@rhize/skill-forge 0.11.3 → 0.13.0

package/dist/cli.js

@@ -5,7 +5,7 @@ import { Command } from "commander";
 import { createRequire } from "module";
 
 // src/commands/add.ts
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 
 // src/config.ts
 import { existsSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
@@ -1025,15 +1025,15 @@ function readProvenanceLedger(skillsRoot) {
 import { readdirSync as readdirSync7 } from "fs";
 
 // src/auditState.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
-import { basename as basename7, dirname as dirname5, join as join12 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
+import { basename as basename7, dirname as dirname5, join as join13 } from "path";
 
 // src/audit.ts
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   lstatSync as lstatSync2,
   mkdtempSync,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   readdirSync as readdirSync5,
   realpathSync as realpathSync2,
   renameSync as renameSync3,
@@ -1041,7 +1041,7 @@ import {
   statSync as statSync6,
   writeFileSync as writeFileSync5
 } from "fs";
-import { basename as basename6, delimiter as delimiter3, extname as extname3, join as join11, resolve as resolvePath2 } from "path";
+import { basename as basename6, delimiter as delimiter3, extname as extname3, join as join12, resolve as resolvePath2 } from "path";
 
 // src/gate/safety.ts
 import { statSync as statSync4 } from "fs";
@@ -1165,7 +1165,8 @@ function scanStaticRules(targetPath) {
             severity: refined.severity,
             rule: rule.rule,
             file,
-            detail: `line ${i + 1}: ${refined.message}`
+            detail: `line ${i + 1}: ${refined.message}`,
+            context: lines[i].trim()
           });
         }
       }
@@ -1266,19 +1267,27 @@ function scanJsonConfig(file, parsed) {
     const command = typeof node.command === "string" ? node.command : void 0;
     const args = Array.isArray(node.args) ? node.args.filter((a) => typeof a === "string") : [];
     if (command && isNpxCommand(command)) {
-      const flagIdx = args.findIndex((a) => a === "-y" || a === "--yes");
-      if (flagIdx !== -1) {
-        const { packageFlagSpecs, positionalSpec } = collectNpxPackageSpecs(args);
-        const allSpecs = positionalSpec ? [...packageFlagSpecs, positionalSpec] : packageFlagSpecs;
-        for (const pkgSpec of allSpecs) {
-          if (!isPinnedPackageSpec(pkgSpec)) {
-            findings.push({
-              severity: "MEDIUM",
-              rule: "mcp-unpinned-npx",
-              file,
-              detail: `npx -y ${pkgSpec} is unpinned \u2014 pin an exact version (${packageSpecBase(pkgSpec)}@<version>) so the resolved server code can't change silently`
-            });
-          }
+      const hasYes = args.includes("-y") || args.includes("--yes");
+      const { packageFlagSpecs, positionalSpec } = collectNpxPackageSpecs(args);
+      const allSpecs = positionalSpec ? [...packageFlagSpecs, positionalSpec] : packageFlagSpecs;
+      for (const pkgSpec of allSpecs) {
+        if (isPinnedPackageSpec(pkgSpec)) continue;
+        if (hasYes) {
+          findings.push({
+            severity: "MEDIUM",
+            rule: "mcp-unpinned-npx",
+            file,
+            detail: `npx -y ${pkgSpec} is unpinned \u2014 pin an exact version (${packageSpecBase(pkgSpec)}@<version>) so the resolved server code can't change silently`,
+            context: pkgSpec
+          });
+        } else {
+          findings.push({
+            severity: "LOW",
+            rule: "mcp-unpinned-npx",
+            file,
+            detail: `npx ${pkgSpec} is unpinned \u2014 without -y npx prompts before first install, but once cached the tag still floats to whatever the registry points at; pin ${packageSpecBase(pkgSpec)}@<version>`,
+            context: pkgSpec
+          });
         }
       }
     }
@@ -1288,7 +1297,8 @@ function scanJsonConfig(file, parsed) {
           severity: "HIGH",
           rule: "mcp-dangerous-flag",
           file,
-          detail: `launch arg ${a} disables a safety guard`
+          detail: `launch arg ${a} disables a safety guard`,
+          context: a
         });
       }
       if (a === "/" || a === "~") {
@@ -1296,7 +1306,8 @@ function scanJsonConfig(file, parsed) {
           severity: "MEDIUM",
           rule: "mcp-filesystem-root-arg",
           file,
-          detail: `launch arg "${a}" grants filesystem access at the root/home directory \u2014 scope this to a specific directory`
+          detail: `launch arg "${a}" grants filesystem access at the root/home directory \u2014 scope this to a specific directory`,
+          context: a
         });
       }
     }
@@ -1309,14 +1320,16 @@ function scanJsonConfig(file, parsed) {
             severity: "HIGH",
             rule: "mcp-inline-credential-value",
             file,
-            detail: `env.${key} has an inline credential value \u2014 emit an empty string and document that the user must fill it in`
+            detail: `env.${key} has an inline credential value \u2014 emit an empty string and document that the user must fill it in`,
+            context: `env.${key}`
           });
         } else if (kind === "file-path") {
           findings.push({
             severity: "LOW",
             rule: "mcp-credential-file-path",
             file,
-            detail: `env.${key} points at a credential file rather than an inline secret \u2014 the value leaks nothing, but keep that file out of version control`
+            detail: `env.${key} points at a credential file rather than an inline secret \u2014 the value leaks nothing, but keep that file out of version control`,
+            context: `env.${key}`
           });
         }
       }
@@ -1324,7 +1337,7 @@ function scanJsonConfig(file, parsed) {
   }
   return findings;
 }
-var NPX_SHELL_RE = /\bnpx(?:\.cmd|\.exe)?\s+(?:-y|--yes)\s+((?:@[\w.-]+\/)?[\w.-]+)(@[\w.-]+)?/gi;
+var NPX_SHELL_RE = /\bnpx(?:\.cmd|\.exe)?\s+(?:(-y|--yes)\s+)?((?:@[\w.-]+\/)?[A-Za-z0-9][\w.-]*)(@[\w.-]+)?/gi;
 var DANGEROUS_FLAG_RE = /--dangerously-[\w-]+|--no-sandbox\b/g;
 var CREDENTIAL_ASSIGNMENT_RE = /["']?([A-Za-z][A-Za-z0-9_]*)["']?\s*[:=]\s*["']([^"']{6,})["']/g;
 var CREDENTIAL_ASSIGNMENT_UNQUOTED_RE = /^\s*(?:export\s+|-\s+)?([A-Za-z][A-Za-z0-9_]*)\s*[:=]\s*(\S+)/;
@@ -1343,14 +1356,16 @@ function pushCredentialFinding(findings, file, lineNo, varName, value) {
       severity: "HIGH",
       rule: "mcp-inline-credential-value",
       file,
-      detail: `line ${lineNo}: inline credential value assigned to ${varName}`
+      detail: `line ${lineNo}: inline credential value assigned to ${varName}`,
+      context: varName
     });
   } else if (kind === "file-path") {
     findings.push({
       severity: "LOW",
       rule: "mcp-credential-file-path",
       file,
-      detail: `line ${lineNo}: ${varName} points at a credential file rather than an inline secret \u2014 the value leaks nothing, but keep that file out of version control`
+      detail: `line ${lineNo}: ${varName} points at a credential file rather than an inline secret \u2014 the value leaks nothing, but keep that file out of version control`,
+      context: varName
     });
   }
 }
@@ -1363,15 +1378,28 @@ function scanTextFile(file, content, allowCredentialCheck) {
     NPX_SHELL_RE.lastIndex = 0;
     let m;
     while ((m = NPX_SHELL_RE.exec(line)) !== null) {
-      const pkgSpec = m[1];
-      const versionSuffix = m[2] ?? "";
-      if (!isPinnedPackageSpec(pkgSpec + versionSuffix)) {
-        findings.push({
-          severity: "MEDIUM",
-          rule: "mcp-unpinned-npx",
-          file,
-          detail: `line ${lineNo}: npx -y ${pkgSpec} is unpinned \u2014 pin an exact version (${pkgSpec}@<version>)`
-        });
+      const hasYes = Boolean(m[1]);
+      const pkgSpec = m[2];
+      const versionSuffix = m[3] ?? "";
+      const fullSpec = pkgSpec + versionSuffix;
+      if (!isPinnedPackageSpec(fullSpec)) {
+        if (hasYes) {
+          findings.push({
+            severity: "MEDIUM",
+            rule: "mcp-unpinned-npx",
+            file,
+            detail: `line ${lineNo}: npx -y ${pkgSpec} is unpinned \u2014 pin an exact version (${pkgSpec}@<version>)`,
+            context: fullSpec
+          });
+        } else {
+          findings.push({
+            severity: "LOW",
+            rule: "mcp-unpinned-npx",
+            file,
+            detail: `line ${lineNo}: npx ${pkgSpec} is unpinned \u2014 without -y npx prompts before first install, but once cached the tag still floats to whatever the registry points at; pin ${pkgSpec}@<version>`,
+            context: fullSpec
+          });
+        }
       }
     }
     DANGEROUS_FLAG_RE.lastIndex = 0;
@@ -1624,6 +1652,89 @@ function scanOverlapPaths(skillMdPaths, threshold = DEFAULT_SET_THRESHOLD) {
   return pairs;
 }
 
