@skill-map/spec 0.18.0 → 0.20.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/CHANGELOG.md +680 -1
  2. package/README.md +6 -6
  3. package/architecture.md +244 -41
  4. package/cli-contract.md +48 -20
  5. package/conformance/README.md +2 -2
  6. package/conformance/cases/kernel-empty-boot.json +2 -2
  7. package/conformance/cases/orphan-markdown-fallback.json +22 -0
  8. package/conformance/cases/plugin-missing-ui-rejected.json +2 -1
  9. package/conformance/cases/sidecar-end-to-end.json +3 -4
  10. package/conformance/coverage.md +8 -6
  11. package/conformance/fixtures/orphan-markdown/.claude/agents/reviewer.md +6 -0
  12. package/conformance/fixtures/orphan-markdown/ARCHITECTURE.md +10 -0
  13. package/conformance/fixtures/sidecar-end-to-end/.claude/agents/orphan.sm +2 -2
  14. package/conformance/fixtures/sidecar-end-to-end/.claude/agents/stale.sm +1 -1
  15. package/conformance/fixtures/sidecar-example/agent-example.md +1 -1
  16. package/conformance/fixtures/sidecar-example/agent-example.sm +1 -1
  17. package/db-schema.md +68 -23
  18. package/index.json +47 -42
  19. package/interfaces/security-scanner.md +2 -2
  20. package/job-events.md +12 -12
  21. package/job-lifecycle.md +1 -1
  22. package/package.json +1 -1
  23. package/plugin-author-guide.md +374 -69
  24. package/plugin-kv-api.md +5 -5
  25. package/prompt-preamble.md +1 -1
  26. package/schemas/annotations.schema.json +5 -9
  27. package/schemas/api/rest-envelope.schema.json +55 -11
  28. package/schemas/conformance-case.schema.json +2 -2
  29. package/schemas/extensions/analyzer.schema.json +43 -0
  30. package/schemas/extensions/base.schema.json +14 -4
  31. package/schemas/extensions/extractor.schema.json +3 -10
  32. package/schemas/extensions/hook.schema.json +6 -4
  33. package/schemas/extensions/provider.schema.json +1 -1
  34. package/schemas/frontmatter/base.schema.json +6 -1
  35. package/schemas/input-types.schema.json +260 -0
  36. package/schemas/issue.schema.json +6 -6
  37. package/schemas/link.schema.json +2 -2
  38. package/schemas/node.schema.json +1 -19
  39. package/schemas/plugins-registry.schema.json +14 -2
  40. package/schemas/project-config.schema.json +25 -0
  41. package/schemas/sidecar.schema.json +6 -6
  42. package/schemas/summaries/agent.schema.json +1 -1
  43. package/schemas/summaries/command.schema.json +1 -1
  44. package/schemas/summaries/hook.schema.json +1 -1
  45. package/schemas/summaries/markdown.schema.json +1 -1
  46. package/schemas/view-slots.schema.json +335 -0
  47. package/schemas/extensions/rule.schema.json +0 -43
@@ -0,0 +1,335 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://skill-map.dev/spec/v0/view-slots.schema.json",
4
+ "title": "ViewSlots",
5
+ "description": "Closed catalog of view slots. A view slot is a kernel-published handle that names a visual surface in the UI, fixes the renderer that draws there, and fixes the payload shape the plugin emits. The plugin author picks ONE slot per view contribution; the kernel validates `ctx.emitContribution(id, payload)` against that slot's payload schema in `$defs.payloads`. There is no separate notion of a 'contract' — the slot IS the contract. Closed catalog by design: every new slot requires a spec change + UI renderer mount + scaffolder support + conformance fixtures + tests. Compounds catalog evolution cost; see ROADMAP.md §UI contribution system → 'Known limitations carried forward'. Slots are versioned via the manifest field `catalogCompat` (semver against the catalog as a whole), not per-slot.",
6
+ "type": "object",
7
+ "$defs": {
8
+ "SlotName": {
9
+ "type": "string",
10
+ "enum": [
11
+ "card.title.right",
12
+ "card.subtitle.left",
13
+ "card.footer.left.counter",
14
+ "card.footer.right",
15
+ "graph.node.alert",
16
+ "inspector.header.badge.counter",
17
+ "inspector.header.badge.tag",
18
+ "inspector.body.panel.breakdown",
19
+ "inspector.body.panel.records",
20
+ "inspector.body.panel.tree",
21
+ "inspector.body.panel.key-values",
22
+ "inspector.body.panel.link-list",
23
+ "inspector.body.panel.markdown",
24
+ "topbar.actions.indicator"
25
+ ],
26
+ "description": "Closed enum of slot identifiers. Adding an entry requires the full spec/UI/scaffolder/conformance round-trip per ROADMAP.md §UI contribution system. Removing or renaming an entry is a catalog-major-bump and triggers `sm plugins upgrade` migration. Slots that share a payload shape (e.g. `card.subtitle.left`, `card.footer.right`, and `card.footer.left.counter` all carry a counter) reference the same payload schema in `$defs.payloads`."
