@rhize/skill-forge 0.13.0 → 0.14.0

package/README.md

@@ -174,6 +174,8 @@ target skills root until you decide.
 | `--ingest` | Pro (free during the 0.x beta). After a successful promote, hands off to a coding agent — see [Ingestion handoff](#ingestion-handoff---ingest). |
 | `--skill-map <path>` | Path to a generated `rhize-plugins` skill map (Phase 4 of that repo's skill-map-graph-substrate plan). When given, ranks the candidate's name/description against every `skill` node in the map — a near-duplicate of an already-shipped marketplace skill is folded into the safety findings as a `HIGH`-severity finding (escalates the verdict to `block`, so it's held rather than silently promoted); a moderate overlap is `MEDIUM` (`warn`). Free (not Pro-gated) — this enforces the marketplace's own curation rule ("close the gap, don't duplicate"), not a premium ranking feature. Missing/unreadable map: printed to stderr, never fatal. **Two map variants exist, with different coverage**: the **static** map (`rhize-plugins/generated/skill-map.static.json`) is first-party-only — it only knows about that marketplace's own skills, so it cannot catch a candidate that duplicates an *installed third-party plugin's* skill. The **resolved** map (`~/.claude/context-manager/skill-map.resolved.json`, produced by `rhize-context-manager`) additionally carries the full third-party ecosystem inventory. Point `--skill-map` at the resolved map when you want ecosystem-wide duplicate detection; the static map is enough only when you're curating a single first-party marketplace against itself. |
 
+**Observability (v0.14.0):** the `--skill-map` curation check now always reports that it ran. A below-threshold PASS previously left no trace at all — no line in the report, no field in `--json` — making "checked 45 skills, nothing crossed the threshold" indistinguishable from "the check never ran". That ambiguity caused a correct PASS to be written up as a broken gate. The report now carries a `Marketplace overlap` line (`checked N skills — closest "x" (score), none over threshold` / `skipped — <reason>`) and `--json` a `mapOverlap` object with `status`, `compared`, `topMatch`, and `matches`. `topMatch` is informational only: it is never graded and never produces a finding. **Scoring and both thresholds are unchanged.** Note the check is lexical, not semantic — two skills can claim the same invocation trigger in different words and score far below threshold (measured: 0.134), so competing `description:` triggers still need a human read. See `gate/mapOverlap.ts`'s module doc.
+
 **Bugfix (v0.13.0):** `--skill-map` previously matched nothing against either real map variant — the loader read a `type` field that the real generated artifact never sets (it uses `kind`), so every node was silently invisible to the overlap check. `loadSkillMap()` now normalizes `kind` → `type` at load time; regression coverage lives in `test/mapOverlap.realmap.test.ts` against vendored real-map snapshots. If you were relying on `--skill-map` before v0.13.0, it was a no-op — re-run `add`/`scan` on anything you're unsure about.
 