+// src/findings.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
+var FINGERPRINT_DISPLAY_LENGTH = 12;
+var MIN_FINGERPRINT_PREFIX_LENGTH = 8;
+var FINGERPRINT_HEX_RE = /^[0-9a-f]{64}$/;
+var VALID_SEVERITIES = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
+var CONTROL_CHAR_RE = /[\u0000-\u001F\u007F-\u009F]/;
+function isValidSeverity(value) {
+  return typeof value === "string" && VALID_SEVERITIES.includes(value);
+}
+function fingerprintFinding(f) {
+  return createHash2("sha256").update(`${f.severity}\0${f.rule}\0${f.target}\0${f.context}`).digest("hex");
+}
+function getAcceptedFindingsPath() {
+  return join11(getHomeDir(), "accepted-findings.json");
+}
+function invalidRecordReason(record) {
+  if (typeof record !== "object" || record === null) return "not an object";
+  const r = record;
+  if (typeof r.fingerprint !== "string" || !FINGERPRINT_HEX_RE.test(r.fingerprint)) return "invalid fingerprint";
+  if (!isValidSeverity(r.severity)) return "invalid severity";
+  if (typeof r.rule !== "string" || r.rule.length === 0 || CONTROL_CHAR_RE.test(r.rule)) return "invalid rule";
+  if (typeof r.target !== "string" || r.target.length === 0 || CONTROL_CHAR_RE.test(r.target)) return "invalid target";
+  if (typeof r.context !== "string" || CONTROL_CHAR_RE.test(r.context)) return "invalid context";
+  if (typeof r.detail !== "string" || CONTROL_CHAR_RE.test(r.detail)) return "invalid detail";
+  if (typeof r.reason !== "string" || r.reason.length === 0 || r.reason.length > MAX_PREFERENCE_NOTE_LENGTH || CONTROL_CHAR_RE.test(r.reason)) {
+    return "invalid reason";
+  }
+  if (typeof r.acceptedAt !== "string" || r.acceptedAt.length === 0) return "invalid acceptedAt";
+  if (r.source !== "user") return "invalid source";
+  return void 0;
+}
+function readAcceptedFindings() {
+  const path = getAcceptedFindingsPath();
+  if (!existsSync8(path)) return { records: [], notices: [] };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync8(path, "utf-8"));
+  } catch {
+    return { records: [], notices: ["accepted-findings store unreadable (corrupt JSON) \u2014 nothing suppressed this run"] };
+  }
+  if (typeof parsed !== "object" || parsed === null || parsed.schemaVersion !== 1 || !Array.isArray(parsed.records)) {
+    return { records: [], notices: ["accepted-findings store unreadable (unrecognized shape or schema version) \u2014 nothing suppressed this run"] };
+  }
+  const rawRecords = parsed.records;
+  const records = [];
+  let dropped = 0;
+  for (const raw of rawRecords) {
+    if (invalidRecordReason(raw) === void 0) {
+      records.push(raw);
+    } else {
+      dropped++;
+    }
+  }
+  const notices = [];
+  if (dropped > 0) {
+    notices.push(
+      `${dropped} accepted-finding record(s) in the store failed validation and were dropped \u2014 whatever they described is reported as active again`
+    );
+  }
+  return { records, notices };
+}
+function writeAcceptedFindings(records) {
+  const store = { schemaVersion: 1, records };
+  writeJsonAtomic(getAcceptedFindingsPath(), store);
+}
+function validateAcceptReason(reason) {
+  if (reason.length === 0) {
+    throw new UserError('--reason is required \u2014 a short note on why this finding is accepted (e.g. "funnel genuinely needs root")');
+  }
+  validateProvenanceText("reason", reason);
+}
+function resolveAmongFindings(prefix, findings) {
+  const lower = prefix.toLowerCase();
+  return findings.filter((f) => f.fingerprint !== void 0 && f.fingerprint.startsWith(lower));
+}
+function resolveAmongRecords(prefix, records) {
+  const lower = prefix.toLowerCase();
+  return records.filter((r) => r.fingerprint.startsWith(lower));
+}
+
 // src/license.ts
 import { verify as cryptoVerify } from "crypto";
 var LICENSE_PREFIX = "skf1";
@@ -1713,7 +1824,13 @@ function proFeatureStatus(feature, betaFree = BETA_FREE) {
 // src/audit.ts
 var OVERSIZED_SKILL_EST_TOKENS = 5e3;
 function toAuditFindings(source) {
-  return source.map((f) => ({ severity: f.severity, rule: f.rule, target: f.file, detail: f.detail }));
+  return source.map((f) => ({ severity: f.severity, rule: f.rule, target: f.file, detail: f.detail, context: f.context }));
+}
+function activeVerdictFor(findings, strictness) {
+  return verdictFor(
+    findings.map((f) => ({ severity: f.severity, rule: f.rule, file: f.target, detail: f.detail })),
+    strictness
+  );
 }
 function resolveConfiguredRoot(root) {
   return resolvePath2(expandHome(root));
@@ -1737,7 +1854,7 @@ function listSubdirsFollowingSymlinks(dir) {
   }
   const out = [];
   for (const entry of entries) {
-    const full = join11(dir, entry.name);
+    const full = join12(dir, entry.name);
     if (entry.isDirectory() || entry.isSymbolicLink() && isDirFollowingSymlink(full)) {
       out.push(full);
     }
@@ -1751,20 +1868,20 @@ function listSubdirsNoSymlinks(dir) {
   } catch {
     return [];
   }
-  return entries.filter((e) => e.isDirectory()).map((e) => join11(dir, e.name));
+  return entries.filter((e) => e.isDirectory()).map((e) => join12(dir, e.name));
 }
 function findSkillDirsUnderRoot(root) {
   const found = /* @__PURE__ */ new Set();
   const rootSubdirs = listSubdirsFollowingSymlinks(root);
   for (const dir of rootSubdirs) {
-    if (existsSync8(join11(dir, "SKILL.md"))) found.add(dir);
+    if (existsSync9(join12(dir, "SKILL.md"))) found.add(dir);
   }
-  for (const dir of listSubdirsFollowingSymlinks(join11(root, "skills"))) {
-    if (existsSync8(join11(dir, "SKILL.md"))) found.add(dir);
+  for (const dir of listSubdirsFollowingSymlinks(join12(root, "skills"))) {
+    if (existsSync9(join12(dir, "SKILL.md"))) found.add(dir);
   }
   for (const topDir of rootSubdirs) {
-    for (const dir of listSubdirsNoSymlinks(join11(topDir, "skills"))) {
-      if (existsSync8(join11(dir, "SKILL.md"))) found.add(dir);
+    for (const dir of listSubdirsNoSymlinks(join12(topDir, "skills"))) {
+      if (existsSync9(join12(dir, "SKILL.md"))) found.add(dir);
     }
   }
   return Array.from(found).filter((p) => !p.includes("/.git/"));
@@ -1860,7 +1977,7 @@ function estimateTokens(text) {
   return Math.ceil(Buffer.byteLength(text, "utf-8") / 4);
 }
 function profileAuditedSkill(group, findings, unreadableSkillMdPaths) {
-  const skillMdPath = join11(group.canonicalPath, "SKILL.md");
+  const skillMdPath = join12(group.canonicalPath, "SKILL.md");
   const base = {
     path: group.canonicalPath,
     skillMdPath,
@@ -1871,7 +1988,7 @@ function profileAuditedSkill(group, findings, unreadableSkillMdPaths) {
   let sizeBytes;
   try {
     sizeBytes = statSync6(skillMdPath).size;
-    text = readFileSync8(skillMdPath, "utf-8");
+    text = readFileSync9(skillMdPath, "utf-8");
   } catch (err) {
     findings.push({
       severity: "MEDIUM",
@@ -1928,7 +2045,7 @@ function auditMcpTarget(targetPath, notices) {
   const findings = [];
   const isToml = extname3(targetPath).toLowerCase() === ".toml";
   const format = isToml ? "toml" : "json";
-  if (!existsSync8(targetPath)) {
+  if (!existsSync9(targetPath)) {
     findings.push({
       severity: "LOW",
       rule: "missing-mcp-target",
@@ -1949,7 +2066,7 @@ function auditMcpTarget(targetPath, notices) {
   }
   if (isToml) {
     try {
-      readFileSync8(targetPath, "utf-8");
+      readFileSync9(targetPath, "utf-8");
     } catch (err) {
       findings.push({
         severity: "MEDIUM",
@@ -1964,7 +2081,7 @@ function auditMcpTarget(targetPath, notices) {
   }
   let raw;
   try {
-    raw = readFileSync8(targetPath, "utf-8");
+    raw = readFileSync9(targetPath, "utf-8");
   } catch (err) {
     findings.push({
       severity: "MEDIUM",
@@ -2040,7 +2157,7 @@ function defaultWhich(cmd) {
   const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
   for (const dir of dirs) {
     for (const ext of exts) {
-      const candidate = join11(dir, cmd + ext);
+      const candidate = join12(dir, cmd + ext);
       try {
         if (statSync6(candidate).isFile()) return candidate;
       } catch {
@@ -2126,16 +2243,23 @@ async function auditConfiguredSet(config, options = {}) {
         severity: "LOW",
         rule: "oversized-skill",
         target: skill.skillMdPath,
-        detail: `est. ${skill.estTokens} tokens exceeds the ${oversizedThreshold}-token threshold \u2014 consider trimming or splitting`
+        detail: `est. ${skill.estTokens} tokens exceeds the ${oversizedThreshold}-token threshold \u2014 consider trimming or splitting`,
+        // Deliberate '' (v0.12, see docs/accepted-findings-schema.md's context table): the detail
+        // embeds a token count that changes on every edit, so "this skill may exceed the
+        // threshold" is genuinely a rule+path identity here. An accepted oversized-skill finding
+        // therefore stays suppressed as the skill keeps growing — a documented tradeoff, not a bug.
+        context: ""
       });
     }
   }
-  const safetyVerdictBySkillPath = /* @__PURE__ */ new Map();
+  const perSkillFindings = /* @__PURE__ */ new Map();
+  const skillScanFailed = /* @__PURE__ */ new Set();
   for (const skill of skills) {
     try {
       const result = await scanSafety(skill.path, config.strictness);
-      findings.push(...toAuditFindings(result.findings));
-      safetyVerdictBySkillPath.set(skill.path, result.verdict);
+      const skillFindings = toAuditFindings(result.findings);
+      findings.push(...skillFindings);
+      perSkillFindings.set(skill.path, skillFindings);
     } catch (err) {
       findings.push({
         severity: "MEDIUM",
@@ -2143,7 +2267,7 @@ async function auditConfiguredSet(config, options = {}) {
         target: skill.path,
         detail: `safety scan failed: ${err.message}`
       });
-      safetyVerdictBySkillPath.set(skill.path, "block");
+      skillScanFailed.add(skill.path);
     }
   }
   const mcpTargetPaths = config.mcpTargets ?? [];
@@ -2174,7 +2298,36 @@ async function auditConfiguredSet(config, options = {}) {
   } else {
     notices.push(overlapStatus.notice ?? "Pro feature (installed-set overlap analysis) locked.");
   }
-  const evolveEligible = skills.filter((s) => s.validFrontmatter && safetyVerdictBySkillPath.get(s.path) === "pass").map((s) => ({ name: s.name, path: s.path }));
+  const acceptedRecords = options.accepted ?? [];
+  const acceptedByFingerprint = new Map(acceptedRecords.map((r) => [r.fingerprint, r]));
+  const matchedFingerprints = /* @__PURE__ */ new Set();
+  const activeFindings = [];
+  const acceptedEntries = [];
+  for (const f of findings) {
+    const context = f.context ?? f.detail;
+    const fingerprint = fingerprintFinding({ severity: f.severity, rule: f.rule, target: f.target, context });
+    f.fingerprint = fingerprint;
+    const record = acceptedByFingerprint.get(fingerprint);
+    if (record) {
+      matchedFingerprints.add(fingerprint);
+      acceptedEntries.push({ finding: f, reason: record.reason, acceptedAt: record.acceptedAt });
+    } else {
+      activeFindings.push(f);
+    }
+  }
+  const unmatchedAcceptedCount = acceptedRecords.filter((r) => !matchedFingerprints.has(r.fingerprint)).length;
+  if (unmatchedAcceptedCount > 0) {
+    notices.push(
+      `${unmatchedAcceptedCount} accepted finding(s) did not match anything this run (resolved, or content changed) \u2014 see \`skill-forge finding list --stale\``
+    );
+  }
+  const activeFindingSet = new Set(activeFindings);
+  const evolveEligible = skills.filter((s) => {
+    if (!s.validFrontmatter || skillScanFailed.has(s.path)) return false;
+    const skillFindings = perSkillFindings.get(s.path) ?? [];
+    const activeSkillFindings = skillFindings.filter((f) => activeFindingSet.has(f));
+    return activeVerdictFor(activeSkillFindings, config.strictness) === "pass";
+  }).map((s) => ({ name: s.name, path: s.path }));
   const foundation = config.foundationSkillPath ? {
     available: false,
     existingPath: config.foundationSkillPath,
@@ -2184,21 +2337,23 @@ async function auditConfiguredSet(config, options = {}) {
     message: "no business-foundation skill yet \u2014 `skill-forge audit --foundation` can scaffold one to ground future skills in your business profile"
   };
   const findingCounts = { LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0 };
-  for (const f of findings) findingCounts[f.severity]++;
+  for (const f of activeFindings) findingCounts[f.severity]++;
   const summary = {
     rootCount: skillRoots.length,
     skillCount: skills.length,
     mcpTargetCount: mcpTargets.length,
     findingCounts,
     overlapClusterCount: overlapClusters.length,
-    evolveEligibleCount: evolveEligible.length
+    evolveEligibleCount: evolveEligible.length,
+    acceptedCount: acceptedEntries.length
   };
   const tooling = checkTooling(options.which ?? defaultWhich, options.env ?? process.env);
   return {
     schemaVersion: 1,
     generatedAt: now().toISOString(),
     inventory: { skillRoots, skills, mcpTargets },
-    hygiene: findings,
+    hygiene: activeFindings,
+    accepted: acceptedEntries,
     opportunities: { overlapClusters, evolveEligible, foundation, overlapLocked: !overlapStatus.enabled },
     tooling,
     notices,
@@ -2260,16 +2415,33 @@ function renderMcpTargetsSection(targets) {
   }
   return lines;
 }
+function displayFingerprint(f) {
+  return f.fingerprint ? f.fingerprint.slice(0, FINGERPRINT_DISPLAY_LENGTH) : "unknown";
+}
 function renderFindingsSection(findings) {
   return [
     "## Hygiene findings",
     "",
     ...bulletList(
-      findings.map((f) => `[${f.severity}] ${f.rule} \u2014 ${sanitizeForMarkdown(f.target)}: ${sanitizeForMarkdown(f.detail)}`),
+      findings.map(
+        (f) => `[${f.severity}] ${f.rule} \u2014 ${sanitizeForMarkdown(f.target)}: ${sanitizeForMarkdown(f.detail)} (fp ${displayFingerprint(f)})`
+      ),
       "(none \u2014 clean)"
     )
   ];
 }
+function renderAcceptedFindingsSection(entries) {
+  return [
+    "## Accepted findings",
+    "",
+    ...bulletList(
+      entries.map(
+        (e) => `[${e.finding.severity}] ${e.finding.rule} \u2014 ${sanitizeForMarkdown(e.finding.target)}: ${sanitizeForMarkdown(e.reason)} (accepted ${sanitizeForMarkdown(e.acceptedAt.slice(0, 10))})`
+      ),
+      "(none)"
+    )
+  ];
+}
 function renderOpportunitiesSection(report) {
   const { overlapClusters, evolveEligible, foundation } = report.opportunities;
   return [
@@ -2327,6 +2499,7 @@ function renderAuditMarkdown(report) {
     `- Skills: ${summary.skillCount}`,
     `- MCP targets: ${summary.mcpTargetCount}`,
     `- Findings: ${summary.findingCounts.CRITICAL} CRITICAL, ${summary.findingCounts.HIGH} HIGH, ${summary.findingCounts.MEDIUM} MEDIUM, ${summary.findingCounts.LOW} LOW`,
+    `- Accepted: ${summary.acceptedCount} (suppressed from the counts above; see the Accepted findings section)`,
     `- Overlap clusters: ${summary.overlapClusterCount}`,
     `- Evolve-eligible skills: ${summary.evolveEligibleCount}`,
     "",
@@ -2340,6 +2513,8 @@ function renderAuditMarkdown(report) {
     "",
     ...renderFindingsSection(report.hygiene),
     "",
+    ...renderAcceptedFindingsSection(report.accepted),
+    "",
     ...renderOpportunitiesSection(report),
     "",
     ...renderToolingSection(report.tooling),
@@ -2392,7 +2567,7 @@ async function scaffoldFoundationSkill(config, profile, targetRoot) {
   if (!isDir(resolvedRoot)) {
     throw new UserError(`skills root does not exist: ${resolvedRoot}`);
   }
-  const destDir = join11(resolvedRoot, "business-foundation");
+  const destDir = join12(resolvedRoot, "business-foundation");
   let destLstat;
   try {
     destLstat = lstatSync2(destDir);
@@ -2406,9 +2581,9 @@ async function scaffoldFoundationSkill(config, profile, targetRoot) {
     throw new UserError(`refusing to scaffold a foundation skill at ${destDir}: already exists`);
   }
   const content = renderFoundationSkillMd(profile);
-  const tempDir = mkdtempSync(join11(resolvedRoot, ".business-foundation-"));
+  const tempDir = mkdtempSync(join12(resolvedRoot, ".business-foundation-"));
   try {
-    writeFileSync5(join11(tempDir, "SKILL.md"), content, { flag: "wx", mode: 384 });
+    writeFileSync5(join12(tempDir, "SKILL.md"), content, { flag: "wx", mode: 384 });
     const safety = await scanSafety(tempDir, config.strictness);
     if (safety.verdict === "block") {
       throw new UserError(
@@ -2442,7 +2617,7 @@ async function scaffoldFoundationSkill(config, profile, targetRoot) {
 
 // src/auditState.ts
 function getAuditStatePath() {
-  return join12(getHomeDir(), "audit-state.json");
+  return join13(getHomeDir(), "audit-state.json");
 }
 function emptyCounts() {
   return { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
@@ -2459,15 +2634,15 @@ function summarizeAudit(report, reportPath) {
     rootOfSkillPath.set(skill.path, skill.root);
   }
   const byRoot = {};
-  for (const finding of report.hygiene) {
+  for (const finding2 of report.hygiene) {
     let root;
-    for (let dir = finding.target; ; dir = dirname5(dir)) {
+    for (let dir = finding2.target; ; dir = dirname5(dir)) {
       root = rootOfSkillPath.get(dir);
       if (root || dirname5(dir) === dir) break;
     }
     if (!root) continue;
     byRoot[root] ??= emptyCounts();
-    bump(byRoot[root], finding.severity);
+    bump(byRoot[root], finding2.severity);
   }
   return {
     schemaVersion: 1,
@@ -2489,7 +2664,8 @@ function summarizeAudit(report, reportPath) {
       suggestedVerb: c.suggestedVerb
     })),
     overlapLocked: report.opportunities.overlapLocked === true,
-    evolveEligibleCount: report.summary.evolveEligibleCount
+    evolveEligibleCount: report.summary.evolveEligibleCount,
+    acceptedCount: report.summary.acceptedCount
   };
 }
 function writeAuditState(state) {
@@ -2497,9 +2673,9 @@ function writeAuditState(state) {
 }
 function readAuditState() {
   const path = getAuditStatePath();
-  if (!existsSync9(path)) return void 0;
+  if (!existsSync10(path)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync9(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
     if (parsed.schemaVersion !== 1 || typeof parsed.lastRunAt !== "string") return void 0;
     return {
       schemaVersion: 1,
@@ -2511,7 +2687,8 @@ function readAuditState() {
       byRoot: parsed.byRoot ?? {},
       overlapClusters: parsed.overlapClusters ?? [],
       overlapLocked: parsed.overlapLocked === true,
-      evolveEligibleCount: parsed.evolveEligibleCount ?? 0
+      evolveEligibleCount: parsed.evolveEligibleCount ?? 0,
+      acceptedCount: parsed.acceptedCount ?? 0
     };
   } catch {
     return void 0;
@@ -2560,32 +2737,32 @@ function formatAuditAdvisory(state, options = {}) {
 }
 
 // src/commands/gatePipeline.ts
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/gate/profile.ts
 import { execFileSync } from "child_process";
 import {
   closeSync,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdtempSync as mkdtempSync2,
   openSync,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   readdirSync as readdirSync6,
   readSync,
   rmSync as rmSync4,
   statSync as statSync7
 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename8, dirname as dirname6, extname as extname5, join as join14, resolve as resolve3 } from "path";
+import { basename as basename8, dirname as dirname6, extname as extname5, join as join15, resolve as resolve3 } from "path";
 
