boost-skill-cli 1.0.209__tar.gz → 1.0.210__tar.gz

{boost_skill_cli-1.0.209 → boost_skill_cli-1.0.210}/Makefile

@@ -10,7 +10,7 @@ PYTEST    := $(VENV)/bin/pytest
 # pinned taps out of the developer's real ~/.boost.
 EVAL_HOME := $(CURDIR)/.eval-home
 
-.PHONY: venv test unit functional smoke coverage patch-coverage mutation lint check demo clean-test eval eval-ai eval-rec eval-stats eval-explain audit dist-check bdd bench bench-cli
+.PHONY: venv test unit functional smoke coverage patch-coverage mutation lint check demo clean-test eval eval-ai eval-rec eval-stats eval-explain audit dist-check bdd bench bench-cli fuzz
 
 # Every tool comes from a hash-pinned requirements/*.txt — the same files CI
 # installs (see scripts/lock_toolchain.py). pip enforces the hashes, so a dev
@@ -66,6 +66,7 @@ lint:
 	$(PY) scripts/build_roadmap.py --check
 	$(PY) scripts/build_command_reference.py --check
 	$(PY) scripts/lock_toolchain.py --check
+	$(PY) scripts/a11y_check.py
 	$(PY) scripts/import_budget.py
 	$(PY) scripts/perf_gate.py
 	$(PY) scripts/check_anchors.py
@@ -140,6 +141,20 @@ bench:
 bench-cli:
 	@command -v hyperfine >/dev/null 2>&1 && bash scripts/bench_cli.sh || echo "hyperfine not on PATH — install via 'brew install hyperfine', skipping"
 
+# Opt-in coverage-guided fuzzing of the hand-rolled parsers (atheris/libFuzzer).
+# Not part of `make check` — a fuzzer is a search, not a pass/fail gate; the
+# scheduled `fuzz` workflow owns the long runs. Each target degrades cleanly to
+# a seed-corpus pass when atheris is absent (it ships manylinux wheels only), and
+# the seed pass also runs in the normal unit suite so the harnesses can't rot.
+# FUZZ_SECONDS=60 make fuzz   to run longer.
+FUZZ_SECONDS ?= 30
+fuzz:
+	@for t in fuzz_frontmatter fuzz_registry; do \
+		echo "== $$t"; \
+		$(PY) tests/fuzz/$$t.py tests/fuzz/corpus/$${t#fuzz_} \
+			-max_total_time=$(FUZZ_SECONDS) -artifact_prefix=/tmp/ || exit 1; \
+	done
+
 # regenerate generated artifacts from their source (registries + roadmap boards)
 generate:
 	$(PY) scripts/build_registries.py

{boost_skill_cli-1.0.209/boost_skill_cli.egg-info → boost_skill_cli-1.0.210}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.209
+Version: 1.0.210
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.209 → boost_skill_cli-1.0.210}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.209'
-__version_tuple__ = version_tuple = (1, 0, 209)
+__version__ = version = '1.0.210'
+__version_tuple__ = version_tuple = (1, 0, 210)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.209 → boost_skill_cli-1.0.210}/boost_cli/core/frontmatter.py

@@ -48,10 +48,26 @@ def _scalar(raw: str):
         return False
     if low == "null" or s == "~":
         return None
+    # Numbers are coerced ONLY when the coercion is lossless — that is, when
+    # str() of the result gives back exactly what the author wrote. A number
+    # whose text carries information the numeric type cannot hold stays a
+    # string, because every consumer of frontmatter (`version`, tags, names)
+    # reads these values back as text.
+    #
+    # This is not hypothetical. `version: 1.10` is ten patch releases past 1.1,
+    # but float("1.10") is 1.1 and str(1.1) is "1.1" — so boost read a skill
+    # published at 1.10 as 1.1, decided 1.1 < 1.9, and never offered the update.
+    # `boost outdated` reported "everything up to date" while the tap was nine
+    # releases ahead. Leading zeros (`007` -> 7) and exponents (`1e5` -> 100000.0)
+    # corrupt the same way. Found by the parser fuzz harness (tests/fuzz/).
     with suppress(ValueError):
-        return int(s)
+        n = int(s)
+        if str(n) == s:
+            return n
     with suppress(ValueError):
-        return float(s)
+        f = float(s)
+        if str(f) == s:
+            return f
     return s
 
 

{boost_skill_cli-1.0.209 → boost_skill_cli-1.0.210/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.209
+Version: 1.0.210
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.209 → boost_skill_cli-1.0.210}/boost_skill_cli.egg-info/SOURCES.txt

