@skein-code/cli 0.3.14 → 0.3.16

package/docs/ARCHITECTURE.md

@@ -46,16 +46,22 @@
 8. Record a bounded, content-free token receipt for the model request and
    persist actual provider counters separately from local estimates.
 9. Continue until the model returns a final response or the turn limit is hit.
-10. Run configured verification commands after changes. The completion gate accepts
+10. Before the first substantive write, run the warning-only repository reuse
+    gate. It binds current candidate/read evidence to the request, index
+    generation, and change sequence without retaining source text.
+11. Capture content-free TS/JS function fingerprints from that pre-write index
+    generation. After the write succeeds, compare only newly added or at least
+    1.5x-expanded functions before refreshing changed index paths. Exact
+    normalized hashes identify Type-1/2 clones; winnowed 10-token shingles and
+    Jaccard similarity identify warning-only Type-3 candidates. Type-4 semantic
+    equivalence is explicitly outside this deterministic contract.
+12. Run configured verification commands after changes. The completion gate accepts
    only current successful test, typecheck, lint, build, check, or `git diff
    --check` evidence recorded after the last mutation. An early final response
    receives one bounded recovery turn; the runtime persists `verified`,
    `unverified`, or `verification_failed` instead of trusting completion claims
    in model text.
-10. Before the first substantive write, run the warning-only repository reuse
-    gate. It binds current candidate/read evidence to the request, index
-    generation, and change sequence without retaining source text.
-11. Persist the outcome and expose the same status through the TUI, text, JSON,
+13. Persist the outcome and expose the same status through the TUI, text, JSON,
     and JSONL surfaces.
 
 ## Interactive startup gate
@@ -84,6 +90,24 @@ and atomically persists the new generation before returning the tool result.
 Manifest reconciliation additionally compares ctime, closing same-size changes
 whose mtime is restored without hashing every source file on an empty query.
 
+The duplication baseline reuses the current local-index chunks and generation;
+it does not add a persisted index schema or external parser service. The runtime
+reconstructs hash-verified file content in memory, extracts ordinary TS/TSX/JS/
+JSX/MJS/CJS functions, then retains only path, symbol, line range, token count,
+exact hash, and winnowed hashes. The generation cache is cleared on load, full
+build, targeted upsert, and deletion. Audit receipts never retain source,
+normalized tokens, literal contents, prompts, or raw retrieval failures.
+
+Duplication findings are folded into the existing completion record rather than
+creating a parallel completion state. The enforcement is explicitly
+warning-only until fixture benchmarks establish the required precision. Active
+matches receive stable, bounded ids; the optional `duplication_audit` read tool
+is exposed only while unsuppressed findings exist. Suppression is exact-match,
+reason-coded, and persisted as a content-free audit receipt. Repaired/deleted/
+small functions produce a `clear` receipt for paths that previously carried an
+active finding, so the summary cannot retain stale warnings. Legacy receipts
+without ids remain readable and are never suppressible.
+
 ### Prompt layers
 
 The runner keeps the cacheable system prefix separate from mutable task state:

package/docs/NEXT_STEPS.md

@@ -9,7 +9,7 @@ one of the milestones below.
 
