renma 0.15.2 → 0.17.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (126) hide show
  1. package/CHANGELOG.md +54 -1
  2. package/README.md +216 -655
  3. package/architecture.md +523 -0
  4. package/design.md +458 -0
  5. package/dist/agent-skills.d.ts +77 -0
  6. package/dist/agent-skills.d.ts.map +1 -0
  7. package/dist/agent-skills.js +468 -0
  8. package/dist/agent-skills.js.map +1 -0
  9. package/dist/catalog.d.ts.map +1 -1
  10. package/dist/catalog.js +38 -5
  11. package/dist/catalog.js.map +1 -1
  12. package/dist/cli-help.d.ts +13 -11
  13. package/dist/cli-help.d.ts.map +1 -1
  14. package/dist/cli-help.js +36 -11
  15. package/dist/cli-help.js.map +1 -1
  16. package/dist/cli.d.ts.map +1 -1
  17. package/dist/cli.js +139 -40
  18. package/dist/cli.js.map +1 -1
  19. package/dist/commands/catalog.d.ts.map +1 -1
  20. package/dist/commands/catalog.js +4 -3
  21. package/dist/commands/catalog.js.map +1 -1
  22. package/dist/commands/graph.d.ts.map +1 -1
  23. package/dist/commands/graph.js +7 -12
  24. package/dist/commands/graph.js.map +1 -1
  25. package/dist/commands/readiness.d.ts.map +1 -1
  26. package/dist/commands/readiness.js +7 -6
  27. package/dist/commands/readiness.js.map +1 -1
  28. package/dist/commands/scaffold.d.ts.map +1 -1
  29. package/dist/commands/scaffold.js +59 -16
  30. package/dist/commands/scaffold.js.map +1 -1
  31. package/dist/commands/suggest-metadata.d.ts +3 -1
  32. package/dist/commands/suggest-metadata.d.ts.map +1 -1
  33. package/dist/commands/suggest-metadata.js +226 -7
  34. package/dist/commands/suggest-metadata.js.map +1 -1
  35. package/dist/commands/suggest-semantic-split.js +3 -3
  36. package/dist/commands/suggest-semantic-split.js.map +1 -1
  37. package/dist/dependency-resolution.d.ts +6 -0
  38. package/dist/dependency-resolution.d.ts.map +1 -0
  39. package/dist/dependency-resolution.js +11 -0
  40. package/dist/dependency-resolution.js.map +1 -0
  41. package/dist/diagnostic-ids.d.ts +29 -0
  42. package/dist/diagnostic-ids.d.ts.map +1 -1
  43. package/dist/diagnostic-ids.js +28 -0
  44. package/dist/diagnostic-ids.js.map +1 -1
  45. package/dist/discovery.d.ts +50 -0
  46. package/dist/discovery.d.ts.map +1 -1
  47. package/dist/discovery.js +183 -25
  48. package/dist/discovery.js.map +1 -1
  49. package/dist/metadata.d.ts +3 -1
  50. package/dist/metadata.d.ts.map +1 -1
  51. package/dist/metadata.js +166 -29
  52. package/dist/metadata.js.map +1 -1
  53. package/dist/model.d.ts +1 -0
  54. package/dist/model.d.ts.map +1 -1
  55. package/dist/report.d.ts.map +1 -1
  56. package/dist/report.js +16 -1
  57. package/dist/report.js.map +1 -1
  58. package/dist/repository-paths.d.ts +13 -0
  59. package/dist/repository-paths.d.ts.map +1 -1
  60. package/dist/repository-paths.js +60 -2
  61. package/dist/repository-paths.js.map +1 -1
  62. package/dist/rules.d.ts.map +1 -1
  63. package/dist/rules.js +97 -107
  64. package/dist/rules.js.map +1 -1
  65. package/dist/scanner.d.ts.map +1 -1
  66. package/dist/scanner.js +3 -1
  67. package/dist/scanner.js.map +1 -1
  68. package/dist/security-diagnostics.d.ts.map +1 -1
  69. package/dist/security-diagnostics.js +98 -35
  70. package/dist/security-diagnostics.js.map +1 -1
  71. package/dist/security-policy-inventory.js +11 -4
  72. package/dist/security-policy-inventory.js.map +1 -1
  73. package/dist/security-policy.d.ts +27 -1
  74. package/dist/security-policy.d.ts.map +1 -1
  75. package/dist/security-policy.js +247 -34
  76. package/dist/security-policy.js.map +1 -1
  77. package/dist/skill-migration.d.ts +30 -0
  78. package/dist/skill-migration.d.ts.map +1 -0
  79. package/dist/skill-migration.js +566 -0
  80. package/dist/skill-migration.js.map +1 -0
  81. package/dist/trust-graph.d.ts.map +1 -1
  82. package/dist/trust-graph.js +7 -11
  83. package/dist/trust-graph.js.map +1 -1
  84. package/dist/types.d.ts +3 -1
  85. package/dist/types.d.ts.map +1 -1
  86. package/dist/yaml-frontmatter.d.ts +26 -0
  87. package/dist/yaml-frontmatter.d.ts.map +1 -0
  88. package/dist/yaml-frontmatter.js +114 -0
  89. package/dist/yaml-frontmatter.js.map +1 -0
  90. package/docs/README.md +55 -0
  91. package/docs/advanced-skill-authoring.md +140 -0
  92. package/docs/agent-skills-compatibility.md +500 -0
  93. package/docs/authoring-guide.md +324 -0
  94. package/docs/context-conflict-diagnostics.md +32 -0