@@ -262,6 +262,7 @@ requirements/release-tools.in
 requirements/release-tools.txt
 requirements/test-tools.in
 requirements/test-tools.txt
+scripts/a11y_check.py
 scripts/bench_cli.sh
 scripts/build_command_reference.py
 scripts/build_registries.py
@@ -322,7 +323,31 @@ tests/functional/test_property_parsers.py
 tests/functional/test_run.py
 tests/functional/test_tap_signing.py
 tests/functional/test_workspace_scope.py
+tests/fuzz/README.md
+tests/fuzz/fuzz_frontmatter.py
+tests/fuzz/fuzz_registry.py
+tests/fuzz/corpus/frontmatter/01-typical.md
+tests/fuzz/corpus/frontmatter/02-lossy-version.md
+tests/fuzz/corpus/frontmatter/03-lossy-numbers.md
+tests/fuzz/corpus/frontmatter/04-lists.md
+tests/fuzz/corpus/frontmatter/05-nested.md
+tests/fuzz/corpus/frontmatter/06-empty-block.md
+tests/fuzz/corpus/frontmatter/07-unterminated.md
+tests/fuzz/corpus/frontmatter/08-none.md
+tests/fuzz/corpus/frontmatter/09-unbalanced-quote.md
+tests/fuzz/corpus/frontmatter/10-keywords.md
+tests/fuzz/corpus/frontmatter/11-crlf.md
+tests/fuzz/corpus/frontmatter/12-bom.md
+tests/fuzz/corpus/registry/01-shorthand.txt
+tests/fuzz/corpus/registry/02-https.txt
+tests/fuzz/corpus/registry/03-ssh.txt
+tests/fuzz/corpus/registry/04-traversal.txt
+tests/fuzz/corpus/registry/05-empty.txt
+tests/fuzz/corpus/registry/06-space.txt
+tests/fuzz/corpus/registry/07-slash.txt
+tests/fuzz/corpus/registry/08-bare-host.txt
 tests/perf/test_benchmarks.py
+tests/unit/test_a11y_check.py
 tests/unit/test_adapters.py
 tests/unit/test_adapters_multi.py
 tests/unit/test_adapters_runner.py
@@ -345,6 +370,7 @@ tests/unit/test_errors_and_cli_table.py
 tests/unit/test_eval_stats_summary.py
 tests/unit/test_faithfulness.py
 tests/unit/test_frontmatter.py
+tests/unit/test_fuzz_targets.py
 tests/unit/test_gitleaks_config.py
 tests/unit/test_gitutil.py
 tests/unit/test_imperative.py
@@ -389,5 +415,6 @@ tests/unit/test_updatediff.py
 tests/unit/test_util.py
 tests/unit/test_version.py
 tests/unit/test_workflows.py
+tests/visual/a11y_check.mjs
 tests/visual/package.json
 tests/visual/visual_check.mjs

{boost_skill_cli-1.0.209 → boost_skill_cli-1.0.210}/docs/design-roadmap.html

@@ -28,7 +28,7 @@
 
   /* ---------- Aurora → ANSI palette bridge ---------- */
   .palette { max-width: 940px; margin: 46px auto 0; }
-  .palette h3 { text-align: center; font-size: 12px; font-weight: 700; font-family: var(--mono); letter-spacing: .18em; text-transform: uppercase; color: var(--text-3); margin-bottom: 20px; }
+  .palette h2 { text-align: center; font-size: 12px; font-weight: 700; font-family: var(--mono); letter-spacing: .18em; text-transform: uppercase; color: var(--text-3); margin-bottom: 20px; }
   .swatches { display: grid; grid-template-columns: repeat(auto-fit, minmax(128px, 1fr)); gap: 12px; }
   .sw { border: 1px solid var(--line); border-radius: 13px; overflow: hidden; background: var(--panel-solid); }
   .sw .chip { height: 46px; }
@@ -38,7 +38,7 @@
 
   /* ---------- legend ---------- */
   .legend { max-width: 900px; margin: 60px auto 0; border: 1px solid var(--line); border-radius: 16px; background: var(--panel); padding: 26px 28px; }
-  .legend h3 { font-size: 14px; font-weight: 700; font-family: var(--mono); letter-spacing: .12em; text-transform: uppercase; color: var(--text-2); margin-bottom: 18px; }
+  .legend h2 { font-size: 14px; font-weight: 700; font-family: var(--mono); letter-spacing: .12em; text-transform: uppercase; color: var(--text-2); margin-bottom: 18px; }
   .legend-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 18px 28px; }
   .legend-grid dt { font-family: var(--mono); font-size: 12.5px; font-weight: 700; color: var(--yellow); margin-bottom: 5px; }
   .legend-grid dd { font-size: 13.5px; color: var(--text-2); line-height: 1.5; }
@@ -63,7 +63,7 @@
   .track { margin-top: 52px; }
   .track-head { display: flex; align-items: center; gap: 14px; }
   .track-icon { width: 12px; height: 34px; border-radius: 5px; background: var(--tk, var(--yellow)); box-shadow: 0 0 22px -2px var(--tk, var(--yellow)); }
-  .track-head h3 { font-size: 22px; font-weight: 780; letter-spacing: -.015em; }
+  .track-head h2 { font-size: 22px; font-weight: 780; letter-spacing: -.015em; }
   .track-head p { font-size: 14px; color: var(--text-2); margin-top: 1px; }
   .track-head .n { margin-left: auto; font-family: var(--mono); font-size: 12px; color: var(--text-2); border: 1px solid var(--line); border-radius: 999px; padding: 5px 13px; white-space: nowrap; }
 
@@ -83,8 +83,8 @@
   .rstatus.progress { color: var(--green); background: rgba(74,222,128,.1); border: 1px solid rgba(74,222,128,.35); }
   .rstatus.done     { color: var(--text-3); background: var(--panel); border: 1px solid var(--line); text-decoration: line-through; }
 
-  .ritem h4 { font-size: 16.5px; font-weight: 720; letter-spacing: -.01em; line-height: 1.28; }
-  .ritem h4 code { font-family: var(--mono); font-size: .82em; color: var(--sky); background: rgba(125,211,252,.07); border-radius: 5px; padding: 1px 6px; }
+  .ritem h3 { font-size: 16.5px; font-weight: 720; letter-spacing: -.01em; line-height: 1.28; }
+  .ritem h3 code { font-family: var(--mono); font-size: .82em; color: var(--sky); background: rgba(125,211,252,.07); border-radius: 5px; padding: 1px 6px; }
   .ritem > p { font-size: 13.5px; color: var(--text-2); margin-top: 8px; line-height: 1.55; }
   .ritem > p b { color: var(--text); font-weight: 640; }
   .ritem > p code { font-family: var(--mono); font-size: .86em; color: var(--text); background: rgba(255,255,255,.05); border-radius: 5px; padding: 1px 5px; }
@@ -152,7 +152,7 @@
 
