renma 0.15.1 → 0.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (81) hide show
  1. package/CHANGELOG.md +34 -1
  2. package/README.md +138 -38
  3. package/dist/agent-skills.d.ts +77 -0
  4. package/dist/agent-skills.d.ts.map +1 -0
  5. package/dist/agent-skills.js +468 -0
  6. package/dist/agent-skills.js.map +1 -0
  7. package/dist/catalog.d.ts.map +1 -1
  8. package/dist/catalog.js +38 -5
  9. package/dist/catalog.js.map +1 -1
  10. package/dist/cli-help.d.ts +8 -8
  11. package/dist/cli-help.d.ts.map +1 -1
  12. package/dist/cli-help.js +15 -3
  13. package/dist/cli-help.js.map +1 -1
  14. package/dist/commands/bom.d.ts +7 -0
  15. package/dist/commands/bom.d.ts.map +1 -1
  16. package/dist/commands/bom.js +24 -13
  17. package/dist/commands/bom.js.map +1 -1
  18. package/dist/commands/graph.d.ts +2 -1
  19. package/dist/commands/graph.d.ts.map +1 -1
  20. package/dist/commands/graph.js +3 -0
  21. package/dist/commands/graph.js.map +1 -1
  22. package/dist/commands/scaffold.d.ts.map +1 -1
  23. package/dist/commands/scaffold.js +45 -14
  24. package/dist/commands/scaffold.js.map +1 -1
  25. package/dist/commands/suggest-metadata.d.ts +3 -1
  26. package/dist/commands/suggest-metadata.d.ts.map +1 -1
  27. package/dist/commands/suggest-metadata.js +179 -6
  28. package/dist/commands/suggest-metadata.js.map +1 -1
  29. package/dist/diagnostic-ids.d.ts +29 -0
  30. package/dist/diagnostic-ids.d.ts.map +1 -1
  31. package/dist/diagnostic-ids.js +28 -0
  32. package/dist/diagnostic-ids.js.map +1 -1
  33. package/dist/discovery.d.ts +22 -0
  34. package/dist/discovery.d.ts.map +1 -1
  35. package/dist/discovery.js +124 -21
  36. package/dist/discovery.js.map +1 -1
  37. package/dist/metadata.d.ts +3 -1
  38. package/dist/metadata.d.ts.map +1 -1
  39. package/dist/metadata.js +166 -29
  40. package/dist/metadata.js.map +1 -1
  41. package/dist/model.d.ts +1 -0
  42. package/dist/model.d.ts.map +1 -1
  43. package/dist/report.d.ts.map +1 -1
  44. package/dist/report.js +16 -1
  45. package/dist/report.js.map +1 -1
  46. package/dist/repository-evidence.d.ts +11 -1
  47. package/dist/repository-evidence.d.ts.map +1 -1
  48. package/dist/repository-evidence.js +22 -2
  49. package/dist/repository-evidence.js.map +1 -1
  50. package/dist/repository-paths.d.ts +6 -0
  51. package/dist/repository-paths.d.ts.map +1 -0
  52. package/dist/repository-paths.js +62 -0
  53. package/dist/repository-paths.js.map +1 -0
  54. package/dist/rules.d.ts +6 -1
  55. package/dist/rules.d.ts.map +1 -1
  56. package/dist/rules.js +111 -97
  57. package/dist/rules.js.map +1 -1
  58. package/dist/scanner.d.ts +7 -1
  59. package/dist/scanner.d.ts.map +1 -1
  60. package/dist/scanner.js +29 -29
  61. package/dist/scanner.js.map +1 -1
  62. package/dist/security-diagnostics.d.ts.map +1 -1
  63. package/dist/security-diagnostics.js +98 -35
  64. package/dist/security-diagnostics.js.map +1 -1
  65. package/dist/security-policy-inventory.js +11 -4
  66. package/dist/security-policy-inventory.js.map +1 -1
  67. package/dist/security-policy.d.ts +27 -1
  68. package/dist/security-policy.d.ts.map +1 -1
  69. package/dist/security-policy.js +247 -34
  70. package/dist/security-policy.js.map +1 -1
  71. package/dist/skill-migration.d.ts +30 -0
  72. package/dist/skill-migration.d.ts.map +1 -0
  73. package/dist/skill-migration.js +566 -0
  74. package/dist/skill-migration.js.map +1 -0
  75. package/dist/types.d.ts +2 -0
  76. package/dist/types.d.ts.map +1 -1
  77. package/dist/yaml-frontmatter.d.ts +26 -0
  78. package/dist/yaml-frontmatter.d.ts.map +1 -0
  79. package/dist/yaml-frontmatter.js +114 -0
  80. package/dist/yaml-frontmatter.js.map +1 -0
  81. package/package.json +4 -1
package/CHANGELOG.md CHANGED
@@ -6,6 +6,37 @@ This project follows the spirit of [Keep a Changelog](https://keepachangelog.com
6
6
 
