boost-skill-cli 1.2.183__tar.gz → 1.2.184__tar.gz

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.183
+Version: 1.2.184
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.183'
-__version_tuple__ = version_tuple = (1, 2, 183)
+__version__ = version = '1.2.184'
+__version_tuple__ = version_tuple = (1, 2, 184)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/boost_cli/commands/configuration.py

@@ -1648,12 +1648,22 @@ def _tool_doctor(args: dict):
         if vals:
             lines.append("%s: %s" % (key, ", ".join(str(v) for v in vals)))
     # sync_plan already reports MISSING rule/workflow materializations; the
-    # digest check adds the drift sync cannot see — content edited in place.
-    mat_issues = ["%s %s: modified since install" % (kind, n)
-                  for kind in ("rule", "workflow")
-                  for n, e in sorted(everything[kind].items())
-                  if (integrity.materialized_status(n, e, kind)
-                      == integrity.STATUS_MODIFIED)]
+    # digest check adds the drift sync cannot see — content edited in place,
+    # and an item that reaches no agent at all. The second is squarely the
+    # same case: sync_plan filters an unwritten row out by design, so an item
+    # whose every row is unwritten is invisible to it. A label map rather
+    # than an equality test, so a status added to one of these and not the
+    # other cannot quietly drop out of the count on the one doctor surface
+    # with no human reading it.
+    _MAT_ISSUE_LABEL = {
+        integrity.STATUS_MODIFIED: "modified since install",
+        integrity.STATUS_UNREACHABLE: "reaches no agent boost writes",
+    }
+    mat_issues = [
+        "%s %s: %s" % (kind, n, _MAT_ISSUE_LABEL[st])
+        for kind in ("rule", "workflow")
+        for n, e in sorted(everything[kind].items())
+        if (st := integrity.materialized_status(n, e, kind)) in _MAT_ISSUE_LABEL]
     lines.extend(mat_issues)
     total = issues + len(mat_issues)
     # A machine with no taps has nothing to disagree about, so every check

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/boost_cli/commands/info.py

@@ -437,6 +437,19 @@ def _info_materialized(name: str, kind: str, entry: dict, as_json: bool) -> int:
         # nothing. Printing the stale agent list here reads as a lie about
         # files that were just removed.
         out.kv("materialized", "(removed — quarantined)")
+    elif integrity.reaches_no_agent(kind, entry):
+        # `agent_names` lists every recorded row, so the dangerous case
+        # advertised the five agents the rule does not reach while the
+        # harmless no-rows case showed none — the two read backwards from
+        # how a user judges risk.
+        # Both halves inflect. One row is the commonest shape by far -- most
+        # items record exactly one -- so a noun-only plural put the ungrammar
+        # on the usual path and hid it on the rare one.
+        rows = len(entry.get("materializations") or [])
+        out.kv("materialized",
+               "(none — %d recorded row%s name%s an agent boost no longer "
+               "writes)" % (rows, "" if rows == 1 else "s",
+                            "s" if rows == 1 else ""))
     else:
         out.kv("materialized",
                ", ".join(lockfile.agent_names(kind, entry)) or "(none)")

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/boost_cli/commands/quality.py

@@ -258,6 +258,11 @@ def _drift_status_materialized(kind: str, name: str, entry: dict) -> str:
         return "store-missing"
     if st == integrity.STATUS_MODIFIED:
         return "local-edits"
+    if st == integrity.STATUS_UNREACHABLE:
+        # Before the tap comparison below, which would otherwise launder an
+        # item that reaches no agent into "in-sync" on the strength of a
+        # source file matching a hash nothing on disk was written from.
+        return "unreachable"
     if entry.get("tap") == "local":
         return "n/a"
     try:
@@ -270,10 +275,15 @@ def _drift_status_materialized(kind: str, name: str, entry: dict) -> str:
     return "in-sync"
 
