boost-skill-cli 1.2.127__tar.gz → 1.2.129__tar.gz

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/CONTRIBUTING.md

@@ -120,8 +120,8 @@ list, and neither should be added to it.
 |---|---|
 | `make test` | unit + functional suites, **≥90% coverage** (statements + branches) |
 | `make patch-coverage` | changed-line coverage vs `main`, **≥80% of the diff** (PRs) |
-| `bash tests/smoke.sh` | 170 end-to-end checks through the real `./boost` shim |
-| `make bdd` | the Gherkin suite — 11 features, 47 scenarios (needs the `[bdd]` extra) |
+| `bash tests/smoke.sh` | 183 end-to-end checks through the real `./boost` shim |
+| `make bdd` | the Gherkin suite — 11 features, 56 scenarios (needs the `[bdd]` extra) |
 | `make mutation` | mutmut over `boost_cli/core`, **≥80% mutants killed** |
 | `ruff check boost_cli tests` | lint, zero findings |
 | `mypy` | type check, zero errors |

{boost_skill_cli-1.2.127/boost_skill_cli.egg-info → boost_skill_cli-1.2.129}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.127
+Version: 1.2.129
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0
@@ -453,7 +453,7 @@ the C4 diagrams in [`docs/architecture/`](docs/architecture/README.md).
 | Registry (Taps) | tap · untap · taps · outdated · catalog |
 | Intelligence | chat · distill · simulate · infer · absorb · evolve · context · focus · impact |
 | Quality & Health | doctor · lint · audit · verify · drift · test · fingerprint · quarantine · decay · heal · conflict · changelog · attest · health · trust |
-| Configuration | config · clean · compact · create · policy · onboard · completions · schedule · serve · mcp · hooks · bmad · self-update |
+| Configuration | quickstart · config · clean · compact · create · policy · onboard · completions · schedule · serve · mcp · hooks · bmad · self-update |
 | Team & Collaboration | cohort · profile · protocol · pulse · replay · who |
 
 The AI-assisted commands (`search --smart`, `explain`, `distill`, `infer`,
@@ -564,7 +564,7 @@ Four test layers are enforced, and `make check` runs all of them:
 | Layer | Gate |
 |---|---|
 | `make test` | ≥90% coverage of `boost_cli`, statements and branches |
-| `make smoke` | 176 checks through the actual `./boost` shim |
+| `make smoke` | 183 checks through the actual `./boost` shim |
 | `make mutation` | ≥80% of ~9,900 mutants in `boost_cli/core` killed |
 | `make evals` | metric floors on the search ranker, plus no significant regression |
 

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/README.md

@@ -411,7 +411,7 @@ the C4 diagrams in [`docs/architecture/`](docs/architecture/README.md).
 | Registry (Taps) | tap · untap · taps · outdated · catalog |
 | Intelligence | chat · distill · simulate · infer · absorb · evolve · context · focus · impact |
 | Quality & Health | doctor · lint · audit · verify · drift · test · fingerprint · quarantine · decay · heal · conflict · changelog · attest · health · trust |
-| Configuration | config · clean · compact · create · policy · onboard · completions · schedule · serve · mcp · hooks · bmad · self-update |
+| Configuration | quickstart · config · clean · compact · create · policy · onboard · completions · schedule · serve · mcp · hooks · bmad · self-update |
 | Team & Collaboration | cohort · profile · protocol · pulse · replay · who |
 
 The AI-assisted commands (`search --smart`, `explain`, `distill`, `infer`,
@@ -522,7 +522,7 @@ Four test layers are enforced, and `make check` runs all of them:
 | Layer | Gate |
 |---|---|
 | `make test` | ≥90% coverage of `boost_cli`, statements and branches |
-| `make smoke` | 176 checks through the actual `./boost` shim |
+| `make smoke` | 183 checks through the actual `./boost` shim |
 | `make mutation` | ≥80% of ~9,900 mutants in `boost_cli/core` killed |
 | `make evals` | metric floors on the search ranker, plus no significant regression |
 

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.127'
-__version_tuple__ = version_tuple = (1, 2, 127)
+__version__ = version = '1.2.129'
+__version_tuple__ = version_tuple = (1, 2, 129)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/boost_cli/core/output.py

@@ -72,11 +72,23 @@ def use_color(stream=None) -> bool:
     return hasattr(stream, "isatty") and stream.isatty()
 
 
+def _span(code: str, text: str) -> str:
+    """``code + text + RESET``, applied to each line on its own.
+
+    One span across a newline opens the style on line 1 and closes it at the
+    end of the last: a reader that stops early (``… 2>&1 | head -2``) is left
+    inside an unterminated style, and lines 2+ carry no code of their own. A
+    multi-line hint from `err` did exactly that. Every painter below routes
+    through here, so no emitter can reintroduce it.
+    """
+    return "\n".join(code + line + RESET for line in text.split("\n"))
+
+
 def c(text: str, *styles: str) -> str:
     """Wrap text in the given SGR styles + RESET; plain when color is off."""
     if not styles or not use_color():
         return text
-    return "".join(styles) + text + RESET
+    return _span("".join(styles), text)
 
 
 # --------------------------------------------------------------------------- #
@@ -139,7 +151,7 @@ def aurora(text: str, name: str, stream=None) -> str:
         return text
     triple, fallback = _AURORA[name]
     code = rgb(*triple) if level == 2 else fallback
-    return code + text + RESET
+    return _span(code, text)
 
 
 # --------------------------------------------------------------------------- #
@@ -171,8 +183,9 @@ def role(text: str, name: str, bold: bool = False, stream=None) -> str:
     if color_level(stream) == 0:
         return text
     kind, value = ROLES[name]
-    painted = aurora(text, value, stream) if kind == "aurora" else value + text + RESET
-    return BOLD + painted if bold else painted
+    painted = aurora(text, value, stream) if kind == "aurora" else _span(value, text)
+    # Per line too: BOLD before line 1 alone would leave lines 2+ regular.
+    return "\n".join(BOLD + ln for ln in painted.split("\n")) if bold else painted
 
 
 def _lerp(a, b, t: float):

