@skein-code/cli 0.3.16 → 0.3.18

package/docs/ARCHITECTURE.md

@@ -53,7 +53,9 @@
     generation. After the write succeeds, compare only newly added or at least
     1.5x-expanded functions before refreshing changed index paths. Exact
     normalized hashes identify Type-1/2 clones; winnowed 10-token shingles and
-    Jaccard similarity identify warning-only Type-3 candidates. Type-4 semantic
+    Jaccard similarity identify Type-3 candidates. The repository-owned fixture
+    matrix calibrates threshold 0.55: unsuppressed Type-1/2 matches block the
+    existing completion gate, while Type-3 remains warning-only. Type-4 semantic
     equivalence is explicitly outside this deterministic contract.
 12. Run configured verification commands after changes. The completion gate accepts
    only current successful test, typecheck, lint, build, check, or `git diff
@@ -99,8 +101,8 @@ build, targeted upsert, and deletion. Audit receipts never retain source,
 normalized tokens, literal contents, prompts, or raw retrieval failures.
 
 Duplication findings are folded into the existing completion record rather than
-creating a parallel completion state. The enforcement is explicitly
-warning-only until fixture benchmarks establish the required precision. Active
+creating a parallel completion state. Fixture benchmarks establish the required
+precision for calibrated Type-1/2 blocking; Type-3 remains warning-only. Active
 matches receive stable, bounded ids; the optional `duplication_audit` read tool
 is exposed only while unsuppressed findings exist. Suppression is exact-match,
 reason-coded, and persisted as a content-free audit receipt. Repaired/deleted/

package/docs/NEXT_STEPS.md

@@ -9,7 +9,7 @@ one of the milestones below.
 
 - Product name: `Skein`; primary executable: `skein`.
 - Compatibility executables: `mosaic` and `mosaic-code`.
-- Current repository version: `0.3.16`.
+- Current repository version: `0.3.18`.
 - Runtime requirement: Node.js `>=22.16.0` (the runtime uses unflagged
   `node:sqlite` with FTS5, and current CLI/build dependencies require this
   Node 22 baseline).
@@ -41,8 +41,8 @@ npm audit --omit=dev
 npm run release:verify -- --output-dir artifacts/package
 ```
 
-The latest verified package is `skein-code-cli-0.3.16.tgz`. The verifier writes
-its SHA-256 to `artifacts/package/skein-code-cli-0.3.16.tgz.sha256`, and CI
+The latest verified package is `skein-code-cli-0.3.18.tgz`. The verifier writes
+its SHA-256 to `artifacts/package/skein-code-cli-0.3.18.tgz.sha256`, and CI
 retains the checksum beside the package metadata. The checksum is deliberately
 not copied into this packaged document because doing so would change the
 archive it describes.
@@ -54,7 +54,25 @@ short-height case. The current full-suite count is recorded from the latest
 
 ## Recommended Order
 
-### P0-D: Warning-only repository reuse and duplication audit
+### P0-E: Token Economy measurement and bounded schema disclosure
+
+Version `0.3.18` adds the repository-owned `token-economy-benchmark-v1`
+deterministic replay. Its seven retrieval, large-output, CJK, and repeated
+zero-hit fixtures compare the legacy ceilings with the adaptive budget and
+firewall policies while requiring complete evidence and recovery coverage.
+The replay reports a 36.7% estimated-input reduction; this is a deterministic
+budget measurement, not a provider billing or task-success claim.
+
+MCP tool definitions are now marked for progressive disclosure. Catalogs of
+eight or fewer eligible tools remain fully visible; larger catalogs disclose a
+deterministically ranked maximum of eight schemas. Selected schemas retain
+their registry order and remain loaded for the current run, and Token Ledger
+receipts record the deferred count. MCP tools remain `network` operations and
+hidden tool calls remain rejected by the existing boundary. This release does
+not defer MCP connection or remote `listTools` discovery and does not claim the
+provider-cache or Context Compaction 2.0 follow-up work is complete.
+
+### P0-D: Repository reuse and calibrated duplication enforcement
 
 Version `0.3.14` added the prompt ladder and pre-write `ReuseReceipt`. Version
 `0.3.15` added a post-write deterministic audit for ordinary TS/TSX/JS/JSX/MJS/
@@ -66,14 +84,16 @@ renames, moves, deletions, small functions, tests, fixtures, generated/vendor/
 dist/minified/declaration files, and failed writes stay quiet. Receipts expose
 at most eight path/symbol/similarity matches through session, TUI, JSON, and
 JSONL without storing source, normalized tokens, prompts, or raw index errors.
-Type-1/2 and Type-3 remain warning-only; unavailable evidence is `unresolved`,
-never a false pass. The next slice is completion-gate suppression UX and
-deterministic benchmark/threshold calibration. Type-4 semantic equivalence is
-not promised.
-
-Version `0.3.16` keeps the same warning-only enforcement while integrating
-duplication summaries into the single completion receipt and every output
-surface. Active matches receive stable 24-character ids. The read-only
+Type-3 remains warning-only and unavailable evidence is `unresolved`, never a
+false pass. The repository-owned `duplication-benchmark-v1` fixture matrix
+calibrated threshold `0.55` at 100% recall, 100% precision, and 0% legitimate
+boundary false-positive rate. Unsuppressed Type-1/2 matches now block the
+existing completion record; Type-4 semantic equivalence is not promised.
+
+Version `0.3.16` integrated duplication summaries into the single completion
+receipt and every output surface while keeping all matches warning-only. Version
+`0.3.17` keeps Type-3 warning-only but promotes calibrated Type-1/2 matches to
+the completion gate. Active matches receive stable 24-character ids. The read-only
 `duplication_audit` tool is disclosed only when unsuppressed matches exist and
 can suppress one exact match with a reason code plus a bounded explanation;
 wildcard/global suppression, credentials, and code-block reasons are rejected.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skein-code/cli",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "description": "A context-first, model-agnostic coding agent with an auditable terminal workspace.",
   "type": "module",
   "license": "MIT",
@@ -16,6 +16,12 @@
   },
   "skein": {
     "releaseNotes": [
+      "Large MCP catalogs now disclose at most eight request-relevant schemas per run while preserving network permissions",
+      "Token Ledger receipts report deferred progressive schemas and selected definitions remain stable across tool turns",
+      "A deterministic Token Economy replay benchmark guards evidence, output-firewall, and no-progress invariants",
+      "Calibrated Type-1/2 duplication matches now block completion until reuse or exact audited suppression",
+      "Type-3 duplication remains warning-only and Type-4 semantic equivalence remains explicitly unsupported",
+      "Duplication benchmark fixtures report deterministic recall, precision, false-positive rate, and latency",
       "Duplication warnings now aggregate into the single completion receipt without changing verified status",
       "Exact match ids support bounded, reason-coded suppression with audit and credential/code-block safeguards",
       "Duplication audit tools are disclosed only when active warnings exist and repaired paths clear stale matches",
@@ -54,6 +60,8 @@
     "pretest:pty": "npm run build",
     "test:pty": "sh test/pty/run-visual.sh",
     "benchmark:context": "tsx scripts/benchmark-local-index.ts",
+    "benchmark:duplication": "tsx scripts/benchmark-duplication.ts",
+    "benchmark:token-economy": "tsx scripts/benchmark-token-economy.ts",
     "verify:package": "node scripts/verify-package.mjs",
     "release:verify": "npm run check && npm run verify:package --",
     "typecheck": "tsc --noEmit",