 
+#: Every word `_drift_status` and `_drift_status_materialized` can return.
+#: The render site subscripts this directly, so a missing key is a KeyError --
+#: not a BoostError, so `boost drift` exits 70 with a crash report rather than
+#: mis-painting one cell. `test_drift_vocabulary_is_covered` pins the two
+#: against each other.
 _DRIFT_ROLE = {"in-sync": "success", "local-edits": "warn",
                "upstream-moved": "accent", "source-missing": "danger",
                "store-missing": "danger", "n/a": "muted",
-               "quarantined": "muted"}
+               "quarantined": "muted", "unreachable": "warn"}
 
 
 def _drift_hint(name: str, status: str, tap: str = "") -> str:
@@ -290,6 +300,12 @@ def _drift_hint(name: str, status: str, tap: str = "") -> str:
         return "boost update" if registry.is_tapped(tap) else "boost tap %s" % tap
     if status == "store-missing":
         return "boost heal"
+    if status == "unreachable":
+        # Not `boost sync`: it filters these rows out by design, so it is a
+        # guaranteed no-op. Not "re-enable the agent" either -- that is wrong
+        # advice for `agents.WITHDRAWN_REASONS`. `doctor` is where
+        # `_mat_remedy` words the split correctly.
+        return "boost doctor"
     return ""
 
 
@@ -744,6 +760,32 @@ def cmd_doctor(argv):
                  % (len(off), _s(len(off)), "s" if len(off) == 1 else "",
                     ", ".join(shown), _mat_remedy(off)),
                  wrap=True)
+    # The per-row note above answers "which row, which agent, why". This
+    # answers a different question the surfaces had nowhere to put: skip every
+    # row an item has and the item reached no agent at all. `rep.note`, not
+    # `rep.warn` -- WARN is documented as restating a fault already counted,
+    # and this one is counted nowhere -- and not `rep.issue`, which would
+    # invert doctor's standing convention that a config-orphaned row is the
+    # user's own decision, named once and never scored. `verify` and `attest`
+    # are the surfaces that fail; doctor's job here is to stop contradicting
+    # its own note.
+    nowhere = [(kind, name)
+               for kind, section in (("rule", rules), ("workflow", workflows))
+               for name, entry in sorted(section.items())
+               if integrity.reaches_no_agent(kind, entry)]
+    if nowhere:
+        # No remedy sentence: every one of these items has at least one row,
+        # so the per-row note above has already printed `_mat_remedy`'s
+        # wording for it, and repeating it verbatim one line later is how a
+        # report teaches the reader to skim past it.
+        rep.note("materialized-nowhere",
+                 "%d item%s reach%s no agent boost writes, so %s installed "
+                 "but loaded by nothing: %s"
+                 % (len(nowhere), _s(len(nowhere)),
+                    "es" if len(nowhere) == 1 else "",
+                    "it is" if len(nowhere) == 1 else "they are",
+                    ", ".join("%s %s" % (k, n) for k, n in nowhere)),
+                 wrap=True)
     if (all_rules or all_workflows) and not mat_issues:
         # Quarantined rules/workflows are excluded above so their stashed-but-
         # removed materializations don't read as rot — but excluding them from
@@ -765,9 +807,15 @@ def cmd_doctor(argv):
             # right above it: "fully materialized" is true of the agents boost
             # writes, and that is now a smaller set than the rows record.
             note += " for every agent boost writes"
+        # Counted over the items that reach at least one agent. The suffix
+        # above is what the note said this line contradicted -- "fully
+        # materialized for every agent boost writes" is trivially true of an
+        # item whose write set is empty, so counting it there is what made
+        # the count true as worded and false as read.
+        n_rules = len(rules) - sum(1 for k, _n in nowhere if k == "rule")
+        n_flows = len(workflows) - sum(1 for k, _n in nowhere if k == "workflow")
         rep.ok("rules-workflows", "%d rule%s and %d workflow%s fully materialized%s"
-               % (len(rules), _s(len(rules)), len(workflows), _s(len(workflows)),
-                  note))
+               % (n_rules, _s(n_rules), n_flows, _s(n_flows), note))
 