7
7
  ## [Unreleased]
8
8
 
9
+ ## [0.16.0] - 2026-07-11
10
+
11
+ ### Added
12
+
13
+ - Added Agent Skills specification validation to `scan`, including stable diagnostics for entrypoint naming, frontmatter, metadata, and body requirements.
14
+ - Added deterministic migration assistance to `suggest-metadata` for pre-0.16 Skill entrypoints and metadata, with conflict detection and canonical candidate validation.
15
+ - Added comprehensive Agent Skills compatibility and migration documentation, canonical authoring guidance, and a Context Lens example for boundary-value spec review.
16
+
17
+ ### Changed
18
+
19
+ - Required operational Skills to use specification-valid Agent Skills frontmatter with Renma extensions under flat, string-valued `metadata.renma.*` keys.
20
+ - Updated catalog, graph, ownership, readiness, BOM, security, scaffold, and reporting consumers to use canonical Skill metadata while retaining legacy forms only as migration input.
21
+ - Expanded the README, architecture, design, user manual, security guidance, and example repository for the 0.16.0 Skill format and repository model.
22
+
23
+ ### Fixed
24
+
25
+ - Corrected the repository-owned release-prep Skill syntax and kept its operational workflow in the required release context.
26
+
27
+ ## [0.15.2] - 2026-07-10
28
+
29
+ ### Added
30
+
31
+ - Added an authoritative Repository Context BOM v1 contract document covering schema compatibility, snapshot consistency, reproducibility, provenance, and future consumed-context evidence boundaries.
32
+ - Added a normalized BOM v1 contract-shape test that pins stable JSON fields, nested shapes, deterministic ordering, and scope declarations.
33
+
34
+ ### Changed
35
+
36
+ - Hardened `renma bom` so graph, readiness, diagnostics, Context Lens evidence, security posture, and security policy inventory are derived from the same collected repository snapshot as catalog assets.
37
+ - Captured referenced helper and dependency path existence in `RepositorySnapshot` so snapshot-derived BOM and scan reports do not query the live filesystem during rule evaluation.
38
+ - Clarified `--omit-generated-at` as a same-environment reproducibility option that removes only the run-time `generatedAt` field and does not normalize freshness metadata, absolute paths, file moves, UTC evaluation date changes, or cross-runner portability.
39
+
9
40
  ## [0.15.1] - 2026-07-10
10
41
 
11
42
  ### Added
@@ -279,7 +310,9 @@ Tag-only release. No GitHub Release entry was published for this version.
279
310
  - Added metadata governance, advisory diagnostics, local path checks, and semantic split suggestions.
280
311
  - Added the initial project documentation, architecture notes, package metadata, tests, and license.
281
312
 
282
- [Unreleased]: https://github.com/KazuCocoa/renma/compare/v0.15.1...HEAD
313
+ [Unreleased]: https://github.com/KazuCocoa/renma/compare/v0.16.0...HEAD
314
+ [0.16.0]: https://github.com/KazuCocoa/renma/compare/v0.15.2...v0.16.0
315
+ [0.15.2]: https://github.com/KazuCocoa/renma/compare/v0.15.1...v0.15.2
283
316
  [0.15.1]: https://github.com/KazuCocoa/renma/compare/v0.15.0...v0.15.1
284
317
  [0.15.0]: https://github.com/KazuCocoa/renma/compare/v0.14.1...v0.15.0
285
318
  [0.14.1]: https://github.com/KazuCocoa/renma/compare/v0.14.0...v0.14.1
package/README.md CHANGED
@@ -4,11 +4,16 @@
4
4
  [![Downloads](http://img.shields.io/npm/dm/renma.svg)](https://npmjs.org/package/renma)
5
5
 
6
6
 
7
- Renma is an opinionated Context Repository toolkit for LLM-era software teams.
7
+ Renma is a Git-native context repository and deterministic governance tool for
8
+ LLM-facing knowledge. It manages reusable Skills, Context Lenses, Context
9
+ Assets, references, ownership, lifecycle, dependencies, and evidence as
10
+ maintainable software assets.
8
11
 
