skillwiki 0.10.111 → 0.10.113

package/dist/{index-projection-2K672CBO.js → index-projection-RQSOEDXM.js}

@@ -4,11 +4,11 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-MRPJ7X7W.js";
-import "./chunk-I6IRJCUJ.js";
-import "./chunk-X5GL2FCU.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+} from "./chunk-IJWZDQDH.js";
+import "./chunk-3TKNAOJH.js";
+import "./chunk-JL2SCLXT.js";
+import "./chunk-6VUK2FTX.js";
+import "./chunk-VNSZCK5V.js";
 export {
   UNMANAGED_END,
   UNMANAGED_START,

package/dist/{journal-QU5IDXQF.js → journal-V5XHBEI5.js}

@@ -3,9 +3,9 @@ import {
   readJournal,
   upsertJournal,
   writeJournal
-} from "./chunk-KWEYA3OE.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+} from "./chunk-SEY4N4CT.js";
+import "./chunk-6VUK2FTX.js";
+import "./chunk-VNSZCK5V.js";
 export {
   readJournal,
   upsertJournal,

package/dist/{managed-write-preflight-GRSHQYKC.js → managed-write-preflight-2BMHZWVJ.js}

@@ -6,13 +6,13 @@ import {
   runManagedWritePeerGate,
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-HBJLFPQP.js";
-import "./chunk-5IBLXGLY.js";
-import "./chunk-I6IRJCUJ.js";
-import "./chunk-X5GL2FCU.js";
-import "./chunk-PYPPG7RF.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+} from "./chunk-FQERKMD7.js";
+import "./chunk-K3YZESND.js";
+import "./chunk-3TKNAOJH.js";
+import "./chunk-JL2SCLXT.js";
+import "./chunk-6VUK2FTX.js";
+import "./chunk-IJKJGQKL.js";
+import "./chunk-VNSZCK5V.js";
 export {
   DEFAULT_MANAGED_WRITE_WAIT_MS,
   MANAGED_WRITE_POLL_INTERVAL_MS,

package/dist/mcp-auth-env-QONKW4EO.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import {
+  MCP_HOST_ID_ENV,
+  MCP_TOKEN_ENV,
+  MCP_URL_ENV,
+  isMcpOnlyLeaf,
+  mcpAuthFromEnv,
+  mergeMcpAuthIntoEnv,
+  nonEmptyEnvValue,
+  redactMcpSecret,
+  resolveMcpAuthEnv
+} from "./chunk-OGEAFXON.js";
+import "./chunk-IJKJGQKL.js";
+import "./chunk-VNSZCK5V.js";
+export {
+  MCP_HOST_ID_ENV,
+  MCP_TOKEN_ENV,
+  MCP_URL_ENV,
+  isMcpOnlyLeaf,
+  mcpAuthFromEnv,
+  mergeMcpAuthIntoEnv,
+  nonEmptyEnvValue,
+  redactMcpSecret,
+  resolveMcpAuthEnv
+};

package/dist/{migrate-PIB4QA54.js → migrate-SRRCXI2K.js}

@@ -6,11 +6,12 @@ import {
   refreshInstalledClipPlist,
   stableCliBinary,
   xml
-} from "./chunk-TDBUJUYH.js";
-import "./chunk-6OQLBNKR.js";
-import "./chunk-PYPPG7RF.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+} from "./chunk-XJ5VEIH7.js";
+import "./chunk-6VUK2FTX.js";
+import "./chunk-OWWWO2XS.js";
+import "./chunk-5D5HFQ76.js";
+import "./chunk-IJKJGQKL.js";
+import "./chunk-VNSZCK5V.js";
 export {
   CLIP_MIGRATION_HINT,
   migrateClipOutbox,