     root = paths.store_dir()
     orphans = [c.name for c in sorted(root.iterdir())
@@ -939,7 +987,21 @@ def cmd_doctor(argv):
     # MCP `boost_doctor` tool already refused to say "healthy" here; this is
     # the CLI half of the same rule.
     issues = rep.issues
-    if issues == 0 and not configured:
+    if issues == 0 and nowhere:
+        # Same rule as the no-taps case above, for the same reason: "healthy"
+        # is the one word this machine is not. An item nothing loads is not
+        # an issue -- it is the user's own config, and doctor's convention is
+        # to name that rather than score it -- but `boost health` keys
+        # `needs attention` on it and sends the reader here, so a verdict
+        # reading "healthy" would close that loop with a flat contradiction.
+        # Reported, never fatal: the exit code still turns only on issues.
+        # Ahead of the no-taps branch below on purpose: a machine holding an
+        # installed item is not "ready to set up", and that wording would
+        # bury the more specific fact under a setup prompt.
+        rep.verdict(False,
+                    "%d item%s installed but loaded by nothing — see above"
+                    % (len(nowhere), _s(len(nowhere))))
+    elif issues == 0 and not configured:
         rep.verdict(True, "ready to set up — tap a registry to make boost "
                           "searchable")
     else:
@@ -1750,9 +1812,16 @@ def cmd_health(argv):
     kv("journal (7d)", "%d event%s" % (recent, _s(recent)), recent)
     kv("fingerprint", _fingerprint()[0][:16])
 
+    # The membership rule is "is there anything there", not "has it drifted":
+    # `local-edits` and `upstream-moved` are expected states of a *live*
+    # install, while these three each mean the install reaches nothing --
+    # the store dir is gone, the source is gone, or no agent was ever
+    # written. Leaving `unreachable` out would be the bug this status was
+    # added for, wearing a new word.
     attention = (bool(broken) or not coverage_ok
                  or drift_counts.get("store-missing", 0) > 0
                  or drift_counts.get("source-missing", 0) > 0
+                 or drift_counts.get("unreachable", 0) > 0
                  or not journal.rotation_healthy())
     if args.json:
         print(json.dumps(data | {"ok": not attention,

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/boost_cli/commands/safety.py

@@ -645,14 +645,21 @@ def cmd_attest(argv):
                 # it was written. UNLOCKED (a pre-hash entry) never fails.
                 st = integrity.materialized_status(name, entry, kind)
             rec["sha_ok"] = st not in (integrity.STATUS_MODIFIED,
-                                       integrity.STATUS_MISSING)
+                                       integrity.STATUS_MISSING,
+                                       integrity.STATUS_UNREACHABLE)
             rec["journal"] = ev is not None
             if not rec["sha_ok"]:
                 # A missing store dir / materialized artifact is not a content
                 # change — conflating the two sends the user hunting for
-                # tampering when the remedy is `boost heal`.
-                rec["reason"] = ("missing" if st == integrity.STATUS_MISSING
-                                 else "modified")
+                # tampering when the remedy is `boost heal`. Unreachable is a
+                # third thing again: nothing was tampered with and nothing is
+                # missing, because no artifact was ever written. Folding it
+                # into "modified" would accuse a user of editing a file whose
+                # only act was turning an agent off.
+                rec["reason"] = (
+                    "unreachable" if st == integrity.STATUS_UNREACHABLE
+                    else "missing" if st == integrity.STATUS_MISSING
+                    else "modified")
                 failures += 1
         records.append(rec)
 
@@ -673,7 +680,13 @@ def cmd_attest(argv):
     if args.verify:
         for r in records:
             if not r["sha_ok"]:
-                if r["reason"] == "missing":
+                if r["reason"] == "unreachable":
+                    # Not `boost sync`: it filters these rows out by design,
+                    # so it is a guaranteed no-op. `doctor` is where
+                    # `_mat_remedy` words the per-agent remedy correctly.
+                    msg = ("reaches no agent boost writes — nothing was "
+                           "attested (boost doctor names the agents)")
+                elif r["reason"] == "missing":
                     msg = ("store directory missing (boost heal)"
                            if r["kind"] == "skill"
                            else "materialized file missing")

