$rc" = 1 ] && case "$out" in *"$DIRECT is not a merge commit"*) true;; *) false;; esac'
+
+probe_chain
+git -C "$CHAIN" checkout -q -b round-evil dev
+printf 'round evil\n' >"$CHAIN/lane/evil.txt"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round evil"
+EVIL_DIGEST="$(run_chain --base dev --print-candidate)"
+mkdir -p "$CHAIN/specs/evil/evidence"
+write_closeout "$CHAIN/specs/evil/evidence/closeout.json" "$EVIL_DIGEST"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round evil ledger"
+git -C "$CHAIN" checkout -q dev
+git -C "$CHAIN" merge -q --no-ff --no-commit round-evil
+printf 'slipped into the merge commit itself\n' >"$CHAIN/lane/smuggled.txt"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "merge round evil (with extra content)"
+EVIL_MERGE="$(git -C "$CHAIN" rev-parse --short=12 HEAD)"
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a merge whose tree is not the automatic merge of its parents is refused, naming the merge" \
+  '[ "$rc" = 1 ] && case "$out" in *"$EVIL_MERGE"*"automatic merge"*) true;; *) false;; esac'
+
+probe_chain
+git -C "$CHAIN" checkout -q -b round-conflict "$CHAIN_TWO"
+printf 'baseline\nconflicting fix\n' >"$CHAIN/README.md"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round conflict"
+CONFLICT_DIGEST="$(run_chain --base "$CHAIN_TWO" --print-candidate)"
+mkdir -p "$CHAIN/specs/conflict/evidence"
+write_closeout "$CHAIN/specs/conflict/evidence/closeout.json" "$CONFLICT_DIGEST"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round conflict ledger"
+git -C "$CHAIN" checkout -q dev
+git -C "$CHAIN" merge -q --no-ff --no-commit round-conflict >/dev/null 2>&1 || true
+printf 'baseline\nresolved by hand\n' >"$CHAIN/README.md"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "merge round conflict (resolved by hand)"
+CONFLICT_MERGE="$(git -C "$CHAIN" rev-parse --short=12 HEAD)"
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a merge that needed hand resolution is refused: the resolution is content no round reviewed" \
+  '[ "$rc" = 1 ] && case "$out" in *"$CONFLICT_MERGE"*"automatic merge"*) true;; *) false;; esac'
+
+probe_chain
+git -C "$CHAIN" checkout -q -b round-stale dev
+printf 'round stale\n' >"$CHAIN/lane/stale.txt"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round stale"
+STALE_DIGEST="$(run_chain --base dev --print-candidate)"
+mkdir -p "$CHAIN/specs/stale/evidence"
+write_closeout "$CHAIN/specs/stale/evidence/closeout.json" "$STALE_DIGEST"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round stale ledger"
+printf 'edited after the review\n' >>"$CHAIN/lane/stale.txt"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round stale moves after its ledger"
+git -C "$CHAIN" checkout -q dev
+git -C "$CHAIN" merge -q --no-ff -m "merge round stale" round-stale
+STALE_MERGE="$(git -C "$CHAIN" rev-parse --short=12 HEAD)"
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a round whose ledger binds a candidate it later moved away from is refused" \
+  '[ "$rc" = 1 ] && case "$out" in *"round $STALE_MERGE"*"does not bind at its own base"*) true;; *) false;; esac'
+
+# A round is judged with the landing tree's controller and validator, never its
+# own: a round that installs an accept-all validator in its own branch, forges a
+# ledger the real validator rejects, and is later followed by a round restoring
+# the real validator must not bind through history's tools.
+probe_chain
+git -C "$CHAIN" checkout -q -b round-forged dev
+printf 'round forged\n' >"$CHAIN/lane/forged.txt"
+printf 'import sys\nprint("extraction_review_state_ok: hollow validator accepts everything")\nsys.exit(0)\n' \
+  >"$CHAIN/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py"
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round forged"
+FORGED_DIGEST="$(run_chain --base dev --print-candidate)"
+mkdir -p "$CHAIN/specs/forged/evidence"
+python3 - "$CHAIN/specs/forged/evidence/closeout.json" "$FORGED_DIGEST" <<'PY'
+import json, sys
+from pathlib import Path
+Path(sys.argv[1]).write_text(json.dumps({"schema_version": 3, "closeout_state": "forged", "controller_receipts": [], "candidate_sha256": sys.argv[2]}))
+PY
+git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "round forged ledger"
+git -C "$CHAIN" checkout -q dev
+git -C "$CHAIN" merge -q --no-ff -m "merge round forged" round-forged
+FORGED_MERGE="$(git -C "$CHAIN" rev-parse --short=12 HEAD)"
+edit_round_restore() { printf '%s' "$STRICT_VALIDATOR" >"$CHAIN/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py"; }
+land_round restore with-ledger edit_round_restore
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a round that forged a ledger under its own hollow validator is refused even after a later round restored the real one" \
+  '[ "$rc" = 1 ] && case "$out" in *"round $FORGED_MERGE"*"does not bind at its own base"*) true;; *) false;; esac'
+
+# The walk is bounded at exactly 64 steps: a chain of 64 passes, 65 is refused.