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.127
+Version: 1.2.129
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0
@@ -453,7 +453,7 @@ the C4 diagrams in [`docs/architecture/`](docs/architecture/README.md).
 | Registry (Taps) | tap · untap · taps · outdated · catalog |
 | Intelligence | chat · distill · simulate · infer · absorb · evolve · context · focus · impact |
 | Quality & Health | doctor · lint · audit · verify · drift · test · fingerprint · quarantine · decay · heal · conflict · changelog · attest · health · trust |
-| Configuration | config · clean · compact · create · policy · onboard · completions · schedule · serve · mcp · hooks · bmad · self-update |
+| Configuration | quickstart · config · clean · compact · create · policy · onboard · completions · schedule · serve · mcp · hooks · bmad · self-update |
 | Team & Collaboration | cohort · profile · protocol · pulse · replay · who |
 
 The AI-assisted commands (`search --smart`, `explain`, `distill`, `infer`,
@@ -564,7 +564,7 @@ Four test layers are enforced, and `make check` runs all of them:
 | Layer | Gate |
 |---|---|
 | `make test` | ≥90% coverage of `boost_cli`, statements and branches |
-| `make smoke` | 176 checks through the actual `./boost` shim |
+| `make smoke` | 183 checks through the actual `./boost` shim |
 | `make mutation` | ≥80% of ~9,900 mutants in `boost_cli/core` killed |
 | `make evals` | metric floors on the search ranker, plus no significant regression |
 

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/docs/design-roadmap.html

@@ -203,7 +203,7 @@
         </div>
         <div>
           <dt>Constraints</dt>
-          <dd>Every proposal stays <code>zero-dependency</code>, degrades on <code>NO_COLOR</code> / non-TTY, and targets <code>Python ≥ 3.9</code>.</dd>
+          <dd>Every proposal stays <code>zero-dependency</code>, degrades on <code>NO_COLOR</code> / non-TTY, and targets <code>Python ≥ 3.12</code>.</dd>
         </div>
       </dl>
     </div>
@@ -579,7 +579,7 @@ hidden hot-path cost hiding behind the one this card measured.</p>
 <footer>
   <div class="wrap">
     <p class="foot-brand"><b>boost</b> — a package manager for AI skills</p>
-    <p class="foot-note">Install with <code>pip install boost-skill-cli</code> · requires Python 3.9+ and <code>git</code></p>
+    <p class="foot-note">Install with <code>pip install boost-skill-cli</code> · requires Python 3.12+ and <code>git</code></p>
     <nav class="foot-links" aria-label="Documentation">
       <a href="index.html">Guide</a>
       <a href="commands.html">Commands</a>

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/docs/openssf-badge.md

@@ -120,7 +120,7 @@ Package: [`boost-skill-cli`](https://pypi.org/project/boost-skill-cli/)
 
 | Criterion | Cat. | Answer | Evidence |
 |---|---|---|---|
-| `test` | MUST | **Met** | Four tiers: `tests/unit`, `tests/functional` (drive the real CLI in-process), `tests/smoke.sh` (170 end-to-end checks through the `./boost` shim) and a Gherkin BDD suite (11 features, 47 scenarios). |
+| `test` | MUST | **Met** | Four tiers: `tests/unit`, `tests/functional` (drive the real CLI in-process), `tests/smoke.sh` (183 end-to-end checks through the `./boost` shim) and a Gherkin BDD suite (11 features, 56 scenarios). |
 | `test_invocation` | SHOULD | **Met** | `make test` — or `nox`, which reproduces the exact CI gate in isolated venvs across every supported interpreter. |
 | `test_most` | SUGGESTED | **Met** | A **90% coverage** gate over statements and branches (`fail_under = 90`), an **80% changed-line** gate on pull requests, and an **80% mutation** gate over `boost_cli/core` — the last of which means coverage cannot be satisfied by tests that merely execute the code without asserting on it. |
 | `test_continuous_integration` | SUGGESTED | **Met** | GitHub Actions runs the full gate on every push and every pull request. |
@@ -204,7 +204,7 @@ of the security-design document for the full account.
 
 | Criterion | Cat. | Answer | Evidence |
 |---|---|---|---|
-| `dynamic_analysis` | SUGGESTED | **Met** | [`fuzz.yml`](https://github.com/jonnyeclectic/boost/blob/main/.github/workflows/fuzz.yml) runs `atheris` (libFuzzer for Python) against the parsers over a target matrix, uploading any crashing input as an artifact. Beyond fuzzing, `tests/smoke.sh` drives the real binary end to end through 170 checks, and the functional suite executes the CLI against a throwaway `$HOME`. |
+| `dynamic_analysis` | SUGGESTED | **Met** | [`fuzz.yml`](https://github.com/jonnyeclectic/boost/blob/main/.github/workflows/fuzz.yml) runs `atheris` (libFuzzer for Python) against the parsers over a target matrix, uploading any crashing input as an artifact. Beyond fuzzing, `tests/smoke.sh` drives the real binary end to end through 183 checks, and the functional suite executes the CLI against a throwaway `$HOME`. |
 | `dynamic_analysis_unsafe` | SUGGESTED | **N/A** | Python is memory-safe; there is no buffer overflow or use-after-free class for a tool like ASan or Valgrind to find. The runtime has no C extension (the optional `[rag]` extra is not on the install path). |
 | `dynamic_analysis_enable_assertions` | SUGGESTED | **Met** | The test suites are assertion-driven and run with assertions enabled (no `-O`), and `pytest` promotes `DeprecationWarning` raised inside `boost_cli` to a hard error, so a latent deprecation fails a run rather than scrolling past. |
 | `dynamic_analysis_fixed` | MUST | **Met** | No medium-or-higher exploitable vulnerability has been found by dynamic analysis. A crashing input found by the fuzzer is uploaded as a workflow artifact and fixed; none is outstanding. |

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/docs/roadmap/items/err-multiline-hint-colours-across-the-newline.md

