boost-skill-cli 1.2.29__tar.gz → 1.2.30__tar.gz

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.30}/CONTRIBUTING.md

@@ -128,6 +128,13 @@ published release, to record an assertion nobody actually made.
 Bot authors (Dependabot and friends) are exempt — an account cannot agree to a
 certificate.
 
+## Governance
+
+Who decides, how a decision gets made, and what happens when people disagree:
+[GOVERNANCE.md](GOVERNANCE.md). Who holds which role and which credential:
+[MAINTAINERS.md](MAINTAINERS.md). Both say plainly that this is a
+single-maintainer project today rather than implying a committee.
+
 ## Code of conduct
 
 Participation is governed by the [Code of Conduct](CODE_OF_CONDUCT.md)

boost_skill_cli-1.2.30/GOVERNANCE.md

@@ -0,0 +1,103 @@
+# Governance
+
+How boost makes decisions, who makes them, and what happens when people
+disagree. [MAINTAINERS.md](MAINTAINERS.md) is the companion: it lists who holds
+which role and which credential. This file is about the *process*.
+
+## The short version
+
+boost is a **single-maintainer project** run in the open. The lead maintainer
+decides; everything that shapes a decision — the roadmap, the quality gates, the
+reasoning behind a change — is public and arguable before it lands. That is a
+benevolent-dictator model, and naming it plainly is better than implying a
+committee that does not exist.
+
+This is stated as the current state, not an aspiration. It changes when a second
+maintainer is appointed under
+[MAINTAINERS.md](MAINTAINERS.md#becoming-a-maintainer), and this file changes
+with it.
+
+## How a decision gets made
+
+**1. Anyone may propose.** Open an issue, or open a pull request. There is no
+membership requirement and no form to fill in.
+
+**2. The argument happens in public, on the artifact.** Issues, pull requests,
+and the roadmap boards. A decision made in a private channel is not a decision
+this project recognises; if something was settled elsewhere, it gets written
+down in the open before it is acted on.
+
+**3. The gates decide what they can.** A large class of decisions is not a
+matter of opinion here — the change either passes the required checks or it does
+not. Coverage, mutation score, retrieval quality, the lint and type gates, the
+generated-file freshness checks: these are stated thresholds, and a maintainer
+does not get to wave one through. Changing a *threshold* is itself a decision
+that goes through this process, in its own pull request, with the measurement
+that justifies it.
+
+**4. The lead maintainer decides what the gates cannot.** Scope, design,
+priority, and whether a proposal fits the project at all. The decision is
+recorded where the work is: in the pull request, or as a roadmap card.
+
+**5. A "no" is recorded, not dropped.** The roadmap has a `declined` status
+precisely so a rejected proposal stops reading as backlog. Without it the same
+refuted question gets re-opened by the next person — or the next agent — who
+scans the board for work. If your proposal is declined you get the reason in
+writing, and it stays there.
+
+## Disagreements
+
+**With a decision.** Say so on the issue or pull request. Bring the thing that
+would change the answer: a measurement, a failing case, a constraint that was
+missed. This project changes its mind on evidence and says so when it does —
+several roadmap cards exist specifically to record that an earlier claim was
+wrong.
+
+**With the process, or with a person.** Conduct concerns go through the private
+reporting route in [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), never a public
+issue.
+
+**When you cannot reach agreement.** With a single maintainer there is no appeal
+body, and pretending otherwise would be dishonest. The real backstop is the
+licence: boost is GPL-3.0 with full public history, so anyone who thinks the
+project is being run badly can fork it and prove it. That is a genuine check on
+the maintainer, not a consolation prize.
+
+## What is deliberately not decided by discussion
+
+Some things are settled by rule, and a pull request arguing the opposite gets
+declined on sight unless it changes the rule first:
+
+- **The runtime imports no third-party package.** Enforced by `import-linter`.
+- **Generated files are never hand-edited.** `registries.json`, both roadmap
+  boards, `commands.html`. Edit the source and regenerate.
+- **A suppressed finding needs a written argument**, naming what would have to
+  change for the suppression to stop being true. See
+  [`docs/dependencies.md`](docs/dependencies.md).
+- **A badge answer or a security claim must be checkable.** If the evidence
+  needs credentials nobody reading has, the claim gets softened to what *is*
+  checkable rather than asserted.
+
+## Roadmap and priority
+
+Priority is public and data-driven. Both boards are generated from one file per
+item under `docs/roadmap/items/`, so proposing work is a pull request adding a
+card, and claiming work is a pull request setting `status` and `owner` on one.
+Two people claiming different items touch different files and merge cleanly; two
+claiming the *same* item conflict on that one small file, which is the intended
+"already claimed" signal — first to merge wins.
+
+There is no private backlog. What is on the boards is what is planned.
+
+## Releases
+
+Every merge to `main` cuts a release. There is no release manager, no release
+meeting, and no window: the decision to release *is* the decision to merge.
+Consequences of that are set out in [SUPPORT.md](SUPPORT.md) — only the latest
+release is supported — and in
+[`docs/verifying-releases.md`](docs/verifying-releases.md), which is how you
+check that a release came from this repository.
+
+## Changing this document
+
+Like anything else: a pull request, argued in public, merged through the gates.