+# Receipt-only rounds keep the fixture fast, since a round whose only change is
+# an excluded receipt binds as "no reviewed-path change" without a freeze.
+probe_chain
+fill_round() {
+  git -C "$CHAIN" checkout -q -b "round-fill-$1" dev
+  mkdir -p "$CHAIN/specs/fill-$1/evidence"
+  printf '{"schema_version": 3, "candidate_sha256": "%s"}\n' "$(printf '0%.0s' $(seq 64))" >"$CHAIN/specs/fill-$1/evidence/note.json"
+  git -C "$CHAIN" add -A && git -C "$CHAIN" commit -qm "fill $1"
+  git -C "$CHAIN" checkout -q dev
+  git -C "$CHAIN" merge -q --no-ff -m "merge fill $1" "round-fill-$1"
+}
+for index in $(seq 1 61); do fill_round "$index"; done
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a chain of exactly 64 steps is still walked and binds" \
+  '[ "$rc" = 0 ] && case "$out" in *"first-parent chain"*"63 rounds"*) true;; *) false;; esac'
+fill_round 62
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a chain of 65 steps is refused as longer than the bound" \
+  '[ "$rc" = 1 ] && case "$out" in *"more than 64 steps"*) true;; *) false;; esac'
+
+# A checkout this run cannot release is an error, never a pass: the removal's
+# result is checked and the registry read back, and nothing prunes registrations
+# the run did not create. A git shim refuses only `worktree remove`.
+git -C "$CHAIN" checkout -q -B dev "$CHAIN_GOOD"
+REAL_GIT="$(command -v git)"
+mkdir -p "$WORK/fakegit" "$WORK/shim-tmp"
+cat >"$WORK/fakegit/git" <<EOF
+#!/usr/bin/env bash
+if [ "\$1" = "-C" ] && [ "\$3" = "worktree" ] && [ "\$4" = "remove" ]; then
+  echo "shim: refusing to remove the worktree" >&2
+  exit 1
+fi
+exec "$REAL_GIT" "\$@"
+EOF
+chmod +x "$WORK/fakegit/git"
+out="$(PATH="$WORK/fakegit:$PATH" TMPDIR="$WORK/shim-tmp" run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a detached checkout that cannot be released turns the verdict into an error, never a pass" \
+  '[ "$rc" != 0 ] && case "$out" in *"cannot release the detached checkout"*) case "$out" in *review_ledger_binding_ok*) false;; *) true;; esac;; *) false;; esac'
+git -C "$CHAIN" worktree prune
+
+# `git worktree add` can register and populate the checkout and still return
+# nonzero. The failure is an error either way, but the registration it left
+# behind must be released and verified, not merely have its directory deleted.
+mkdir -p "$WORK/fakegit-add" "$WORK/shim-add-tmp"
+cat >"$WORK/fakegit-add/git" <<EOF
+#!/usr/bin/env bash
+if [ "\$1" = "-C" ] && [ "\$3" = "worktree" ] && [ "\$4" = "add" ]; then
+  "$REAL_GIT" "\$@"
+  echo "shim: worktree add failed after registering" >&2
+  exit 1
+fi
+exec "$REAL_GIT" "\$@"
+EOF
+chmod +x "$WORK/fakegit-add/git"
+worktrees_before="$(git -C "$CHAIN" worktree list --porcelain)"
+out="$(PATH="$WORK/fakegit-add:$PATH" TMPDIR="$WORK/shim-add-tmp" run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a checkout creation that fails after registering is an error and leaves no registration or directory behind" \
+  '[ "$rc" != 0 ] && case "$out" in *"cannot check out round head"*) case "$out" in *review_ledger_binding_ok*) false;; *) true;; esac;; *) false;; esac && [ "$(git -C "$CHAIN" worktree list --porcelain)" = "$worktrees_before" ] && [ -z "$(ls -A "$WORK/shim-add-tmp")" ]'
+git -C "$CHAIN" worktree prune
+
+# The benign sibling: an add that fails before registering anything must error
+# the same way, leave the registry untouched, and remove the directory this run
+# created for it, without reporting a release problem it does not have.
