@rhize/skill-forge 0.11.0 → 0.11.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -0
- package/dist/cli.js +405 -253
- package/dist/cli.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -611,6 +611,12 @@ Works for both artifact types: a held MCP candidate is re-gated as an MCP server
|
|
|
611
611
|
your MCP config (`--mcp-target`), with env values emptied and unpinned `npx` specs pinned, exactly
|
|
612
612
|
as `add --artifact mcp` would.
|
|
613
613
|
|
|
614
|
+
Promotion also re-validates the candidate against the state it was gated in: each skill dir must
|
|
615
|
+
still be a real directory rather than a symlink, no symlink inside it may resolve out of the
|
|
616
|
+
sandbox, and its content digest must still match the one captured at gate time. Otherwise the gap
|
|
617
|
+
between "scanned" and "installed" — days, for a hold — is a window in which vetted content can be
|
|
618
|
+
swapped for something that never passed the gate.
|
|
619
|
+
|
|
614
620
|
`promote` **re-gates** rather than promoting blind. The original run's gate result was never
|
|
615
621
|
persisted, so the alternative would be a queue entry with a fabricated gate record — and a hold
|
|
616
622
|
may be days old, with the ruleset and your installed set since changed. Re-scanning is static and
|