package/dist/mirror-H5BTBAON.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+import {
+  writeRegularExclusive
+} from "./chunk-K3M6OSUW.js";
+import {
+  parseDestination
+} from "./chunk-ZRGZBAVS.js";
+import "./chunk-QESNTTVY.js";
+
+// src/clip-outbox/mirror.ts
+import { mkdir, rmdir } from "fs/promises";
+import { dirname, join } from "path";
+import { GetObjectCommand } from "@aws-sdk/client-s3";
+var ADMIT = /^raw\/(articles|assets)\/[A-Za-z0-9._/-]+$/;
+function admitMirrorPath(path) {
+  return ADMIT.test(path) && !path.split("/").some((part) => part === ".." || part === "." || !part);
+}
+function orderMirrorPaths(paths) {
+  const unique = [...new Set(paths.filter(admitMirrorPath))];
+  return [...unique.filter((path) => path.startsWith("raw/assets/")), ...unique.filter((path) => path.startsWith("raw/articles/"))];
+}
+function eventsUrlFromMcp(mcpUrl) {
+  const url = new URL(mcpUrl);
+  url.pathname = "/events";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function wikiFetchPullLockDir(home) {
+  return join(home, "Library", "Caches", "vault-sync", "wiki-fetch", "pull.lock.d");
+}
+async function acquireWikiFetchPullLock(home) {
+  const lockDir = wikiFetchPullLockDir(home);
+  await mkdir(dirname(lockDir), { recursive: true });
+  try {
+    await mkdir(lockDir);
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
+  }
+  return async () => {
+    await rmdir(lockDir).catch(() => void 0);
+  };
+}
+function parseChangedSseBlock(block) {
+  let event = "message";
+  let data = "";
+  for (const line of block.split(/\r?\n/)) {
+    if (line.startsWith("event:")) event = line.slice(6).trim();
+    else if (line.startsWith("data:")) data += line.slice(5).trimStart();
+  }
+  if (event !== "changed" || !data) return null;
+  try {
+    const parsed = JSON.parse(data);
+    if (parsed.vault_id !== "central" || !Array.isArray(parsed.paths)) return null;
+    return { vault_id: "central", paths: parsed.paths.filter((path) => typeof path === "string") };
+  } catch {
+    return null;
+  }
+}
+async function applyMirrorPaths(opts) {
+  const ordered = orderMirrorPaths(opts.paths);
+  const release = await opts.lock();
+  if (!release) return { copied: [], skipped: ordered };
+  try {
+    const copied = [];
+    const skipped = [];
+    for (const rel of ordered) {
+      const body = await opts.getObject(rel);
+      if (!body) {
+        skipped.push(rel);
+        continue;
+      }
+      const result = await opts.write(rel, body);
+      if (result === "conflict") skipped.push(rel);
+      else copied.push(rel);
+    }
+    return { copied, skipped };
+  } finally {
+    await release();
+  }
+}
+function createS3GetObject(opts) {
+  const prefix = opts.prefix ?? "";
+  const resolveKey = (rel) => [prefix, rel].filter(Boolean).join("/");
+  return async (key) => {
+    if (!admitMirrorPath(key)) return null;
+    try {
+      const response = await opts.client.send(new GetObjectCommand({ Bucket: opts.bucket, Key: resolveKey(key) }));
+      if (!response.Body) return null;
+      const bytes = Buffer.from(await response.Body.transformToByteArray());
+      return bytes.length > opts.maxBytes ? null : bytes;
+    } catch (error) {
+      const status = error.$metadata?.httpStatusCode;
+      if (status === 404 || error.name === "NoSuchKey") return null;
+      throw error;
+    }
+  };
+}
+async function startMirrorListener(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const write = (rel, body) => writeRegularExclusive(input.config.mirrorRoot, rel, body);
+  const lock = input.lock ?? (() => acquireWikiFetchPullLock(input.home));
+  let delayMs = 1e3;
+  while (!input.signal.aborted) {
+    try {
+      const response = await fetchImpl(input.eventsUrl, {
+        headers: { Authorization: `Bearer ${input.mcpToken}`, Accept: "text/event-stream" },
+        signal: input.signal
+      });
+      if (!response.ok || !response.body) throw new Error("sse unavailable");
+      delayMs = 1e3;
+      let buffer = "";
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      while (!input.signal.aborted) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true }).replaceAll("\r\n", "\n");
+        let split;
+        while ((split = buffer.indexOf("\n\n")) >= 0) {
+          const block = buffer.slice(0, split);
+          buffer = buffer.slice(split + 2);
+          const changed = parseChangedSseBlock(block);
+          if (!changed) continue;
+          await applyMirrorPaths({ paths: changed.paths, getObject: input.getObject, write, lock });
+        }
+      }
+    } catch (error) {
+      if (input.signal.aborted) return;
+      if (error.name === "AbortError") return;
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+      delayMs = Math.min(delayMs * 2, 3e4);
+    }
+  }
+}
+function parseDestinationForMirror(destination) {
+  return parseDestination(destination);
+}
+export {
+  acquireWikiFetchPullLock,
+  admitMirrorPath,
+  applyMirrorPaths,
+  createS3GetObject,
+  eventsUrlFromMcp,
+  orderMirrorPaths,
+  parseChangedSseBlock,
+  parseDestinationForMirror,
+  startMirrorListener,
+  wikiFetchPullLockDir
+};

