@erclx/aitk 0.32.0 → 0.33.0

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "aitk",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/bash-script/REQUIREMENT.md

@@ -0,0 +1,36 @@
+---
+name: bash-script
+description: Scope boundary for the interactive script house style and the stream discipline underneath it
+---
+
+# Bash script requirement
+
+## Gap
+
+Without this skill, a session asked for a human-facing shell tool writes one whose frame decoration, log lines, and prompts all land on stdout, so the script cannot be piped and any data it emits arrives mixed with its own presentation.
+
+Three more failures share a cause, which is that an interactive script is written as though a person is always watching. A prompt blocks forever when stdin is not a terminal, which is the shape every CI job and every agent run has. A cancellation path prints both a cancel line and an error, or an exit trap prints a closing frame the success path already printed, so the same run reports twice. And each generated script picks its own icons, casing, and frame characters, so a folder of them reads as several unrelated tools.
+
+The visual conventions this skill fixes are otherwise arbitrary. Their value is that they are the same across every script, which is a property no individual script can establish for itself.
+
+## Must
+
+- Keep every frame, log line, and prompt on stderr, and reserve stdout for data. `--help` is the one exception, since its consumer is a person rather than a pipe.
+- Guard every prompt on an attached terminal and refuse inside the frame rather than blocking on a read that will never return
+- Give the timeline one owner per exit path, so success, cancellation, and error each close it exactly once
+- Copy the shared templates rather than restating them, keeping only the colors and functions the script uses
+
+## Must not
+
+- Assert a convention the generated script cannot be checked against by reading it. A rule that cannot be verified from the output is style with no gate behind it.
+- Carry a second copy of the timeline, logging, or prompt implementations. The bundled reference is the single copy, and a body that restates it drifts from it.
+
+## Guards
+
+- A request for a script with no human at the terminal stops and routes to `cli-script` rather than generating a timeline nothing will render
+
+## Out of scope
+
+- Non-interactive automation, CI, and agent-run scripts: `cli-script`, which keeps the error handling and the stdout contract and drops the timeline, the icons, and the prompts
+- GitHub Actions workflow files: `ci-workflow`
+- What the generated script does. This skill fixes the shape of the output and the stream it goes to, and the commands belong to the request.

package/claude/skills/ci-workflow/REQUIREMENT.md

@@ -0,0 +1,35 @@
+---
+name: ci-workflow
+description: Scope boundary for pipeline structure against job contents, and the reproducibility rules under it
+---
+
+# CI workflow requirement
+
+## Gap
+
+Without this skill, a session writes a pipeline whose jobs run in sequence because `needs` was used to express the order a person reads them in rather than a data dependency. The pipeline then costs the sum of its jobs where it could have cost the longest one, and the waste compounds on every push.
+
+The rest are reproducibility failures that surface as flakes. An action pinned to a moving ref changes under the project, so a run that passed yesterday fails today with no commit behind it and the diff explains nothing. A cache keyed on a static string serves a stale browser or toolchain after a version bump, and the failure reads as a broken test rather than a stale cache. Artifacts upload on every run and never expire, so storage grows with the commit count while the ones worth reading are the failures. And a workflow with no manual trigger can only be reproduced by pushing a commit, which is the wrong instrument for a run that failed for an environmental reason.
+
+## Must
+
+- Gate a job only on a data dependency or on a cost that justifies the wait, and leave every other job parallel
+- Pin every action to a tag that cannot cross a major version
+- Key a cache on the version string of the thing it caches
+- Give every workflow a manual trigger beside its primary one
+- Bound artifact upload to failures and set an expiry on it
+
+## Must not
+
+- Own what runs inside a job. The build, test, and deploy commands come from the project, and a workflow asserting its own is a second copy of the project's scripts.
+- Enumerate the job set as a fixed list. Projects add and remove jobs, and what has to survive that is the parallel and gated structure rather than the roster.
+
+## Guards
+
+- A request for a deploy, publish, or release step stops at the gate. The job's contents carry credentials and an environment this skill cannot see, so it emits the `needs` wiring and names what the caller has to fill in rather than guessing a deploy command.
+
+## Out of scope
+
+- The shell scripts a job invokes: `cli-script`
+- Secrets, environments, and deploy targets, which live in the repository settings rather than in the workflow this skill writes
+- CI systems other than GitHub Actions. The structure rules generalize and the file format does not, so a different system is a different skill rather than a flag on this one.