  95. package/docs/context-language-diagnostics.md +99 -0
  96. package/docs/context-lens.md +253 -0
  97. package/docs/context-lifecycle-diagnostics.md +55 -0
  98. package/docs/diagnostics.md +373 -0
  99. package/docs/metadata-budget.md +14 -0
  100. package/docs/repository-context-bom.md +113 -0
  101. package/docs/security-policy.md +338 -0
  102. package/docs/user-manual.md +813 -0
  103. package/examples/context-lens/README.md +101 -0
  104. package/examples/context-lens/contexts/testing/boundary-value-analysis.md +23 -0
  105. package/examples/context-lens/lenses/testing/spec-review-boundary-values.md +29 -0
  106. package/examples/context-lens/lenses/testing/test-design-boundary-values.md +29 -0
  107. package/examples/context-lens/skills/testing/spec-review/SKILL.md +49 -0
  108. package/examples/context-repo/README.md +149 -0
  109. package/examples/context-repo/contexts/domain/payment/idempotency.md +20 -0
  110. package/examples/context-repo/contexts/testing/boundary-value-analysis.md +19 -0
  111. package/examples/context-repo/contexts/testing/negative-testing.md +19 -0
  112. package/examples/context-repo/lenses/testing/spec-review-boundary-values.md +35 -0
  113. package/examples/context-repo/renma.config.json +12 -0
  114. package/examples/context-repo/skills/testing/spec-review/SKILL.md +66 -0
  115. package/examples/context-repo/tools/appium/README.md +14 -0
  116. package/examples/github-actions/renma-ci-report.yml +36 -0
  117. package/examples/interactive-placeholder/README.md +104 -0
  118. package/examples/interactive-placeholder/assets/template.txt +1 -0
  119. package/examples/interactive-placeholder/renma.config.json +6 -0
  120. package/examples/interactive-placeholder/skills/replace-placeholder/SKILL.md +54 -0
  121. package/examples/interactive-placeholder/tools/README.md +48 -0
  122. package/examples/interactive-placeholder/tools/placeholder-demo.mjs +99 -0
  123. package/package.json +11 -1
  124. package/plan-discovery.md +740 -0
  125. package/plan.md +150 -0
  126. package/scripts/verify-package.mjs +97 -0
@@ -0,0 +1,740 @@
1
+ # Renma Skill Discovery Plan
2
+
3
+ Status: proposed
4
+
5
+ Target: 0.18.0
6
+
7
+ Scope: optional, backward-compatible skill discovery for large single repositories
8
+
9
+ Only **Current Baseline** describes implemented behavior. Route metadata,
10
+ `skill-index`, discovery diagnostics, and the integrations proposed elsewhere in
11
+ this document are not implemented in 0.17.0. This plan is intentionally outside
12
+ the 0.17.0 usability and documentation-consolidation release.
13
+
14
+ ## Summary
15
+
16
+ Renma should add a static skill discovery projection for repositories that have grown beyond the point where an agent can reliably inspect every `SKILL.md` before choosing where to start.
17
+
18
+ The implementation should preserve Renma's current model and boundaries:
19
+
20
+ ```text
21
+ Skill = agent-facing entrypoint / routing contract / usage guide
22
+ Context Lens = purpose-oriented interpretation layer over context assets
23
+ Context Asset = independently owned source-of-truth knowledge
24
+ ```
25
+
26
+ The new capability should not introduce a required directory hierarchy, move existing files, select a skill for a live task, assemble prompts, or call an LLM. It should model the layered `SKILL.md` routing that repositories already use, validate that routing deterministically, and generate compact indexes and visualizations from the same repository evidence used by catalog, graph, readiness, diff, Trust Graph, and Repository Context BOM.
27
+
28
+ The intended operating model is:
29
+
30
+ ```text
31
+ Existing SKILL.md files own routing
32
+ -> Renma records and validates skill-to-skill routes
33
+ -> Renma emits a static skill index
34
+ -> an agent reads the index and source SKILL.md files
35
+ -> humans review summaries, diffs, and visualizations
36
+ ```
37
+
38
+ No-LLM workflows remain first-class:
39
+
40
+ ```text
41
+ LLM proposes. Renma verifies. Human approves.
42
+ ```
43
+
44
+ ## Current Baseline
45
+
46
+ The current 0.16.0 product model provides most of the infrastructure needed for
47
+ this work, and 0.17.0 improves the usability of that baseline without
48
+ implementing discovery:
49
+
50
+ - Repository discovery for skills, context assets, context lenses, profiles, references, examples, agents, config, and supporting files.