package/dist/runtime-LQZIG3XN.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import {
+  assertClipS3Endpoint,
+  conditionalCreateProven,
+  evidencePath,
+  isRfc1918OrLoopback,
+  loadClipCredentials,
+  validateRuntime
+} from "./chunk-OWWWO2XS.js";
+import "./chunk-5D5HFQ76.js";
+import "./chunk-IJKJGQKL.js";
+import "./chunk-VNSZCK5V.js";
+export {
+  assertClipS3Endpoint,
+  conditionalCreateProven,
+  evidencePath,
+  isRfc1918OrLoopback,
+  loadClipCredentials,
+  validateRuntime
+};

package/dist/skillwiki-mcp.js

@@ -1,19 +1,21 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-OJJBZDPR.js";
-import "./chunk-JQV5KNPT.js";
+} from "./chunk-5RHR4FEK.js";
+import "./chunk-CBT35FAW.js";
 import "./chunk-7I2TPIV5.js";
-import "./chunk-MRPJ7X7W.js";
-import "./chunk-HBJLFPQP.js";
-import "./chunk-5IBLXGLY.js";
-import "./chunk-I6IRJCUJ.js";
-import "./chunk-X5GL2FCU.js";
-import "./chunk-TDBUJUYH.js";
-import "./chunk-6OQLBNKR.js";
-import "./chunk-PYPPG7RF.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+import "./chunk-IJWZDQDH.js";
+import "./chunk-FQERKMD7.js";
+import "./chunk-K3YZESND.js";
+import "./chunk-3TKNAOJH.js";
+import "./chunk-JL2SCLXT.js";
+import "./chunk-OGEAFXON.js";
+import "./chunk-XJ5VEIH7.js";
+import "./chunk-6VUK2FTX.js";
+import "./chunk-OWWWO2XS.js";
+import "./chunk-5D5HFQ76.js";
+import "./chunk-IJKJGQKL.js";
+import "./chunk-VNSZCK5V.js";
 
 // src/mcp-entry.ts
 runSkillwikiMcpStdio().catch((error) => {

package/dist/sources-E6KHDRDE.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import {
+  runSourcesPending
+} from "./chunk-CBT35FAW.js";
+import "./chunk-K3YZESND.js";
+import "./chunk-JL2SCLXT.js";
+import "./chunk-VNSZCK5V.js";
+export {
+  runSourcesPending
+};

package/dist/{watcher-MHG46J3R.js → watcher-VJ3TOU6J.js}

@@ -1,35 +1,35 @@
 #!/usr/bin/env node
 import {
-  sha256Hex
-} from "./chunk-ZRGZBAVS.js";
+  readJournal,
+  upsertJournal,
+  writeJournal
+} from "./chunk-SEY4N4CT.js";
 import {
   buildReadyHint
 } from "./chunk-OSL4J7GF.js";
 import {
-  runFetchGuardSync
-} from "./chunk-I2J3IJB7.js";
-import "./chunk-QESNTTVY.js";
+  readRegular
+} from "./chunk-K3M6OSUW.js";
 import {
-  readJournal,
-  upsertJournal,
-  writeJournal
-} from "./chunk-KWEYA3OE.js";
-import "./chunk-GQWCTJTU.js";
+  sha256Hex
+} from "./chunk-ZRGZBAVS.js";
+import "./chunk-QESNTTVY.js";
+import "./chunk-6VUK2FTX.js";
 import {
-  ipv4InCidr,
-  isBlockedHost
-} from "./chunk-UIEQIJXP.js";
+  assertPublicHttpsUrl
+} from "./chunk-5D5HFQ76.js";
+import "./chunk-VNSZCK5V.js";
 