   <!-- ================= PALETTE BRIDGE ================= -->
   <div class="wrap palette">
-    <h3>The bridge — Aurora web tokens → 24-bit ANSI</h3>
+    <h2>The bridge — Aurora web tokens → 24-bit ANSI</h2>
     <div class="swatches">
       <div class="sw"><div class="chip" style="background:#22d3ee"></div><div class="lab"><b>Cyan</b><span>#22d3ee · accent</span></div></div>
       <div class="sw"><div class="chip" style="background:#a855f7"></div><div class="lab"><b>Violet</b><span>#a855f7 · brand</span></div></div>
@@ -166,7 +166,7 @@
   <!-- ================= LEGEND ================= -->
   <div class="wrap">
     <div class="legend reveal">
-      <h3>How to read this roadmap</h3>
+      <h2>How to read this roadmap</h2>
       <dl class="legend-grid">
         <div>
           <dt>Status</dt>
@@ -224,7 +224,7 @@
       <div class="track-head">
         <div class="track-icon"></div>
         <div>
-          <h3>Aurora Color Engine</h3>
+          <h2>Aurora Color Engine</h2>
           <p>Bring the brand palette and gradient into the terminal — with graceful fallbacks.</p>
         </div>
         <span class="n"><!-- ROADMAP:count track=color -->4 items<!-- /ROADMAP:count --></span>
@@ -234,7 +234,7 @@
         <!-- ROADMAP:cards track=color -->
 <article class="ritem" id="BOOST-D01" data-track="color" data-impact="high">
   <div class="ritem-top"><span class="rid">BOOST-D01</span><span class="rstatus done">Shipped</span></div>
-  <h4>24-bit Aurora palette in <code>output.py</code></h4>
+  <h3>24-bit Aurora palette in <code>output.py</code></h3>
   <p>The whole CLI runs on eight legacy SGR codes (<code>RED</code>…<code>CYAN</code>) that don't match the brand at all — the front door paints section headers in generic <code>[33m</code> yellow. Add truecolor <code>rgb()</code> helpers mapping the exact web tokens: cyan <b>#22d3ee</b>, violet <b>#a855f7</b>, pink <b>#f472d0</b>, green <b>#4ade80</b>, yellow <b>#facc15</b>, plus <code>--text</code>/<code>--text-3</code> greys. One map recolors everything.</p>
   <div class="rmeta"><span class="m-cat">color</span><span>Complexity S</span><span class="m-imp high">Impact High</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>core/output.py:15–38</code></div>
@@ -242,7 +242,7 @@
 
 <article class="ritem" id="BOOST-D02" data-track="color" data-impact="high">
   <div class="ritem-top"><span class="rid">BOOST-D02</span><span class="rstatus done">Shipped</span></div>
-  <h4>Terminal capability detection &amp; graceful degradation</h4>
+  <h3>Terminal capability detection &amp; graceful degradation</h3>
   <p><code>use_color()</code> is binary — color or nothing. Add a tier ladder: <b>truecolor</b> (<code>COLORTERM=truecolor/24bit</code>) → <b>256</b> → <b>16</b> → <b>none</b>, so the Aurora tokens snap to the nearest available color instead of vanishing. Keep the existing <code>NO_COLOR</code> honor, add a <code>BOOST_COLOR=always/auto/never</code> override, and treat <code>TERM=dumb</code> as none.</p>
   <div class="rmeta"><span class="m-cat">color</span><span>Complexity M</span><span class="m-imp high">Impact High</span><span class="m-wow">★★★☆☆</span></div>
   <div class="rref"><code>core/output.py:26–38</code></div>
@@ -250,7 +250,7 @@
 
 <article class="ritem" id="BOOST-D03" data-track="color" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D03</span><span class="rstatus done">Shipped</span></div>
-  <h4>Gradient text renderer — the signature move</h4>
+  <h3>Gradient text renderer — the signature move</h3>
   <p>The brand <em>is</em> the cyan→violet→pink <code>--grad</code>. Interpolate it per-character across a string so headings, the <code>boost</code> wordmark and hero counts shimmer in the terminal exactly like the web hero. A pure-Python lerp over the three stops; falls back to a single accent color when truecolor is unavailable.</p>
   <div class="rmeta"><span class="m-cat">color</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★★</span></div>
   <div class="rref"><code>core/output.py · new gradient()</code></div>
@@ -258,7 +258,7 @@
 