 // src/gate/mcpCapabilities.ts
-import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
-import { extname as extname4, join as join13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+import { extname as extname4, join as join14 } from "path";
 var SOURCE_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
 var MAX_ITEMS_PER_CATEGORY = 200;
 function readJsonSafe(file) {
   try {
-    return JSON.parse(readFileSync10(file, "utf-8"));
+    return JSON.parse(readFileSync11(file, "utf-8"));
   } catch {
     return void 0;
   }
@@ -2686,16 +2863,16 @@ var MCP_SDK_IMPORT_RE = /@modelcontextprotocol\/sdk/;
 function extractMcpCapabilities(packageDir) {
   const buckets = { tools: /* @__PURE__ */ new Set(), resources: /* @__PURE__ */ new Set(), prompts: /* @__PURE__ */ new Set() };
   let hasPackageJsonMarker = false;
-  const pkgPath = join13(packageDir, "package.json");
-  if (existsSync10(pkgPath)) {
+  const pkgPath = join14(packageDir, "package.json");
+  if (existsSync11(pkgPath)) {
     const pkg2 = readJsonSafe(pkgPath);
     if (pkg2 && typeof pkg2 === "object" && !Array.isArray(pkg2)) {
       hasPackageJsonMarker = hasPackageJsonMcpMarkers(pkg2);
     }
   }
   for (const manifestName of [".mcp.json", "mcp.json"]) {
-    const manifestPath = join13(packageDir, manifestName);
-    if (!existsSync10(manifestPath)) continue;
+    const manifestPath = join14(packageDir, manifestName);
+    if (!existsSync11(manifestPath)) continue;
     const parsed = readJsonSafe(manifestPath);
     if (parsed !== void 0) {
       collectDeclaredFromManifest(parsed, buckets);
@@ -2772,7 +2949,7 @@ var PYTHON_STDLIB = /* @__PURE__ */ new Set([
 ]);
 function profileSkill(inputPath) {
   const p = resolve3(expandHome(inputPath));
-  if (!existsSync11(p)) {
+  if (!existsSync12(p)) {
     throw new Error(`path does not exist: ${p}`);
   }
   const stat = statSync7(p);
@@ -2802,7 +2979,7 @@ function asProfile(candidatePath, artifact) {
   return asSkillProfile(profile, `at ${candidatePath}`);
 }
 function classifyInput(p) {
-  if (existsSync11(join14(p, ".claude-plugin", "plugin.json"))) return "plugin";
+  if (existsSync12(join15(p, ".claude-plugin", "plugin.json"))) return "plugin";
   if (detectArtifactType(p) === "mcp") return "mcp";
   return "skill";
 }
@@ -2810,10 +2987,10 @@ var MCP_SDK_DEP2 = "@modelcontextprotocol/sdk";
 var MCP_KEYWORD2 = "mcp-server";
 var MCP_BIN_PREFIX2 = /^mcp-/i;
 function readPackageJsonSafe(root) {
-  const pkgPath = join14(root, "package.json");
-  if (!existsSync11(pkgPath)) return void 0;
+  const pkgPath = join15(root, "package.json");
+  if (!existsSync12(pkgPath)) return void 0;
   try {
-    return JSON.parse(readFileSync11(pkgPath, "utf-8"));
+    return JSON.parse(readFileSync12(pkgPath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -2834,7 +3011,7 @@ function hasMcpPackageMarkers(pkg2) {
   return false;
 }
 function detectArtifactType(root) {
-  if (existsSync11(join14(root, ".mcp.json")) || existsSync11(join14(root, "mcp.json"))) return "mcp";
+  if (existsSync12(join15(root, ".mcp.json")) || existsSync12(join15(root, "mcp.json"))) return "mcp";
   const pkg2 = readPackageJsonSafe(root);
   if (pkg2 && hasMcpPackageMarkers(pkg2)) return "mcp";
   return "skill";
@@ -2844,7 +3021,7 @@ function resolveSkillMd(inputPath) {
   let tmpDir;
   const initialStat = statSync7(currentPath);
   if (extname5(currentPath) === ".skill" || initialStat.isFile() && isZipFile(currentPath)) {
-    tmpDir = mkdtempSync2(join14(tmpdir(), "forge_"));
+    tmpDir = mkdtempSync2(join15(tmpdir(), "forge_"));
     extractZip(currentPath, tmpDir);
     currentPath = tmpDir;
   }
@@ -2853,8 +3030,8 @@ function resolveSkillMd(inputPath) {
     return { skillMd: currentPath, root: dirname6(currentPath), tmpDir };
   }
   if (stat.isDirectory()) {
-    const direct = join14(currentPath, "SKILL.md");
-    if (existsSync11(direct)) {
+    const direct = join15(currentPath, "SKILL.md");
+    if (existsSync12(direct)) {
       return { skillMd: direct, root: currentPath, tmpDir };
     }
     const matches = findSkillMdOneLevelDown(currentPath);
@@ -2879,16 +3056,16 @@ function findSkillMdOneLevelDown(dir) {
   const matches = /* @__PURE__ */ new Set();
   for (const entry of readdirSync6(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      const candidate = join14(dir, entry.name, "SKILL.md");
-      if (existsSync11(candidate)) matches.add(candidate);
+      const candidate = join15(dir, entry.name, "SKILL.md");
+      if (existsSync12(candidate)) matches.add(candidate);
     }
   }
-  const skillsDir = join14(dir, "skills");
+  const skillsDir = join15(dir, "skills");
   if (isDir(skillsDir)) {
     for (const entry of readdirSync6(skillsDir, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        const candidate = join14(skillsDir, entry.name, "SKILL.md");
-        if (existsSync11(candidate)) matches.add(candidate);
+        const candidate = join15(skillsDir, entry.name, "SKILL.md");
+        if (existsSync12(candidate)) matches.add(candidate);
       }
     }
   }
@@ -2954,6 +3131,33 @@ function extractDescription(block) {
   }
   return stripQuotes(first);
 }
+function extractExtends(block) {
+  const lines = block.split("\n");
+  const idx = lines.findIndex((l) => /^\s*extends:\s*(.*)$/.test(l));
+  if (idx === -1) return void 0;
+  const inline = lines[idx].match(/^\s*extends:\s*(.*)$/)[1].trim();
+  if (inline.startsWith("[")) {
+    const inner = inline.replace(/^\[/, "").replace(/\]\s*$/, "");
+    const items = inner.split(",").map((s) => stripQuotes(s.trim())).filter(Boolean);
+    return items.length ? items : void 0;
+  }
+  if (inline === "") {
+    const items = [];
+    for (let i = idx + 1; i < lines.length; i++) {
+      const line = lines[i];
+      const m = line.match(/^\s*-\s*(.+)$/);
+      if (m) {
+        items.push(stripQuotes(m[1].trim()));
+      } else if (line.trim() === "") {
+        continue;
+      } else {
+        break;
+      }
+    }
+    return items.length ? items : void 0;
+  }
+  return [stripQuotes(inline)];
+}
 function parseFrontmatter(text) {
   if (!text.startsWith("---\n")) {
     return { validFrontmatter: false };
@@ -2964,16 +3168,17 @@ function parseFrontmatter(text) {
     name: extractSimpleField(block, "name"),
     version: extractSimpleField(block, "version"),
     license: extractSimpleField(block, "license"),
-    description: extractDescription(block)
+    description: extractDescription(block),
+    extends: extractExtends(block)
   };
 }
 function detectLicense(root, fm) {
   if (fm.license) return fm.license;
   const names = ["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING", "license"];
   for (const name of names) {
-    const p = join14(root, name);
-    if (existsSync11(p) && statSync7(p).isFile()) {
-      const head = readFileSync11(p, "utf-8").slice(0, 2e3).toLowerCase();
+    const p = join15(root, name);
+    if (existsSync12(p) && statSync7(p).isFile()) {
+      const head = readFileSync12(p, "utf-8").slice(0, 2e3).toLowerCase();
       for (const [hint, label] of Object.entries(SPDX_HINTS)) {
         if (head.includes(hint)) return label;
       }
@@ -2985,7 +3190,7 @@ function detectLicense(root, fm) {
 function walkFiles(dir) {
   const out = [];
   for (const entry of readdirSync6(dir, { withFileTypes: true })) {
-    const full = join14(dir, entry.name);
+    const full = join15(dir, entry.name);
     if (entry.isDirectory()) {
       out.push(...walkFiles(full));
     } else if (entry.isFile()) {
@@ -2997,7 +3202,7 @@ function walkFiles(dir) {
 function countResources(root) {
   const resources = {};
   for (const d of RESOURCE_DIRS) {
-    const dp = join14(root, d);
+    const dp = join15(root, d);
     if (isDir(dp)) {
       resources[d] = walkFiles(dp).length;
     }
@@ -3008,11 +3213,11 @@ function scanMcpAndImports(text, root) {
   const mcpRefRe = /mcp__[a-zA-Z0-9_]+/g;
   const mcpRefs = new Set(text.match(mcpRefRe) ?? []);
   const imports = /* @__PURE__ */ new Set();
-  const scriptsDir = join14(root, "scripts");
+  const scriptsDir = join15(root, "scripts");
   if (isDir(scriptsDir)) {
     for (const f of walkFiles(scriptsDir)) {
       if (!f.endsWith(".py")) continue;
-      const ft = readFileSync11(f, "utf-8");
+      const ft = readFileSync12(f, "utf-8");
       for (const m2 of ft.match(mcpRefRe) ?? []) mcpRefs.add(m2);
       const importRe = /^\s*(?:import|from)\s+([a-zA-Z0-9_]+)/gm;
       let m;
@@ -3029,7 +3234,7 @@ function scanMcpAndImports(text, root) {
 function profileSkillDir(inputPath) {
   const { skillMd, root, tmpDir } = resolveSkillMd(inputPath);
   try {
-    const text = readFileSync11(skillMd, "utf-8");
+    const text = readFileSync12(skillMd, "utf-8");
     const fm = parseFrontmatter(text);
     const bodyLines = (text.match(/\n/g)?.length ?? 0) + 1;
     const headers = Array.from(text.matchAll(/^#{1,3}\s+(.+)$/gm)).map((m) => m[1]);
@@ -3050,26 +3255,27 @@ function profileSkillDir(inputPath) {
       resources,
       mcpDependencies: mcpDeps,
       externalPythonDeps: externalDeps,
-      artifactType: detectArtifactType(root)
+      artifactType: detectArtifactType(root),
+      extends: fm.extends ?? []
     };
   } finally {
     cleanupTmp(tmpDir);
   }
 }
 function profilePlugin(p) {
-  const manifestPath = join14(p, ".claude-plugin", "plugin.json");
+  const manifestPath = join15(p, ".claude-plugin", "plugin.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync11(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync12(manifestPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse plugin.json under ${p}: ${err.message}`);
   }
-  const skillsDir = join14(p, "skills");
+  const skillsDir = join15(p, "skills");
   let skills = [];
   if (isDir(skillsDir)) {
-    skills = readdirSync6(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync11(join14(skillsDir, d.name, "SKILL.md"))).map((d) => d.name).sort();
+    skills = readdirSync6(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync12(join15(skillsDir, d.name, "SKILL.md"))).map((d) => d.name).sort();
   }
-  const commandsDir = join14(p, "commands");
+  const commandsDir = join15(p, "commands");
   const commands = isDir(commandsDir) ? readdirSync6(commandsDir).filter((f) => f.endsWith(".md")).length : 0;
   const mc = manifest.mcpServers ?? manifest.mcp_servers ?? {};
   const mcpServers = typeof mc === "object" && mc !== null ? Object.keys(mc).sort() : [];
@@ -3087,11 +3293,11 @@ function profilePlugin(p) {
   };
 }
 function profileMcp(p) {
-  const explicitConfig = existsSync11(join14(p, ".mcp.json")) ? join14(p, ".mcp.json") : existsSync11(join14(p, "mcp.json")) ? join14(p, "mcp.json") : void 0;
+  const explicitConfig = existsSync12(join15(p, ".mcp.json")) ? join15(p, ".mcp.json") : existsSync12(join15(p, "mcp.json")) ? join15(p, "mcp.json") : void 0;
   if (explicitConfig) {
     let cfg;
     try {
-      cfg = JSON.parse(readFileSync11(explicitConfig, "utf-8"));
+      cfg = JSON.parse(readFileSync12(explicitConfig, "utf-8"));
     } catch (err) {
       throw new Error(`could not parse MCP config ${explicitConfig}: ${err.message}`);
     }
@@ -3107,10 +3313,10 @@ function profileMcp(p) {
       capabilities: extractMcpCapabilities(p)
     };
   }
-  const pkgPath = join14(p, "package.json");
+  const pkgPath = join15(p, "package.json");
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync11(pkgPath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync12(pkgPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse package.json ${pkgPath}: ${err.message}`);
   }
@@ -3127,14 +3333,14 @@ function profileMcp(p) {
 }
 
 // src/gate/mcpOverlap.ts
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
 import { resolve as resolve4 } from "path";
 function readTargetServers(targetPath) {
   const path = resolve4(expandHome(targetPath));
-  if (!existsSync12(path)) return [];
+  if (!existsSync13(path)) return [];
   let cfg;
   try {
-    cfg = JSON.parse(readFileSync12(path, "utf-8"));
+    cfg = JSON.parse(readFileSync13(path, "utf-8"));
   } catch {
     return [];
   }
@@ -3206,6 +3412,144 @@ function scanMcpOverlap(candidate, mcpTargetPaths) {
   };
 }
 