package/claude/skills/claude-seed-sync/REQUIREMENT.md

@@ -0,0 +1,40 @@
+---
+name: claude-seed-sync
+description: Scope boundary for section-granular seed reconciliation against the bulk install and sync commands
+---
+
+# Claude seed sync requirement
+
+## Gap
+
+Without this skill, a project that edited an installed seed or standard has two ways to take an upstream change and both lose something. `aitk standards install` overwrites every file, so the edits are gone with no record of what they were. `aitk standards sync` updates only files it already finds and adds none, so a standard written after the project installed never arrives at all. Neither can deliver one upstream section into a file the project has customized, which is the case a grown project is always in.
+
+A whole-file diff does not close it either. It cannot separate a section the user rewrote on purpose from a section the toolkit moved on without them, so the choice reaches the user as accept everything or lose everything, and the safe answer is always to skip.
+
+Two failures belong to the audit rather than to the diff. A decision taken in chat dies with the session, so an audit half applied cannot be resumed and the second run starts over. And a file the toolkit generates rather than ships, such as an index rebuilt from sibling frontmatter, is absent from every source catalog by design, so a naive comparison reports it as a local addition and invites the user to reconcile something nothing owns.
+
+## Must
+
+- Read seed and standard content from the CLI rather than holding a copy, so the audit and the install cannot disagree
+- Diff per section, treating the preamble as a section of its own
+- Separate a customized section from a stale one, and default the customized one to no action
+- Persist the proposal and every decision to a review file that stays the source of truth across re-pings
+- Apply one section at a time, never by rewriting a file
+
+## Must not
+
+- Propose removing a section present only in the target. Those are the customizations the skill exists to preserve.
+- Write a target file before a decision is recorded against the item
+- Read an empty decision slot as consent
+
+## Guards
+
+- No `aitk` on PATH, or no `.claude/` directory at the project root, stops before any read
+
+## Out of scope
+
+- Bulk install and sync of a whole domain, which `aitk <domain> install` and `aitk <domain> sync` own and `toolkit-cli` documents. Reach for this skill when the target holds edits worth keeping, and for those commands when it does not.
+- Golden configs, which overwrite by design and carry no section structure to diff
+- Governance rules: `aitk gov sync`
+- First-time scaffold of a project that has installed nothing yet: `setup-init`
+- Public `README.md` and `docs/` prose: `docs-sync`

package/claude/skills/docs-sync/REQUIREMENT.md

@@ -0,0 +1,38 @@
+---
+name: docs-sync
+description: Scope boundary for consumer-facing prose against the agent-facing docs the ship chain syncs beside it
+---
+
+# Docs sync requirement
+
+## Gap
+
+Without this skill, a rename or a dropped flag ships with the README still describing the old surface. Nothing fails, because no test reads prose, so the doc stays wrong until a person hits it.
+
+Three failures belong to the sync itself rather than to the drift. A session that syncs by rewriting whole files churns sections the change never reached, which costs the reviewer the ability to tell the sync from the feature. A doc edited earlier in the same session reads as current while a later change leaves one of its sections stale, so file-level classification passes where section-level would not. And a hardcoded doc list never checks the file someone added after the list was written.
+
+The quiet one is the baseline. A diff resolved against a bare local ref equals HEAD on `main` and on a branch before its first commit, so every committed change drops out of the set. The skill then reports nothing to sync, which reads as a clean result rather than as an admission that it could not see the work.
+
+## Must
+
+- Resolve one merge base, prefer the remote ref over the local one, and reuse it everywhere the skill reads the diff
+- Say so in the output when the baseline degrades, rather than reporting a clean pass off a set it could not build
+- Discover the doc set by glob at run time
+- Classify and rewrite at section level, so a partly stale file is partly rewritten
+- Write immediately after the preview, since the tool permission dialog is the confirmation gate
+
+## Must not
+
+- Touch a section the change does not reach
+- Rewrite a doc to match the diff when the doc records an intent the diff departed from. That is a finding rather than a sync.
+
+## Guards
+
+- No committed change and no working-tree change stops the skill before it reads any doc
+
+## Out of scope
+
+- `.claude/` planning docs, tasks, plans, and context entries: `claude-docs`, which runs immediately before this skill in the ship chain and resolves the same baseline. The split is by audience, so a file's location decides which skill owns it rather than its subject.
+- `CLAUDE.md` and the installed seed docs: `claude-seed-sync`, which reconciles them per section against the toolkit source
+- Changelog entries, which release tooling generates from commit messages
+- Whether the prose conforms to its standards. `claude-standards-audit` reports violations and fixes none, and this skill writes prose it does not audit.