9
- It helps teams manage reusable, human-curated context assets in Git so agents, coding tools, and future AI runtimes can consume team knowledge more safely and consistently.
10
-
11
- Renma is the deterministic governance and health layer around that repository knowledge. Instead of letting critical knowledge get copied into many prompts or buried in one-off Markdown files, Renma treats it as a software asset: named, owned, versioned, linked, checked in CI, and reviewed with deterministic diagnostics and scan findings.
12
+ Instead of letting critical knowledge get copied into prompts or buried in
13
+ one-off Markdown files, Renma keeps it named, owned, versioned, linked, checked
14
+ in CI, and reviewed through deterministic diagnostics. Agents, coding tools,
15
+ and other runtimes consume those repository assets according to their own
16
+ runtime behavior.
12
17
 
13
18
  Renma now supports `scan`, `catalog`, `ownership`, `graph`, focused graph views, `trust-graph`, `readiness`, Repository Context BOM reports, repeated-context diagnostics, semantic diff, `ci-report`, `inspect`, `scaffold`, `suggest-metadata`, `suggest-semantic-split`, and security diagnostics.
14
19
 
@@ -20,7 +25,10 @@ Renma is especially useful when a repository contains agent-facing material such
20
25
  - Team-owned context assets that should outlive a single prompt
21
26
  - References and examples that agents should be able to cite or inspect
22
27
 
23
- Renma is not an agent runtime, not a prompt library, not a vector database, and not a general Markdown linter. Markdown is the storage format today; the product is the catalog, dependency graph, ownership model, and readiness checks around agent-consumable repository knowledge.
28
+ Renma is not an agent runtime, prompt builder, live context selector, workflow
29
+ engine, telemetry collector, vector database, or general Markdown linter.
30
+ Markdown is the storage format today; the product is the repository model and
31
+ the deterministic governance views around agent-consumable knowledge.
24
32
 
25
33
  Use Renma when you need to answer repository-level questions such as:
26
34
 
@@ -38,29 +46,66 @@ It is not a prompt library. It is not a vector database. It is not an agent memo
38
46
 
39
47
  It is a place where teams maintain context assets with ownership, lifecycle state, dependencies, references, and review history.
40
48
 
41
- ## The Layer Model
49
+ ## Agent Skills Compatibility
42
50
 
43
- ```text
44
- Tools
45
- Codex, Claude, Cursor, CI, editors, internal CLIs
51
+ Renma recognizes and validates [Agent Skills-compatible syntax](https://agentskills.io/specification)
52
+ as a familiar, portable authoring entrypoint. This lowers adoption cost without
53
+ making the Agent Skills format Renma's complete repository model: shared
54
+ Context Assets, Context Lenses, policies, references, ownership, lifecycle,
55
+ dependencies, and evidence remain independently governed repository assets.
46
56
 
47
- Skills
48
- agent-facing entrypoints that route an agent toward a task
57
+ In short, Renma is **Agent Skills-compatible, but not Agent Skills-defined**. A
58
+ repository may organize its broader knowledge assets around domains, products,
59
+ teams, or workflows without embedding them inside Skill directories. Canonical
60
+ Skill entrypoints in 0.16.0 are still discovered only under
61
+ `skills/**/SKILL.md` and `.agents/skills/**/SKILL.md`; arbitrary Skill roots are
62
+ not implemented. Renma is not an Agent Skills runtime, registry, or live
63
+ router. For the exact 0.16.0 syntax and migration boundary, see
64
+ [Agent Skills Compatibility and Migration](docs/agent-skills-compatibility.md).
49
65
 
50
- Context Lenses
51
- purpose-oriented interpretation layers over context assets
66
+ ## The Layer Model
52
67
 
53
- Context Assets
54
- Shared domain, product, testing, platform, and tool knowledge
68
+ ```mermaid
69
+ flowchart TD
70
+ subgraph Repository["Git-reviewed Repository — source of truth"]
71
+ Skills["Skills: agent-facing entrypoints and usage guides"]
72
+ Lenses["Context Lenses: purpose-oriented interpretation"]
73
+ Assets["Context Assets: reusable source-of-truth knowledge"]
74
+ Skills -->|may reference| Lenses
75
+ Skills -->|may reference directly| Assets
76
+ Lenses -->|interprets| Assets
77
+ end
78
+ Renma["Renma: discover, parse, normalize, and validate"]
79
+ Catalog["Catalog: generated projection of IDs, ownership, lifecycle, dependencies, evidence"]
80
+ Views["Graph, Trust Graph, Readiness, and BOM projections"]
81
+ Consumers["External tools and agents — runtime behavior outside Renma"]
82
+ Skills --> Renma
83
+ Lenses --> Renma
84
+ Assets --> Renma
85
+ Renma --> Catalog
86
+ Renma --> Views
87
+ Consumers -->|consume according to their runtime behavior| Skills
88
+ Consumers -->|may also consume| Lenses
89
+ Consumers -->|may also consume| Assets
90
+ ```
55
91
 
56
- Catalog
57
- Deterministic IDs, ownership, lifecycle state, dependencies, evidence
92
+ Skills may point through a Context Lens or directly to a Context Asset; a Lens
93
+ is not required for every asset. Renma generates the Catalog and other
94
+ governance projections from repository source assets and declarations; the
95
+ Catalog describes those assets rather than creating them. Renma validates
96
+ static declarations but does not select a Skill, choose or inject task Context,
97
+ assemble a prompt, or execute the consumer's workflow.
58
98
 
59
- Repository
60
- Git-reviewed source of truth for agent-consumable knowledge
61
- ```
99
+ ## Primary Workflows
62
100
 
