boost-skill-cli 1.0.61__tar.gz → 1.0.63__tar.gz

{boost_skill_cli-1.0.61 → boost_skill_cli-1.0.63}/.gitattributes

@@ -2,3 +2,4 @@
 # CONTRIBUTING.md "Generated files"). Marked linguist-generated so GitHub
 # collapses their diffs and excludes them from language stats.
 boost_cli/data/registries.json linguist-generated=true
+docs/roadmap.html              linguist-generated=true

{boost_skill_cli-1.0.61 → boost_skill_cli-1.0.63}/CONTRIBUTING.md

@@ -42,10 +42,22 @@ drifts from its source (CI fails the build otherwise):
 | Generated file | Source of truth | Regenerate with |
 |---|---|---|
 | `boost_cli/data/registries.json` | `SKILLS`/`RULES`/`WORKFLOWS` tuples in `scripts/build_registries.py` | `python3 scripts/build_registries.py` |
+| `docs/roadmap.html` | one file per item under `docs/roadmap/items/` | `python3 scripts/build_roadmap.py` |
 
-CI runs `python3 scripts/build_registries.py --check` and fails on drift; the
-same guard lives in `tests/unit/test_registries_fresh.py`. Regenerating last also
-keeps line-adjacent JSON conflicts between parallel branches rare.
+Or regenerate everything at once with `make generate`. CI runs the matching
+`--check` for each and fails on drift; the same guards live in
+`tests/unit/test_registries_fresh.py` and `tests/unit/test_roadmap_fresh.py`.
+
+### The roadmap is data-driven — add items, don't edit the HTML
+
+To add or change a roadmap card, create/edit a small Markdown-with-frontmatter
+file under `docs/roadmap/items/` and run `python3 scripts/build_roadmap.py`.
+**Never hand-edit the `<article>` cards or the snapshot counters in
+`docs/roadmap.html`** — they are regenerated, and the counters are computed. This
+is what lets parallel loops work the roadmap without colliding: two loops adding
+two items create two different files (clean merge); a status change edits one
+small file instead of a shared line in a 1,400-line document. Regenerating last
+also keeps line-adjacent conflicts rare.
 
 ## Pull requests
 

{boost_skill_cli-1.0.61 → boost_skill_cli-1.0.63}/Makefile

@@ -35,6 +35,13 @@ mutation:
 lint:
 	$(VENV)/bin/ruff check boost_cli tests
 	$(VENV)/bin/mypy
+	$(PY) scripts/build_registries.py --check
+	$(PY) scripts/build_roadmap.py --check
+
+# regenerate generated artifacts from their source (registries + roadmap boards)
+generate:
+	$(PY) scripts/build_registries.py
+	$(PY) scripts/build_roadmap.py
 
 # regenerate docs/demo.gif (brew install vhs)
 demo:

{boost_skill_cli-1.0.61 → boost_skill_cli-1.0.63}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.61
+Version: 1.0.63
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.61 → boost_skill_cli-1.0.63}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.61'
-__version_tuple__ = version_tuple = (1, 0, 61)
+__version__ = version = '1.0.63'
+__version_tuple__ = version_tuple = (1, 0, 63)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.61 → boost_skill_cli-1.0.63}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.61
+Version: 1.0.63
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