package/docs/agents.md

@@ -399,6 +399,8 @@ The table check reports a catalog that grows a row per shipped thing, not a tabl
 
 The provenance check reports the markers narrating how a domain reached its shape rather than describing what it is: a date, a change number, or a release label. The standard admits a rejected alternative and the reasoning that killed it while refusing the provenance attached to it, so a marker names a line to read rather than a line to delete. Findings group by entry and sort left to right within a line, since what a reader acts on is which file to open. Fenced blocks are excluded, which keeps a pinned version in an install command from reading as a claim the entry makes. Frontmatter is excluded with them, since the content checks read the body alone, and that is what keeps a diagram entry's dated `verified` stamp a record of its last check rather than a marker to settle. Length is the exception, counting the whole file, so a reader applying the 150-rendered-line checkpoint against the body alone lands a few lines under what the tool reports.
 
+This one check covers `.claude/context/` alone, while length, depth, and the table finding reach every audited folder. The rule is stated in `.claude/standards/context.md`, which opens its scope by handing diagrams and wireframes to `diagrams.md` and `wireframes.md`, and the sibling standards do not restate it. A marker reported in a diagram entry would cite a rule that entry's own standard routes elsewhere. The split is between kinds of rule rather than kinds of folder: a threshold on how far a reader travels generalizes across entry types, while a rule about what an entry may say is the jurisdiction a scope statement exists to settle. The scoping key is the folder an entry was audited under, so `--folder` still reaches a folder the default list does not carry, and a domain split into `context/<sub-area>/` is governed as `context`. Every run states the reach, including a run where no audited folder is the governed one. The JSON record carries it as `checkpoints.provenanceFolder` and a per-folder `governsContent`.
+
 Index drift compares an index against its siblings in both directions. An entry the index does not link is invisible to a session choosing what to open, and a linked name resolving to nothing sends one to a path that opens nothing.
 
 ### The citation gate
@@ -413,15 +415,15 @@ What remains is a sentence naming a hypothetical entry to show the shape of a na
 
 Use these to discover what's available instead of hardcoding names.
 
-| Command                          | Returns                                      |
-| -------------------------------- | -------------------------------------------- |
-| `aitk tooling list --json`       | Stacks, extends chain, dep and script counts |
-| `aitk snippets list --json`      | Presets and categories with their slugs      |
-| `aitk standards list --json`     | Standards docs and the paths each governs    |
-| `aitk gov list --json`           | Governance stacks and rule sets              |
-| `aitk claude seeds list --json`  | Seed doc sources with content                |
-| `aitk claude skills list --json` | Plugin skills with their descriptions        |
-| `aitk docs list --json`          | Consumer docs plus per-domain context        |
+| Command                          | Returns                                       |
+| -------------------------------- | --------------------------------------------- |
+| `aitk tooling list --json`       | Stacks, extends chain, dep and script counts  |
+| `aitk snippets list --json`      | Presets and categories with their slugs       |
+| `aitk standards list --json`     | Standards docs and the paths each governs     |
+| `aitk gov list --json`           | Governance stacks and rule sets               |
+| `aitk claude seeds list --json`  | Seed doc sources with content                 |
+| `aitk claude skills list --json` | Plugin skills, descriptions, requirement flag |
+| `aitk docs list --json`          | Consumer docs plus per-domain context         |
 
 Every catalog serializes through `JSON.stringify`, so a name carrying a quote
 emits valid JSON. `aitk tooling list` and `aitk snippets list` previously built
@@ -448,6 +450,12 @@ or unparseable returns an empty description rather than failing the listing, so
 one malformed file cannot hide the rest of the catalog. `--names` emits skill
 names one per line.
 
