replen 1.0.17 → 1.0.19

package/extras/skills/replen/SKILL.md

@@ -5,11 +5,12 @@ description: Review Replen's suggestions for the current repo against your code.
 
 # Replen Match — in-session candidate triage
 
-You are running the matching loop locally. Replen has fetched a list of
-plausible OSS candidates from the wider ecosystem; you've got the user's
-codebase open. Your job is to decide which (if any) are worth their
-attention, write up the strong ones, and capture what they want to do
-about them.
+You are running the matching loop locally. Replen's **Watchtower** — its
+maintained network of ~1,250 sources (vendor changelogs, advisories, pricing
+pages, release feeds, standards trackers, EOL calendars) — has fetched a list
+of plausible OSS candidates and events; you've got the user's codebase open.
+Your job is to decide which (if any) are worth their attention, write up the
+strong ones, and capture what they want to do about them.
 
 **This runs entirely on the user's subscription tokens.** No API keys
 get used. Replen's hosted side did the cheap structural filtering; you
@@ -308,6 +309,12 @@ any write back to Replen. Don't hand-roll `curl` to the API for these; the MCP
 path is the intended mechanism and avoids tripping host permission classifiers
 on the candidate repo name in a curl payload.
 
+**Never record a bare verdict.** Every `replen_record_triage` call — including
+quick skips made outside this full protocol (e.g. from the session-start
+footnote) — must carry at least `oneLine` and `cosine`. A verdict with no
+reasoning shows up in the user's Atlas dossier and vault as "bare verdict —
+the agent recorded no reasoning", which is a bug report with your name on it.
+
 When you call `replen_record_triage`, **pass the contextual fields** so Replen
 learns: `matchedFacet` (copy the `matchedFacet` from the candidate's
 replen_match data), `facetModality` (the data modality of that capability —

package/extras/skills/replen-onboard/SKILL.md

@@ -71,13 +71,37 @@ Replen — a re-run backfills versions across every repo in minutes.
 
 For each in-scope repo, do this contract:
 
+### 2a-pre. Check for an existing knowledge graph FIRST (the adapter step)
+
+Replen doesn't map code internals — it ingests whatever already does. Before
+reading raw source, look for pre-digested knowledge and use it as your primary
+grounding source (faster AND richer than a cold code-read):
+
+- **Graphify vault** — an Obsidian-compatible markdown vault with frontmatter
+  + `[[wikilinks]]` + EXTRACTED/INFERRED/AMBIGUOUS-style provenance tags
+  (commonly in-repo as `graph/`, `vault/`, `.graphify/`, or alongside the
+  repo). Its entity/concept notes ARE the capability map: distill capabilities
+  from them, take descriptors from the note bodies, and use the files each
+  note links as the capability's `paths` evidence anchors.
+- **Plain Obsidian vault / docs vault** — same treatment, lower confidence.
+- **ADRs** (`docs/adr/*.md`, `doc/decisions/`) — architecture decisions are
+  high-grade descriptor material and often name the load-bearing files.
+
+If you ground from one of these, START the report (2c) with one line:
+`Grounding source: Graphify vault at <path>` (or `Obsidian vault…` / `ADRs…`)
+— it renders into the user's Atlas vault, linking the two tools. Then skim the
+code only to VERIFY (the vault may be stale); don't re-derive what it already
+holds. Privacy is unchanged: only capabilities/descriptors/paths/tags leave
+the machine, exactly as with a code-read — never vault content or code.
+
 ### 2a. Read the code (not just the README)
 
 Read enough source to actually understand the project: entry points, the core
 modules, manifests (`package.json`/`pyproject.toml`/`Cargo.toml`/`go.mod`),
 configs, schemas, and the files that implement its real work (the model/algo/
 pipeline files, not the glue). This is what makes the grounding accurate — a
-doc paraphrase is not enough.
+doc paraphrase is not enough. (Skip the deep read when 2a-pre found a fresh
+knowledge graph — verify instead.)
 
 ### 2b. Assess doc quality → `good` | `thin` | `none`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {