opencode-swarm 7.109.1 → 7.109.3

package/.opencode/skills/ci-failure-batching/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: ci-failure-batching
+description: Batch collection and fix protocol for CI failures. Triggered when any CI check fails on a PR. Prevents serial diagnose-fix-push cycles by collecting all failures before fixing.
+---
+
+# CI Failure Batching
+
+## Trigger
+When ANY CI check fails on the PR (pr-monitor surfaces `pr.ci.failed`).
+
+## Protocol
+1. **DO NOT immediately fix the first failure.** Check if other jobs are still running:
+   ```
+   gh pr checks <PR> --repo <repo>
+   ```
+2. **If jobs are still running:** Note the failure, WAIT for the run to complete
+3. **Once the run completes, collect ALL failures:**
+   - Identify every check with `fail` status
+   - For each: `gh run view <run-id> --log-failed`
+   - Build a complete failure ledger
+4. **Fix ALL failures in one changeset:** Cluster by root cause, fix each cluster, verify locally
+5. **Push the fixes in one cycle.** Amend the commit and push. NOTE: `git push --force` / `--force-with-lease` is deny-pattern-blocked by the guardrail in guarded sessions (no orchestrator exemption). If force-push is blocked, push a normal new fix commit instead — the batching goal is ONE push cycle (collect all → fix all → push once), not literally one commit. A single new commit containing all batched fixes satisfies the goal.
+6. **Only re-push if NEW failures surface** that were not in the original batch.
+
+## Why this matters
+Without batching, N failures produce N push cycles. With batching, N failures produce 1 push cycle.
+
+Example from session #1685:
+- Without batching: 6 pushes (format → stale-assertion-1 → stale-assertion-2 → integration → merge-group → clean)
+- With batching: 2 pushes (collect all → fix all → push once → clean)
+
+## Pr-monitor workaround
+The pr-monitor fires `pr.ci.failed` per-check. When the first event arrives:
+1. Check `gh pr checks` — are other jobs still running?
+2. If yes: WAIT for completion
+3. If no: the single failure IS the only failure — proceed normally
+
+## Root cause
+The pr-monitor should batch-fire after the CI run completes (issue #1746 item 7). This playbook is the manual protocol.

package/.opencode/skills/engineering-conventions/SKILL.md

@@ -127,3 +127,48 @@ When a sandbox executor (`src/sandbox/{linux,macos,win32}/*.ts`) interpolates en
 - Scope-materialization for lane-scoped resources.
 
 A divergence between primary and fallback that is not exercised by a parity test is a regression. The existing per-OS test files `tests/unit/sandbox/{linux,macos,win32}.test.ts` must continue to cover both the primary and fallback paths after every env-affecting change — extend these tests rather than relying on dedicated sandbox-envoverride test files that may or may not exist in your branch.
+
+## SAST baseline capturing (differential scanning)
+
+The `sast_scan` tool supports `capture_baseline: true` with a `phase` parameter
+to snapshot pre-existing findings. Subsequent scans with the same `phase` value
+perform differential checking — they only fail on **new** findings, not
+pre-existing ones.
+
+### When to capture a baseline
+
+- **Before Phase 1 code changes.** The baseline must reflect the state of the
+  codebase *before* any new work is done. This ensures the differential scan
+  catches findings introduced by the current session's changes.
+
+### Critical safety guard
+
+**NEVER capture a baseline after code changes have been made in a phase.**
+A baseline captured post-edit silently encodes the very bugs the scan is meant
+to catch as "pre-existing," suppressing them indefinitely. This turns the SAST
+gate into theater.
+
+### How to use it
+
+1. Identify the files to scan. In a phase, use the union of declared task-scope
+   files plus files the coder is expected to touch. Derive the list from
+   `declare_scope` outputs, `git diff --name-only`, or the phase's task specs.
+2. Before any coder delegation in Phase 1, capture the baseline:
+   ```
+   sast_scan(directory, changed_files=[...], capture_baseline=true, phase=1)
+   ```
+3. After coder work, scan the same file set:
+   ```
+   sast_scan(directory, changed_files=[...], phase=1)
+   ```
+   This returns only NEW findings (absent from the baseline).
+4. If a pre-existing finding is legitimately fixed, the baseline can be
+   re-captured at the start of the next phase with the updated file list.
+
+### Why this matters
+
+During PR #1704 review, SAST flagged `RegExp.prototype.exec()` as
+"command injection via child_process.exec()" — a false positive that blocked
+the gate. With a baseline captured before the phase, this pre-existing false
+positive would have been suppressed, and only genuinely new findings would
+surface.