+Each entry also carries `requirement`, whether the folder holds a sibling
+`REQUIREMENT.md`. Coverage of that file is selective by design, so a `false` is
+not a gap to close and the flag answers which skills carry one without a caller
+listing the directory itself. It says nothing about why, which is a judgment the
+toolkit records against its own corpus rather than in the catalog.
+
 ## Non-interactive examples
 
 ```bash

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/aitk",
   "type": "module",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/src/claude/skills-list.ts

@@ -6,6 +6,7 @@ const FRONTMATTER = /^---\n([\s\S]*?)\n---/
 export interface SkillListing {
   readonly name: string
   readonly description: string
+  readonly requirement: boolean
 }
 
 /**
@@ -15,6 +16,10 @@ export interface SkillListing {
  *
  * The folder name wins over the frontmatter `name` when they disagree, because
  * Claude Code invokes a skill by its directory.
+ *
+ * `requirement` reports whether the folder carries `REQUIREMENT.md`. Coverage is
+ * selective by design, so a false is not a gap to close and this field carries no
+ * reason for one. The toolkit records those separately from the catalog.
  */
 export function listSkills(root: string): SkillListing[] {
   const skillsRoot = join(root, 'claude', 'skills')
@@ -30,6 +35,7 @@ export function listSkills(root: string): SkillListing[] {
   return paths.map((path) => ({
     name: dirname(path),
     description: readDescription(join(skillsRoot, path)),
+    requirement: existsSync(join(skillsRoot, dirname(path), 'REQUIREMENT.md')),
   }))
 }
 

package/src/commands/context.ts

@@ -2,9 +2,11 @@ import { resolve } from 'node:path'
 import type { Command } from 'commander'
 import {
   type EntryReport,
+  governsContent,
   LENGTH_CHECKPOINT,
   measureFolders,
   PEER_BULLET_CHECKPOINT,
+  PROVENANCE_FOLDER,
   RENDER_WIDTH,
   RUN_CHECKPOINT,
 } from '@/context/audit'
@@ -90,8 +92,8 @@ function parseFolders(list: string | undefined): string[] | string {
 
   if (names.length === 0) return 'Empty --folder list. Pass at least one name.'
 
-  // `..` would resolve the audit root above `.claude/`, where `presentNames`
-  // has no folder name to slice out and hands the citation pattern undefined.
+  // `..` would resolve the audited folder above `.claude/`, taking the scan
+  // and the citation pattern outside the tree the audit describes.
   const invalid = names.filter((name) => !FOLDER_NAME.test(name))
   if (invalid.length > 0) {
     return `--folder takes folder names under .claude/, not paths: ${invalid.join(', ')}`
@@ -138,7 +140,7 @@ async function runAudit(
     reportLength(entries)
     reportDepth(entries)
     reportTables(entries)
-    reportProvenance(entries)
+    reportProvenance(entries, folders)
     reportDrift(drift)
     outro()
   }
@@ -150,6 +152,7 @@ async function runAudit(
         folders: folders.map((folder) => ({
           path: folder.rel,
           entries: folder.entries.length,
+          governsContent: governsContent(folder),
         })),
         citations: {
           scanned: citations.scanned,
@@ -164,6 +167,7 @@ async function runAudit(
           runCountsBlankLines: true,
           renderWidth: RENDER_WIDTH,
           peerBullet: PEER_BULLET_CHECKPOINT,
+          provenanceFolder: PROVENANCE_FOLDER,
         },
       })}\n`,
     )
@@ -332,9 +336,28 @@ function reportTables(entries: readonly EntryReport[]): void {
  * time, and a flat list of those buries the entries holding one. What a reader
  * acts on is which file to open, so the count sits beside the name and the
  * lines follow it.
+ *
+ * The reach is stated on every run, including the run where nothing is in
+ * scope. A check that covered three folders and now covers one reads as quietly
+ * missing things unless the report says which folder it measured.
  */
-function reportProvenance(entries: readonly EntryReport[]): void {
+function reportProvenance(