@@ -2,15 +2,15 @@
 id: err-multiline-hint-colours-across-the-newline
 board: code
 section: planned
-status: planned
+status: shipped
 category: UX · Bug
 complexity: S
 impact: Low
 wow: 2
 note: err() joins a multi-line hint's lines and then wraps the whole joined string in one c…
 order: 207
-owner:
-pr:
+owner: loop/err-hint-per-line
+pr: 877
 title: <code>out.err</code>'s multi-line hint is coloured as one span, so line 1 ends with no RESET and lines 2+ carry no start code
 ---
 <b>Measured.</b> With colour forced, a three-line hint from <code>err()</code> emits an opening <code>ESC[2m</code> on hint line 1 that is never terminated, two bare continuation lines carrying no SGR at all, and one closing <code>ESC[0m</code> at visible column 98 of the last line — so <code>boost index 2&gt;&amp;1 | head -2</code> under <code>CLICOLOR_FORCE</code> hands the consumer a stream ending inside an unterminated dim span; output.py:252 wraps the newline-joined body in a single <code>c(..., DIM)</code>, colouring first and splitting after.

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/docs/roadmap/items/readme-81-command-table-lists-80-omits-quickstart.md

@@ -2,15 +2,15 @@
 id: readme-81-command-table-lists-80-omits-quickstart
 board: code
 section: planned
-status: planned
+status: shipped
 category: Quality · Docs
 complexity: S
 impact: Low
 wow: 2
 note: README.md:389 heads a table "## 81 commands, organized into 8 groups", but the eight …
 order: 224
-owner:
-pr:
+owner: loop/readme-command-table
+pr: 876
 title: README's "81 commands" table enumerates only 80 — the missing one is <code>quickstart</code>, the README's own first command
 ---
 <b>Measured.</b> Commit dd2fba07 (PR #594, "publish prebuilt vectors where a new user can reach them") added <code>("quickstart", "cfg", ...)</code> to cli.py's COMMANDS and changed README.md:389 from "## 80 commands" to "## 81 commands" — and left README.md:404's Configuration row at its 13 names, so the README has advertised 81 commands while listing 80 ever since, with the whole test suite green, because <code>test_marketing_counts.py</code> asserts the integer and <code>test_docsite_chrome.py:63-71</code> pins the enumeration only for <code>docs/index.html</code>.
@@ -41,7 +41,6 @@ The defect itself reproduces exactly as stated — README.md:389 heads "81 comma
 
 2. SOFT — "the one <code>docs/semantic-search.md</code> points at three times". Three is only right if you count fenced-code invocations (lines 30, 63, 64). The string <code>boost quickstart</code> appears 4 times (30, 33, 63, 64) and <code>quickstart</code> appears on 7 lines (+1, 83, 89). Say "four <code>boost quickstart</code> references across seven mentions" or drop the number.
 
-3.
 
 <b>What is NOT established.</b> Recorded because a card that overstates its own evidence is worse than no card.
 
@@ -51,6 +50,6 @@ WHY Low, not Med. The finder's Med overstates it. <code>quickstart</code> is nam
 
 WHY IT IS STILL WORTH A CARD. The value is structural, not the symptom: of the three enumerations of the command surface, <code>docs/index.html</code> is pinned name-by-name against COMMANDS (test_docsite_chrome.py:63-71), <code>docs/commands.html</code> is generated from COMMANDS and gated by <code>build_command_reference.py --check</code>, and README's table is hand-maintained with only its integer asserted. PR #594 is the proof that the gap is live rather than theoretical.
 
-<b>Why it is worth doing.</b> The README table is the only place a reader browses the command surface without running the CLI, and the one command it drops is the one the same file's hero block makes step 2 of onboarding. A user who reads the table sees no quickstart, and a user who reads the hero sees a command the table says does not exist. The count and the list also contradict each other in the same heading, which is exactly the class of drift test_marketing_counts.py was written for — it just guards the integer and not the enumeration.
+<b>Why it is worth doing.</b> The README table is the command surface a reader browses in-file, and the one enumeration of the three that nothing pinned; the one command it dropped is the one the same file's hero block makes step 2 of onboarding. A user who reads the table sees no quickstart, and a user who reads the hero sees a command the table says does not exist. The count and the list also contradict each other in the same heading, which is exactly the class of drift test_marketing_counts.py was written for — it just guards the integer and not the enumeration.
 
 <em>Found by an automated audit of retrieval/eval quality, the search &amp; browse surfaces, and first-run onboarding; every finding was then re-measured from scratch by an independent adversarial verifier whose instruction was to refute it. Verdict: <b>CORRECTED</b>. No fix is prescribed here — the measurement is the contribution.</em>

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/docs/roadmap/items/roadmap-boards-advertise-python-39.md

@@ -2,15 +2,15 @@
 id: roadmap-boards-advertise-python-39
 board: code
 section: planned
-status: planned
+status: shipped
 category: Quality · Docs
 complexity: S
 impact: Low
 wow: 2
 note: docs/roadmap.html:17141 and docs/design-roadmap.html:582 both close with Install with…
 order: 228
-owner:
-pr:
+owner: loop/boards-python-floor
+pr: 878
 title: The two roadmap boards' install footers still advertise Python 3.9+, four minor versions under the real floor
 ---
 <b>Measured.</b> On stock macOS <code>python3</code> (3.9.6), the exact command in both roadmap footers succeeds silently and installs the wrong software: <code>pip download --no-deps boost-skill-cli</code> exits 0 with no Requires-Python notice and selects boost_skill_cli-1.0.392, because 390 of 557 published releases still declare <code>requires_python: &gt;=3.9</code> — 167 releases behind the current 1.2.103.

