@csark0812/skeleton 1.6.0 → 1.6.2

package/README.md

@@ -1,6 +1,6 @@
 # Skeleton
 
-**Source of truth for** Package overview.
+<!-- source-of-truth: Package overview -->
 
 <!-- doc-meta: owner=eng | last-reviewed=2026-08-16 -->
 
@@ -36,7 +36,7 @@ Does an intact Skeleton contract change agent behavior — grounding on the righ
 
 ### What we did
 
-We ran a paired live A/B harness with [`@post-print/agent-test`](https://www.npmjs.com/package/@post-print/agent-test): `skeleton-clean` vs `skeleton-messy`. Same prompts and scenario set; the only intentional difference was registry / conflict structure and context profile.
+We ran a paired live A/B harness with [`@post-print/agent-test`](https://www.npmjs.com/package/@post-print/agent-test): `skeleton-clean` vs `skeleton-messy`. Same prompts and scenario set; the only intentional difference was SSOT / conflict structure and context profile.
 
 Scenarios covered contested grounding (conflicting docs), docs-only validation routing, canonical grounding, owned-skill routing, and customize ownership. Protocol: **N=10** sequential paired compares on 2026-07-17; McNemar on paired pass/fail; median token deltas with a bootstrap CI on the mean.
 
@@ -50,7 +50,7 @@ Full method: [refs/llm-harness.md](refs/llm-harness.md). Suites: [agent-suites/R
 
 On tasks that depend on an intact SSOT, the clean fixture was both more accurate and cheaper:
 
-- **Contested grounding** — In every paired run, clean settled on the registry canonical; messy never did (McNemar p = 0.002). Clean hops the registry; messy thrashes across conflicting docs.
+- **Contested grounding** — In every paired run, clean settled on the SSOT canonical; messy never did (McNemar p = 0.002). Clean hops the catalog/SSOT path; messy thrashes across conflicting docs.
 - **Docs routing** — Clean consistently chose the correct audit lane; messy invented a non-existent `audit all` path (McNemar p = 0.002).
 - **Token cost** — Across grounding tasks, messy used a median **~312k** more tokens than clean (bootstrap 95% CI on the mean excludes 0). Pass rate alone understates the gap: messy can still luck into an answer while spending far more.
 
@@ -94,7 +94,7 @@ Flag details: [install](docs/developer/install.md).
 - **SSOT summary fit** — heuristic overlap between the one-liner and the body (warn / `--strict`)
 - **Link audit** — broken refs, skill links, anchors in scanned markdown
 - **Skill index** — disk matches taxonomy READMEs in detected skill roots
-- **Banned paths** — session artifacts and other files that must not exist
+- **deny.paths** — globs for files that must not exist (often outside `scan.include`)
 - **Coverage gaps** — markdown outside the scan perimeter (warn-only)
 - **Doc meta + stale dates** — owner and `last-reviewed` on indexes and SSOT-bearing files
 - **Prose policy** (optional plugins) — YAML pattern rules; idle with no plugins
@@ -104,27 +104,31 @@ Agents skim `.skeleton/catalog.md` (generated, gitignored) before opening full p
 
 Skeleton doesn't replace your code gates. Keep TypeScript, Python, Nx, pytest, and the rest in the repo that owns them.
 
-## The `.skeleton/` contract
+## The contract
+
+Config lives in **`skeleton.toml`** at the repo root (preferred). Optional under `.skeleton/`:
 
 ```
+skeleton.toml          # scan perimeter, deny.paths, docsLint, …
 .skeleton/
-├── config.yaml      # scan perimeter (required)
-├── registry.md      # topic → canonical file (required)
-├── plugins/         # optional consumer audit plugins (.ts + built .mjs)
-└── customize/       # project-specific skill overrides (optional)
+├── catalog.md         # generated by `skeleton catalog` (gitignored)
+├── plugins/           # optional consumer audit plugins (.ts + built .mjs)
+└── customize/         # project-specific skill overrides (optional)
     └── code-review.md
 ```
 