boost_skill_cli-1.0.63/boost_skill_cli.egg-info/SOURCES.txt

@@ -0,0 +1,202 @@
+.gitattributes
+.gitignore
+CLAUDE.md
+CONTRIBUTING.md
+LICENSE
+MANIFEST.in
+Makefile
+README.md
+SECURITY.md
+boost
+index.html
+pyproject.toml
+setup.cfg
+boost_cli/__init__.py
+boost_cli/__main__.py
+boost_cli/_version.py
+boost_cli/cli.py
+boost_cli/cliparse.py
+boost_cli/errors.py
+boost_cli/spin.py
+boost_cli/commands/__init__.py
+boost_cli/commands/bmad.py
+boost_cli/commands/configuration.py
+boost_cli/commands/discovery.py
+boost_cli/commands/hooks.py
+boost_cli/commands/info.py
+boost_cli/commands/intelligence.py
+boost_cli/commands/pkg.py
+boost_cli/commands/quality.py
+boost_cli/commands/taps.py
+boost_cli/commands/team.py
+boost_cli/core/__init__.py
+boost_cli/core/agents.py
+boost_cli/core/ai.py
+boost_cli/core/catalog.py
+boost_cli/core/claude_settings.py
+boost_cli/core/config.py
+boost_cli/core/dense.py
+boost_cli/core/embed.py
+boost_cli/core/frontmatter.py
+boost_cli/core/gitutil.py
+boost_cli/core/journal.py
+boost_cli/core/lockfile.py
+boost_cli/core/logs.py
+boost_cli/core/mcp.py
+boost_cli/core/output.py
+boost_cli/core/paths.py
+boost_cli/core/policy.py
+boost_cli/core/rag.py
+boost_cli/core/registry.py
+boost_cli/core/store.py
+boost_cli/core/util.py
+boost_cli/data/registries.json
+boost_skill_cli.egg-info/PKG-INFO
+boost_skill_cli.egg-info/SOURCES.txt
+boost_skill_cli.egg-info/dependency_links.txt
+boost_skill_cli.egg-info/entry_points.txt
+boost_skill_cli.egg-info/requires.txt
+boost_skill_cli.egg-info/top_level.txt
+docs/DEBUGGING.md
+docs/demo.gif
+docs/demo.tape
+docs/design-roadmap.html
+docs/index.html
+docs/mcp-hub.html
+docs/rag-architecture.md
+docs/roadmap.html
+docs/.claude/settings.local.json
+docs/roadmap/items/accessibility-audit-pa11y-ci-axe-core.md
+docs/roadmap/items/atomic-corruption-safe-lock-file-writes.md
+docs/roadmap/items/atomic-skill-install-temp-dir-swap.md
+docs/roadmap/items/autonomous-ship-workflow-and-isolated-worktree.md
+docs/roadmap/items/bring-commands-under-mutation-testing.md
+docs/roadmap/items/broken-link-and-anchor-checking-lychee.md
+docs/roadmap/items/build-provenance-slsa-attestations.md
+docs/roadmap/items/cache-the-catalog-entry-set-across-rag-queries.md
+docs/roadmap/items/capability-manifest-and-least-privilege-policy.md
+docs/roadmap/items/clean-env-install-smoke-pip-and-pipx.md
+docs/roadmap/items/command-reference-docs-site.md
+docs/roadmap/items/complexity-and-dead-code-radar-xenon-vulture.md
+docs/roadmap/items/consolidate-skill-staleness-drift-logic-into-cor.md
+docs/roadmap/items/coverage-dashboard-codecov-free-for-oss.md
+docs/roadmap/items/coverage-guided-fuzzing-atheris-oss-fuzz.md
+docs/roadmap/items/crash-recorder-error-paths-core-logs-py.md
+docs/roadmap/items/dependency-cve-gate-pip-audit.md
+docs/roadmap/items/docstring-coverage-interrogate.md
+docs/roadmap/items/end-of-options-guard-on-git-commands.md
+docs/roadmap/items/extension-free-tests-core-dense-py.md
+docs/roadmap/items/extract-mcp-http-servers-out-of-configuration-py.md
+docs/roadmap/items/finish-mutation-hardening-across-core.md
+docs/roadmap/items/fix-self-update-version-detection-dead-branch.md
+docs/roadmap/items/frontmatter-scalar-over-coercion.md
+docs/roadmap/items/github-pages-deploy-is-broken-every-push.md
+docs/roadmap/items/guard-output-table-against-ragged-rows.md
+docs/roadmap/items/hash-pinned-reproducible-toolchain-uv-lock.md
+docs/roadmap/items/html-validation-html-validate.md
+docs/roadmap/items/integrity-verification-boost-verify.md
+docs/roadmap/items/layering-guard-import-linter.md
+docs/roadmap/items/lighthouse-ci-on-the-pages-site.md
+docs/roadmap/items/localize-the-stored-bm25-snippet.md
+docs/roadmap/items/lockfile-enforcement-and-commit-pinning.md
+docs/roadmap/items/lowest-version-resolution-uv-resolution-lowest-d.md
+docs/roadmap/items/make-the-roadmaps-discoverable.md
+docs/roadmap/items/markdown-consistency-markdownlint-cli2.md
+docs/roadmap/items/memoize-config-load-in-process.md
+docs/roadmap/items/modernization-smells-refurb-pyupgrade.md
+docs/roadmap/items/mutation-hardening-core-frontmatter-py.md