package/.opencode/skills/gate-attribution/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: gate-attribution
+description: Per-task gate dispatch protocol. Documents the single-taskId attribution rule and parallel-lane optimization for reviewer/test_engineer gates.
+---
+
+# Gate Attribution
+
+## The rule
+The gate tracker attributes reviewer/test_engineer dispatches PER TASK (single taskId in the prompt). Set-dispatches covering multiple tasks do NOT count per-task, even with per-task verdicts.
+
+## Protocol
+1. **For each task requiring a gate:** Dispatch a separate reviewer and/or test_engineer with exactly ONE taskId
+2. **Minimize overhead via parallel dispatch:**
+   ```
+   dispatch_lanes_async with:
+   - common_prompt: shared verification context
+   - lanes: one lane per task, each with a single taskId
+   - max_concurrent: up to 3
+   ```
+3. **Collect + attribute:** Each lane result auto-attributes to its taskId
+4. **Do NOT batch:** Even for identical reviews, dispatch separately
+
+## Optimization for trivial tasks
+For pure ceremony gates (1-line doc fix):
+```
+TASK: Verify task X.Y. Run skill-mirrors.test.ts. PASS/FAIL.
+taskId: X.Y
+```
+
+## Why this exists
+The gate tracker (`src/hooks/delegation-gate.ts`) keys delegation chains by `sessionID`, and task attribution resolves exactly ONE taskId per dispatch (`args.task_id ?? args.taskId`). Ambiguous multi-task prompts fail closed (resolve to null) rather than attributing to any task — so a set-dispatch covering multiple tasks does not count per-task even with per-task verdicts. Tracked in issue #1746 item 6.

package/.opencode/skills/merge-queue-readiness/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: merge-queue-readiness
+description: Pre-queue merge-group CI simulation. Triggered before adding a PR to a GitHub merge queue. Prevents merge-queue kick-outs from integration test failures.
+---
+
+# Merge Queue Readiness
+
+## Trigger
+Before adding the PR to the merge queue (or before the final push if the repo uses a merge queue).
+
+## Protocol
+1. **Fetch latest main:** `git fetch origin main`
+2. **Create a temporary simulation worktree (do NOT mutate the PR branch).** Use a project-relative path UNDER the swarm worktree base so the path is portable across OSes and its later removal is permitted by the worktree guardrail (paths outside `.swarm-worktrees/` are blocked). Do NOT hardcode `/tmp` — it does not exist on Windows.
+   ```
+   git worktree add .swarm-worktrees/merge-sim origin/main
+   cd .swarm-worktrees/merge-sim
+   git merge <pr-branch> --no-edit
+   ```
+3. **Run integration + unit tests against the merged result:**
+   ```
+   bun test tests/integration --timeout 120000
+   bun test tests/unit --timeout 120000
+   ```
+   (Use per-file loops for hot modules per AGENTS.md invariant 6)
+4. **If failures:** Fix on the PR branch, re-push, re-simulate. Always run the cleanup step (5) before re-simulating or on any exit path — do not leave the simulation worktree behind.
+5. **Cleanup (run on EVERY exit path, including failure):** `git worktree remove --force .swarm-worktrees/merge-sim`. If the remove is guardrail-blocked or fails, delete the directory directly and run `git worktree prune`.
+6. **Only after simulation passes,** add PR to the merge queue.
+
+## Why this matters
+PR-branch CI and merge-group CI test DIFFERENT things:
+- PR-branch: tests the PR head commit in isolation
+- Merge-group: tests a temporary merge of PR head + latest main
+
+Integration tests that pass on the PR branch may fail in merge-group context due to test interactions exposed by the merged result.
+
+## Root cause
+A `swarm ci-simulate` command would automate this (issue #1746 item 5). This playbook is the manual protocol.

