boost-skill-cli 1.2.27__tar.gz → 1.2.28__tar.gz

{boost_skill_cli-1.2.27 → boost_skill_cli-1.2.28}/.vale/styles/config/vocabularies/boost/accept.txt

@@ -7,6 +7,12 @@ argparse
 Arize
 ASan
 Attio
+Autofix
+autofix
+Backfilling
+backfilling
+backport
+backported
 backtick
 backticks
 Bagisto
@@ -72,6 +78,7 @@ mcp
 mergeable
 minisign
 misconfiguration
+mitigations
 MLflow
 mutmut
 mypy
@@ -112,8 +119,10 @@ Saltzer
 sandboxed
 sandboxing
 scrollbar
+sdist
 SEO
 setuptools
+SHAs
 Shopify
 Sigstore
 SonarCloud
@@ -144,6 +153,7 @@ unkilled
 unlinking
 unpatched
 unregister
+unremediated
 unstaged
 untap
 untrusted

{boost_skill_cli-1.2.27 → boost_skill_cli-1.2.28}/.vale.ini

@@ -20,5 +20,12 @@ Vale.Terms = NO
 [docs/roadmap/items/*.md]
 BasedOnStyles =
 
+; docs/commit-audit.md is a generated record: a table of short SHAs, file paths
+; and tool identifiers produced by an audit pass, not authored prose. Spelling
+; it would mean adding ~27 one-off identifiers to the shared vocabulary, which
+; would weaken the check everywhere else to lint one machine-written file.
+[docs/commit-audit.md]
+BasedOnStyles =
+
 [.claude/**/*.md]
 BasedOnStyles =

{boost_skill_cli-1.2.27 → boost_skill_cli-1.2.28}/CONTRIBUTING.md

@@ -98,6 +98,36 @@ list, and neither should be added to it.
 | `refurb boost_cli` | modernization smells the ruff families miss, zero findings |
 | `scripts/lock_toolchain.py --check` | the hash-pinned toolchain matches its `.in` declarations |
 
+## Sign your commits (DCO)
+
+Every commit needs a `Signed-off-by` trailer naming **you**, the author. It is
+your assertion, under the [Developer Certificate of Origin](DCO), that you have
+the right to submit the work. Git writes it for you:
+
+```bash
+git commit -s              # sign off as you go
+git commit --amend --signoff --no-edit    # fix the last commit
+git rebase --signoff origin/main          # fix a whole branch
+```
+
+`scripts/check_dco.py` enforces it as a required check, and you can run the
+exact same check locally:
+
+```bash
+python3 scripts/check_dco.py              # HEAD against origin/main
+```
+
+Two things it deliberately will not accept. The trailer must name the **author** of
+the commit it sits on — a sign-off from anyone else certifies nothing, so it is
+rejected rather than counted. And the check only ever looks at the commits your
+pull request adds: DCO applies from the commit that introduced it, and history
+before that is left alone. Backfilling sign-offs would mean rewriting `main`,
+breaking 478 tags and invalidating the build-provenance attestation on every
+published release, to record an assertion nobody actually made.
+
+Bot authors (Dependabot and friends) are exempt — an account cannot agree to a
+certificate.
+
 ## Code of conduct
 
 Participation is governed by the [Code of Conduct](CODE_OF_CONDUCT.md)

boost_skill_cli-1.2.28/DCO

@@ -0,0 +1,34 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.

