@ccoalm/ccl-skills 0.6.2 → 0.8.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/check-parallel-stack-parity.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# check-parallel-stack-parity.sh — cross-file parity gate for parallel-stack mirrored references.
+#
+# The parallel-stack pattern (references/parallel-stack-references-pattern.md) requires the
+# mirrored region of each sibling pair — everything from the exact heading line
+# "## When this applies / does not apply" up to the stack-specific
+# "## <Stack>-specific implementation patterns" H2 — to be BYTE-IDENTICAL across the Python
+# and Go trees. There is deliberately NO normalization: earlier versions rewrote routing
+# references and sibling skill names before diffing, and two adversarial rounds each found a
+# fresh way that lossy rewriting could mask real drift (second element of an or-list swapped,
+# canonical pointer replaced by a mapped name, self-reference via name mapping). The
+# capability was removed rather than patched again: routing text that legitimately differs
+# per tree is written INTO the mirrored region naming both trees inline —
+#   `x.md` (Python) / `y.md` (Go)
+# — so both files carry the same bytes and a one-sided change is always drift.
+#
+# Marker integrity: each marker must match as an EXACT whole line, exactly once, in order.
+# A missing, duplicated, or prefix-gamed heading is a malformed-markers verdict, never a
+# silent ok. Residual accepted and documented: moving BOTH stop markers earlier in the same
+# change shrinks the compared region symmetrically; that is a visible, reviewable contract
+# edit in the diff, not something this gate can distinguish from a legitimate region change.
+# The optional "## Topic-extension backlog" H2 after the stack-glue H2 is mirrored by
+# convention but excluded from this strict gate (its section rule allows near-identical
+# wording so it can name vendors/engines); keep it in sync by review.
+#
+# Exit codes: 0 = parity ok; 1 = drift / missing file / malformed markers (content verdict);
+# 2 = infrastructure failure (this script could not run its own checks).
+#
+# Usage: check-parallel-stack-parity.sh [repo-root]   (default: .)
+set -euo pipefail
+
+ROOT="${1:-.}"
+PY_DIR="$ROOT/skills/python-service-architecture/references"
+GO_DIR="$ROOT/skills/go-microservice-architecture/references"
+
+START_MARKER="## When this applies / does not apply"
+
+PAIRS=(
+  "event-driven-architecture.md"
+  "multi-tenant-isolation.md"
+  "data-platform-architecture.md"
+)
+
+# count_exact <file> <exact line> — prints the match count. Distinguishes grep's "no
+# match" (rc 1, a legitimate count of 0) from a hard failure such as an unreadable file
+# (rc >1), which must surface as infrastructure failure, never as a content verdict.
+count_exact() {
+  local c rc
+  set +e; c=$(grep -cxF "$2" "$1"); rc=$?; set -e
+  case "$rc" in
+    0|1) printf '%s\n' "${c:-0}"; return 0 ;;
+    *) return 2 ;;
+  esac
+}
+
+# extract_mirrored <file> <stop-H2 exact line> <out-file>
+# Writes the mirrored region to <out-file> BYTE-EXACTLY (a file, not a command
+# substitution: $(...) strips trailing newlines, which let a trailing blank line before
+# the stack-glue H2 diverge invisibly). Returns 1 on malformed markers (missing,
+# duplicated, or out of order), 2 on infrastructure failure.
+extract_mirrored() {
+  local file="$1" stop="$2" out="$3" starts stops start_line stop_line
+  starts=$(count_exact "$file" "$START_MARKER") || return 2
+  stops=$(count_exact "$file" "$stop") || return 2
+  if [ "$starts" -ne 1 ] || [ "$stops" -ne 1 ]; then
+    return 1
+  fi
+  start_line=$(grep -nxF "$START_MARKER" "$file" | head -1 | cut -d: -f1) || return 2
+  stop_line=$(grep -nxF "$stop" "$file" | head -1 | cut -d: -f1) || return 2
+  if [ "$start_line" -ge "$stop_line" ]; then
+    return 1
+  fi
+  sed -n "${start_line},$((stop_line - 1))p" "$file" > "$out" || return 2
+}
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/stack-parity.XXXXXX")" || { echo "parity_infra: mktemp failed" >&2; exit 2; }
+trap 'rm -rf "$WORK"' EXIT
+
+fail=0
+for f in "${PAIRS[@]}"; do
+  py="$PY_DIR/$f"
+  go="$GO_DIR/$f"
+  if [ ! -f "$py" ] || [ ! -f "$go" ]; then
+    echo "parity_missing_file: $f"
+    fail=1
+    continue
+  fi
+  py_out="$WORK/py-$f.txt"; go_out="$WORK/go-$f.txt"
+  rc=0; extract_mirrored "$py" "## Python-specific implementation patterns" "$py_out" || rc=$?