package/.opencode/skills/skill-edit-validation/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: skill-edit-validation
+description: Content-assertion sweep after editing SKILL.md files. Triggered when a task changes skill or prompt content that tests assert against. Prevents stale-assertion CI failures.
+---
+
+# Skill Edit Validation
+
+## Trigger
+After editing ANY `.md` file under `.opencode/skills/`, `.claude/skills/`, or `.agents/skills/` that changes content wording (not just whitespace/formatting).
+
+## Protocol
+1. **Extract changed phrases:** Identify old wording vs new wording (e.g., "spec.md does NOT exist" changed to "NO effective spec exists")
+2. **Targeted sweep:** For each OLD phrase, grep test files:
+   ```
+   rg "<old-phrase>" tests/ src/ --type ts -l
+   ```
+   Focus on: `*-audit*`, `*-security*`, `*-spec-gate*`, `*skill-mirror*`, `*soft-spec*`, `*prompt*`, `*workflow*`
+3. **For each match:** Read the assertion context (surrounding 10 lines). Verify:
+   - Does the assertion still hold against the new content?
+   - Is it checking a substring containing the old phrase?
+   - Is it checking for the ABSENCE of a word the new wording introduces? (e.g., `not.toContain('skip')` catches "this check is skipped")
+4. **Update stale assertions in the same changeset.** Do NOT defer to CI.
+5. **Preserve behavioral intent:** When updating, preserve what the assertion TESTS (e.g., "the plan skill has a spec-absent branch"), not just the string match.
+
+## Constraint
+Do NOT rubber-stamp brittle assertions. If an assertion tests implementation detail rather than behavioral intent, flag it for refactoring to a semantic check.
+
+## Root cause
+A skill-content test registry would auto-adjust (issue #1746 item 3). This playbook is the manual safety net.

package/.opencode/skills/swarm-pr-feedback/SKILL.md

@@ -102,6 +102,53 @@ current branch before editing:
 - **Cache/state claims:** Test both relevant state orders when the behavior
   depends on cache priming, singleton state, or prior calls.
 
+### Automated Security Finding Verification
+
+Automated security bots (e.g., hermes-pr-review, CodeRabbit, Gemini) frequently
+produce findings rated CRITICAL or HIGH that are false positives. In a recent
+PR review cycle, 7/7 bot security findings were false positives upon source
+verification. Before acting on any bot security finding, perform these
+source-level checks:
+
+1. **`child_process.exec` vs `RegExp.exec`**: SAST rules pattern-match on
+   `.exec(` and cannot distinguish `child_process.exec(userInput)` (real
+   injection risk) from `/^pattern$/.exec(str)` (safe regex test). Read the
+   actual line to determine which `.exec` is called.
+
+2. **Schema validation already present**: Bots may flag "missing type
+   validation" without checking the Zod schema. Search for the field name in
+   `src/config/schema.ts` — `z.number().int()`, `z.string().min()`, etc. are
+   runtime validators that run before the code path the bot reviewed.
+
+3. **`Object.assign` mutation claims**: Bots may claim `Object.assign` mutates
+   the source object. Check whether the call is `Object.assign(target, source)`
+   (mutates target) vs `Object.assign({}, source)` or a manual copy loop into a
+   new `{}` (creates a new object, source is safe). Read the actual assignment.
+
+4. **Path containment for system-generated paths**: Bots may flag "path
+   traversal" on file paths. Check whether the path is user-controlled (real
+   risk) or system-generated from `provisionWorktree`, `mkdtempSync`, or
+   similar (no user input reaches the path). Trace the variable's origin.
+
+5. **Value validation vs key validation**: Bots may suggest validating env var
+   *values* for shell injection characters. Check whether the value is passed
+   through a sandbox executor that escapes arguments (e.g., `wrapCommand`
+   which returns a shell-quoted / `psStringEscape`-escaped string for the
+   `bunSpawn` array-form argv to consume). Value validation would break
+   legitimate env vars (PATH with `;`, URLs with `$`); escaping is the
+   sandbox's job — see `engineering-conventions` § "Sandbox env overrides"
+   for the full escape contract.
+
+6. **Deduplication for independent resources**: Bots may suggest deduplicating
+   cache redirects or env var entries. Check whether the entries map to
+   independent keys (different env var names) — independent keys cannot
+   "collide" and deduplication is nonsensical.
+
+**Rule:** For any bot finding rated CRITICAL or HIGH, read the actual source
+line AND its surrounding context (parent function, schema definition, type
+annotations) before accepting the finding. If the finding is disproved, record
+it in the closure ledger with the specific source evidence that disproves it.
+
 ## Operating Stance
 
