@rhize/skill-forge 0.20.0 → 0.21.0

package/README.md

@@ -2,9 +2,13 @@
 
 **The supply-chain gate for agent skills.**
 
-Source version: `@rhize/skill-forge@0.20.0` (2026-09-14), 0.x beta (Pro features free until 1.0).
-Npm publication is a separate tag-driven step; `npm view @rhize/skill-forge version` reports the
-latest published version.
+`audit --laya-shadow --json` can add a local Laya ranking of current finding metadata
+for human triage. It leaves all safety findings and gate decisions unchanged. See
+[the audit contract](docs/commands/audit.md).
+
+Source version: `@rhize/skill-forge@0.21.0`, 0.x beta (Pro features free until 1.0).
+Publishing uses the tag/OIDC workflow; `npm view @rhize/skill-forge version` reports the
+current published version independently of this checkout.
 
 > This project is unrelated to the [`skillforge`](https://www.npmjs.com/package/skillforge)
 > package on npm, which is a Claude Skills *evaluation* framework. `skill-forge` (this package,
@@ -128,7 +132,10 @@ per-feature implementation status.
   outright; a lower-severity finding produces `warn`; a clean scan is `pass`.
 - **npm-sourced MCP candidates:** fetched with `--ignore-scripts`, and every tarball member path is
   validated before extraction (a path-traversal guard).
-- **SkillSpector, when installed,** is purely additive — its absence never blocks the gate.
+- **SkillSpector, when installed,** adds its individual findings, including modern `issues`
+  reports. Its absence preserves the built-in-only gate. A failed, malformed or incomplete
+  installed scan is an explicit HIGH `skillspector-unavailable` finding, which blocks under
+  default strictness. A LOW aggregate score cannot hide a HIGH individual issue.
 
 See [docs/security-model.md](docs/security-model.md) for the full rule table and current status of
 each check.