+// src/gate/skillMap.ts
+import { readFileSync as readFileSync14 } from "fs";
+import { resolve as resolve5 } from "path";
+function loadSkillMap(path) {
+  const resolved = resolve5(expandHome(path));
+  let text;
+  try {
+    text = readFileSync14(resolved, "utf-8");
+  } catch (err) {
+    throw new Error(`could not read skill map at ${resolved}: ${err.message}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    throw new Error(`skill map at ${resolved} is not valid JSON: ${err.message}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`skill map at ${resolved}: expected a JSON object`);
+  }
+  const obj = parsed;
+  if (!Array.isArray(obj.nodes) || !Array.isArray(obj.edges)) {
+    throw new Error(`skill map at ${resolved}: expected "nodes" and "edges" arrays`);
+  }
+  const nodes = obj.nodes.map((n) => ({
+    ...n,
+    type: typeof n.type === "string" ? n.type : n.kind
+  }));
+  return {
+    schemaVersion: typeof obj.schemaVersion === "string" ? obj.schemaVersion : void 0,
+    nodes,
+    edges: obj.edges
+  };
+}
+function nodeById(map, id) {
+  return map.nodes.find((n) => n.id === id);
+}
+function edgesOfType(map, type) {
+  return map.edges.filter((e) => e.type === type);
+}
+function tagsForNode(map, node) {
+  const tags = new Set(node.tags ?? []);
+  for (const edge of map.edges) {
+    if (edge.from !== node.id) continue;
+    if (edge.type !== "topic-tag" && edge.type !== "stack-tag") continue;
+    const tagNode = nodeById(map, edge.to);
+    const label = tagNode?.name ?? tagNode?.id;
+    if (label) tags.add(label);
+  }
+  return Array.from(tags);
+}
+
+// src/gate/mapOverlap.ts
+var STOPWORDS2 = new Set(
+  `
+a an the and or of to for in on with use used using when whether this that these those is are be
+your you it its as at by from into via per also any all not no than then so if up out about
+skill skills user claude code based comprehensive enhanced practical including include includes
+`.split(/\s+/).filter(Boolean)
+);
+var STRONG_THRESHOLD = 0.45;
+var REPORT_THRESHOLD = 0.2;
+function tokenize2(text) {
+  const matches = text.toLowerCase().match(/[a-z][a-z0-9+.-]{2,}/g) ?? [];
+  return new Set(matches.filter((t) => !STOPWORDS2.has(t)));
+}
+function intersectSize2(a, b) {
+  let n = 0;
+  for (const x of a) if (b.has(x)) n += 1;
+  return n;
+}
+function unionSize2(a, b) {
+  const u = new Set(a);
+  for (const x of b) u.add(x);
+  return u.size;
+}
+function round33(n) {
+  return Math.round(n * 1e3) / 1e3;
+}
+function score3(candidateTokens, otherTokens) {
+  if (candidateTokens.size === 0) return 0;
+  const inter = intersectSize2(candidateTokens, otherTokens);
+  const union = unionSize2(candidateTokens, otherTokens);
+  const jaccard = union ? inter / union : 0;
+  const containment = inter / candidateTokens.size;
+  return round33(0.3 * jaccard + 0.7 * containment);
+}
+function nodeText(map, node) {
+  const tags = tagsForNode(map, node);
+  return [node.name ?? "", node.description ?? "", ...tags].join(" ");
+}
+function scanMapOverlap(candidate, map) {
+  const candidateTokens = tokenize2(`${candidate.name ?? ""} ${candidate.description ?? ""}`);
+  if (candidateTokens.size === 0) return { matches: [] };
+  const matches = [];
+  for (const node of map.nodes) {
+    if (node.type !== "skill") continue;
+    const otherTokens = tokenize2(nodeText(map, node));
+    const s = score3(candidateTokens, otherTokens);
+    if (s >= REPORT_THRESHOLD) {
+      matches.push({ skillId: node.id, name: node.name ?? node.id, score: s });
+    }
+  }
+  matches.sort((a, b) => b.score - a.score);
+  return { matches };
+}
+function mapOverlapFinding(result) {
+  const top = result.matches[0];
+  if (!top) return void 0;
+  const severity = top.score >= STRONG_THRESHOLD ? "HIGH" : "MEDIUM";
+  return {
+    severity,
+    rule: "skill-map-overlap",
+    file: "skill-map",
+    detail: `candidate overlaps existing marketplace skill "${top.name}" (score ${top.score}) \u2014 see CLAUDE.md's curation rule: close the gap, don't duplicate`,
+    context: top.skillId
+  };
+}
+function isDeclaredExtension(match, extendsDeclarations) {
+  const qualifiedId = match.skillId.replace(/^[a-z]+:/, "");
+  const bareId = qualifiedId.split("/").pop() ?? qualifiedId;
+  return extendsDeclarations.some((raw) => {
+    const declared = raw.trim();
+    if (!declared) return false;
+    return declared === match.name || declared === bareId || declared === qualifiedId;
+  });
+}
+function mapOverlapDecision(result, extendsDeclarations = []) {
+  const top = result.matches[0];
+  if (!top) return {};
+  if (extendsDeclarations.length > 0 && isDeclaredExtension(top, extendsDeclarations)) {
+    return {
+      informational: `declared extension of "${top.name}" (score ${top.score}) \u2014 overlap expected; verify the layering claim in review`
+    };
+  }
+  return { finding: mapOverlapFinding(result) };
+}
+
 // src/report/render.ts
 var SAFETY_VERDICT_MAP = {
   pass: "ALLOW",
@@ -3234,10 +3578,10 @@ function renderSafetyLine(safety) {
   const withDetail = detail ? `${safety.verdict} (${detail})` : safety.verdict;
   return safety.recommendation ? `${withDetail} \u2014 ${safety.recommendation}` : withDetail;
 }
-function renderFindingLine(finding) {
-  const severity = finding.severity ?? "UNKNOWN";
-  const rule = finding.rule ?? "unknown-rule";
-  return `  - [${severity}] ${rule}${finding.message ? `: ${finding.message}` : ""}`;
+function renderFindingLine(finding2) {
+  const severity = finding2.severity ?? "UNKNOWN";
+  const rule = finding2.rule ?? "unknown-rule";
+  return `  - [${severity}] ${rule}${finding2.message ? `: ${finding2.message}` : ""}`;
 }
 function renderFindingsLines(findings) {
   if (!findings?.length) return [];
@@ -3331,6 +3675,16 @@ function tryMcpOverlap(profile, mcpTargets) {
     return void 0;
   }
 }
+function tryMapOverlapDecision(skillMapPath, candidate, extendsDeclarations) {
+  if (!skillMapPath) return void 0;
+  try {
+    const map = loadSkillMap(skillMapPath);
+    return mapOverlapDecision(scanMapOverlap(candidate, map), extendsDeclarations);
+  } catch (err) {
+    console.error(`[skill-forge] skill-map overlap check skipped: ${err.message}`);
+    return void 0;
+  }
+}
 function resolveMcpCandidatePath(entry) {
   if (entry.packageDir) return entry.packageDir;
   let children = [];
@@ -3338,49 +3692,64 @@ function resolveMcpCandidatePath(entry) {
     children = readdirSync7(entry.quarantinePath, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
   }
-  return children.length === 1 ? join15(entry.quarantinePath, children[0]) : entry.quarantinePath;
+  return children.length === 1 ? join16(entry.quarantinePath, children[0]) : entry.quarantinePath;
 }
 async function runGate(candidatePath, skillsRoot, {
   proFeatureLabel = "overlap analysis",
   strictness = DEFAULT_STRICTNESS,
   artifact = "skill",
-  mcpTargets = []
+  mcpTargets = [],
+  skillMapPath
 } = {}) {
   const profile = asProfile(candidatePath, artifact);
   const proStatus = proFeatureStatus(proFeatureLabel);
   const safety = artifact === "mcp" ? await mcpScan(candidatePath, strictness) : await scanSafety(candidatePath, strictness);
   const overlap = !proStatus.enabled ? void 0 : artifact === "mcp" ? tryMcpOverlap(profile, mcpTargets) : tryOverlap(candidatePath, skillsRoot);
+  const mapDecision = artifact === "mcp" ? void 0 : tryMapOverlapDecision(
+    skillMapPath,
+    {
+      name: "name" in profile ? profile.name : void 0,
+      description: "description" in profile ? profile.description : void 0
+    },
+    profile.kind === "skill" ? profile.extends : []
+  );
+  const mapFinding = mapDecision?.finding;
+  const combinedSafety = mapFinding ? { verdict: verdictFor([...safety.findings, mapFinding], strictness), findings: [...safety.findings, mapFinding] } : safety;
   const advisory = formatAuditAdvisory(readAuditState(), {
     targetRoot: skillsRoot || void 0,
     candidateName: "name" in profile ? profile.name : void 0
   });
+  const notices = [
+    ...proStatus.notice ? [proStatus.notice] : [],
+    ...mapDecision?.informational ? [mapDecision.informational] : []
+  ];
   const gateResult = {
     profile,
     overlap,
     overlapLocked: !proStatus.enabled,
-    notices: proStatus.notice ? [proStatus.notice] : void 0,
+    notices: notices.length > 0 ? notices : void 0,
     safety: {
-      verdict: SAFETY_VERDICT_MAP[safety.verdict],
-      findings: mapSafetyFindings(safety.findings)
+      verdict: SAFETY_VERDICT_MAP[combinedSafety.verdict],
+      findings: mapSafetyFindings(combinedSafety.findings)
     },
     advisory
   };
-  return { safety, gateResult, proEnabled: proStatus.enabled };
+  return { safety: combinedSafety, gateResult, proEnabled: proStatus.enabled };
 }
 
 // src/queue.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync13, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
+import { join as join17 } from "path";
 function getQueuePath() {
-  return join16(getHomeDir(), "queue.json");
+  return join17(getHomeDir(), "queue.json");
 }
 function readQueue() {
   const path = getQueuePath();
-  if (!existsSync13(path)) {
+  if (!existsSync14(path)) {
     return { version: 1, entries: [] };
   }
-  const raw = readFileSync13(path, "utf-8");
+  const raw = readFileSync15(path, "utf-8");
   const parsed = JSON.parse(raw);
   return { version: 1, entries: parsed.entries ?? [] };
 }
@@ -3388,7 +3757,7 @@ function writeQueue(queue2) {
   const home = getHomeDir();
   mkdirSync6(home, { recursive: true });
   const finalPath = getQueuePath();
-  const tempPath = join16(home, `.queue.json.tmp-${randomUUID3()}`);
+  const tempPath = join17(home, `.queue.json.tmp-${randomUUID3()}`);
   try {
     writeFileSync6(tempPath, JSON.stringify(queue2, null, 2) + "\n", "utf-8");
     renameSync4(tempPath, finalPath);
@@ -3437,16 +3806,16 @@ function generateId(existingIds) {
 
 // src/handoff.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync14 } from "fs";
-import { dirname as dirname7, join as join17 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { dirname as dirname7, join as join18 } from "path";
 import { fileURLToPath } from "url";
 var KNOWN_AGENT_BINARIES = ["claude", "codex", "cursor-agent", "windsurf", "opencode", "gemini"];
 var HANDOFF_INSTRUCTION = "Read {prompt} and follow its instructions for the skill installed at {path}";
 function resolvePromptPath(assetName = "ingest-prompt.md") {
   const here = dirname7(fileURLToPath(import.meta.url));
-  const builtCandidate = join17(here, assetName);
-  if (existsSync14(builtCandidate)) return builtCandidate;
-  return join17(here, "..", "assets", assetName);
+  const builtCandidate = join18(here, assetName);
+  if (existsSync15(builtCandidate)) return builtCandidate;
+  return join18(here, "..", "assets", assetName);
 }
 function defaultIsOnPath(bin) {
   const finder = process.platform === "win32" ? "where" : "which";
@@ -3502,14 +3871,14 @@ function runHandoff(config, installedPath, options = {}) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { homedir as homedir4 } from "os";
 import { createInterface as createInterface3 } from "readline/promises";
 
 // src/agents.ts
 import { statSync as statSync8 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join18, resolve as resolve5 } from "path";
+import { join as join19, resolve as resolve6 } from "path";
 function isFile(p) {
   try {
     return statSync8(p).isFile();
@@ -3518,12 +3887,12 @@ function isFile(p) {
   }
 }
 function projectPath(root, cwd) {
-  return root ? resolve5(cwd, root) : void 0;
+  return root ? resolve6(cwd, root) : void 0;
 }
 function globalPath(root, home) {
   if (!root) return void 0;
   if (root === "~") return home;
-  if (root.startsWith("~/")) return join18(home, root.slice(2));
+  if (root.startsWith("~/")) return join19(home, root.slice(2));
   return root;
 }
 function makeAgent(spec) {
@@ -3753,8 +4122,8 @@ var AGENTS = [
 ].map(makeAgent);
 
 // src/commands/audit.ts
-import { existsSync as existsSync15 } from "fs";
-import { join as join19, resolve as resolvePath3 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join20, resolve as resolvePath3 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 
 // src/decision.ts
@@ -3822,7 +4191,7 @@ async function captureBusinessProfile(rl, existing) {
 function resolveReportPath(reportOption) {
   if (reportOption) return resolvePath3(reportOption);
   const iso = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  return join19(getHomeDir(), "reports", `audit-${iso}.md`);
+  return join20(getHomeDir(), "reports", `audit-${iso}.md`);
 }
 function printTerminalSummary(report, reportPath) {
   const { summary } = report;
@@ -3831,6 +4200,7 @@ function printTerminalSummary(report, reportPath) {
   console.log(
     `  findings: ${summary.findingCounts.CRITICAL} CRITICAL, ${summary.findingCounts.HIGH} HIGH, ${summary.findingCounts.MEDIUM} MEDIUM, ${summary.findingCounts.LOW} LOW`
   );
+  console.log(`  accepted: ${summary.acceptedCount} (suppressed from counts; see report)`);
   console.log(`  overlap clusters: ${summary.overlapClusterCount}  evolve-eligible: ${summary.evolveEligibleCount}`);
   console.log(`  report -> ${reportPath}`);
   for (const notice of report.notices) console.log(`  [notice] ${notice}`);
@@ -3871,7 +4241,7 @@ async function maybeHandoff(config, reportPath, options, rl) {
 }
 async function auditCommand(options = {}) {
   await maybeOfferInit({ json: options.json, yes: options.yes, suppressAuditOffer: true });
-  if (!existsSync15(getConfigPath())) {
+  if (!existsSync16(getConfigPath())) {
     throw new UserError(
       "no skill-forge config found \u2014 run `skill-forge init` first (audit requires a configured skill/MCP set; it never audits an invented default)."
     );
@@ -3887,7 +4257,9 @@ async function auditCommand(options = {}) {
         saveConfig(config);
       }
     }
-    const report = await auditConfiguredSet(config);
+    const { records: accepted, notices: storeNotices } = readAcceptedFindings();
+    const report = await auditConfiguredSet(config, { accepted });
+    if (storeNotices.length > 0) report.notices = [...report.notices, ...storeNotices];
     const reportPath = resolveReportPath(options.report);
     writeNewFile(reportPath, renderAuditMarkdown(report), "--report");
     try {
@@ -4214,7 +4586,7 @@ async function init(options = {}, deps = {}) {
 }
 async function maybeOfferInit(options = {}) {
   if (options.json || options.yes || !process.stdin.isTTY) return;
-  if (existsSync16(getConfigPath())) return;
+  if (existsSync17(getConfigPath())) return;
   console.log(
     "[skill-forge] No config found \u2014 run `skill-forge init` to detect your agents and set gate targets (init finishes with a `skill-forge audit` health check over what it just configured)."
   );
@@ -4263,7 +4635,8 @@ async function add(source, options = {}) {
   const { safety, gateResult, proEnabled } = await runGate(entry.skillDirs[0], targetRoot, {
     proFeatureLabel: PRO_FEATURE_LABEL,
     strictness: config.strictness,
-    artifact
+    artifact,
+    skillMapPath: options.skillMap
   });
   const { profile, overlap } = gateResult;
   if (profile.kind !== "skill") {
@@ -4364,7 +4737,7 @@ async function addMcp(source, config, options) {
       envVars: detail.env ? Object.keys(detail.env) : void 0,
       candidateEntry: detail.command ? { command: detail.command, args: detail.args, env: detail.env } : void 0
     };
-    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join20(process.cwd(), ".mcp.json");
+    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join21(process.cwd(), ".mcp.json");
     const result = promoteMcp(entry, serverProfile, mcpTargetPath, { force: options.force });
     reject(entry);
     logOutcome(`[skill-forge] promoted -> ${result.target} (server "${result.serverName}")`, options.json);
@@ -4442,7 +4815,8 @@ async function scan(source, options = {}) {
     const { safety, gateResult } = await runGate(candidatePath, skillsRoot ?? "", {
       strictness: config.strictness,
       artifact,
-      mcpTargets: config.mcpTargets ?? []
+      mcpTargets: config.mcpTargets ?? [],
+      skillMapPath: options.skillMap
     });
     if (artifact === "mcp" && gateResult.profile.kind === "mcp" && gateResult.profile.serverCount > 1) {
       console.error(
@@ -4459,7 +4833,7 @@ async function scan(source, options = {}) {
 }
 
 // src/commands/list.ts
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 async function list() {
   await maybeOfferInit();
   const config = loadConfig();
@@ -4472,14 +4846,14 @@ async function list() {
   }
   console.log(`[skill-forge] ${ids.length} held in quarantine (${quarantineDir}):`);
   for (const id of ids) {
-    const skillDirs = findSkillDirs(join21(quarantineDir, id));
+    const skillDirs = findSkillDirs(join22(quarantineDir, id));
     if (skillDirs.length === 0) {
       console.log(`  ${id}  (no SKILL.md found)`);
       continue;
     }
     const names = skillDirs.map((dir) => {
       try {
-        return readFrontmatter(join21(dir, "SKILL.md")).name;
+        return readFrontmatter(join22(dir, "SKILL.md")).name;
       } catch {
         return dir;
       }
@@ -4489,18 +4863,18 @@ async function list() {
 }
 
 // src/commands/guide.ts
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync19 } from "fs";
 