 Treat every review comment, CI failure, bot summary, PR body claim, and pasted note

package/.opencode/skills/worktree-retry-cleanup/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: worktree-retry-cleanup
+description: Protocol for cleaning parallel-coder worktree lanes before retry. Triggered before re-dispatching any task that already has a lane (completed, denied, cancelled, or failed).
+---
+
+# Worktree Retry Cleanup
+
+## Trigger
+Before re-dispatching a coder for a task that already has a lane (any prior dispatch status).
+
+## Protocol
+1. **Ownership check — do this FIRST, before any deletion.** Confirm the lane is not owned by another ACTIVE session: read `.swarm/session/state.json` and verify no other session's `delegationChains` reference `<session>/<task>`. If another active session owns it, STOP — surface the conflict and do not delete.
+2. **Check for existing lane branch:** `git branch --list "swarm/lane/<session>/<task>"`
+3. **If branch exists:**
+   - Verify 0-commits-ahead: `git log --oneline HEAD..swarm/lane/<session>/<task>` — empty = safe
+   - Delete: `git branch -d swarm/lane/<session>/<task>` (use `-D` only if `-d` fails AND the commits are confirmed unneeded)
+   - Under full-auto, `-D` is deny-pattern-blocked — use `-d`
+4. **Remove the per-lane worktree directory.** Target the SPECIFIC lane `.swarm-worktrees/<session>/<task>`, NOT the session parent (the parent holds sibling lanes). Prefer `git worktree remove .swarm-worktrees/<session>/<task>` — this is permitted because the path is under the `.swarm-worktrees/` base. A bare `rm -rf` / `Remove-Item -Recurse -Force` on `.swarm-worktrees/` is deny-pattern-blocked by the guardrail, so do not use it here.
+5. **Prune:** `git worktree prune`
+6. **Verify:** `git branch --list "swarm/lane/<session>/<task>"` returns empty
+7. Only after cleanup, proceed to `declare_scope` + coder dispatch
+
+## Root cause
+The provisioning code should auto-clean after coder completion/denial/cancellation (tracked in issue #1746 item 1). This playbook is the temporary protocol.

package/dist/cli/{curator-q4febs18.js → curator-9q3m25va.js}

@@ -11,9 +11,9 @@ import {
   runCuratorInit,
   runCuratorPhase,
   writeCuratorSummary
-} from "./index-nq9h2t3x.js";
+} from "./index-xyz8epk6.js";
 import"./index-wj4jeavn.js";
-import"./index-5gnp8fyw.js";
+import"./index-mtzjbaaa.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
 import"./index-j2v3w1ds.js";
@@ -22,10 +22,10 @@ import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
 import"./index-09xpycan.js";
 import"./index-h4c4rrwx.js";
-import"./index-9qxntjtx.js";
-import"./index-mmny81g1.js";
-import"./index-fz1jgbvw.js";
-import"./index-wg0665ft.js";
+import"./index-b15qbvph.js";
+import"./index-y5z2qdvk.js";
+import"./index-41fgssqr.js";
+import"./index-8f10r7ay.js";
 import"./index-2nt4mq9n.js";
 import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";

package/dist/cli/{curator-llm-factory-gtfhwnbr.js → curator-llm-factory-78dyv010.js}

@@ -1,9 +1,9 @@
 // @bun
 import {
   createCuratorLLMDelegate
-} from "./index-nq9h2t3x.js";
+} from "./index-xyz8epk6.js";
 import"./index-wj4jeavn.js";
-import"./index-5gnp8fyw.js";
+import"./index-mtzjbaaa.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
 import"./index-j2v3w1ds.js";
@@ -12,10 +12,10 @@ import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
 import"./index-09xpycan.js";
 import"./index-h4c4rrwx.js";
-import"./index-9qxntjtx.js";
-import"./index-mmny81g1.js";
-import"./index-fz1jgbvw.js";
-import"./index-wg0665ft.js";
+import"./index-b15qbvph.js";
+import"./index-y5z2qdvk.js";
+import"./index-41fgssqr.js";
+import"./index-8f10r7ay.js";
 import"./index-2nt4mq9n.js";
 import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";

