boost-skill-cli 1.0.82__tar.gz → 1.0.84__tar.gz

{boost_skill_cli-1.0.82 → boost_skill_cli-1.0.84}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.82
+Version: 1.0.84
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.82 → boost_skill_cli-1.0.84}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.82'
-__version_tuple__ = version_tuple = (1, 0, 82)
+__version__ = version = '1.0.84'
+__version_tuple__ = version_tuple = (1, 0, 84)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.82 → boost_skill_cli-1.0.84}/boost_cli/commands/pkg.py

@@ -16,7 +16,7 @@ from typing import Dict, List, Optional
 
 from .. import cliparse
 from ..core import (agents, catalog, gitutil, journal, lockfile, paths,
-                    registry, store, util)
+                    registry, staleness, store, util)
 from ..core import output as out
 from ..errors import BoostError
 
@@ -287,16 +287,16 @@ def cmd_update(argv: List[str]) -> int:
         entry = matches[0]
         old_v = str(lk.get("version", "0.0.0"))
         new_v = str(entry.get("version", "0.0.0"))
-        reason = "version" if util.semver_gt(new_v, old_v) else None
-        if reason is None:
+        head, src_sha = "", None
+        if not util.semver_gt(new_v, old_v):
             head = gitutil.head_commit(registry.get(tapname).path)
             if head and head != lk.get("commit"):
                 try:
-                    src = store.source_dir_for(entry)
+                    src_sha = util.sha256_dir(store.source_dir_for(entry))
                 except BoostError:
                     continue
-                if util.sha256_dir(src) != lk.get("sha256"):
-                    reason = "content"
+        reason = staleness.upstream_reason(old_v, new_v, lk.get("commit", ""),
+                                           head, lk.get("sha256", ""), src_sha)
         if reason is None:
             continue
         try:

{boost_skill_cli-1.0.82 → boost_skill_cli-1.0.84}/boost_cli/commands/quality.py

@@ -18,7 +18,7 @@ from typing import List, Optional, Tuple
 from .. import cliparse
 from ..core import (agents, ai, catalog, frontmatter, gitutil, journal,
                     lockfile, logs, output as out, paths, policy, registry,
-                    store, util)
+                    staleness, store, util)
 from ..errors import BoostError
 
 # --- audit: dangerous-content patterns ------------------------------------
@@ -119,18 +119,20 @@ def _drift_status(name: str, entry: dict) -> str:
     """'in-sync' | 'local-edits' | 'upstream-moved' | 'source-missing'
     | 'store-missing' | 'n/a' (local imports with no tap source)."""
     sdir = store.skill_store_dir(name)
-    if not sdir.is_dir():
-        return "store-missing"
-    if util.sha256_dir(sdir) != entry.get("sha256"):
-        return "local-edits"
-    if entry.get("tap") == "local":
-        return "n/a"
-    try:
-        src = store.source_dir_for({"name": name, "tap": entry.get("tap", ""),
-                                    "rel_dir": entry.get("source_dir", ".")})
-    except BoostError:
-        return "source-missing"
-    return "in-sync" if util.sha256_dir(src) == entry.get("sha256") else "upstream-moved"
+    store_sha = util.sha256_dir(sdir) if sdir.is_dir() else None
+    is_local = entry.get("tap") == "local"
+    lock_sha = entry.get("sha256", "")
+    source_sha = None
+    if store_sha is not None and store_sha == lock_sha and not is_local:
+        try:
+            src = store.source_dir_for(
+                {"name": name, "tap": entry.get("tap", ""),
+                 "rel_dir": entry.get("source_dir", ".")})
+        except BoostError:
+            source_sha = None
+        else:
+            source_sha = util.sha256_dir(src)
+    return staleness.drift_state(store_sha, lock_sha, is_local, source_sha)
 
 
 _DRIFT_STYLE = {"in-sync": out.GREEN, "local-edits": out.YELLOW,

{boost_skill_cli-1.0.82 → boost_skill_cli-1.0.84}/boost_cli/commands/taps.py

@@ -5,7 +5,7 @@ import argparse
 import json
 
 from .. import cliparse, spin
-from ..core import catalog, config, gitutil, journal, lockfile, paths, registry, store, util
+from ..core import catalog, config, gitutil, journal, lockfile, paths, registry, staleness, store, util
 from ..core import output as out
 from ..errors import BoostError
 