 // src/commands/held.ts
-import { existsSync as existsSync17, realpathSync as realpathSync3 } from "fs";
-import { basename as basename9, join as join22, resolve as resolvePath4, sep as sep2 } from "path";
+import { existsSync as existsSync18, realpathSync as realpathSync3 } from "fs";
+import { basename as basename9, join as join23, resolve as resolvePath4, sep as sep2 } from "path";
 var PRO_FEATURE_LABEL2 = "overlap analysis, the provenance ledger, and the pending-ingestion queue";
 function resolveHeldPath(quarantineDir, id) {
   if (id === "" || id !== basename9(id) || id === "." || id === "..") {
     throw new UserError(`invalid quarantine id "${id}" \u2014 pass a single id exactly as printed by \`skill-forge list\``);
   }
-  const candidate = join22(quarantineDir, id);
-  if (!existsSync17(candidate)) {
+  const candidate = join23(quarantineDir, id);
+  if (!existsSync18(candidate)) {
     throw new UserError(`no held entry with id "${id}" \u2014 run \`skill-forge list\` to see what is in quarantine`);
   }
   const realRoot = realpathSync3(resolvePath4(quarantineDir));
@@ -4528,7 +4902,7 @@ function resolveTargetRoot(config, target) {
 function heldSkillNames(skillDirs) {
   return skillDirs.map((dir) => {
     try {
-      return readFrontmatter(join22(dir, "SKILL.md")).name;
+      return readFrontmatter(join23(dir, "SKILL.md")).name;
     } catch {
       return basename9(dir);
     }
@@ -4536,7 +4910,7 @@ function heldSkillNames(skillDirs) {
 }
 function looksLikeMcpSandbox(quarantinePath) {
   const candidate = resolveMcpCandidatePath({ quarantinePath });
-  return [".mcp.json", "mcp.json", "package.json"].some((f) => existsSync17(join22(candidate, f)));
+  return [".mcp.json", "mcp.json", "package.json"].some((f) => existsSync18(join23(candidate, f)));
 }
 async function promoteHeldMcp(id, entry, config, options) {
   const candidatePath = resolveMcpCandidatePath(entry);
@@ -4570,7 +4944,7 @@ async function promoteHeldMcp(id, entry, config, options) {
     envVars: detail.env ? Object.keys(detail.env) : void 0,
     candidateEntry: detail.command ? { command: detail.command, args: detail.args, env: detail.env } : void 0
   };
-  const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join22(process.cwd(), ".mcp.json");
+  const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join23(process.cwd(), ".mcp.json");
   const result = promoteMcp(entry, serverProfile, mcpTargetPath, { force: options.force });
   reject(entry);
   logOutcome(`[skill-forge] promoted -> ${result.target} (server "${result.serverName}")`, options.json);
@@ -4815,7 +5189,7 @@ var TOPICS = [
 ];
 function readState() {
   const configPath = getConfigPath();
-  const configured = existsSync18(configPath);
+  const configured = existsSync19(configPath);
   const base = {
     configured,
     configPath,
@@ -5044,18 +5418,18 @@ async function status() {
 
 // src/evolve.ts
 import { createInterface as createInterface5 } from "readline/promises";
-import { createHash as createHash2 } from "crypto";
-import { cpSync as cpSync3, existsSync as existsSync19, lstatSync as lstatSync3, mkdtempSync as mkdtempSync3, readFileSync as readFileSync14, rmSync as rmSync6 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { cpSync as cpSync3, existsSync as existsSync20, lstatSync as lstatSync3, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, rmSync as rmSync6 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename10, dirname as dirname9, join as join23, resolve as resolvePath5, sep as sep3 } from "path";
+import { basename as basename10, dirname as dirname9, join as join24, resolve as resolvePath5, sep as sep3 } from "path";
 var SKILLOPT_BIN = "skillopt-sleep";
 var PRO_FEATURE_LABEL3 = "self-evolution via SkillOpt-Sleep (evolve) \u2014 re-gating, provenance, and the pending-ingestion queue";
 async function evolve(targetSkillDir, options = {}, deps = {}) {
   const exec = deps.exec ?? defaultExec;
   const json = options.json;
   const resolvedTargetDir = resolvePath5(targetSkillDir);
-  const skillMdPath = join23(resolvedTargetDir, "SKILL.md");
-  if (!existsSync19(skillMdPath)) {
+  const skillMdPath = join24(resolvedTargetDir, "SKILL.md");
+  if (!existsSync20(skillMdPath)) {
     throw new UserError(`no SKILL.md found at ${skillMdPath} \u2014 evolve requires an existing, installed skill directory`);
   }
   const proStatus = proFeatureStatus(PRO_FEATURE_LABEL3);
@@ -5113,33 +5487,33 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
     }
     return;
   }
-  const stagingRoot = join23(project, ".skillopt-sleep", "staging");
+  const stagingRoot = join24(project, ".skillopt-sleep", "staging");
   const stagingDir = resolvePath5(parsed.staging_dir);
   if (stagingDir !== stagingRoot && !stagingDir.startsWith(stagingRoot + sep3)) {
     throw new UserError(
       `skillopt-sleep reported a staging_dir outside the expected sandbox (${stagingRoot}): ${stagingDir} \u2014 refusing to use it`
     );
   }
-  const proposedSkillMd = join23(stagingDir, "proposed_SKILL.md");
-  const proposedClaudeMd = join23(stagingDir, "proposed_CLAUDE.md");
-  const reportMdPath = join23(stagingDir, "report.md");
-  if (!existsSync19(proposedSkillMd)) {
+  const proposedSkillMd = join24(stagingDir, "proposed_SKILL.md");
+  const proposedClaudeMd = join24(stagingDir, "proposed_CLAUDE.md");
+  const reportMdPath = join24(stagingDir, "report.md");
+  if (!existsSync20(proposedSkillMd)) {
     throw new UserError(`skillopt-sleep reported an accepted proposal but ${proposedSkillMd} is missing`);
   }
-  if (existsSync19(reportMdPath)) {
+  if (existsSync20(reportMdPath)) {
     notices.push(`SkillOpt-Sleep's full report: ${reportMdPath}`);
   }
   assertNotSymlink(proposedSkillMd, "proposed_SKILL.md");
   assertNotSymlink(proposedClaudeMd, "proposed_CLAUDE.md");
   const scannedSkillHash = sha256File(proposedSkillMd);
   const scannedClaudeHash = sha256File(proposedClaudeMd);
-  const tempDir = mkdtempSync3(join23(tmpdir2(), "skill-forge-evolve-"));
+  const tempDir = mkdtempSync3(join24(tmpdir2(), "skill-forge-evolve-"));
   let profile;
   let safety;
   try {
-    cpSync3(proposedSkillMd, join23(tempDir, "SKILL.md"));
-    if (existsSync19(proposedClaudeMd)) {
-      cpSync3(proposedClaudeMd, join23(tempDir, "CLAUDE.md"));
+    cpSync3(proposedSkillMd, join24(tempDir, "SKILL.md"));
+    if (existsSync20(proposedClaudeMd)) {
+      cpSync3(proposedClaudeMd, join24(tempDir, "CLAUDE.md"));
     }
     profile = asSkillProfile(profileSkill(tempDir), "for the evolved proposal");
     const strictness = loadConfig().strictness;
@@ -5238,7 +5612,7 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
     if (safetyVerdict === "block") process.exitCode = 1;
   } else {
     logOutcome(`[skill-forge] held \u2014 staging dir left in place -> ${stagingDir}`, json);
-    if (existsSync19(reportMdPath)) {
+    if (existsSync20(reportMdPath)) {
       logOutcome(`[skill-forge] see ${reportMdPath} for the full evidence report`, json);
     }
   }
@@ -5280,10 +5654,10 @@ function validateRunOutput(raw) {
   return { accepted: Boolean(obj.accepted), staging_dir: stagingDirRaw ?? null };
 }
 function readManifest(stagingDir) {
-  const manifestPath = join23(stagingDir, "manifest.json");
+  const manifestPath = join24(stagingDir, "manifest.json");
   let raw;
   try {
-    raw = readFileSync14(manifestPath, "utf-8");
+    raw = readFileSync16(manifestPath, "utf-8");
   } catch (err) {
     throw new UserError(`could not read staging manifest ${manifestPath}: ${err.message}`);
   }
@@ -5317,18 +5691,18 @@ function validateManifest(raw, manifestPath) {
   };
 }
 function filesIdentical(a, b) {
-  if (!existsSync19(a) || !existsSync19(b)) return false;
-  return readFileSync14(a).equals(readFileSync14(b));
+  if (!existsSync20(a) || !existsSync20(b)) return false;
+  return readFileSync16(a).equals(readFileSync16(b));
 }
 function isAlreadyAdopted(stagingDir, manifest) {
-  const proposedSkillMd = join23(stagingDir, "proposed_SKILL.md");
-  const proposedClaudeMd = join23(stagingDir, "proposed_CLAUDE.md");
+  const proposedSkillMd = join24(stagingDir, "proposed_SKILL.md");
+  const proposedClaudeMd = join24(stagingDir, "proposed_CLAUDE.md");
   let sawComparison = false;
-  if (existsSync19(proposedSkillMd)) {
+  if (existsSync20(proposedSkillMd)) {
     sawComparison = true;
     if (!filesIdentical(proposedSkillMd, manifest.live_skill_path)) return false;
   }
-  if (existsSync19(proposedClaudeMd) && manifest.live_memory_path) {
+  if (existsSync20(proposedClaudeMd) && manifest.live_memory_path) {
     sawComparison = true;
     if (!filesIdentical(proposedClaudeMd, manifest.live_memory_path)) return false;
   }
@@ -5346,8 +5720,8 @@ function assertNotSymlink(path, label) {
   }
 }
 function sha256File(path) {
-  if (!existsSync19(path)) return null;
-  return createHash2("sha256").update(readFileSync14(path)).digest("hex");
+  if (!existsSync20(path)) return null;
+  return createHash3("sha256").update(readFileSync16(path)).digest("hex");
 }
 
 // src/commands/evolve.ts
@@ -5355,12 +5729,118 @@ async function evolveCommand(targetSkillDir, options = {}) {
   await evolve(targetSkillDir, options);
 }
 
+// src/commands/finding.ts
+import { existsSync as existsSync21 } from "fs";
+function requireSavedConfig() {
+  if (!existsSync21(getConfigPath())) {
+    throw new UserError(
+      "no skill-forge config found \u2014 run `skill-forge init` first (`finding accept` re-runs the audit engine to resolve a live finding, and audit never runs against an invented default)."
+    );
+  }
+}
+function shortDate(iso) {
+  return iso.slice(0, 10) || iso;
+}
+async function findingAcceptCommand(prefix, options = {}) {
+  requireSavedConfig();
+  if (prefix.length < MIN_FINGERPRINT_PREFIX_LENGTH) {
+    throw new UserError(`prefix too short \u2014 use at least ${MIN_FINGERPRINT_PREFIX_LENGTH} hex chars (got "${prefix}")`);
+  }
+  const reason = options.reason;
+  if (reason === void 0) {
+    throw new UserError("--reason is required \u2014 a short note on why this finding is accepted");
+  }
+  validateAcceptReason(reason);
+  const config = loadConfig();
+  const { records: accepted } = readAcceptedFindings();
+  const report = await auditConfiguredSet(config, { accepted });
+  const activeMatches = resolveAmongFindings(prefix, report.hygiene);
+  if (activeMatches.length > 1) {
+    const list2 = activeMatches.map((f) => `${f.rule} @ ${f.target} (${f.fingerprint})`).join("; ");
+    throw new UserError(`prefix "${prefix}" matches ${activeMatches.length} current findings \u2014 use a longer prefix: ${list2}`);
+  }
+  if (activeMatches.length === 0) {
+    const alreadyMatches = resolveAmongRecords(prefix, accepted);
+    if (alreadyMatches.length > 0) {
+      const already = alreadyMatches[0];
+      throw new UserError(`already accepted on ${shortDate(already.acceptedAt)}: ${already.reason}`);
+    }
+    throw new UserError(`no current finding matches "${prefix}" \u2014 run \`skill-forge audit\` and copy a fingerprint from the report`);
+  }
+  const finding2 = activeMatches[0];
+  if (finding2.severity === "HIGH" || finding2.severity === "CRITICAL") {
+    throw new UserError(
+      `refusing to accept a ${finding2.severity} finding (${finding2.rule}) \u2014 acceptance is capped at LOW/MEDIUM, and there is no override flag. A HIGH/CRITICAL false positive is a rule bug to report/fix, not something to baseline.`
+    );
+  }
+  const record = {
+    fingerprint: finding2.fingerprint,
+    severity: finding2.severity,
+    rule: finding2.rule,
+    target: finding2.target,
+    context: finding2.context ?? finding2.detail,
+    detail: finding2.detail,
+    reason,
+    acceptedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source: "user"
+  };
+  writeAcceptedFindings([...accepted, record]);
+  if (options.json) {
+    console.log(JSON.stringify(record, null, 2));
+    return;
+  }
+  console.log(`[skill-forge] accepted [${record.severity}] ${record.rule} \u2014 ${record.target}`);
+  console.log(`  fingerprint: ${record.fingerprint}`);
+  console.log(`  reason: ${record.reason}`);
+  console.log('  this finding is excluded from active counts, but stays permanently visible under "Accepted findings" in every future report.');
+}
+async function findingRevokeCommand(prefix, options = {}) {
+  if (prefix.length < MIN_FINGERPRINT_PREFIX_LENGTH) {
+    throw new UserError(`prefix too short \u2014 use at least ${MIN_FINGERPRINT_PREFIX_LENGTH} hex chars (got "${prefix}")`);
+  }
+  const { records } = readAcceptedFindings();
+  const matches = resolveAmongRecords(prefix, records);
+  if (matches.length > 1) {
+    const list2 = matches.map((r) => `${r.rule} @ ${r.target} (${r.fingerprint})`).join("; ");
+    throw new UserError(`prefix "${prefix}" matches ${matches.length} accepted findings \u2014 use a longer prefix: ${list2}`);
+  }
+  if (matches.length === 0) {
+    throw new UserError(`no accepted finding matches "${prefix}" \u2014 run \`skill-forge finding list\` to see what is accepted`);
+  }
+  const record = matches[0];
+  writeAcceptedFindings(records.filter((r) => r.fingerprint !== record.fingerprint));
+  if (options.json) {
+    console.log(JSON.stringify(record, null, 2));
+    return;
+  }
+  console.log(`[skill-forge] revoked [${record.severity}] ${record.rule} \u2014 ${record.target}`);
+}
+async function findingListCommand(options = {}) {
+  const { records, notices } = readAcceptedFindings();
+  for (const notice of notices) console.error(`[skill-forge] ${notice}`);
+  const rows = options.stale ? records.filter((r) => !existsSync21(r.target)) : records;
+  if (options.json) {
+    console.log(JSON.stringify(rows, null, 2));
+    return;
+  }
+  if (rows.length === 0) {
+    console.log(options.stale ? "[skill-forge] no stale accepted findings." : "[skill-forge] no accepted findings.");
+    return;
+  }
+  console.log(`[skill-forge] accepted findings${options.stale ? " (stale \u2014 target no longer exists)" : ""}:`);
+  for (const r of rows) {
+    console.log(
+      `  [${r.severity}] ${sanitizeForMarkdown(r.rule)} \u2014 ${sanitizeForMarkdown(r.target)}: ${sanitizeForMarkdown(r.reason)} (fp ${r.fingerprint.slice(0, FINGERPRINT_DISPLAY_LENGTH)}, accepted ${shortDate(r.acceptedAt)})`
+    );
+  }
+}
+
 // src/commands/organize.ts
 import { resolve as resolvePath7 } from "path";
 