+docs/roadmap/items/mutation-hardening-core-gitutil-py.md
+docs/roadmap/items/mutation-hardening-core-store-py.md
+docs/roadmap/items/one-command-every-env-nox.md
+docs/roadmap/items/one-shared-atomic-write-helper.md
+docs/roadmap/items/package-metadata-validation-twine-check-friends.md
+docs/roadmap/items/patch-coverage-gate-diff-cover.md
+docs/roadmap/items/performance-regression-gate-pytest-benchmark.md
+docs/roadmap/items/post-deploy-smoke-headless-load-check.md
+docs/roadmap/items/pre-release-python-canary-3-14t-free-threaded.md
+docs/roadmap/items/promote-nav-footer-into-the-shared-style-system.md
+docs/roadmap/items/prompt-injection-scanning-of-skill-markdown.md
+docs/roadmap/items/property-based-tests-hypothesis-on-the-parsers.md
+docs/roadmap/items/prose-and-terminology-linting-vale.md
+docs/roadmap/items/prune-ignored-dirs-during-scan-dir-walk.md
+docs/roadmap/items/quality-dashboard-sonarcloud-free-for-oss.md
+docs/roadmap/items/reconcile-the-theme-drift.md
+docs/roadmap/items/refresh-the-marketing-surface.md
+docs/roadmap/items/reuse-helpers-kill-minor-dead-work.md
+docs/roadmap/items/robust-tag-argument-parsing.md
+docs/roadmap/items/runner-egress-monitoring-stepsecurity-harden-run.md
+docs/roadmap/items/sbom-aware-scanning-osv-scanner.md
+docs/roadmap/items/sbom-on-every-release-cyclonedx-syft.md
+docs/roadmap/items/second-type-checker-pyright.md
+docs/roadmap/items/secret-and-pii-scanning-of-installed-skills.md
+docs/roadmap/items/secret-scanning-gitleaks-push-protection.md
+docs/roadmap/items/security-linting-bandit-via-ruff-s-rules.md
+docs/roadmap/items/shift-left-gate-pre-commit-pre-commit-ci.md
+docs/roadmap/items/single-imperative-rule-extractor.md
+docs/roadmap/items/single-tech-stack-prober.md
+docs/roadmap/items/split-oversized-command-modules.md
+docs/roadmap/items/startup-and-import-time-budget-x-importtime.md
+docs/roadmap/items/stop-re-serializing-entry-meta-on-every-search.md
+docs/roadmap/items/supply-chain-posture-openssf-scorecard.md
+docs/roadmap/items/tap-signing-and-provenance-sigstore-minisign.md
+docs/roadmap/items/theme-asset-linting-stylelint-eslint.md
+docs/roadmap/items/typo-detection-codespell.md
+docs/roadmap/items/typosquat-and-name-confusion-detection.md
+docs/roadmap/items/unify-tilde-two-copies-have-a-boundary-bug.md
+docs/roadmap/items/untrack-generated-build-noise.md
+docs/roadmap/items/update-diff-before-apply.md
+docs/roadmap/items/visual-regression-pass-on-the-guide.md
+docs/roadmap/items/widen-the-ruff-rule-surface-b-sim-c4-perf-ruf.md
+docs/roadmap/items/windows-in-the-ci-matrix.md
+docs/roadmap/items/workflow-linting-actionlint.md
+docs/roadmap/items/workflow-sast-zizmor.md
+scripts/build_registries.py
+scripts/build_roadmap.py
+scripts/mutation_gate.py
+style/README.md
+style/boost.css
+style/boost.js
+style/demo.html
+tests/conftest.py
+tests/make_fixture.py
+tests/smoke.sh
+tests/functional/test_cli_bmad.py
+tests/functional/test_cli_configuration.py
+tests/functional/test_cli_discovery.py
+tests/functional/test_cli_hooks.py
+tests/functional/test_cli_info.py
+tests/functional/test_cli_intelligence.py
+tests/functional/test_cli_pkg.py
+tests/functional/test_cli_quality.py
+tests/functional/test_cli_taps.py
+tests/functional/test_cli_team.py
+tests/functional/test_everyday_loop.py
+tests/unit/test_agents.py
+tests/unit/test_ai.py
+tests/unit/test_catalog.py
+tests/unit/test_claude_settings.py
+tests/unit/test_cliparse.py
+tests/unit/test_config.py
+tests/unit/test_dense.py
+tests/unit/test_dense_fallback.py
+tests/unit/test_embed.py
+tests/unit/test_errors_and_cli_table.py
+tests/unit/test_frontmatter.py
+tests/unit/test_gitutil.py
+tests/unit/test_journal.py
+tests/unit/test_lockfile.py
+tests/unit/test_logs.py
+tests/unit/test_mcp.py
+tests/unit/test_mutation_hardening.py
+tests/unit/test_output.py
+tests/unit/test_paths.py
+tests/unit/test_policy.py
+tests/unit/test_rag.py
+tests/unit/test_registries_fresh.py
+tests/unit/test_registry.py
+tests/unit/test_roadmap_fresh.py
+tests/unit/test_spin.py
+tests/unit/test_store.py
+tests/unit/test_token_parity.py
+tests/unit/test_util.py
+tests/unit/test_version.py

