boost-skill-cli 1.0.415__tar.gz → 1.0.416__tar.gz

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416}/Makefile

@@ -52,7 +52,7 @@ mutation:
 	$(PY) scripts/mutation_gate.py --run --min 80
 
 lint:
-	$(VENV)/bin/ruff check boost_cli tests evals
+	$(VENV)/bin/ruff check boost_cli tests evals scripts
 	$(VENV)/bin/mypy
 	$(VENV)/bin/pyright
 	$(VENV)/bin/lint-imports

{boost_skill_cli-1.0.415/boost_skill_cli.egg-info → boost_skill_cli-1.0.416}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.415
+Version: 1.0.416
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.415'
-__version_tuple__ = version_tuple = (1, 0, 415)
+__version__ = version = '1.0.416'
+__version_tuple__ = version_tuple = (1, 0, 416)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.415
+Version: 1.0.416
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416}/docs/roadmap/items/scripts-under-the-lint-gate.md

@@ -1,8 +1,10 @@
 ---
 id: scripts-under-the-lint-gate
 board: code
-section: planned
-status: planned
+section: internals
+status: shipped
+owner: loop/scripts-lint
+pr: 471
 category: Tech-debt
 complexity: M
 impact: Med

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416}/docs/roadmap.html

@@ -125,7 +125,7 @@
       <!-- ROADMAP:stats -->
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
-      <div class="stat"><b>7</b><span>Planned</span></div>
+      <div class="stat"><b>6</b><span>Planned</span></div>
       <div class="stat"><b>221</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
@@ -680,36 +680,6 @@ published version works against PyPI as it stands today.</p>
           <span class="m">the artifacts already build and pass twine check in CI — what is missing is a cadence and a Trusted Publisher</span>
         </div>
       </article>
-
-      <article class="cap rcard" id="scripts-under-the-lint-gate">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Tech-debt</span></div>
-        <h3>bring <code>scripts/</code> under the ruff gate</h3>
-        <p><code>make lint</code> runs <code>ruff check boost_cli tests evals</code> — and <code>scripts/</code>,
-the 28 build-and-gate tools that decide whether every PR merges, is not in the list. Nothing that
-lints the product lints the gatekeepers.
-
-<b>Why it bit, twice in one day.</b> The <code>zip(strict=)</code> audit enforced B905 across the
-linted trees, and an adversarial review immediately found two more <code>zip()</code> sites in
-<code>scripts/</code> that the rule cannot guard — one of them (<code>eval_explain.py</code> pairing
-ragas scores with samples by position) exactly the silent-misattribution shape the audit existed to
-kill. They were fixed by hand, but the next <code>zip()</code> added to <code>scripts/</code> gets
-no intent check, and the same blindness applies to every rule the gate enforces.
-
-<b>Measured, not guessed:</b> running the current rule set over <code>scripts/</code> today finds
-<b>291</b> violations — ~277 are the mechanical UP typing sweep the rest of the repo just finished
-(<code>List</code> → <code>list</code> and friends), plus a handful of real ones (a
-<code>raise ... from</code> miss, collapsible ifs, stale <code>noqa</code>s). So the shape is: one
-mechanical pass like the pep585 sweep, a short judgement pass over the rest, then add
-<code>scripts</code> to the Makefile line and CI so it stays clean. Some rules may deserve
-per-directory ignores (scripts legitimately print, exit, and parse argv) — decide those in the PR
-rather than globally.</p>
-        <div class="meta">
-          <span class="m">Complexity <b>M</b></span>
-          <span class="m">Impact <b>Med</b></span>
-          <span class="m">Wow <b class="wow">★</b></span>
-          <span class="m">291 findings across 28 files, measured — most are the same UP sweep the package just finished</span>
-        </div>
-      </article>
       <!-- /ROADMAP:cards -->
 
     </div>
@@ -3444,6 +3414,37 @@ ownership check reverted.</p></details>
         </div>
       </article>
 