 <article class="ritem" id="BOOST-D04" data-track="color" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D04</span><span class="rstatus done">Shipped</span></div>
-  <h4>Semantic color roles, not raw codes</h4>
+  <h3>Semantic color roles, not raw codes</h3>
   <p>Commands scattered <code>out.c(x, out.YELLOW)</code> and <code>out.GREEN</code> literally throughout the command layer, so a palette change meant a repo-wide sweep. Now a single <code>ROLES</code> table in <code>output.py</code> maps six named roles — <code>accent</code>, <code>brand</code>, <code>success</code>, <code>warn</code>, <code>danger</code>, <code>muted</code> — resolved through the Aurora palette (truecolor → 16-color → plain), and <code>out.role(text, name)</code> paints by intent. Every color call site across all eight command groups now reads as meaning, not mechanics; brand hues (accent/success/warn) upgraded from flat 16-color to on-theme truecolor in the process. Re-theming is a one-file edit.</p>
   <div class="rmeta"><span class="m-cat">color</span><span>Complexity S</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★☆☆☆</span></div>
   <div class="rref"><code>core/output.py:ROLES / role() · commands/*.py</code></div>
@@ -273,7 +273,7 @@
       <div class="track-head">
         <div class="track-icon"></div>
         <div>
-          <h3>Structure &amp; Layout</h3>
+          <h2>Structure &amp; Layout</h2>
           <p>Width-aware output, glass panels, and results that never blow up the pane.</p>
         </div>
         <span class="n"><!-- ROADMAP:count track=layout -->7 items<!-- /ROADMAP:count --></span>
@@ -283,7 +283,7 @@
         <!-- ROADMAP:cards track=layout -->
 <article class="ritem" id="BOOST-D05" data-track="layout" data-impact="high">
   <div class="ritem-top"><span class="rid">BOOST-D05</span><span class="rstatus done">Shipped</span></div>
-  <h4>Fix <code>search</code>: truncate &amp; width-clamp results</h4>
+  <h3>Fix <code>search</code>: truncate &amp; width-clamp results</h3>
   <p>Today <code>boost search</code> is the worst screen in the app: a single result can dump a <b>2,000-character description with literal, unrendered <code>\\n\\n</code> escapes</b>, while names are padded to a fixed 30 columns that waste half the row. Clamp each row to the live terminal width, collapse whitespace/escape artifacts, and ellipsize. This one fix turns a wall of noise into a scannable list.</p>
   <div class="rmeta"><span class="m-cat">layout</span><span>Complexity M</span><span class="m-imp high">Impact High</span><span class="m-wow">★★★★★</span></div>
   <div class="rref"><code>commands/discovery.py · search</code></div>
@@ -291,7 +291,7 @@
 
 <article class="ritem" id="BOOST-D06" data-track="layout" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D06</span><span class="rstatus done">Shipped</span></div>
-  <h4>Glass-panel box primitives</h4>
+  <h3>Glass-panel box primitives</h3>
   <p>The web system frames everything in rounded glass; the CLI frames nothing. Add rounded box-drawing primitives (<code>╭─╮ │ ╰─╯</code>) with dim <code>--line</code> borders and an optional title, mirroring the web <code>.glass</code>/<code>.window</code> surfaces. Reusable chrome for <code>doctor</code>, <code>info</code>, <code>snapshot</code> and success summaries.</p>
   <div class="rmeta"><span class="m-cat">layout</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>core/output.py · new panel()</code></div>
@@ -299,7 +299,7 @@
 
 <article class="ritem" id="BOOST-D07" data-track="layout" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D07</span><span class="rstatus done">Shipped</span></div>
-  <h4>Relevance visualization in search</h4>
+  <h3>Relevance visualization in search</h3>
   <p>Results are "ranked by heuristic relevance" but the ranking is invisible — every row looks equal. Render a tiny gradient relevance bar or score glyph per hit and visually separate <b>curated</b> from GitHub-wide matches, so the eye lands on the best result first.</p>
   <div class="rmeta"><span class="m-cat">layout</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>commands/discovery.py · search</code></div>
@@ -307,7 +307,7 @@
 
 <article class="ritem" id="BOOST-D08" data-track="layout" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D08</span><span class="rstatus done">Shipped</span></div>
-  <h4>Width-aware, right-aligned tables</h4>
+  <h3>Width-aware, right-aligned tables</h3>
   <p><code>table()</code> is a naive <code>ljust</code> that ignores terminal width and left-aligns numeric columns. Make it width-aware (shrink the widest text column to fit), right-align counts with tabular figures, and add dim column separators — matching the web's <code>font-variant-numeric: tabular-nums</code> stat blocks.</p>
   <div class="rmeta"><span class="m-cat">layout</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★☆☆</span></div>
   <div class="rref"><code>core/output.py · table()</code></div>
@@ -315,7 +315,7 @@
 
 <article class="ritem" id="BOOST-D09" data-track="layout" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D09</span><span class="rstatus done">Shipped</span></div>
-  <h4>Terminal-window chrome for <code>preview</code> / <code>cat</code></h4>
+  <h3>Terminal-window chrome for <code>preview</code> / <code>cat</code></h3>
   <p>The web guide renders skills inside a titled window with traffic-light dots (<code>.window .dots</code>). Give <code>preview</code>/<code>cat</code> the same treatment: a titled frame with the skill name in the bar, so a rendered <code>SKILL.md</code> in the terminal matches the screenshots on the site.</p>
   <div class="rmeta"><span class="m-cat">layout</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>commands/info.py · preview/cat</code></div>
@@ -323,7 +323,7 @@
 
 <article class="ritem" id="BOOST-D23" data-track="layout" data-impact="high">
   <div class="ritem-top"><span class="rid">BOOST-D23</span><span class="rstatus done">Shipped</span></div>
-  <h4><code>trending</code> had the same overflow as <code>search</code></h4>
+  <h3><code>trending</code> had the same overflow as <code>search</code></h3>
   <p>Grading the un-touched commands surfaced a sibling of D05: <code>boost trending</code> piped raw catalog descriptions straight into <code>table()</code>, so a single 300-char description blew the table across the pane. Fixed by clipping each description through <code>out.truncate()</code> to the width left after the name/installs/last columns — the same helper the search fix introduced.</p>
   <div class="rmeta"><span class="m-cat">layout</span><span>Complexity S</span><span class="m-imp high">Impact High</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>commands/discovery.py · cmd_trending</code></div>
@@ -331,7 +331,7 @@
 
