boost-skill-cli 1.0.329__tar.gz → 1.0.331__tar.gz

{boost_skill_cli-1.0.329/boost_skill_cli.egg-info → boost_skill_cli-1.0.331}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.329
+Version: 1.0.331
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.329'
-__version_tuple__ = version_tuple = (1, 0, 329)
+__version__ = version = '1.0.331'
+__version_tuple__ = version_tuple = (1, 0, 331)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/boost_cli/core/rag.py

@@ -23,6 +23,7 @@ import re
 import sqlite3
 from collections import defaultdict
 from collections.abc import Sequence
+from functools import lru_cache
 from pathlib import Path
 from typing import Dict, List, Optional, Tuple, cast
 
@@ -31,7 +32,7 @@ try:  # TypedDict lives in typing on 3.9+, kept optional for safety
 except ImportError:  # pragma: no cover - 3.9+ always has it
     TypedDict = None  # type: ignore
 
-from . import ai, catalog, frontmatter, gitutil, paths, registry, util
+from . import ai, catalog, config, frontmatter, gitutil, paths, registry, util
 
 # v2: `snip` stores a larger head of the matched chunk (not just SNIP_WIDTH
 # chars) so `retrieve` can window it onto the query terms; bump forces a
@@ -527,6 +528,50 @@ def entry_key(entry: dict) -> Tuple[str, str]:
     return (entry["tap"], entry["skill_md"])
 
 
+@lru_cache(maxsize=1)
+def _confidence_map() -> Dict[str, str]:
+    """``tap name -> confidence`` from the shipped registry catalog.
+
+    Cached because dedup asks per hit and the catalog is 466 rows; parsing it
+    inside a search loop would be a real cost for a value that cannot change
+    while the process runs.
+    """
+    out: Dict[str, str] = {}
+    for row in config.load_registry_catalog():
+        name = row.get("name")
+        conf = row.get("confidence")
+        if name and conf:
+            out[str(name)] = str(conf)
+    return out
+
+
+def registry_confidence(tap: str) -> Optional[str]:
+    """The shipped confidence for a tap, or None if it is not catalogued."""
+    return _confidence_map().get(tap)
+
+
+# Lower sorts better. Unknown registries rank below every known one rather than
+# above, so an uncatalogued tap never outranks a vetted one by default.
+_CONFIDENCE_ORDER = {"high": 0, "med": 1, "low": 2}
+
+
+def source_rank(entry: dict) -> Tuple[int, int]:
+    """How much this copy's *source* is worth, for choosing between identical bodies.
+
+    Only ever used inside a content cluster, where every candidate has the same
+    body — so this decides where the user installs from, not what they find.
+
+    The user's own ``curated`` flag comes first and the shipped ``confidence``
+    second, deliberately: a maintainer opinion baked into the package should
+    never override a decision the machine's owner made with `boost tap
+    --curated`.
+    """
+    curated = 0 if entry.get("curated") else 1
+    conf = _CONFIDENCE_ORDER.get(registry_confidence(entry.get("tap", "")) or "",
+                                 len(_CONFIDENCE_ORDER))
+    return (curated, conf)
+
+
 def dedupe_by_content(hits: List[Hit], limit: int) -> List[Hit]:
     """Collapse byte-identical copies, then take ``limit``.
 
@@ -562,9 +607,9 @@ def dedupe_by_content(hits: List[Hit], limit: int) -> List[Hit]:
             best[digest] = len(out)
             out.append(hit)
             continue
-        # Same body already shown. Keep its rank, but prefer a curated source.
+        # Same body already shown. Keep its rank, but prefer a better source.
         kept = out[seen]
-        if hit["entry"].get("curated") and not kept["entry"].get("curated"):
+        if source_rank(hit["entry"]) < source_rank(kept["entry"]):
             # cast, not a literal annotation: `Hit` is total=False for the
             # optional `content` key, and NotRequired needs 3.11 while boost
             # targets 3.9.