+      <article class="cap rcard" id="scripts-under-the-lint-gate">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Tech-debt</span></div>
+        <h3>bring <code>scripts/</code> under the ruff gate</h3>
+        <details class="cardbody"><summary>Write-up</summary>
+        <p><code>make lint</code> runs <code>ruff check boost_cli tests evals</code> — and <code>scripts/</code>,
+the 28 build-and-gate tools that decide whether every PR merges, is not in the list. Nothing that
+lints the product lints the gatekeepers.
+
+<b>Why it bit, twice in one day.</b> The <code>zip(strict=)</code> audit enforced B905 across the
+linted trees, and an adversarial review immediately found two more <code>zip()</code> sites in
+<code>scripts/</code> that the rule cannot guard — one of them (<code>eval_explain.py</code> pairing
+ragas scores with samples by position) exactly the silent-misattribution shape the audit existed to
+kill. They were fixed by hand, but the next <code>zip()</code> added to <code>scripts/</code> gets
+no intent check, and the same blindness applies to every rule the gate enforces.
+
+<b>Measured, not guessed:</b> running the current rule set over <code>scripts/</code> today finds
+<b>291</b> violations — ~277 are the mechanical UP typing sweep the rest of the repo just finished
+(<code>List</code> → <code>list</code> and friends), plus a handful of real ones (a
+<code>raise ... from</code> miss, collapsible ifs, stale <code>noqa</code>s). So the shape is: one
+mechanical pass like the pep585 sweep, a short judgement pass over the rest, then add
+<code>scripts</code> to the Makefile line and CI so it stays clean. Some rules may deserve
+per-directory ignores (scripts legitimately print, exit, and parse argv) — decide those in the PR
+rather than globally.</p></details>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★</b></span>
+          <span class="m">291 findings across 28 files, measured — most are the same UP sweep the package just finished</span>
+        </div>
+      </article>
+
       <article class="cap rcard" id="dry-run-promised-a-link-nobody-makes">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Correctness</span></div>
         <h3>install --dry-run predicted an install that never happens</h3>

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416}/scripts/build_command_reference.py

@@ -71,9 +71,9 @@ def _capture_parser(name: str, module: str):
     cliparse.parser = spy
     try:
         buf = io.StringIO()
-        with contextlib.redirect_stdout(buf), contextlib.redirect_stderr(buf):
-            with contextlib.suppress(SystemExit):
-                getattr(mod, fn)(["--help"])
+        with contextlib.redirect_stdout(buf), contextlib.redirect_stderr(buf), \
+                contextlib.suppress(SystemExit):
+            getattr(mod, fn)(["--help"])
     finally:
         cliparse.parser = real
     return created[0] if created else None  # main parser is created first
@@ -121,8 +121,7 @@ def _extract(name: str, group: str, module: str, summary: str) -> dict:
     for act in opt:
         flag = act.option_strings[-1]
         syn.append("[%s]" % (flag if act.nargs == 0 else "%s %s" % (flag, _metavar(act))))
-    for act in pos:
-        syn.append(_positional_syn(act))
+    syn.extend(_positional_syn(act) for act in pos)
 
     def rows(actions, is_opt):
         out = []
@@ -178,7 +177,7 @@ def render() -> str:
         for c in items:
             search = html.escape(
                 (" ".join([c["name"], c["summary"], c["description"]]
-                          + [l for l, _h in c["options"] + c["positionals"]])).lower(),
+                          + [label for label, _h in c["options"] + c["positionals"]])).lower(),
                 quote=True)
             nav.append(
                 '      <a class="cmd-link" href="#cmd-%s" data-search="%s">%s</a>'

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416}/scripts/build_scale_corpus.py

@@ -64,8 +64,8 @@ from __future__ import annotations
 import argparse
 import json
 import sys
+from collections.abc import Sequence
 from pathlib import Path
-from typing import Dict, List, Optional, Sequence, Tuple
 