63
- Tools decide what to do at runtime. Skills tell an agent when and how to use a capability. Context lenses describe purpose-oriented interpretation over reusable knowledge. Context assets hold that reusable knowledge. Renma catalogs and validates the layer underneath so tools and agents are not guessing from stale, orphaned, duplicated, or unowned files.
101
+ Renma supports two common user journeys:
102
+
103
+ 1. [Create a new Skill with `scaffold`](docs/user-manual.md#user-story-create-a-new-skill-with-scaffold), add reusable Context, validate the repository, and review the result.
104
+ 2. [Improve an existing Skill or context repository](docs/user-manual.md#user-story-improve-existing-skills-with-diagnostics) from deterministic diagnostics, optionally using a coding agent to propose a patch that a human reviews.
105
+
106
+ The [`examples/context-repo`](examples/context-repo) fixture demonstrates the
107
+ second journey as a repository-aware, statically navigable specification review
108
+ with an explicit Renma, agent, and human responsibility boundary.
64
109
 
65
110
  ## How Renma Relates to RAG and Agent Memory
66
111
 
@@ -97,9 +142,12 @@ Renma supports existing skill-local references, profiles, and examples. The pref
97
142
  ```text
98
143
  skills/
99
144
  testing/
100
- test-case-generation.skill.md
101
- spec-review.skill.md
102
- regression-planning.skill.md
145
+ test-case-generation/
146
+ SKILL.md
147
+ spec-review/
148
+ SKILL.md
149
+ regression-planning/
150
+ SKILL.md
103
151
 
104
152
  contexts/
105
153
  testing/
@@ -128,7 +176,12 @@ lenses/
128
176
  spec-review-boundary-values.md
129
177
  ```
130
178
 
131
- `contexts/` is preferred. `context/` is also scanned for compatibility. Files under either root are cataloged as first-class `context` assets, while experimental `context_lens` assets live under `lenses/` or opt in from context files with `type: context_lens`. Skill-local `references/` remain supported as `reference` assets.
179
+ This is an illustrative domain-oriented layout, not a required repository
180
+ schema. `contexts/` is preferred and `context/` is also scanned for
181
+ compatibility. Files under either root are cataloged as first-class `context`
182
+ assets, while `context_lens` assets live under `lenses/` or opt in from context
183
+ files with `type: context_lens`. Skill-local `references/` remain supported as
184
+ `reference` assets.
132
185
 
133
186
  ## What Renma Does Today
134
187
 
@@ -199,7 +252,7 @@ renma bom . --format json --omit-generated-at
199
252
 
200
253
  ### Repository Context BOM
201
254
 
202
- `renma bom` prints a declared Repository Context BOM generated from existing Renma evidence.
255
+ `renma bom` prints a declared Repository Context BOM generated from existing Renma evidence. See the [Repository Context BOM contract](docs/repository-context-bom.md) for the authoritative v1 schema, snapshot, reproducibility, provenance, and future consumed-context evidence boundaries.
203
256
 