@@ -218,9 +218,8 @@ def cmd_outdated(argv) -> int:
         latest = str(entry.get("version") or "0.0.0")
         installed_v = str(lk.get("version") or "0.0.0")
         stale, latest_disp = False, latest
-        if util.semver_gt(latest, installed_v):
-            stale = True
-        else:
+        head, src_sha, src_missing = "", None, False
+        if not util.semver_gt(latest, installed_v):
             if tap_name not in heads:
                 try:
                     tap = registry.get(tap_name)
@@ -231,13 +230,19 @@ def cmd_outdated(argv) -> int:
             head = heads[tap_name]
             if head and head != lk.get("commit"):
                 try:
-                    src = store.source_dir_for(entry)
+                    src_sha = util.sha256_dir(store.source_dir_for(entry))
                 except BoostError:
-                    stale, latest_disp = True, "source missing"
-                else:
-                    if util.sha256_dir(src) != lk.get("sha256"):
-                        stale = True
-                        latest_disp = "%s (%s)" % (latest, head[:7])
+                    src_missing = True
+        if src_missing:
+            stale, latest_disp = True, "source missing"
+        else:
+            reason = staleness.upstream_reason(
+                installed_v, latest, lk.get("commit", ""), head,
+                lk.get("sha256", ""), src_sha)
+            if reason == staleness.VERSION:
+                stale = True
+            elif reason == staleness.CONTENT:
+                stale, latest_disp = True, "%s (%s)" % (latest, head[:7])
         if stale:
             results.append({"name": name, "installed": installed_v,
                             "latest": latest_disp, "tap": tap_name,

boost_skill_cli-1.0.84/boost_cli/core/staleness.py

@@ -0,0 +1,78 @@
+"""Single source of truth for "is an installed skill stale vs its tap?".
+
+``cmd_update`` (pkg.py), ``cmd_outdated`` (taps.py) and ``_drift_status``
+(quality.py) each re-derived this from the same three signals — the catalog
+version, the tap's HEAD commit and the source tree's ``sha256`` — so the logic
+lived in three places that would inevitably drift apart. These two pure
+(I/O-free) functions are now the one decision the commands render.
+
+Keeping them free of any filesystem/subprocess access is deliberate: the
+commands gather the raw signals (``head_commit``, ``source_dir_for``,
+``sha256_dir``) and pass them in, so the *decision* stays trivially testable.
+"""
+from __future__ import annotations
+
+from typing import Optional
+
+from . import util
+
+# ── upstream_reason: why a tap's copy is newer than the installed one ──────
+VERSION = "version"  # the catalog advertises a higher semver
+CONTENT = "content"  # the tap HEAD moved AND the source tree's bytes changed
+
+
+def upstream_reason(installed_version: str, latest_version: str,
+                    installed_commit: str, tap_head: str,
+                    installed_sha: str, source_sha: Optional[str]
+                    ) -> Optional[str]:
+    """Why the tap's copy is newer than the installed one, else ``None``.
+
+    Mirrors the historical order exactly: a higher advertised semver wins
+    immediately; otherwise a *moved* tap HEAD **plus** a changed source tree
+    counts as content drift. ``source_sha`` is ``None`` when the source tree
+    could not be hashed (missing checkout) — treated as "no content signal",
+    i.e. not stale on that axis.
+    """
+    if util.semver_gt(latest_version, installed_version):
+        return VERSION
+    if tap_head and tap_head != installed_commit:
+        if source_sha is not None and source_sha != installed_sha:
+            return CONTENT
+    return None
+
+
+# ── drift_state: how an installed skill's store copy relates to lock+tap ───
+IN_SYNC = "in-sync"
+LOCAL_EDITS = "local-edits"
+UPSTREAM_MOVED = "upstream-moved"
+SOURCE_MISSING = "source-missing"
+STORE_MISSING = "store-missing"
+NA = "n/a"
+
+
+def drift_state(store_sha: Optional[str], lock_sha: str,
+                is_local: bool, source_sha: Optional[str]) -> str:
+    """Drift of an installed skill's store copy vs its lock entry and tap.
+
+    Signals (all pre-computed by the caller):
+
+    * ``store_sha``  — ``sha256`` of the on-disk store dir, or ``None`` if the
+      store dir is missing.
+    * ``lock_sha``   — the ``sha256`` recorded in the lock entry.
+    * ``is_local``   — ``True`` for local imports (no tap source to compare).
+    * ``source_sha`` — ``sha256`` of the tap source dir, or ``None`` if it is
+      unavailable (only consulted once the store copy matches the lock and the
+      skill has a tap).
+
+    The ordering is significant and matches the historical ``_drift_status``:
+    a missing store beats local edits, which beat the local/upstream split.
+    """
+    if store_sha is None:
+        return STORE_MISSING
+    if store_sha != lock_sha:
+        return LOCAL_EDITS
+    if is_local:
+        return NA
+    if source_sha is None:
+        return SOURCE_MISSING
+    return IN_SYNC if source_sha == lock_sha else UPSTREAM_MOVED