 // src/organize.ts
-import { existsSync as existsSync20, readFileSync as readFileSync15, readdirSync as readdirSync8, realpathSync as realpathSync4, statSync as statSync9 } from "fs";
-import { basename as basename11, join as join24, resolve as resolvePath6 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync17, readdirSync as readdirSync8, realpathSync as realpathSync4, statSync as statSync9 } from "fs";
+import { basename as basename11, join as join25, resolve as resolvePath6 } from "path";
 var PRO_FEATURE_LABEL4 = "set-level organizer reports";
 var TIERS = /* @__PURE__ */ new Set(["resource", "custom"]);
 var MATURITIES = /* @__PURE__ */ new Set(["seedling", "stable", "deprecated"]);
@@ -5373,7 +5853,7 @@ function listSubdirs2(dir) {
   }
   const out = [];
   for (const entry of entries) {
-    const full = join24(dir, entry.name);
+    const full = join25(dir, entry.name);
     if (entry.isDirectory()) {
       out.push(full);
       continue;
@@ -5391,14 +5871,14 @@ function findSkillDirsUnderRoot2(root) {
   const found = /* @__PURE__ */ new Set();
   const topDirs = listSubdirs2(root);
   for (const dir of topDirs) {
-    if (existsSync20(join24(dir, "SKILL.md"))) found.add(dir);
+    if (existsSync22(join25(dir, "SKILL.md"))) found.add(dir);
   }
-  for (const dir of listSubdirs2(join24(root, "skills"))) {
-    if (existsSync20(join24(dir, "SKILL.md"))) found.add(dir);
+  for (const dir of listSubdirs2(join25(root, "skills"))) {
+    if (existsSync22(join25(dir, "SKILL.md"))) found.add(dir);
   }
   for (const topDir of topDirs) {
-    for (const dir of listSubdirs2(join24(topDir, "skills"))) {
-      if (existsSync20(join24(dir, "SKILL.md"))) found.add(dir);
+    for (const dir of listSubdirs2(join25(topDir, "skills"))) {
+      if (existsSync22(join25(dir, "SKILL.md"))) found.add(dir);
     }
   }
   return Array.from(found).filter((p) => !p.includes("/.git/"));
@@ -5467,7 +5947,7 @@ function loadUsageSnapshot(snapshotPath) {
   const resolvedPath = resolvePath6(expandHome(snapshotPath));
   let raw;
   try {
-    raw = readFileSync15(resolvedPath, "utf-8");
+    raw = readFileSync17(resolvedPath, "utf-8");
   } catch (err) {
     return { usage: /* @__PURE__ */ new Map(), warning: `could not read usage snapshot (${err.message}); proceeding without usage` };
   }
@@ -5573,10 +6053,10 @@ function buildRegistryEntries(candidates, warnings) {
     }
     if (seenRealPaths.has(realPath)) continue;
     seenRealPaths.add(realPath);
-    const skillMdPath = join24(realPath, "SKILL.md");
+    const skillMdPath = join25(realPath, "SKILL.md");
     let text;
     try {
-      text = readFileSync15(skillMdPath, "utf-8");
+      text = readFileSync17(skillMdPath, "utf-8");
     } catch (err) {
       warnings.push(`could not read ${skillMdPath}: ${err.message}`);
       continue;
@@ -5982,7 +6462,162 @@ async function find(query, options = {}, deps = {}) {
 
 // src/commands/watch.ts
 import { realpathSync as realpathSync5 } from "fs";
-import { join as join25, resolve as resolvePath8 } from "path";
+import { join as join26, resolve as resolvePath8 } from "path";
+
+// src/gate/skillMapDrift.ts
+import { createHash as createHash4 } from "crypto";
+import { readFileSync as readFileSync18, existsSync as existsSync23 } from "fs";
+import { dirname as dirname10, isAbsolute as isAbsolute2, resolve as resolve7 } from "path";
+function sha256(text) {
+  return createHash4("sha256").update(text, "utf-8").digest("hex");
+}
+function shortHash(hash) {
+  return hash.slice(0, 12);
+}
+var ACTIONABLE_STATUSES = /* @__PURE__ */ new Set([
+  "upstream-moved",
+  "diverged",
+  "drifted",
+  "upstream-unreachable",
+  "local-missing"
+]);
+function isActionable(status2) {
+  return ACTIONABLE_STATUSES.has(status2);
+}
+function threeWayVerdict(localNormalized, upstreamHash, baselineHash) {
+  const localMatchesBaseline = localNormalized === baselineHash;
+  const upstreamMatchesBaseline = upstreamHash === baselineHash;
+  const hashSuffix = `baseline=${shortHash(baselineHash)}\u2026, local-normalized=${shortHash(localNormalized)}\u2026, upstream=${shortHash(upstreamHash)}\u2026`;
+  const TABLE = {
+    TT: { status: "in-sync", detail: `local and upstream both match the recorded baseline (${hashSuffix})` },
+    TF: { status: "upstream-moved", detail: `only upstream changed since baseline \u2014 review for adoption (${hashSuffix})` },
+    FT: { status: "local-only", detail: `only local content changed since baseline \u2014 deliberate fork divergence (${hashSuffix})` },
+    FF: { status: "diverged", detail: `both local and upstream changed since baseline \u2014 review for adoption (${hashSuffix})` }
+  };
+  const key = `${localMatchesBaseline ? "T" : "F"}${upstreamMatchesBaseline ? "T" : "F"}`;
+  const { status: status2, detail } = TABLE[key];
+  return { status: status2, detail, actionable: isActionable(status2) };
+}
+function resolveLocalPath(path, mapDir) {
+  const expanded = expandHome(path);
+  if (isAbsolute2(expanded)) return resolve7(expanded);
+  const candidates = [resolve7(expanded)];
+  if (mapDir) {
+    candidates.push(resolve7(mapDir, expanded));
+    candidates.push(resolve7(mapDir, "..", expanded));
+  }
+  for (const candidate of candidates) {
+    if (existsSync23(candidate)) return candidate;
+  }
+  return candidates[0];
+}
+function defaultReadLocalFile(path, mapDir) {
+  const resolved = resolveLocalPath(path, mapDir);
+  if (!existsSync23(resolved)) return void 0;
+  try {
+    return readFileSync18(resolved, "utf-8");
+  } catch {
+    return void 0;
+  }
+}
+async function defaultFetchUpstream(url) {
+  try {
+    const res = await fetch(url);
+    if (!res.ok) return void 0;
+    return await res.text();
+  } catch {
+    return void 0;
+  }
+}
+function isHttpUrl(value) {
+  return /^https?:\/\//i.test(value.trim());
+}
+function upstreamLabel(node, edge) {
+  return node?.url ?? node?.path ?? node?.name ?? node?.id ?? edge.to;
+}
+async function computeMapDrift(map, deps = {}) {
+  const mapDir = deps.mapPath ? dirname10(resolve7(expandHome(deps.mapPath))) : void 0;
+  const readLocalFile = deps.readLocalFile ?? ((path) => defaultReadLocalFile(path, mapDir));
+  const fetchUpstream = deps.fetchUpstream ?? defaultFetchUpstream;
+  const rows = [];
+  for (const edge of edgesOfType(map, "fork-of")) {
+    const localNode = nodeById(map, edge.from);
+    const upstreamNode = nodeById(map, edge.to);
+    const skillLabel = localNode?.name ?? localNode?.id ?? edge.from;
+    const upstream = upstreamLabel(upstreamNode, edge);
+    if (!localNode || !localNode.path || !localNode.contentHash) {
+      rows.push({
+        skill: skillLabel,
+        upstream,
+        status: "local-missing",
+        detail: !localNode ? `fork-of edge "from" node not found in map: ${edge.from}` : 'local skill node missing "path" or "contentHash" \u2014 cannot compare',
+        actionable: isActionable("local-missing")
+      });
+      continue;
+    }
+    const localResolved = resolveLocalPath(localNode.path, mapDir);
+    if (!existsSync23(localResolved)) {
+      rows.push({
+        skill: skillLabel,
+        upstream,
+        status: "local-missing",
+        detail: `local path does not exist: ${localResolved}`,
+        actionable: isActionable("local-missing")
+      });
+      continue;
+    }
+    const upstreamLocation = upstreamNode?.url ?? upstreamNode?.path;
+    if (!upstreamLocation) {
+      rows.push({
+        skill: skillLabel,
+        upstream,
+        status: "upstream-unreachable",
+        detail: 'upstream node has no "url" or "path" to fetch/read',
+        actionable: isActionable("upstream-unreachable")
+      });
+      continue;
+    }
+    const upstreamText = isHttpUrl(upstreamLocation) ? await fetchUpstream(upstreamLocation) : readLocalFile(upstreamLocation);
+    if (upstreamText === void 0) {
+      rows.push({
+        skill: skillLabel,
+        upstream,
+        status: "upstream-unreachable",
+        detail: `could not fetch/read upstream: ${upstreamLocation}`,
+        actionable: isActionable("upstream-unreachable")
+      });
+      continue;
+    }
+    const upstreamHash = sha256(upstreamText);
+    const baselineHash = upstreamNode?.baselineHash;
+    const localNormalized = localNode.contentHashNormalized;
+    if (baselineHash && localNormalized) {
+      const { status: status2, detail, actionable } = threeWayVerdict(localNormalized, upstreamHash, baselineHash);
+      rows.push({ skill: skillLabel, upstream, status: status2, detail, actionable, baselineHash, upstreamHash });
+      continue;
+    }
+    if (upstreamHash === localNode.contentHash) {
+      rows.push({
+        skill: skillLabel,
+        upstream,
+        status: "in-sync",
+        detail: `contentHash matches (${shortHash(upstreamHash)}\u2026)`,
+        actionable: isActionable("in-sync")
+      });
+    } else {
+      rows.push({
+        skill: skillLabel,
+        upstream,
+        status: "drifted",
+        detail: `recorded ${shortHash(localNode.contentHash)}\u2026, upstream now hashes to ${shortHash(upstreamHash)}\u2026`,
+        actionable: isActionable("drifted")
+      });
+    }
+  }
+  return rows;
+}
+
+// src/commands/watch.ts
 var PRO_FEATURE_LABEL5 = "provenance drift watch (watch)";
 function isGitUrl(source) {
   const s = source.trim();
@@ -6018,7 +6653,7 @@ async function checkGitDrift(exec, url, ref) {
 async function runWatch(config, options = {}, deps = {}) {
   const proStatus = proFeatureStatus(PRO_FEATURE_LABEL5);
   if (!proStatus.enabled) {
-    return { roots: [], rows: [], warnings: [], notices: [proStatus.notice ?? "Pro feature (watch) locked."] };
+    return { roots: [], rows: [], warnings: [], notices: [proStatus.notice ?? "Pro feature (watch) locked."], mapDrift: [] };
   }
   const notices = proStatus.notice ? [proStatus.notice] : [];
   const exec = deps.exec ?? defaultExec;
@@ -6044,7 +6679,7 @@ async function runWatch(config, options = {}, deps = {}) {
       ledger = readProvenanceLedger(resolvedRoot);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      const ledgerPath = join25(resolvedRoot, "SOURCES.md");
+      const ledgerPath = join26(resolvedRoot, "SOURCES.md");
       roots.push({ root, realPath, exists, ledgerPath, ledgerExists: false });
       warnings.push(`${ledgerPath}: could not read ledger: ${message}`);
       continue;
@@ -6084,7 +6719,19 @@ async function runWatch(config, options = {}, deps = {}) {
       rows.push({ ...rowBase, checkMethod: "git-ls-remote", driftStatus: status2, detail });
     }
   }
-  return { roots, rows, warnings, notices };
+  let mapDrift = [];
+  if (options.skillMap) {
+    try {
+      const map = loadSkillMap(options.skillMap);
+      mapDrift = await computeMapDrift(map, {
+        mapPath: options.skillMap,
+        ...options.offline ? { fetchUpstream: async () => void 0 } : {}
+      });
+    } catch (err) {
+      warnings.push(`skill map at ${options.skillMap}: ${err.message}`);
+    }
+  }
+  return { roots, rows, warnings, notices, mapDrift };
 }
 function printWatchTerminal(report) {
   console.log("[skill-forge] watch \u2014 provenance drift check");
@@ -6122,6 +6769,13 @@ ${sanitizeForMarkdown(root.root)} (${sanitizeForMarkdown(root.realPath)})`);
     console.log("\nWarnings:");
     for (const w of report.warnings) console.log(`  - ${sanitizeForMarkdown(w)}`);
   }
+  if (report.mapDrift.length > 0) {
+    console.log("\nSkill-map fork-of drift:");
+    for (const row of report.mapDrift) {
+      console.log(`  \u2022 ${sanitizeForMarkdown(row.skill)}  <-  ${sanitizeForMarkdown(row.upstream)}`);
+      console.log(`      ${row.status} \u2014 ${sanitizeForMarkdown(row.detail)}`);
+    }
+  }
   console.log("\nCompare each stored ref to current upstream; re-run ingestion on any that moved.");
 }
 async function watchCommand(options = {}) {
@@ -6135,8 +6789,8 @@ async function watchCommand(options = {}) {
 }
 
 // src/commands/routine.ts
-import { existsSync as existsSync21, rmSync as rmSync7, statSync as statSync10 } from "fs";
-import { join as join26 } from "path";
+import { existsSync as existsSync24, rmSync as rmSync7, statSync as statSync10 } from "fs";
+import { join as join27 } from "path";
 var PRO_FEATURE_LABEL6 = "the scheduled maintenance routine";
 var SEVERITY_ORDER = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
 function parseFailOnFloor(failOn) {
@@ -6157,7 +6811,7 @@ function exceedsFloor(audit2, failOn) {
 }
 function resolveReportPath2(override, generatedAt) {
   if (override) return override;
-  return join26(getHomeDir(), "reports", `routine-${generatedAt.replace(/[:.]/g, "-")}.md`);
+  return join27(getHomeDir(), "reports", `routine-${generatedAt.replace(/[:.]/g, "-")}.md`);
 }
 function runHousekeeping(config, options) {
   const actions = [];
@@ -6166,7 +6820,7 @@ function runHousekeeping(config, options) {
   const pruneDays = options.pruneDays ?? 30;
   const cutoff = Date.now() - pruneDays * 864e5;
   for (const id of listQuarantineIds(config.quarantineDir)) {
-    const path = join26(config.quarantineDir, id);
+    const path = join27(config.quarantineDir, id);
     let mtime;
     try {
       mtime = statSync10(path).mtimeMs;
@@ -6204,7 +6858,7 @@ function runHousekeeping(config, options) {
   }
   for (const entry of entries) {
     if (entry.status !== "pending") continue;
-    if (!entry.installedPath || existsSync21(entry.installedPath)) continue;
+    if (!entry.installedPath || existsSync24(entry.installedPath)) continue;
     if (apply) {
       try {
         updateQueueEntry(entry.id, { status: "dismissed" });
@@ -6237,6 +6891,7 @@ function renderRoutineMarkdown(result, audit2, watch, organize) {
     "",
     `- Skills: ${result.audit.skillCount} across ${audit2.summary.rootCount} configured root(s)`,
     `- Findings: ${audit2.summary.findingCounts.CRITICAL ?? 0} critical, ${audit2.summary.findingCounts.HIGH ?? 0} high, ${audit2.summary.findingCounts.MEDIUM ?? 0} medium, ${audit2.summary.findingCounts.LOW ?? 0} low`,
+    `- Accepted: ${audit2.summary.acceptedCount} (suppressed from the counts above; see Accepted findings)`,
     `- Overlap clusters: ${result.audit.overlapClusters.length}${result.audit.overlapLocked ? ' (overlap analysis was locked \u2014 not "none found")' : ""}`,
     `- Pending queue entries: ${result.pending.queue}`,
     `- Held in quarantine: ${result.pending.quarantine}`
@@ -6247,6 +6902,10 @@ function renderRoutineMarkdown(result, audit2, watch, organize) {
   if (organize) {
     lines.push(`- Capability registry: ${result.organize?.skills ?? 0} skill(s) across ${result.organize?.roots ?? 0} root(s)`);
   }
+  if (result.notices.length > 0) {
+    lines.push("", "## Notices", "");
+    for (const item of result.notices) lines.push(`- ${sanitizeForMarkdown(item)}`);
+  }
   if (result.degraded.length > 0) {
     lines.push("", "## Incomplete steps", "");
     for (const item of result.degraded) lines.push(`- ${sanitizeForMarkdown(item)}`);
@@ -6262,9 +6921,18 @@ function renderRoutineMarkdown(result, audit2, watch, organize) {
   }
   if (audit2.hygiene.length > 0) {
     lines.push("", "## Findings", "");
-    for (const finding of audit2.hygiene) {
+    for (const finding2 of audit2.hygiene) {
+      const fp = finding2.fingerprint ? finding2.fingerprint.slice(0, 12) : "unknown";
       lines.push(
-        `- **${finding.severity}** \`${sanitizeForMarkdown(finding.rule)}\` \u2014 ${sanitizeForMarkdown(finding.target)}: ${sanitizeForMarkdown(finding.detail)}`
+        `- **${finding2.severity}** \`${sanitizeForMarkdown(finding2.rule)}\` \u2014 ${sanitizeForMarkdown(finding2.target)}: ${sanitizeForMarkdown(finding2.detail)} (fp ${fp})`
+      );
+    }
+  }
+  if (audit2.accepted.length > 0) {
+    lines.push("", "## Accepted findings", "");
+    for (const entry of audit2.accepted) {
+      lines.push(
+        `- **${entry.finding.severity}** \`${sanitizeForMarkdown(entry.finding.rule)}\` \u2014 ${sanitizeForMarkdown(entry.finding.target)}: ${sanitizeForMarkdown(entry.reason)} (accepted ${sanitizeForMarkdown(entry.acceptedAt.slice(0, 10))})`
       );
     }
   }
@@ -6294,7 +6962,9 @@ async function routineCommand(options = {}) {
   }
   const config = loadConfig();
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const audit2 = await auditConfiguredSet(config);
+  const { records: accepted, notices: storeNotices } = readAcceptedFindings();
+  for (const notice of storeNotices) log(`[skill-forge] ${notice}`);
+  const audit2 = await auditConfiguredSet(config, { accepted });
   const auditState = summarizeAudit(audit2);
   const degraded = [];
   let watch;
@@ -6337,6 +7007,7 @@ async function routineCommand(options = {}) {
     organize: organize ? { skills: organize.registry.count, roots: organize.registry.skillsRoots.length, notices: organize.notices } : void 0,
     pending: { queue: pending.count, quarantine: quarantine2.count },
     housekeeping,
+    notices: storeNotices,
     degraded
   };
   const failure = degraded.length > 0 ? `${degraded.length} step(s) did not complete: ${degraded.join("; ")}` : exceedsFloor(auditState, options.failOn ?? "none");
@@ -6355,6 +7026,7 @@ async function routineCommand(options = {}) {
     console.log(
       `  findings: ${auditState.findings.CRITICAL ?? 0} critical / ${auditState.findings.HIGH ?? 0} high / ${auditState.findings.MEDIUM ?? 0} medium / ${auditState.findings.LOW ?? 0} low`
     );
+    console.log(`  accepted: ${auditState.acceptedCount ?? 0} (suppressed from counts; see report)`);
     if (result.watch) console.log(`  drift: ${result.watch.moved} moved of ${result.watch.checked} tracked`);
     if (result.organize) console.log(`  registry: ${result.organize.skills} skill(s)`);
     console.log(`  pending: ${result.pending.queue} queue, ${result.pending.quarantine} quarantine`);
@@ -6379,7 +7051,7 @@ async function routineCommand(options = {}) {
 