 ROOT = Path(__file__).resolve().parent.parent
 REGISTRIES = ROOT / "boost_cli" / "data" / "registries.json"
@@ -86,7 +86,7 @@ DEFAULT_TARGET = 20_000
 TYPE_ORDER = ("rule", "workflow", "skill")
 
 
-def required_rows(text: str) -> List[str]:
+def required_rows(text: str) -> list[str]:
     """The required corpus's rows, verbatim, in file order."""
     return [ln.rstrip() for ln in text.splitlines()
             if ln.strip() and not ln.lstrip().startswith("#")]
@@ -97,14 +97,14 @@ def repo_of(row: str) -> str:
 
 
 def candidates(registries: Sequence[dict], exclude: Sequence[str]
-               ) -> Dict[str, List[Tuple[str, int]]]:
+               ) -> dict[str, list[tuple[str, int]]]:
     """``type -> [(repo, est_items)]``, largest first, excluding what we have.
 
     ``list_only`` rows are awesome-list indexes rather than skill trees, so they
     contribute nothing to scan and are dropped — the same distinction
     `registries.json` already draws for its own item-count math.
     """
-    out: Dict[str, List[Tuple[str, int]]] = {}
+    out: dict[str, list[tuple[str, int]]] = {}
     seen = set(exclude)
     for row in registries:
         name = str(row.get("name", ""))
@@ -117,8 +117,8 @@ def candidates(registries: Sequence[dict], exclude: Sequence[str]
     return out
 
 
-def select(pools: Dict[str, List[Tuple[str, int]]], target: int
-           ) -> List[Tuple[str, int]]:
+def select(pools: dict[str, list[tuple[str, int]]], target: int
+           ) -> list[tuple[str, int]]:
     """Round-robin across types, largest first within each, until ``target``.
 
     Deterministic: the pools are already sorted, and the cycle order is fixed.
@@ -126,7 +126,7 @@ def select(pools: Dict[str, List[Tuple[str, int]]], target: int
     ``--check`` gate is meaningless.
     """
     cursors = dict.fromkeys(pools, 0)
-    picked: List[Tuple[str, int]] = []
+    picked: list[tuple[str, int]] = []
     total = 0
     order = [k for k in TYPE_ORDER if k in pools] + \
             [k for k in sorted(pools) if k not in TYPE_ORDER]
@@ -149,7 +149,7 @@ def select(pools: Dict[str, List[Tuple[str, int]]], target: int
     return picked
 
 
-def existing_pins(text: str) -> Dict[str, str]:
+def existing_pins(text: str) -> dict[str, str]:
     """``repo -> its committed row``, so a regeneration keeps what was measured.
 
     Without this the generator and `eval_corpus.py --refresh` fight: the refresh
@@ -160,7 +160,7 @@ def existing_pins(text: str) -> Dict[str, str]:
     So `--check` verifies the *selection* — which registries are in and in what
     order — and leaves the pins to the job that actually measured them.
     """
-    out: Dict[str, str] = {}
+    out: dict[str, str] = {}
     for line in text.splitlines():
         if not line.strip() or line.lstrip().startswith("#"):
             continue
@@ -168,8 +168,8 @@ def existing_pins(text: str) -> Dict[str, str]:
     return out
 
 
-def render(required: Sequence[str], picked: Sequence[Tuple[str, int]],
-           target: int, pinned: Optional[Dict[str, str]] = None) -> str:
+def render(required: Sequence[str], picked: Sequence[tuple[str, int]],
+           target: int, pinned: dict[str, str] | None = None) -> str:
     """The taps-scale.txt text, header included."""
     pinned = pinned or {}
     est = sum(e for _n, e in picked)

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416}/scripts/check_licenses.py

@@ -29,13 +29,13 @@ from __future__ import annotations
 import json
 import re
 import sys
-from typing import List, Tuple
+from pathlib import Path
 