+mkdir -p "$WORK/fakegit-noadd" "$WORK/shim-noadd-tmp"
+cat >"$WORK/fakegit-noadd/git" <<EOF
+#!/usr/bin/env bash
+if [ "\$1" = "-C" ] && [ "\$3" = "worktree" ] && [ "\$4" = "add" ]; then
+  echo "shim: worktree add refused before registering" >&2
+  exit 1
+fi
+exec "$REAL_GIT" "\$@"
+EOF
+chmod +x "$WORK/fakegit-noadd/git"
+worktrees_before="$(git -C "$CHAIN" worktree list --porcelain)"
+out="$(PATH="$WORK/fakegit-noadd:$PATH" TMPDIR="$WORK/shim-noadd-tmp" run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a checkout creation that fails before registering errors cleanly with no registration, no directory, and no release complaint" \
+  '[ "$rc" != 0 ] && case "$out" in *"cannot check out round head"*) case "$out" in *"could not be released"*|*review_ledger_binding_ok*) false;; *) true;; esac;; *) false;; esac && [ "$(git -C "$CHAIN" worktree list --porcelain)" = "$worktrees_before" ] && [ -z "$(ls -A "$WORK/shim-noadd-tmp")" ]'
+
+# The registry is read NUL-terminated: line-oriented porcelain cannot carry a
+# path with a newline (the line splits; a tab is printed raw on the git in use,
+# and quoting depends on version and core.quotePath), so a registration under
+# such a temporary directory would match neither spelling and read as gone.
+# Here the add registers and fails, the remove is refused, and the surviving
+# registration must be reported.
+TAB_TMP="$WORK/shim nl
+dir"
+mkdir -p "$WORK/fakegit-tab" "$TAB_TMP"
+cat >"$WORK/fakegit-tab/git" <<EOF
+#!/usr/bin/env bash
+if [ "\$1" = "-C" ] && [ "\$3" = "worktree" ] && [ "\$4" = "add" ]; then
+  "$REAL_GIT" "\$@"
+  echo "shim: worktree add failed after registering" >&2
+  exit 1
+fi
+if [ "\$1" = "-C" ] && [ "\$3" = "worktree" ] && [ "\$4" = "remove" ]; then
+  echo "shim: refusing to remove the worktree" >&2
+  exit 1
+fi
+exec "$REAL_GIT" "\$@"
+EOF
+chmod +x "$WORK/fakegit-tab/git"
+worktrees_before="$(git -C "$CHAIN" worktree list --porcelain)"
+out="$(PATH="$WORK/fakegit-tab:$PATH" TMPDIR="$TAB_TMP" run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "a surviving registration under a newline-bearing temporary path is still reported, not read as gone through line-oriented porcelain" \
+  '[ "$rc" != 0 ] && case "$out" in *"cannot check out round head"*"could not be released"*"still registered"*) true;; *) false;; esac'
+rm -rf "$TAB_TMP"
+git -C "$CHAIN" worktree prune
+# This case deliberately leaves a registration behind, so its own cleanup is
+# what restores the fixture. Prune only drops registrations whose directory is
+# already gone, so the directory must go first; asserting the restoration keeps
+# a later reordering from silently handing every following case a mutated
+# registry.
+check "the newline-path case restores the fixture's worktree registry for the cases that follow" \
+  '[ "$(git -C "$CHAIN" worktree list --porcelain)" = "$worktrees_before" ]'
+
+git -C "$CHAIN" checkout -q -B dev "$CHAIN_ADVANCED"
+out="$(run_chain --base "$CHAIN_MAIN")"; rc=$?
+check "the passing chain state still passes after the probes" \
+  '[ "$rc" = 0 ]'