27
+ },
28
+ "Severity": {
29
+ "type": "string",
30
+ "enum": ["info", "warn", "success", "danger"],
31
+ "description": "Closed severity palette aligned with PrimeNG `<p-tag>` / `<p-message>` severities. Used by counter, tag, alert, and icon slots for color/contrast hints. The UI maps each severity to a theme-aware tint; plugins do not pick raw colors."
32
+ },
33
+ "IconString": {
34
+ "type": "string",
35
+ "minLength": 1,
36
+ "maxLength": 64,
37
+ "description": "Single string, dual-resolved by the UI. If the value matches a Unicode `\\p{Extended_Pictographic}` codepoint, render as emoji text. Otherwise resolve as a PrimeIcons class id (without the `pi-` prefix; the UI prepends it). Unknown PrimeIcons names render no icon (silent fallback) plus a console warning. The plugin author types either the emoji character or the icon name; the discrimination is automatic."
38
+ },
39
+ "IViewContribution": {
40
+ "type": "object",
41
+ "additionalProperties": false,
42
+ "required": ["slot"],
43
+ "properties": {
44
+ "slot": { "$ref": "#/$defs/SlotName" },
45
+ "label": {
46
+ "type": "string",
47
+ "maxLength": 64,
48
+ "description": "Short human-readable label. Used as metadata (docs / plugin-doctor / aria-label) and, for some slots, rendered in the chip / panel header / table label. English-only per AGENTS.md (`Externalized texts, not internationalized`). Per-slot notes specify whether it is rendered inline; counter slots keep it as metadata only."
49
+ },
50
+ "tooltip": {
51
+ "type": "string",
52
+ "maxLength": 256,
53
+ "description": "Hover tooltip shown on the chip or panel header. English-only."
54
+ },
55
+ "icon": { "$ref": "#/$defs/IconString" },
56
+ "emptyText": {
57
+ "type": "string",
58
+ "maxLength": 128,
59
+ "description": "Text shown in the empty placeholder when the slot permits an empty payload. Defaults to a UI-supplied generic 'No data.' string. English-only."
60
+ },
61
+ "emitWhenEmpty": {
62
+ "type": "boolean",
63
+ "default": false,
64
+ "description": "When false (default), the kernel drops emissions whose payload is structurally empty (zero counter value, empty array, empty tree, etc.) so the slot stays silent. When true, the renderer surfaces an empty placeholder instead. Per-slot definition of 'empty' lives in the payload schema notes."
65
+ },
66
+ "priority": {
67
+ "type": "number",
68
+ "default": 100,
69
+ "description": "Optional ordering hint. Slots configured with `order: 'priority'` sort contributions ASC by this value, with alphabetical tie-break by qualified id. Default 100 — plugins use it to suggest where their contribution belongs relative to others sharing the same slot. The slot has the final say on whether `priority` is honoured at all."