boost_skill_cli-1.0.63/docs/roadmap/items/accessibility-audit-pa11y-ci-axe-core.md

@@ -0,0 +1,20 @@
+---
+id: accessibility-audit-pa11y-ci-axe-core
+board: code
+section: docsite
+status: planned
+category: Quality · A11y
+complexity: M
+impact: Med
+wow: 4
+note: WCAG AA
+order: 3
+owner:
+pr:
+title: Accessibility audit — <code>pa11y-ci</code> / axe-core
+---
+Run WCAG checks over the rendered pages: colour contrast, focus order,
+           alt text and ARIA. The Aurora palette leans on muted
+           <code>--text-2/--text-3</code> tokens against dark glass — exactly where
+           contrast ratios slip below AA. Catches the a11y regressions a purely
+           visual review misses.

boost_skill_cli-1.0.63/docs/roadmap/items/atomic-corruption-safe-lock-file-writes.md

@@ -0,0 +1,16 @@
+---
+id: atomic-corruption-safe-lock-file-writes
+board: code
+section: internals
+status: next
+category: Correctness · Robustness
+complexity: M
+impact: High
+wow: 4
+note: 
+order: 1
+owner:
+pr:
+title: Atomic, corruption-safe lock-file writes
+---
+<code>read()</code> returns an empty skeleton on <b>any</b> JSON error and <code>write()</code> is a bare <code>write_text</code> at <code>core/lockfile.py:55</code>. An interrupted or concurrent write truncates the lock — the next <code>set_skill()</code> then <b>permanently drops every prior install record</b> while store dirs linger as orphans. Write to a temp file + <code>os.replace()</code>, and tell "empty" apart from "corrupt".

boost_skill_cli-1.0.63/docs/roadmap/items/atomic-skill-install-temp-dir-swap.md

@@ -0,0 +1,16 @@
+---
+id: atomic-skill-install-temp-dir-swap
+board: code
+section: internals
+status: planned
+category: Robustness
+complexity: M
+impact: Med
+wow: 3
+note: 
+order: 7
+owner:
+pr:
+title: Atomic skill install (temp-dir swap)
+---
+<code>_copy_skill</code> does <code>rmtree(dest)</code> then <code>copytree()</code> (<code>core/store.py:108–131</code>); an interrupt between the two leaves a missing or half-copied skill, and the lock is written afterward — so a mid-copy failure leaves store and lock <b>disagreeing</b>. Copy to a temp dir and atomically swap into place.