204
257
  ```bash
205
258
  renma bom . --format json
@@ -209,11 +262,11 @@ renma bom . --format json --omit-generated-at
209
262
 
210
263
  The BOM is a repository manifest, not a runtime usage report. It combines the catalog asset inventory, content hashes, owners, lifecycle metadata, declared dependency graph evidence, diagnostics, readiness checks, security posture, and security policy inventory into one reviewable artifact.
211
264
 
212
- Renma collects one shared repository evidence snapshot for BOM catalog assets and graph dependencies so those sections stay internally consistent.
265
+ Renma derives each BOM from one in-memory repository snapshot: configuration, discovered artifacts, parsed documents, catalog, graph evidence, diagnostics, readiness, and security summaries all come from the same collected state.
213
266
 
214
267
  It does not describe what an LLM actually used, assemble prompts, select task-specific context, inject context into agents, import consumed-context evidence, or collect telemetry. JSON is the source of truth; Markdown is the compact pull-request review view.
215
268
 
216
- By default, `generatedAt` records the actual generation time. Use `--omit-generated-at` when CI or review automation needs to avoid clock-based diffs. This option only removes the run-time generation timestamp; it does not ignore repository metadata timestamps such as `lastReviewedAt` or `expiresAt`, and it does not normalize absolute `root` or `configPath` values.
269
+ By default, `generatedAt` records the actual generation time. Use `--omit-generated-at` when CI or review automation needs to avoid clock-based diffs. With the same checkout path, config path, repository contents, Renma version, and UTC evaluation date, repeated `--omit-generated-at` runs should produce byte-identical JSON. The option does not remove metadata freshness dates, suppress freshness diagnostics, normalize absolute `root` or `configPath`, hide file moves, or guarantee portable byte-for-byte output across runners.
217
270
 
218
271
  ### Repeated context diagnostics
219
272
 
@@ -292,6 +345,10 @@ npx renma scaffold context contexts/testing/boundary-value-analysis.md --id cont
292
345
  npx renma scaffold context_lens lenses/testing/spec-review-boundary-values.md --id lens.testing.spec-review.boundary-values --title "Spec Review Boundary Values Lens" --owner qa-platform --tags testing,spec-review
293
346
  ```
294
347
 
348
+ The Skill scaffold writes a canonical Agent Skills `SKILL.md` directly, with
349
+ Renma governance values under flat, string-valued `metadata.renma.*` keys.
350
+ Context and context-lens scaffolds retain their existing top-level metadata.
351
+
295
352
  Inspect a focused graph for the new skill:
296
353
 
297
354
  ```bash
@@ -322,7 +379,8 @@ Renma does not require an LLM for this loop. Its core analysis is deterministic
322
379
 
323
380
  ## Example repository
324
381
 
325
- See [`examples/context-repo`](examples/context-repo) for a small skill and shared-context repository you can scan with renma.
382
+ See [`examples/context-repo`](examples/context-repo) for a repository-aware
383
+ Skill and shared-context fixture you can inspect with Renma.
326
384
 
327
385
  See [`examples/context-lens`](examples/context-lens) for a Context Lens governance example with valid lenses, readiness output, inspect output, and expected diagnostics for an invalid lens.
328
386
 
@@ -330,6 +388,7 @@ See [`examples/context-lens`](examples/context-lens) for a Context Lens governan
330
388
 
331
389
  ```bash
332
390
  renma scan <path>
391
+ renma bom <path>
333
392
  renma catalog <path>
334
393
  renma ownership <path>
335
394
  renma graph <path>
@@ -339,6 +398,7 @@ renma diff <path> --from <ref> --to <ref>
339
398
  renma ci-report <path> --from <ref> --to <ref>
340
399
  renma inspect <file>
341
400
  renma inspect <file> --lines L10-L42
401
+ renma scaffold <skill|context|context_lens> <path>
342
402
  renma suggest-metadata <file>
343
403
  renma suggest-semantic-split <file>
344
404
  ```
@@ -379,15 +439,41 @@ Trust Graph helps reviewers inspect owner evidence, lifecycle status evidence, d
379
439
 
380
440
  ## What Gets Scanned
381
441
 
382
- By default, Renma looks for:
442
+ Canonical Agent Skills entrypoints use the exact `SKILL.md` filename:
383
443
 
384
444
  ```text
385
445
  skills/**/SKILL.md
446
+ .agents/skills/**/SKILL.md
447
+ ```
448
+
449
+ Renma 0.16.0 requires Agent Skills format for operational Skills. Renma
450
+ governance and security values use flat, string-valued `metadata.renma.*`
451
+ entries; list values are JSON-array strings and booleans are the exact strings
452
+ `"true"` or `"false"`. Pre-0.16 top-level Skill metadata is discovered only as
453
+ migration input for `suggest-metadata`; catalog, ownership, graph, readiness,
454
+ BOM, Trust Graph, lifecycle, and security consumers do not use it. Contexts and
455
+ other non-Skill assets keep their existing top-level metadata syntax. See
456
+ [Agent Skills Compatibility and Migration](docs/agent-skills-compatibility.md)
457
+ for the normative boundary.
458
+
459
+ Renma also discovers these historical spellings so `scan` can report migration
460
+ diagnostics; they are not Agent Skills-compatible entrypoints:
461
+
462
+ ```text
386
463
  skills/**/skill.md
387
464
  skills/**/*.skill.md
388
- .agents/skills/**/SKILL.md
389
465
  .agents/skills/**/skill.md
390
466
  .agents/skills/**/*.skill.md
467
+ ```
468
+
469
+ For migration, `skills/demo/skill.md` targets `skills/demo/SKILL.md`, while
470
+ `skills/testing/spec-review.skill.md` targets
471
+ `skills/testing/spec-review/SKILL.md`. `suggest-metadata` reports these path
472
+ changes explicitly and does not edit files.
473
+
474
+ Other default scan inputs include:
475
+
476
+ ```text
391
477
  .agents/**/*.md
392
478
  AGENTS.md
393
479
  README.md
@@ -435,7 +521,6 @@ Add `renma.config.json` at the repository root to tune discovery and CI behavior
435
521
  "format": "json",
436
522
  "globs": [
437
523
  "skills/**/SKILL.md",
438
- "skills/**/skill.md",
439
524
  ".agents/skills/**/SKILL.md",
440
525
  "AGENTS.md",
441
526
  "contexts/**/*.md"
@@ -474,7 +559,9 @@ Each suppression requires a rule `id`, one or more path patterns, and an audit `
474
559
 