boost_skill_cli-1.2.28/MAINTAINERS.md

@@ -0,0 +1,102 @@
+# Maintainers
+
+Who has access to what, what each role is expected to do, and what has to
+happen before anyone is granted more. This file is the authoritative list; if it
+disagrees with someone's memory, this file is right and the memory is stale.
+
+## Current maintainers
+
+| Name | GitHub | Role | Since |
+|---|---|---|---|
+| Jonathan Reyes | [@jonnyeclectic](https://github.com/jonnyeclectic) | Lead maintainer | 2026-07 |
+
+boost is a **single-maintainer project today**. That is stated plainly rather
+than glossed, because it is the single largest risk to the project and it
+changes what you should expect: review latency depends on one person, and the
+bus factor is one. See [Continuity](#continuity) for what happens if that
+person becomes unavailable, and [Becoming a maintainer](#becoming-a-maintainer)
+for how that changes.
+
+## Access to sensitive resources
+
+Every credential and privileged surface the project depends on, and who holds
+it. Nothing not listed here grants access to anything.
+
+| Resource | Who has access | How access works |
+|---|---|---|
+| GitHub repository (admin) | Lead maintainer | GitHub account with 2FA |
+| `main` branch | **No one directly.** | A ruleset requires a pull request and the full required-check gate; `non_fast_forward` blocks history rewrites. Admin included. |
+| PyPI project `boost-skill-cli` | **No stored credential exists.** | Publishing is a [PyPI Trusted Publisher](https://docs.pypi.org/trusted-publishers/): GitHub mints a short-lived OIDC token for `publish.yml` on `main` only. There is no API token to leak, share, or rotate. |
+| GitHub Actions secrets | Lead maintainer | Only optional dashboard tokens (`CODECOV_TOKEN`, `SONAR_TOKEN`) and optional evaluation API keys. Every job reading one skips itself when it is absent, so none is required to build, test, or release. |
+| Security advisories / private vulnerability reports | Lead maintainer | GitHub private vulnerability reporting |
+| GitHub Pages docs site | Lead maintainer | Published from `main` by CI; no separate credential |
+
+## Roles and responsibilities
+
+**Lead maintainer.** Sets direction; reviews and merges pull requests; owns the
+release process; is the recipient of private vulnerability reports and owns the
+response; administers repository settings, branch rulesets and the required-check
+list; maintains this file.
+
+**Maintainer** (none appointed yet). Reviews and merges pull requests within an
+agreed area; may not change repository settings, rulesets, or the release path.
+A maintainer is expected to keep the quality gates green rather than route
+around them, and to say so publicly when a gate is wrong instead of disabling it
+quietly.
+
+**Contributor.** Anyone who opens a pull request. No standing permissions; a
+contribution is merged by a maintainer after the gates pass. See
+[CONTRIBUTING.md](CONTRIBUTING.md).
+
+**Security reporter.** Anyone who reports a vulnerability through the process in
+[SECURITY.md](SECURITY.md). Reporters are credited by name in the advisory and
+the release notes unless they ask not to be.
+
+## Becoming a maintainer
+
+Escalated permission is granted deliberately and never by default. The policy:
+
+1. **A track record first.** A sustained series of merged, non-trivial
+   contributions — enough that their judgement on this codebase is a known
+   quantity, not an assumption.
+2. **Review before the grant.** The lead maintainer reviews that history and
+   proposes the change in a public issue, naming the scope of access being
+   granted and why. Existing maintainers may object there.
+3. **Least privilege at the grant.** New collaborators receive the lowest
+   permission that lets them do the job. Write access is a separate, later
+   decision from repository administration, which is a separate decision again
+   from anything touching the release path.
+4. **This file is updated in the same change** that grants the permission. An
+   access grant that is not recorded here has not happened.
+
+The same review applies when an existing maintainer is given more access, not
+only to a first grant.
+
+## Removing access
+
+Access is removed promptly when a maintainer steps down, becomes unreachable for
+an extended period, or at their own request — and immediately if an account is
+believed compromised. Removal does not require agreement from the person losing
+access. Because publishing uses a short-lived OIDC identity rather than a stored
+token, removing someone's GitHub access removes their ability to release; there
+is no separate credential left behind to revoke.
+
+## Continuity
+
+If the lead maintainer becomes unavailable:
+
+- **The code is safe regardless.** It is GPL-3.0, the full history is public,
+  and every release is reproducible from a public tag. Anyone may fork.
+- **The published artifacts stay published.** PyPI releases and GitHub releases
+  remain available; nothing expires if no one logs in.
+- **Recovery of the canonical repository** would go through
+  [GitHub's account-recovery and inactive-repository processes](https://docs.github.com/en/site-policy).
+  Because the release path is a GitHub OIDC identity bound to this repository,
+  whoever legitimately controls the repository controls releases — there is no
+  personal token that has to be handed over.
+- **The practical answer is to fork.** Until a second maintainer exists, that
+  is the honest continuity plan, and the project would rather say so than
+  imply a succession process it does not have.
+
+Reducing this risk is open work: if you have been contributing and want to help
+carry it, say so in an issue.

{boost_skill_cli-1.2.27 → boost_skill_cli-1.2.28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.27
+Version: 1.2.28
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