+
 # The suite above exercises a synthetic repository. The gate must also run against
 # the real checkout it ships in, or a break in that path passes every test here.
 REAL_ROOT="$(cd "$DIR/../../.." && pwd -P)"

package/dist/assets/release.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "npmPackage": "@ccoalm/ccl-skills",
-  "version": "0.13.0",
-  "sourceCommit": "17dc842da2e26c10bdd0459da27264048f4144b3",
+  "version": "0.14.0",
+  "sourceCommit": "3b42a5bd027e29f72b90b055c763333964d46259",
   "sourceState": "clean",
   "files": [
     {
@@ -1992,7 +1992,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/attention-budget-ratchet.md",
-      "sha256": "3f6fa158cf3e09df7ce59c98b407ef10187711635db720199ad0c0b3585f4a44",
+      "sha256": "b09b1b6908e87b75ecdb2cba5c2499b4a9bd490f7c7225b509a560285a61cb9d",
       "mode": 420
     },
     {
@@ -2005,24 +2005,29 @@
       "sha256": "a7ff4aea676dcf3abc62316a2ddb10c88b035d2f6a7b97d5a0343d8533aeb33c",
       "mode": 420
     },
+    {
+      "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/correction-routing-map.md",
+      "sha256": "6712b1a91e3a019795e1fbf58fbe52042a31962674159f868671117003f46a12",
+      "mode": 420
+    },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/coverage-exhaustion-traps.md",
-      "sha256": "9d920528936da253c513f3056b4780354d5c73290986cad11437f3abf14472ae",
+      "sha256": "0070f58a0df463fe491d760b2378fae85d7fea956fc01ac4a4b0aae05a25b4b5",
       "mode": 420
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/description-authoring.md",
-      "sha256": "a78c1b37bb648da6024e16c1d4435bd9413d403a4171673f270fd86440b70732",
+      "sha256": "6d5ebb079c9f3570985c12a30995a09174ee2efef066a9da7efe89b56c0f0166",
       "mode": 420
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/dual-track-review-gate.md",
-      "sha256": "50f907bd644401adbcdf55f259430eb62c39e656e27c14c1f367654c3da1b630",
+      "sha256": "9deda45197efe202db5b3ed1d603aa1e97090476558a254b4612c7c6ab7c95ee",
       "mode": 420
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/eval-routing.md",
-      "sha256": "9251d2da1a4ff80c70a5857b44eb5b825d94d2a7a224fb763d263712f029b309",
+      "sha256": "867941f4dcb59c19b36310f8f304bf883e77a5c58c9e9d5cf82e879720dff0de",
       "mode": 420
     },
     {
@@ -2037,7 +2042,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/external-practice-controls.md",
-      "sha256": "a956c52fdf268c2f75edcc7de66f882be222fdd5bad07b68c1242ad05d79637d",
+      "sha256": "665eaecb1f9ef219f581fa86a02df4bb378694dbc4ff52b5117f7c929bdec287",
       "mode": 420
     },
     {
@@ -2047,7 +2052,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/extraction-quickstart.md",
-      "sha256": "68b6327538ad1bb99fe9c0dd337bd961f029ddf9929c1ecd7c60c616f59d84de",
+      "sha256": "7ed3fa06032d45fa6d0ab03679cf64e571a80cdf470f34476d77ab54db0869a4",
       "mode": 420
     },
     {
@@ -2057,12 +2062,12 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/harness-patterns-and-eval.md",
-      "sha256": "0dd0a49299a54a90b4726cc8223ee2fc0ab145cf9b16f4ae6ddc61d3b58c0c8c",
+      "sha256": "2149bf40adc0eabdd7d0ad4ebc7938288e6c74050ca979d9227f5d9221bec8cb",
       "mode": 420
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/incident-postmortem-extraction.md",
-      "sha256": "1d2f764ad17925254509c0f541f81161227752f054b77e0536036b3502a4ff88",
+      "sha256": "31ee01a1b025f1b89631f1b133dcb5449df8087bff49a80065684f39656a027b",
       "mode": 420
     },
     {
@@ -2112,7 +2117,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/rule-consolidation.md",
-      "sha256": "d2455dfb4f3213db76244a21e004ad0f934279c773d733bae9303a90990f285f",
+      "sha256": "e4c73b6bd412c9aca273cc36af7d987491e77f7da9639d7469110b2dc6da338a",
       "mode": 420
     },
     {
@@ -2122,7 +2127,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md",
-      "sha256": "f49ace762eaa93ed4e662cacc67714b848ca567e98c1f93a7674e3bba30a16b6",
+      "sha256": "12ca28829763dcd5b1e7e55ffe32c5189757855d9e22d34a56c4dc1524293e18",
       "mode": 420
     },
     {
@@ -2137,7 +2142,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/uiux-judgment-extraction.md",
-      "sha256": "6513a3f9788b37c5577379a1db6f1136fcb43f5206a2c293faa6473e36a90487",