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.329
+Version: 1.0.331
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/boost_skill_cli.egg-info/SOURCES.txt

@@ -485,6 +485,7 @@ tests/unit/test_command_reference_fresh.py
 tests/unit/test_community_health_files.py
 tests/unit/test_config.py
 tests/unit/test_content_dedupe.py
+tests/unit/test_dedup_trust.py
 tests/unit/test_dense.py
 tests/unit/test_dense_fallback.py
 tests/unit/test_dense_fix_hint.py

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/docs/roadmap/items/code-scanning-rule-can-be-restored.md

@@ -2,7 +2,7 @@
 id: code-scanning-rule-can-be-restored
 board: code
 section: trust
-status: planned
+status: shipped
 category: Release safety
 complexity: S
 impact: Med
@@ -45,3 +45,19 @@ path filters and runs on <code>push</code>, <code>pull_request</code> and
 repo has hit twice. And it catches something the status check does not &mdash;
 <code>codeql-analyze</code> passes when the <em>job</em> succeeds, including when it succeeds
 having found error-severity alerts.
+
+<b>Done &mdash; the rule is back, and scoped exactly as this card prescribed.</b> Read from the live
+<code>main</code> ruleset (id <code>19130332</code>): it carries a <code>code_scanning</code> rule
+whose <code>code_scanning_tools</code> list is <b><code>CodeQL</code> alone</b>, at
+<code>security_alerts_threshold: high_or_higher</code> and <code>alerts_threshold: errors</code>.
+Scorecard is not in the list, which is the single decision this card exists to get right.
+
+The safety precondition still holds and was re-checked rather than assumed: <b>CodeQL has 0 open
+alerts</b>, while Scorecard has <b>4 open</b> (down from the 7 recorded above), every one still a
+posture metric that must not be dismissed. Had Scorecard been added to that tool list, those four
+would block every merge in the repository immediately &mdash; the failure mode this card correctly
+identifies as the reason the work looked blocked.
+
+No change was needed. Recording it as shipped so the board stops advertising work that is already
+in place, and so the tool-list constraint stays written down: anyone re-editing this rule through the
+GitHub UI will be offered Scorecard right next to CodeQL in the picker.

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/docs/roadmap/items/demo-cannot-open-its-own-pr.md

@@ -2,7 +2,7 @@
 id: demo-cannot-open-its-own-pr
 board: code
 section: pipeline
-status: planned
+status: shipped
 category: CI reporting
 complexity: S
 impact: Med
@@ -61,3 +61,14 @@ that job cannot open a pull request either. So this toggle now gates two items r
 the second is a supply-chain freshness gap rather than a docs asset. That does not make the
 decision automatic, but it does change what is on each side of it.
 
+
+<b>Unblocked, and already working &mdash; the setting was flipped.</b> This card's blocker is
+<code>can_approve_pull_request_reviews: false</code>. The API now reports it as <b><code>true</code></b>,
+and the effect is visible rather than theoretical: <code>demo.yml</code>'s recent runs are green, and
+<b>PR <code>#353</code> was opened by <code>github-actions[bot]</code></b> &mdash; the exact action
+this card says is impossible.
+
+Nothing in the tree needed changing. Recording it as shipped rather than deleting it, because the
+card's analysis was right about <em>where</em> the blocker was: the earlier investigation had chased
+<code>demo.yml</code>'s own <code>permissions:</code> block, and the note that no edit to the workflow
+could fix a repository-level setting is what stopped that from being a long false lead.