70
+ }
71
+ },
72
+ "allOf": [
73
+ {
74
+ "if": {
75
+ "properties": {
76
+ "slot": {
77
+ "enum": [
78
+ "card.subtitle.left",
79
+ "card.footer.left.counter",
80
+ "card.footer.right",
81
+ "inspector.header.badge.counter"
82
+ ]
83
+ }
84
+ }
85
+ },
86
+ "then": { "required": ["slot", "icon"] }
87
+ },
88
+ {
89
+ "if": { "properties": { "slot": { "const": "card.title.right" } } },
90
+ "then": { "required": ["slot", "icon"] }
91
+ }
92
+ ],
93
+ "description": "Manifest-side declaration of a single view contribution, keyed in `IExtensionBase.viewContributions[<contributionId>]`. The plugin author picks ONE slot from the closed `SlotName` enum; the slot fixes the renderer and the payload shape. Slots whose renderer is the counter chip require `icon` in the manifest; same for `card.title.right` (the standalone icon slot)."
94
+ },
95
+ "payloads": {
96
+ "description": "Per-slot payload schemas. The kernel validates `ctx.emitContribution(id, payload)` calls against the entry corresponding to the declared slot before persisting to `scan_contributions`. Off-shape payloads emit an `extension.error` event and drop silently (mirror of `emitLink` off-contract drop pattern). Slots that share a renderer share a payload shape; the schema is defined inline at each slot to keep lookups direct (no internal indirection).",
97
+ "card.title.right": {
98
+ "type": "object",
99
+ "additionalProperties": false,
100
+ "properties": {
101
+ "icon": {
102
+ "$ref": "#/$defs/IconString",
103
+ "description": "Optional payload-time icon override. When omitted the manifest-declared `icon` (which is required for this slot — see `IViewContribution.allOf`) is rendered instead. Lets a plugin emit a different icon per node without redeclaring the manifest."
104
+ },
105
+ "severity": { "$ref": "#/$defs/Severity" },
106
+ "tooltip": { "type": "string", "maxLength": 256 }
107
+ },
108
+ "description": "Single icon per node — small standalone marker rendered next to the card title. The manifest requires `icon`; the payload optionally overrides it per node and may add `severity` (color tint) and `tooltip`. No counts, no labels — for chip + number use a counter slot; for label + severity use a tag slot. 'Empty' for `emitWhenEmpty` is the absence of both payload `icon` and a manifest fallback (in practice never empty since the manifest icon is required)."
109
+ },
110
+ "card.subtitle.left": { "$ref": "#/$defs/payloads/_counter" },
111
+ "card.footer.left.counter": { "$ref": "#/$defs/payloads/_counter" },
112
+ "card.footer.right": { "$ref": "#/$defs/payloads/_counter" },
113
+ "inspector.header.badge.counter": { "$ref": "#/$defs/payloads/_counter" },
114
+ "_counter": {
115
+ "type": "object",
116
+ "additionalProperties": false,
117
+ "required": ["value"],
118
+ "properties": {
119
+ "value": {
120
+ "type": "integer",
121
+ "minimum": 0,
122
+ "description": "Single non-negative integer for the chip / badge. 'Empty' for `emitWhenEmpty` purposes is `value === 0`."
123
+ },
124
+ "tooltip": { "type": "string", "maxLength": 256 },
125
+ "severity": {
126
+ "$ref": "#/$defs/Severity",
127
+ "description": "Optional severity for visual tinting. The slot decides whether to honour it (`SLOT_REGISTRY[slot].respectSeverity`). The plugin emits the data; the UI decides the presentation."
128
+ }
129
+ },
130
+ "description": "Single icon + integer pair, modelled after the `.sm-gnode__stat` rows in the card footer. Manifest requires `icon` (enforced by `IViewContribution.allOf` for every counter slot); payload carries `value`, optionally `severity` and `tooltip`. The manifest `label` is metadata (docs / plugin-doctor / aria-label) and is NOT rendered inline."