+  entries: readonly EntryReport[],
+  folders: readonly AuditedFolder[],
+): void {
   logStep('Provenance')
+
+  const governed = folders.filter(governsContent)
+  if (governed.length === 0) {
+    logInfo(
+      `Out of scope. The rule is stated in the standard governing .claude/${PROVENANCE_FOLDER}/, and no audited folder is that one.`,
+    )
+    return
+  }
+
+  logInfo(
+    `Covers .claude/${PROVENANCE_FOLDER}/ alone, whose standard carries the rule. The sibling standards do not restate it.`,
+  )
   logInfo('Fenced blocks are excluded. A marker is a judgment, never a defect.')
 
   const carrying = entries

package/src/context/audit.ts

@@ -61,6 +61,25 @@ const PROVENANCE: readonly { kind: ProvenanceKind; pattern: RegExp }[] = [
   { kind: 'release', pattern: /\bv\d+\.\d+(?:\.\d+)?\b/g },
 ]
 
+/**
+ * The folder whose standard carries the exclusion above.
+ *
+ * `standards/context.md` opens its scope by handing diagrams and wireframes to
+ * `diagrams.md` and `wireframes.md`, so a marker reported in either would cite
+ * a rule that entry's own standard routes elsewhere. The length, depth, and
+ * table checkpoints are quoted from the same standard and keep reaching every
+ * audited folder, because a threshold on how far a reader travels generalizes
+ * across entry types while a rule about what an entry may say does not.
+ *
+ * Restating the exclusion in the sibling standards was the alternative. It
+ * duplicates one knowledge item across three surfaces, which the root
+ * instruction file forbids, and pointing is not available because the surface
+ * they would point at is the one disclaiming them. Should a diagram entry ever
+ * accumulate narration, the escalation is an attribute standard owning the rule
+ * across document types, not restoring this reach without an owner.
+ */
+export const PROVENANCE_FOLDER = 'context'
+
 export type ProvenanceKind = 'date' | 'change' | 'release'
 
 export interface TableFinding {
@@ -95,6 +114,7 @@ export interface EntryReport {
   /** First line of the longest run, or 0 when the entry has no run at all. */
   readonly longestRunLine: number
   readonly catalogTables: readonly TableFinding[]
+  /** Empty for an entry no standard bans a change narrative in. */
   readonly provenance: readonly ProvenanceFinding[]
 }
 
@@ -320,7 +340,18 @@ function provenance(lines: readonly BodyLine[]): ProvenanceFinding[] {
     .map((each) => each.finding)
 }
 
-export function measureEntry(rel: string, source: string): EntryReport {
+/**
+ * Measures one entry, scanning for provenance only when a standard claims it.
+ *
+ * The caller passes jurisdiction rather than deriving it from `rel`, because a
+ * path prefix hardcodes what `--folder` exists to override and misses a domain
+ * split into `context/<sub-area>/`.
+ */
+export function measureEntry(
+  rel: string,
+  source: string,
+  governsContent = true,
+): EntryReport {
   const lines = bodyLines(source)
   const run = longestRun(lines)
 
@@ -333,7 +364,7 @@ export function measureEntry(rel: string, source: string): EntryReport {
     longestRun: run.length,
     longestRunLine: run.line,
     catalogTables: catalogTables(lines),
-    provenance: provenance(lines),
+    provenance: governsContent ? provenance(lines) : [],
   }
 }
 
@@ -341,6 +372,9 @@ export function measureEntry(rel: string, source: string): EntryReport {
  * Measures every entry in the audited folders. A generated `index.md` is not
  * among them, since its body is rewritten on every regen and no checkpoint
  * describes a catalog.
+ *
+ * Jurisdiction is applied here rather than at the report, so the JSON record
+ * and the printed run agree on which entries a content rule reached.
  */
 export async function measureFolders(
   root: string,
@@ -351,10 +385,19 @@ export async function measureFolders(
   for (const folder of folders) {
     for (const path of folder.entries) {
       reports.push(
-        measureEntry(relative(root, path), await readFile(path, 'utf8')),
