@csark0812/skeleton 2.0.0 → 3.0.1

package/README.md

@@ -2,9 +2,9 @@
 
 <!-- source-of-truth: Package overview -->
 
-<!-- doc-meta: owner=eng | last-reviewed=2026-08-19 -->
+<!-- doc-meta: owner=eng | last-reviewed=2026-08-31 -->
 
-<!-- code-fit: targets=src/cli.ts surface=audit,validate,catalog,init,build-plugin,references -->
+<!-- review-deps: paths=src/cli.ts,package.json -->
 
 Agent repos get messy fast. Skills get copied around, docs disagree, links go stale, and nobody remembers which file is actually canonical.
 
@@ -23,7 +23,7 @@ That needs to be explicit — and stay true after the next 50 PRs. Skeleton turn
 | Code repos                                              | Agent repos                                                                            |
 | ------------------------------------------------------- | -------------------------------------------------------------------------------------- |
 | ESLint catches broken imports, unused vars, style drift | Skeleton catches broken links, bad SSOT markers, stale doc-meta, deny.paths artifacts |
-| `eslint --fix` on changed files                         | `skeleton validate changed` on changed docs, skills, and docs linked to changed code   |
+| `eslint --fix` on changed files                         | `skeleton validate changed` on changed docs, skills, and matching document dependencies |
 | Pre-commit + CI gate                                    | `--staged` pre-commit + `--base` CI gate                                               |
 
 Skill linters ask: _"Is this SKILL.md well-formed?"_
@@ -99,8 +99,8 @@ Flag details: [install](docs/developer/install.md).
 - **deny.paths** — globs for files that must not exist (often outside `scan.include`)
 - **Coverage gaps** — markdown outside the scan perimeter (warn-only)
 - **Doc meta + stale dates** — owner and `last-reviewed` on indexes and SSOT-bearing files
-- **Review proof** — optional hashes bind a human review to exact document and `code-fit` target bytes
-- **Code impact routing** — changed source files automatically pull linked documents into validation
+- **Review proof** — optional hashes bind a human review to exact document and `review-deps` bytes
+- **Dependency routing** — changed repository files automatically pull matching documents into validation
 - **Prose policy** (optional plugins) — YAML pattern rules; idle with no plugins
 - **Shell / JSON syntax** — lightweight checks on changed `.sh` and `.json` files
 
@@ -160,8 +160,7 @@ skeleton customize resolve <slug>
 | Foreign / lockfile-synced skill bodies                                              | skip → lint in the owning skills/toolbox repo |
 | `.sh`, `.bash`, `.zsh`                                                              | shellcheck or `bash -n`                       |
 | Other `.json`                                                                       | JSONC-tolerant syntax check                   |
-| `.ts`, `.tsx`, `.js`, `.jsx`, `.mjs`, `.cjs`, `.py`                               | native code gates + audit documents whose `code-fit` target changed |
-| `package.json`, `project.json`                                                     | native code gates (exits 1 if no auditable paths) |
+| Any repository file                                                                 | native gates where applicable + audit documents whose `review-deps` path or glob matched |
 
 Pre-commit: `skeleton validate changed --staged` (path-scoped, fast).
 
@@ -177,7 +176,7 @@ CI: `skeleton validate changed --base origin/main` (global rules first, then cha
 
 Skeleton never calls Nx or another app task runner. Consumer repos keep ownership of test, typecheck, and build.
 
-See [tiers](docs/tiers.md).
+See [tiers](docs/tiers.md). Related work: [Toolbox](https://github.com/csark0812/toolbox) packages portable process skills, and [Christopher's profile](https://github.com/csark0812) connects the broader builder story.
 
 ## Docs
 
@@ -200,7 +199,7 @@ bun run check
 
 `bun run check` = lint + test + typecheck + build + `audit:self`.
 
-`validate:changed` does not replace code tests. It classifies code separately and also audits every scanned document that names a changed file in `code-fit`. Owned skill-body edits need `audit skills`. Code-only changes with no linked document still exit non-zero locally and point to native gates.
+`validate:changed` does not replace code tests. It classifies code separately and also audits every scanned document whose `review-deps` declaration matches a changed file. Owned skill-body edits need `audit skills`. Code-only changes with no linked document still exit non-zero locally and point to native gates.
 
 For code: `bun test`, `bun run typecheck`, `bun run build`.
 

package/dist/audit/config/types.d.ts

@@ -31,7 +31,7 @@ export interface ReviewProofConfig {
     /** Repo-relative proof lockfile (default: .skeleton/review-lock.json). */
     lockfile?: string;
 }
-/** Tunables for near-duplicate, SSOT-summary, and code-fit docs lint. */
+/** Tunables for near-duplicate and SSOT-summary docs lint. */
 export interface DocsLintConfig {
     /** Jaccard threshold on word shingles (0–1). Default 0.72. */
     nearDuplicateThreshold?: number;
@@ -45,13 +45,6 @@ export interface DocsLintConfig {
     ignorePairs?: [string, string][];
     /** Globs excluded from near-dupe / duplicate-SSOT (still catalogued if they have SSOT). */
     ignoreGlobs?: string[];
-    /**
-     * Min fraction of code identifiers that must appear in the doc (code-fit).
-     * Default 0.03 — separate from ssotOverlapMin (doc-grounding vs large modules).
-     */
-    codeFitOverlapMin?: number;
-    /** Max auto-extracted surface names before surface= is required (default 25). */
-    codeFitSurfaceCap?: number;
 }
 export interface SkeletonConfig {
     scan: ScanConfig;

package/dist/audit/core/review-deps.d.ts

@@ -0,0 +1,16 @@
+export interface ReviewDepsMarker {
+    paths: string[];
+    raw: string;
+}
+export interface ResolvedReviewDependencies {
+    patterns: string[];
+    targets: string[];
+}
+/** Parse review dependency markers outside fenced and inline code. */
+export declare function parseReviewDepsMarkers(content: string): ReviewDepsMarker[];
+export declare function reviewDependencyPatterns(content: string): string[];
+export declare function isReviewDependencyGlob(pattern: string): boolean;
+export declare function isSafeReviewDependencyPath(value: string): boolean;
+/** Resolve all declared paths against the repository, without scan-perimeter filtering. */
+export declare function resolveReviewDependencies(root: string, patterns: string[]): ResolvedReviewDependencies;
+export declare function reviewDependencyMatchesPath(pattern: string, relPath: string): boolean;

package/dist/audit/rules/index.d.ts

@@ -6,7 +6,7 @@ export interface AuditRule {
     global?: boolean;
     /**
      * When true, still run under `--paths` / path-scoped validate (globals are skipped).
-     * Used by rules that must re-check the full scan corpus (e.g. code-fit markers).
+     * Used by rules that must re-check the full scan corpus (e.g. review-deps markers).
      */
     alwaysRun?: boolean;
     /** Which audit suites include this rule. Default: `["docs"]`. */

package/dist/audit/rules/review-deps.d.ts

@@ -0,0 +1,9 @@
+import type { AuditContext } from "../core/context.ts";
+import { type Issue } from "../core/report.ts";
+/** Validate opt-in repository dependencies for every scanned document. */
+export declare function runReviewDepsRule(ctx: AuditContext): Issue[];
+export declare const reviewDepsRule: {
+    id: string;
+    alwaysRun: boolean;
+    run: typeof runReviewDepsRule;
+};