 // src/clip-outbox/watcher.ts
 import { createRequire } from "module";
 import { randomBytes as randomBytes2 } from "crypto";
 import { mkdir as mkdir2, readdir, rmdir, unlink, writeFile } from "fs/promises";
-import { basename, join as join2, resolve as resolve3 } from "path";
+import { basename, join as join2, resolve as resolve2 } from "path";
 
 // src/clip-outbox/seal.ts
 import { randomBytes } from "crypto";
-import { mkdir, open as open2 } from "fs/promises";
-import { dirname, join, relative as relative3 } from "path";
+import { mkdir, open } from "fs/promises";
+import { dirname, join, relative as relative2 } from "path";
 import yaml from "js-yaml";
 
 // src/clip-outbox/localize.ts
@@ -108,60 +108,6 @@ function localAssetRelPath(target) {
   return void 0;
 }
 
-// src/clip-outbox/ssrf.ts
-import { isIP } from "net";
-import { lookup as dnsLookup } from "dns/promises";
-var extraBlockedV4 = [
-  ["0.0.0.0", 8],
-  ["100.64.0.0", 10],
-  ["192.0.2.0", 24],
-  ["198.18.0.0", 15],
-  ["198.51.100.0", 24],
-  ["203.0.113.0", 24],
-  ["224.0.0.0", 4],
-  ["240.0.0.0", 4]
-];
-function isBlockedAddress(address) {
-  if (isBlockedHost(address)) return true;
-  const version = isIP(address);
-  if (version === 4) {
-    return extraBlockedV4.some(([base, prefix]) => ipv4InCidr(address, base, prefix));
-  }
-  if (version === 6) {
-    const lower = address.toLowerCase();
-    return lower === "::" || lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
-  }
-  return false;
-}
-async function assertPublicHttpsUrl(url, lookup = defaultLookup) {
-  const guard = runFetchGuardSync({ url });
-  if (!guard.result.ok) {
-    return { ok: false, reason: guard.result.error };
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return { ok: false, reason: "MALFORMED_URL" };
-  }
-  if (isBlockedAddress(parsed.hostname)) {
-    return { ok: false, reason: "HOST_BLOCKED" };
-  }
-  try {
-    const addresses = await lookup(parsed.hostname);
-    if (addresses.length === 0) return { ok: false, reason: "DNS_EMPTY" };
-    if (addresses.some(isBlockedAddress)) return { ok: false, reason: "HOST_BLOCKED" };
-  } catch {
-    return { ok: false, reason: "DNS_FAILED" };
-  }
-  return { ok: true, href: parsed.href };
-}
-async function defaultLookup(hostname) {
-  if (isIP(hostname)) return [hostname];
-  const v4 = await dnsLookup(hostname, { all: true, verbatim: true });
-  return v4.map((row) => row.address);
-}
-
 // src/clip-outbox/localize.ts
 var LocalizeError = class extends Error {
   constructor(message, code = "LOCALIZE_HELD") {
@@ -279,42 +225,6 @@ async function downloadImage(href, config, fetchImpl, lookup) {
   throw new LocalizeError("too many redirects");
 }
 