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/boost_cli/core/integrity.py

@@ -33,6 +33,8 @@ STATUS_MODIFIED = "modified"     # on-disk content no longer matches the lock
 STATUS_MISSING = "missing"       # lock says installed, but the store dir is gone
 STATUS_UNLOCKED = "unlocked"     # present on disk but no lock digest to check
 STATUS_QUARANTINED = "quarantined"  # artifacts removed on purpose; stash holds them
+STATUS_UNREACHABLE = "unreachable"  # rows exist and boost writes none of the
+                                    # agents they name: the item reached nothing
 
 ENFORCE_KEY = "security.enforce_digest"
 COMMIT_KEY = "security.enforce_commit"
@@ -64,6 +66,40 @@ def status(name: str, entry: dict | None = None) -> str:
     return STATUS_OK if util.sha256_dir(sdir) == recorded else STATUS_MODIFIED
 
 
+def reaches_no_agent(kind: str | None, entry: dict) -> bool:
+    """Whether every materialization row names an agent boost no longer writes.
+
+    Skipping such a row is right *per row*: nothing wrote that file and
+    nothing ever will, so reading it as ``MISSING`` reported a fault whose
+    remedy could not run (:func:`agents.materialization_is_written`).
+    Skipping *every* row of an item is a different fact -- the rule reaches
+    no agent, the workflow is in no command palette -- and the loop that
+    skipped them has nothing left to judge, so it fell through to ``OK`` and
+    an install that materialized nowhere read as healthy on every surface but
+    ``doctor``'s note.
+
+    An item with **no rows** is not this case and must keep reading ``OK``: a
+    rule installed before rows existed has nothing to be unreachable about.
+    That is the whole of ``bool(rows)``, and keying on "no row was written"
+    instead would condemn every pre-rows entry on five surfaces at once. A
+    row carrying no ``agent`` counts as written -- ``agents`` answers ``True``
+    for it, preferring a reported gap to a dropped one -- so such an entry is
+    judged by the loop, never condemned here.
+
+    One predicate because two surfaces ask it: :func:`materialized_status`
+    below, and ``boost doctor``, which walks the rows itself rather than
+    re-reading every artifact. Re-deriving it in the command layer is how the
+    two would come to disagree -- the same failure the ``kind`` parameter was
+    added to :func:`materialized_status` to prevent.
+    """
+    rows = entry.get("materializations") or []
+    kind = str(kind or entry.get("kind") or "rule")
+    return bool(rows) and not any(
+        agents.materialization_is_written(kind, entry.get("base"),
+                                          m.get("agent"))
+        for m in rows)
+
+
 def materialized_status(name: str, entry: dict,
                         kind: str | None = None) -> str:
     """Classify a rule/workflow's integrity against its lock entry.
@@ -91,8 +127,17 @@ def materialized_status(name: str, entry: dict,
     from . import rules
     if entry.get("quarantined"):
         return STATUS_QUARANTINED
-    unlocked = False
     kind = str(kind or entry.get("kind") or "rule")
+    # Every row skipped means the item reached nothing. Asked before the loop
+    # rather than after it because each of the three in-loop outcomes needs a
+    # *written* row -- MISSING and MODIFIED return from inside the body and
+    # `unlocked` is only set there -- so this is mutually exclusive with all
+    # of them and there is no precedence to settle. Quarantine still wins
+    # above: those artifacts are gone on purpose, and calling that unreachable
+    # would send the user to a remedy that re-arms what quarantine disarmed.
+    if reaches_no_agent(kind, entry):
+        return STATUS_UNREACHABLE
+    unlocked = False
     for m in entry.get("materializations") or []:
         # A row naming an agent boost no longer writes is a record, not an
         # artifact: nothing wrote that file and nothing ever will, so reading
@@ -202,6 +247,7 @@ def verification_passed(status: str, missing_fields: list, commit_pin: str | Non
 _VERIFY_ROLE_BY_STATUS = {
     STATUS_OK: "success", STATUS_MODIFIED: "warn", STATUS_MISSING: "danger",
     STATUS_UNLOCKED: "warn", STATUS_QUARANTINED: "muted",
+    STATUS_UNREACHABLE: "warn",
 }
 