+      "sha256": "969808be6cf5234e689a7675c2108d1ac464882b93216e600122e02bdc05f221",
       "mode": 420
     },
     {
@@ -2147,7 +2152,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/validation-and-landing.md",
-      "sha256": "58f85c05e3a08c49836113778ba7a8dba86c5dbf4b2716e20c38f86632481c52",
+      "sha256": "cd5cbc4ae9185a1c96fc945dee1bcfd958638498f01ba2487b772a2e9cc49ece",
       "mode": 420
     },
     {
@@ -2195,6 +2200,11 @@
       "sha256": "10cdd03d67185c1b1730a34248edb6c311e6ee8b82b8ecc0f7923e8f8f368b59",
       "mode": 420
     },
+    {
+      "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/entrypoint_form_census.py",
+      "sha256": "878c4694c4177a29f19c3b46d9b595696a768e26ff275429d380bf0e4bfc809e",
+      "mode": 493
+    },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/eval-golden-trace.rb",
       "sha256": "14c3c7c1437c6d70c5ab48ac8b1312fab3a421de31b110da84fa0528762b924c",
@@ -2245,6 +2255,11 @@
       "sha256": "8bd90fc37d53e466ac5735d2fc956a9d3a31bcd31dd51614ae9e15d435e39726",
       "mode": 420
     },
+    {
+      "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/reference-access-census.sh",
+      "sha256": "c408c6d4871d91b9a7d345959154ad70e2c5bf8233ff7e88bbd7d6cd7bb01323",
+      "mode": 493
+    },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/register-firing-path-resolution.rb",
       "sha256": "db009982ac485aaebf708c4bff9b33fc65e2fef6264769ec1e42870f75bc8677",
@@ -2252,7 +2267,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py",
-      "sha256": "a44a65d80dbcb366f667742e160949256c7b191175ab6fb711c38e35c74f11c7",
+      "sha256": "ae7b2aa0c7f0afa569f424fbd57d62209e21fd4da9a6b94da15686eb4b2d8719",
       "mode": 493
     },
     {
@@ -2312,7 +2327,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh",
-      "sha256": "2463130c6af00c0611f1197628b3eb760e141b7db3fb8db8b88bb27e3da7fd62",
+      "sha256": "c8309b75883f8e7e404ae15a85efc347e58f0255385bf57ddb6b200a3b587588",
       "mode": 493
     },
     {
@@ -2365,6 +2380,11 @@
       "sha256": "46016ad11df8ee75dd7aa17c2e017fad60dc127a234f0bd4c5bcb3baf4f7d0ee",
       "mode": 493
     },
+    {
+      "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_entrypoint_form_census.sh",
+      "sha256": "2cb5a411fc9badfd0667cea9cc20567b7edade74b30520de184c1dfca99b6491",
+      "mode": 493
+    },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_bank_grader_diagnostics.sh",
       "sha256": "10cacb2baf142dbedddbecb34ac2ee1bd9d043b9c946acff9ce83373be0d1553",
@@ -2460,6 +2480,11 @@
       "sha256": "c495841ae6cd6cb3bf4c65a9883da08b4b24f50b53dba2219df9327a41980251",
       "mode": 493
     },
+    {
+      "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_reference_access_census.sh",
+      "sha256": "4aa6d437078b939270e607d1ad4ea17f4043824aee807859a795a85f7ebc00a6",
+      "mode": 493
+    },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_register_firing_path_resolution.sh",
       "sha256": "4894f739af0b3aa995243592d71ca3f93de3108a11f9734422a4f15c2ca33668",
@@ -2482,7 +2507,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh",
-      "sha256": "471362ad4524c7c13367e4cc296d48beff3127bd50974fdc5d4e8d038396855e",
+      "sha256": "a7274e735371dcd80b4c1b7745e3e5648d7e84b1dee676bf2743f4600751a770",
       "mode": 493
     },
     {
@@ -2542,7 +2567,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/SKILL.md",
-      "sha256": "83c6d8bb60a0edafc1c80ca02109f7210ec090e5c9b5eda813672b14779b7cc4",
+      "sha256": "5d46b33dcc0c84ec4cac51bdea93aba643427f88dcd7ee3930b3ecd2132bc4f0",
       "mode": 420
     },
     {
@@ -3378,5 +3403,5 @@
       "mode": 420
     }
   ],
-  "snapshotHash": "d4aa7c100eb2cd58f72a70fe4ee98c37c0b6035a75afcf7cc5a001eb88147cce"
+  "snapshotHash": "ba1bcedf0fe6247bda9eb70091de735a5e6fef8e7fc8d82f573841870dcb5302"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccoalm/ccl-skills",
-	"version": "0.13.0",
+	"version": "0.14.0",
   "description": "Reusable workflows that help coding agents plan, build, test, review, and release software — for Claude Code, Codex, and OpenCode",
 	"keywords": ["skills", "agent-skills", "claude", "claude-code", "codex", "opencode", "agent", "ai", "ai-agents", "cli", "anthropic", "developer-tools"],
   "type": "module",