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/docs/roadmap/items/merged-loop-branches-are-never-pruned.md

@@ -2,7 +2,7 @@
 id: merged-loop-branches-are-never-pruned
 board: code
 section: pipeline
-status: planned
+status: shipped
 category: Hygiene · DX
 complexity: S
 impact: Low
@@ -45,3 +45,26 @@ Low impact and near-zero risk to fix &mdash; flip <code>delete_branch_on_merge</
 the backlog can be pruned by listing merged PR head refs. The reason it is worth doing at all is
 that CLAUDE.md tells every agent to run <code>git worktree list</code> and inspect branch state
 before touching a tree, and 68 stale entries make that check noisier for every concurrent loop.
+
+<b>Shipped &mdash; and the premise had gone stale, which is why it was worth re-checking rather than
+assuming.</b> This card's core claim is that <code>delete_branch_on_merge</code> is <code>false</code>.
+It is now <b><code>true</code></b>, and the backlog it describes is gone: against the card's
+<b>77 branches, 70 of them <code>loop/*</code></b>, the repository today carries <b>5 branches, 2
+<code>loop/*</code></b>.
+
+Two stragglers predating the setting change were still present and are now deleted:
+<code>evals-harness</code> (PR <code>#317</code>, merged) and <code>mcp-task-entrance</code>
+(PR <code>#318</code>, merged). Both were classified the way this card insists on &mdash; by
+<b>pull-request state</b>, not commit reachability &mdash; because the squash-merge point above is
+real: <code>compare(main...branch).ahead_by</code> reports every merged branch as permanently ahead,
+so reachability would have reported 0 of them deletable.
+
+Three branches remain and are deliberately <em>not</em> deleted: <code>bot/demo-gif</code> has an
+open PR (<code>#353</code>), and <code>badges</code>, <code>loop/keyless-card-dedupe</code> and
+<code>loop/sbom-in-release-job</code> have <b>no PR on record</b>. A branch with no PR cannot be shown
+to be merged, and deleting it could destroy unmerged work &mdash; so the safe rule is to leave it for
+a human, which is also why no automated pruner is proposed here.
+
+<b>No automation was added.</b> The repository setting does the job going forward; a workflow that
+deleted branches on a schedule would add a way to lose work in exchange for tidying a list that is
+now five entries long.

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/docs/roadmap/items/near-duplicate-items-eat-the-result-slots.md

@@ -164,3 +164,26 @@ bodies. Both are refinements — the byte-identical case is 78.3% of the pro
 quality prior than <code>curated</code> and near-identical (rather than byte-identical) clustering.
 Unowned and ready for anyone &mdash; the byte-identical case was 78.3% of the problem, so the
 remainder is refinement rather than the bulk.
+
+<b>The quality prior is now richer than the <code>curated</code> flag alone.</b> Inside a cluster
+every copy is byte-identical, so which one survives is not a relevance question &mdash; it decides
+where the user installs from. Two signals exist and they are not the same thing: the entry's own
+<code>curated</code> flag, which is a decision this machine's owner made with
+<code>boost tap --curated</code>, and <code>confidence</code> in the shipped
+<code>registries.json</code> (high / med / low across 466 registries, currently 268 / 153 / 45).
+
+<code>rag.source_rank</code> orders on the user's flag <em>first</em> and the shipped confidence
+second, deliberately: a maintainer opinion baked into the package should never override a choice made
+on the user's own machine. An uncatalogued registry ranks below every catalogued one rather than
+above, so an unknown tap never wins by default, and equal trust falls back to ranking order so the
+result stays deterministic when there is no signal at all. The catalog is read once
+(<code>lru_cache</code>) because dedup asks per hit and parsing 466 rows inside a search loop would
+be a real cost for a value that cannot change while the process runs.
+
+Retrieval quality is untouched by construction &mdash; the gate reads 0.863 / 0.473 / 0.607 / 0.662
+before and after, because the prior only chooses between copies that are already identical.
+
+<b>Still open:</b> near-identical rather than byte-identical clustering, where
+<code>core/typosquat.py</code>'s confusion machinery would apply. Stars and recency, which the card
+also names, have no shipped data source today &mdash; adding one is its own piece of work rather than
+a tweak to this.