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/docs/roadmap/items/stale-gate-sizes-in-readme-and-contributing.md

@@ -2,15 +2,15 @@
 id: stale-gate-sizes-in-readme-and-contributing
 board: code
 section: planned
-status: planned
+status: shipped
 category: Quality · Docs
 complexity: S
 impact: Low
 wow: 2
 note: README.md:515 says make smoke is "176 checks" and CONTRIBUTING.md:123 says bash tests…
 order: 235
-owner:
-pr:
+owner: loop/gate-sizes
+pr: 879
 title: The contributor-onboarding gate tables state three wrong suite sizes, and README and CONTRIBUTING disagree with each other
 ---
 <b>Measured.</b> One command (<code>make smoke</code> is literally <code>bash tests/smoke.sh</code>, Makefile:48-49) is documented as three different sizes in three files — 176 in README.md:515, 170 in CONTRIBUTING.md:123 and 170 again in docs/openssf-badge.md:123 — while it actually runs 183 checks, a figure that is deterministic and statically derivable as 102 top-level <code>run</code> lines plus 81 <code>--help</code> entries in the CMDS heredoc.

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/docs/roadmap.html

@@ -1294,42 +1294,9 @@ PRIOR DISCLOSURE (the finder declared it, and I confirmed it): docs/roadmap/item
       </article>
 
       <article class="cap rcard" id="err-multiline-hint-colours-across-the-newline">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">UX · Bug</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">UX · Bug</span></div>
         <h3><code>out.err</code>'s multi-line hint is coloured as one span, so line 1 ends with no RESET and lines 2+ carry no start code</h3>
-        <p><b>Measured.</b> With colour forced, a three-line hint from <code>err()</code> emits an opening <code>ESC[2m</code> on hint line 1 that is never terminated, two bare continuation lines carrying no SGR at all, and one closing <code>ESC[0m</code> at visible column 98 of the last line — so <code>boost index 2&gt;&amp;1 | head -2</code> under <code>CLICOLOR_FORCE</code> hands the consumer a stream ending inside an unterminated dim span; output.py:252 wraps the newline-joined body in a single <code>c(..., DIM)</code>, colouring first and splitting after.
-
-<b>Reproduce it.</b>
-
-<code>cd &lt;repo&gt;</code><br>
-<code>BOOST_COLOR=always .venv/bin/python -c "</code><br>
-<code>from boost_cli.core import output as out</code><br>
-<code>out.err('gh api failed', 'HTTP 401: Bad credentials\nTry authenticating with:  gh auth login\ngh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable.')</code><br>
-<code>" 2&gt;&amp;1 | /bin/cat -v</code><br>
-<code># and the live call path (single-line tail in this sandbox, but proves err() is reached):</code><br>
-<code>export HOME=$TMPDIR/audit-output-formatting; export BOOST_HOME=$HOME/.boost; mkdir -p "$HOME"</code><br>
-<code>GH_TOKEN=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef BOOST_COLOR=always ./boost index 2&gt;&amp;1 | head -3 | /bin/cat -v</code>
-
-<b>What adversarial verification corrected.</b> This card's numbers are the re-measured ones, not the ones first reported.
-
-The core defect and its byte shape reproduce exactly. Five stated details are wrong:
-
-1. "<code>empty_state._block</code> (output.py:559-561)" — WRONG LINES. 559-561 is docstring prose. <code>_block</code> is defined at output.py:569 and its per-line colouring is at 571-572.
-
-2. "the lone <code>^[[0m</code> is 90 columns into line 4" — WRONG. It sits at visible column 98. 90 is the length of the message text alone; the line also carries the 8-column <code> hint: </code> alignment indent.
-
-3. "<code>err</code> is the one emitter that does not [colour per line]" — REFUTED. Handed a string containing a literal newline with <code>wrap</code> off, <code>dim()</code>, <code>warn()</code> and <code>empty_state()</code> all emit the identical straddling span (measured above). <code>empty_state._block</code> only colours per line of its *wrap* output; with <code>wrap=False</code> <code>body = [text]</code>, so the newline sits inside one <code>c(..., DIM)</code>. What is actually unique about <code>err</code> is that it is the only emitter whose docstring documents accepting embedded newlines and the only one with a live multi-line caller (<code>gh_failure_hint</code>); I grepped every <code>out.warn(</code> / <code>out.dim(</code> / <code>out.empty_state(</code> call site and none passes a <code>\n</code>-bearing string (all joins use ", " or "; ").
-
-4. "<code>boost index 2&gt;&amp;1 | head -2</code> hands the shell an opening SGR with no close" — WRONG without a stated precondition.
-
-<b>What is NOT established.</b> Recorded because a card that overstates its own evidence is worse than no card.
-
-Not carded — I re-checked independently. Grepped all <code>^title:</code> lines for colour/ANSI/reset/escape/SGR/dim/hint terms and read the four plausible cards in full: <code>long-hints-overflow-narrow-panes.md</code> (line width, not escape spans), <code>BOOST-D04.md</code> (semantic colour roles), <code>BOOST-D18.md</code> (empty-state/hint styling consistency), <code>BOOST-D27.md</code> (its three named remaining wrap-law gaps are <code>dim()</code>'s embedded indent, <code>empty_state()</code> adoption, and <code>truncate()</code>/<code>search_layout()</code> wide-char width — <code>err()</code> is not among them). <code>grep -ril 'unterminated|RESET|SGR|escape code' docs/roadmap/items/</code> returned 11 files, none about <code>err()</code>.
-
-Scope of my repro, and what a card must not overclaim: - No corpus was needed; this is a pure library-call repro plus one live CLI path. The 20-tap eval corpus at $TMPDIR/eval-home is irrelevant here and I did not touch it. The <code>./boost index</code> run used its own disposable HOME. - I could not produce the 3-line <code>gh</code> tail live either: the sandbox proxy's TLS failure is a single line, so the live run only proves <code>err()</code> is reached with a <code>gh</code>-sourced hint, not that a 3-line tail occurred. The multi-line shape is proven by the direct call, which is what the finder also did. - A card must state the forced-colour precondition. In an ordinary interactive run the bytes ARE emitted (stdout is a TTY), but every terminal I know carries DIM across a newline, so it renders correctly — the finding concedes this. The only consumer that sees breakage is a line-oriented reader under <code>BOOST_COLOR=always</code> / <code>CLICOLOR_FORCE</code> (CI).
-
-<b>Why it is worth doing.</b> Most terminals carry DIM across a newline, so it usually *looks* right — the harm is to anything reading a line at a time. <code>boost index 2&gt;&amp;1 | head -2</code> hands the shell an opening SGR with no close, dimming everything printed afterwards; and because the hint goes to stderr, any stdout written between hint lines lands inside the unterminated dim run. The module already knows the correct shape and uses it twice — <code>empty_state._block</code> (output.py:559-561) and <code>table</code>'s header cells (output.py:906-908, with the comment "a whole-line wrap would be cancelled at the first separator's RESET") both colour per line. <code>err</code> is the one emitter that does not.
-
-<em>Found by an automated audit of retrieval/eval quality, the search &amp; browse surfaces, and first-run onboarding; every finding was then re-measured from scratch by an independent adversarial verifier whose instruction was to refute it. Verdict: <b>CORRECTED</b>. No fix is prescribed here — the measurement is the contribution.</em></p>
+        <p class="cardbody"><a class="writeup" href="https://github.com/jonnyeclectic/boost/blob/main/docs/roadmap/items/err-multiline-hint-colours-across-the-newline.md">Write-up &middot; err-multiline-hint-colours-across-the-newline.md</a></p>
         <div class="meta">
           <span class="m">Complexity <b>S</b></span>
           <span class="m">Impact <b>Low</b></span>
@@ -2083,49 +2050,9 @@ FIX SCOPE IS WIDER THAN THE FINDING SAYS: because <code>pkg.py:941</code> (<code
       </article>
 