-// src/clip-outbox/files.ts
-import { constants } from "fs";
-import { lstat, open, realpath } from "fs/promises";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "path";
-async function readRegular(root, path, maxBytes) {
-  const rel = relative2(root, path);
-  if (!rel || rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute2(rel)) throw new Error("unsafe input path");
-  let current = resolve2(root);
-  for (const part of ["", ...rel.split(sep)]) {
-    current = resolve2(current, part);
-    const st = await lstat(current);
-    if (st.isSymbolicLink()) throw new Error("symlink input refused");
-    if (current !== path && !st.isDirectory()) throw new Error("invalid input parent");
-  }
-  const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-  try {
-    const before = await handle.stat();
-    if (!before.isFile() || before.size > maxBytes) throw new Error("input type or size refused");
-    const bytes = Buffer.alloc(before.size + 1);
-    let bytesRead = 0;
-    while (bytesRead < bytes.length) {
-      const chunk = await handle.read(bytes, bytesRead, bytes.length - bytesRead, bytesRead);
-      if (chunk.bytesRead === 0) break;
-      bytesRead += chunk.bytesRead;
-    }
-    const after = await handle.stat();
-    if (await realpath(path) !== path) throw new Error("input path changed during read");
-    const leaf = await lstat(path);
-    if (leaf.ino !== before.ino || leaf.dev !== before.dev) throw new Error("input identity changed during read");
-    if (bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) throw new Error("input changed during read");
-    return bytes.subarray(0, bytesRead);
-  } finally {
-    await handle.close();
-  }
-}
-
 // src/clip-outbox/seal.ts
 var UnstableCapture = class extends Error {
 };
@@ -325,7 +235,7 @@ function snapshotPath(config, entry, key) {
 }
 async function durableFile(root, path, bytes) {
   await mkdir(dirname(path), { recursive: true, mode: 448 });
-  const f = await open2(path, "wx", 384);
+  const f = await open(path, "wx", 384);
   try {
     await f.writeFile(bytes);
     await f.sync();
@@ -334,7 +244,7 @@ async function durableFile(root, path, bytes) {
   }
   let dir = dirname(path);
   while (true) {
-    const handle = await open2(dir, "r");
+    const handle = await open(dir, "r");
     try {
       await handle.sync();
     } finally {
@@ -383,7 +293,7 @@ async function sealCapture(config, entry, deps = {}) {
   return { ...entry, sourceSha256: sha256Hex(article), assetKeys: [...objects.keys()].filter((k) => k !== entry.articleKey), sha256: Object.fromEntries([...objects].map(([k, b]) => [k, sha256Hex(b)])), sizes: Object.fromEntries([...objects].map(([k, b]) => [k, b.length])), receipts: {}, state: "sealed", reason: void 0, attempts: 0, retryAt: void 0, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 function admittedArticle(root, path) {
-  const rel = relative3(root, path).replaceAll("\\", "/");
+  const rel = relative2(root, path).replaceAll("\\", "/");
   if (!rel.startsWith("raw/articles/") || !rel.endsWith(".md")) return false;
   return rel.split("/").every((part) => part !== "." && part !== ".." && !part.startsWith(".") && !/[\x00-\x1f]/.test(part) && !part.endsWith("~"));
 }
@@ -580,7 +490,7 @@ async function startClipWorker(config, deps) {
         requestScan();
         return;
       }
-      const absolute = resolve3(path);
+      const absolute = resolve2(path);
       if (admittedArticle(config.root, absolute)) schedule(absolute);
       else if (absolute.startsWith(join2(config.root, "raw/assets") + "/")) {
         for (const entry of entries) if (!entry.sourceSha256 && entry.source) schedule(entry.source);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.111",
+  "version": "0.10.113",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.111",
+  "version": "0.10.113",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 22 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp, skillwiki-connect) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.111",
+  "version": "0.10.113",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 22 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.111",
+  "version": "0.10.113",
   "description": "Project-aware Karpathy-style knowledge base: 22 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp, skillwiki-connect) backed by HTTP MCP wiki_capture.",
   "author": {
     "name": "karlorz"

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.10.111",
+  "version": "0.10.113",
   "private": true,
   "files": [
     "wiki-*",

