boost-skill-cli 1.0.143__tar.gz → 1.0.145__tar.gz

{boost_skill_cli-1.0.143 → boost_skill_cli-1.0.145}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.143
+Version: 1.0.145
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.143 → boost_skill_cli-1.0.145}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.143'
-__version_tuple__ = version_tuple = (1, 0, 143)
+__version__ = version = '1.0.145'
+__version_tuple__ = version_tuple = (1, 0, 145)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.143 → boost_skill_cli-1.0.145}/boost_cli/core/serve.py

@@ -14,6 +14,7 @@ import json
 import re
 import urllib.parse
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
 from typing import Optional, Tuple
 
 from .. import __version__
@@ -68,7 +69,10 @@ def _safe_join_within(base, rel):
     """Resolve base/rel and return it only when contained within base."""
     try:
         base_r = base.resolve(strict=False)
-        candidate = (base_r / rel).resolve(strict=False)
+        rel_p = rel if hasattr(rel, "is_absolute") else __import__("pathlib").Path(rel)
+        if rel_p.is_absolute():
+            return None
+        candidate = (base_r / rel_p).resolve(strict=False)
         candidate.relative_to(base_r)
     except (OSError, ValueError, TypeError):
         return None
@@ -80,8 +84,8 @@ def skill_text(name: str) -> Optional[str]:
     if not SKILL_NAME_RE.fullmatch(name):
         return None
     base = store.skill_store_dir(name)
-    fp = base / "SKILL.md"
-    if _is_within(base, fp) and fp.is_file():
+    fp = _safe_join_within(base, Path("SKILL.md"))
+    if fp is not None and fp.is_file():
         return fp.read_text(encoding="utf-8", errors="replace")
     for e in catalog.find(name):
         try:

{boost_skill_cli-1.0.143 → boost_skill_cli-1.0.145}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.143
+Version: 1.0.145
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.143 → boost_skill_cli-1.0.145}/boost_skill_cli.egg-info/SOURCES.txt

@@ -138,6 +138,7 @@ docs/roadmap/items/framework-adapter-multi-agent.md
 docs/roadmap/items/framework-adapters-boost-adapt.md
 docs/roadmap/items/frontmatter-scalar-over-coercion.md
 docs/roadmap/items/github-pages-deploy-is-broken-every-push.md
+docs/roadmap/items/golden-set-statistical-power.md
 docs/roadmap/items/hash-pinned-reproducible-toolchain-uv-lock.md
 docs/roadmap/items/html-validation-html-validate.md
 docs/roadmap/items/integrity-verification-boost-verify.md
@@ -173,6 +174,7 @@ docs/roadmap/items/property-based-tests-hypothesis-on-the-parsers.md
 docs/roadmap/items/prose-and-terminology-linting-vale.md
 docs/roadmap/items/prune-ignored-dirs-during-scan-dir-walk.md
 docs/roadmap/items/quality-dashboard-sonarcloud-free-for-oss.md
+docs/roadmap/items/ranx-significance-monitor.md
 docs/roadmap/items/reconcile-the-theme-drift.md
 docs/roadmap/items/refresh-the-marketing-surface.md
 docs/roadmap/items/retrieval-quality-eval-harness.md
@@ -180,6 +182,7 @@ docs/roadmap/items/reuse-helpers-kill-minor-dead-work.md
 docs/roadmap/items/robust-tag-argument-parsing.md
 docs/roadmap/items/rule-install-native-materialization.md
 docs/roadmap/items/runner-egress-monitoring-stepsecurity-harden-run.md
+docs/roadmap/items/runtime-explain-faithfulness-guardrail.md
 docs/roadmap/items/sbom-aware-scanning-osv-scanner.md
 docs/roadmap/items/sbom-on-every-release-cyclonedx-syft.md
 docs/roadmap/items/scan-and-sync-rules-and-workflows.md

boost_skill_cli-1.0.145/docs/roadmap/items/golden-set-statistical-power.md

@@ -0,0 +1,25 @@
+---
+id: golden-set-statistical-power
+board: code
+section: health
+status: planned
+category: Quality · Retrieval eval
+complexity: M
+impact: High
+wow: 4
+note: 43 → deeper, per-kind
+order: 4
+owner:
+pr:
+title: Grow & diversify the golden set for statistical power
+---
+The golden set (<b>43</b> queries / 8 stacks / 7 skills) is small enough that
+engine comparisons don't yet reach significance — the paired t-test lands at
+<code>p≈0.11–0.26</code> on the pinned corpus, so BM25's numeric lead over the
+heuristic can't be called statistically real. Expand and diversify it: many more
+labelled queries with balanced per-kind coverage (skill / rule / workflow),
+harder near-miss distractors, and judgments for the still-unevaluated surfaces
+(<code>search --smart</code>, <code>detect_stack</code>). Tighter confidence
+intervals mean comparisons that actually reach significance and a gate that
+catches subtler regressions. The single highest-leverage extension of the eval
+harness.