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/docs/roadmap/items/scheduled-toolchain-lock-regeneration.md

@@ -71,3 +71,19 @@ normal PR gate once a human opens it.
 Either way the freshness gap this item exists to close narrows from "nobody is watching" to "a
 human clicks a button", which is the honest available improvement while the setting stands.
 
+
+<b>The blocker is gone.</b> This card is gated on the same repository setting as
+<code>demo-cannot-open-its-own-pr</code>, and the API now reports
+<code>can_approve_pull_request_reviews: <b>true</b></code>. Confirmed working rather than merely
+configured: <code>#353</code> was opened by <code>github-actions[bot]</code>.
+
+So the &ldquo;honest available improvement while the setting stands&rdquo; compromise described above
+&mdash; a workflow that only reports drift and waits for a human to click a button &mdash; is no
+longer the ceiling. A scheduled job can now regenerate the lock and open its own PR, which is what
+this card originally asked for.
+
+Deliberately left unimplemented here. It needs a real decision about cadence and about what happens
+when the regenerated lock fails <code>lock_toolchain.py --check</code> on a runner, and shipping an
+untested scheduled workflow that opens PRs against <code>main</code> is worse than shipping nothing.
+The value of this note is that the next person picking it up starts from &ldquo;build it&rdquo;
+rather than from &ldquo;it cannot be built&rdquo;.

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/docs/roadmap.html

@@ -1681,7 +1681,24 @@ than a description of them, and <code>lock_toolchain.py --audit</code> then runs
 normal PR gate once a human opens it.
 
 Either way the freshness gap this item exists to close narrows from "nobody is watching" to "a
-human clicks a button", which is the honest available improvement while the setting stands.</p>
+human clicks a button", which is the honest available improvement while the setting stands.
+
+
+<b>The blocker is gone.</b> This card is gated on the same repository setting as
+<code>demo-cannot-open-its-own-pr</code>, and the API now reports
+<code>can_approve_pull_request_reviews: <b>true</b></code>. Confirmed working rather than merely
+configured: <code>#353</code> was opened by <code>github-actions[bot]</code>.
+
+So the &ldquo;honest available improvement while the setting stands&rdquo; compromise described above
+&mdash; a workflow that only reports drift and waits for a human to click a button &mdash; is no
+longer the ceiling. A scheduled job can now regenerate the lock and open its own PR, which is what
+this card originally asked for.
+
+Deliberately left unimplemented here. It needs a real decision about cadence and about what happens
+when the regenerated lock fails <code>lock_toolchain.py --check</code> on a runner, and shipping an
+untested scheduled workflow that opens PRs against <code>main</code> is worse than shipping nothing.
+The value of this note is that the next person picking it up starts from &ldquo;build it&rdquo;
+rather than from &ldquo;it cannot be built&rdquo;.</p>
         <div class="meta">
           <span class="m">Complexity <b>M</b></span>
           <span class="m">Impact <b>Med</b></span>
@@ -3318,7 +3335,7 @@ concrete proof that the original recommendation would have blocked every release
       </article>
 
