@rhize/skill-forge 0.17.0 → 0.19.0

package/LICENSE

@@ -27,6 +27,7 @@ Pro Modules
 - src/refine/store.ts
 - src/refine/patch.ts
 - src/refine/context.ts
+- src/refine/activation.ts
 - src/insights/models.ts
 - src/insights/sources.ts
 - src/insights/store.ts

package/README.md

@@ -2,8 +2,9 @@
 
 **The supply-chain gate for agent skills.**
 
-Status: published — `@rhize/skill-forge@0.17.0` on npm (released 2026-09-04),
-0.x beta (Pro features free until 1.0)
+Source version: `@rhize/skill-forge@0.19.0` (2026-09-05), 0.x beta (Pro features free until 1.0).
+Npm publication is a separate tag-driven step; `npm view @rhize/skill-forge version` reports the
+latest published version.
 
 > This project is unrelated to the [`skillforge`](https://www.npmjs.com/package/skillforge)
 > package on npm, which is a Claude Skills *evaluation* framework. `skill-forge` (this package,
@@ -66,7 +67,8 @@ reports every enabled plugin (safety findings, skill count, and — with `--usag
 `unknown` recommendation). Plugin roots are never promotion targets, the safety scan surface
 never shrinks, and nothing here changes an `add`/`scan` verdict. `init` asks once whether to
 enable this; `routine` carries the same flags for cron. See
-[docs/commands/audit.md](docs/commands/audit.md).
+[docs/commands/audit.md](docs/commands/audit.md). For a practical maintenance loop and the limits
+of invocation-based advice, see [Plugin governance](docs/plugin-governance.md).
 
 `<source>` accepts a `skills.sh` `owner/name` slug, a git URL (`https://...`, `git@...`, or
 anything ending in `.git`), or a local filesystem path.
@@ -85,6 +87,7 @@ anything ending in `.git`), or a local filesystem path.
 | `find [query] [options]` | Discover skills via skills.sh and check partner security audits (free) | [docs/commands/find.md](docs/commands/find.md) |
 | `watch [options]` (Pro) | Drift check across every `SOURCES.md` provenance ledger | [docs/commands/watch.md](docs/commands/watch.md) |
 | `ingest [options]` / `queue close <id>` (Pro) | Hand the pending-ingestion queue off to a coding agent for the decide/absorb pass | [docs/commands/ingest.md](docs/commands/ingest.md) |
+| `plugins keep/list/forget` | Record explicit host/project keep rationale without suppressing safety findings | [governance additions](docs/governance-improvements.md) |
 | `refine [options]` (Pro) | Capture, list, review, promote, and roll back project-scope skill overrides | [docs/commands/refine.md](docs/commands/refine.md) |
 | `insight <subcommand>` (Pro) | Turn sources into evidence-backed capability plans and Jira manifests | [docs/commands/insight.md](docs/commands/insight.md) |
 | `routine [options]` (Pro) | One scheduled maintenance pass: audit (plugins + usage aware) + drift + registry, cron-friendly | [docs/commands/routine.md](docs/commands/routine.md) |
@@ -206,3 +209,17 @@ skill-forge is open-core with a split license (as of v0.2.0):
 
 [LICENSE](LICENSE) is the authoritative map of which files fall under which license.
 Versions up to and including 0.1.0 were published entirely under MIT.
+
+## Governance utility additions (0.19)
+
+Use `plugins keep/list/forget` for explicit host/project retention rationale without
+suppressing safety findings. `audit --plugin-inventory <file>` and the same option
+on `routine` import static host evidence; Codex never joins Claude usage counts.
+`audit --compare <full-audit.json>` highlights changes while preserving all findings.
+`refine activate --skill <capture> --base <dir> --as <unique-name> --host claude|codex`
+materializes a captured patch/extend as a new project skill after a staged safety scan.
+Preview with `--dry-run --json`; activation requires confirmation. Verify actual host
+loading in a fresh task before treating the refinement as consumed. Roll back using
+the returned backup ID with `refine rollback <id> --project --yes`.
+
+See the [governance operating guide](docs/governance-improvements.md) for scope, schemas, examples and limits.