       <article class="cap rcard" id="readme-81-command-table-lists-80-omits-quickstart">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · Docs</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Quality · Docs</span></div>
         <h3>README's "81 commands" table enumerates only 80 — the missing one is <code>quickstart</code>, the README's own first command</h3>
-        <p><b>Measured.</b> Commit dd2fba07 (PR #594, "publish prebuilt vectors where a new user can reach them") added <code>("quickstart", "cfg", ...)</code> to cli.py's COMMANDS and changed README.md:389 from "## 80 commands" to "## 81 commands" — and left README.md:404's Configuration row at its 13 names, so the README has advertised 81 commands while listing 80 ever since, with the whole test suite green, because <code>test_marketing_counts.py</code> asserts the integer and <code>test_docsite_chrome.py:63-71</code> pins the enumeration only for <code>docs/index.html</code>.
-
-<b>Reproduce it.</b>
-
-<code>cd &lt;repo&gt;</code><br>
-<code>.venv/bin/python - &lt;&lt;'PY'</code><br>
-<code>import re, sys</code><br>
-<code>sys.path.insert(0,'.')</code><br>
-<code>from boost_cli.cli import COMMANDS</code><br>
-<code>names = {n for n,_,_,_ in COMMANDS}</code><br>
-<code>readme = open('README.md').read()</code><br>
-<code>rows = re.findall(r'^\| ([A-Z][^|]*?) \| (.+?) \|$', readme, re.M)</code><br>
-<code>tbl = {g.strip(): [c.strip() for c in cmds.split('·')] for g, cmds in rows if '·' in cmds}</code><br>
-<code>listed = {c for v in tbl.values() for c in v}</code><br>
-<code>print("README table total:", sum(len(v) for v in tbl.values()), "COMMANDS:", len(names))</code><br>
-<code>print("missing from README table:", sorted(names - listed))</code><br>
-<code>PY</code><br>
-<code>grep -n '81 commands' README.md</code><br>
-<code>./boost --help | grep -n 'quickstart'</code>
-
-<b>What adversarial verification corrected.</b> This card's numbers are the re-measured ones, not the ones first reported.
-
-The defect itself reproduces exactly as stated — README.md:389 heads "81 commands", the eight rows at README.md:398-405 enumerate 80, and the set difference against <code>cli.py</code>'s COMMANDS is exactly <code>{'quickstart'}</code>. Two stated facts are wrong:
-
-1. LOAD-BEARING — <code>why_it_matters</code> says "The README table is the only place a reader browses the command surface without running the CLI." False. <code>docs/commands.html</code> (4 quickstart hits) and <code>docs/index.html</code> (3 hits, including the pinned <code>["quickstart","cfg",...]</code> row) both enumerate the full surface, and README.md:391-393 links both of them two lines ABOVE the table. A card must not ship that sentence. The honest framing: the README table is the surface a reader browses in-file, and the one enumeration of the three that nothing pins.
-
-2. SOFT — "the one <code>docs/semantic-search.md</code> points at three times". Three is only right if you count fenced-code invocations (lines 30, 63, 64). The string <code>boost quickstart</code> appears 4 times (30, 33, 63, 64) and <code>quickstart</code> appears on 7 lines (+1, 83, 89). Say "four <code>boost quickstart</code> references across seven mentions" or drop the number.
-
-3.
-
-<b>What is NOT established.</b> Recorded because a card that overstates its own evidence is worse than no card.
-
-SCOPE OF MY REPRO: entirely static — README.md, boost_cli/cli.py, docs/*.html, the two test files, and <code>./boost --help</code> from the repo checkout. No corpus, tap set or network was needed, so nothing here is contingent on the 20-tap eval corpus or on which registries ship by default. Fully settled.
-
-WHY Low, not Med. The finder's Med overstates it. <code>quickstart</code> is named in README.md five other times (line 23 hero, 142, 145, 151, 176), in <code>./boost --help</code>, and in both generated doc pages that the README links immediately above the table. The user-visible cost is one missing name out of 81 in one browsable list; nothing breaks and no one is misinformed about whether the command exists. The finder's line "a user who reads the hero sees a command the table says does not exist" is rhetorical — the table omits, it does not deny.
-
-WHY IT IS STILL WORTH A CARD. The value is structural, not the symptom: of the three enumerations of the command surface, <code>docs/index.html</code> is pinned name-by-name against COMMANDS (test_docsite_chrome.py:63-71), <code>docs/commands.html</code> is generated from COMMANDS and gated by <code>build_command_reference.py --check</code>, and README's table is hand-maintained with only its integer asserted. PR #594 is the proof that the gap is live rather than theoretical.
-
-<b>Why it is worth doing.</b> The README table is the only place a reader browses the command surface without running the CLI, and the one command it drops is the one the same file's hero block makes step 2 of onboarding. A user who reads the table sees no quickstart, and a user who reads the hero sees a command the table says does not exist. The count and the list also contradict each other in the same heading, which is exactly the class of drift test_marketing_counts.py was written for — it just guards the integer and not the enumeration.
-
-<em>Found by an automated audit of retrieval/eval quality, the search &amp; browse surfaces, and first-run onboarding; every finding was then re-measured from scratch by an independent adversarial verifier whose instruction was to refute it. Verdict: <b>CORRECTED</b>. No fix is prescribed here — the measurement is the contribution.</em></p>
+        <p class="cardbody"><a class="writeup" href="https://github.com/jonnyeclectic/boost/blob/main/docs/roadmap/items/readme-81-command-table-lists-80-omits-quickstart.md">Write-up &middot; readme-81-command-table-lists-80-omits-quickstart.md</a></p>
         <div class="meta">
           <span class="m">Complexity <b>S</b></span>
           <span class="m">Impact <b>Low</b></span>
@@ -2270,40 +2197,9 @@ BLAST RADIUS — do not overstate it in the card. The natural set is NOT wired i
       </article>
 