       <article class="cap rcard" id="demo-cannot-open-its-own-pr">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">CI reporting</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">CI reporting</span></div>
         <h3><code>demo.yml</code> still fails on every push &mdash; and the fix is not in the workflow</h3>
         <p><code>demo-gif-workflow-has-never-succeeded</code> (shipped, PR&nbsp;294) fixed the recorder:
 <code>charmbracelet/vhs-action</code>'s broken ffmpeg installer was replaced with apt plus
@@ -3366,7 +3383,19 @@ permission: since <code>#349</code> switched off Dependabot's version updates fo
 toolchain, the replacement is a scheduled job that regenerates the lock and proposes it &mdash; and
 that job cannot open a pull request either. So this toggle now gates two items rather than one, and
 the second is a supply-chain freshness gap rather than a docs asset. That does not make the
-decision automatic, but it does change what is on each side of it.</p>
+decision automatic, but it does change what is on each side of it.
+
+
+<b>Unblocked, and already working &mdash; the setting was flipped.</b> This card's blocker is
+<code>can_approve_pull_request_reviews: false</code>. The API now reports it as <b><code>true</code></b>,
+and the effect is visible rather than theoretical: <code>demo.yml</code>'s recent runs are green, and
+<b>PR <code>#353</code> was opened by <code>github-actions[bot]</code></b> &mdash; the exact action
+this card says is impossible.
+
+Nothing in the tree needed changing. Recording it as shipped rather than deleting it, because the
+card's analysis was right about <em>where</em> the blocker was: the earlier investigation had chased
+<code>demo.yml</code>'s own <code>permissions:</code> block, and the note that no edit to the workflow
+could fix a repository-level setting is what stopped that from being a long false lead.</p>
         <div class="meta">
           <span class="m">Complexity <b>S</b></span>
           <span class="m">Impact <b>Med</b></span>
@@ -3376,7 +3405,7 @@ decision automatic, but it does change what is on each side of it.</p>
       </article>
 
       <article class="cap rcard" id="merged-loop-branches-are-never-pruned">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Hygiene · DX</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Hygiene · DX</span></div>
         <h3>68 of the repo's 77 branches are merged <code>loop/*</code> branches nobody deletes</h3>
         <p>The repository carries <b>77 branches, 70 of them <code>loop/*</code></b>. Classifying each by the
 state of its pull request: <b>68 have a merged PR</b> and are safe to delete, <b>1</b> has an open
@@ -3409,7 +3438,30 @@ manually.
 Low impact and near-zero risk to fix &mdash; flip <code>delete_branch_on_merge</code> to true and
 the backlog can be pruned by listing merged PR head refs. The reason it is worth doing at all is
 that CLAUDE.md tells every agent to run <code>git worktree list</code> and inspect branch state
-before touching a tree, and 68 stale entries make that check noisier for every concurrent loop.</p>
+before touching a tree, and 68 stale entries make that check noisier for every concurrent loop.
+
+<b>Shipped &mdash; and the premise had gone stale, which is why it was worth re-checking rather than
+assuming.</b> This card's core claim is that <code>delete_branch_on_merge</code> is <code>false</code>.
+It is now <b><code>true</code></b>, and the backlog it describes is gone: against the card's
+<b>77 branches, 70 of them <code>loop/*</code></b>, the repository today carries <b>5 branches, 2
+<code>loop/*</code></b>.
+
+Two stragglers predating the setting change were still present and are now deleted:
+<code>evals-harness</code> (PR <code>#317</code>, merged) and <code>mcp-task-entrance</code>
+(PR <code>#318</code>, merged). Both were classified the way this card insists on &mdash; by
+<b>pull-request state</b>, not commit reachability &mdash; because the squash-merge point above is
+real: <code>compare(main...branch).ahead_by</code> reports every merged branch as permanently ahead,
+so reachability would have reported 0 of them deletable.
+
+Three branches remain and are deliberately <em>not</em> deleted: <code>bot/demo-gif</code> has an
+open PR (<code>#353</code>), and <code>badges</code>, <code>loop/keyless-card-dedupe</code> and
+<code>loop/sbom-in-release-job</code> have <b>no PR on record</b>. A branch with no PR cannot be shown
+to be merged, and deleting it could destroy unmerged work &mdash; so the safe rule is to leave it for
+a human, which is also why no automated pruner is proposed here.
+
+<b>No automation was added.</b> The repository setting does the job going forward; a workflow that
+deleted branches on a schedule would add a way to lose work in exchange for tidying a list that is
+now five entries long.</p>
         <div class="meta">
           <span class="m">Complexity <b>S</b></span>
           <span class="m">Impact <b>Low</b></span>
@@ -3635,7 +3687,30 @@ bodies. Both are refinements &mdash; the byte-identical case is 78.3% of the pro
 <b>Claim released.</b> The key fix and content-hash dedup have merged; what is left is a richer
 quality prior than <code>curated</code> and near-identical (rather than byte-identical) clustering.
 Unowned and ready for anyone &mdash; the byte-identical case was 78.3% of the problem, so the
-remainder is refinement rather than the bulk.</p>
+remainder is refinement rather than the bulk.
+
+<b>The quality prior is now richer than the <code>curated</code> flag alone.</b> Inside a cluster
+every copy is byte-identical, so which one survives is not a relevance question &mdash; it decides
+where the user installs from. Two signals exist and they are not the same thing: the entry's own
+<code>curated</code> flag, which is a decision this machine's owner made with
+<code>boost tap --curated</code>, and <code>confidence</code> in the shipped
+<code>registries.json</code> (high / med / low across 466 registries, currently 268 / 153 / 45).
+
+<code>rag.source_rank</code> orders on the user's flag <em>first</em> and the shipped confidence
+second, deliberately: a maintainer opinion baked into the package should never override a choice made
+on the user's own machine. An uncatalogued registry ranks below every catalogued one rather than
+above, so an unknown tap never wins by default, and equal trust falls back to ranking order so the
+result stays deterministic when there is no signal at all. The catalog is read once
+(<code>lru_cache</code>) because dedup asks per hit and parsing 466 rows inside a search loop would
+be a real cost for a value that cannot change while the process runs.
+
+Retrieval quality is untouched by construction &mdash; the gate reads 0.863 / 0.473 / 0.607 / 0.662
+before and after, because the prior only chooses between copies that are already identical.
+
+<b>Still open:</b> near-identical rather than byte-identical clustering, where
+<code>core/typosquat.py</code>'s confusion machinery would apply. Stars and recency, which the card
+also names, have no shipped data source today &mdash; adding one is its own piece of work rather than
+a tweak to this.</p>
         <div class="meta">
           <span class="m">Complexity <b>M</b></span>
           <span class="m hi">Impact <b>High</b></span>
@@ -5746,7 +5821,7 @@ same-repo PRs and red CI.</p>
       </article>
 