{boost_skill_cli-1.0.82 → boost_skill_cli-1.0.84}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.82
+Version: 1.0.84
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.82 → boost_skill_cli-1.0.84}/boost_skill_cli.egg-info/SOURCES.txt

@@ -48,6 +48,7 @@ boost_cli/core/paths.py
 boost_cli/core/policy.py
 boost_cli/core/rag.py
 boost_cli/core/registry.py
+boost_cli/core/staleness.py
 boost_cli/core/store.py
 boost_cli/core/util.py
 boost_cli/data/registries.json
@@ -126,9 +127,11 @@ docs/roadmap/items/layering-guard-import-linter.md
 docs/roadmap/items/lighthouse-ci-on-the-pages-site.md
 docs/roadmap/items/localize-the-stored-bm25-snippet.md
 docs/roadmap/items/lockfile-enforcement-and-commit-pinning.md
+docs/roadmap/items/log-timestamps-mislabeled-utc.md
 docs/roadmap/items/lowest-version-resolution-uv-resolution-lowest-d.md
 docs/roadmap/items/make-the-roadmaps-discoverable.md
 docs/roadmap/items/markdown-consistency-markdownlint-cli2.md
+docs/roadmap/items/mcp-launch-objc-fork-safety.md
 docs/roadmap/items/memoize-config-load-in-process.md
 docs/roadmap/items/modernization-smells-refurb-pyupgrade.md
 docs/roadmap/items/mutation-hardening-core-frontmatter-py.md
@@ -223,6 +226,7 @@ tests/unit/test_registries_fresh.py
 tests/unit/test_registry.py
 tests/unit/test_roadmap_fresh.py
 tests/unit/test_spin.py
+tests/unit/test_staleness.py
 tests/unit/test_store.py
 tests/unit/test_token_parity.py
 tests/unit/test_util.py

boost_skill_cli-1.0.84/docs/roadmap/items/consolidate-skill-staleness-drift-logic-into-cor.md

@@ -0,0 +1,16 @@
+---
+id: consolidate-skill-staleness-drift-logic-into-cor
+board: code
+section: shipped
+status: shipped
+category: Correctness
+complexity: M
+impact: High
+wow: 3
+note: three copies → one core module
+order: 3
+owner: loop/consolidate-staleness
+pr: 91
+title: Consolidate skill-staleness / drift logic into core
+---
+The "is this skill outdated" decision — <code>semver_gt</code> → commit compare → <code>sha256_dir</code> vs lock — was reimplemented nearly verbatim in <code>cmd_update</code>, <code>cmd_outdated</code> and <code>_drift_status</code> — three copies of core business logic that would drift apart. It now lives in one place: <code>core/staleness.py</code> exposes two <b>pure</b> (I/O-free) decisions — <code>upstream_reason()</code> (the version→commit→content ladder rendered by <code>cmd_update</code>/<code>cmd_outdated</code>) and <code>drift_state()</code> (the store/local-edits/upstream ladder rendered by <code>_drift_status</code>). The commands became thin renderers; behavior is byte-for-byte preserved and the new module is fully unit-tested (every branch pinned, all mutants killed).