475
560
  ## Asset Metadata
476
561
 
477
- Renma works best when reusable assets declare lightweight metadata in front matter:
562
+ Contexts and other non-Skill assets declare lightweight metadata in frontmatter
563
+ using the existing top-level syntax. Skills use canonical Agent Skills
564
+ frontmatter and `metadata.renma.*` as described above.
478
565
 
479
566
  ```markdown
480
567
  ---
@@ -491,7 +578,9 @@ requires_context:
491
578
  # Boundary Value Analysis
492
579
  ```
493
580
 
494
- Useful metadata includes:
581
+ Useful metadata semantics include the following. The spellings shown here are
582
+ the top-level non-Skill form; canonical Skills use the corresponding
583
+ `metadata.renma.*` keys.
495
584
 
496
585
  - `id`: Stable catalog ID
497
586
  - `title`: Human-readable asset title
@@ -527,7 +616,10 @@ renma suggest-metadata skills/testing/spec-review/SKILL.md --format prompt
527
616
 
528
617
  `suggest-metadata` is not an auto-fixer. It tells a human or coding agent to inspect the existing asset, preserve existing frontmatter and Markdown body content, add only compact missing metadata that is clearly supported, and rerun `renma scan .` and `renma ownership .`. It does not infer owners. If you pass `--owner qa-platform`, the output may include that owner because it was explicitly provided; otherwise missing owner remains allowed and is reported as unowned by `ownership`. If an existing asset already declares an owner, `suggest-metadata` preserves it; a different `--owner` value is treated as a human-review ownership change, not an automatic metadata suggestion.
529
618
 
530
- Renma reads deterministic frontmatter from skills and context assets. YAML-style block lists are supported for selected metadata fields, which keeps authored metadata explicit and reviewable:
619
+ For non-Skill assets, YAML-style block lists are supported for selected
620
+ metadata fields, which keeps authored metadata explicit and reviewable.
621
+ Pre-0.16 Skill fields may use this shape as migration input, but are not
622
+ operational in Renma 0.16.0:
531
623
 
532
624
  ```yaml
533
625
  ---
@@ -557,7 +649,11 @@ superseded_by:
557
649
  ---
558
650
  ```
559
651
 
560
- Supported YAML-style block-list fields are `tags`, `when_to_use`, `when_not_to_use`, `requires_context`, `optional_context`, `conflicts`, and `superseded_by`. Renma supports lists for those metadata fields, not arbitrary nested maps; it does not infer missing dependencies with an LLM during `scan`.
652
+ Supported YAML-style block-list fields in that syntax are `tags`,
653
+ `when_to_use`, `when_not_to_use`, `requires_context`, `optional_context`,
654
+ `conflicts`, and `superseded_by`. Canonical Skills instead encode the
655
+ corresponding `renma.*` values as JSON-array strings. Renma does not infer
656
+ missing dependencies with an LLM during `scan`.
561
657
 