131
+ },
132
+ "inspector.header.badge.tag": { "$ref": "#/$defs/payloads/_tag" },
133
+ "_tag": {
134
+ "type": "object",
135
+ "additionalProperties": false,
136
+ "required": ["label"],
137
+ "properties": {
138
+ "label": {
139
+ "type": "string",
140
+ "minLength": 1,
141
+ "maxLength": 32,
142
+ "description": "Tag text (e.g. 'fresh', 'stale', '7d ago'). 'Empty' for `emitWhenEmpty` is `label === ''`."
143
+ },
144
+ "severity": { "$ref": "#/$defs/Severity" },
145
+ "tooltip": { "type": "string", "maxLength": 256 }
146
+ }
147
+ },
148
+ "graph.node.alert": {
149
+ "type": "object",
150
+ "additionalProperties": false,
151
+ "properties": {
152
+ "icon": { "$ref": "#/$defs/IconString" },
153
+ "severity": { "$ref": "#/$defs/Severity" },
154
+ "count": {
155
+ "type": "integer",
156
+ "minimum": 1,
157
+ "maximum": 99,
158
+ "description": "Optional badge count rendered next to the icon (1-99; 99+ collapses to '99+'). Omit for an icon-only marker."
159
+ },
160
+ "tooltip": { "type": "string", "maxLength": 256 }
161
+ },
162
+ "description": "Decoration on the graph node (corner badge / pin). At least one of `icon`, `severity`, `count` is required. 'Empty' for `emitWhenEmpty` is the absence of `icon` AND `count`. Hard cap 1 marker per node per plugin extension (slot config enforces)."
163
+ },
164
+ "inspector.body.panel.breakdown": {
165
+ "type": "object",
166
+ "additionalProperties": false,
167
+ "required": ["entries"],
168
+ "properties": {
169
+ "entries": {
170
+ "type": "array",
171
+ "maxItems": 20,
172
+ "items": {
173
+ "type": "object",
174
+ "additionalProperties": false,
175
+ "required": ["label", "value"],
176
+ "properties": {
177
+ "label": { "type": "string", "minLength": 1, "maxLength": 32 },
178
+ "value": { "type": "integer", "minimum": 0 },
179
+ "tooltip": { "type": "string", "maxLength": 256 }
180
+ }
181
+ },
182
+ "description": "Top-N labeled values rendered as a horizontal bar chart. Hard cap 20 entries (overflow rejected at validation, plugin should pre-truncate). 'Empty' for `emitWhenEmpty` is `entries.length === 0`."
183
+ }
184
+ }
185
+ },
186
+ "inspector.body.panel.records": {
187
+ "type": "object",
188
+ "additionalProperties": false,
189
+ "required": ["columns", "rows"],
190
+ "properties": {
191
+ "columns": {
192
+ "type": "array",
193
+ "minItems": 1,
194
+ "maxItems": 6,
195
+ "items": {
196
+ "type": "object",
197
+ "additionalProperties": false,
198
+ "required": ["key", "label"],
199
+ "properties": {
200
+ "key": { "type": "string", "minLength": 1, "maxLength": 32, "pattern": "^[a-zA-Z][a-zA-Z0-9_-]*$" },
201
+ "label": { "type": "string", "minLength": 1, "maxLength": 32 }
202
+ }
203
+ },
204
+ "description": "Column declarations (max 6). Each row's value at `key` is rendered under `label`."
205
+ },
206
+ "rows": {
207
+ "type": "array",
208
+ "maxItems": 50,
209
+ "items": {
210
+ "type": "object",
211
+ "additionalProperties": {
212
+ "oneOf": [
213
+ { "type": "string", "maxLength": 256 },
214
+ { "type": "number" },
215
+ { "type": "boolean" },
216
+ { "type": "null" }
217
+ ]
218
+ }
219
+ },
220
+ "description": "Tabular rows (max 50). Cell values are scalar only (string ≤256 chars, number, boolean, or null). 'Empty' for `emitWhenEmpty` is `rows.length === 0`."