package/dist/cli/{guardrail-explain-r2d8ftkv.js → guardrail-explain-csnawe0d.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-wsg3vkss.js";
-import"./index-nq9h2t3x.js";
+} from "./index-r9dbs4zr.js";
+import"./index-xyz8epk6.js";
 import"./index-wj4jeavn.js";
-import"./index-5gnp8fyw.js";
+import"./index-mtzjbaaa.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
 import"./index-j2v3w1ds.js";
@@ -13,10 +13,10 @@ import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
 import"./index-09xpycan.js";
 import"./index-h4c4rrwx.js";
-import"./index-9qxntjtx.js";
-import"./index-mmny81g1.js";
-import"./index-fz1jgbvw.js";
-import"./index-wg0665ft.js";
+import"./index-b15qbvph.js";
+import"./index-y5z2qdvk.js";
+import"./index-41fgssqr.js";
+import"./index-8f10r7ay.js";
 import"./index-2nt4mq9n.js";
 import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";

package/dist/cli/{hive-promoter-mfd5p9f5.js → hive-promoter-xnx734y3.js}

@@ -5,9 +5,9 @@ import {
   isHiveEligible,
   promoteFromSwarm,
   promoteToHive
-} from "./index-nq9h2t3x.js";
+} from "./index-xyz8epk6.js";
 import"./index-wj4jeavn.js";
-import"./index-5gnp8fyw.js";
+import"./index-mtzjbaaa.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
 import"./index-j2v3w1ds.js";
@@ -16,10 +16,10 @@ import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
 import"./index-09xpycan.js";
 import"./index-h4c4rrwx.js";
-import"./index-9qxntjtx.js";
-import"./index-mmny81g1.js";
-import"./index-fz1jgbvw.js";
-import"./index-wg0665ft.js";
+import"./index-b15qbvph.js";
+import"./index-y5z2qdvk.js";
+import"./index-41fgssqr.js";
+import"./index-8f10r7ay.js";
 import"./index-2nt4mq9n.js";
 import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";

package/dist/cli/{index-1capawwy.js → index-3nd7bz90.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-wsg3vkss.js";
+} from "./index-r9dbs4zr.js";
 import {
   handleGuardrailLog
 } from "./index-vx76tcxe.js";
@@ -80,9 +80,9 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-nq9h2t3x.js";
+} from "./index-xyz8epk6.js";
 import"./index-wj4jeavn.js";
-import"./index-5gnp8fyw.js";
+import"./index-mtzjbaaa.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
 import"./index-j2v3w1ds.js";
@@ -95,10 +95,10 @@ import {
   ORCHESTRATOR_NAME,
   stripKnownSwarmPrefix
 } from "./index-h4c4rrwx.js";
-import"./index-9qxntjtx.js";
-import"./index-mmny81g1.js";
-import"./index-fz1jgbvw.js";
-import"./index-wg0665ft.js";
+import"./index-b15qbvph.js";
+import"./index-y5z2qdvk.js";
+import"./index-41fgssqr.js";
+import"./index-8f10r7ay.js";
 import"./index-2nt4mq9n.js";
 import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";