562
658
  Catalog and scan diagnostics preserve field-level evidence for metadata. For
563
659
  block-list dependency fields such as `requires_context` and `optional_context`,
@@ -675,11 +771,14 @@ Renma reports deterministic safety findings for agent-facing operational instruc
675
771
 
676
772
  These findings are guardrails for review. They do not replace secret scanning, SAST, dependency scanning, or human security review.
677
773
 
678
- Near-term security work is focused on stabilizing these diagnostics for the 0.7.0 line. Renma now summarizes security posture in readiness and CI reports, and exposes Trust Graph evidence for effective policy, security profile resolution, approved destinations, forbidden inputs, human approval requirements, and high-risk findings.
774
+ Renma summarizes security posture in Readiness and CI reports, and exposes
775
+ Trust Graph evidence for effective policy, security profile resolution,
776
+ approved destinations, forbidden inputs, human approval requirements, and
777
+ high-risk findings.
679
778
 
680
779
  Trust Graph interprets existing catalog, graph, scan, and security evidence as deterministic repository evidence. It is not a runtime system, not enforcement, not context selection or prompt assembly, not telemetry collection, not an LLM call, and not a subjective trust score.
681
780
 
682
- Repository Context BOM is a declared repository manifest of assets, hashes, owners, lifecycle states, dependencies, security posture, diagnostics, and readiness evidence. It does not claim what an LLM actually used at runtime. Later external consumed-context evidence may be imported and validated against Renma's repository model, while telemetry collection remains outside Renma.
781
+ Repository Context BOM is a declared repository manifest of assets, hashes, owners, lifecycle states, dependencies, security posture, diagnostics, and readiness evidence. It does not claim what an LLM actually used at runtime. The v1 contract deliberately keeps Git revision identity in the surrounding CI/PR artifact context and keeps any future consumed-context evidence separate from the declared BOM meaning. See the [Repository Context BOM contract](docs/repository-context-bom.md).
683
782
 