boost_skill_cli-1.0.84/docs/roadmap/items/log-timestamps-mislabeled-utc.md

@@ -0,0 +1,25 @@
+---
+id: log-timestamps-mislabeled-utc
+board: code
+section: health
+status: planned
+category: Observability · Diagnostics
+complexity: S
+impact: Med
+wow: 2
+note: converter = time.gmtime
+order: 10
+owner:
+pr:
+title: Log timestamps are local time mislabeled <code>Z</code>
+---
+<code>core/logs.py</code> builds the <code>logging.Formatter</code> with
+           <code>datefmt="%Y-%m-%dT%H:%M:%SZ"</code> but never sets
+           <code>converter = time.gmtime</code>, so <code>%(asctime)s</code> uses
+           <em>local</em> time while stamping a literal <code>Z</code> (UTC)
+           suffix. Every line in <code>~/.boost/logs/boost.log</code> is therefore
+           off by the machine's UTC offset — which nearly caused a 5-hour
+           mis-correlation when matching the log against an OS crash report. Set
+           the formatter's <code>converter</code> to <code>time.gmtime</code> (or
+           drop the <code>Z</code>) so the trail is honestly UTC, making the
+           pid/ppid crash-correlation breadcrumbs trustworthy.

boost_skill_cli-1.0.84/docs/roadmap/items/mcp-launch-objc-fork-safety.md

@@ -0,0 +1,26 @@
+---
+id: mcp-launch-objc-fork-safety
+board: code
+section: compat
+status: planned
+category: Compatibility · macOS
+complexity: S
+impact: Med
+wow: 3
+note: OBJC_DISABLE_INITIALIZE_FORK_SAFETY
+order: 9
+owner:
+pr:
+title: Harden <code>boost mcp</code> launch against macOS Obj-C fork aborts
+---
+On macOS, a host that spawns <code>boost mcp --stdio</code> via <code>fork()</code>
+           can abort on the child side pre-<code>exec</code> when Obj-C is touched
+           post-fork (CFPreferences / <code>_scproxy</code> proxy lookup) — the
+           classic <em>"crashed on child side of fork pre-exec"</em>
+           <code>SIGABRT</code>. Not boost's own code (it aborts before boost
+           runs), but boost can make its integration robust: when registering the
+           MCP server (<code>boost mcp register</code> / the emitted client
+           config), set <code>OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES</code> (and
+           <code>no_proxy=*</code>) in the launch environment so the host's fork
+           into boost can't trip the Obj-C fork-safety abort. Document it for
+           hosts that launch boost directly.

{boost_skill_cli-1.0.82 → boost_skill_cli-1.0.84}/docs/roadmap.html

@@ -115,10 +115,10 @@
   <section class="block reveal">
     <div class="stats">
       <!-- ROADMAP:stats -->
-      <div class="stat"><b>9</b><span>Shipped</span></div>
+      <div class="stat"><b>10</b><span>Shipped</span></div>
       <div class="stat"><b>3</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>85</b><span>Loop finds</span></div>
+      <div class="stat"><b>87</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -162,6 +162,18 @@
         </div>
       </article>
 
+      <article class="cap rcard">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Correctness</span></div>
+        <h3>Consolidate skill-staleness / drift logic into core</h3>
+        <p>The "is this skill outdated" decision — <code>semver_gt</code> → commit compare → <code>sha256_dir</code> vs lock — was reimplemented nearly verbatim in <code>cmd_update</code>, <code>cmd_outdated</code> and <code>_drift_status</code> — three copies of core business logic that would drift apart. It now lives in one place: <code>core/staleness.py</code> exposes two <b>pure</b> (I/O-free) decisions — <code>upstream_reason()</code> (the version→commit→content ladder rendered by <code>cmd_update</code>/<code>cmd_outdated</code>) and <code>drift_state()</code> (the store/local-edits/upstream ladder rendered by <code>_drift_status</code>). The commands became thin renderers; behavior is byte-for-byte preserved and the new module is fully unit-tested (every branch pinned, all mutants killed).</p>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">three copies → one core module</span>
+        </div>
+      </article>
+
       <article class="cap rcard">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Testing</span></div>
         <h3>Mutation hardening — <code>core/frontmatter.py</code></h3>
@@ -439,17 +451,6 @@
         </div>
       </article>
 