+        measureEntry(
+          relative(root, path),
+          await readFile(path, 'utf8'),
+          governsContent(folder),
+        ),
       )
     }
   }
 
   return reports
 }
+
+/** Reports whether the folder's standard is the one carrying the exclusion. */
+export function governsContent(folder: AuditedFolder): boolean {
+  return folder.name === PROVENANCE_FOLDER
+}

package/src/context/folders.ts

@@ -18,6 +18,13 @@ export const DEFAULT_FOLDERS: readonly string[] = [
 ]
 
 export interface AuditedFolder {
+  /**
+   * The requested folder name this was resolved under, which is what says
+   * which standard governs the entries. A nested split folder carries the name
+   * of the folder it sits beneath rather than its own, so
+   * `.claude/context/claude-plugin` is governed as `context`.
+   */
+  readonly name: string
   /** Repo-relative folder path, used verbatim in every report line. */
   readonly rel: string
   readonly indexPath: string
@@ -35,7 +42,7 @@ export interface AuditedFolder {
  * here for the sole reason that this repository has no wireframes.
  */
 export function presentNames(folders: readonly AuditedFolder[]): string[] {
-  return [...new Set(folders.map((folder) => folder.rel.split('/')[1]))]
+  return [...new Set(folders.map((folder) => folder.name))]
 }
 
 async function readEntries(dir: string): Promise<string[]> {
@@ -80,6 +87,7 @@ export async function resolveFolders(
 
     for (const each of [...new Set(dirs)].sort()) {
       folders.push({
+        name,
         rel: relative(root, each),
         indexPath: `${each}/${INDEX_FILE}`,
         entries: await readEntries(each),

package/standards/tasks.md

@@ -48,7 +48,33 @@ Readiness is three groups under fixed headings, `## Run now`, `## Up next`, and
 - `## Up next`: a written plan exists, and the task either collides with something running or waits on another task to land. The blocker column names which.
 - `## Needs a plan`: everything else. The task has no plan, or the plan it carries no longer describes the work.
 
-Each group fixes its own columns, which follow from the test above it rather than from preference. `## Run now` carries `Task`, `Touches`, and `Plan`, since neither half of its test is checkable without the last two. `## Up next` carries `Task`, `Touches`, and `Waiting on`, the last naming whether a collision or a dependency holds it. `## Needs a plan` carries `Task` and `Waiting on` alone, because a task with no plan has no bounded file set to state.
+Each group fixes its own columns, which follow from the test above it rather than from preference. Neither half of the `## Run now` test is checkable without the file set and the plan sitting beside the task. The blocker column under `## Up next` names whether a collision or a dependency holds the row. `## Needs a plan` states no file set at all, because a task with no plan has no bounded one to state. A group with no rows keeps its heading and its header row.
+
+```markdown
+---
+title: Priority
+description: One line on what the board covers
+---
+
+# Priority
+
+## Run now
+
+| Task                            | Touches                 | Plan                                 |
+| ------------------------------- | ----------------------- | ------------------------------------ |
+| [vXX.Y <slug>](vXX.Y-<slug>.md) | <what the task touches> | [<slug>](../plans/feature-<slug>.md) |
+
+## Up next
+
+| Task | Touches | Waiting on |
+| ---- | ------- | ---------- |
+
+## Needs a plan
+
+| Task                            | Waiting on                              |
+| ------------------------------- | --------------------------------------- |
+| [vXX.Y <slug>](vXX.Y-<slug>.md) | <the collision or the task it waits on> |
+```
 
 The tests live here so the board does not carry them. Writing them as a sentence under each heading produces the paragraph the rule above deletes, and a criterion with no home gets restated from memory every time the board is touched.