       <article class="cap rcard" id="roadmap-boards-advertise-python-39">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · Docs</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Quality · Docs</span></div>
         <h3>The two roadmap boards' install footers still advertise Python 3.9+, four minor versions under the real floor</h3>
-        <p><b>Measured.</b> On stock macOS <code>python3</code> (3.9.6), the exact command in both roadmap footers succeeds silently and installs the wrong software: <code>pip download --no-deps boost-skill-cli</code> exits 0 with no Requires-Python notice and selects boost_skill_cli-1.0.392, because 390 of 557 published releases still declare <code>requires_python: &gt;=3.9</code> — 167 releases behind the current 1.2.103.
-
-<b>Reproduce it.</b>
-
-<code>cd &lt;repo&gt;</code><br>
-<code>for f in docs/*.html; do printf '%-22s %s\n' "$(basename $f)" "$(grep -m1 -n 'foot-note' $f)"; done | grep -o 'Python 3\.[0-9]*+' | sort | uniq -c</code><br>
-<code>grep -n 'requires Python 3.9' docs/roadmap.html docs/design-roadmap.html</code><br>
-<code>sed -n '206p' docs/design-roadmap.html</code><br>
-<code>grep -n 'requires-python' pyproject.toml</code><br>
-<code>.venv/bin/python scripts/build_roadmap.py --check ; echo "EXIT=$?"   # green despite the drift</code>
-
-<b>What adversarial verification corrected.</b> This card's numbers are the re-measured ones, not the ones first reported.
-
-The documented defect (<code>claim</code> + <code>evidence</code>) reproduces byte-for-byte — every file, line number and count is right: 9 of 11 footers say 3.12+, roadmap.html:17141 and design-roadmap.html:582 say 3.9+, design-roadmap.html:206 says "targets Python ≥ 3.9", pyproject.toml:22 is &gt;=3.12, README.md:54 says 3.12+, and <code>build_roadmap.py --check</code> exits 0. The correction is confined entirely to <code>why_it_matters</code>, which is wrong three times:
-
-1. WRONG: "the launcher on that interpreter dies with a SyntaxError out of core/workflows.py's match statements." The <code>./boost</code> launcher no longer gates at 3.9 — <code>grep -n '3\.9' boost</code> returns nothing (exit 1), and boost:5, boost:27 and boost:37 all say 3.12. Observed on a PATH holding only Python 3.9.6, the launcher prints <code>boost: Python 3.12+ is required but was not found on PATH / hint: brew install python3</code>. It never selects the 3.9 interpreter.
-
-2. WRONG even if the gate is bypassed: importing the package on 3.9 does not raise SyntaxError from <code>core/workflows.py</code>'s match statements. It raises <code>ImportError: cannot import name 'UTC' from 'datetime'</code> at <code>boost_cli/core/util.py:15</code>, which fires before workflows.py is reached.
-
-3. WRONG about the failure being visible at all. The footer's advertised path is <code>pip install boost-skill-cli</code>, not the launcher.
-
-<b>What is NOT established.</b> Recorded because a card that overstates its own evidence is worse than no card.
-
-SCOPE OF MY REPRO: everything above was measured on this checkout at the session's HEAD (main, 9b70fc8e) and against live PyPI. No eval corpus or BOOST_HOME was involved — this is a static docs/metadata finding, so the 20-tap corpus caveat does not apply. I did not run a real <code>pip install</code> (only <code>pip download</code>, which exercises the same resolver and version selection without mutating anything).
-
-NOT CARDED — confirmed independently. I grepped all roadmap item titles, then every item body containing <code>3.9</code> (21 files) and every item body containing <code>footer</code>/<code>foot-note</code> (16 files). None names the docs/*.html install footers or their Python version. Three near misses, all genuinely distinct: - <code>audit-root-findings.md</code> covers the *launcher's* three 3.9 sites and explicitly closes "README already says 3.12+ — no doc change needed"; it never mentions a docs page. - <code>python-floor-moves-to-312.md</code> enumerates pyproject, the CI matrix and telemetry; no docs page. - <code>promote-nav-footer-into-the-shared-style-system.md</code> is about nav/footer *presence and styling*, not their text.
-
-TRAP FOR THE CARD AUTHOR — do not re-import the SyntaxError claim. The finder took it from <code>docs/roadmap/items/audit-root-findings.md:36-43</code>, which is still <code>status: planned</code> but whose premise is already fixed on disk: that card says the launcher "still gates at Python 3.9" at boost:5/:27/:37, and all three now say 3.12. Anyone who reads that card while writing this one will copy a consequence that no longer happens.
-
-<b>Why it is worth doing.</b> Both boards are linked from the README ("Roadmap" section, README.md:490-494) and from the Visual Guide nav, so they are landing surfaces a reader can arrive on first. Their footer is the only install instruction on the page, and it tells the reader a Python 3.9 will do. It will not: stock macOS <code>python3</code> IS 3.9, and the launcher on that interpreter dies with a SyntaxError out of core/workflows.py's match statements. The design board's "targets Python ≥ 3.9" also mis-sets the floor for anyone writing a proposal against it.
-
-<em>Found by an automated audit of retrieval/eval quality, the search &amp; browse surfaces, and first-run onboarding; every finding was then re-measured from scratch by an independent adversarial verifier whose instruction was to refute it. Verdict: <b>CORRECTED</b>. No fix is prescribed here — the measurement is the contribution.</em></p>
+        <p class="cardbody"><a class="writeup" href="https://github.com/jonnyeclectic/boost/blob/main/docs/roadmap/items/roadmap-boards-advertise-python-39.md">Write-up &middot; roadmap-boards-advertise-python-39.md</a></p>
         <div class="meta">
           <span class="m">Complexity <b>S</b></span>
           <span class="m">Impact <b>Low</b></span>
@@ -2555,32 +2451,9 @@ NOT ALREADY CARDED — I re-checked independently. The PR 739 card (<code>audit-
       </article>
 