221
+ }
222
+ }
223
+ },
224
+ "inspector.body.panel.tree": {
225
+ "$ref": "#/$defs/payloads/_TreeNode",
226
+ "description": "Recursive tree rendered as an indented hierarchy. Hard caps: max depth 6, max 200 total nodes per tree (validator enforces). 'Empty' for `emitWhenEmpty` is the root having no `children`."
227
+ },
228
+ "_TreeNode": {
229
+ "type": "object",
230
+ "additionalProperties": false,
231
+ "required": ["label"],
232
+ "properties": {
233
+ "label": { "type": "string", "minLength": 1, "maxLength": 64 },
234
+ "marker": { "$ref": "#/$defs/IconString" },
235
+ "tooltip": { "type": "string", "maxLength": 256 },
236
+ "children": {
237
+ "type": "array",
238
+ "items": { "$ref": "#/$defs/payloads/_TreeNode" }
239
+ }
240
+ }
241
+ },
242
+ "inspector.body.panel.key-values": {
243
+ "type": "object",
244
+ "additionalProperties": false,
245
+ "required": ["entries"],
246
+ "properties": {
247
+ "entries": {
248
+ "type": "array",
249
+ "maxItems": 50,
250
+ "items": {
251
+ "type": "object",
252
+ "additionalProperties": false,
253
+ "required": ["key", "value"],
254
+ "properties": {
255
+ "key": { "type": "string", "minLength": 1, "maxLength": 64 },
256
+ "value": {
257
+ "oneOf": [
258
+ { "type": "string", "maxLength": 512 },
259
+ { "type": "number" },
260
+ { "type": "boolean" },
261
+ { "type": "null" }
262
+ ]
263
+ },
264
+ "tooltip": { "type": "string", "maxLength": 256 }
265
+ }
266
+ },
267
+ "description": "Flat key/value pairs (max 50). Renders as a definition list. 'Empty' for `emitWhenEmpty` is `entries.length === 0`."
268
+ }
269
+ }
270
+ },
271
+ "inspector.body.panel.link-list": {
272
+ "type": "object",
273
+ "additionalProperties": false,
274
+ "required": ["entries"],
275
+ "properties": {
276
+ "entries": {
277
+ "type": "array",
278
+ "maxItems": 100,
279
+ "items": {
280
+ "type": "object",
281
+ "additionalProperties": false,
282
+ "required": ["path"],
283
+ "properties": {
284
+ "path": {
285
+ "type": "string",
286
+ "minLength": 1,
287
+ "maxLength": 512,
288
+ "description": "Node path within the scope. Resolved by the UI to a clickable link via `Router.navigate` — never rendered as a raw `[href]` (per the renderer attr-sanitization analyzer)."
289
+ },
290
+ "label": { "type": "string", "minLength": 1, "maxLength": 128 },
291
+ "kind": {
292
+ "type": "string",
293
+ "minLength": 1,
294
+ "maxLength": 32,
295
+ "description": "Optional Provider kind id (informational). The UI may apply per-kind tinting from `kindRegistry`."
296
+ }
297
+ }
298
+ },
299
+ "description": "List of in-scope node paths (max 100). 'Empty' for `emitWhenEmpty` is `entries.length === 0`."
300
+ }
301
+ }
302
+ },
303
+ "inspector.body.panel.markdown": {
304
+ "type": "object",
305
+ "additionalProperties": false,
306
+ "required": ["markdown"],
307
+ "properties": {
308
+ "markdown": {
309
+ "type": "string",
310
+ "maxLength": 4096,
311
+ "description": "Markdown text rendered with a sanitized allow-list (paragraphs, headings up to H3, lists, inline code, fenced code, emphasis, strong, blockquote). HTML, scripts, embedded SVG, image tags, and link autodetection are stripped. Hard cap 4096 chars to keep render cost bounded. 'Empty' for `emitWhenEmpty` is `markdown.trim() === ''`."