 **Extends-declared overlap exemption**: a candidate can declare `metadata.rhize.extends:

package/dist/cli.js

@@ -3505,18 +3505,23 @@ function nodeText(map, node) {
 }
 function scanMapOverlap(candidate, map) {
   const candidateTokens = tokenize2(`${candidate.name ?? ""} ${candidate.description ?? ""}`);
-  if (candidateTokens.size === 0) return { matches: [] };
+  if (candidateTokens.size === 0) return { matches: [], compared: 0 };
   const matches = [];
+  let compared = 0;
+  let topMatch;
   for (const node of map.nodes) {
     if (node.type !== "skill") continue;
+    compared += 1;
     const otherTokens = tokenize2(nodeText(map, node));
     const s = score3(candidateTokens, otherTokens);
+    const match = { skillId: node.id, name: node.name ?? node.id, score: s };
+    if (!topMatch || s > topMatch.score) topMatch = match;
     if (s >= REPORT_THRESHOLD) {
-      matches.push({ skillId: node.id, name: node.name ?? node.id, score: s });
+      matches.push(match);
     }
   }
   matches.sort((a, b) => b.score - a.score);
-  return { matches };
+  return { matches, compared, topMatch };
 }
 function mapOverlapFinding(result) {
   const top = result.matches[0];
@@ -3608,6 +3613,17 @@ function renderCapabilitiesLine(profile) {
   );
   return `${padLabel("Capabilities")}: ${counts} (declaredConfidence: ${declaredConfidence})`;
 }
+function renderMapOverlapLines(report) {
+  if (!report || report.status === "not-requested") return [];
+  if (report.status === "skipped") {
+    return [`${padLabel("Marketplace overlap")}: skipped \u2014 ${report.reason ?? "map unavailable"}`];
+  }
+  const top = report.topMatch;
+  const flagged = report.matches?.length ?? 0;
+  const closest = top ? `closest "${top.name}" (${top.score})` : "no comparable skills";
+  const verdict = flagged > 0 ? `${flagged} at/over threshold` : "none over threshold";
+  return [`${padLabel("Marketplace overlap")}: checked ${report.compared ?? 0} skills \u2014 ${closest}, ${verdict}`];
+}
 function renderReport(result) {
   const { profile, overlap, overlapLocked, safety, worthTaking, leaveBehind } = result;
   const { name, version, license } = profileHeaderFields(profile);
@@ -3622,6 +3638,7 @@ function renderReport(result) {
     `${padLabel("Artifact type")}: ${profile.artifactType}`,
     ...profile.kind === "mcp" ? [renderCapabilitiesLine(profile)] : [],
     ...overlapLines,
+    ...renderMapOverlapLines(result.mapOverlap),
     renderListField("What's worth taking", worthTaking, "(pending \u2014 not yet determined)"),
     renderListField("What to leave behind", leaveBehind, "(pending \u2014 not yet determined)"),
     `${padLabel("Safety verdict")}: ${renderSafetyLine(safety)}`,
@@ -3676,13 +3693,23 @@ function tryMcpOverlap(profile, mcpTargets) {
   }
 }
 function tryMapOverlapDecision(skillMapPath, candidate, extendsDeclarations) {
-  if (!skillMapPath) return void 0;
+  if (!skillMapPath) return { report: { status: "not-requested" } };
   try {
     const map = loadSkillMap(skillMapPath);
-    return mapOverlapDecision(scanMapOverlap(candidate, map), extendsDeclarations);
+    const result = scanMapOverlap(candidate, map);
+    return {
+      decision: mapOverlapDecision(result, extendsDeclarations),
+      report: {
+        status: "checked",
+        compared: result.compared,
+        topMatch: result.topMatch,
+        matches: result.matches
+      }
+    };
   } catch (err) {
-    console.error(`[skill-forge] skill-map overlap check skipped: ${err.message}`);
-    return void 0;
+    const reason = err.message;
+    console.error(`[skill-forge] skill-map overlap check skipped: ${reason}`);
+    return { report: { status: "skipped", reason } };
   }
 }
 function resolveMcpCandidatePath(entry) {
@@ -3705,7 +3732,7 @@ async function runGate(candidatePath, skillsRoot, {
   const proStatus = proFeatureStatus(proFeatureLabel);
   const safety = artifact === "mcp" ? await mcpScan(candidatePath, strictness) : await scanSafety(candidatePath, strictness);
   const overlap = !proStatus.enabled ? void 0 : artifact === "mcp" ? tryMcpOverlap(profile, mcpTargets) : tryOverlap(candidatePath, skillsRoot);
-  const mapDecision = artifact === "mcp" ? void 0 : tryMapOverlapDecision(
+  const mapOutcome = artifact === "mcp" ? { decision: void 0, report: { status: "not-requested" } } : tryMapOverlapDecision(
     skillMapPath,
     {
       name: "name" in profile ? profile.name : void 0,
@@ -3713,6 +3740,7 @@ async function runGate(candidatePath, skillsRoot, {
     },
     profile.kind === "skill" ? profile.extends : []
   );
+  const mapDecision = mapOutcome.decision;
   const mapFinding = mapDecision?.finding;
   const combinedSafety = mapFinding ? { verdict: verdictFor([...safety.findings, mapFinding], strictness), findings: [...safety.findings, mapFinding] } : safety;
   const advisory = formatAuditAdvisory(readAuditState(), {
@@ -3728,6 +3756,7 @@ async function runGate(candidatePath, skillsRoot, {
     overlap,
     overlapLocked: !proStatus.enabled,
     notices: notices.length > 0 ? notices : void 0,
+    mapOverlap: mapOutcome.report,
     safety: {
       verdict: SAFETY_VERDICT_MAP[combinedSafety.verdict],
       findings: mapSafetyFindings(combinedSafety.findings)