boost_skill_cli-1.0.63/docs/roadmap/items/autonomous-ship-workflow-and-isolated-worktree.md

@@ -0,0 +1,19 @@
+---
+id: autonomous-ship-workflow-and-isolated-worktree
+board: code
+section: shipped
+status: shipped
+category: Infra · DX
+complexity: L
+impact: High
+wow: 4
+note: 
+order: 6
+owner:
+pr:
+title: Autonomous ship-workflow & isolated worktree
+---
+The loop now runs commit → PR → green CI → squash-merge → release in a
+           dedicated <code>~/boost-loop</code> git worktree (own venv for mutmut),
+           and modern <strong>git&nbsp;2.55</strong> replaced a 2017 build that
+           fatally choked on the global <code>zdiff3</code> config.

boost_skill_cli-1.0.63/docs/roadmap/items/bring-commands-under-mutation-testing.md

@@ -0,0 +1,18 @@
+---
+id: bring-commands-under-mutation-testing
+board: code
+section: planned
+status: planned
+category: Testing · Gap
+complexity: XL
+impact: High
+wow: 3
+note: 
+order: 2
+owner:
+pr:
+title: Bring <code>commands/</code> under mutation testing
+---
+The ~5,000-line CLI command layer has <strong>zero</strong> mutation
+           coverage today — mutmut is scoped to <code>core/</code> only. Extend
+           the gate (or a second gate) to the command groups.

boost_skill_cli-1.0.63/docs/roadmap/items/broken-link-and-anchor-checking-lychee.md

@@ -0,0 +1,20 @@
+---
+id: broken-link-and-anchor-checking-lychee
+board: code
+section: docsite
+status: planned
+category: Quality · Docs
+complexity: S
+impact: Med
+wow: 3
+note: URLs + anchors
+order: 5
+owner:
+pr:
+title: Broken-link &amp; anchor checking — <code>lychee</code>
+---
+Fast, free link checker over the README and <code>docs/*.html</code>:
+           verifies external URLs (GitHub, PyPI), asset paths
+           (<code>../style/boost.css</code>) and in-page anchors
+           (<code>#next</code>, <code>#health</code>) still resolve. A dead link in
+           the landing page is the first broken promise a visitor sees.

boost_skill_cli-1.0.63/docs/roadmap/items/build-provenance-slsa-attestations.md

@@ -0,0 +1,20 @@
+---
+id: build-provenance-slsa-attestations
+board: code
+section: pipeline
+status: planned
+category: Security · Supply chain
+complexity: S
+impact: Med
+wow: 4
+note: SLSA build L2
+order: 3
+owner:
+pr:
+title: Build provenance — SLSA attestations
+---
+<code>actions/attest-build-provenance</code> emits a cryptographically
+           signed, verifiable record of <em>which workflow built which wheel from
+           which commit</em>, layered on top of the existing PyPI Trusted
+           Publishing. Consumers can <code>gh attestation verify</code> the
+           artifact they install — provenance without a paid signing service.

boost_skill_cli-1.0.63/docs/roadmap/items/cache-the-catalog-entry-set-across-rag-queries.md

@@ -0,0 +1,16 @@
+---
+id: cache-the-catalog-entry-set-across-rag-queries
+board: code
+section: internals
+status: planned
+category: Performance
+complexity: M
+impact: Med
+wow: 3
+note: 
+order: 10
+owner:
+pr:
+title: Cache the catalog entry-set across RAG queries
+---
+<code>rag.retrieve()</code> calls <code>all_entries()</code>, which reads &amp; <code>json.loads</code> <b>every tap cache on every search</b> to build the live map (<code>rag.py:323 · catalog.py:166–181</code>) — the BM25 index is mtime-cached, the entry set is not. Memoize the entry set on cache mtime the same way.

boost_skill_cli-1.0.63/docs/roadmap/items/capability-manifest-and-least-privilege-policy.md

