boost-skill-cli 1.0.268__tar.gz → 1.0.270__tar.gz

{boost_skill_cli-1.0.268/boost_skill_cli.egg-info → boost_skill_cli-1.0.270}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.268
+Version: 1.0.270
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.268'
-__version_tuple__ = version_tuple = (1, 0, 268)
+__version__ = version = '1.0.270'
+__version_tuple__ = version_tuple = (1, 0, 270)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.268
+Version: 1.0.270
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/boost_skill_cli.egg-info/SOURCES.txt

@@ -182,6 +182,7 @@ docs/roadmap/items/crash-recorder-error-paths-core-logs-py.md
 docs/roadmap/items/demo-gif-workflow-has-never-succeeded.md
 docs/roadmap/items/dense-search-fallback-and-stale-tap-pruning.md
 docs/roadmap/items/dependabot-missing-pip-ecosystem.md
+docs/roadmap/items/dependabot-root-pip-entry-duplicates-requirements.md
 docs/roadmap/items/dependency-cve-gate-pip-audit.md
 docs/roadmap/items/docsite-chrome-and-content-audit.md
 docs/roadmap/items/docstring-coverage-interrogate.md

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/ai-bridge-silent-failure-logging.md

@@ -2,15 +2,15 @@
 id: ai-bridge-silent-failure-logging
 board: code
 section: internals
-status: planned
+status: shipped
 category: Observability
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 40
-owner:
-pr:
+owner: loop/ai-failure-logging
+pr: 284
 title: AI bridge swallows failures with zero diagnostic trail
 ---
 <code>core/ai.py</code>'s CLI and API call paths both catch their failure modes (timeout, OS error,

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/crash-listing-branch-untested.md

@@ -2,15 +2,15 @@
 id: crash-listing-branch-untested
 board: code
 section: internals
-status: planned
+status: shipped
 category: Testing · Bug
 complexity: S
 impact: Low
 wow: 1
 note:
 order: 37
-owner:
-pr:
+owner: loop/crash-listing-tests
+pr: 291
 title: <code>boost log --crashes</code> listing branch has no non-empty test
 ---
 <code>_show_crashes</code> has an empty-state branch and a listing branch that reads each

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/demo-gif-workflow-has-never-succeeded.md

@@ -2,15 +2,15 @@
 id: demo-gif-workflow-has-never-succeeded
 board: code
 section: docsite
-status: planned
+status: shipped
 category: Bug
 complexity: S
 impact: Low
 wow: 2
 note: 3 runs, 3 failures, 0 PRs opened
 order: 52
-owner:
-pr:
+owner: loop/fix-demo-recorder
+pr: 294
 title: <code>demo.yml</code> has failed every run since it landed — vhs-action cannot install ffmpeg
 ---
 <code>demo.yml</code> re-records <code>docs/demo.gif</code> with

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/dense-search-fallback-and-stale-tap-pruning.md

@@ -2,15 +2,15 @@
 id: dense-search-fallback-and-stale-tap-pruning
 board: code
 section: internals
-status: planned
+status: shipped
 category: Bug
 complexity: M
 impact: Med
 wow: 2
 note:
 order: 30
-owner:
-pr:
+owner: loop/dense-fallback-and-prune
+pr: 293
 title: Dense search's empty result skips the BM25 fallback
 ---
 <code>_retrieve_any</code> treats any non-<code>None</code> dense result as final, but

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/dependabot-missing-pip-ecosystem.md

@@ -2,15 +2,15 @@
 id: dependabot-missing-pip-ecosystem
 board: code
 section: pipeline
-status: planned
+status: shipped
 category: Supply chain
 complexity: S
 impact: Low
 wow: 1
 note: extras only — <code>/requirements</code> is covered
 order: 11
-owner:
-pr:
+owner: loop/dependabot-pyproject-extras
+pr: 289
 title: Dependabot's <code>pip</code> entry misses <code>pyproject.toml</code>'s extras
 ---
 <code>.github/dependabot.yml</code> declares <code>pip</code> for

boost_skill_cli-1.0.270/docs/roadmap/items/dependabot-root-pip-entry-duplicates-requirements.md