51
+ - A normalized catalog model with deterministic IDs, paths, hashes, owners, lifecycle metadata, tags, and declared dependencies.
52
+ - A shared `RepositoryEvidence` collection path used by catalog, graph, and Repository Context BOM work.
53
+ - Static graph relationships for required and optional context, required and optional lenses, lens application, conflicts, supersession references, and coverage evidence.
54
+ - Markdown, JSON, and Mermaid reports for human review, CI, and downstream tooling.
55
+ - Readiness, semantic diff, ownership, Trust Graph, diagnostics v2, review bundles, scaffold, and metadata suggestions.
56
+ - A compact metadata parser that supports scalar values and selected block-list fields while intentionally discouraging large nested frontmatter.
57
+
58
+ Skill discovery should extend this baseline. It should not create a parallel scanner, a second catalog, a new runtime service, or a separate source of truth.
59
+
60
+ ## Decision Status
61
+
62
+ Accepted constraints for 0.18.0 design are:
63
+
64
+ - Renma remains a deterministic repository-governance layer, not a runtime
65
+ selector.
66
+ - Existing canonical `SKILL.md` files remain source assets.
67
+ - Discovery is a projection over shared repository evidence.
68
+ - No required category, product, team, or workflow directory hierarchy is
69
+ introduced.
70
+ - Adoption remains backward-compatible and human-reviewable.
71
+
72
+ Everything else in this document is prototype knowledge or a proposed
73
+ implementation decision until code, contract tests, and release review accept
74
+ it. In particular, `routes_to`, `skill-index`, discovery aliases, explicit
75
+ entrypoints, diagnostic identifiers, report fields, views, thresholds, and
76
+ phase ordering are proposals rather than current product contracts.
77
+
78
+ ## Problem
79
+
80
+ A repository with 100 or more skills and many contributing teams has two different discovery problems:
81
+
82
+ 1. Renma must organize and validate the assets.
83
+ 2. An agent must find the right starting `SKILL.md` without reading the entire repository.
84
+
85
+ The first problem is already within Renma's current governance model. The second becomes difficult when a flat catalog exposes too many plausible skills at once.
86
+
87
+ Existing repositories often solve this with layered Skills. The proposed model
88
+ records that topology as a graph rather than requiring this directory tree:
89
+
90
+ ```mermaid
91
+ flowchart TD
92
+ Top["Top-level entrypoint Skill"]
93
+ Group["Category, product, or team entrypoint Skill"]
94
+ Workflow["Concrete workflow Skill"]
95
+ Lens["Context Lens"]
96
+ Assets["Context Assets"]
97
+ Top -->|proposed routes_to| Group
98
+ Top -->|may route directly| Workflow
99
+ Group -->|proposed routes_to| Workflow
100
+ Workflow -->|declared relationship| Lens
101
+ Workflow -->|may reference directly| Assets
102
+ Lens -->|applies_to| Assets
103
+ ```
104
+
105
+ Existing `SKILL.md` files would remain the source of routing policy. Renma would
106
+ record, validate, and present declared routes; tree-like views would remain
107
+ projections, and Renma would not select a Skill for a live user request.
108
+
109
+ Examples include:
110
+
111
+ ```text
112
+ setup
113
+ -> Appium setup
114
+ -> Android UiAutomator2 setup
115
+ ```
116
+
117
+ and:
118
+
119
+ ```text
120
+ test case generation
121
+ -> Checkout test case generation
122
+ -> current team workflow
123
+ -> requirements-based generation
124
+ ```
125
+
126
+ This structure is valuable. It separates responsibilities, keeps individual skills small, and lets different owners maintain different routing boundaries. Renma should make this structure visible and verifiable rather than replacing it with one large handwritten index.
127
+
128
+ ## Product Decisions
129
+
130
+ ### 1. Keep one repository as the governance boundary
131
+
132
+ The first implementation should target one repository containing its skills, lenses, contexts, metadata, and generated review artifacts.
133
+
134
+ A single repository provides one review surface for:
135
+
136
+ - Skill-to-skill reachability.
137
+ - Context and lens references.
138
+ - Product knowledge reuse.
139
+ - Ownership changes.
140
+ - Lifecycle and deprecation routing.
141
+ - Repeated-context evidence.
142
+ - Semantic diff and readiness.
143
+
144
+ Multi-repository federation, package synchronization, and organization-wide distribution remain out of scope for the initial implementation.
145
+
146
+ ### 2. Preserve every existing `SKILL.md`
147
+
148
+ All existing specification-valid `SKILL.md` files remain Skill assets. This
149
+ proposal must not require a migration to a new directory shape or a new Skill
150
+ type.
151
+
152
+ A category entrypoint, product entrypoint, team entrypoint, hybrid router, and concrete workflow are all still `skill` assets. Their role is expressed through their route relationships and existing usage boundaries, not through a mandatory physical hierarchy.
153
+
154
+ ### 3. Model discovery as a graph, not a required tree
155
+
156
+ Repositories may route by category, product, platform, input type, owner, workflow stage, or a combination of those dimensions. The order is not guaranteed to be the same across the repository.