-      <article class="cap rcard">
-        <div class="head"><span class="pill next">Next</span><span class="cat">Correctness</span></div>
-        <h3>Consolidate skill-staleness / drift logic into core</h3>
-        <p>The "is this skill outdated" decision — <code>semver_gt</code> → commit compare → <code>sha256_dir</code> vs lock — is reimplemented nearly verbatim in <code>cmd_update</code>, <code>cmd_outdated</code> and <code>_drift_status</code> (<code>pkg.py:277 · taps.py:225 · quality.py:120</code>). Three copies of core business logic that <b>will drift apart</b>. Make it one <code>core</code> function the commands render.</p>
-        <div class="meta">
-          <span class="m">Complexity <b>M</b></span>
-          <span class="m hi">Impact <b>High</b></span>
-          <span class="m">Wow <b class="wow">★★★</b></span>
-        </div>
-      </article>
-
       <article class="cap rcard">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Performance</span></div>
         <h3>Memoize <code>config.load()</code> in-process</h3>
@@ -783,6 +784,27 @@
           <span class="m">avoid macOS _scproxy Obj-C path</span>
         </div>
       </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Observability · Diagnostics</span></div>
+        <h3>Log timestamps are local time mislabeled <code>Z</code></h3>
+        <p><code>core/logs.py</code> builds the <code>logging.Formatter</code> with
+           <code>datefmt="%Y-%m-%dT%H:%M:%SZ"</code> but never sets
+           <code>converter = time.gmtime</code>, so <code>%(asctime)s</code> uses
+           <em>local</em> time while stamping a literal <code>Z</code> (UTC)
+           suffix. Every line in <code>~/.boost/logs/boost.log</code> is therefore
+           off by the machine's UTC offset — which nearly caused a 5-hour
+           mis-correlation when matching the log against an OS crash report. Set
+           the formatter's <code>converter</code> to <code>time.gmtime</code> (or
+           drop the <code>Z</code>) so the trail is honestly UTC, making the
+           pid/ppid crash-correlation breadcrumbs trustworthy.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★</b></span>
+          <span class="m">converter = time.gmtime</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>
@@ -1398,6 +1420,28 @@
           <span class="m">local == CI</span>
         </div>
       </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Compatibility · macOS</span></div>
+        <h3>Harden <code>boost mcp</code> launch against macOS Obj-C fork aborts</h3>
+        <p>On macOS, a host that spawns <code>boost mcp --stdio</code> via <code>fork()</code>
+           can abort on the child side pre-<code>exec</code> when Obj-C is touched
+           post-fork (CFPreferences / <code>_scproxy</code> proxy lookup) — the
+           classic <em>"crashed on child side of fork pre-exec"</em>
+           <code>SIGABRT</code>. Not boost's own code (it aborts before boost
+           runs), but boost can make its integration robust: when registering the
+           MCP server (<code>boost mcp register</code> / the emitted client
+           config), set <code>OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES</code> (and
+           <code>no_proxy=*</code>) in the launch environment so the host's fork
+           into boost can't trip the Obj-C fork-safety abort. Document it for
+           hosts that launch boost directly.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">OBJC_DISABLE_INITIALIZE_FORK_SAFETY</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>

