@skein-code/cli 0.3.15 → 0.3.17

package/docs/ARCHITECTURE.md

@@ -53,7 +53,9 @@
     generation. After the write succeeds, compare only newly added or at least
     1.5x-expanded functions before refreshing changed index paths. Exact
     normalized hashes identify Type-1/2 clones; winnowed 10-token shingles and
-    Jaccard similarity identify warning-only Type-3 candidates. Type-4 semantic
+    Jaccard similarity identify Type-3 candidates. The repository-owned fixture
+    matrix calibrates threshold 0.55: unsuppressed Type-1/2 matches block the
+    existing completion gate, while Type-3 remains warning-only. Type-4 semantic
     equivalence is explicitly outside this deterministic contract.
 12. Run configured verification commands after changes. The completion gate accepts
    only current successful test, typecheck, lint, build, check, or `git diff
@@ -98,6 +100,16 @@ exact hash, and winnowed hashes. The generation cache is cleared on load, full
 build, targeted upsert, and deletion. Audit receipts never retain source,
 normalized tokens, literal contents, prompts, or raw retrieval failures.
 
+Duplication findings are folded into the existing completion record rather than
+creating a parallel completion state. Fixture benchmarks establish the required
+precision for calibrated Type-1/2 blocking; Type-3 remains warning-only. Active
+matches receive stable, bounded ids; the optional `duplication_audit` read tool
+is exposed only while unsuppressed findings exist. Suppression is exact-match,
+reason-coded, and persisted as a content-free audit receipt. Repaired/deleted/
+small functions produce a `clear` receipt for paths that previously carried an
+active finding, so the summary cannot retain stale warnings. Legacy receipts
+without ids remain readable and are never suppressible.
+
 ### Prompt layers
 
 The runner keeps the cacheable system prefix separate from mutable task state:

package/docs/NEXT_STEPS.md

@@ -9,7 +9,7 @@ one of the milestones below.
 
 - Product name: `Skein`; primary executable: `skein`.
 - Compatibility executables: `mosaic` and `mosaic-code`.
-- Current repository version: `0.3.15`.
+- Current repository version: `0.3.16`.
 - Runtime requirement: Node.js `>=22.16.0` (the runtime uses unflagged
   `node:sqlite` with FTS5, and current CLI/build dependencies require this
   Node 22 baseline).
@@ -41,8 +41,8 @@ npm audit --omit=dev
 npm run release:verify -- --output-dir artifacts/package
 ```
 
-The latest verified package is `skein-code-cli-0.3.15.tgz`. The verifier writes
-its SHA-256 to `artifacts/package/skein-code-cli-0.3.15.tgz.sha256`, and CI
+The latest verified package is `skein-code-cli-0.3.16.tgz`. The verifier writes
+its SHA-256 to `artifacts/package/skein-code-cli-0.3.16.tgz.sha256`, and CI
 retains the checksum beside the package metadata. The checksum is deliberately
 not copied into this packaged document because doing so would change the
 archive it describes.
@@ -54,10 +54,10 @@ short-height case. The current full-suite count is recorded from the latest
 
 ## Recommended Order
 
-### P0-D: Warning-only repository reuse and duplication audit
+### P0-D: Repository reuse and calibrated duplication enforcement
 
 Version `0.3.14` added the prompt ladder and pre-write `ReuseReceipt`. Version
-`0.3.15` adds a post-write deterministic audit for ordinary TS/TSX/JS/JSX/MJS/
+`0.3.15` added a post-write deterministic audit for ordinary TS/TSX/JS/JSX/MJS/
 CJS functions. The audit captures a content-free baseline before mutation,
 normalizes identifiers plus literals, uses exact hashes and 10-token
 shingle/winnowing Jaccard matching, and runs before changed-path index refresh.
@@ -66,10 +66,22 @@ renames, moves, deletions, small functions, tests, fixtures, generated/vendor/
 dist/minified/declaration files, and failed writes stay quiet. Receipts expose
 at most eight path/symbol/similarity matches through session, TUI, JSON, and
 JSONL without storing source, normalized tokens, prompts, or raw index errors.
-Type-1/2 and Type-3 remain warning-only; unavailable evidence is `unresolved`,
-never a false pass. The next slice is completion-gate suppression UX and
-deterministic benchmark/threshold calibration. Type-4 semantic equivalence is
-not promised.
+Type-3 remains warning-only and unavailable evidence is `unresolved`, never a
+false pass. The repository-owned `duplication-benchmark-v1` fixture matrix
+calibrated threshold `0.55` at 100% recall, 100% precision, and 0% legitimate
+boundary false-positive rate. Unsuppressed Type-1/2 matches now block the
+existing completion record; Type-4 semantic equivalence is not promised.
+
+Version `0.3.16` integrated duplication summaries into the single completion
+receipt and every output surface while keeping all matches warning-only. Version
+`0.3.17` keeps Type-3 warning-only but promotes calibrated Type-1/2 matches to
+the completion gate. Active matches receive stable 24-character ids. The read-only
+`duplication_audit` tool is disclosed only when unsuppressed matches exist and
+can suppress one exact match with a reason code plus a bounded explanation;
+wildcard/global suppression, credentials, and code-block reasons are rejected.
+Suppression is an audit event, never a verification bypass. A repaired,
+deleted, or below-threshold function emits a clear receipt so old warnings do
+not persist. Older `0.3.15` receipts without match ids remain readable.
 
 ### P0: Continuous Integration And Release Reproducibility
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skein-code/cli",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "description": "A context-first, model-agnostic coding agent with an auditable terminal workspace.",
   "type": "module",
   "license": "MIT",
@@ -16,6 +16,12 @@
   },
   "skein": {
     "releaseNotes": [
+      "Calibrated Type-1/2 duplication matches now block completion until reuse or exact audited suppression",
+      "Type-3 duplication remains warning-only and Type-4 semantic equivalence remains explicitly unsupported",
+      "Duplication benchmark fixtures report deterministic recall, precision, false-positive rate, and latency",
+      "Duplication warnings now aggregate into the single completion receipt without changing verified status",
+      "Exact match ids support bounded, reason-coded suppression with audit and credential/code-block safeguards",
+      "Duplication audit tools are disclosed only when active warnings exist and repaired paths clear stale matches",
       "Warning-only TS/JS duplication audit compares new functions with the pre-write index generation",
       "Deterministic Type-1/2 and Type-3 receipts retain only hashes, locations, scores, and bounded counts",
       "Ordinary edits, renames, moves, deletions, small functions, tests, generated paths, and failed writes stay quiet",
@@ -51,6 +57,7 @@
     "pretest:pty": "npm run build",
     "test:pty": "sh test/pty/run-visual.sh",
     "benchmark:context": "tsx scripts/benchmark-local-index.ts",
+    "benchmark:duplication": "tsx scripts/benchmark-duplication.ts",
     "verify:package": "node scripts/verify-package.mjs",
     "release:verify": "npm run check && npm run verify:package --",
     "typecheck": "tsc --noEmit",