 // src/commands/ingest.ts
 import { realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute2, relative as relative2, resolve as resolvePath9 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute3, relative as relative2, resolve as resolvePath9 } from "path";
 var PRO_FEATURE_LABEL7 = "the pending-ingestion queue";
 var VALID_STATUSES = ["ingested", "dismissed"];
 function requireProFeature() {
@@ -6427,12 +7099,12 @@ function realpathOrNull(p) {
 }
 function isUnderRoot(candidate, root) {
   const rel = relative2(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function validatePendingEntries(entries, config) {
   const quarantineRoot = realpathOrNull(resolvePath9(config.quarantineDir));
   const skillsRoots = config.skillsRoots.map((r) => realpathOrNull(resolvePath9(r))).filter((r) => r !== null);
-  const mcpTargetDirs = (config.mcpTargets ?? []).map((f) => realpathOrNull(dirname11(resolvePath9(f)))).filter((r) => r !== null);
+  const mcpTargetDirs = (config.mcpTargets ?? []).map((f) => realpathOrNull(dirname12(resolvePath9(f)))).filter((r) => r !== null);
   const allowedRoots = [quarantineRoot, ...skillsRoots, ...mcpTargetDirs].filter((r) => r !== null);
   const valid = [];
   const excluded = [];
@@ -6504,14 +7176,14 @@ async function queueClose(id, options = {}) {
 }
 
 // src/commands/refine.ts
-import { createHash as createHash4, randomUUID as randomUUID5 } from "crypto";
-import { chmodSync, existsSync as existsSync24, lstatSync as lstatSync4, mkdirSync as mkdirSync9, readFileSync as readFileSync17, realpathSync as realpathSync9, renameSync as renameSync6, rmSync as rmSync9, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname13, isAbsolute as isAbsolute4, join as join29, relative as relative4, resolve as resolvePath12, sep as sep4 } from "path";
+import { createHash as createHash6, randomUUID as randomUUID5 } from "crypto";
+import { chmodSync, existsSync as existsSync27, lstatSync as lstatSync4, mkdirSync as mkdirSync9, readFileSync as readFileSync20, realpathSync as realpathSync9, renameSync as renameSync6, rmSync as rmSync9, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname14, isAbsolute as isAbsolute5, join as join30, relative as relative4, resolve as resolvePath12, sep as sep4 } from "path";
 import { createInterface as createInterface6 } from "readline/promises";
 
 // src/refine/context.ts
-import { existsSync as existsSync23, realpathSync as realpathSync8, statSync as statSync12 } from "fs";
-import { isAbsolute as isAbsolute3, join as join28, relative as relative3, resolve as resolvePath11 } from "path";
+import { existsSync as existsSync26, realpathSync as realpathSync8, statSync as statSync12 } from "fs";
+import { isAbsolute as isAbsolute4, join as join29, relative as relative3, resolve as resolvePath11 } from "path";
 
 // src/refine/models.ts
 import { randomBytes } from "crypto";
@@ -6567,40 +7239,40 @@ function fingerprintKey(skill, target, overrideType, action) {
   return [normalize(skill), normalize(target), overrideType, action ?? ""].join("::");
 }
 function contentSimilarity(a, b) {
-  const tokenize2 = (s) => new Set(s.toLowerCase().split(/\s+/).filter(Boolean));
-  const tokensA = tokenize2(a);
-  const tokensB = tokenize2(b);
+  const tokenize3 = (s) => new Set(s.toLowerCase().split(/\s+/).filter(Boolean));
+  const tokensA = tokenize3(a);
+  const tokensB = tokenize3(b);
   if (tokensA.size === 0 || tokensB.size === 0) return 0;
   let intersectionSize = 0;
   for (const token of tokensA) {
     if (tokensB.has(token)) intersectionSize++;
   }
-  const unionSize2 = tokensA.size + tokensB.size - intersectionSize;
-  return unionSize2 === 0 ? 0 : intersectionSize / unionSize2;
+  const unionSize3 = tokensA.size + tokensB.size - intersectionSize;
+  return unionSize3 === 0 ? 0 : intersectionSize / unionSize3;
 }
 