157
+
158
+ Renma should therefore model:
159
+
160
+ ```text
161
+ skill -> skill
162
+ ```
163
+
164
+ as a typed route relationship and derive tree-like views only as projections.
165
+
166
+ The graph may represent any of these shapes:
167
+
168
+ ```text
169
+ category -> product -> workflow
170
+ category -> team -> workflow
171
+ product -> category -> workflow
172
+ category -> workflow
173
+ entrypoint -> entrypoint -> leaf
174
+ ```
175
+
176
+ No category, team, or product directory is required for correctness.
177
+
178
+ ### 4. Treat product identity as stable and ownership as mutable
179
+
180
+ Teams and maintainers may change. Product identity and product behavior usually change more slowly.
181
+
182
+ Durable product knowledge should therefore remain in independently owned context assets with stable IDs. A product-oriented path such as `contexts/products/checkout/` may be recommended where useful, but the stable asset ID and references matter more than the directory name.
183
+
184
+ For example:
185
+
186
+ ```text
187
+ context.product.checkout.behavior
188
+ context.product.checkout.regression-risk
189
+ lens.product.checkout.test-case-generation
190
+ ```
191
+
192
+ A skill owned by Team A today and Team D later can keep referencing the same product contexts. Renma diff should report the owner or route change separately from the unchanged product knowledge.
193
+
194
+ Product is a logical facet in the first implementation, not a new required artifact kind. Product views can be derived from stable context IDs, exact context/lens relationships, and optional namespaced tags such as `product:checkout`.
195
+
196
+ ### 5. Keep routing policy close to the skill that owns it
197
+
198
+ A category `SKILL.md` should remain the human-owned routing contract for that category. The generated index should summarize and link to it, not copy all of its instructions.
199
+
200
+ ```text
201
+ Top-level index owns first-hop visibility.
202
+ Entrypoint SKILL.md owns routing policy.
203
+ Leaf SKILL.md owns concrete workflow guidance.
204
+ Context lens owns interpretation focus.
205
+ Context asset owns durable knowledge.
206
+ Owner metadata records current responsibility.
207
+ Renma owns deterministic validation and reviewability.
208
+ ```
209
+
210
+ ### 6. Generate output without mutating the repository by default
211
+
212
+ The initial command should write to stdout, like existing Renma report commands. Users may redirect output into a checked-in file or publish it as a CI artifact.
213
+
214
+ ```bash
215
+ renma skill-index . --format markdown > SKILL_INDEX.md
216
+ renma skill-index . --format json > skill-index.json
217
+ renma skill-index . --format mermaid > skill-index.mmd
218
+ ```
219
+
220
+ Renma should not create `.renma/`, move skills, rewrite metadata, or update a generated index automatically during scan.
221
+
222
+ ## Discovery Model
223
+
224
+ ### Skill route edge
225
+
226
+ Add a static dependency kind for skill routing:
227
+
228
+ ```text
229
+ routes_to
230
+ ```
231
+
232
+ The relationship means:
233
+
234
+ ```text
235
+ The source skill explicitly directs an agent to inspect or continue with the target skill.
236
+ ```
237
+
238
+ It does not mean:
239
+
240
+ - Renma selected the target for a live user task.
241
+ - The target must be loaded into a prompt.
242
+ - The target was actually consumed at runtime.
243
+ - The source and target must follow a fixed directory hierarchy.
244
+
245
+ Route edges should preserve source evidence, including path, line range, target spelling, and declaration form.
246
+
247
+ ### Declared and observed routes
248
+
249
+ Adoption should not require immediate metadata changes across every existing skill.
250
+
251
+ Renma should support two deterministic evidence forms:
252
+
253
+ 1. **Declared route**: an optional `routes_to` metadata list containing exact skill IDs or repository-relative paths.
254
+ 2. **Observed route**: an exact local Markdown link from one discovered skill file to another discovered skill file.
255
+
256
+ Declared routes are explicit repository contracts. Observed routes preserve existing layered `SKILL.md` structures and provide a zero-restructure adoption path.
257
+
258
+ The report should keep the declaration form visible. Later diagnostics may recommend declaring important observed routes explicitly, but the MVP should not require this for all repositories.
259
+
260
+ ### Entrypoints
261
+
262
+ A discovery entrypoint is an active skill intended to appear in the first-hop index.
263
+
264
+ The default inference should be conservative:
265
+
266
+ - Active skills with no incoming route are inferred roots.
267
+ - Exact explicitly configured or declared entrypoints are always roots.
268
+ - Deprecated and archived skills are not published as normal roots.
269
+ - Standalone skills remain visible even when they are not yet connected.
270
+
271
+ An optional flat Renma metadata field may be added when repositories need to
272
+ override inference. Under the canonical 0.16.0 Skill syntax, the proposal would
273
+ use a string value under `metadata`:
274
+
275
+ ```yaml
276
+ metadata:
277
+ renma.discovery-entrypoint: "true"
278
+ ```
279
+
280
+ An optional config list may later provide a small repository-level root set. It must contain only broad roots and must not become a central list of every skill.