 <article class="ritem" id="BOOST-D24" data-track="layout" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D24</span><span class="rstatus done">Shipped</span></div>
-  <h4>Width-aware shared <code>table()</code></h4>
+  <h3>Width-aware shared <code>table()</code></h3>
   <p><code>out.table()</code> backs ~28 call sites, and several overflowed: <code>taps</code> padded the NAME column to the widest repo (<code>K-Dense-AI/claude-scientific-skills</code> = 44 cols) and then printed full URLs, so wide catalogs wrapped. Now <code>table()</code> is width-aware itself — when a row would exceed the terminal it shrinks the widest <b>text</b> column and clips its cells with an ellipsis (ANSI-aware, so colored cells keep their color and close cleanly), while <b>numeric</b> columns are right-aligned like tabular figures and never truncated. Narrow tables render byte-identical to before; the logic only engages on overflow or multi-row number columns. Delivered test-first: dedicated unit coverage for <code>_numeric_col</code>, <code>_clip_visible</code>, <code>_fit_widths</code>, and the integrated render keeps the mutation gate green.</p>
   <div class="rmeta"><span class="m-cat">layout</span><span>Complexity L</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>core/output.py:table() / _fit_widths / _clip_visible</code></div>
@@ -346,7 +346,7 @@
       <div class="track-head">
         <div class="track-icon"></div>
         <div>
-          <h3>Motion &amp; Feedback</h3>
+          <h2>Motion &amp; Feedback</h2>
           <p>Make it feel <em>snappy</em> — spinners, progress, and instant first paint.</p>
         </div>
         <span class="n"><!-- ROADMAP:count track=motion -->4 items<!-- /ROADMAP:count --></span>
@@ -356,7 +356,7 @@
         <!-- ROADMAP:cards track=motion -->
 <article class="ritem" id="BOOST-D10" data-track="motion" data-impact="high">
   <div class="ritem-top"><span class="rid">BOOST-D10</span><span class="rstatus done">Shipped</span></div>
-  <h4>Braille spinner for network waits</h4>
+  <h3>Braille spinner for network waits</h3>
   <p>Network-bound commands — <code>search</code> (AI rank), <code>tap</code> clone, <code>discover</code>, <code>index</code> — currently freeze silently while they work. Add a lightweight braille-dot spinner (<code>⠋⠙⠹⠸…</code>) tinted with the Aurora accent, auto-suppressed on non-TTY and under <code>NO_COLOR</code>. The single biggest "feels fast" upgrade.</p>
   <div class="rmeta"><span class="m-cat">motion</span><span>Complexity S</span><span class="m-imp high">Impact High</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>core/output.py · new spinner()</code></div>
@@ -364,7 +364,7 @@
 
 <article class="ritem" id="BOOST-D11" data-track="motion" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D11</span><span class="rstatus done">Shipped</span></div>
-  <h4>Determinate progress bars for batch ops</h4>
+  <h3>Determinate progress bars for batch ops</h3>
   <p>Multi-item commands — <code>reindex</code>, <code>update</code>, <code>sync</code>, <code>snapshot</code> restore — give no sense of "how far in." Add a gradient-filled progress bar (<code>N/total</code> + ETA) for anything looping over a known count, so long operations read as intentional rather than hung.</p>
   <div class="rmeta"><span class="m-cat">motion</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>core/output.py · new progress()</code></div>
@@ -372,7 +372,7 @@
 
 <article class="ritem" id="BOOST-D12" data-track="motion" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D12</span><span class="rstatus proposed">Proposed</span></div>
-  <h4>Stream search hits as they rank</h4>
+  <h3>Stream search hits as they rank</h3>
   <p><code>search</code> computes the full ranking, then prints the whole list at once — the terminal sits blank, then floods. Stream the top hits as they're scored so the first result paints almost immediately. Perceived latency drops even when total time is unchanged.</p>
   <div class="rmeta"><span class="m-cat">motion</span><span>Complexity L</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★☆☆</span></div>
   <div class="rref"><code>commands/discovery.py · search</code></div>
@@ -380,7 +380,7 @@
 
 <article class="ritem" id="BOOST-D13" data-track="motion" data-impact="low">
   <div class="ritem-top"><span class="rid">BOOST-D13</span><span class="rstatus done">Shipped</span></div>
-  <h4>Framed success summary with next step</h4>
+  <h3>Framed success summary with next step</h3>
   <p><code>ok()</code> prints a lone green check, then the command just ends. After <code>install</code>/<code>uninstall</code>, close with a small framed confirmation — what changed, where it landed, and the obvious next step (<code>boost info &lt;skill&gt;</code>) — so a completed action feels finished, not dropped.</p>
   <div class="rmeta"><span class="m-cat">ux</span><span>Complexity S</span><span class="m-imp low">Impact Low</span><span class="m-wow">★★★☆☆</span></div>
   <div class="rref"><code>core/output.py:41 · commands/pkg.py</code></div>
@@ -395,7 +395,7 @@
       <div class="track-head">
         <div class="track-icon"></div>
         <div>
-          <h3>Command-by-command Polish</h3>
+          <h2>Command-by-command Polish</h2>
           <p>The screens users actually stare at — front door, doctor, list, info, browse.</p>
         </div>
         <span class="n"><!-- ROADMAP:count track=commands -->7 items<!-- /ROADMAP:count --></span>
@@ -405,7 +405,7 @@
         <!-- ROADMAP:cards track=commands -->
 <article class="ritem" id="BOOST-D14" data-track="commands" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D14</span><span class="rstatus done">Shipped</span></div>
-  <h4>Front door: gradient wordmark + section glyphs</h4>
+  <h3>Front door: gradient wordmark + section glyphs</h3>
   <p>The <code>boost</code> home screen is the first thing everyone sees. Today the wordmark is plain bold and every group header is the same generic yellow. Paint the <code>boost</code> wordmark with the Aurora gradient and give each command group a colored bullet/glyph keyed to a brand hue — turning a flat list into a branded index.</p>
   <div class="rmeta"><span class="m-cat">commands</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★★</span></div>
   <div class="rref"><code>commands/info.py · help renderer</code></div>
@@ -413,7 +413,7 @@
 