       <article class="cap rcard" id="stale-gate-sizes-in-readme-and-contributing">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · Docs</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Quality · Docs</span></div>
         <h3>The contributor-onboarding gate tables state three wrong suite sizes, and README and CONTRIBUTING disagree with each other</h3>
-        <p><b>Measured.</b> One command (<code>make smoke</code> is literally <code>bash tests/smoke.sh</code>, Makefile:48-49) is documented as three different sizes in three files — 176 in README.md:515, 170 in CONTRIBUTING.md:123 and 170 again in docs/openssf-badge.md:123 — while it actually runs 183 checks, a figure that is deterministic and statically derivable as 102 top-level <code>run</code> lines plus 81 <code>--help</code> entries in the CMDS heredoc.
-
-<b>Reproduce it.</b>
-
-<code>cd &lt;repo&gt;</code><br>
-<code>sed -n '48,49p' Makefile          # make smoke == bash tests/smoke.sh</code><br>
-<code>bash tests/smoke.sh 2&gt;&amp;1 | tail -1 # == results: 183 passed, 0 failed</code><br>
-<code>sed -n '515p' README.md            # "176 checks"</code><br>
-<code>sed -n '123,124p' CONTRIBUTING.md  # "170 end-to-end checks" ; "11 features, 47 scenarios"</code><br>
-<code>HOME=$TMPDIR/audit-bdd BOOST_HOME=$TMPDIR/audit-bdd/.boost .venv/bin/behave tests/bdd/features --dry-run 2&gt;&amp;1 | tail -2</code>
-
-<b>Verification found nothing to correct.</b> Every number, <code>file:line</code> and command output above was independently re-derived and matched exactly.
-
-<b>What is NOT established.</b> Recorded because a card that overstates its own evidence is worse than no card.
-
-1. THE FINDING UNDERCOUNTS THE BLAST RADIUS. It names two files; there are three. <code>docs/openssf-badge.md:123</code> carries both stale numbers ("170 end-to-end checks" and "11 features, 47 scenarios") in the row that answers the OpenSSF <code>test</code> MUST criterion. That makes five stale statements across three files, not three across two. The finder's not_carded_check grepped roadmap bodies but never grepped <code>docs/</code>, which is how it missed this. A card that fixes only README and CONTRIBUTING leaves a stale count in the file that argues boost's test coverage to an external badge audit.
-
-2. TWO ARE DRIFT, ONE WAS WRONG ON DAY ONE — do not write the card as uniform "drift". Re-deriving the count at each blame commit: README's 176 was CORRECT at 3aaf4ba4 (2026-08-28, PR #579) and has since drifted to 183; CONTRIBUTING's 170 was CORRECT at c043bb3f (2026-07-24, PR #233) and was never touched again; CONTRIBUTING's "47 scenarios" was CORRECT at 17bd5003 (2026-07-28, PR #292). But docs/openssf-badge.md's 170 was WRONG WHEN IT WAS WRITTEN — at 560652b1 (2026-08-28, PR #563) the suite already ran 176. It copied CONTRIBUTING's already-stale number rather than measuring. That is the sharper story: the count is not just drifting, it is being propagated by copy from whichever file the author happened to read, which is exactly the failure mode the finding's "no way to tell which is authoritative" line predicts.
-
-3. 183 IS DETERMINISTIC — a card author must not "correct" it.
-
-<b>Why it is worth doing.</b> These two tables are the contributor's map of what <code>make check</code> will do to their PR, and a first-time contributor reads whichever file they landed on. Seeing 183 where the doc promised 176 (or 170) is a signal the gate changed under them; worse, the two files disagree, so there is no way to tell which is authoritative without running the suite. The BDD row is the same failure in a suite that is not even in <code>make check</code>, where a wrong size is the only signal a contributor has that scenarios were added.
-
-<em>Found by an automated audit of retrieval/eval quality, the search &amp; browse surfaces, and first-run onboarding; every finding was then re-measured from scratch by an independent adversarial verifier whose instruction was to refute it. Verdict: <b>CONFIRMED</b>. No fix is prescribed here — the measurement is the contribution.</em></p>
+        <p class="cardbody"><a class="writeup" href="https://github.com/jonnyeclectic/boost/blob/main/docs/roadmap/items/stale-gate-sizes-in-readme-and-contributing.md">Write-up &middot; stale-gate-sizes-in-readme-and-contributing.md</a></p>
         <div class="meta">
           <span class="m">Complexity <b>S</b></span>
           <span class="m">Impact <b>Low</b></span>
@@ -8477,7 +8350,7 @@ regressed. Lowering the floor alone just relocates the coin flip.</p>
 <footer>
   <div class="wrap">
     <p class="foot-brand"><b>boost</b> — a package manager for AI skills</p>
-    <p class="foot-note">Install with <code>pip install boost-skill-cli</code> · requires Python 3.9+ and <code>git</code></p>
+    <p class="foot-note">Install with <code>pip install boost-skill-cli</code> · requires Python 3.12+ and <code>git</code></p>
     <nav class="foot-links" aria-label="Documentation">
       <a href="index.html">Guide</a>
       <a href="commands.html">Commands</a>