684
783
  ## Design Notes
685
784
 
@@ -708,6 +807,7 @@ node dist/index.js scan .
708
807
 
709
808
  ## Documentation
710
809
 
810
+ - [Agent Skills Compatibility and Migration](docs/agent-skills-compatibility.md)
711
811
  - [User Manual](docs/user-manual.md)
712
812
  - [Authoring Guide](docs/authoring-guide.md)
713
813
  - [Security Policy Guide](docs/security-policy.md)
@@ -0,0 +1,77 @@
1
+ import { type AgentSkillDiagnosticId } from "./diagnostic-ids.js";
2
+ import type { ParsedDocument } from "./types.js";
3
+ import { type ParsedYamlFrontmatter } from "./yaml-frontmatter.js";
4
+ export declare const AGENT_SKILLS_SPECIFICATION = "https://agentskills.io/specification";
5
+ export declare const AGENT_SKILLS_VALIDATION_PROFILE = "agentskills.io/specification@2026-07-11";
6
+ export declare const AGENT_SKILLS_TOP_LEVEL_FIELDS: readonly ["name", "description", "license", "compatibility", "metadata", "allowed-tools"];
7
+ export declare const LEGACY_RENMA_SKILL_FIELDS: readonly ["id", "title", "version", "owner", "status", "purpose", "last_reviewed_at", "review_cycle", "expires_at", "tags", "when_to_use", "when_not_to_use", "requires_context", "optional_context", "requires_lens", "optional_lens", "conflicts", "superseded_by", "allowed_data", "network_allowed", "external_upload_allowed", "secrets_allowed", "requires_human_approval", "forbidden_inputs", "approved_network_destinations", "approved_upload_destinations", "security_profile"];
8
+ export type AgentSkillFormat = "agent-skills" | "renma-legacy" | "hybrid" | "unknown";
9
+ export interface AgentSkillValidationIssue {
10
+ code: AgentSkillDiagnosticId;
11
+ severity: "error" | "warning";
12
+ category: "specification" | "renma-authoring";
13
+ path: string;
14
+ startLine: number;
15
+ endLine: number;
16
+ message: string;
17
+ field?: string;
18
+ details?: Record<string, unknown>;
19
+ }
20
+ export interface AgentSkillValidationResult {
21
+ path: string;
22
+ format: AgentSkillFormat;
23
+ valid: boolean;
24
+ name?: string;
25
+ description?: string;
26
+ migrationRecommended: boolean;
27
+ migrationDirection?: "legacy-to-agent-skills";
28
+ migrationCommand?: AgentSkillMigrationCommand;
29
+ legacyFields: string[];
30
+ canonicalRenmaFields: string[];
31
+ errorCount: number;
32
+ warningCount: number;
33
+ issues: AgentSkillValidationIssue[];
34
+ }
35
+ export interface AgentSkillInspection {
36
+ frontmatter: ParsedYamlFrontmatter;
37
+ validation: AgentSkillValidationResult;
38
+ }
39
+ export interface AgentSkillMigrationCommand {
40
+ command: "renma";
41
+ args: ["suggest-metadata", string];
42
+ display: string;
43
+ }
44
+ export interface AgentSkillsValidationSummary {
45
+ specification: string;
46
+ profile: string;
47
+ totalSkillCount: number;
48
+ validSkillCount: number;
49
+ invalidSkillCount: number;
50
+ canonicalSkillCount: number;
51
+ legacySkillCount: number;
52
+ hybridSkillCount: number;
53
+ warningCount: number;
54
+ results: AgentSkillValidationResult[];
55
+ }
56
+ export interface AgentSkillNameValidation {
57
+ normalized: string | undefined;
58
+ problems: string[];
59
+ }
60
+ /** Validate every discovered Skill using one locally versioned Agent Skills profile. */
61
+ export declare function validateAgentSkills(documents: ParsedDocument[]): AgentSkillsValidationSummary;
62
+ /** Validate one discovered Skill without changing any operational metadata reader. */
63
+ export declare function validateAgentSkill(document: ParsedDocument): AgentSkillValidationResult;
64
+ /** Parse and validate a Skill once for canonical operational consumers. */
65
+ export declare function inspectAgentSkill(document: ParsedDocument): AgentSkillInspection;
66
+ /** Resolve the YAML description value used by Skill quality rules. */
67
+ export declare function resolvedAgentSkillDescription(document: ParsedDocument): string | undefined;
68
+ /** Normalize and validate an Agent Skills YAML name field. */
69
+ export declare function normalizeAgentSkillNameField(value: unknown): AgentSkillNameValidation;
70
+ /** Normalize and validate a Skill directory name without changing filesystem identity. */
71
+ export declare function normalizeAgentSkillDirectoryName(value: unknown): AgentSkillNameValidation;
72
+ /** Backward-compatible name for validating an Agent Skills YAML name field. */
73
+ export declare function validateAgentSkillName(value: unknown): AgentSkillNameValidation;
74
+ export declare function legacyRenmaMetadataKey(field: string): string | undefined;
75
+ /** Return all Markdown line numbers occupied by backtick or tilde fences. */
76
+ export declare function agentSkillFenceLines(lines: string[], bodyStartLine: number): Set<number>;
77
+ //# sourceMappingURL=agent-skills.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"agent-skills.d.ts","sourceRoot":"","sources":["../src/agent-skills.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAEL,KAAK,qBAAqB,EAE3B,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,0BAA0B,yCACC,CAAC;AACzC,eAAO,MAAM,+BAA+B,4CACD,CAAC;AAE5C,eAAO,MAAM,6BAA6B,2FAOhC,CAAC;AAEX,eAAO,MAAM,yBAAyB,4dA4B5B,CAAC;AAQX,MAAM,MAAM,gBAAgB,GACxB,cAAc,GACd,cAAc,GACd,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,QAAQ,EAAE,eAAe,GAAG,iBAAiB,CAAC;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,yBAAyB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,qBAAqB,CAAC;IACnC,UAAU,EAAE,0BAA0B,CAAC;CACxC;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,0BAA0B,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,cAAc,EAAE,GAC1B,4BAA4B,CA0B9B;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,cAAc,GACvB,0BAA0B,CAG5B;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,cAAc,GACvB,oBAAoB,CAMtB;AAED,sEAAsE;AACtE,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,cAAc,GACvB,MAAM,GAAG,SAAS,CAKpB;AA0LD,8DAA8D;AAC9D,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,GACb,wBAAwB,CAE1B;AAED,0FAA0F;AAC1F,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,GACb,wBAAwB,CAE1B;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,GACb,wBAAwB,CAE1B;AA+BD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIxE;AAsXD,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EAAE,EACf,aAAa,EAAE,MAAM,GACpB,GAAG,CAAC,MAAM,CAAC,CAgCb"}