 <article class="ritem" id="BOOST-D15" data-track="commands" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D15</span><span class="rstatus done">Shipped</span></div>
-  <h4><code>doctor</code> as a health dashboard</h4>
+  <h3><code>doctor</code> as a health dashboard</h3>
   <p><code>doctor</code> is an undifferentiated wall of green checks — no hierarchy, no headline. Reframe it as a panel with a verdict line (<code>● Healthy</code> in green / <code>● Attention</code> in amber), grouped checks, dim sub-detail, and severity color so a problem actually stands out instead of hiding among the ✓s.</p>
   <div class="rmeta"><span class="m-cat">commands</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>commands/quality.py · doctor</code></div>
@@ -421,7 +421,7 @@
 
 <article class="ritem" id="BOOST-D16" data-track="commands" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D16</span><span class="rstatus done">Shipped</span></div>
-  <h4><code>info</code> skill identity card</h4>
+  <h3><code>info</code> skill identity card</h3>
   <p><code>info</code> lists <code>kv()</code> pairs as flat dim labels. Promote it to a framed identity card: gradient skill name, status badges (<b>installed</b> / <b>pinned</b> / tap origin) styled like the web <code>.badge</code> pills, then the metadata — a real "detail view," not a key-value dump.</p>
   <div class="rmeta"><span class="m-cat">commands</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>commands/info.py:177+</code></div>
@@ -429,7 +429,7 @@
 
 <article class="ritem" id="BOOST-D17" data-track="commands" data-impact="low">
   <div class="ritem-top"><span class="rid">BOOST-D17</span><span class="rstatus done">Shipped</span></div>
-  <h4><code>list</code> polish — chips &amp; aligned counts</h4>
+  <h3><code>list</code> polish — chips &amp; aligned counts</h3>
   <p><code>list</code> already uses a nice <code>·</code> agent separator; take it further. Color the agent names as small chips, right-align the count footer with tabular figures, and add a dim header rule so the table reads as a designed object rather than raw columns.</p>
   <div class="rmeta"><span class="m-cat">commands</span><span>Complexity S</span><span class="m-imp low">Impact Low</span><span class="m-wow">★★★☆☆</span></div>
   <div class="rref"><code>commands/info.py:130–131</code></div>
@@ -437,7 +437,7 @@
 
 <article class="ritem" id="BOOST-D18" data-track="commands" data-impact="low">
   <div class="ritem-top"><span class="rid">BOOST-D18</span><span class="rstatus done">Shipped</span></div>
-  <h4>Consistent empty-states &amp; hint styling</h4>
+  <h3>Consistent empty-states &amp; hint styling</h3>
   <p>Empty and hint lines are ad-hoc — <code>info</code>'s "no skills installed" hint is a hand-rolled <code>DIM</code> string. Standardize a single empty-state affordance (muted icon + one-line guidance + suggested command) and a single hint style, applied everywhere, so guidance always looks the same.</p>
   <div class="rmeta"><span class="m-cat">ux</span><span>Complexity S</span><span class="m-imp low">Impact Low</span><span class="m-wow">★★☆☆☆</span></div>
   <div class="rref"><code>commands/info.py:117–119 · core/output.py</code></div>
@@ -445,7 +445,7 @@
 
 <article class="ritem" id="BOOST-D25" data-track="commands" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D25</span><span class="rstatus done">Shipped</span></div>
-  <h4>Branded usage &amp; error output</h4>
+  <h3>Branded usage &amp; error output</h3>
   <p>Grading confirmed this hits <b>every command with a required argument</b> — <code>boost uninstall</code>, <code>boost snapshot</code> and more all dump raw, unstyled <code>argparse</code>: a multi-line usage block with a bare <code>error:</code>, nothing like the branded top-level dispatch (which already routes through <code>Error:</code> + a difflib "did you mean"). The durable fix is a shared <code>BoostArgumentParser</code> subclass whose <code>error()</code>/usage route through the Aurora output layer, adopted across the ~50 per-command parsers — a broad, test-first sweep, so logged rather than rushed.</p>
   <div class="rmeta"><span class="m-cat">ux</span><span>Complexity L</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★☆☆</span></div>
   <div class="rref"><code>cliparse.py (BoostArgumentParser) · all 10 command files</code></div>
@@ -453,7 +453,7 @@
 