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/tests/unit/test_launcher_python_floor.py

@@ -46,3 +46,35 @@ class TestLauncherPythonFloor:
         major, minor = _requires_python_floor()
         text = LAUNCHER.read_text(encoding="utf-8")
         assert "Python %d.%d+ is required" % (major, minor) in text
+
+
+class TestDocsPythonFloor:
+    """The docs' own install lines must name the same floor.
+
+    Nine of the eleven docs pages' footers moved to 3.12 with the floor; the
+    two roadmap boards' footers — hand-authored outside the regions
+    `build_roadmap.py` regenerates, so `--check` stayed green — kept saying
+    3.9, as did the design board's "targets Python ≥ 3.9". Stock macOS
+    `python3` is 3.9, so that is the reader the stale floor misleads.
+    """
+
+    def test_every_footer_names_requires_python(self):
+        major, minor = _requires_python_floor()
+        pages = sorted((ROOT / "docs").glob("*.html"))
+        footers = {page.name: [ln.strip() for ln in
+                               page.read_text(encoding="utf-8").splitlines()
+                               if 'class="foot-note"' in ln]
+                   for page in pages}
+        # One footer per page, found by its class alone — so a page that
+        # loses its footer, or rewords it away from "requires Python", fails
+        # here rather than dropping out of the scan.
+        assert pages and all(len(f) == 1 for f in footers.values()), footers
+        stale = {name: f[0] for name, f in footers.items()
+                 if "requires Python %d.%d+" % (major, minor) not in f[0]}
+        assert not stale, stale
+
+    def test_design_board_targets_the_same_floor(self):
+        major, minor = _requires_python_floor()
+        text = (ROOT / "docs" / "design-roadmap.html").read_text(encoding="utf-8")
+        assert re.findall(r"targets <code>Python ≥ (\d+\.\d+)</code>", text) \
+            == ["%d.%d" % (major, minor)]

{boost_skill_cli-1.2.127 → boost_skill_cli-1.2.129}/tests/unit/test_marketing_counts.py

@@ -59,6 +59,22 @@ class TestCommandCount:
         assert counts == {_command_count()}, \
             "README states conflicting command counts: %s" % sorted(counts)
 
+    def test_readme_table_lists_exactly_the_registry(self):
+        # The integer above was guarded; the enumeration under it was not, so
+        # #594 moved the heading to 81 and the table stayed at 80 (quickstart,
+        # the README's own onboarding step, was the one missing). Pin the rows
+        # by group title and order, the way docs/index.html's list is pinned.
+        from boost_cli.cli import GROUPS
+        rows = {group: [c.strip() for c in cmds.split("·")]
+                for group, cmds in re.findall(
+                    r"^\| ([A-Z][^|]*?) \| (.+?) \|$", README, re.M)
+                if "·" in cmds}
+        want: dict[str, list[str]] = {}
+        for name, group, _module, _summary in COMMANDS:
+            want.setdefault(GROUPS[group][1], []).append(name)
+        assert rows == want
+        assert list(rows) == list(want)       # the groups' order too
+
     def test_landing_page_counts_agree(self):
         counts = {int(n) for n in re.findall(r"(\d+)\s+commands", INDEX)}
         assert counts == {_command_count()}, \
@@ -84,6 +100,49 @@ class TestCommandCount:
 # test whose formula is a guess is worse than no test.
 
 
+class TestSuiteSizesAgree:
+    """The smoke and BDD sizes the docs state.
+
+    They had drifted three ways at once: README said 176 smoke checks,
+    CONTRIBUTING and the OpenSSF badge answer 170, the suite ran 183, and the
+    badge's 170 was already wrong on the day it was copied in. Per the note
+    above, the smoke count is not derived from smoke.sh's shape; what IS
+    checkable without a formula is that the docs agree with each other, so a
+    reader never has to guess which file is right. The BDD size is
+    declarative (one `Scenario:` per scenario), so it is checked outright.
+    """
+
+    DOCS = ("README.md", "CONTRIBUTING.md", "docs/openssf-badge.md")
+
+    def _read(self, doc):
+        return (ROOT / doc).read_text(encoding="utf-8")
+
+    def test_every_doc_states_the_same_smoke_size(self):
+        sizes = {}
+        for doc in self.DOCS:
+            for line in self._read(doc).splitlines():
+                if "smoke" in line:
+                    for n in re.findall(r"(\d+) (?:end-to-end )?checks", line):
+                        sizes.setdefault(int(n), []).append(doc)
+        # Every statement, not just every doc: the badge answer states it twice.
+        assert sorted(d for docs in sizes.values() for d in docs) == sorted(
+            ["README.md", "CONTRIBUTING.md"] + ["docs/openssf-badge.md"] * 2)
+        assert len(sizes) == 1, "docs disagree on the smoke size: %s" % sizes
+
+    def test_bdd_size_matches_the_feature_files(self):
+        features = sorted((ROOT / "tests" / "bdd" / "features").glob("*.feature"))
+        texts = [f.read_text(encoding="utf-8") for f in features]
+        # An outline expands to one scenario per Examples row, and `Example:`
+        # is Gherkin's synonym for `Scenario:`; this count models neither, so
+        # refuse rather than undercount.
+        assert not any(re.search(r"^\s*(Scenario Outline|Example):", t, re.M)
+                       for t in texts)
+        scenarios = sum(len(re.findall(r"^\s*Scenario:", t, re.M)) for t in texts)
+        stated = [(int(f), int(s)) for doc in self.DOCS for f, s in
+                  re.findall(r"(\d+) features, (\d+) scenarios", self._read(doc))]
+        assert stated and set(stated) == {(len(features), scenarios)}, stated
+
+
 class TestNoStaleCountsElsewhere:
     @pytest.mark.parametrize("doc", ["README.md", "docs/index.html"])
     def test_no_command_count_is_a_stale_literal(self, doc):