@@ -0,0 +1,45 @@
+---
+id: dependabot-root-pip-entry-duplicates-requirements
+board: code
+section: internals
+status: planned
+category: Build · Gap
+complexity: S
+impact: Low
+wow: 1
+note: fallout from #289 — every toolchain bump now arrives twice
+order: 35
+owner:
+pr:
+title: Dependabot raises every toolchain bump <em>twice</em>
+---
+PR #289 added a third Dependabot entry, <code>package-ecosystem: pip</code> with
+<code>directory: /</code>, to give <code>pyproject.toml</code>'s optional extras the proactive bump
+PRs they had never had. The first scheduled run after it merged produced <b>eight</b> PRs, and two
+pairs of them are duplicates: <code>#301</code>/<code>#302</code> (twine) and
+<code>#300</code>/<code>#303</code> (hypothesis) change <b>byte-identical file sets</b> — one PR from
+the <code>/</code> entry and one from the pre-existing <code>/requirements</code> entry, for the same
+bump. Merging either makes the other redundant, and Dependabot closes the twin automatically, so the
+cost is noise rather than breakage. It will recur every week.
+
+Worse, the entry cannot deliver what it was added for. Every constraint under
+<code>[project.optional-dependencies]</code> is either an open lower bound
+(<code>sqlite-vec&gt;=0.1.6</code>) or explicitly listed in that entry's own <code>ignore</code>
+block (the pinned langchain 0.3 stack held back for ragas). Dependabot does not raise a
+<i>version</i> PR when the declared range already admits the newest release, so the set of
+<code>pyproject.toml</code> version updates this entry can ever produce is <b>empty</b> — which is
+why none of the eight touched <code>pyproject.toml</code>.
+
+Do not simply revert it. Dependabot <i>security</i> updates ignore the versioning strategy and fire
+on a vulnerable version inside a permitted range, so the entry does give the extras security
+coverage they previously lacked — the item it closed was right that
+<code>[rag]</code>/<code>[bdd]</code>/<code>[perf]</code> had only reactive pip-audit flags. The
+entry should be <b>narrowed</b>, not removed.
+
+Two candidate fixes, both needing verification against a real scheduled run rather than reasoning —
+Dependabot's file discovery is what got this wrong in the first place. <b>First</b>, scope the
+<code>/</code> entry so it stops matching <code>requirements/**</code>, leaving
+<code>/requirements</code> as the single owner of the hash-pinned lock. <b>Second</b>, if proactive
+extras bumps are genuinely wanted, that needs <code>versioning-strategy: increase</code> so open
+lower bounds are raised at all; otherwise accept that this entry is security-only and say so in the
+comment, which is the honest smaller change.

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/github-community-health-files.md

@@ -2,15 +2,15 @@
 id: github-community-health-files
 board: code
 section: dx
-status: planned
+status: shipped
 category: Developer Experience
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 11
-owner:
-pr:
+owner: loop/community-health-files
+pr: 290
 title: No issue/PR templates or a code of conduct
 ---
 The repo has <code>SECURITY.md</code>, <code>CONTRIBUTING.md</code>, and

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/license-compliance-scanning.md

@@ -2,15 +2,15 @@
 id: license-compliance-scanning
 board: code
 section: pipeline
-status: planned
+status: shipped
 category: Supply chain
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 12
-owner:
-pr:
+owner: loop/license-compliance
+pr: 310
 title: License-compliance scanning of the dependency closure
 ---
 Nothing in CI checks SPDX license compatibility of resolved dependencies — <code>pip-audit</code>

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/lint-tap-misscopes-rule-workflow-entries.md

@@ -2,15 +2,15 @@
 id: lint-tap-misscopes-rule-workflow-entries
 board: code
 section: internals
-status: planned
+status: shipped
 category: Bug
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 34
-owner:
-pr:
+owner: loop/lint-tap-scope
+pr: 279
 title: <code>lint --tap</code> mis-scores rule/workflow entries as broken
 ---
 <code>boost lint --tap</code> builds its target list without filtering by kind, so rule/workflow

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/lock-invariant-cannot-parse-extras-pins.md

@@ -2,15 +2,15 @@
 id: lock-invariant-cannot-parse-extras-pins
 board: code
 section: health
-status: planned
+status: shipped
 category: Latent bug
 complexity: S
 impact: Med
 wow: 2
 note: <code>pkg[extra]==x</code> reads as unpinned
 order: 16
-owner:
-pr:
+owner: loop/lock-invariant-extras
+pr: 306
 title: The lock invariant can't parse <code>name[extra]==version</code>, so a valid pin fails the gate
 ---
 <code>tests/unit/test_toolchain_lock.py</code> (added with the lock-stability fix, #248)

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/merge-queue-would-deadlock-most-required-checks.md

@@ -2,15 +2,15 @@
 id: merge-queue-would-deadlock-most-required-checks
 board: code
 section: pipeline
-status: planned
+status: shipped
 category: Release safety
 complexity: S
 impact: Med
 wow: 3
 note: a latent trap, only if someone enables the queue
 order: 58
-owner:
-pr:
+owner: loop/merge-queue
+pr: 280
 title: Enabling a merge queue would deadlock every required check except ci.yml's
 ---
 Only <code>ci.yml</code> declares <code>merge_group</code> among its triggers. The other

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/mypy-strict-mode-for-commands.md

@@ -2,15 +2,15 @@
 id: mypy-strict-mode-for-commands
 board: code
 section: health
-status: planned
+status: shipped
 category: Testing · Type
 complexity: M
 impact: High
 wow: 3
 note:
 order: 11
-owner:
-pr:
+owner: loop/mypy-check-command-bodies
+pr: 309
 title: mypy's default mode skips untyped command bodies
 ---
 <code>[tool.mypy]</code> in <code>pyproject.toml</code> sets only <code>python_version</code>/