@@ -0,0 +1,20 @@
+---
+id: capability-manifest-and-least-privilege-policy
+board: code
+section: trust
+status: planned
+category: Security · Policy
+complexity: L
+impact: Med
+wow: 4
+note: builds on policy.py
+order: 8
+owner:
+pr:
+title: Capability manifest & least-privilege policy
+---
+Extend the existing <code>policy.py</code> so a skill declares the
+           capabilities it expects — network, shell, file scope — and the user's
+           policy allows or denies them. Turns install-time governance into
+           least-privilege for the instructions an agent is about to run, the
+           natural next step for a tool that already blocks installs by policy.

boost_skill_cli-1.0.63/docs/roadmap/items/clean-env-install-smoke-pip-and-pipx.md

@@ -0,0 +1,21 @@
+---
+id: clean-env-install-smoke-pip-and-pipx
+board: code
+section: compat
+status: planned
+category: Testing · Install
+complexity: S
+impact: High
+wow: 4
+note: tests the real artifact
+order: 2
+owner:
+pr:
+title: Clean-env install smoke — pip &amp; <code>pipx</code>
+---
+Every gate runs against an editable <code>pip install -e .</code>, which
+           hides missing package-data, a broken entry point or an undeclared
+           dependency. A job that <code>pip install</code>s the built wheel into a
+           <em>fresh</em> venv (and <code>pipx install</code>s it) then runs
+           <code>boost --version</code> proves the artifact a user actually gets
+           works.

boost_skill_cli-1.0.63/docs/roadmap/items/command-reference-docs-site.md

@@ -0,0 +1,24 @@
+---
+id: command-reference-docs-site
+board: code
+section: docsite
+status: planned
+category: Docs · Command reference
+complexity: M
+impact: High
+wow: 4
+note: Read the Docs–style
+order: 10
+owner:
+pr:
+title: Command reference documentation site
+---
+boost has no browsable command reference — help lives only in
+           <code>--help</code> output and scattered README prose, so there's no
+           versioned, searchable home for what each command does. Build a proper
+           docs site in the shape of
+           <a href="https://learning-python.readthedocs.io/en/latest/">learning-python.readthedocs.io</a>:
+           a left-nav tree of commands, per-command pages (synopsis, flags,
+           examples, exit codes), and full-text search. Generate the command
+           pages from the CLI's own definitions so the docs can't drift from the
+           code, and publish alongside the existing Pages site under the Aurora theme.

boost_skill_cli-1.0.63/docs/roadmap/items/complexity-and-dead-code-radar-xenon-vulture.md

@@ -0,0 +1,20 @@
+---
+id: complexity-and-dead-code-radar-xenon-vulture
+board: code
+section: health
+status: planned
+category: Quality · Smell
+complexity: M
+impact: Med
+wow: 2
+note: commands/ first
+order: 5
+owner:
+pr:
+title: Complexity &amp; dead-code radar — <code>xenon</code> · <code>vulture</code>
+---
+Gate CI on a maintainability grade with <code>xenon</code> (built on
+           <code>radon</code>) and flag unreachable branches, unused arguments and
+           orphan helpers with <code>vulture</code>. First target: the
+           ~5,000-line <code>commands/</code> layer that has no complexity signal
+           today. Surfaces the structural smells mutation testing can't see.

boost_skill_cli-1.0.63/docs/roadmap/items/consolidate-skill-staleness-drift-logic-into-cor.md

@@ -0,0 +1,16 @@
+---
+id: consolidate-skill-staleness-drift-logic-into-cor
+board: code
+section: internals
+status: next
+category: Correctness
+complexity: M
+impact: High
+wow: 3
+note: 
+order: 3
+owner:
+pr:
+title: Consolidate skill-staleness / drift logic into core
+---
+The "is this skill outdated" decision — <code>semver_gt</code> → commit compare → <code>sha256_dir</code> vs lock — is reimplemented nearly verbatim in <code>cmd_update</code>, <code>cmd_outdated</code> and <code>_drift_status</code> (<code>pkg.py:277 · taps.py:225 · quality.py:120</code>). Three copies of core business logic that <b>will drift apart</b>. Make it one <code>core</code> function the commands render.