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.29
+Version: 1.2.30
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE
@@ -725,6 +725,7 @@ Dynamic: license-file
 [![Mutation score](https://img.shields.io/badge/mutation_score-%E2%89%A580%25_killed-blueviolet)](https://github.com/jonnyeclectic/boost/blob/main/scripts/mutation_gate.py)
 [![Platform](https://img.shields.io/badge/platform-macOS%20%7C%20Linux-lightgrey)](https://github.com/jonnyeclectic/boost/actions/workflows/ci.yml)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14275/badge)](https://www.bestpractices.dev/projects/14275)
+[![OpenSSF Baseline](https://www.bestpractices.dev/projects/14275/baseline)](https://www.bestpractices.dev/projects/14275/baseline-2)
 [![License](https://img.shields.io/github/license/jonnyeclectic/boost)](LICENSE)
 
 **Homebrew for AI coding skills.** boost finds, installs, and version-tracks

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.30}/README.md

@@ -7,6 +7,7 @@
 [![Mutation score](https://img.shields.io/badge/mutation_score-%E2%89%A580%25_killed-blueviolet)](https://github.com/jonnyeclectic/boost/blob/main/scripts/mutation_gate.py)
 [![Platform](https://img.shields.io/badge/platform-macOS%20%7C%20Linux-lightgrey)](https://github.com/jonnyeclectic/boost/actions/workflows/ci.yml)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14275/badge)](https://www.bestpractices.dev/projects/14275)
+[![OpenSSF Baseline](https://www.bestpractices.dev/projects/14275/baseline)](https://www.bestpractices.dev/projects/14275/baseline-2)
 [![License](https://img.shields.io/github/license/jonnyeclectic/boost)](LICENSE)
 
 **Homebrew for AI coding skills.** boost finds, installs, and version-tracks

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.30}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.29'
-__version_tuple__ = version_tuple = (1, 2, 29)
+__version__ = version = '1.2.30'
+__version_tuple__ = version_tuple = (1, 2, 30)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.30}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.29
+Version: 1.2.30
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE
@@ -725,6 +725,7 @@ Dynamic: license-file
 [![Mutation score](https://img.shields.io/badge/mutation_score-%E2%89%A580%25_killed-blueviolet)](https://github.com/jonnyeclectic/boost/blob/main/scripts/mutation_gate.py)
 [![Platform](https://img.shields.io/badge/platform-macOS%20%7C%20Linux-lightgrey)](https://github.com/jonnyeclectic/boost/actions/workflows/ci.yml)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14275/badge)](https://www.bestpractices.dev/projects/14275)
+[![OpenSSF Baseline](https://www.bestpractices.dev/projects/14275/baseline)](https://www.bestpractices.dev/projects/14275/baseline-2)
 [![License](https://img.shields.io/github/license/jonnyeclectic/boost)](LICENSE)
 
 **Homebrew for AI coding skills.** boost finds, installs, and version-tracks

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.30}/boost_skill_cli.egg-info/SOURCES.txt

@@ -12,6 +12,7 @@ CLAUDE.md
 CODE_OF_CONDUCT.md
 CONTRIBUTING.md
 DCO
+GOVERNANCE.md
 LICENSE
 MAINTAINERS.md
 MANIFEST.in
@@ -350,6 +351,7 @@ docs/roadmap/items/one-dead-tap-broke-every-update.md
 docs/roadmap/items/one-shared-atomic-write-helper.md
 docs/roadmap/items/openssf-best-practices-badge.md
 docs/roadmap/items/openssf-playbook.md
+docs/roadmap/items/openssf-silver.md
 docs/roadmap/items/osps-baseline-levels.md
 docs/roadmap/items/package-metadata-validation-twine-check-friends.md
 docs/roadmap/items/patch-coverage-gate-diff-cover.md

boost_skill_cli-1.2.30/docs/roadmap/items/openssf-silver.md

@@ -0,0 +1,39 @@
+---
+id: openssf-silver
+board: code
+section: health
+status: inflight
+category: Security · Posture
+complexity: S
+impact: Med
+wow: 3
+note: 55 criteria, 31% → the gap was two documents, not fifty
+order: 7
+owner: loop/openssf-silver
+pr:
+title: OpenSSF silver — reachable solo, and mostly already true
+---
+Silver reads like a wall — <b>55 criteria</b> on top of passing — and the board showed 31%
+with 37 unanswered. Reading them rather than assuming turned the estimate from "a day" into
+<b>two documents</b>. The same lesson <a href="roadmap.html#osps-baseline-levels">the Baseline
+audit</a> taught: most unanswered criteria are already satisfied and merely unrecorded.
+Eighteen were <b>already answered</b>, because the badge site carries a justification across
+levels wherever a criterion name repeats — so <code>assurance_case</code>,
+<code>signed_releases</code>, <code>dco</code> and <code>roles_responsibilities</code> arrived
+already Met from the passing and Baseline work. Most of the remaining 37 are evidence that
+exists and had never been written into a form: the coverage and mutation gates, the
+hash-pinned toolchain, the C4 architecture docs, the generated command reference with its
+freshness check.
+<b>The two genuine gaps.</b> <code>governance</code> wanted the decision-making model, which
+<code>MAINTAINERS.md</code> did not cover — it lists roles, not how a decision gets made or
+what happens when people disagree. <code>GOVERNANCE.md</code> now says it plainly: a
+benevolent-dictator model, the gates decide what they can, a "no" is recorded rather than
+dropped, and the real backstop on a single maintainer is the GPL and a public history —
+anyone who thinks it is run badly can fork and prove it. <code>documentation_achievements</code>
+wanted the badges hyperlinked from the front page.
+<b>What stays honestly Unmet</b>, all SHOULD or SUGGESTED, so the badge still passes:
+<code>bus_factor</code> (one maintainer), <code>version_tags_signed</code> (tags are
+unsigned; releases carry SLSA provenance instead), <code>crypto_algorithm_agility</code>
+(minisign is Ed25519-only by format) and <code>internationalization</code> (the CLI is
+English-only). Gold remains out of reach for the reason it always was — it needs a second
+human, not a commit.

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.30}/docs/roadmap.html

@@ -133,7 +133,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>7</b><span>Planned</span></div>
-      <div class="stat"><b>270</b><span>Loop finds</span></div>
+      <div class="stat"><b>271</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -4759,6 +4759,41 @@ improvement is real (or isn't)."</p></details>
         </div>
       </article>
 
+      <article class="cap rcard" id="openssf-silver">
+        <div class="head"><span class="pill inflight">In flight</span><span class="cat">Security · Posture</span></div>
+        <h3>OpenSSF silver — reachable solo, and mostly already true</h3>
+        <p>Silver reads like a wall — <b>55 criteria</b> on top of passing — and the board showed 31%
+with 37 unanswered. Reading them rather than assuming turned the estimate from "a day" into
+<b>two documents</b>. The same lesson <a href="roadmap.html#osps-baseline-levels">the Baseline
+audit</a> taught: most unanswered criteria are already satisfied and merely unrecorded.
+Eighteen were <b>already answered</b>, because the badge site carries a justification across
+levels wherever a criterion name repeats — so <code>assurance_case</code>,
+<code>signed_releases</code>, <code>dco</code> and <code>roles_responsibilities</code> arrived
+already Met from the passing and Baseline work. Most of the remaining 37 are evidence that
+exists and had never been written into a form: the coverage and mutation gates, the
+hash-pinned toolchain, the C4 architecture docs, the generated command reference with its
+freshness check.
+<b>The two genuine gaps.</b> <code>governance</code> wanted the decision-making model, which
+<code>MAINTAINERS.md</code> did not cover — it lists roles, not how a decision gets made or
+what happens when people disagree. <code>GOVERNANCE.md</code> now says it plainly: a
+benevolent-dictator model, the gates decide what they can, a "no" is recorded rather than
+dropped, and the real backstop on a single maintainer is the GPL and a public history —
+anyone who thinks it is run badly can fork and prove it. <code>documentation_achievements</code>
+wanted the badges hyperlinked from the front page.
+<b>What stays honestly Unmet</b>, all SHOULD or SUGGESTED, so the badge still passes:
+<code>bus_factor</code> (one maintainer), <code>version_tags_signed</code> (tags are
+unsigned; releases carry SLSA provenance instead), <code>crypto_algorithm_agility</code>
+(minisign is Ed25519-only by format) and <code>internationalization</code> (the CLI is
+English-only). Gold remains out of reach for the reason it always was — it needs a second
+human, not a commit.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">55 criteria, 31% → the gap was two documents, not fifty</span>
+        </div>
+      </article>
+
       <article class="cap rcard" id="property-based-tests-hypothesis-on-the-parsers">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Testing · Bug</span></div>
         <h3>Property-based tests — <code>hypothesis</code> on the parsers</h3>