312
+ }
313
+ }
314
+ },
315
+ "topbar.actions.indicator": {
316
+ "type": "object",
317
+ "additionalProperties": false,
318
+ "required": ["value"],
319
+ "properties": {
320
+ "value": {
321
+ "oneOf": [
322
+ { "type": "integer", "minimum": 0 },
323
+ { "type": "string", "minLength": 1, "maxLength": 64 }
324
+ ],
325
+ "description": "Either a non-negative integer or a short string. The UI renders it as a single chip in the topbar."
326
+ },
327
+ "label": { "type": "string", "minLength": 1, "maxLength": 32 },
328
+ "tooltip": { "type": "string", "maxLength": 256 },
329
+ "severity": { "$ref": "#/$defs/Severity" }
330
+ },
331
+ "description": "Single value summarizing the entire scope. Emitted ONCE per scan (not per node). Plugins use `ctx.emitScopeContribution(...)` (analyzer context) — extractors do not see `emitScopeContribution`."
332
+ }
333
+ }
334
+ }
335
+ }
@@ -1,43 +0,0 @@
1
- {
2
- "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "https://skill-map.dev/spec/v0/extensions/rule.schema.json",
4
- "title": "ExtensionRule",
5
- "description": "Manifest shape for a `Rule` extension. A rule consumes the full graph (nodes + links) after all extractors have run and emits `Issue[]`. Rules are dual-mode: `deterministic` rules MUST be byte-for-byte reproducible (same graph in → same issues out; time, random, and network are forbidden) and run synchronously inside `sm check` / `sm scan`. `probabilistic` rules invoke an LLM through the kernel's `RunnerPort` and execute only as queued jobs (`sm job submit rule:<id>`); their output MAY vary across runs and they NEVER participate in `sm scan`. See `architecture.md` §Execution modes for the full contract.",
6
- "allOf": [
7
- { "$ref": "base.schema.json" }
8
- ],
9
- "type": "object",
10
- "required": ["id", "kind", "version", "emitsRuleIds", "defaultSeverity"],
11
- "unevaluatedProperties": false,
12
- "properties": {
13
- "kind": { "const": "rule" },
14
- "mode": {
15
- "type": "string",
16
- "enum": ["deterministic", "probabilistic"],
17
- "default": "deterministic",
18
- "description": "`deterministic` (default): pure code, byte-for-byte reproducible, runs during `sm check` and `sm scan`. `probabilistic`: invokes an LLM via `ctx.runner` and runs only as a queued job; never participates in scan-time pipelines. The kernel rejects probabilistic rules that try to register scan-time hooks at load time. Omitting the field is equivalent to declaring `deterministic`."
19
- },
20
- "emitsRuleIds": {
21
- "type": "array",
22
- "description": "List of `rule_id` values this rule may emit on issues. Typically a singleton (`trigger-collision` → emits `trigger-collision`). A rule emitting a `rule_id` not in this list → kernel logs `rule-id-violation` but keeps the issue (forward compatibility).",
23
- "minItems": 1,
24
- "items": { "type": "string" }
25
- },
26
- "defaultSeverity": {
27
- "type": "string",
28
- "enum": ["error", "warn", "info"],
29
- "description": "Severity attached by default to emitted issues. Rules MAY override per-issue."
30
- },
31
- "consumes": {
32
- "type": "string",
33
- "enum": ["nodes", "links", "both"],
34
- "default": "both",
35
- "description": "Which slices of the graph the rule reads. The kernel MAY pass a restricted view when this is a strict subset."
36
- },
37
- "configurable": {
38
- "type": "boolean",
39
- "default": false,
40
- "description": "If true, the rule reads its own config from `config_preferences` under the key `rules.<id>.<field>`. Implementations MAY surface these in `sm config`."
41
- }
42
- }
43
- }