 

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.183
+Version: 1.2.184
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/docs/roadmap/items/an-item-materialized-nowhere-reads-ok-in-verify-health-drift.md

@@ -2,14 +2,14 @@
 id: an-item-materialized-nowhere-reads-ok-in-verify-health-drift
 board: code
 section: health
-status: planned
+status: inflight
 category: CLI · Bug
 complexity: S
 impact: Low
 wow: 2
 note: a rule whose every materialization row names an agent boost no longer writes reads "ok" in verify and is counted as installed by health — only doctor says otherwise
 order: 354
-owner:
+owner: loop/materialized-nowhere
 pr:
 title: An item materialized <em>nowhere</em> reads <code>ok</code> in <code>verify</code>, <code>health</code> and <code>drift</code>
 ---

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/docs/roadmap.html

@@ -3807,7 +3807,7 @@ step at the top of the command whose failure degrades the agent-dependent sectio
       </article>
 
       <article class="cap rcard" id="an-item-materialized-nowhere-reads-ok-in-verify-health-drift">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">CLI · Bug</span></div>
+        <div class="head"><span class="pill inflight">In flight</span><span class="cat">CLI · Bug</span></div>
         <h3>An item materialized <em>nowhere</em> reads <code>ok</code> in <code>verify</code>, <code>health</code> and <code>drift</code></h3>
         <p><b>Found by the second review of</b> <code>sync-repairs-a-disabled-agents-row-every-run</code>.
 That item fixed a row for an agent boost no longer writes being read as a <em>missing artifact</em>:

{boost_skill_cli-1.2.183 → boost_skill_cli-1.2.184}/tests/functional/test_cli_quality.py

@@ -2843,9 +2843,51 @@ class TestARowForADisabledAgent:
         assert "boost uninstall" in flat
         assert "missing its cursor materialization" not in flat
         assert "issue needs attention" not in flat
-        # and the count line must not read as a flat contradiction of it
+        # This fixture is one rule with one row, so it is also the per-ITEM
+        # case: skip the only row and the rule reaches nothing. The count
+        # line must therefore not count it. Before this it said "1 rule ...
+        # fully materialized for every agent boost writes" -- true as worded
+        # and false as read, because the write set was empty and every item
+        # satisfies all of nothing.
+        assert "0 rules and 0 workflows fully materialized " \
+               "for every agent boost writes" in flat
+        assert "1 item reaches no agent boost writes" in flat
+        assert "rule house" in flat
+        # named, never scored: doctor's convention is that a config-orphaned
+        # row is the user's own decision
+        assert r.rc == 0
+        # ...but the verdict may not then call the machine healthy, because
+        # `boost health` keys "needs attention" on this and sends the reader
+        # straight here
+        assert "1 item installed but loaded by nothing" in flat
+        assert "● healthy" not in r.out
+
+    def test_an_item_that_still_reaches_one_agent_is_not_named(self, boost,
+                                                               sandbox):
+        """The partial case, which proves the suffix is no longer vacuous.
+
+        Two rows, one agent disabled: four surfaces must stay quiet. The
+        per-row note still fires -- that is its job -- but the item reaches
+        `windsurf`, so it is counted and not named as unreachable.
+        """
+        from boost_cli.core import lockfile
+        cur = paths.home() / ".cursor" / "rules" / "house.mdc"
+        wnd = paths.home() / ".windsurf" / "rules" / "house.md"
+        for f in (cur, wnd):
+            f.parent.mkdir(parents=True, exist_ok=True)
+            f.write_text("x\n", encoding="utf-8")
+        lockfile.set_rule("house", {"kind": "rule", "materializations": [
+            {"agent": "cursor", "mode": "file", "path": str(cur)},
+            {"agent": "windsurf", "mode": "file", "path": str(wnd)}]})
+        self._disable()
+        flat = " ".join(boost("doctor").out.split())
+        assert "1 recorded materialization names an agent boost no longer " \
+               "writes" in flat
         assert "1 rule and 0 workflows fully materialized " \
                "for every agent boost writes" in flat
+        assert "reaches no agent boost writes" not in flat
+        assert "loaded by nothing" not in flat
+
 