-Every canonical doc carries a banner:
+Legacy `.skeleton/config.yaml` still loads when no TOML is present.
+
+Every canonical doc opts into the catalog with a marker:
 
 ```markdown
-**Source of truth for** Backend API conventions.
+<!-- source-of-truth: Backend API conventions -->
 ```
 
-Register it:
+Then refresh the agent index:
 
 ```bash
-skeleton register docs/developer/api.md
+skeleton catalog
 ```
 
 Synced skills stay pristine. Project overrides live in `.skeleton/customize/<slug>.md` and inject when the skill is read — no editing copied `SKILL.md` files.
@@ -133,8 +137,8 @@ Synced skills stay pristine. Project overrides live in `.skeleton/customize/<slu
 
 ```bash
 skeleton init [--skills] [--force-hooks]
-skeleton register <path> [--topic=…]
-skeleton audit docs|skills|self [--strict] [--paths=a,b] [--fix[=doc-meta|anchors]] [--dry-run]
+skeleton catalog [--check]
+skeleton audit docs|skills|self [--strict] [--paths=a,b] [--fix[=doc-meta|anchors|ssot]] [--dry-run]
 skeleton build-plugin [path] [--check]
 skeleton validate changed [--staged | --base <ref>] [paths…]
 skeleton references sync|check

package/dist/cli.js

@@ -18446,8 +18446,9 @@ import { relative as relative5 } from "node:path";
 
 // src/audit/core/ssot.ts
 var SSOT_COMMENT_RE = /<!--\s*source-of-truth:\s*([\s\S]*?)\s*-->/gi;
-var SSOT_VISIBLE_LINE_RE = /^\s*source-of-truth:\s*(.+?)\s*$/gim;
-var LEGACY_BANNER_LINE_RE = /^\s*\*\*Source of truth for\*\*\s*(.+?)\s*$/gim;
+var HWS = "[ \\t]*";
+var SSOT_VISIBLE_LINE_RE = new RegExp(`^${HWS}source-of-truth:${HWS}(.+?)${HWS}$`, "gim");
+var LEGACY_BANNER_LINE_RE = new RegExp(`^${HWS}\\*\\*Source of truth for\\*\\*${HWS}(.+?)${HWS}$`, "gim");
 function cleanSummary(raw) {
   return raw.replace(/\s+/g, " ").trim().replace(/\.$/, "").trim();
 }
@@ -30836,7 +30837,7 @@ function checkStaleReview(input) {
   if (ageDays <= staleDays)
     return null;
   return issue("doc-meta", relPath2, {
-    message: `doc-meta last-reviewed ${reviewedStr} is stale (>${staleDays} days)`,
+    message: `doc-meta last-reviewed ${reviewedStr} exceeds re-read cadence (>${staleDays} days) — re-affirm the paper or bump after review`,
     severity: "warning"
   });
 }
@@ -30860,7 +30861,7 @@ function checkGitFreshness(input) {
   if (committed.getTime() <= reviewed.getTime())
     return null;
   return issue("doc-meta", relPath2, {
-    message: `content changed after last-reviewed ${reviewedStr} (git: ${gitDate}) — bump last-reviewed or confirm review`,
+    message: `content changed after last-reviewed ${reviewedStr} (git: ${gitDate}) — review no longer covers latest edit; bump last-reviewed after review`,
     severity: "warning"
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@csark0812/skeleton",
-	"version": "1.6.0",
+	"version": "1.6.2",
 	"description": "SSOT audit CLI for agent harness repos",
 	"type": "module",
 	"bin": {

package/schemas/config.schema.json

@@ -41,7 +41,8 @@
 		},
 		"daysUntilStale": {
 			"type": "integer",
-			"minimum": 1
+			"minimum": 1,
+			"description": "Re-read cadence in days for doc-meta last-reviewed (warn; --strict → error). Separate from git edit-behind-review checks."
 		},
 		"docsLint": {
 			"type": "object",