281
+
282
+ ### Minimal metadata direction
283
+
284
+ The current parser intentionally supports compact scalar and list metadata. Discovery should preserve that constraint.
285
+
286
+ Potential additive semantics are shown below using the canonical 0.16.0 Skill
287
+ serialization. These names are proposals, not currently operational fields:
288
+
289
+ ```yaml
290
+ metadata:
291
+ renma.routes-to: '["products.checkout.test-case-generation","products.search.test-case-generation"]'
292
+ renma.discovery-aliases: '["generate test cases","test case design"]'
293
+ renma.discovery-entrypoint: "true"
294
+ ```
295
+
296
+ Existing fields remain primary routing evidence:
297
+
298
+ - `renma.id`
299
+ - `renma.owner`
300
+ - `renma.status`
301
+ - `renma.tags`
302
+ - `renma.when-to-use`
303
+ - `renma.when-not-to-use`
304
+ - `renma.requires-context`
305
+ - `renma.optional-context`
306
+ - `renma.requires-lens`
307
+ - `renma.optional-lens`
308
+
309
+ Namespaced tags can provide optional facets without fixing a hierarchy:
310
+
311
+ ```yaml
312
+ metadata:
313
+ renma.tags: '["category:test-case-generation","product:checkout","platform:android"]'
314
+ ```
315
+
316
+ Do not add nested discovery maps to frontmatter in the first implementation. Do not require all fields on all skills. Add a field only when a command or deterministic diagnostic uses it.
317
+
318
+ ### Product projection
319
+
320
+ Product views should derive from durable evidence rather than current team names.
321
+
322
+ Possible evidence, in priority order:
323
+
324
+ 1. Direct `product:<id>` tags on a skill, lens, or context.
325
+ 2. A skill's exact relationship to a product-scoped lens or context.
326
+ 3. Stable IDs such as `context.product.<id>.*` or `lens.product.<id>.*`.
327
+ 4. Optional repository configuration for aliases only when naming cannot be normalized otherwise.
328
+
329
+ Renma should not infer product identity from `owner` alone.
330
+
331
+ A product view should show:
332
+
333
+ - Product-scoped contexts.
334
+ - Product-scoped lenses.
335
+ - Skills that use them.
336
+ - Current owners of those skills and assets.
337
+ - Route entrypoints that lead to those skills.
338
+ - Missing, deprecated, or orphaned relationships.
339
+
340
+ This lets a human verify that product knowledge remains stable even when ownership changes.
341
+
342
+ ## Command Direction
343
+
344
+ Use **Skill Discovery** as the product concept and begin with a static index command:
345
+
346
+ ```bash
347
+ renma skill-index [path] [--format json|markdown|mermaid]
348
+ ```
349
+
350
+ `skill-index` is preferable to a command that accepts task text because it clearly describes a repository artifact and does not imply runtime skill selection.
351
+
352
+ The implementation should be a thin projection over `RepositoryEvidence`. Internally, use names such as `skill-discovery` or `skill-index` to avoid confusing this feature with the existing repository file discovery module.
353
+
354
+ ### Views
355
+
356
+ Reuse the existing `--view` and `--focus` command conventions where possible.
357
+
358
+ Proposed views:
359
+
360
+ ```text
361
+ entrypoints
362
+ Compact first-hop index. This is the default Markdown view.
363
+
364
+ routes
365
+ Full skill-to-skill routing graph with route evidence and reachability.
366
+
367
+ products
368
+ Product contexts, lenses, consuming skills, routes, and current owners.
369
+
370
+ full
371
+ Complete discovery projection for tooling and debugging.
372
+ ```
373
+
374
+ Examples:
375
+
376
+ ```bash
377
+ renma skill-index . --format markdown
378
+ renma skill-index . --view routes --format json
379
+ renma skill-index . --view products --format markdown
380
+ renma skill-index . --focus test-case-generation --format mermaid
381
+ ```
382
+
383
+ JSON should be the canonical machine-readable shape. Markdown should remain compact enough for an agent to read and a human to paste into a pull request. Mermaid should provide a review visualization without creating a hosted dashboard.
384
+
385
+ ### Compact Markdown contract
386
+
387
+ The first-hop Markdown view should explain how to use the index without becoming a prompt package:
388
+
389
+ ```text
390
+ 1. Match the repository task to a broad entrypoint's usage boundaries.
391
+ 2. Open the source SKILL.md.
392
+ 3. Follow that skill's declared or observed routes.
393
+ 4. Read the selected leaf skill and its required lenses and contexts.
394
+ 5. Treat source SKILL.md, lenses, and contexts as authoritative over the generated index.
395
+ 6. Do not guess when no route is clear.
396
+ ```
397
+
398
+ Each root entry should include only compact evidence:
399
+
400
+ - ID and title or first heading.
401
+ - Source path.
402
+ - Owner and lifecycle state.
403
+ - `when_to_use` and `when_not_to_use` summaries when available.
404
+ - Direct route targets.
405
+ - Product facets when deterministically known.