package/skills/skills/using-skillwiki/SKILL.md

@@ -183,7 +183,7 @@ If the vault has `.WIKI_GIT_FROZEN`:
 ## Skill Map
 | Skill | When to Invoke |
 |-------|----------------|
-| `wiki-init` | Bootstrap a vault and install `_Templates/web-clipper/llm-wiki-clippings.json` plus import guidance. File-level clips use a dedicated `~/Obsidian/clip-outbox` vault, not `~/wiki`; `skillwiki doctor` reports clip-channel rows; `wiki_capture` is not clip ingress. |
+| `wiki-init` | Bootstrap a vault and install `_Templates/web-clipper/llm-wiki-clippings.json` plus import guidance. File-level clips use a dedicated `~/Obsidian/clip-outbox` vault, not `~/wiki`; `skillwiki doctor` reports clip-channel rows including the inbound `com.karlchow.skillwiki-mirror-sse` listener, which upgrades never auto-load; `wiki_capture` is not clip ingress. |
 | `wiki-ingest` | Convert URLs, files, or pasted text into typed-knowledge pages |
 | `wiki-query` | Search typed knowledge by default; work-queue / doctor / MCP diagnose questions use `wiki_context` or `--scope work` / `--scope all`; explicitly requested fresh/raw evidence uses the separate pending channel |
 | `wiki-lint` | Vault health and lint checks; use `health` for whole-system reports and `lint --summary` for bounded lint buckets |

package/skills/skills/wiki-ingest/SKILL.md

@@ -42,6 +42,53 @@ Run `skillwiki lang` at the start. Generate page-body prose, narrative sections,
    5. `skillwiki sources compile published <raw-path> [vault] --pages "<typed/a.md,typed/b.md>" --reason "<why>"` then `--write --approve <token>`
    6. Leave the review `open` unless the human resolves it with `skillwiki sources review <raw-path> --status accepted|needs-fix|dismissed --reason "<why>"`
    Goal, satellite, and headless sessions may list pending / compile status / reviews but must not claim or publish compile turns.
+## Output standard v2
+`skillwiki ingest` stamps `output_standard: v2` on every new typed stub. v2 is an authoring contract. CLI lint reports advisory warnings on marked pages only. Publish, health, and lint exit stay unchanged by these checks.
+
+### Rung 1 — STE-80 (default)
+STE is Simplified Technical English.
+- Use at most 20 words for each instruction. Use at most 25 words for each description.
+- One topic per paragraph. Each paragraph <= 6 sentences.
+- One word, one meaning. Prefer simple verbs: use, start, stop, find, check.
+- Keep technical terms (API, cache, Docker). Define each term once at first use.
+- No hedges except in `## Uncertainty`. Never drop facts to shorten.
+- Hedge list: might, may, perhaps, possibly, probably, likely, seems, appears to, arguably, somewhat, could be.
+- Use `## Uncertainty` only for uncertainty the source itself reports. If the source reports none, omit the section or write "The source reports no open uncertainty."
+
+### Rung 2 — diagrams (default when content has structure)
+Add one Mermaid diagram when the page has flow, components, timeline, hierarchy, or comparison. Keep a text summary beside the diagram. Directly after the diagram, add `**Least certain:**` and a bullet list of labels or edges.
+
+The `**Least certain:**` bullets name diagram labels or edges. State why that part of the diagram is the least certain representation. Use one of these reasons: an interpretive grouping, a simplified step, an omitted condition, or a mapping the source does not state directly.
+
+Never add doubt about a fact the source states as settled. Never turn a decision, constraint, or policy into an open question.
+
+If a diagram has fewer than 3 labels and edges in total, list all of them. Otherwise list the 3 least-certain labels or edges.
+
+A diagram must not present a shortened executable procedure. For safety or recovery flows, keep all required steps or point the node to the full text procedure.
+
+### Rung 3 — HTML (opt-in)
+Set `html_render: true` by hand or with `skillwiki ingest --html`. Render outside the vault:
+
+```bash
+skillwiki page render-html <page> [vault] --out <file>
+```
+
+HTML is always opt-in. The renderer writes one self-contained file (TOC, tabs per H2, `<details>`, inline CSS and JS). Mermaid stays as readable source. No network fetch.
+
+### Rung 4 — video
+Explainer video is out of scope. Use STE text plus a diagram.
+
+### Format table
+
+| Content type | Format | Rung | Policy |
+| --- | --- | --- | --- |
+| Exact procedure (re-read later) | STE text | 1 | default |
+| Relationships (structure / flow / hierarchy) | Mermaid diagram + text | 2 | default |
+| Comparison / hands-on exploration | HTML interactive page | 3 | opt-in; otherwise STE + table or diagram |
+| Concept from zero | Explainer video | 4 | out of scope; use STE + diagram |
+
+Rules: formats stack; HTML is always opt-in; video is outside the current scope.
+
 ## Provenance defaults
 - Default `provenance: research`.
 - If cwd is inside `projects/{slug}/`, set `provenance: project` and add `provenance_projects: ["[[slug]]"]`.