 <article class="ritem" id="BOOST-D26" data-track="commands" data-impact="high">
   <div class="ritem-top"><span class="rid">BOOST-D26</span><span class="rstatus done">Shipped</span></div>
-  <h4><code>browse</code> — Aurora the full-screen TUI</h4>
+  <h3><code>browse</code> — Aurora the full-screen TUI</h3>
   <p>The interactive <code>browse</code> pane was the <b>last off-theme surface</b>: a curses screen drawn in raw <code>A_BOLD</code>/<code>A_DIM</code>/<code>A_REVERSE</code> — zero brand color while every other command spoke Aurora. Rebuilt it as a first-class TUI: a macOS <b>titlebar</b> (traffic-light dots + <code>boost browse</code> wordmark under a cyan→violet→pink gradient rule), an <code>❯</code> chevron prompt with a live <code>▏</code> caret, <b>fuzzy-match highlighting</b> (matched chars glow pink as you type), a cyan selection bar, yellow curated <code>★</code>, violet tap labels, a right-edge scrollbar, and a gradient-topped detail pane with <code>#tag</code> chips. Colors come from the single-source <code>out.TOKENS</code> via <code>init_color</code> — parity-locked to <code>style/boost.css</code> — and degrade truecolor → 8-color → monochrome. Stdlib only. With this, <b>every boost command is on-theme</b>.</p>
   <div class="rmeta"><span class="m-cat">commands</span><span>Complexity L</span><span class="m-imp high">Impact High</span><span class="m-wow">★★★★★</span></div>
   <div class="rref"><code>commands/discovery.py · _browse_tui / _aurora_theme</code></div>
@@ -467,7 +467,7 @@
       <div class="track-head">
         <div class="track-icon"></div>
         <div>
-          <h3>Design System &amp; Tooling</h3>
+          <h2>Design System &amp; Tooling</h2>
           <p>One source of truth for the brand — and the tools to show it off.</p>
         </div>
         <span class="n"><!-- ROADMAP:count track=system -->4 items<!-- /ROADMAP:count --></span>
@@ -477,7 +477,7 @@
         <!-- ROADMAP:cards track=system -->
 <article class="ritem" id="BOOST-D19" data-track="system" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D19</span><span class="rstatus done">Shipped</span></div>
-  <h4>Resolve theme drift: <code>style/</code> vs <code>docs/style/</code></h4>
+  <h3>Resolve theme drift: <code>style/</code> vs <code>docs/style/</code></h3>
   <p>Two copies of <code>boost.css</code> have <b>diverged</b>: the root <code>style/</code> uses a cyan→violet→pink gradient (<code>--violet #a855f7</code>), while <code>docs/style/</code> uses an orange→pink→violet one (<code>--violet #a78bfa</code>). Same brand, two looks. Pick <code>style/</code> as canonical and make <code>docs/style/</code> a generated copy or symlink so the portfolio, roadmaps and CLI can't drift again.</p>
   <div class="rmeta"><span class="m-cat">system</span><span>Complexity S</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★☆☆</span></div>
   <div class="rref"><code>style/boost.css · docs/style/boost.css</code></div>
@@ -485,7 +485,7 @@
 
 <article class="ritem" id="BOOST-D20" data-track="system" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D20</span><span class="rstatus done">Shipped</span></div>
-  <h4>Single source of design tokens (web ↔ CLI)</h4>
+  <h3>Single source of design tokens (web ↔ CLI)</h3>
   <p><b>Done:</b> the CLI palette is now single-sourced — one <code>output.TOKENS</code> dict holds every Aurora RGB triple, and the gradient, brand tints and badges all <em>derive</em> from it (previously cyan/violet/pink were re-typed across <code>_AURORA</code> and <code>_GRAD_STOPS</code>). A test locks the contract so a stray hex can't drift. <b>Remaining:</b> lift <code>TOKENS</code> into a shared <code>tokens.json</code> and generate <em>both</em> the CSS custom properties and this map from it, so the site and the terminal move in lockstep. <b>Shipped as enforcement instead of generation:</b> a unit test parses <code>style/boost.css</code> and asserts every <code>--token</code> matches <code>output.TOKENS</code>, so a hex changed in one place and not the other fails CI — the same guarantee without rewriting the hand-authored stylesheet.</p>
   <div class="rmeta"><span class="m-cat">system</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>core/output.py TOKENS · style/boost.css · future build_tokens.py</code></div>
@@ -493,7 +493,7 @@
 
 <article class="ritem" id="BOOST-D21" data-track="system" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D21</span><span class="rstatus done">Shipped</span></div>
-  <h4>Scripted demo recording (VHS / asciinema)</h4>
+  <h3>Scripted demo recording (VHS / asciinema)</h3>
   <p>There's a <code>docs/demo.tape</code> + <code>demo.gif</code>, but no repeatable way to re-record once the aesthetic changes — and <code>tmux</code> isn't even installed in the dev box. Add a <code>make demo</code> that drives a scripted session (VHS tape or asciinema, optionally split-pane via tmux) and refreshes the GIF, so the README and portfolio always show the current look.</p>
   <div class="rmeta"><span class="m-cat">tooling</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>docs/demo.tape · Makefile</code></div>
@@ -501,7 +501,7 @@
 
 <article class="ritem" id="BOOST-D22" data-track="system" data-impact="med">
   <div class="ritem-top"><span class="rid">BOOST-D22</span><span class="rstatus done">Shipped</span></div>
-  <h4>README / portfolio terminal parity</h4>
+  <h3>README / portfolio terminal parity</h3>
   <p>The web <code>.window</code> mock shows an <em>idealized</em> boost session — gradient prompt, clean checks — that the real CLI doesn't yet produce. Once D01–D15 land, update the mock (and README code blocks) to mirror the true output 1:1, so every screenshot is honest and the brand reads identically across web, README and terminal.</p>
   <div class="rmeta"><span class="m-cat">system</span><span>Complexity S</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
   <div class="rref"><code>docs/index.html · README.md · style/demo.html</code></div>