406
+ - Blocking discovery diagnostics.
407
+
408
+ Detailed workflow instructions remain in the source skill.
409
+
410
+ ## Diagnostics
411
+
412
+ Discovery diagnostics should reuse the current diagnostic and review-bundle model. They should be emitted by normal deterministic scans and summarized by `skill-index`, readiness, semantic diff, and CI reports where appropriate.
413
+
414
+ Initial rules should be narrow and exact:
415
+
416
+ ```text
417
+ DISCOVERY-UNRESOLVED-ROUTE
418
+ A declared or exact local skill route does not resolve to a discovered skill.
419
+
420
+ DISCOVERY-ROUTE-TARGET-NOT-SKILL
421
+ A routes_to declaration resolves to a non-skill asset.
422
+
423
+ DISCOVERY-DEPRECATED-SKILL-ROUTED
424
+ An active skill routes to a deprecated or archived skill.
425
+
426
+ DISCOVERY-ROUTE-CYCLE
427
+ Skill routing contains a cycle that prevents a clear traversal boundary.
428
+
429
+ DISCOVERY-UNREACHABLE-SKILL
430
+ An active published skill cannot be reached from any discovery entrypoint.
431
+
432
+ DISCOVERY-DUPLICATE-ALIAS
433
+ Multiple active skills claim the same normalized discovery alias.
434
+
435
+ DISCOVERY-ROOT-SURFACE-LARGE
436
+ The inferred first-hop surface is too large to be a useful compact index.
437
+
438
+ DISCOVERY-ENTRYPOINT-WITHOUT-BOUNDARIES
439
+ An explicit entrypoint lacks usable when-to-use or when-not-to-use boundaries.
440
+ ```
441
+
442
+ Existing findings for missing negative routing, weak usage guidance, missing ownership, broken context references, deprecated context, orphaned context, and lens governance should be reused rather than duplicated under new codes.
443
+
444
+ Threshold-based rules such as a large root surface should begin as advisory and configurable. They must not impose a universal repository shape.
445
+
446
+ ## Readiness, Diff, Trust Graph, and BOM Integration
447
+
448
+ ### Readiness
449
+
450
+ After the route model stabilizes, readiness may add a compact `skillDiscovery` section containing:
451
+
452
+ - Active skill count.
453
+ - Explicit and inferred entrypoint count.
454
+ - Reachable skill percentage.
455
+ - Unresolved route count.
456
+ - Deprecated routed skill count.
457
+ - Route cycle count.
458
+ - Root surface status.
459
+
460
+ This section describes repository preparedness. It does not score the correctness of a live skill choice.
461
+
462
+ ### Semantic diff
463
+
464
+ Semantic diff should report:
465
+
466
+ - Added and removed route edges.
467
+ - Entrypoint changes.
468
+ - Skills that became reachable or unreachable.
469
+ - Alias changes and collisions.
470
+ - Owner changes independently from product context identity.
471
+ - Product context and lens reference changes.
472
+ - New routes to deprecated or archived skills.
473
+
474
+ A team ownership change should not appear as a product context replacement when stable product context IDs remain unchanged.
475
+
476
+ ### Trust Graph
477
+
478
+ Trust Graph may include route evidence after the route semantics are stable. It should expose owner, lifecycle, diagnostic, and route evidence for review without assigning a subjective trust or routing score.
479
+
480
+ ### Repository Context BOM
481
+
482
+ Repository Context BOM may later include an additive skill discovery summary and route manifest. The BOM remains a declared repository evidence snapshot, not a runtime report of which skill an LLM selected or consumed.
483
+
484
+ These integrations should follow the standalone route model and `skill-index` MVP rather than expanding the first patch.
485
+
486
+ ## Human and LLM-Assisted Maintenance
487
+
488
+ Humans are expected to review compact summaries, semantic diffs, diagnostics, and Mermaid views rather than manually inspect every edge in a large repository.
489
+
490
+ LLM coding agents may help maintain the graph by:
491
+
492
+ - Adding exact route metadata.
493
+ - Converting a large handwritten index into layered entrypoint skills.
494
+ - Extracting durable product knowledge into product-scoped context assets.
495
+ - Updating owners while preserving stable product context IDs.
496
+ - Resolving deprecated routes.
497
+ - Proposing aliases and usage boundaries.
498
+
499
+ Renma should support that workflow with deterministic diagnostics, `suggest-metadata`, scaffold output, and review bundles. Renma should not call a provider, choose the patch, or rewrite the repository automatically.
500
+
501
+ The repair loop remains:
502
+
503
+ ```text
504
+ renma scan / skill-index / diff
505
+ -> deterministic diagnostics and review evidence
506
+ -> human or coding agent proposes a patch
507
+ -> human reviews the patch
508
+ -> renma validates the result
509
+ ```
510
+
511
+ ## Implementation Phases
512
+
513
+ ### Phase 0: Schema and fixture design
514
+
515
+ Define the smallest additive model before adding a command.
516
+
517
+ Work:
518
+
519
+ - Add representative fixtures for layered setup routing and layered test-case generation.