       <article class="cap rcard" id="code-scanning-rule-can-be-restored">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Release safety</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Release safety</span></div>
         <h3>The <code>code_scanning</code> ruleset rule can go back on &mdash; but only scoped to CodeQL</h3>
         <p>Repairing the <code>main</code> ruleset dropped its <code>code_scanning</code> rule in favour of
 <code>codeql-analyze</code> as a required status check (see
@@ -5779,7 +5854,23 @@ path filters and runs on <code>push</code>, <code>pull_request</code> and
 <code>merge_group</code>, so it always reports and cannot produce the never-reports deadlock this
 repo has hit twice. And it catches something the status check does not &mdash;
 <code>codeql-analyze</code> passes when the <em>job</em> succeeds, including when it succeeds
-having found error-severity alerts.</p>
+having found error-severity alerts.
+
+<b>Done &mdash; the rule is back, and scoped exactly as this card prescribed.</b> Read from the live
+<code>main</code> ruleset (id <code>19130332</code>): it carries a <code>code_scanning</code> rule
+whose <code>code_scanning_tools</code> list is <b><code>CodeQL</code> alone</b>, at
+<code>security_alerts_threshold: high_or_higher</code> and <code>alerts_threshold: errors</code>.
+Scorecard is not in the list, which is the single decision this card exists to get right.
+
+The safety precondition still holds and was re-checked rather than assumed: <b>CodeQL has 0 open
+alerts</b>, while Scorecard has <b>4 open</b> (down from the 7 recorded above), every one still a
+posture metric that must not be dismissed. Had Scorecard been added to that tool list, those four
+would block every merge in the repository immediately &mdash; the failure mode this card correctly
+identifies as the reason the work looked blocked.
+
+No change was needed. Recording it as shipped so the board stops advertising work that is already
+in place, and so the tool-list constraint stays written down: anyone re-editing this rule through the
+GitHub UI will be offered Scorecard right next to CodeQL in the picker.</p>
         <div class="meta">
           <span class="m">Complexity <b>S</b></span>
           <span class="m">Impact <b>Med</b></span>