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/negative-limit-inverts-log-pulse-output.md

@@ -2,15 +2,15 @@
 id: negative-limit-inverts-log-pulse-output
 board: code
 section: internals
-status: planned
+status: shipped
 category: CLI ergonomics
 complexity: S
 impact: Low
 wow: 1
 note:
 order: 36
-owner:
-pr:
+owner: loop/positive-count-flags
+pr: 285
 title: Negative <code>-n</code> silently inverts <code>log</code>/<code>pulse</code> output
 ---
 <code>boost log</code>/<code>boost pulse</code> accept <code>-n</code>/<code>--limit</code> as a bare

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/onboard-overwrites-generated-files-without-confirm.md

@@ -2,15 +2,15 @@
 id: onboard-overwrites-generated-files-without-confirm
 board: code
 section: internals
-status: planned
+status: shipped
 category: UX · Bug
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 35
-owner:
-pr:
+owner: loop/onboard-confirm-overwrite
+pr: 287
 title: <code>boost onboard</code> silently overwrites existing generated files
 ---
 <code>boost onboard</code> writes <code>.boost/telemetry.json</code>, a GitHub Actions workflow, and

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/roadmap-html-goes-stale-on-every-rebase.md

@@ -2,15 +2,15 @@
 id: roadmap-html-goes-stale-on-every-rebase
 board: code
 section: dx
-status: planned
+status: shipped
 category: DX
 complexity: M
 impact: Med
 wow: 3
 note: hit twice on one PR in a single afternoon
 order: 59
-owner:
-pr:
+owner: loop/roadmap-stale-diagnosis
+pr: 307
 title: <code>roadmap.html</code> goes stale on every rebase, so a card and a merge race redden the whole matrix
 ---
 The data-driven roadmap solved the conflict problem for <em>item files</em>: two loops adding

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/sbom-release-event-never-fires.md

@@ -9,7 +9,7 @@ impact: High
 wow: 4
 note: 253 releases shipped with no SBOM; fixed with workflow_run
 order: 50
-owner:
+owner: loop/sbom-trigger
 pr: 295
 title: <code>sbom.yml</code> has never run — it waits for an event <code>GITHUB_TOKEN</code> cannot emit
 ---

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/serve-py-traversal-guards-untested.md

@@ -2,15 +2,15 @@
 id: serve-py-traversal-guards-untested
 board: code
 section: internals
-status: planned
+status: shipped
 category: Testing · Security
 complexity: S
 impact: Med
 wow: 2
 note: lowest coverage in core/
 order: 38
-owner:
-pr:
+owner: loop/serve-guard-coverage
+pr: 282
 title: <code>boost serve</code>'s own path-traversal guards are untested
 ---
 <code>serve.py</code>'s defenses against a malicious catalog <code>skill_md</code> path

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/structured-json-log-output-mode.md

@@ -2,15 +2,15 @@
 id: structured-json-log-output-mode
 board: code
 section: internals
-status: planned
+status: shipped
 category: Observability
 complexity: M
 impact: Med
 wow: 2
 note:
 order: 39
-owner:
-pr:
+owner: loop/json-log-format
+pr: 308
 title: Diagnostic log has no structured/JSON output mode
 ---
 <code>core/logs.py</code> uses stdlib <code>logging</code> with rotation and crash reports, but its

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/sync-relinks-into-every-agent-ignoring-scope.md

@@ -10,7 +10,7 @@ wow: 2
 note: the half of the scope leak PR #288 deliberately left open
 order: 34
 owner: loop/sync-agent-scope
-pr:
+pr: 311
 title: <code>sync</code> relinks a narrowed skill into every agent
 ---
 <code>store.preserved_agent_scope</code> (PR #288) stopped <code>update</code> and

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/update-reinstall-widens-agent-scope.md

@@ -2,15 +2,15 @@
 id: update-reinstall-widens-agent-scope
 board: code
 section: internals
-status: planned
+status: shipped
 category: Bug
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 33
-owner:
-pr:
+owner: loop/keep-agent-scope
+pr: 288
 title: <code>update</code>/<code>reinstall</code> silently widen a skill's agent scope
 ---
 A skill installed with <code>--agent</code> narrowing (e.g. <code>boost install foo --agent

{boost_skill_cli-1.0.268 → boost_skill_cli-1.0.270}/docs/roadmap/items/wire-bdd-suite-into-ci.md

@@ -2,15 +2,15 @@
 id: wire-bdd-suite-into-ci
 board: code
 section: dx
-status: planned
+status: shipped
 category: Test infra
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 12
-owner:
-pr:
+owner: loop/wire-bdd-into-ci
+pr: 292
 title: New BDD suite has zero CI wiring
 ---
 The behave suite added under <code>tests/bdd/</code> (11 features, 47 scenarios) passes cleanly