package/dist/cli/{index-fz1jgbvw.js → index-41fgssqr.js}

@@ -6,7 +6,7 @@ import {
   resolveSwarmKnowledgePath,
   resolveSwarmRejectedPath,
   transactKnowledge
-} from "./index-wg0665ft.js";
+} from "./index-8f10r7ay.js";
 import {
   resolveKnowledgeStoreDir
 } from "./index-2nt4mq9n.js";
@@ -341,6 +341,7 @@ function validateLesson(candidate, existingLessons, meta) {
 }
 var ACTIONABLE_STRING_MAX = 200;
 var ACTIONABLE_LIST_MAX = 20;
+var RETIRED_SKILL_HISTORY_MAX = 50;
 var NAME_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
 var SOURCE_REF_FORBIDDEN = /(\.\.\/|\.\.\\|\0|[\x00-\x1f\x7f])/;
 var ALLOWED_SKILL_PATH_PREFIXES = [
@@ -473,6 +474,25 @@ function validateActionableFields(fields) {
   if (fields.generated_skill_path !== undefined && !validateSkillPath(fields.generated_skill_path)) {
     errors.push("generated_skill_path must be repo-local under allowed prefix");
   }
+  if (fields.draft_generated_skill_slug !== undefined) {
+    if (typeof fields.draft_generated_skill_slug !== "string" || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(fields.draft_generated_skill_slug)) {
+      errors.push("draft_generated_skill_slug must be a kebab-case slug");
+    }
+  }
+  if (fields.draft_generated_skill_path !== undefined && !validateSkillPath(fields.draft_generated_skill_path)) {
+    errors.push("draft_generated_skill_path must be repo-local under allowed prefix");
+  }
+  if (fields.retired_skill_history !== undefined) {
+    if (!Array.isArray(fields.retired_skill_history)) {
+      errors.push("retired_skill_history must be an array of slugs");
+    } else {
+      if (fields.retired_skill_history.length > RETIRED_SKILL_HISTORY_MAX) {
+        errors.push(`retired_skill_history exceeds ${RETIRED_SKILL_HISTORY_MAX} items`);
+      } else if (!fields.retired_skill_history.every((s) => typeof s === "string" && /^[a-z0-9][a-z0-9-]{0,63}$/.test(s))) {
+        errors.push("retired_skill_history entries must be kebab-case slugs");
+      }
+    }
+  }
   return { valid: errors.length === 0, errors };
 }
 function hasNonEmptyList(v) {
@@ -738,4 +758,4 @@ var _internals = {
   hasSignificantOverlap
 };
 
-export { DANGEROUS_COMMAND_ERROR_PATTERNS, DANGEROUS_COMMAND_WARNING_PATTERNS, DANGEROUS_COMMAND_PATTERNS, SECURITY_DEGRADING_PATTERNS, INVISIBLE_FORMAT_CHARS, INJECTION_PATTERNS, validateLesson, ACTIONABLE_STRING_MAX, ACTIONABLE_LIST_MAX, ALLOWED_SKILL_PATH_PREFIXES, validateSkillPath, validateSkillCandidatePath, validateActionableFields, validateActionability, resolveUnactionablePath, appendUnactionable, auditEntryHealth, quarantineEntry, restoreEntry, unarchiveEntry, _internals };
+export { DANGEROUS_COMMAND_ERROR_PATTERNS, DANGEROUS_COMMAND_WARNING_PATTERNS, DANGEROUS_COMMAND_PATTERNS, SECURITY_DEGRADING_PATTERNS, INVISIBLE_FORMAT_CHARS, INJECTION_PATTERNS, validateLesson, ACTIONABLE_STRING_MAX, ACTIONABLE_LIST_MAX, RETIRED_SKILL_HISTORY_MAX, ALLOWED_SKILL_PATH_PREFIXES, validateSkillPath, validateSkillCandidatePath, validateActionableFields, validateActionability, resolveUnactionablePath, appendUnactionable, auditEntryHealth, quarantineEntry, restoreEntry, unarchiveEntry, _internals };

package/dist/cli/{index-wg0665ft.js → index-8f10r7ay.js}

@@ -525,7 +525,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
   const recovered = touched.filter((e) => e.confidence > CONFIDENCE_FLOOR + FLOOR_EPSILON && e.confidence_floor_demoted);
   if (atFloor.length === 0 && recovered.length === 0)
     return;
-  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-6n3x3he2.js");
+  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-ymysgtrr.js");
   const rollups = await readKnowledgeCounterRollups(directory);
   const flagIds = new Set;
   for (const e of atFloor) {
@@ -592,7 +592,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
     });
   }
   if (action === "quarantine" && toQuarantine.length > 0) {
-    const { quarantineEntry } = await import("./knowledge-validator-exymfcb9.js");
+    const { quarantineEntry } = await import("./knowledge-validator-b9nvmzjc.js");
     for (const { id } of toQuarantine) {
       await quarantineEntry(directory, id, "confidence_floor_negative_outcome", "auto").catch((err) => {
         console.warn("[knowledge-store] confidence-floor quarantine failed (best-effort):", err instanceof Error ? err.message : String(err));