boost_skill_cli-1.0.331/tests/unit/test_dedup_trust.py

@@ -0,0 +1,117 @@
+"""Which copy survives dedup, when every copy is byte-identical.
+
+Content-hash dedup collapses a cluster to one result. Because the bodies are
+identical, *which* one survives is not a relevance question at all — it decides
+where the user installs from. The roadmap card asks for "a quality prior —
+source trust, stars, recency, maintenance".
+
+Two signals exist today and they are not the same thing:
+
+* the entry's own ``curated`` flag — the user tapped that registry with
+  ``--curated``, i.e. a decision this machine's owner made;
+* ``confidence`` in the shipped ``registries.json`` — high / med / low, a
+  maintainer judgement about the registry, covering 466 registries.
+
+The user's own flag outranks the shipped default deliberately: a shipped
+opinion should never override a decision the user made on their own machine.
+Below both, ranking order breaks the tie, so the behaviour stays deterministic
+when there is no trust signal at all.
+"""
+from __future__ import annotations
+
+from boost_cli.core import rag
+
+
+def _hit(name, tap, score, content, curated=False):
+    return {"entry": {"name": name, "tap": tap, "curated": curated,
+                      "skill_md": "%s/SKILL.md" % name, "kind": "skill",
+                      "description": ""},
+            "score": score, "snippet": "", "content": content}
+
+
+class TestTrustRank:
+    """`source_rank` orders candidates; lower sorts first."""
+
+    def test_a_curated_tap_beats_an_uncurated_one(self, monkeypatch):
+        monkeypatch.setattr(rag, "registry_confidence", lambda tap: None)
+        assert rag.source_rank({"tap": "a/x", "curated": True}) < \
+               rag.source_rank({"tap": "b/y", "curated": False})
+
+    def test_high_confidence_beats_low(self, monkeypatch):
+        conf = {"a/x": "high", "b/y": "low"}
+        monkeypatch.setattr(rag, "registry_confidence", conf.get)
+        assert rag.source_rank({"tap": "a/x"}) < rag.source_rank({"tap": "b/y"})
+
+    def test_high_beats_med_beats_low(self, monkeypatch):
+        conf = {"h": "high", "m": "med", "l": "low"}
+        monkeypatch.setattr(rag, "registry_confidence", conf.get)
+        ranks = [rag.source_rank({"tap": t}) for t in ("h", "m", "l")]
+        assert ranks == sorted(ranks) and len(set(ranks)) == 3
+
+    def test_the_users_own_flag_outranks_a_shipped_high(self, monkeypatch):
+        # A shipped opinion must not override a decision made on this machine.
+        conf = {"rando": None, "shipped": "high"}
+        monkeypatch.setattr(rag, "registry_confidence", conf.get)
+        assert rag.source_rank({"tap": "rando", "curated": True}) < \
+               rag.source_rank({"tap": "shipped", "curated": False})
+
+    def test_an_unknown_registry_ranks_below_a_known_one(self, monkeypatch):
+        monkeypatch.setattr(rag, "registry_confidence",
+                            {"known": "low"}.get)
+        assert rag.source_rank({"tap": "known"}) < \
+               rag.source_rank({"tap": "never-heard-of-it"})
+
+
+class TestDedupUsesIt:
+    """The prior only matters inside a cluster of identical bodies."""
+
+    def test_a_trusted_copy_wins_over_a_better_ranked_one(self, monkeypatch):
+        monkeypatch.setattr(rag, "registry_confidence",
+                            {"rando/x": "low", "solid/y": "high"}.get)
+        hits = [_hit("rule", "rando/x", 3.0, "same"),
+                _hit("rule", "solid/y", 2.0, "same")]
+        assert rag.dedupe_by_content(hits, 10)[0]["entry"]["tap"] == "solid/y"
+
+    def test_the_cluster_keeps_its_best_score(self, monkeypatch):
+        monkeypatch.setattr(rag, "registry_confidence",
+                            {"rando/x": "low", "solid/y": "high"}.get)
+        hits = [_hit("rule", "rando/x", 3.0, "same"),
+                _hit("rule", "solid/y", 2.0, "same")]
+        assert rag.dedupe_by_content(hits, 10)[0]["score"] == 3.0
+
+    def test_equal_trust_falls_back_to_rank(self, monkeypatch):
+        monkeypatch.setattr(rag, "registry_confidence",
+                            {"a/x": "high", "b/y": "high"}.get)
+        hits = [_hit("rule", "a/x", 3.0, "same"), _hit("rule", "b/y", 2.0, "same")]
+        assert rag.dedupe_by_content(hits, 10)[0]["entry"]["tap"] == "a/x"
+
+    def test_trust_never_merges_distinct_bodies(self, monkeypatch):
+        # The prior decides *which* copy, never *whether* to collapse.
+        monkeypatch.setattr(rag, "registry_confidence",
+                            {"a/x": "high", "b/y": "low"}.get)
+        hits = [_hit("rule", "a/x", 3.0, "one body"),
+                _hit("rule", "b/y", 2.0, "a different body")]
+        assert len(rag.dedupe_by_content(hits, 10)) == 2
+
+
+class TestConfidenceLookup:
+    """Reading the shipped catalog, without paying for it on every call."""
+
+    def test_a_shipped_registry_resolves(self):
+        # Picked from registries.json; asserted as a real value, not just truthy.
+        assert rag.registry_confidence("Aaronontheweb/dotnet-cursor-rules") == "med"
+
+    def test_an_unknown_registry_is_none(self):
+        assert rag.registry_confidence("nobody/nothing") is None
+
+    def test_the_catalog_is_read_once(self, monkeypatch):
+        # 466 registries parsed per hit would be a real cost in a search loop.
+        calls = []
+        rag._confidence_map.cache_clear()
+        real = rag.config.load_registry_catalog
+        monkeypatch.setattr(rag.config, "load_registry_catalog",
+                            lambda: calls.append(1) or real())
+        rag.registry_confidence("a")
+        rag.registry_confidence("b")
+        rag.registry_confidence("c")
+        assert len(calls) == 1

