@ccoalm/ccl-skills 0.14.0 → 0.15.1

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/review_gate.py

@@ -2736,6 +2736,7 @@ def freeze_review_profile(
     required_self_review_fields = {"concern", "conclusion", "evidence_refs"}
     self_review: list[dict[str, Any]] = []
     seen_concerns: set[str] = set()
+    seen_owner_concerns: set[tuple[str, str]] = set()
     for index, item in enumerate(self_review_raw):
         item_fields = set(item) if isinstance(item, dict) else set()
         if item_fields not in (
@@ -2761,7 +2762,6 @@ def freeze_review_profile(
             len(normalized_conclusion) < 20
             or placeholder_key in PLACEHOLDER_TEXT
             or concern not in known_concern_ids
-            or concern in seen_concerns
             or not isinstance(references, list)
             or not references
             or any(
@@ -2781,6 +2781,12 @@ def freeze_review_profile(
             )
         except GateError as exc:
             raise GateError(exc.reason, "self_review_incomplete") from exc
+        if (concern, skill) in seen_owner_concerns:
+            raise GateError(
+                "self_review repeats a concern for the same skill",
+                "self_review_incomplete",
+            )
+        seen_owner_concerns.add((concern, skill))
         seen_concerns.add(concern)
         self_review.append(
             {
@@ -3368,7 +3374,10 @@ def decode_wrapper(
     native_skill_binding = payload.get("native_skill_binding")
     for field in CONTROLLER_OWNED_FIELDS:
         payload.pop(field, None)
-    if native_skill_binding in {"established", "not_requested"}:
+    # `unavailable` is a wrapper that reviewed the packet without the selected
+    # owner skills because the installed registry or plugin could not be used:
+    # a valid review with weaker skill evidence, never a refusal.
+    if native_skill_binding in {"established", "not_requested", "unavailable"}:
         payload["native_skill_binding"] = native_skill_binding
     payload.setdefault("wrapper_exit_code", completed.returncode)
     return payload
@@ -4144,11 +4153,15 @@ def main(argv: list[str] | None = None) -> int:
                 payload["status"] = claude_status(
                     payload, args.mode, completed.returncode
                 )
+            # A wrapper must still SAY what happened to the owner-skill binding:
+            # `established` or `unavailable` are both attested outcomes, while
+            # a missing receipt means the wrapper never considered it.
             if (
                 completed.returncode == 0
                 and payload.get("status") in {"passed", "findings"}
                 and len(profile["selected_skills"]) > 1
-                and payload.get("native_skill_binding") != "established"
+                and payload.get("native_skill_binding")
+                not in {"established", "unavailable"}
             ):
                 payload.update(
                     status="inconclusive",
@@ -4322,6 +4335,7 @@ def main(argv: list[str] | None = None) -> int:
                         item["name"]
                         for item in profile["selected_skills"]
                         if item["name"] != "code-review"
+                        and payload.get("native_skill_binding") == "established"
                     ],
                     native_skill_binding=payload.get("native_skill_binding"),
                     skill_usage_evidence={

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/runtime-surface-verification-design.md

@@ -19,8 +19,10 @@ runtime judge requires:
 
 - the exact expected built-in tool set (`StructuredOutput` only for schema-based
   packet modes; `Read,Grep,Glob` plus `StructuredOutput` for repository consult);
-- empty `mcp_servers`, `slash_commands`, `skills`, and `plugins` lists;
-- only reviewed init metadata fields and values;
+- an empty `mcp_servers` list;
+- only reviewed init metadata fields and values, where `slash_commands`,
+  `terminal_slash_commands`, `skills`, and `plugins` are vocabulary that may
+  hold any value;
 - no tool invocation outside the expected set;
 - a structurally clean result envelope with no error, API status, permission
   denial, auth, or quota signal.