 # (pattern, why). Matched case-insensitively against the whole declared licence
 # string. Deliberately short: the aim is high-confidence incompatibility, not a
 # taxonomy. LGPL, MPL and EPL are all fine to *consume* from a GPL-3.0 project
 # and are not listed.
-DENIED: Tuple[Tuple[str, str], ...] = (
+DENIED: tuple[tuple[str, str], ...] = (
     (r"affero|\bagpl\b",
      "AGPL adds network-use copyleft that GPL-3.0 does not carry"),
     # GPLv2-*only* cannot be combined with GPL-3.0. "v2 or later" / "GPLv2+"
@@ -63,7 +63,7 @@ def is_undeclared(licence: str) -> bool:
     return bool(_UNDECLARED.match(licence or ""))
 
 
-def violations(rows: List[dict]) -> List[str]:
+def violations(rows: list[dict]) -> list[str]:
     """Human-readable problems in a ``pip-licenses --format=json`` payload."""
     problems = []
     for row in rows:
@@ -83,8 +83,8 @@ def violations(rows: List[dict]) -> List[str]:
     return problems
 
 
-def main(argv: List[str]) -> int:
-    raw = (open(argv[0], encoding="utf-8").read() if argv
+def main(argv: list[str]) -> int:
+    raw = (Path(argv[0]).read_text(encoding="utf-8") if argv
            else sys.stdin.read())
     try:
         rows = json.loads(raw)

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416}/scripts/check_required_checks.py

@@ -44,7 +44,6 @@ import json
 import re
 import sys
 from pathlib import Path
-from typing import Dict, List, Set, Tuple
 
 ROOT = Path(__file__).resolve().parent.parent
 WORKFLOWS = ROOT / ".github" / "workflows"
@@ -92,7 +91,7 @@ PR_ALWAYS = "always"      # fires on every PR — safe to require
 PR_FILTERED = "filtered"  # fires only on some PRs — NEVER safe to require
 
 
-def has_merge_group(header_lines: List[str]) -> bool:
+def has_merge_group(header_lines: list[str]) -> bool:
     """Does this workflow declare a ``merge_group:`` trigger?
 
     Same narrow, stdlib-only parsing as everything else here: a top-level
@@ -101,7 +100,7 @@ def has_merge_group(header_lines: List[str]) -> bool:
     return any(_MG_TRIGGER.match(line) for line in header_lines)
 
 
-def pull_request_state(header_lines: List[str]) -> str:
+def pull_request_state(header_lines: list[str]) -> str:
     """Classify the ``pull_request:`` trigger in a workflow header.
 
     Returns one of :data:`PR_NONE`, :data:`PR_ALWAYS`, :data:`PR_FILTERED`.
@@ -143,7 +142,7 @@ def _strip_quotes(s: str) -> str:
     return s
 
 
-def parse_workflow(path: Path) -> Tuple[str, bool, Dict[str, str]]:
+def parse_workflow(path: Path) -> tuple[str, bool, dict[str, str]]:
     """``(pull_request_state, has_merge_group, {job_id: display_name})``."""
     lines = path.read_text(encoding="utf-8").splitlines()
     try:
@@ -154,7 +153,7 @@ def parse_workflow(path: Path) -> Tuple[str, bool, Dict[str, str]]:
     on_pr = pull_request_state(lines[:jobs_at])
     on_mg = has_merge_group(lines[:jobs_at])
 
-    jobs: Dict[str, str] = {}
+    jobs: dict[str, str] = {}
     current = None
     for line in lines[jobs_at + 1:]:
         job = _JOB.match(line)
@@ -169,17 +168,17 @@ def parse_workflow(path: Path) -> Tuple[str, bool, Dict[str, str]]:
     return on_pr, on_mg, jobs
 
 
-def collect() -> Tuple[Dict[str, List[str]], Set[str], Dict[str, str], Set[str]]:
+def collect() -> tuple[dict[str, list[str]], set[str], dict[str, str], set[str]]:
     """``({check_name: [workflow, ...]}, {on every PR}, {name: workflow}, {on merge_group})``.
 