boost_skill_cli-1.0.63/docs/roadmap/items/coverage-dashboard-codecov-free-for-oss.md

@@ -0,0 +1,20 @@
+---
+id: coverage-dashboard-codecov-free-for-oss
+board: code
+section: dx
+status: planned
+category: Testing · Platform
+complexity: S
+impact: Med
+wow: 3
+note: PR decoration
+order: 8
+owner:
+pr:
+title: Coverage dashboard — Codecov (free for OSS)
+---
+Upgrade the homegrown coverage badge to Codecov's PR diff-coverage
+           comments, file sunburst and trend graph — free for public repos. The
+           hosted counterpart to the self-contained <code>diff-cover</code> gate:
+           one enforces patch coverage in CI, the other visualizes the trend over
+           time.

boost_skill_cli-1.0.63/docs/roadmap/items/coverage-guided-fuzzing-atheris-oss-fuzz.md

@@ -0,0 +1,20 @@
+---
+id: coverage-guided-fuzzing-atheris-oss-fuzz
+board: code
+section: health
+status: planned
+category: Testing · Bug
+complexity: L
+impact: Med
+wow: 4
+note: stretch
+order: 8
+owner:
+pr:
+title: Coverage-guided fuzzing — <code>atheris</code> / OSS-Fuzz
+---
+Google's <code>atheris</code> fuzzes the frontmatter and registry
+           parsers under coverage guidance to mine deep crash inputs; OSS-Fuzz
+           runs it continuously for free once boost qualifies as an open-source
+           project. The stretch goal — the highest ceiling for finding the bug
+           nobody thought to write a test for.

boost_skill_cli-1.0.63/docs/roadmap/items/crash-recorder-error-paths-core-logs-py.md

@@ -0,0 +1,22 @@
+---
+id: crash-recorder-error-paths-core-logs-py
+board: code
+section: shipped
+status: shipped
+category: Testing · Resilience
+complexity: S
+impact: Med
+wow: 3
+note: 7 branches · 88%→100%
+order: 5
+owner:
+pr:
+title: Crash-recorder error paths — <code>core/logs.py</code>
+---
+The black-box diagnostic logger swallows every filesystem/handler
+           failure so a broken log can never break the CLI — but those
+           <code>except</code> arms (the parts that matter most <em>during</em> a
+           crash) were the least exercised. New tests force each failure —
+           handler <code>close()</code> raising, a read-only log dir, an
+           unresolvable version, a wedged logger, <code>unlink</code> denied —
+           taking the module to <strong>100%</strong> coverage.

boost_skill_cli-1.0.63/docs/roadmap/items/dependency-cve-gate-pip-audit.md

@@ -0,0 +1,21 @@
+---
+id: dependency-cve-gate-pip-audit
+board: code
+section: health
+status: planned
+category: Security · Supply chain
+complexity: S
+impact: Med
+wow: 2
+note: OSV-backed
+order: 2
+owner:
+pr:
+title: Dependency CVE gate — <code>pip-audit</code>
+---
+PyPA's <code>pip-audit</code> fails CI when a resolved dependency
+           matches a known advisory in the OSV / PyPI Advisory database.
+           Dependabot <em>opens</em> update PRs but never blocks a merge on a live
+           CVE; a scheduled&nbsp;+&nbsp;PR <code>pip-audit</code> job closes that
+           gap and covers the dev/test toolchain that ships nothing but can still
+           run malicious code.

boost_skill_cli-1.0.63/docs/roadmap/items/docstring-coverage-interrogate.md

@@ -0,0 +1,19 @@
+---
+id: docstring-coverage-interrogate
+board: code
+section: dx
+status: planned
+category: Quality · Docs
+complexity: S
+impact: Low
+wow: 2
+note: keeps core/ documented
+order: 5
+owner:
+pr:
+title: Docstring coverage — <code>interrogate</code>
+---
+Gate CI below a docstring-coverage threshold so the engine stays
+           self-documenting as it grows. <code>core/</code> is already well
+           commented; <code>interrogate</code> keeps it that way and flags the
+           new public function that shipped without a word of explanation.