{boost_skill_cli-1.0.329 → boost_skill_cli-1.0.331}/tests/unit/test_embed.py

@@ -120,9 +120,23 @@ class TestProviderSelection:
 
 
 class TestEmbed:
-    def test_none_without_provider(self, sandbox):
+    def test_none_without_provider(self, sandbox, monkeypatch):
+        # `local_available` is forced off for the same reason as the tests in
+        # TestProviderSelection: since the [rag] extra bundles a local model,
+        # "no key" no longer implies "no provider", and `embed` returns real
+        # vectors rather than None once anything has warmed that backend. Left
+        # ambient this passed or failed depending on test ORDER, which made it
+        # a latent flake rather than an assertion about the code.
+        monkeypatch.setattr(embed, "local_available", lambda: False)
         assert embed.embed(["hi"]) is None
 
+    def test_the_local_backend_alone_still_embeds(self, sandbox, monkeypatch):
+        # The other half: with no key but the extra present, embedding works.
+        # That is the keyless tier, and nothing else in this file covers it.
+        monkeypatch.setattr(embed, "local_available", lambda: True)
+        monkeypatch.setattr(embed, "_embed_local", lambda texts, **kw: [[0.1]])
+        assert embed.embed(["hi"]) == [[0.1]]
+
     def test_empty_batch_is_empty_list(self, sandbox, monkeypatch):
         monkeypatch.setenv("OPENAI_API_KEY", "o")
         assert embed.embed([]) == []