     The third value maps a *conditionally*-triggered check name to the workflow
     that narrows it, so the error message can name the culprit. The fourth is
     the set of names that would also report on a merge-queue ref.
     """
-    by_name: Dict[str, List[str]] = {}
-    on_pr: Set[str] = set()
-    filtered: Dict[str, str] = {}
-    on_mg: Set[str] = set()
+    by_name: dict[str, list[str]] = {}
+    on_pr: set[str] = set()
+    filtered: dict[str, str] = {}
+    on_mg: set[str] = set()
     files = sorted(WORKFLOWS.glob("*.yml")) + sorted(WORKFLOWS.glob("*.yaml"))
     if not files:
         raise SystemExit("required-checks: no workflow files found under %s" % WORKFLOWS)
@@ -204,7 +203,7 @@ def collect() -> Tuple[Dict[str, List[str]], Set[str], Dict[str, str], Set[str]]
     return by_name, on_pr, filtered, on_mg
 
 
-def read_config() -> List[str]:
+def read_config() -> list[str]:
     if not CONFIG.exists():
         raise SystemExit("required-checks: missing %s" % CONFIG)
     out = []
@@ -217,7 +216,7 @@ def read_config() -> List[str]:
     return out
 
 
-def resolve(required: str, on_pr: Set[str]) -> Tuple[bool, str]:
+def resolve(required: str, on_pr: set[str]) -> tuple[bool, str]:
     """Is ``required`` satisfied by some job name in ``on_pr``?
 
     Called twice — once against the names that run on every PR, and once
@@ -242,7 +241,7 @@ def resolve(required: str, on_pr: Set[str]) -> Tuple[bool, str]:
     return False, ""
 
 
-def workflows_for(required: str, by_name: Dict[str, List[str]]) -> List[str]:
+def workflows_for(required: str, by_name: dict[str, list[str]]) -> list[str]:
     """Which workflow file(s) produce ``required``.
 
     Accepts the same three spellings :func:`resolve` does — an exact name, a
@@ -262,7 +261,7 @@ def workflows_for(required: str, by_name: Dict[str, List[str]]) -> List[str]:
     return ["an unknown workflow"]
 
 
-def classic_payload(required: List[str]) -> dict:
+def classic_payload(required: list[str]) -> dict:
     """The `PUT /branches/{branch}/protection` body for this required list."""
     return {
         "required_status_checks": {"strict": True, "contexts": list(required)},
@@ -274,7 +273,7 @@ def classic_payload(required: List[str]) -> dict:
     }
 
 
-def ruleset_rule(required: List[str]) -> dict:
+def ruleset_rule(required: list[str]) -> dict:
     """The `required_status_checks` RULE for a repository ruleset.
 
     Shaped differently from the classic payload on purpose — this is not a
@@ -294,7 +293,7 @@ def ruleset_rule(required: List[str]) -> dict:
     }
 
 
-def drift(required: List[str], remote: List[str]) -> Tuple[List[str], List[str]]:
+def drift(required: list[str], remote: list[str]) -> tuple[list[str], list[str]]:
     """``(missing, extra)`` — how a live mechanism disagrees with the file.
 
     Order-insensitive and duplicate-tolerant: GitHub returns contexts in its own
@@ -315,7 +314,7 @@ def _api(path: str, token: str) -> object:
         return json.load(resp)
 
 
-def ruleset_contexts(detail: dict) -> Tuple[bool, List[str]]:
+def ruleset_contexts(detail: dict) -> tuple[bool, list[str]]:
     """``(has_rule, contexts)`` for one ruleset's required-status-checks rule.
 