package/skills/skills/wiki-init/SKILL.md

@@ -41,6 +41,9 @@ None for the first run.
    worker localizes required v1 HTTPS images before freeze, writes
    `![[raw/assets/...]]` embeds, and uploads `raw/assets/<capture-id>/note.md`.
    `wiki_capture` is not clip ingress. Never use `.txt` as the only index.
+   The inbound production SSE listener is a separate attended
+   `skillwiki clip-outbox install-or-migrate --load-mirror` job; package
+   upgrade never auto-loads it and never watches `~/wiki` as clip input.
 8. **Suggest first sources.** Propose 3–5 initial sources (URLs, papers, articles) appropriate to the domain. Prompt the user to provide the first one to ingest, then hand off to wiki-ingest.
 
 ## Stop conditions

package/skills/skills/wiki-lint/SKILL.md

@@ -19,6 +19,13 @@ Standard four reads.
 6. If `log_rotate_needed` is present and the user consents, run `skillwiki log-rotate <vault> --apply`. Otherwise leave alone.
 7. **Post-migration verification**: If the user recently migrated **vault content** (e.g., moved entity/concept pages to another vault), re-run `skillwiki lint <vault> --summary` and verify that broken_wikilinks count decreased. Remaining broken links for migrated content indicate pages still referencing the moved files — these should be cleaned up (remove citations or migrate the referencing pages too). This step is content moves only — not HTTP MCP client/plugin upgrades (those use `skillwiki doctor --check-mcp`).
 8. Append a `log.md` entry summarizing lint counts only when the user asked to record the maintenance result. Do not log routine `health` reports by default.
+## Output standard v2 WARN buckets
+These four buckets apply only to typed pages whose frontmatter has `output_standard: v2`. They are advisory WARN findings. They do not change the lint exit code, publish, health exit, or release CI on content.
+- `ste_sentence_length`: prose sentences > 25 words; ordered-list items and list items under Steps/Procedure headings > 20 words.
+- `ste_hedge_words`: whole-word hedges outside `## Uncertainty`, outside the `**Least certain:**` list, and outside code and blockquotes.
+- `ste_diagram_uncertainty`: a Mermaid block with no `**Least certain:**` bullet list after it.
+- `ste_comparison_visual`: a `type: comparison` page with neither a Markdown table nor a Mermaid block.
+Drill with `skillwiki lint <vault> --only <bucket>`.
 ## Stop conditions
 None — lint reports all findings even on per-page errors.
 ## Forbidden

package/skills/using-skillwiki/SKILL.md

@@ -183,7 +183,7 @@ If the vault has `.WIKI_GIT_FROZEN`:
 ## Skill Map
 | Skill | When to Invoke |
 |-------|----------------|
-| `wiki-init` | Bootstrap a vault and install `_Templates/web-clipper/llm-wiki-clippings.json` plus import guidance. File-level clips use a dedicated `~/Obsidian/clip-outbox` vault, not `~/wiki`; `skillwiki doctor` reports clip-channel rows; `wiki_capture` is not clip ingress. |
+| `wiki-init` | Bootstrap a vault and install `_Templates/web-clipper/llm-wiki-clippings.json` plus import guidance. File-level clips use a dedicated `~/Obsidian/clip-outbox` vault, not `~/wiki`; `skillwiki doctor` reports clip-channel rows including the inbound `com.karlchow.skillwiki-mirror-sse` listener, which upgrades never auto-load; `wiki_capture` is not clip ingress. |
 | `wiki-ingest` | Convert URLs, files, or pasted text into typed-knowledge pages |
 | `wiki-query` | Search typed knowledge by default; work-queue / doctor / MCP diagnose questions use `wiki_context` or `--scope work` / `--scope all`; explicitly requested fresh/raw evidence uses the separate pending channel |
 | `wiki-lint` | Vault health and lint checks; use `health` for whole-system reports and `lint --summary` for bounded lint buckets |