     def test_the_same_row_is_rot_again_once_the_agent_is_back(self, boost,
                                                               sandbox):
@@ -2963,3 +3005,124 @@ class TestARowForADisabledAgent:
         flat = " ".join(boost("doctor").out.split())
         assert "Change that agent's entry in" in flat
         assert "turn back on" not in flat
+
+
+class TestAnItemMaterializedNowhere:
+    """An item whose every row names an agent boost no longer writes.
+
+    Skipping a row is right per row; skipping every row an item has means it
+    reached no agent at all, and `verify`, `drift`, `health` and
+    `attest --verify` all read that as fine. Only `doctor` had a channel for
+    it, and it then contradicted itself two lines later.
+    """
+
+    def _seed_unreachable(self, name="house"):
+        from boost_cli.core import config, lockfile
+        rp = paths.home() / ".cursor" / "rules" / ("%s.mdc" % name)
+        lockfile.set_rule(name, {
+            "kind": "rule", "tap": "local", "version": "1.0.0",
+            "sha256": "a" * 64, "installed_at": "2026-01-01T00:00:00Z",
+            "materializations": [{"agent": "cursor", "mode": "file",
+                                  "path": str(rp), "sha256": "b" * 64}]})
+        cfg = config.load()
+        cfg["agents"]["cursor"]["enabled"] = False
+        config.save(cfg)
+
+    def _seed_rows(self, n, name="many"):
+        """`n` rows for one disabled agent, so row count is the only variable."""
+        from boost_cli.core import config, lockfile
+        rows = [{"agent": "cursor", "mode": "file",
+                 "path": str(paths.home() / ".cursor" / "rules"
+                            / ("%s-%d.mdc" % (name, i))),
+                 "sha256": "b" * 64} for i in range(n)]
+        lockfile.set_rule(name, {
+            "kind": "rule", "tap": "local", "version": "1.0.0",
+            "sha256": "a" * 64, "installed_at": "2026-01-01T00:00:00Z",
+            "materializations": rows})
+        cfg = config.load()
+        cfg["agents"]["cursor"]["enabled"] = False
+        config.save(cfg)
+
+    def test_info_says_none_and_counts_the_rows(self, boost, sandbox):
+        """`boost info` used to list the agents the item does NOT reach --
+        `agent_names` walks every recorded row -- so the dangerous case
+        advertised five agents and the harmless no-rows case showed none,
+        exactly backwards from how a user judges risk."""
+        self._seed_unreachable()
+        out = boost("info", "house").out
+        assert "(none — 1 recorded row names an agent boost no longer " \
+               "writes)" in out
+        # the row's agent is the thing that must NOT be advertised as reached
+        assert "materialized  cursor" not in out
+
+    def test_the_count_line_inflects_both_halves(self, boost, sandbox):
+        """One row is the commonest shape by far, so a noun-only plural put
+        the ungrammar on the usual path: "1 recorded row name an agent"."""
+        self._seed_rows(1, "one")
+        assert "1 recorded row names an agent" in boost("info", "one").out
+        self._seed_rows(2, "two")