+  if [ "$rc" -eq 2 ]; then echo "parity_infra: $f (python side: grep/sed could not run)" >&2; exit 2; fi
+  if [ "$rc" -ne 0 ]; then
+    echo "parity_malformed_markers: $f (python side: start/stop heading missing, duplicated, not an exact heading line, or out of order)"
+    fail=1
+    continue
+  fi
+  rc=0; extract_mirrored "$go" "## Go-specific implementation patterns" "$go_out" || rc=$?
+  if [ "$rc" -eq 2 ]; then echo "parity_infra: $f (go side: grep/sed could not run)" >&2; exit 2; fi
+  if [ "$rc" -ne 0 ]; then
+    echo "parity_malformed_markers: $f (go side: start/stop heading missing, duplicated, not an exact heading line, or out of order)"
+    fail=1
+    continue
+  fi
+  if [ ! -s "$py_out" ] || [ ! -s "$go_out" ]; then
+    echo "parity_empty_mirrored_region: $f"
+    fail=1
+    continue
+  fi
+  if ! cmp -s "$py_out" "$go_out"; then
+    echo "parity_drift: $f"
+    diff "$py_out" "$go_out" | head -40 || true
+    fail=1
+  fi
+done
+
+if [ "$fail" -ne 0 ]; then
+  echo "parallel_stack_parity_FAIL"
+  exit 1
+fi
+echo "parallel_stack_parity_ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/extraction_review_gate.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Extraction-owned autonomous review wrapper: one review plus two challenges.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+CONTROLLER="$SCRIPT_DIR/../../code-review/scripts/review_gate.sh"
+
+for arg in "$@"; do
+  case "$arg" in
+    --challenge-b*)
+      echo "extraction_review_gate_error: challenge budget is fixed at 2" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [[ ! -x "$CONTROLLER" ]]; then
+  echo "extraction_review_gate_error: code-review controller is unavailable" >&2
+  exit 2
+fi
+
+exec bash "$CONTROLLER" --challenge-budget 2 "$@"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/impact-chain-gate.rb

@@ -132,6 +132,7 @@ upstream_owner_skills = %w[
   llm-inference-integration
   multi-agent-delegation
   multi-perspective-research
+  nodejs-service-dev
   platform-observability
   platform-release-engineering
   platform-service-connectivity
@@ -292,8 +293,10 @@ upstream = upstream.reject do |path|
   rename_excused[path] = true if excused
   excused
 end
-# The block runs when a selected owner changed (there is something to demand) OR
-# when the ledger itself changed (there is something to validate). It used to
+# The block runs when a selected owner changed (there is something to demand),
+# when any skill entrypoint changed (its description may owe routing-bank
+# evidence), OR when the ledger itself changed (there is something to validate).
+# It used to
 # gate on `upstream.any?` alone, which is the demand side only — and that is the
 # other half of the restored-owner hole: revert the owner and the range has no
 # changed owner at all, so the entire row evaluation was skipped and the
@@ -303,7 +306,10 @@ end
 # `eval/routing-tasks.jsonl` changes no owner package and need not touch the
 # ledger, so without this the whole block — including the bank-evidence
 # obligation written for exactly that change — was never entered.
-if upstream.any? || changed_paths.include?(LEDGER_PATH) || changed_paths.include?("eval/routing-tasks.jsonl")
+routing_entrypoint_changed = changed_paths.any? do |path|
+  path.match?(%r{\Askills/[^/]+/SKILL\.md\z})
+end
+if upstream.any? || routing_entrypoint_changed || changed_paths.include?(LEDGER_PATH) || changed_paths.include?("eval/routing-tasks.jsonl")
   # Rows are collected PER ROUND and carry the scope they were authored against,
   # so the classifiers below judge a row against its own round's diff. Reading the
   # cumulative register diff instead would re-judge every earlier round's rows
@@ -1564,6 +1570,13 @@ if upstream.any? || changed_paths.include?(LEDGER_PATH) || changed_paths.include
   round_bounds.each do |span_base, span_head|
     scope = scope_at.call(span_base, span_head)
     scope_rows = rows.select { |row| row[:scope].head == span_head }
+    # Routing-bank evidence applies to every skill description, not only to the
+    # curated impact-chain owners. Keep a separate vocabulary for this one
+    # obligation so broadening bank coverage cannot broaden the impact-chain
+    # subject set or its row refusals.