520
+ - Include product-scoped context, context lenses, mutable owners, deprecated skills, an unresolved route, and a route cycle.
521
+ - Confirm exact ID and path resolution rules for skill targets.
522
+ - Decide how declared and observed route evidence is represented without changing existing dependency semantics.
523
+ - Define a versioned `SkillIndexReport` JSON shape.
524
+
525
+ Acceptance criteria:
526
+
527
+ - No existing output changes.
528
+ - No new required metadata.
529
+ - Fixtures represent category-first, product-first, team-first, and direct-leaf routing without requiring different code paths.
530
+
531
+ ### Phase 1: Route evidence in the normalized model
532
+
533
+ Add skill-to-skill route evidence to the existing catalog and graph pipeline.
534
+
535
+ Work:
536
+
537
+ - Parse optional `routes_to` block lists.
538
+ - Resolve exact skill IDs and repository-relative paths.
539
+ - Record exact local skill-to-skill Markdown links as observed routes.
540
+ - Add source evidence and declaration form.
541
+ - Add the `routes_to` relationship kind to graph output.
542
+ - Keep current catalog fields and dependency kinds backward compatible through additive output.
543
+ - Add unresolved, non-skill, deprecated-target, and cycle diagnostics.
544
+
545
+ Acceptance criteria:
546
+
547
+ - Existing layered skills produce a route graph without moving files.
548
+ - Existing commands remain deterministic.
549
+ - Repositories that do not use route metadata continue to scan successfully.
550
+ - No fuzzy matching, semantic search, or LLM inference is used.
551
+
552
+ ### Phase 2: `renma skill-index` MVP
553
+
554
+ Build the static discovery projection from shared repository evidence.
555
+
556
+ Work:
557
+
558
+ - Add `SkillIndexReport` with roots, skills, routes, reachability, facets, and diagnostics.
559
+ - Add JSON and compact Markdown output.
560
+ - Support `--focus` and the `entrypoints`, `routes`, and `full` views.
561
+ - Infer roots conservatively and support explicit entrypoint metadata.
562
+ - Keep standalone skills visible in a separate section instead of silently hiding them.
563
+ - Emit output to stdout only.
564
+
565
+ Acceptance criteria:
566
+
567
+ - A repository with more than 100 skills produces a bounded first-hop Markdown index.
568
+ - The index points to source skills rather than copying detailed workflow text.
569
+ - Specific leaf skills remain directly discoverable by ID, alias, path, or focused view.
570
+ - The command never accepts free-form task text and never ranks skills for a live task.
571
+
572
+ ### Phase 3: Product and ownership views
573
+
574
+ Add a stable product-oriented review projection.
575
+
576
+ Work:
577
+
578
+ - Recognize exact `product:<id>` tags.
579
+ - Recognize stable product context and lens IDs.
580
+ - Traverse context and lens relationships to associate skills with product evidence.
581
+ - Add the `products` view.
582
+ - Show current owners separately from product identity.
583
+ - Add fixtures where ownership changes but product context remains unchanged.
584
+
585
+ Acceptance criteria:
586
+
587
+ - Product views remain stable across owner changes.
588
+ - Renma never derives product identity from owner alone.
589
+ - Product contexts can be reused by multiple skills and teams without duplication.
590
+ - No product directory or first-class product node is required.
591
+
592
+ ### Phase 4: Readiness and semantic diff integration
593
+
594
+ Make discovery health reviewable in CI and pull requests.
595
+
596
+ Work:
597
+
598
+ - Add discovery summary fields to readiness.
599
+ - Add route, reachability, entrypoint, alias, product-facet, and ownership changes to semantic diff.
600
+ - Add compact discovery sections to CI reports.
601
+ - Reuse diagnostics v2 and review bundles for repair guidance.
602
+ - Define suppression behavior for advisory scale rules.
603
+
604
+ Acceptance criteria:
605
+
606
+ - A pull request clearly shows when a skill becomes unreachable.
607
+ - Owner changes are separated from product context changes.
608
+ - Discovery regressions can be gated only when a repository opts into the relevant severity threshold.
609
+ - Existing readiness and diff consumers remain compatible with additive fields.
610
+
611
+ ### Phase 5: Visualization and review artifacts
612
+
613
+ Add human-readable graph views after the report model is stable.
614
+
615
+ Work:
616
+
617
+ - Add Mermaid output for route and product views.
618
+ - Visually separate entrypoints, routers, leaves, lenses, contexts, and unresolved targets.
619
+ - Keep direct skill-to-context and skill-to-lens relationships visible without obscuring routes.
620
+ - Document redirection into checked-in or CI artifacts.
621
+
622
+ Acceptance criteria:
623
+
624
+ - A focused test-case-generation graph clearly shows entrypoint-to-skill routing and skill-to-lens-to-context relationships.
625
+ - A product graph clearly shows stable product context and current owners.
626
+ - No hosted dashboard or generated file mutation is required.
627
+
628
+ ### Phase 6: Authoring assistance
629
+
630
+ Reduce maintenance cost without making Renma a semantic author or runtime selector.