 // src/refine/store.ts
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync16, statSync as statSync11, realpathSync as realpathSync7 } from "fs";
-import { join as join27, resolve as resolvePath10 } from "path";
+import { createHash as createHash5 } from "crypto";
+import { existsSync as existsSync25, readFileSync as readFileSync19, statSync as statSync11, realpathSync as realpathSync7 } from "fs";
+import { join as join28, resolve as resolvePath10 } from "path";
 var SIMILARITY_JOIN_THRESHOLD = 0.7;
 var READY_THRESHOLD = 2;
 function getRefinementsDir() {
-  return join27(getHomeDir(), "refinements");
+  return join28(getHomeDir(), "refinements");
 }
 function getRefinementsPath() {
-  return join27(getRefinementsDir(), "refinements.json");
+  return join28(getRefinementsDir(), "refinements.json");
 }
 function getPatternsPath() {
-  return join27(getRefinementsDir(), "patterns.json");
+  return join28(getRefinementsDir(), "patterns.json");
 }
 function getBackupsDir() {
-  return join27(getRefinementsDir(), "backups");
+  return join28(getRefinementsDir(), "backups");
 }
 function readJsonFile(path, label) {
   let raw;
   try {
-    raw = readFileSync16(path, "utf-8");
+    raw = readFileSync19(path, "utf-8");
   } catch (err) {
     throw new UserError(`unable to read ${label} at ${path}: ${err.message}`);
   }
@@ -6611,7 +7283,7 @@ function readJsonFile(path, label) {
   }
 }
 function readStore(path, label, validateRecord) {
-  if (!existsSync22(path)) {
+  if (!existsSync25(path)) {
     return { schemaVersion: 1, records: [] };
   }
   const parsed = readJsonFile(path, label);
@@ -6835,16 +7507,16 @@ function createBackup(filePaths, deps = {}) {
   const randomHex = deps.randomHex ?? defaultRandomHex;
   const id = `${formatBackupTimestamp(now)}-${randomHex()}`;
   const files = filePaths.map((path) => {
-    if (!existsSync22(path)) {
+    if (!existsSync25(path)) {
       return { path, existed: false, sha256: null, mode: null, contentBase64: null };
     }
-    const bytes = readFileSync16(path);
+    const bytes = readFileSync19(path);
     const mode = statSync11(path).mode & 511;
-    const sha256 = createHash3("sha256").update(bytes).digest("hex");
-    return { path, existed: true, sha256, mode, contentBase64: bytes.toString("base64") };
+    const sha2562 = createHash5("sha256").update(bytes).digest("hex");
+    return { path, existed: true, sha256: sha2562, mode, contentBase64: bytes.toString("base64") };
   });
   const manifest = { id, createdAt: now.toISOString(), files };
-  writeJsonAtomic(join27(getBackupsDir(), id, "manifest.json"), manifest);
+  writeJsonAtomic(join28(getBackupsDir(), id, "manifest.json"), manifest);
   return manifest;
 }
 function validateBackupManifestShape(value, path) {
@@ -6893,8 +7565,8 @@ function readBackupManifest(id) {
   if (!isValidBackupId(id)) {
     throw new UserError(`invalid backup id "${id}" \u2014 expected the format produced by \`skill-forge refine promote\` (e.g. 20260720T142305Z-a1b2)`);
   }
-  const manifestPath = join27(getBackupsDir(), id, "manifest.json");
-  if (!existsSync22(manifestPath)) {
+  const manifestPath = join28(getBackupsDir(), id, "manifest.json");
+  if (!existsSync25(manifestPath)) {
     throw new UserError(`no backup with id: ${id}`);
   }
   const parsed = readJsonFile(manifestPath, "backup manifest");
@@ -6923,25 +7595,25 @@ function realpathOrNull2(p) {
 }
 function isUnderRoot2(candidate, root) {
   const rel = relative3(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
 }
 function resolveScopes(config, cwd, skill, userRootFlag) {
   assertPlainSkillName(skill);
   const resolvedCwd = resolvePath11(cwd);
-  const localDir = join28(resolvedCwd, ".claude", "skills", skill);
-  const sharedDir = join28(resolvedCwd, "skills", skill);
-  const local = { scope: "local", dir: localDir, exists: existsSync23(localDir) };
-  const shared = { scope: "shared", dir: sharedDir, exists: existsSync23(sharedDir) };
+  const localDir = join29(resolvedCwd, ".claude", "skills", skill);
+  const sharedDir = join29(resolvedCwd, "skills", skill);
+  const local = { scope: "local", dir: localDir, exists: existsSync26(localDir) };
+  const shared = { scope: "shared", dir: sharedDir, exists: existsSync26(sharedDir) };
   const user = resolveUserScope(config, resolvedCwd, skill, userRootFlag);
   return { local, shared, user };
 }
 function resolveUserScope(config, resolvedCwd, skill, userRootFlag) {
   if (userRootFlag) {
     const root = resolvePath11(userRootFlag);
-    return { resolved: true, dir: join28(root, skill), root: userRootFlag, reason: "flag" };
+    return { resolved: true, dir: join29(root, skill), root: userRootFlag, reason: "flag" };
   }
   const cwdReal = realpathOrNull2(resolvedCwd) ?? resolvedCwd;
-  const candidates = config.skillsRoots.map((root) => ({ root, dir: join28(resolveConfiguredRoot2(root), skill) }));
+  const candidates = config.skillsRoots.map((root) => ({ root, dir: join29(resolveConfiguredRoot2(root), skill) }));
   for (const candidate of candidates) {
     const skillReal = realpathOrNull2(candidate.dir);
     if (skillReal) {
@@ -6976,12 +7648,12 @@ function inventoryScopeDir(scope, dir) {
     scope,
     dir,
     dirExists: isDirectory(dir),
-    skillMd: isFile2(join28(dir, "SKILL.md")),
-    patchMd: isFile2(join28(dir, "SKILL.patch.md")),
-    extendMd: isFile2(join28(dir, "SKILL.extend.md")),
-    configJson: isFile2(join28(dir, "skill-config.json")),
-    hooksDir: isDirectory(join28(dir, "hooks")),
-    scriptsDir: isDirectory(join28(dir, "scripts"))
+    skillMd: isFile2(join29(dir, "SKILL.md")),
+    patchMd: isFile2(join29(dir, "SKILL.patch.md")),
+    extendMd: isFile2(join29(dir, "SKILL.extend.md")),
+    configJson: isFile2(join29(dir, "skill-config.json")),
+    hooksDir: isDirectory(join29(dir, "hooks")),
+    scriptsDir: isDirectory(join29(dir, "scripts"))
   };
 }
 function inventoryAllScopes(resolution) {
@@ -7254,14 +7926,14 @@ function resolveConfiguredRoot3(root) {
 }
 function isUnderRoot3(candidate, root) {
   const rel = relative4(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
 }
 function sanitizeDiffForConsole(diff) {
   return diff.split("\n").map((line) => sanitizeForMarkdown(line)).join("\n");
 }
 function resolveContentOption(options) {
   if (options.content !== void 0) return options.content;
-  if (options.contentFile) return readFileSync17(resolvePath12(options.contentFile), "utf-8");
+  if (options.contentFile) return readFileSync20(resolvePath12(options.contentFile), "utf-8");
   return void 0;
 }
 function validateCaptureOptions(options) {
@@ -7413,8 +8085,8 @@ function ensureScopeDirSafe(scopeDir, resolvedCwd) {
 }
 function writeOverrideFile(scopeDir, relPath, content, resolvedCwd) {
   const realScopeDir = ensureScopeDirSafe(scopeDir, resolvedCwd);
-  const destPath = join29(scopeDir, relPath);
-  const destDir = dirname13(destPath);
+  const destPath = join30(scopeDir, relPath);
+  const destDir = dirname14(destPath);
   mkdirSync9(destDir, { recursive: true });
   const realDestDir = realpathSync9(destDir);
   if (!isUnderRoot3(realDestDir, realScopeDir)) {
@@ -7509,12 +8181,12 @@ Write ${preview.destPath}? [y/N] `);
 }
 function renderCaptureArtifactPreview(opts, content, refinementId, generatedAt, scopeDir) {
   const probeRelPath = opts.overrideType === "patch" ? "SKILL.patch.md" : opts.overrideType === "extend" || opts.overrideType === "new" ? "SKILL.extend.md" : void 0;
-  const probePath = probeRelPath ? join29(scopeDir, probeRelPath) : void 0;
-  const existingContent = probePath && existsSync24(probePath) ? readFileSync17(probePath, "utf-8") : "";
+  const probePath = probeRelPath ? join30(scopeDir, probeRelPath) : void 0;
+  const existingContent = probePath && existsSync27(probePath) ? readFileSync20(probePath, "utf-8") : "";
   const rendered = renderCaptureArtifact(opts, content, refinementId, generatedAt, existingContent);
   const relPath = rendered.relPath;
-  const destPath = join29(scopeDir, relPath);
-  const before = existsSync24(destPath) ? readFileSync17(destPath, "utf-8") : "";
+  const destPath = join30(scopeDir, relPath);
+  const before = existsSync27(destPath) ? readFileSync20(destPath, "utf-8") : "";
   const diff = previewDiff(before, rendered.content, destPath);
   return { relPath, content: rendered.content, destPath, diff };
 }
@@ -7611,16 +8283,16 @@ async function refineWhichCommand(skill, options = {}) {
 }
 function writePostWriteSidecar(backupId, files) {
   const sidecar = { schemaVersion: 1, files };
-  const dir = join29(getBackupsDir(), backupId);
+  const dir = join30(getBackupsDir(), backupId);
   mkdirSync9(dir, { recursive: true });
-  writeFileSync9(join29(dir, "post.json"), JSON.stringify(sidecar, null, 2) + "\n", { mode: 384 });
+  writeFileSync9(join30(dir, "post.json"), JSON.stringify(sidecar, null, 2) + "\n", { mode: 384 });
 }
 function readPostWriteSidecar(backupId) {
-  const path = join29(getBackupsDir(), backupId, "post.json");
-  if (!existsSync24(path)) return { hashes: /* @__PURE__ */ new Map(), status: "missing" };
+  const path = join30(getBackupsDir(), backupId, "post.json");
+  if (!existsSync27(path)) return { hashes: /* @__PURE__ */ new Map(), status: "missing" };
   let raw;
   try {
-    raw = readFileSync17(path, "utf-8");
+    raw = readFileSync20(path, "utf-8");
   } catch {
     return { hashes: /* @__PURE__ */ new Map(), status: "unreadable" };
   }
@@ -7678,8 +8350,8 @@ async function refinePromoteCommand(patternId, options = {}) {
   if (!isUnderRoot3(realSkillDir, realUserRoot)) {
     throw new UserError(`refusing to promote: resolved skill directory ${skillDir} is outside the configured user scope root ${scopes.user.root}`);
   }
-  const skillMdPath = join29(skillDir, "SKILL.md");
-  if (!existsSync24(skillMdPath)) {
+  const skillMdPath = join30(skillDir, "SKILL.md");
+  if (!existsSync27(skillMdPath)) {
     throw new UserError(`user-scope SKILL.md not found at ${skillMdPath} \u2014 refusing to promote against a missing base skill.`);
   }
   const refinementsStore = readRefinementsStore();
@@ -7696,7 +8368,7 @@ async function refinePromoteCommand(patternId, options = {}) {
       `pattern ${patternId}'s representative refinement is a '${representative.overrideType}' override \u2014 promote currently only materializes patch/extend/new-type patterns against the user-scope SKILL.md; other override types must be merged manually.`
     );
   }
-  const before = readFileSync17(skillMdPath, "utf-8");
+  const before = readFileSync20(skillMdPath, "utf-8");
   const after = applyPatchBlocks(before, [block]);
   const diff = previewDiff(before, after, skillMdPath);
   if (options.dryRun) {
@@ -7728,7 +8400,7 @@ Promote pattern ${patternId} into ${skillMdPath}? [y/N] `);
     throw err;
   }
   try {
-    const postSha256 = createHash4("sha256").update(readFileSync17(skillMdPath)).digest("hex");
+    const postSha256 = createHash6("sha256").update(readFileSync20(skillMdPath)).digest("hex");
     writePostWriteSidecar(backup.id, [{ path: skillMdPath, sha256: postSha256 }]);
     markGeneralized(patternId, backup.id);
     const skillsRoot = resolveConfiguredRoot3(scopes.user.root);
@@ -7754,10 +8426,10 @@ Promote pattern ${patternId} into ${skillMdPath}? [y/N] `);
 }
 function assertBackupDirContained(backupId) {
   const backupsDir = getBackupsDir();
-  if (!existsSync24(backupsDir)) return;
+  if (!existsSync27(backupsDir)) return;
   const realBackupsDir = realpathSync9(backupsDir);
-  const backupDir = join29(backupsDir, backupId);
-  if (!existsSync24(backupDir)) return;
+  const backupDir = join30(backupsDir, backupId);
+  if (!existsSync27(backupDir)) return;
   const realBackupDir = realpathSync9(backupDir);
   if (!isUnderRoot3(realBackupDir, realBackupsDir)) {
     throw new UserError(`refusing rollback: backup id "${backupId}" resolves outside the backups directory`);
@@ -7769,9 +8441,9 @@ function resolveTargetRealPath(path) {
     try {
       const real = realpathSync9(lexicalAncestor);
       const remainder = relative4(lexicalAncestor, resolvePath12(path));
-      return remainder === "" ? real : join29(real, remainder);
+      return remainder === "" ? real : join30(real, remainder);
     } catch {
-      const parent = dirname13(lexicalAncestor);
+      const parent = dirname14(lexicalAncestor);
       if (parent === lexicalAncestor) return resolvePath12(path);
       lexicalAncestor = parent;
     }
@@ -7815,7 +8487,7 @@ function findLexicalRoot(filePath, config) {
   for (const root of config.skillsRoots) {
     const rootLexical = resolveConfiguredRoot3(root);
     const rel = relative4(rootLexical, lexicalTarget);
-    if (rel !== "" && (rel === ".." || rel.startsWith(`..${sep4}`) || isAbsolute4(rel))) continue;
+    if (rel !== "" && (rel === ".." || rel.startsWith(`..${sep4}`) || isAbsolute5(rel))) continue;
     let rootReal;
     try {
       rootReal = realpathSync9(rootLexical);
@@ -7838,7 +8510,7 @@ function walkRealComponents(filePath, config, createMissing) {
   let current = rootReal;
   for (const component of dirComponents) {
     if (current === void 0) break;
-    const next = join29(current, component);
+    const next = join30(current, component);
     let lst;
     try {
       lst = lstatSync4(next);
@@ -7869,7 +8541,7 @@ function safeRestoreWrite(filePath, contentBuffer, mode, config) {
   if (parentReal === void 0) {
     throw new UserError(`refusing to restore ${filePath}: could not establish a real parent directory`);
   }
-  const finalPath = join29(parentReal, leafComponent);
+  const finalPath = join30(parentReal, leafComponent);
   if (!isUnderRoot3(finalPath, rootReal)) {
     throw new UserError(`refusing to restore ${filePath}: resolves outside root ${rootReal}`);
   }
@@ -7895,7 +8567,7 @@ function safeRestoreWrite(filePath, contentBuffer, mode, config) {
 function safeDeleteTombstone(filePath, config) {
   const { parentReal, leafComponent, rootReal } = walkRealComponents(filePath, config, false);
   if (parentReal === void 0) return;
-  const finalPath = join29(parentReal, leafComponent);
+  const finalPath = join30(parentReal, leafComponent);
   if (!isUnderRoot3(finalPath, rootReal)) {
     throw new UserError(`refusing to delete ${filePath}: resolves outside root ${rootReal}`);
   }
@@ -7937,7 +8609,7 @@ async function refineRollbackCommand(backupId, options = {}) {
   for (const file of manifest.files) {
     const expected = sidecar.hashes.get(file.path);
     if (expected === void 0) continue;
-    const currentSha256 = existsSync24(file.path) ? createHash4("sha256").update(readFileSync17(file.path)).digest("hex") : null;
+    const currentSha256 = existsSync27(file.path) ? createHash6("sha256").update(readFileSync20(file.path)).digest("hex") : null;
     if (currentSha256 !== expected) mismatches.push(file.path);
   }
   if (mismatches.length > 0 && !options.force) {
@@ -8033,8 +8705,14 @@ program.name("skill-forge").description("The supply-chain gate for agent skills"
 program.command("add <source>").description("Quarantine-install a skill and run it through the safety gate").option("-y, --yes", "skip the interactive prompt; honor the gate verdict automatically").option("-t, --target <dir>", "skills root to promote into (defaults to config defaultTarget, then skillsRoots[0])").option("--json", "print the gate result as JSON instead of the terminal report").option("--ingest", "after a successful promote, hand off the bundled ingest prompt to a coding agent").option("--artifact <type>", 'gate as a "skill" or an "mcp" server (default: skill)', parseArtifact).option(
   "--mcp-target <file>",
   "MCP config file to promote into (mcp artifacts only; defaults to config.mcpTargets[0], then <cwd>/.mcp.json)"
-).option("--force", "overwrite an existing same-name MCP server entry when promoting (mcp artifacts only)").action(add);
-program.command("scan <source>").description("Run the safety gate against a skill without installing it").option("--json", "print the gate result as JSON instead of the terminal report").option("--artifact <type>", 'gate as a "skill" or an "mcp" server (default: skill)', parseArtifact).action(scan);
+).option("--force", "overwrite an existing same-name MCP server entry when promoting (mcp artifacts only)").option(
+  "--skill-map <path>",
+  "path to a generated rhize-plugins skill map; reports existing-capability overlap against every skill node in it before promotion (curation-rule check)"
+).action(add);
+program.command("scan <source>").description("Run the safety gate against a skill without installing it").option("--json", "print the gate result as JSON instead of the terminal report").option("--artifact <type>", 'gate as a "skill" or an "mcp" server (default: skill)', parseArtifact).option(
+  "--skill-map <path>",
+  "path to a generated rhize-plugins skill map; reports existing-capability overlap against every skill node in it (curation-rule check)"
+).action(scan);
 program.command("list").description("List skills currently in quarantine").action(list);
 program.command("status").description("Show skill-forge configuration and quarantine status").action(status);
 program.command("promote <id>").description("Re-gate a held quarantine entry and promote it (finishes a decision left on hold)").option("-t, --target <dir>", "skills root to promote into (defaults to config defaultTarget, then skillsRoots[0])").option("--force", "overwrite an existing same-name skill dir / MCP server entry in the target").option("--mcp-target <file>", "MCP config file to promote a held MCP candidate into (defaults to config.mcpTargets[0], then <cwd>/.mcp.json)").option("-y, --yes", "skip the prompt; honor the re-gate verdict automatically").option("--json", "print the re-gate result as JSON instead of the terminal report").action(promoteHeld);
@@ -8049,9 +8727,16 @@ configCmd.command("review").description("Review pending agent-proposed preferenc
 program.command("guide [topic]").description("What this tool does, what state you are in, and the next command to run").action(guide);
 program.command("evolve <target-skill-dir>").description("Self-evolve a skill via SkillOpt-Sleep, re-gate the proposal, then promote/hold/reject (Pro)").option("--project <dir>", "project dir passed to SkillOpt-Sleep as --project (defaults to cwd)").option("--dry-run", "SkillOpt-Sleep dry-run: report only, nothing staged").option("--backend <name>", "SkillOpt-Sleep backend (default: mock, offline \u2014 a real backend requires --yes or interactive confirmation)").option("--lookback-hours <n>", "hours of session history for SkillOpt-Sleep to harvest", parseLookbackHours).option("-y, --yes", "skip interactive prompts; honor the re-gate verdict automatically").option("--json", "print the re-gate result as JSON instead of the terminal report").option("--force", "allow re-adopting a staging dir whose proposed content already matches the live skill").action(evolveCommand);
 program.command("audit").alias("doctor").description("Doctor-style health check over the configured skill/MCP set: inventory, hygiene findings, and consolidation/refinement opportunities").option("--json", "print the audit report as JSON instead of the terminal summary (non-interactive: skips the business-profile prompt)").option("-y, --yes", "skip interactive prompts (business profile, foundation, handoff); never implies --foundation or --handoff").option("--report <file>", "write the report to this path instead of the default ~/.skill-forge/reports/audit-<timestamp>.md (refuses an existing path)").option("--foundation", "authorizes exactly one skills-root write: scaffold a business-foundation skill from the captured business profile").option("--handoff", "authorizes launching the configured agent with the bundled curation prompt against the written report").action(auditCommand);
+var finding = program.command("finding").description("Review and acknowledge audit findings \u2014 human-only, never a gate input (see docs/accepted-findings-schema.md)");
+finding.command("accept <fingerprint-prefix>").description("Accept a currently-active LOW/MEDIUM finding (no override for HIGH/CRITICAL); re-runs the audit engine to resolve it").requiredOption("--reason <text>", "why this finding is accepted (mandatory, 1-200 chars, no control characters)").option("--json", "print the accepted record as JSON").action(findingAcceptCommand);
+finding.command("revoke <fingerprint-prefix>").description("Remove a stored acceptance so the finding reports again").option("--json", "print the removed record as JSON").action(findingRevokeCommand);
+finding.command("list", { isDefault: true }).description("List every accepted finding").option("--stale", "only records whose target no longer exists on disk").option("--json", "print records as JSON").action(findingListCommand);
 program.command("organize").description("Build the set-level capability registry + dependency graph across configured skills roots (Pro)").option("--json", "print the registry+graph report as JSON instead of the terminal summary").option("--out <file>", "write the full report JSON to this path (refuses an existing path)").option("--usage-snapshot <file>", "join per-skill usage counts from a skill-monitor snapshot JSON").action(organizeCommand);
 program.command("find [query]").description("Discover skills via skills.sh and check partner security audits (requires VERCEL_OIDC_TOKEN)").option("--limit <n>", "max search results (default 10)", parseLimit).option("--audit <id>", "show partner audit verdicts (Socket/Snyk/\u2026) for a skills.sh id").option("--get <id>", "show detail + file tree for a skills.sh id").option("--curated", "list skills.sh curated skills").option("--json", "print the raw API payload as JSON").action(find);
-program.command("watch").description("Drift check across every SOURCES.md provenance ledger: which ingested upstreams have moved (Pro)").option("--offline", "skip all network checks; list entries for manual comparison only").option("--json", "print the drift report as JSON instead of the terminal summary").action(watchCommand);
+program.command("watch").description("Drift check across every SOURCES.md provenance ledger: which ingested upstreams have moved (Pro)").option("--offline", "skip all network checks; list entries for manual comparison only").option("--json", "print the drift report as JSON instead of the terminal summary").option(
+  "--skill-map <path>",
+  "also drift-check every fork-of edge in a generated rhize-plugins skill map (contentHash compare against upstream)"
+).action(watchCommand);
 program.command("routine").description("One scheduled maintenance pass: audit + drift + registry, one report, cron-friendly exit codes (Pro)").option("--json", "print the routine result as JSON instead of the terminal summary").option("--offline", "skip every network check (drift entries are reported unchecked)").option("--skip-watch", "skip the drift check").option("--skip-organize", "skip the capability registry").option("--fail-on <level>", "exit 1 when a finding at or above this severity exists: none|low|medium|high|critical|any (default none)", parseFailOn).option("--housekeeping", "opt in to bounded writes: prune expired quarantine sandboxes, close orphaned queue entries").option("--prune-days <n>", "quarantine age threshold in days for --housekeeping (default 30)", parsePruneDays).option("--dry-run", "with --housekeeping: report what would change, change nothing").option("--handoff", "hand the written report to the configured agent (curation prompt)").option("--report <file>", "write the report here instead of ~/.skill-forge/reports/routine-<timestamp>.md (refuses an existing path)").action(routineCommand);
 program.command("ingest").description(
   "Hand the pending-ingestion queue to the configured coding agent for the decide/absorb pass (Pro). For a single new source, use `skill-forge add <source> --ingest` instead."