+    bank_owner_names = (
+      owner_names_at.call(scope.base) + owner_names_at.call(scope.head)
+    ).uniq
     # Same head-declared-grammar rule as `result-class` above, and for the same
     # reason: the paragraph that defines `bank-evidence` also dates it.
     next unless grammar_declared_at.call(scope.head)
@@ -1578,6 +1591,13 @@ if upstream.any? || changed_paths.include?(LEDGER_PATH) || changed_paths.include
     # being silently outside the trigger because of how the owner set is built.
     created_surfaces = scope.changed_paths.filter_map do |relative|
       next unless relative.start_with?("skills/") && relative.end_with?("/SKILL.md")
+      # This pickup covers both a brand-new entrypoint and an EXISTING
+      # non-curated skill editing its description — both move the routing
+      # surface. An earlier round bounded it to base-absent entrypoints
+      # because non-curated obligations were undischargeable then; the
+      # bank-only resolver below now binds rows over base+head skill names,
+      # so the obligation is dischargeable and the bound would only reopen
+      # the evidence-free description-edit hole.
       path = relative.sub(%r{\Askills/}, "")
       next if triggered_owners.include?(path)
       next unless description_touched.call(scope, path)
@@ -1623,7 +1643,31 @@ if upstream.any? || changed_paths.include?(LEDGER_PATH) || changed_paths.include
     end
     triggered_owners.each do |path|
       owner = path.sub(%r{/SKILL\.md\z}, "")
-      owner_scope_rows = rows_by_upstream_path[path].select { |row| row[:scope].head == scope.head }
+      owner_scope_rows =
+        if upstream_set[path] || lineage_extra[path]
+          # Preserve the existing selected-owner resolver byte-for-byte: bank
+          # coverage must not weaken or widen impact-chain attribution.
+          rows_by_upstream_path[path].select { |row| row[:scope].head == scope.head }
+        else
+          # Mirror that resolver for bank-only owners. Declaring rows use the
+          # owner-package prefix convention; non-declaring rows keep the prior
+          # exact `<owner>/SKILL.md` convention. A row naming more than one owner
+          # satisfies none of them, so one locator cannot discharge two routing
+          # surfaces.
+          scope_rows.select do |row|
+            declares_impact_chain = row[:behavior].split(";").any? do |fragment|
+              fragment.match?(/\A\s*behavioral-evidence:/i)
+            end
+            candidate_names =
+              if declares_impact_chain
+                bank_owner_names.select { |name| owner_mentioned.call(row[:evidence], name) }
+              else
+                row[:evidence].scan(owner_skill_md_path).flatten.uniq
+                   .select { |name| bank_owner_names.include?(name) }
+              end
+            candidate_names == [owner]
+          end
+        end
       bank_evidence_failures << path unless owner_scope_rows.any? { |row| row_satisfies.call(row, owner) }
     end
     if bank_changed
@@ -1637,6 +1681,7 @@ if upstream.any? || changed_paths.include?(LEDGER_PATH) || changed_paths.include
     warn "impact_chain_bank_evidence_missing: a round that changed the routing surface carries no bank evidence for that owner"
     warn "  note: the routing surface is the SKILL.md frontmatter `description` entry and `#{bank_relative}`. The measurement protocol says it is mandatory, but nothing produced or consumed it, so not running it left no absence to detect — the reviewer saw a candidate, not a gap"
     warn "  fix: add `bank-evidence: command:<changed executable>` or `bank-evidence: file:<changed markdown>#<unique anchor>` to that owner's row; to skip the run deliberately use `bank-evidence: downscoped:<token>` and record the same token in this round's spec, so the downscope is itself an artifact"
+    warn "  note: a row without a `behavioral-evidence:` fragment attributes to its owner only via a bare `<owner>/SKILL.md` citation in the evidence cell — the full `skills/<owner>/SKILL.md` spelling is reserved for locators and does NOT attribute, so a row that looks like valid evidence but cites only the full path never reaches the owner"
     bank_evidence_failures.each { |path| warn "  owes bank evidence: #{path}" }
     exit 1
   end