     ``has_rule`` is returned separately from an empty list because the two mean
@@ -329,9 +328,9 @@ def ruleset_contexts(detail: dict) -> Tuple[bool, List[str]]:
     return False, []
 
 
-def verify_remote(required: List[str], token: str) -> List[str]:
+def verify_remote(required: list[str], token: str) -> list[str]:
     """Compare BOTH live mechanisms against the file. Returns problems."""
-    problems: List[str] = []
+    problems: list[str] = []
 
     prot = _api("/repos/%s/branches/%s/protection" % (REPO, BRANCH), token)
     contexts = ((prot or {}).get("required_status_checks") or {}).get("contexts", [])
@@ -377,7 +376,7 @@ def verify_remote(required: List[str], token: str) -> List[str]:
     return problems
 
 
-def main(argv: List[str]) -> int:
+def main(argv: list[str]) -> int:
     ap = argparse.ArgumentParser(description=__doc__)
     ap.add_argument("--print-api", action="store_true",
                     help="print the CLASSIC branch-protection payload and exit")
@@ -436,7 +435,7 @@ def main(argv: List[str]) -> int:
               "(%d checks)." % (CONFIG.name, len(required)))
         return 0
 
-    problems: List[str] = []
+    problems: list[str] = []
 
     ambiguous = {n: w for n, w in sorted(by_name.items()) if len(w) > 1}
     for name, where in ambiguous.items():

{boost_skill_cli-1.0.415 → boost_skill_cli-1.0.416}/scripts/eval_corpus.py

@@ -77,8 +77,8 @@ import argparse
 import re
 import subprocess
 import sys
+from collections.abc import Sequence
 from pathlib import Path
-from typing import Dict, List, Optional, Sequence, Tuple
 
 ROOT = Path(__file__).resolve().parent.parent
 DEFAULT_TAPS = ROOT / "tests" / "eval" / "taps.txt"
@@ -89,7 +89,7 @@ SCALE_TAPS = ROOT / "tests" / "eval" / "taps-scale.txt"
 _SHA = re.compile(r"[0-9a-f]{40}")
 
 #: ``(owner/repo, pinned commit or None, pinned entry count or None)``.
-Row = Tuple[str, Optional[str], Optional[int]]
+Row = tuple[str, str | None, int | None]
 
 #: A repository, or the commit a row pins, could not be fetched.
 UNAVAILABLE = "unavailable"
@@ -129,7 +129,7 @@ class CorpusError(RuntimeError):
         self.detail = detail
 
 
-def parse_taps(text: str) -> List[Row]:
+def parse_taps(text: str) -> list[Row]:
     """Rows of ``owner/repo [sha [count]]``, comments and blanks dropped.
 
     An absent SHA parses as ``None`` rather than an error so the format stays
@@ -139,7 +139,7 @@ def parse_taps(text: str) -> List[Row]:
     fatal on the same grounds, and requires a SHA — a count beside an unpinned
     repo describes a tree that is free to change underneath it.
     """
-    rows: List[Row] = []
+    rows: list[Row] = []
     for raw in text.splitlines():
         line = raw.strip()
         if not line or line.startswith("#"):
@@ -170,7 +170,7 @@ def parse_taps(text: str) -> List[Row]:
     return rows
 
 
-def shares(rows: Sequence[Row]) -> List[Tuple[str, int, float]]:
+def shares(rows: Sequence[Row]) -> list[tuple[str, int, float]]:
     """``(repo, count, share)`` for every counted row, largest first.
 
     Rows with no recorded count are omitted rather than treated as zero: a
@@ -185,7 +185,7 @@ def shares(rows: Sequence[Row]) -> List[Tuple[str, int, float]]:
                   key=lambda row: (-row[1], row[0]))
 
 
-def check_concentration(rows: Sequence[Row]) -> Optional[str]:
+def check_concentration(rows: Sequence[Row]) -> str | None:
     """Return a message when one repository exceeds ``MAX_SHARE``, else ``None``.
 