 - Product name: `Skein`; primary executable: `skein`.
 - Compatibility executables: `mosaic` and `mosaic-code`.
-- Current repository version: `0.3.14`.
+- Current repository version: `0.3.16`.
 - Runtime requirement: Node.js `>=22.16.0` (the runtime uses unflagged
   `node:sqlite` with FTS5, and current CLI/build dependencies require this
   Node 22 baseline).
@@ -41,8 +41,8 @@ npm audit --omit=dev
 npm run release:verify -- --output-dir artifacts/package
 ```
 
-The latest verified package is `skein-code-cli-0.3.14.tgz`. The verifier writes
-its SHA-256 to `artifacts/package/skein-code-cli-0.3.14.tgz.sha256`, and CI
+The latest verified package is `skein-code-cli-0.3.16.tgz`. The verifier writes
+its SHA-256 to `artifacts/package/skein-code-cli-0.3.16.tgz.sha256`, and CI
 retains the checksum beside the package metadata. The checksum is deliberately
 not copied into this packaged document because doing so would change the
 archive it describes.
@@ -54,19 +54,32 @@ short-height case. The current full-suite count is recorded from the latest
 
 ## Recommended Order
 
-### P0-D: Warning-only repository reuse gate
-
-Version `0.3.14` adds the first runtime reuse slice. The prompt states a short
-repository-first ladder, while `src/agent/reuse-gate.ts` evaluates only the
-first substantive `write_file` or `apply_patch` addition. It flushes the local
-index, re-reads ranked candidates, and persists a bounded `ReuseReceipt` with
-hashed query metadata, paths, symbols, scores, read status, generation, and
-change sequence. The receipt never stores source or prompt text. This release
-is intentionally warning-only; an unavailable index is `unresolved`, not a
-false pass, and legitimate docs/config/test/generated/deletion/local-edit
-changes are exempt. The next slice is deterministic function extraction and
-post-write duplication audit; high-confidence blocking waits for fixture-based
-precision calibration.
+### P0-D: Warning-only repository reuse and duplication audit
+
+Version `0.3.14` added the prompt ladder and pre-write `ReuseReceipt`. Version
+`0.3.15` added a post-write deterministic audit for ordinary TS/TSX/JS/JSX/MJS/
+CJS functions. The audit captures a content-free baseline before mutation,
+normalizes identifiers plus literals, uses exact hashes and 10-token
+shingle/winnowing Jaccard matching, and runs before changed-path index refresh.
+It audits only new or at least 1.5x-expanded functions; same-function edits,
+renames, moves, deletions, small functions, tests, fixtures, generated/vendor/
+dist/minified/declaration files, and failed writes stay quiet. Receipts expose
+at most eight path/symbol/similarity matches through session, TUI, JSON, and
+JSONL without storing source, normalized tokens, prompts, or raw index errors.
+Type-1/2 and Type-3 remain warning-only; unavailable evidence is `unresolved`,
+never a false pass. The next slice is completion-gate suppression UX and
+deterministic benchmark/threshold calibration. Type-4 semantic equivalence is
+not promised.
+
+Version `0.3.16` keeps the same warning-only enforcement while integrating
+duplication summaries into the single completion receipt and every output
+surface. Active matches receive stable 24-character ids. The read-only
+`duplication_audit` tool is disclosed only when unsuppressed matches exist and
+can suppress one exact match with a reason code plus a bounded explanation;
+wildcard/global suppression, credentials, and code-block reasons are rejected.
+Suppression is an audit event, never a verification bypass. A repaired,
+deleted, or below-threshold function emits a clear receipt so old warnings do
+not persist. Older `0.3.15` receipts without match ids remain readable.
 
 ### P0: Continuous Integration And Release Reproducibility
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skein-code/cli",
-  "version": "0.3.14",
+  "version": "0.3.16",
   "description": "A context-first, model-agnostic coding agent with an auditable terminal workspace.",
   "type": "module",
   "license": "MIT",
@@ -16,6 +16,12 @@
   },
   "skein": {
     "releaseNotes": [
+      "Duplication warnings now aggregate into the single completion receipt without changing verified status",
+      "Exact match ids support bounded, reason-coded suppression with audit and credential/code-block safeguards",
+      "Duplication audit tools are disclosed only when active warnings exist and repaired paths clear stale matches",
+      "Warning-only TS/JS duplication audit compares new functions with the pre-write index generation",
+      "Deterministic Type-1/2 and Type-3 receipts retain only hashes, locations, scores, and bounded counts",
+      "Ordinary edits, renames, moves, deletions, small functions, tests, generated paths, and failed writes stay quiet",
       "Warning-only Reuse Gate records content-free candidate evidence before the first substantive write",
       "Reuse receipts surface unresolved index/read failures instead of claiming a safe new implementation",
       "Prompt and timeline diagnostics expose the repository-first reuse ladder without blocking legitimate writes",