boost_skill_cli-1.2.28/SECURITY.md

@@ -0,0 +1,86 @@
+# Security policy
+
+## Supported versions
+
+Only the latest release receives security fixes. [SUPPORT.md](SUPPORT.md) sets
+out the scope and duration of support in full, including when a version stops
+receiving security updates.
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for security reports. Instead, use
+GitHub's private vulnerability reporting:
+
+**[Report a vulnerability](https://github.com/jonnyeclectic/boost/security/advisories/new)**
+
+You can expect an acknowledgement within a few days. Please include steps to
+reproduce and the affected command(s).
+
+## Vulnerability fixes in release notes
+
+Every merge to `main` cuts a release, so a fix reaches users within minutes of
+landing. When a release fixes a publicly known vulnerability in boost itself —
+one that already had a CVE or an equivalent identifier when the release was
+cut — the [release notes](https://github.com/jonnyeclectic/boost/releases) will
+name it and its identifier, so you can tell an upgrade that matters from one
+that does not. No such vulnerability has been reported to date.
+
+Vulnerabilities in boost's *dependencies* are handled separately: the runtime
+has none, and the development toolchain is watched by `osv-scanner`, `pip-audit`
+and Dependabot.
+
+## Scope notes
+
+boost executes `git` against registry URLs you tap and symlinks skills into
+agent directories. Reports about tap-supplied content escaping the store,
+path traversal via `SKILL.md` frontmatter, or command injection through
+skill/tap names are especially valuable.
+
+## Secrets and credentials
+
+The policy in one line: **boost stores no credential it could leak.**
+
+- **Releases use no stored token.** Publishing goes through PyPI Trusted
+  Publishing — GitHub mints a short-lived OIDC identity for `publish.yml` at the
+  moment of upload. There is no PyPI API token in a secret, on a laptop, or in a
+  password manager, so there is nothing to rotate and nothing to steal.
+- **Every secret that does exist is optional.** Only `CODECOV_TOKEN`,
+  `SONAR_TOKEN` and the optional evaluation API keys are configured, all as
+  GitHub Actions repository secrets. Every job reading one skips itself when it
+  is absent, so none is required to build, test or release.
+- **Secrets never reach untrusted code.** No workflow uses
+  `pull_request_target`, so a fork's pull request runs with a read-only token
+  and no secret access. Secrets are bound at job level, never interpolated into
+  a `run:` block, and `zizmor` fails a pull request that breaks either rule.
+- **Access follows the maintainer list.** Who holds what is recorded in
+  [MAINTAINERS.md](MAINTAINERS.md), which also states the policy that escalated
+  permissions are reviewed before they are granted. Access is removed promptly
+  when someone steps down and immediately if an account is believed compromised.
+- **Rotation.** An optional dashboard token is rotated on suspicion of exposure
+  or when the holder's access is removed — revoked at the issuing service, then
+  replaced or deleted in repository settings. Because none is required, deleting
+  one is always a safe first move.
+- **Committed secrets are caught.** `gitleaks` runs in CI on every push and
+  fails the build on a hit; the allowlist covers only boost's own synthetic
+  scanner test fixtures.
+
+If you believe a boost credential has been exposed, report it through the
+private channel above rather than opening an issue.
+
+## How boost is designed to resist this
+
+[`docs/security-design.md`](docs/security-design.md) is the threat model: what
+boost trusts and what it does not, the design principles the code is held to,
+and the table of error classes — path traversal, command injection, zip-slip,
+untrusted deserialization, supply-chain compromise — each paired with the
+mitigation that counters it. It also states the known limits plainly, including
+the one that matters most: boost gives you a skill's provenance, integrity and
+diff, but judging what the skill *tells your agent to do* is yours.
+
+For how boost's badge-level security posture is assessed, see
+[`docs/openssf-badge.md`](docs/openssf-badge.md). Two companion documents cover
+the supply chain either side of a release:
+[`docs/dependencies.md`](docs/dependencies.md) — how dependencies are chosen,
+pinned by hash, tracked, and at what threshold a finding blocks a merge — and
+[`docs/verifying-releases.md`](docs/verifying-releases.md) — how to verify for
+yourself that an artifact you installed was built by this repository.

boost_skill_cli-1.2.28/SUPPORT.md

@@ -0,0 +1,78 @@
+# Support
+
+What boost supports, for how long, and where to ask.
+
+## Where to ask
+
+| You want to | Go here |
+|---|---|
+| Report a bug | [Open an issue](https://github.com/jonnyeclectic/boost/issues/new/choose) |
+| Request a feature | [Open an issue](https://github.com/jonnyeclectic/boost/issues/new/choose) |
+| Report a vulnerability | **Not an issue** — [SECURITY.md](SECURITY.md) |
+| Diagnose a broken install | [`docs/DEBUGGING.md`](docs/DEBUGGING.md), then `boost doctor` |
+| Contribute a change | [CONTRIBUTING.md](CONTRIBUTING.md) |
+
+`boost doctor` is the first thing to run for anything that looks like a
+misconfiguration. It names the single next action for each problem it finds
+rather than printing a menu, and its output is the most useful thing to paste
+into an issue.
+
+## What is supported
+
+**Only the latest release.** boost releases on every merge to `main`, so the
+latest version is usually minutes old and the gap between "what you have" and
+"what is fixed" is small by design. Bug fixes and security fixes go into the
+next release; there are no backport branches and no long-term-support line.
+
+If you are on an older version, the supported answer is to upgrade:
+
+```bash
+pipx upgrade boost-skill-cli     # or: pip install -U boost-skill-cli
+```
+
+**Supported environments** — these are what CI runs on every pull request, so a
+regression on any of them fails the build:
+
+| | Supported |
+|---|---|
+| Python | 3.12, 3.13, 3.14 (and a non-blocking 3.14 free-threaded canary) |
+| Operating system | Linux, macOS, Windows |
+| Required external tools | `git` |
+
+Python 3.11 and earlier are **not** supported: the project's floor is
+`requires-python = ">=3.12"`.
+
+## When a version stops receiving security updates
+
+**The moment a newer release exists.** A version other than the latest receives
+no security updates, and none will be backported to it.
+
+This is stated as a policy rather than left implicit because the alternative
+would be misleading. With a release cut on every merge, maintaining a supported
+older line would mean supporting hundreds of versions; the project does not do
+that and will not pretend to. In exchange, the upgrade path is deliberately
+cheap — a single `pipx upgrade`, a stdlib-only runtime with no dependency
+resolution to go wrong, and no configuration migration between patch releases.
+
+If a release fixes a publicly known vulnerability, the release notes name it and
+its identifier — see
+[SECURITY.md](SECURITY.md#vulnerability-fixes-in-release-notes).
+
+## What is not supported
+
+- **The content of third-party skills, rules and workflows.** boost gives you a
+  skill's provenance, its integrity digest and a diff. Judging what a skill
+  tells your agent to do is yours; see the limits section of
+  [`docs/security-design.md`](docs/security-design.md).
+- **`boost serve`** as a hardened server. It is a local development
+  convenience for a trusted network.
+- **Optional extras** (`[rag]`, `[eval]`, `[bdd]`, `[langchain]`) carry
+  third-party dependencies and their own compatibility constraints. The default
+  install is stdlib-only and is what the support statement above covers.
+
+## Response expectations
+
+This is a single-maintainer project ([MAINTAINERS.md](MAINTAINERS.md)), so
+response times depend on one person's availability. Vulnerability reports are
+acknowledged within a few days and are the highest priority; ordinary issues are
+triaged as they arrive but carry no service-level guarantee.

{boost_skill_cli-1.2.27 → boost_skill_cli-1.2.28}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.27'
-__version_tuple__ = version_tuple = (1, 2, 27)
+__version__ = version = '1.2.28'
+__version_tuple__ = version_tuple = (1, 2, 28)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.27 → boost_skill_cli-1.2.28}/boost_cli/commands/quality.py

@@ -1187,9 +1187,20 @@ def cmd_trust(argv) -> int:
         key_path = paths.expand(args.key)
         key_text = (key_path.read_text(encoding="utf-8")
                     if key_path.is_file() else args.key)
-        provenance.add_trusted_key(args.name, key_text)
+        rec = provenance.add_trusted_key(args.name, key_text)
         journal.log("trust", args.name, op="add-key")
-        out.ok("trusted key added")
+        # The fingerprint is the point of this line, not incidental detail: it
+        # is how the user checks by eye that the key they just trusted is the
+        # one the publisher advertises. CodeQL's py/clear-text-logging-sensitive
+        # -data flags it because `name` is user-supplied and `fingerprint` reads
+        # like a credential, but a minisign PUBLIC key fingerprint is meant to
+        # be published — printing it is the verification, and an autofix that
+        # replaced this with a constant string (dc6e827) removed the only check
+        # `trust add` offers. Restored, suppressed with the reason, and pinned
+        # by tests/functional/test_tap_signing.py so it cannot be quietly
+        # dropped a second time.
+        out.ok("trusted key %s (%s)"  # codeql[py/clear-text-logging-sensitive-data]
+               % (rec["name"], rec["fingerprint"]))
         return 0
 
     if args.action == "remove":

{boost_skill_cli-1.2.27 → boost_skill_cli-1.2.28}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.27
+Version: 1.2.28
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.2.27 → boost_skill_cli-1.2.28}/boost_skill_cli.egg-info/SOURCES.txt

@@ -11,11 +11,14 @@
 CLAUDE.md
 CODE_OF_CONDUCT.md
 CONTRIBUTING.md
+DCO
 LICENSE
+MAINTAINERS.md
 MANIFEST.in
 Makefile
 README.md
 SECURITY.md
+SUPPORT.md
 boost
 codecov.yml
 eslint.config.mjs
@@ -122,10 +125,12 @@ docs/adapters.html
 docs/carousel.html
 docs/chat.html
 docs/commands.html
+docs/commit-audit.md
 docs/demo-index.json
 docs/demo.gif
 docs/demo.html
 docs/demo.tape
+docs/dependencies.md
 docs/design-roadmap.html
 docs/eval-latest.json
 docs/eval.html
@@ -136,6 +141,7 @@ docs/openssf-badge.md
 docs/rag-architecture.md
 docs/roadmap.html
 docs/security-design.md
+docs/verifying-releases.md
 docs/.claude/settings.local.json
 docs/architecture/README.md
 docs/architecture/c4-components-core.md
@@ -342,6 +348,7 @@ docs/roadmap/items/one-commit-can-cut-two-releases.md
 docs/roadmap/items/one-dead-tap-broke-every-update.md
 docs/roadmap/items/one-shared-atomic-write-helper.md
 docs/roadmap/items/openssf-best-practices-badge.md
+docs/roadmap/items/osps-baseline-levels.md
 docs/roadmap/items/package-metadata-validation-twine-check-friends.md
 docs/roadmap/items/patch-coverage-gate-diff-cover.md
 docs/roadmap/items/path-traversal-unsanitized-rule-workflow-name.md
@@ -485,6 +492,7 @@ scripts/build_registries.py
 scripts/build_roadmap.py
 scripts/build_scale_corpus.py
 scripts/check_anchors.py
+scripts/check_dco.py
 scripts/check_licenses.py
 scripts/check_required_checks.py
 scripts/ensure_eval_corpus.sh
@@ -607,6 +615,7 @@ tests/unit/test_catalog.py
 tests/unit/test_catalogbundle.py
 tests/unit/test_chat.py
 tests/unit/test_check_anchors.py
+tests/unit/test_check_dco.py
 tests/unit/test_check_licenses.py
 tests/unit/test_claude_settings.py
 tests/unit/test_clean_internal_cache.py

boost_skill_cli-1.2.28/docs/commit-audit.md

@@ -0,0 +1,129 @@
+# Commit audit — message versus diff
+
+Every commit claims something in its message. This is a record of an
+independent pass checking whether the diff actually delivers it, produced while
+adopting the [Developer Certificate of Origin](../CONTRIBUTING.md#sign-your-commits-dco).
+
+It exists because the DCO itself could not be applied backwards. A
+`Signed-off-by` is the *contributor* asserting they may submit the work, so a
+trailer added later by a reviewer certifies nothing — and backfilling one across
+569 commits would rewrite `main`, breaking 478 tags and invalidating the
+build-provenance attestation on every published release. The review still had
+value; the history rewrite did not. So the review happened and was written down
+here instead.
+
+Repo: `/private/tmp/claude-501/boost-osps` (worktree of github.com/jonnyeclectic/boost)
+Range: 60 commits, `9ca72fd` through `c8c9075` inclusive (i.e. `git log -60 c8c9075`). NOTE: while this audit ran, a peer session
+re-committed the tip to add a DCO sign-off, so `c8c9075` is now `0939f53` (identical
+tree, message differs only by a `Signed-off-by:` trailer) and a 61st commit `b23b98f`
+sits on top. The findings below are unaffected.
+Method: read subject + full body, then the diff (generated payloads — `docs/roadmap.html`,
+`registries.json`, `demo.gif` — checked at the stat level and judged against the
+source-of-truth files and tests instead). Read-only: only `git log` / `git show`.
+
+## Counts
+
+| Verdict | Count |
+|---|---|
+| MATCHES | 57 |
+| OVERSTATES | 1 |
+| UNDERSTATES | 1 |
+| SUPERSEDED | 1 |
+| UNCLEAR | 0 |
+
+## Needs a human look
+
+- **`dc6e827` — UNDERSTATES.** "Potential fix for code scanning alert no. 54: Clear-text
+  logging of sensitive information". The diff (`boost_cli/commands/quality.py`, `cmd_trust`)
+  does not merely stop logging — it deletes the trusted-key **name and fingerprint** from
+  `boost trust add`'s success line and replaces it with the constant `"trusted key added"`,
+  discarding `rec` entirely. Nothing in the message says a user-facing verification output
+  was removed. Two seconds later `560652b` shipped `docs/openssf-badge.md:231-240`, which
+  states this exact autofix "would remove the only verification the command offers and make
+  boost *less* secure, **so it must not be merged**" — and lists dismissing the alert as a
+  pending human action. It was already merged, and it is still in `HEAD`.
+- **`d82467a` — OVERSTATES.** Subject: "…and stop Dependabot auto-rebasing". The diff adds
+  `rebase-strategy: disabled` to 3 of the 5 `package-ecosystem` blocks in
+  `.github/dependabot.yml` (github-actions, npm `/`, npm `/tests/visual`); the two `pip`
+  blocks are untouched. Those blocks carry `open-pull-requests-limit: 0`, but the file's own
+  comment says "Security updates ignore the limit and keep firing" — so a live PR-producing
+  path is still auto-rebased. Low severity, but the claim is unqualified.
+- **`e4f2491` — SUPERSEDED by `838aa81`.** "fix(ci): give eval-stats credentials to push
+  with" delivers the credentials (`git push origin HEAD:main` → an
+  `x-access-token:${{ github.token }}@github.com/...` URL) plus a guard test, and the body
+  implies the publisher now lands. It could not: `838aa81` establishes that `main` carries a
+  ruleset with an empty bypass list so *no* token can push to it, and replaces the whole
+  push-to-main with a PR flow off an `eval-metrics` branch.
+
+## Cross-cutting note (not a verdict)
+
+`560652b`'s `docs/openssf-badge.md` and the tree disagree about alert 54 — see `dc6e827`
+above. `560652b`'s own subject claim ("all 67 passing criteria, with a threat model") is
+delivered: 67 criteria rows (61 Met / 6 N/A / 1 Unmet-justified) plus
+`docs/security-design.md` with trust boundaries, Saltzer–Schroeder principles, and CWE
+classes.
+
+## Per-commit table
+
+| SHA | Subject (60 chars) | Verdict | Evidence |
+|---|---|---|---|
+| c8c9075 (now 0939f53) | docs: the four documents OSPS Baseline Level 2 asks for | MATCHES | Exactly four new docs (MAINTAINERS.md, SUPPORT.md, docs/dependencies.md, docs/verifying-releases.md) + roadmap item; all four added to the vale list in prose-lint.yml; SECURITY.md gains a Secrets section. |
+| 560652b | docs(security): answer all 67 OpenSSF passing criteria, wit | MATCHES | 67 criteria rows in docs/openssf-badge.md; docs/security-design.md is the threat model. See cross-cutting note re: alert 54. |
+| dc6e827 | Potential fix for code scanning alert no. 54: Clear-text lo | UNDERSTATES | quality.py `cmd_trust` drops `rec["name"]`/`rec["fingerprint"]` for a constant string, removing the key-verification output; undisclosed, and contradicted by docs/openssf-badge.md:231. |
+| b0b1c6e | chore: drop permission entries for paths that no longer exi | MATCHES | Exactly 5 `Bash(...)` entries removed from .claude/settings.local.json, all naming `~/vibe`/`vibe_cli`. |
+| 8658e8f | fix(ci): exempt cramjam from the licence gate, with the ups | MATCHES | `"cramjam": "MIT upstream; wheel metadata omits it"` in UNDECLARED_OK + `test_cramjam_is_exempt`. |
+| 714e879 | chore(deps-dev): bump eslint from 10.8.1 to 10.9.1 | MATCHES | Routine bot bump (batched with the other dependabot rows below). |
+| 61d6097 | chore(deps): bump the codeql-action group with 3 updates | MATCHES | Routine bot bump; all three sub-action pins move together, as 731a598's grouping intends. |
+| d82467a | docs(style): display-face traps, an AI-tells prose rule, an | OVERSTATES | `rebase-strategy: disabled` on 3 of 5 `package-ecosystem` blocks in .github/dependabot.yml; both pip blocks untouched. |
+| f75d85d | chore(deps): bump step-security/harden-runner 2.20.1→2.21.0 | MATCHES | Routine bot bump across 18 workflows. |
+| e6e1d31 | chore(eval): refresh published metrics | MATCHES | docs/eval-latest.json: `generated`/`commit` re-stamped; no metric value moved (nothing claimed one would). |
+| 7819053 | chore(deps): bump google/osv-scanner-action reusable workfl | MATCHES | Routine bot bump. |
+| e3d1ccd | chore(deps): bump puppeteer-core 25.6.0→25.8.0 in /tests/vi | MATCHES | Routine bot bump, lockfile + manifest only. |
+| d6f6e80 | chore(deps): bump the codeql-action group with 3 updates | MATCHES | Routine bot bump, grouped. |
+| 351f558 | fix(cli): fold long hints to the pane without splitting the | MATCHES | `out.wrap()` + `wrap=` kwarg on warn/info/dim/kv in core/output.py; 5 command modules converted; test_cli_pane_width.py (137 lines) + test_output.py (+217). |
+| fc70c8a | fix(search): a term with no postings falls back to the comm | MATCHES | `rag.stem_expansions()` range-scan + `_note_stem_expansions` in discovery.py so the substitution is reported; 14 unit + 3 functional tests added. |
+| 7a5816f | fix(cli): fit the boxes and the help screen to the terminal | MATCHES | Both literal `%%` strings removed from commands/team.py; `panel()` clamps to `term_width() - 4`; `print_help` measures via `out.term_width()`. |
+| 8687c40 | feat(catalog): curate a marketing / CRM / email / outreach d | MATCHES | 16 new `marketing` rows + 4 recategorised = 20, in scripts/build_registries.py (the source of truth); registries.json + taps-scale.txt regenerated; test_registry_categories.py +94. |
+| 1167bcd | docs(demo): re-record demo.gif against the current CLI | MATCHES | Bot; docs/demo.gif binary only. |
+| 3387607 | perf(dense): rank on one bit per dimension, rescore the sur | MATCHES | `vec_chunks_bin` + `vec_raw` + `quantize()`/`quantized()` in core/dense.py; `reindex --dense` calls quantize and doctor reports `quantized`; test_dense_quantized.py (376) incl. `test_the_rescore_is_load_bearing`; test_dense_status_cheap.py (281) covers the COUNT(*) removal. |
+| 7db0477 | perf(search): cache the LLM rerank order, keyed on exactly | MATCHES | `rerank_cache_path()` + FIFO get/put in core/rag.py; `"rerank_cache.json"` added to paths.INTERNAL_CACHE_FILES; MCP cost wording updated + test_rerank_cache.py. |
+| 45a6dfa | perf(search): rank from the index, materialise only the sur | MATCHES | `_retrieve_from_index` + `_windowed` in core/rag.py; dense.ready() stats before importing; test_rag_fastpath.py (279) + test_dense_ready_order.py. |
+| d53354e | docs(demo): re-record demo.gif against the current CLI | MATCHES | Bot; binary only. |
+| f54b72b | chore(eval): refresh published metrics | MATCHES | Timestamp/commit re-stamp only. |
+| 7f1a9a8 | feat(ui): one design system across search and browse | MATCHES | `search_layout`, `format_search_row`, `meter_hue`, `kind_label` in core/output.py; `rule_segments`, `scrollbar`, `empty_lines`, `badge_positions`, `state_glyph`, `session_summary`, `install_target`, `count_tail` in core/browse.py (12 helpers, as claimed); `_aurora_theme`/`_subseq`/`_match_positions` removed. |
+| 3a28b3f | test(eval): re-pin the Tier 1b scale corpus | MATCHES | Bot; exactly 165/165 lines in taps-scale.txt — the distractors gain SHAs, the 20 required rows are byte-identical. Confirms 007f1dd's fix held. |
+| 007f1dd | fix(eval): the scale re-pin moved the twenty rows it does n | MATCHES | `frozen_rows()` + `frozen=` in `relock_text` (scripts/eval_corpus.py); eval-scale.yml gains a post-refresh `build_scale_corpus.py --check`; test_eval_corpus.py +153, test_scale_corpus.py +34. |
+| 422570f | chore(eval): refresh published metrics | MATCHES | Timestamp/commit re-stamp only. |
+| a3a751a | docs(shards): replace the scale estimate with what the job | MATCHES | shards.yml comment-only rewrite carrying the measured 77,423→24,246 / 2 h 07 m / 129 MB figures; no timeout or logic changed, as the `docs(` prefix implies. |
+| 838aa81 | fix(ci): a publisher that could not publish, and an alert t | MATCHES | eval-stats.yml: push-to-main replaced by a branch + PR, `contents`/`pull-requests: write`; ci-failure-issue.yml gains the `close-issue` job keyed on the per-workflow marker and moves `issues: write` from workflow to job level; two guard tests. |
+| ec87983 | fix(registry): a tap spec too long for the filesystem is an | MATCHES | `MAX_NAME_BYTES = 255` + total `_looks_like_a_directory()` in core/registry.py; both reproducers added as fuzz corpus seeds; test_registry_control_chars.py +120. |
+| 3f7bd86 | fix(deps): bump two transitive npm advisories out of the th | MATCHES | package-lock.json only: brace-expansion 5.0.8→5.0.9 and nanoid 3.3.16→3.3.18, exactly the two named. |
+| 06b6246 | fix(registries): stop advertising two repos that no longer | MATCHES | `RETIRED = {...}` + `verify_live()` + `--verify-live` in scripts/build_registries.py; 28 lines removed from registries.json; 3 new tests in test_registry_categories.py. |
+| 709eb05 | feat(catalog): give an entry an identity for what it is, no | MATCHES | `catalog._content_digest` + `CACHE_FORMAT = 1` with rescan-on-stale; browse.dedupe and `resolve_one` key on the digest; dense chunk-dedupe; test_content_identity.py (437) + test_dense_embed_dedupe.py (216). |
+| 0861e7f | chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 | MATCHES | Routine bot bump. |
+| c289c88 | chore(deps): bump puppeteer-core 25.5.0→25.6.0 in /tests/vi | MATCHES | Routine bot bump. |
+| 0fd70ba | docs(demo): re-record demo.gif against the current CLI | MATCHES | Bot; binary only. |
+| 717b8c8 | feat(browse): let space reach the query, and rebuild the br | MATCHES | Printable-range fix with the keymap move (Enter/Tab/Esc/^T) in commands/discovery.py; new core/browse.py (470) holding the pure logic; scripts/build_roadmap.py gains the raw-`<` guard the second sub-commit describes; test_browse.py (687) + test_roadmap_fresh.py. |
+| 3e6b494 | fix(completions): stop --install deleting the config betwee | MATCHES | `_spans`/`_outside` single-scan rewrite of `_merge_rc`/`_strip_rc` plus `RcPlan`/`plan_install`/`plan_uninstall`/`apply` and `--dry-run`; test_complete_rc_block.py (367) incl. the 672-arrangement property test. |
+| 35eb03f | fix(visual): stop handing --single-process to a full Chrome | MATCHES | `needsSingleProcess` predicate gates both `--single-process`/`--in-process-gpu` and `headless: "shell"` in visual_check.mjs; test_visual_harness_flags.py pins parity with a11y_check.mjs. |
+| 4be314c | perf(taps): stop checking out the 84% of a repo boost never | MATCHES | `SPARSE_PATTERNS` + `--filter=blob:none --sparse` + memoized `materialize`/`narrow` in core/gitutil.py; `cmd_compact`; `paths.INTERNAL_CACHE_FILES` guard for `boost clean`; command counters corrected; 5 new test modules incl. test_gitutil_sparse.py (293). |
+| 15b129e | fix: four defects found by reading a real machine's crash r | MATCHES | All four present: `logs._redact` (name + value-shape), `PermissionError` handling in store `_copy_skill`, `IncompleteRead` in embed `_post`, and `blocked_links` in sync_plan/sync_apply + doctor; four dedicated test modules. |
+| bf85de1 | feat(catalog): share the catalogue instead of making everyo | MATCHES | New core/catalogbundle.py (265) with `export_bundle`/`import_bundle`/`_safe_members` (traversal, symlink, member-count and size caps); `cmd_catalog` + COMMANDS row; test_catalogbundle.py (405) + test_cli_catalog.py (190); the pinned command-count literals updated across README/CLAUDE/docs/tests. |
+| 5b27b41 | fix(self-update): stop claiming "already up to date" withou | MATCHES | `PYPI_JSON` + `latest_version()` + `is_behind()` in core/selfupdate.py; per-manager index-refresh flags (`--refresh` / `--no-cache-dir`); test_selfupdate.py +272. |
+| c4a8584 | chore(deps): bump step-security/harden-runner 2.20.0→2.20.1 | MATCHES | Routine bot bump to the peeled SHA, as the body states. |
+| aba4e27 | fix(shards): make the shard pipeline able to produce a shar | MATCHES | `--list-repos` in scripts/eval_corpus.py and shards.yml switched to it; `_tap_chunk_count`/`_unreadable_vectors` separate the two states in core/dense.py; three new test modules incl. one that runs without sqlite-vec. |
+| 14ba426 | chore(deps): bump puppeteer-core 25.4.0→25.5.0 in /tests/vi | MATCHES | Human-authored regeneration, but touches only tests/visual/package{,-lock}.json; puppeteer-core 25.4.0→25.5.0, @puppeteer/browsers 3.0.6→3.1.0, axe-core held at 4.13.0 — exactly as the body states. |
+| f5ecc54 | fix(store): let `boost sync` repair a skill whose SKILL.md | MATCHES | One-condition change `if not sdir.is_dir()` → `or not (sdir / "SKILL.md").is_file()`; test_sync_repairs_gutted_skill.py (96) pins both directions. |
+| 0b5b317 | docs: correct five measurably-wrong claims, and stop the sm | MATCHES | All five: recall floor 0.85→0.78, the UP006/UP035/UP045 sweep note, UP031 ~860→1,005/1,800 with the reproducing command, index.html 5→7 pre-tapped (both places), smoke 170→174; plus 5 commands added to smoke.sh and test_smoke_covers_every_command.py mirroring COMMANDS. |
+| 470b9de | fix(registry): reject control characters in a tap spec, and | MATCHES | Control-char rejection at `parse_spec`; the watched list goes from 2 to exactly 26 workflows; Makefile `lint` now runs `zizmor --offline`; test_failure_alerting_covers_unattended.py + test_zizmor_ignores_still_anchor.py. |
+| 13891fa | docs(demo): re-record demo.gif against the current CLI | MATCHES | Bot; binary only. |
+| 93f16d9 | test(langsmith): cover the golden-set publisher, which had | MATCHES | Single new file tests/unit/test_publish_golden_dataset.py (226); no production change, as the `test(` prefix implies. |
+| e4f2491 | fix(ci): give eval-stats credentials to push with | SUPERSEDED | Credentials added as claimed, but the push to `main` still could not succeed; `838aa81` replaces `git push … HEAD:main` with an `eval-metrics` branch + PR because main's ruleset has an empty bypass list. |
+| 3ebccb0 | chore(deps): bump google/osv-scanner-action/... | MATCHES | Routine bot bump. |
+| 844675e | chore(deps): bump actions/attest-build-provenance 4.1.1→4.2 | MATCHES | Routine bot bump. |
+| 08a7744 | fix(ci): stop one PR's demo run from cancelling another PR' | MATCHES | demo.yml `group: demo` → `demo-${{ pull_request.number \|\| sha }}` with `cancel-in-progress` gated on `pull_request`; sonarcloud.yml given the same shape; test_workflow_concurrency_groups.py (144). |
+| 8a4a211 | chore(deps): bump axe-core from 4.12.1 to 4.13.0 in /tests/ | MATCHES | Routine bot bump. |
+| 731a598 | fix(ci): move every sub-action of one action repo in lockst | MATCHES | `groups:` for `github/codeql-action*` and `actions/cache*` in dependabot.yml; all three codeql pins moved to the same peeled SHA; test_action_pin_lockstep.py (290) parametrised over both families. |
+| ff969c8 | fix(gitutil): never download Git LFS payloads when cloning | MATCHES | `env=os.environ \| {"GIT_LFS_SKIP_SMUDGE": "1"}` passed per-call in core/gitutil.py; test_gitutil_lfs.py (67). |
+| 3827fea | docs(demo): re-record demo.gif against the current CLI | MATCHES | Bot; binary only. |
+| 9ca72fd | feat(serve): a searchable, faceted catalogue and a graph of | MATCHES | core/serve.py +793: `catalog_rows`, `search_rows` (reusing catalog.search), `entry_tags` namespaced facets, `_label_propagate` graph, fingerprint-keyed `cached_view`/`cached_graph`, `public_row` \u-escaping; test_serve.py +571 incl. the reflection payload tests. |