     Static — it reads the counts already in the file, so it costs no network and
@@ -208,7 +208,7 @@ def check_concentration(rows: Sequence[Row]) -> Optional[str]:
                MAX_SHARE * 100))
 
 
-def extra_taps(configured: Sequence[str], pinned: Sequence[str]) -> List[str]:
+def extra_taps(configured: Sequence[str], pinned: Sequence[str]) -> list[str]:
     """Configured taps that this list does not pin, sorted.
 
     The third way to score a corpus that is not the pinned one, and the easiest
@@ -261,7 +261,7 @@ def pin_clone(path: Path, sha: str) -> None:
 
 
 def _materialise(rows: Sequence[Row], verify: bool = True
-                 ) -> Tuple[Dict[str, int], List[CorpusError]]:
+                 ) -> tuple[dict[str, int], list[CorpusError]]:
     """Tap, pin and rescan every row. Returns ``(counts, failures)``.
 
     Every row is attempted even after one fails. Stopping at the first would
@@ -271,8 +271,8 @@ def _materialise(rows: Sequence[Row], verify: bool = True
     sys.path.insert(0, str(ROOT))
     from boost_cli.core import catalog, registry  # deferred: repo-root import shim
 
-    counts: Dict[str, int] = {}
-    failures: List[CorpusError] = []
+    counts: dict[str, int] = {}
+    failures: list[CorpusError] = []
     for repo, sha, want in rows:
         try:
             try:
@@ -345,8 +345,8 @@ def _report_failures(failures: Sequence[CorpusError], total_rows: int) -> int:
     return EXIT_DRIFT if drift else EXIT_UNAVAILABLE
 
 
-def relock_text(text: str, counts: Dict[str, int],
-                shas: Optional[Dict[str, str]] = None) -> str:
+def relock_text(text: str, counts: dict[str, int],
+                shas: dict[str, str] | None = None) -> str:
     """Rewrite each pinned row's entry count — and its SHA when ``shas`` says so.
 
     A whole-file rewrite would lose the header, which is where the reasoning
@@ -379,8 +379,8 @@ def relock_text(text: str, counts: Dict[str, int],
     return "\n".join(out) + ("\n" if text.endswith("\n") else "")
 
 
-def refresh_summary(rows: Sequence[Row], shas: Dict[str, str],
-                    counts: Dict[str, int]) -> str:
+def refresh_summary(rows: Sequence[Row], shas: dict[str, str],
+                    counts: dict[str, int]) -> str:
     """A Markdown table of what a refresh moved, for the pull request body.
 
     The point of the scheduled refresh is not the refresh — it is that the diff
@@ -446,7 +446,7 @@ def _ensure(taps: Path, relock: bool = False) -> int:
     return 0
 
 
-def _refresh(taps: Path, summary_path: Optional[str] = None) -> int:
+def _refresh(taps: Path, summary_path: str | None = None) -> int:
     """Move every row to current upstream HEAD, re-measure, rewrite taps.txt.
 
     Pinning bought reproducibility with representativeness: the gate measures
@@ -465,9 +465,9 @@ def _refresh(taps: Path, summary_path: Optional[str] = None) -> int:
     from boost_cli.core import catalog, gitutil, registry  # deferred: path shim
 
     rows = parse_taps(taps.read_text(encoding="utf-8"))
-    shas: Dict[str, str] = {}
-    counts: Dict[str, int] = {}
-    failures: List[CorpusError] = []
+    shas: dict[str, str] = {}
+    counts: dict[str, int] = {}
+    failures: list[CorpusError] = []
     for repo, old_sha, _n in rows:
         try:
             try:
@@ -534,7 +534,7 @@ def _audit(taps: Path) -> int:
     return 0
 
 
-def main(argv: Optional[List[str]] = None) -> int:
+def main(argv: list[str] | None = None) -> int:
     p = argparse.ArgumentParser(prog="eval_corpus.py", description=__doc__)
     p.add_argument("--ensure", action="store_true",
                    help="tap, pin and verify every row, then rebuild its cache")