boost_skill_cli-1.0.145/docs/roadmap/items/ranx-significance-monitor.md

@@ -0,0 +1,24 @@
+---
+id: ranx-significance-monitor
+board: code
+section: health
+status: planned
+category: Quality · Retrieval eval
+complexity: S
+impact: Med
+wow: 3
+note: p-value, not point delta
+order: 5
+owner:
+pr:
+title: Significance-tracked engine comparison (ranx monitor)
+---
+Tier 1b (the <code>ranx</code> paired t-test, <code>--stats</code>) only runs on
+demand today. Wire it into a scheduled CI monitor — like the
+<code>eval-explain</code> workflow — that tracks whether BM25's lead over the
+heuristic, and any new engine's lead over BM25, is <em>statistically
+significant</em> rather than merely numerically higher, and flags when a change
+erases a previously-significant win. Stays out of the required stdlib gate (ranx
+is an opt-in <code>[eval]</code> dependency); it's a non-blocking monitor, so a
+noisy p-value can never block a merge. Turns "recall went up 0.02" into "the
+improvement is real (or isn't)."

boost_skill_cli-1.0.145/docs/roadmap/items/runtime-explain-faithfulness-guardrail.md

@@ -0,0 +1,25 @@
+---
+id: runtime-explain-faithfulness-guardrail
+board: code
+section: trust
+status: planned
+category: Trust · Hallucination guard
+complexity: M
+impact: Med
+wow: 4
+note: faithfulness → extractive fallback
+order: 4
+owner:
+pr:
+title: Runtime hallucination guardrail for <code>boost explain</code>
+---
+Today the ragas <b>faithfulness</b> check (Tier 2c, <code>scripts/eval_explain.py</code>)
+is <em>eval-time only</em> — an offline monitor that flags when generated
+explanations drift from their <code>SKILL.md</code>, but never intercepts a live
+response. Promote it to a <b>runtime guardrail</b>: score the generated summary
+against the source and, when it falls below a faithfulness threshold, fall back
+to the deterministic extractive summary <code>cmd_explain</code> already ships
+for the no-AI case (description + outline + key rules) — or append a
+low-confidence caveat. Turns "a human notices the drift next week" into "the
+tool refuses to show an ungrounded explanation," closing the gap between
+detecting hallucinations and preventing them.

{boost_skill_cli-1.0.143 → boost_skill_cli-1.0.145}/docs/roadmap.html

@@ -118,7 +118,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>104</b><span>Loop finds</span></div>
+      <div class="stat"><b>107</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -942,6 +942,27 @@ explanations and safety, not better ranking.</p>
         </div>
       </article>
 
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · Retrieval eval</span></div>
+        <h3>Grow &amp; diversify the golden set for statistical power</h3>
+        <p>The golden set (<b>43</b> queries / 8 stacks / 7 skills) is small enough that
+engine comparisons don't yet reach significance — the paired t-test lands at
+<code>p≈0.11–0.26</code> on the pinned corpus, so BM25's numeric lead over the
+heuristic can't be called statistically real. Expand and diversify it: many more
+labelled queries with balanced per-kind coverage (skill / rule / workflow),
+harder near-miss distractors, and judgments for the still-unevaluated surfaces
+(<code>search --smart</code>, <code>detect_stack</code>). Tighter confidence
+intervals mean comparisons that actually reach significance and a gate that
+catches subtler regressions. The single highest-leverage extension of the eval
+harness.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">43 → deeper, per-kind</span>
+        </div>
+      </article>
+
       <article class="cap rcard">
         <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Secrets</span></div>
         <h3>Secret scanning — <code>gitleaks</code> + push protection</h3>
@@ -974,6 +995,26 @@ explanations and safety, not better ranking.</p>
         </div>
       </article>
 
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · Retrieval eval</span></div>
+        <h3>Significance-tracked engine comparison (ranx monitor)</h3>
+        <p>Tier 1b (the <code>ranx</code> paired t-test, <code>--stats</code>) only runs on
+demand today. Wire it into a scheduled CI monitor — like the
+<code>eval-explain</code> workflow — that tracks whether BM25's lead over the
+heuristic, and any new engine's lead over BM25, is <em>statistically
+significant</em> rather than merely numerically higher, and flags when a change
+erases a previously-significant win. Stays out of the required stdlib gate (ranx
+is an opt-in <code>[eval]</code> dependency); it's a non-blocking monitor, so a
+noisy p-value can never block a merge. Turns "recall went up 0.02" into "the
+improvement is real (or isn't)."</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">p-value, not point delta</span>
+        </div>
+      </article>
+
       <article class="cap rcard">
         <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · Platform</span></div>
         <h3>Quality dashboard — SonarCloud (free for OSS)</h3>
@@ -1919,6 +1960,27 @@ re-break it.</p>
         </div>
       </article>
 
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Trust · Hallucination guard</span></div>
+        <h3>Runtime hallucination guardrail for <code>boost explain</code></h3>
+        <p>Today the ragas <b>faithfulness</b> check (Tier 2c, <code>scripts/eval_explain.py</code>)
+is <em>eval-time only</em> — an offline monitor that flags when generated
+explanations drift from their <code>SKILL.md</code>, but never intercepts a live
+response. Promote it to a <b>runtime guardrail</b>: score the generated summary
+against the source and, when it falls below a faithfulness threshold, fall back
+to the deterministic extractive summary <code>cmd_explain</code> already ships
+for the no-AI case (description + outline + key rules) — or append a
+low-confidence caveat. Turns "a human notices the drift next week" into "the
+tool refuses to show an ungrounded explanation," closing the gap between
+detecting hallucinations and preventing them.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">faithfulness → extractive fallback</span>
+        </div>
+      </article>
+
       <article class="cap rcard">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Registry</span></div>
         <h3>Typosquat &amp; name-confusion detection</h3>