631
+
632
+ Work:
633
+
634
+ - Extend scaffold with optional route metadata inputs.
635
+ - Extend `suggest-metadata` to propose missing exact routes, aliases, and explicit entrypoints from deterministic evidence.
636
+ - Create review bundles for large root surfaces, unreachable skills, deprecated routes, and repeated product context.
637
+ - Document how coding agents can use the bundles to prepare reviewable patches.
638
+
639
+ Acceptance criteria:
640
+
641
+ - Suggestions are deterministic and do not modify files.
642
+ - Every suggested route cites exact repository evidence.
643
+ - A human can reject or edit suggestions without affecting core validation.
644
+ - No external LLM is required.
645
+
646
+ ## Backward Compatibility and Rollout
647
+
648
+ The rollout should be incremental.
649
+
650
+ ### Adoption stage 1: inspect only
651
+
652
+ Users run the new report against the existing repository:
653
+
654
+ ```bash
655
+ renma skill-index . --format markdown
656
+ ```
657
+
658
+ No files move. No metadata is required. Existing exact links provide initial route evidence.
659
+
660
+ ### Adoption stage 2: clarify crowded areas
661
+
662
+ Maintainers add `routes_to`, aliases, or explicit entrypoint metadata only to ambiguous or high-volume areas.
663
+
664
+ A repository may improve `test-case-generation/SKILL.md` without changing unrelated skills.
665
+
666
+ ### Adoption stage 3: stabilize product context
667
+
668
+ Maintainers and coding agents move durable product behavior out of team-only instructions when semantic review confirms that it should outlive the current owner.
669
+
670
+ The original team-specific material may remain when it records a genuinely team-specific process or lens.
671
+
672
+ ### Adoption stage 4: enable CI gating
673
+
674
+ Repositories opt into failure thresholds for exact discovery problems such as unresolved routes or deprecated routed skills. Scale and quality advisories remain warnings until local policy says otherwise.
675
+
676
+ ## Testing Strategy
677
+
678
+ Tests should follow current Renma patterns and use deterministic fixtures.
679
+
680
+ Required coverage:
681
+
682
+ - Metadata parsing for route lists, aliases, and explicit entrypoints.
683
+ - Exact skill ID and path resolution.
684
+ - Observed local skill links.
685
+ - Missing and non-skill targets.
686
+ - Deprecated and archived targets.
687
+ - Route cycles.
688
+ - Root inference and explicit roots.
689
+ - Standalone and unreachable skills.
690
+ - Duplicate aliases.
691
+ - Category-first, product-first, team-first, and direct-leaf graphs.
692
+ - Product contexts shared by multiple owners.
693
+ - Owner changes with stable product context.
694
+ - JSON snapshot stability.
695
+ - Markdown table escaping.
696
+ - Mermaid escaping and cycle safety.
697
+ - More than 100 generated fixture skills to verify bounded output and acceptable performance.
698
+ - No changes to existing command outputs unless additive discovery fields are explicitly introduced.
699
+
700
+ ## Non-Goals
701
+
702
+ The following remain out of scope:
703
+
704
+ - Accepting a live user task and choosing a skill.
705
+ - Ranking skills with embeddings, fuzzy search, or an LLM.
706
+ - Prompt assembly or context bundling.
707
+ - Loading or injecting the selected skill into an agent.
708
+ - Agent execution or tool orchestration.
709
+ - Runtime telemetry collection.
710
+ - Automatically moving or rewriting `SKILL.md` files.
711
+ - Requiring category, product, team, or workflow directories.
712
+ - Requiring all skills to declare new metadata.
713
+ - Replacing source `SKILL.md`, lens, or context content with generated index prose.
714
+ - Multi-repository package synchronization in the initial implementation.
715
+ - A hosted discovery dashboard.
716
+
717
+ ## Success Criteria
718
+
719
+ This direction is successful when:
720
+
721
+ 1. Existing Renma users can adopt it after skill growth without a repository restructure.
722
+ 2. Existing layered `SKILL.md` routing becomes visible and validated.
723
+ 3. A first-hop index remains usable with 100 or more skills and many teams.
724
+ 4. Broad tasks lead agents to stable entrypoint skills, while specific tasks can still reach concrete leaf skills directly.
725
+ 5. Category, product, team, and workflow ordering can vary without breaking the model.
726
+ 6. Durable product context remains stable when ownership changes.
727
+ 7. Context and lens reuse remain visible and are not overshadowed by discovery metadata.
728
+ 8. Humans can review compact Markdown, semantic diff, diagnostics, and Mermaid views.
729
+ 9. Core outputs remain deterministic and useful without an LLM.
730
+ 10. Renma remains a repository governance layer, not a runtime skill selector.
731
+
732
+ The governing principle remains:
733
+
734
+ ```text
735
+ Existing structure is preserved.
736
+ Routing becomes explicit and reviewable.
737
+ Product knowledge remains durable.
738
+ Generated indexes remain projections.
739
+ Renma verifies; it does not select at runtime.
740
+ ```