{boost_skill_cli-1.0.209 → boost_skill_cli-1.0.210}/docs/eval.html

@@ -18,7 +18,12 @@
              text-wrap: balance; margin-top: 24px; }
   .hero p.lede { max-width: 700px; margin-top: 24px; font-size: 18.5px; color: var(--text-2); }
   .crumbs { font-family: var(--mono); font-size: 12.5px; color: var(--text-3); margin-bottom: 4px; }
-  .crumbs a { color: var(--sky); text-decoration: none; }
+  /* Underlined, not colour-only: --sky on --text-3 is 2.47:1, under the 3:1
+     WCAG 1.4.1 needs to distinguish a link from its surrounding text by
+     colour alone. The underline is the non-colour cue (same pattern as
+     `footer a` in boost.css). Caught by the axe-core sweep. */
+  .crumbs a { color: var(--sky); text-decoration: underline;
+              text-underline-offset: 2px; text-decoration-thickness: 1px; }
   .stats { margin-top: 58px; }
 
   .lead { max-width: 760px; margin: 0 auto; text-align: center; color: var(--text-2);

{boost_skill_cli-1.0.209 → boost_skill_cli-1.0.210}/docs/mcp-hub.html

@@ -18,7 +18,12 @@
              text-wrap: balance; margin-top: 24px; }
   .hero p.lede { max-width: 680px; margin-top: 24px; font-size: 18.5px; color: var(--text-2); }
   .crumbs { font-family: var(--mono); font-size: 12.5px; color: var(--text-3); margin-bottom: 4px; }
-  .crumbs a { color: var(--sky); text-decoration: none; }
+  /* Underlined, not colour-only: --sky on --text-3 is 2.47:1, under the 3:1
+     WCAG 1.4.1 needs to distinguish a link from its surrounding text by
+     colour alone. The underline is the non-colour cue (same pattern as
+     `footer a` in boost.css). Caught by the axe-core sweep. */
+  .crumbs a { color: var(--sky); text-decoration: underline;
+              text-underline-offset: 2px; text-decoration-thickness: 1px; }
   .stats { margin-top: 58px; }
 
   /* Diagram frame: a glass surface that scrolls its own wide SVG (body never scrolls X). */

boost_skill_cli-1.0.210/docs/roadmap/items/accessibility-audit-pa11y-ci-axe-core.md

@@ -0,0 +1,31 @@
+---
+id: accessibility-audit-pa11y-ci-axe-core
+board: code
+section: docsite
+status: shipped
+category: Quality · A11y
+complexity: M
+impact: Med
+wow: 4
+note: WCAG AA
+order: 3
+owner: loop/a11y-audit
+pr: 243
+title: Accessibility audit — <code>pa11y-ci</code> / axe-core
+---
+WCAG 2.1 AA over every docs page, in two halves. <code>scripts/a11y_check.py</code>
+           is the always-on gate: pure stdlib, so it runs in the lint job beside the other
+           <code>--check</code> scripts with no Node, Chrome or network. It covers what the
+           markup alone decides — <code>lang</code>, <code>alt</code>, accessible names for
+           links and buttons, duplicate ids, heading order — plus the 1.4.3 contrast ratios
+           computed from the Aurora tokens for the ink/ground pairs the CSS actually puts
+           together (listing the real pairs, not the cross-product, so a pair that never
+           renders can't cry wolf). The axe-core sweep in <code>tests/visual/</code> is the
+           other half: contrast as <em>rendered</em> over glass and gradient, ARIA validity
+           against the computed tree, landmarks, focusable-but-hidden elements — everything
+           that needs a live DOM and therefore can't be a cheap always-on gate. The audit
+           found one real failure, a skipped heading level on the design board, fixed by
+           promoting the section headings with their class-scoped selectors in lockstep so
+           the rendering is unchanged. Contrast came back clean: the muted tokens the card
+           suspected were already fixed (<code>--text-3</code> had been raised from a 3.9:1
+           value), and this gate is what keeps them that way.

boost_skill_cli-1.0.210/docs/roadmap/items/coverage-guided-fuzzing-atheris-oss-fuzz.md

@@ -0,0 +1,30 @@
+---
+id: coverage-guided-fuzzing-atheris-oss-fuzz
+board: code
+section: health
+status: shipped
+category: Testing · Bug
+complexity: L
+impact: Med
+wow: 4
+note: stretch
+order: 8
+owner: loop/fuzz-parsers
+pr: 242
+title: Coverage-guided fuzzing — <code>atheris</code> / OSS-Fuzz
+---
+Google's <code>atheris</code> instruments the bytecode and evolves inputs toward
+           uncovered branches in boost's two hand-rolled parsers — the SKILL.md frontmatter
+           reader (a stdlib-only YAML subset, so no upstream project's fuzzing covers it)
+           and the tap-spec parser. It has already paid for itself: the frontmatter harness
+           found that numeric coercion was <em>lossy</em>. <code>version: 1.10</code> is ten
+           patch releases past 1.1, but <code>float("1.10")</code> is <code>1.1</code> — so
+           boost read a skill published at 1.10 as 1.1, compared it as older than 1.9, and
+           never offered the update, with <code>boost outdated</code> reporting "everything
+           up to date" while the tap was nine releases ahead. Note that "it doesn't crash"
+           would have missed it entirely: the invariant has to compare the parsed value
+           against the source text. The seeds through every invariant run in the required
+           suite so a harness cannot rot; the coverage-guided run is a weekly non-blocking
+           job, because a timed search is not reproducible enough to gate a merge. Targets
+           follow the OSS-Fuzz Python contract, ready for continuous runs once boost
+           qualifies.