+        assert "2 recorded rows name an agent" in boost("info", "two").out
+
+    def test_verify_fails_it(self, boost, sandbox):
+        """`verify` is what scripts gate on, and it passed an install that
+        reaches nothing -- the reason this is not cosmetic."""
+        self._seed_unreachable()
+        r = boost("verify", expect=1)
+        assert "unreachable" in r.out
+
+    def test_verify_json_carries_the_status(self, boost, sandbox):
+        self._seed_unreachable()
+        doc = json.loads(boost("verify", "--json", expect=1).out)
+        row = next(s for s in doc["skills"] if s["name"] == "house")
+        assert row["status"] == "unreachable"
+        assert row["passed"] is False
+        assert doc["failed"] == 1
+
+    def test_attest_names_it_without_accusing_the_user(self, boost, sandbox):
+        """`sha_ok` already does not mean "a sha mismatched" -- MISSING sets
+        it false with no content change. Folding this into "modified" would
+        print "no longer matches the lock sha" at a user whose only act was
+        turning an agent off."""
+        self._seed_unreachable()
+        r = boost("attest", "--verify", expect=1)
+        assert "reaches no agent boost writes" in r.out
+        assert "no longer matches" not in r.out
+        assert "boost sync" not in r.out
+
+    def test_attest_json_gets_its_own_reason(self, boost, sandbox):
+        self._seed_unreachable()
+        doc = json.loads(boost("attest", "--verify", "--json", expect=1).out)
+        row = next(s for s in doc["skills"] if s["name"] == "house")
+        assert row["sha_ok"] is False
+        assert row["reason"] == "unreachable"
+
+    def test_drift_says_so_rather_than_in_sync(self, boost, sandbox):
+        self._seed_unreachable()
+        r = boost("drift")
+        assert "unreachable" in r.out
+        assert "in-sync" not in r.out
+        # not `boost sync`, which filters the row out by design
+        assert "boost doctor" in r.out
+
+    def test_health_needs_attention(self, boost, sandbox):
+        self._seed_unreachable()
+        doc = json.loads(boost("health", "--json").out)
+        assert doc["drift"].get("unreachable") == 1
+        assert doc["ok"] is False
+        assert doc["status"] == "needs attention"
+
+    def test_an_item_with_no_rows_at_all_stays_ok(self, boost, sandbox):
+        """The control case, and the dangerous direction: keying on "no row
+        was written" rather than "rows existed and none was written" turns
+        every pre-rows lock entry into a fault on five surfaces at once."""
+        from boost_cli.core import lockfile
+        lockfile.set_rule("house", {
+            "kind": "rule", "tap": "local", "version": "1.0.0",
+            "sha256": "a" * 64, "installed_at": "2026-01-01T00:00:00Z",
+            "materializations": []})
+        assert "ok" in boost("verify").out
+        assert "unreachable" not in boost("drift").out
+        assert json.loads(boost("health", "--json").out)["ok"] is True
+        flat = " ".join(boost("doctor").out.split())
+        assert "1 rule and 0 workflows fully materialized" in flat
+        assert "loaded by nothing" not in flat