boost_skill_cli-1.0.84/tests/unit/test_staleness.py

@@ -0,0 +1,102 @@
+"""Unit tests: boost_cli/core/staleness.py — the single-source staleness/drift
+decision that cmd_update, cmd_outdated and _drift_status now render.
+
+Both functions are pure, so every branch (and the ordering between branches) is
+pinned here with assertions specific enough to kill mutants.
+"""
+from __future__ import annotations
+
+from boost_cli.core import staleness
+
+SHA_A = "a" * 64
+SHA_B = "b" * 64
+
+
+class TestUpstreamReason:
+    def test_higher_semver_is_version(self):
+        assert staleness.upstream_reason(
+            "1.0.0", "1.1.0", "c1", "c2", SHA_A, SHA_B) == staleness.VERSION
+
+    def test_version_constant_value(self):
+        # pins the literal so a mutated constant is caught
+        assert staleness.VERSION == "version"
+
+    def test_content_constant_value(self):
+        assert staleness.CONTENT == "content"
+
+    def test_version_wins_even_when_commit_and_content_also_differ(self):
+        # semver must be checked FIRST — a higher version reports "version"
+        # regardless of the (also-changed) commit/content signals.
+        assert staleness.upstream_reason(
+            "1.0.0", "2.0.0", "old", "new", SHA_A, SHA_B) == staleness.VERSION
+
+    def test_same_version_no_commit_move_is_none(self):
+        assert staleness.upstream_reason(
+            "1.0.0", "1.0.0", "c1", "c1", SHA_A, SHA_B) is None
+
+    def test_empty_tap_head_is_none(self):
+        # no HEAD signal (e.g. tap not cloned) → not stale on the content axis
+        assert staleness.upstream_reason(
+            "1.0.0", "1.0.0", "c1", "", SHA_A, SHA_B) is None
+
+    def test_moved_commit_but_source_unhashable_is_none(self):
+        # source_sha None means "no content signal" — must NOT report content
+        assert staleness.upstream_reason(
+            "1.0.0", "1.0.0", "old", "new", SHA_A, None) is None
+
+    def test_moved_commit_same_content_is_none(self):
+        assert staleness.upstream_reason(
+            "1.0.0", "1.0.0", "old", "new", SHA_A, SHA_A) is None
+
+    def test_moved_commit_changed_content_is_content(self):
+        assert staleness.upstream_reason(
+            "1.0.0", "1.0.0", "old", "new", SHA_A, SHA_B) == staleness.CONTENT
+
+    def test_lower_advertised_version_not_stale_by_version(self):
+        # a downgrade in the catalog is not an upgrade — no commit move → None
+        assert staleness.upstream_reason(
+            "2.0.0", "1.0.0", "c1", "c1", SHA_A, SHA_B) is None
+
+
+class TestDriftState:
+    def test_store_missing(self):
+        assert staleness.drift_state(
+            None, SHA_A, False, SHA_A) == staleness.STORE_MISSING
+
+    def test_store_missing_takes_precedence_over_local(self):
+        # a missing store is reported even for a local import
+        assert staleness.drift_state(
+            None, SHA_A, True, None) == staleness.STORE_MISSING
+
+    def test_local_edits(self):
+        assert staleness.drift_state(
+            SHA_B, SHA_A, False, SHA_A) == staleness.LOCAL_EDITS
+
+    def test_local_edits_take_precedence_over_na(self):
+        # edited store beats the local/upstream split even for local imports
+        assert staleness.drift_state(
+            SHA_B, SHA_A, True, None) == staleness.LOCAL_EDITS
+
+    def test_local_import_in_sync_is_na(self):
+        assert staleness.drift_state(
+            SHA_A, SHA_A, True, None) == staleness.NA
+
+    def test_source_missing(self):
+        assert staleness.drift_state(
+            SHA_A, SHA_A, False, None) == staleness.SOURCE_MISSING
+
+    def test_in_sync(self):
+        assert staleness.drift_state(
+            SHA_A, SHA_A, False, SHA_A) == staleness.IN_SYNC
+
+    def test_upstream_moved(self):
+        assert staleness.drift_state(
+            SHA_A, SHA_A, False, SHA_B) == staleness.UPSTREAM_MOVED
+
+    def test_status_constant_values(self):
+        assert staleness.IN_SYNC == "in-sync"
+        assert staleness.LOCAL_EDITS == "local-edits"
+        assert staleness.UPSTREAM_MOVED == "upstream-moved"
+        assert staleness.SOURCE_MISSING == "source-missing"
+        assert staleness.STORE_MISSING == "store-missing"
+        assert staleness.NA == "n/a"

boost_skill_cli-1.0.82/docs/roadmap/items/consolidate-skill-staleness-drift-logic-into-cor.md

@@ -1,16 +0,0 @@
----
-id: consolidate-skill-staleness-drift-logic-into-cor
-board: code
-section: internals
-status: next
-category: Correctness
-complexity: M
-impact: High
-wow: 3
-note: 
-order: 3
-owner:
-pr:
-title: Consolidate skill-staleness / drift logic into core
----
-The "is this skill outdated" decision — <code>semver_gt</code> → commit compare → <code>sha256_dir</code> vs lock — is reimplemented nearly verbatim in <code>cmd_update</code>, <code>cmd_outdated</code> and <code>_drift_status</code> (<code>pkg.py:277 · taps.py:225 · quality.py:120</code>). Three copies of core business logic that <b>will drift apart</b>. Make it one <code>core</code> function the commands render.