@csark0812/skeleton 4.0.1 → 4.0.2

package/README.md

@@ -2,7 +2,7 @@
 
 <!-- source-of-truth: Package overview -->
 
-<!-- doc-meta: owner=eng | last-reviewed=2026-09-02 -->
+<!-- doc-meta: owner=eng | last-reviewed=2026-09-13 -->
 
 <!-- review-deps: paths=src/cli.ts,package.json -->
 
@@ -157,15 +157,15 @@ skeleton customize resolve <slug>
 | Path                                                                                | Action                                        |
 | ----------------------------------------------------------------------------------- | --------------------------------------------- |
 | Docs in scan perimeter                                                              | path-scoped audit                             |
-| Owned skill bodies (`SKILL.md` trees)                                               | exit 1 → run `audit skills`                   |
+| Owned skill bodies (`SKILL.md` trees)                                               | run `audit skills`                            |
 | Foreign / lockfile-synced skill bodies                                              | skip → lint in the owning skills/toolbox repo |
 | `.sh`, `.bash`, `.zsh`                                                              | shellcheck or `bash -n`                       |
 | Other `.json`                                                                       | JSONC-tolerant syntax check                   |
 | Any repository file                                                                 | native gates where applicable + audit documents whose `review-deps` path or glob matched |
 
-Pre-commit: `skeleton validate changed --staged` (path-scoped, fast).
+Pre-commit: `skeleton validate changed --staged` (index bytes, coverage, owning papers).
 
-CI: `skeleton validate changed --base origin/main` (global rules first, then changed files).
+CI: `skeleton validate changed --base origin/main` (global rules first, then changed files, same coverage fail).
 
 ## Ecosystem
 
@@ -200,8 +200,8 @@ bun run check
 
 `bun run check` = lint + test + typecheck + build + `audit:self`.
 
-`validate:changed` does not replace code tests. It classifies code separately and also audits every scanned document whose `review-deps` declaration matches a changed file. Owned skill-body edits need `audit skills`. Code-only changes with no linked document still exit non-zero locally and point to native gates.
+`validate:changed` does not replace code tests. It classifies code separately and also audits every scanned document whose `review-deps` declaration matches a changed file. A coverage-candidate path with no owning paper fails on local and CI runs. Owned skill-body edits run the skills suite. `--staged` reads git index bytes.
 
 For code: `bun test`, `bun run typecheck`, `bun run build`.
 
-Optional: `brew install pre-commit` (or `pipx install pre-commit`), then `pre-commit install` to wire `.pre-commit-config.yaml`.
+`skeleton init` writes `.pre-commit-config.yaml`. Install [pre-commit](https://pre-commit.com/) once (`brew install pre-commit` or `pipx install pre-commit`), then `pre-commit install`.

package/dist/audit/config/types.d.ts

@@ -24,6 +24,13 @@ export interface SkillOwnershipConfig {
     /** Force these slugs foreign even if absent from the lockfile / local. */
     foreignSlugs?: string[];
 }
+/** Files that must appear in at least one scanned document's review-deps. */
+export interface ReviewCoverageConfig {
+    /** Repo-relative globs that require an owning paper. Empty include disables the gate. */
+    include?: string[];
+    /** Globs removed from the coverage set. */
+    exclude?: string[];
+}
 /** Verifiable evidence that a human review covered exact document and code bytes. */
 export interface ReviewProofConfig {
     /** Hash mode stores reviewed document and code-target digests in a lockfile. */
@@ -54,6 +61,7 @@ export interface SkeletonConfig {
     customize?: CustomizeConfig;
     skillOwnership?: SkillOwnershipConfig;
     reviewProof?: ReviewProofConfig;
+    reviewCoverage?: ReviewCoverageConfig;
     docsLint?: DocsLintConfig;
     /**
      * Plugin entry paths relative to `.skeleton/` (e.g. `plugins/example.ts`).

package/dist/audit/core/context.d.ts

@@ -1,5 +1,6 @@
 import type { SkeletonConfig } from "../config/types.ts";
 import type { PolicyFile } from "../policies/types.ts";
+import type { FileSource } from "./repo-files.ts";
 import { type SkillIndex } from "./skill-roots.ts";
 import type { SsotForm } from "./ssot.ts";
 import { type SsotFileEntry } from "./ssot-collect.ts";
@@ -30,6 +31,8 @@ export interface AuditContext {
     lockedSkillSlugs: Set<string>;
     /** Compiled prose policies from plugins (empty when no plugins / no policy globs). */
     policies: PolicyFile[];
+    /** Read document and dependency bytes from the worktree or the git index. */
+    fileSource?: FileSource;
 }
 export interface AuditOptions {
     root?: string;
@@ -42,5 +45,7 @@ export interface AuditOptions {
      * matches path-scoped / validate `--base` prove.
      */
     includeExcludedSkillTrees?: boolean;
+    /** When `index`, review-proof and coverage reads use `git show :path`. */
+    fileSource?: FileSource;
 }
 export declare function createContext(options?: AuditOptions): AuditContext;

package/dist/audit/core/repo-files.d.ts

@@ -0,0 +1,5 @@
+export type FileSource = "worktree" | "index";
+/** Read a repo-relative file from the worktree or the git index. */
+export declare function readRepoText(root: string, relPath: string, source?: FileSource): string | null;
+/** True when worktree bytes differ from HEAD, including new untracked files. */
+export declare function pathDiffersFromHead(root: string, relPath: string): boolean;

package/dist/audit/core/report.d.ts

@@ -29,3 +29,4 @@ export declare function issue(rule: string, file: string, details: string | Issu
 export declare function issue(rule: string, file: string, message: string, options?: IssueOptions): Issue;
 export declare function finalizeIssues(issues: Issue[], strict: boolean): Issue[];
 export declare function printReport(issues: Issue[], options: ReportOptions): number;
+export declare function isRereadIssue(item: Issue): boolean;

package/dist/audit/core/review-coverage.d.ts

@@ -0,0 +1,18 @@
+import type { SkeletonConfig } from "../config/types.ts";
+import { type FileSource } from "./repo-files.ts";
+import type { SkillIndex } from "./skill-roots.ts";
+export declare const DEFAULT_REVIEW_COVERAGE_INCLUDE: string[];
+export declare const DEFAULT_REVIEW_COVERAGE_EXCLUDE: string[];
+export declare function reviewCoveragePatterns(config: SkeletonConfig): {
+    include: string[];
+    exclude: string[];
+};
+export declare function pathRequiresReviewCoverage(relPath: string, config: SkeletonConfig): boolean;
+export declare function collectReviewDependencyPatterns(input: {
+    root: string;
+    config: SkeletonConfig;
+    skillIndex: SkillIndex;
+    fileSource?: FileSource;
+}): string[];
+export declare function pathHasReviewOwner(relPath: string, patterns: string[]): boolean;
+export declare function collectReviewCoverageFiles(root: string, config: SkeletonConfig): string[];

package/dist/audit/rules/review-coverage.d.ts

@@ -0,0 +1,8 @@
+import type { AuditContext } from "../core/context.ts";
+import { type Issue } from "../core/report.ts";
+export declare function runReviewCoverageRule(ctx: AuditContext): Issue[];
+export declare const reviewCoverageRule: {
+    id: string;
+    global: boolean;
+    run: typeof runReviewCoverageRule;
+};