boost_skill_cli-1.2.184/tests/unit/test_drift_hint.py

@@ -0,0 +1,115 @@
+# Copyright the boost contributors.
+# SPDX-License-Identifier: Apache-2.0
+"""Unit tests: `_drift_hint`'s branches, and the drift vocabulary itself.
+
+`boost update` only refreshes configured taps, so hinting it for a skill
+whose tap was untapped is a guaranteed no-op — the CLI audit's repro. Pinned
+directly against `registry.is_tapped` (monkeypatched) rather than through a
+full `boost drift` run, because reaching "source-missing while still tapped"
+end-to-end would require a tap whose clone cannot be silently re-fetched,
+which `store.source_dir_for` does for anything with a reachable URL.
+"""
+from __future__ import annotations
+
+from typing import ClassVar
+
+from boost_cli.commands import quality
+from boost_cli.core import integrity
+from boost_cli.core import output as out
+
+
+class TestDriftHintSourceMissing:
+    def test_untapped_hints_retap(self, monkeypatch):
+        monkeypatch.setattr(quality.registry, "is_tapped", lambda name: False)
+        assert (quality._drift_hint("brainstorming", "source-missing",
+                                    "owner/repo")
+                == "boost tap owner/repo")
+
+    def test_still_tapped_hints_update(self, monkeypatch):
+        monkeypatch.setattr(quality.registry, "is_tapped", lambda name: True)
+        assert (quality._drift_hint("brainstorming", "source-missing",
+                                    "owner/repo")
+                == "boost update")
+
+
+class TestDriftHintOtherStatuses:
+    """Untouched by this fix — pinned so the source-missing branch can't
+    leak into a neighboring status."""
+
+    def test_quarantined(self):
+        assert (quality._drift_hint("x", "quarantined")
+                == "boost quarantine --release x to restore")
+
+    def test_upstream_moved(self):
+        assert quality._drift_hint("x", "upstream-moved") == "boost update"
+
+    def test_local_edits(self):
+        assert (quality._drift_hint("x", "local-edits")
+                == "boost reinstall x to discard local edits")
+
+    def test_store_missing(self):
+        assert quality._drift_hint("x", "store-missing") == "boost heal"
+
+    def test_in_sync_has_no_hint(self):
+        assert quality._drift_hint("x", "in-sync") == ""
+
+    def test_defaults_to_empty_tap(self):
+        # `_drift_hint` is called with no explicit tap outside source-missing,
+        # so the default must not raise even though it is never dereferenced.
+        assert quality._drift_hint("x", "n/a") == ""
+
+    def test_unreachable_hints_doctor_and_never_sync(self):
+        """`boost sync` filters an unwritten row out by design, so hinting it
+        here would be a guaranteed no-op -- the same fault the whole
+        source-missing branch above exists to avoid. And "re-enable the
+        agent" is wrong advice for `agents.WITHDRAWN_REASONS`, so the hint
+        points at the one command that words the split correctly."""
+        hint = quality._drift_hint("x", "unreachable")
+        assert hint == "boost doctor"
+        assert "sync" not in hint
+
+
+class TestDriftVocabularyIsCovered:
+    """`_DRIFT_ROLE` is subscripted directly at the render site.
+
+    `cmd_drift` builds its table with `_DRIFT_ROLE[r["status"]]`, so a word
+    the status functions can return and this table does not carry is a
+    `KeyError` -- not a `BoostError`, so it escapes the CLI's handler and
+    `boost drift` exits 70 with a crash report rather than mis-painting one
+    cell. Unlike the historical `_PROVENANCE_STYLE` bug it is not masked by
+    `NO_COLOR`: the lookup happens before `out.role` can short-circuit. The
+    suite only catches that on a test that reaches the state, so the two
+    tables are linted against each other here instead.
+    """
+
+    #: Every word `_drift_status_materialized` and `_drift_status` can return.
+    #: `staleness.drift_state` owns the skill half.
+    WORDS: ClassVar[set[str]] = {
+        "in-sync", "local-edits", "upstream-moved", "source-missing",
+        "store-missing", "n/a", "quarantined", "unreachable"}
+
+    def test_every_drift_word_has_a_role(self):
+        assert set(quality._DRIFT_ROLE) >= self.WORDS
+
+    def test_every_role_is_a_real_palette_entry(self):
+        """`out.role` looks the name up in `output.ROLES`; a name that is not
+        there raised KeyError on any colour terminal, which is exactly how
+        the `_PROVENANCE_STYLE` "err" bug shipped."""
+        assert set(quality._DRIFT_ROLE.values()) <= set(out.ROLES)
+
+    def test_the_materialized_statuses_each_map_to_a_word(self):
+        """The three integrity statuses `_drift_status_materialized`
+        translates must each land on a word this table carries, so a new
+        status cannot reach the render site unmapped."""
+        for st in (integrity.STATUS_MISSING, integrity.STATUS_MODIFIED,
+                   integrity.STATUS_UNREACHABLE):
+            assert quality._DRIFT_ROLE[_STATUS_WORD[st]]
+
+
+#: How `_drift_status_materialized` spells each integrity status.
+_STATUS_WORD = {
+    integrity.STATUS_MISSING: "store-missing",
+    integrity.STATUS_MODIFIED: "local-edits",
+    integrity.STATUS_UNREACHABLE: "unreachable",
+}
+