skill-harness 0.2.1__tar.gz

skill_harness-0.2.1/.editorconfig

@@ -0,0 +1,24 @@
+# https://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 4
+insert_final_newline = true
+trim_trailing_whitespace = true
+max_line_length = 100
+
+[*.{md,markdown}]
+trim_trailing_whitespace = false
+max_line_length = off
+
+[*.{yml,yaml,json,toml}]
+indent_size = 2
+
+[*.{ps1,cmd,bat}]
+end_of_line = crlf
+
+[Makefile]
+indent_style = tab

skill_harness-0.2.1/.gitattributes

@@ -0,0 +1,12 @@
+* text=auto eol=lf
+*.py text eol=lf
+*.md text eol=lf
+*.sql text eol=lf
+*.toml text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+*.json text eol=lf
+*.sh text eol=lf
+*.ps1 text eol=crlf
+*.cmd text eol=crlf
+*.bat text eol=crlf

skill_harness-0.2.1/.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# Every change in this repo is reviewed by @MrBinnacle until a wider
+# team forms. Sub-paths can list additional reviewers later without
+# removing the global owner.
+
+* @MrBinnacle
+
+# Architectural artifacts — extra scrutiny zone. Any change to the
+# load-bearing invariants should be discussed in an issue first.
+/docs/PRD.md                     @MrBinnacle
+/docs/PLAN.md                    @MrBinnacle
+/src/skill_harness/storage/migrations_sql/  @MrBinnacle
+
+# Storage / migrations gate — SCHEMA + SECURITY seat sign-off per A30 + dev-team-council
+src/skill_harness/storage/migrations_sql/*    @MrBinnacle
+/.github/                        @MrBinnacle
+/SECURITY.md                     @MrBinnacle

skill_harness-0.2.1/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,93 @@
+name: Bug report
+description: Report a reproducible defect in Skill Harness
+title: "[bug] "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report. Skill Harness is pre-1.0 and moving fast, so some parts are still rough. Please confirm this is a defect (something behaves contrary to the PRD or its tests) and not a missing feature before filing.
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: One or two sentences describing what's wrong.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Exact commands or code that produce the bug.
+      placeholder: |
+        1. Create venv: `python -m venv .venv`
+        2. Install: `pip install -e ".[dev]"`
+        3. Run: `pytest -q tests/test_X.py::test_Y`
+        4. Observe: ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What should happen instead? Link the docs/PRD.md section if relevant.
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What actually happens. Include exact error messages and tracebacks.
+      render: shell
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: skill-harness version
+      placeholder: "0.2.0 (or commit SHA)"
+    validations:
+      required: true
+
+  - type: input
+    id: python
+    attributes:
+      label: Python version
+      placeholder: "3.13.1"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - Windows
+        - macOS
+        - Other (specify in extra context)
+    validations:
+      required: true
+
+  - type: textarea
+    id: extra
+    attributes:
+      label: Extra context
+      description: Logs, config, anything else relevant. Redact any API keys.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-flight
+      options:
+        - label: I have searched existing issues and confirmed this is not a duplicate
+          required: true
+        - label: I have read CONTRIBUTING.md
+          required: true
+        - label: This report contains no secrets (API keys, tokens, credentials)
+          required: true

skill_harness-0.2.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,9 @@
+blank_issues_enabled: false
+
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/MrBinnacle/skill-harness/security/advisories/new
+    about: Report a vulnerability privately. Do NOT open a public issue for security defects.
+  - name: Architecture discussion
+    url: https://github.com/MrBinnacle/skill-harness/discussions
+    about: For architectural questions, alternative designs, or anything that touches the load-bearing invariants in docs/INVARIANTS.md, open a discussion before an issue.

skill_harness-0.2.1/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,62 @@
+name: Feature request
+description: Suggest new functionality
+title: "[feat] "
+labels: ["enhancement", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing, please skim `docs/PRD.md` § 18 (CLI surface), `docs/PLAN.md` (build tracks), and the "Out of scope for v0.1" section of `docs/PLAN.md`. Many "missing features" are explicitly deferred to v0.2 or beyond — those don't need new issues.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What can't you do today? Who is the user?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Sketch the design. Be concrete enough for someone else to estimate.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What else did you weigh, and why does this proposal win?
+
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Scope
+      options:
+        - Inside PRD v1.0 scope (clarification / refinement)
+        - Inside docs/PLAN.md track scope (build work)
+        - Explicitly deferred past v0.1 (docs/PLAN.md “Out of scope”)
+        - Outside current scope (extension proposal)
+    validations:
+      required: true
+
+  - type: textarea
+    id: prior-art
+    attributes:
+      label: Prior art
+      description: |
+        For statistical / eval-design proposals, cite the literature.
+        For SQLite / Python tooling, link the relevant docs.
+        New defaults without citations are unlikely to be accepted.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-flight
+      options:
+        - label: I have read docs/PRD.md and docs/PLAN.md
+          required: true
+        - label: This is not already covered by an existing docs/PLAN.md track
+          required: true

skill_harness-0.2.1/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,52 @@
+<!--
+Thanks for the PR.
+
+Before you submit, please confirm:
+
+- [ ] You read `CONTRIBUTING.md` and `docs/INVARIANTS.md`
+- [ ] `ruff check src tests` is clean
+- [ ] `ruff format --check src tests` is clean
+- [ ] `mypy src tests` is clean
+- [ ] `pytest -q` is green
+- [ ] New tests cover the new behavior (TDD discipline — see CONTRIBUTING.md)
+
+If this PR touches PRD §-tagged invariants, link the relevant
+docs/PRD.md section.
+-->
+
+## Summary
+
+<!-- 1–3 sentences. What changed and why. -->
+
+## Track / scope
+
+<!-- Which build track does this land in? A=storage, B=extractor, C=oracle,
+D=runner, E=aggregation, CLI=cli, DOCS=docs, CI=ci, OTHER=specify. -->
+
+- [ ] A — Storage
+- [ ] B — Extractor
+- [ ] C — Oracle library
+- [ ] D — Ablation runner
+- [ ] E — Aggregation + CLI
+- [ ] DOCS / CI / OTHER (specify):
+
+## Invariant / decision reference
+
+<!-- If this PR realizes or modifies a locked invariant (docs/PRD.md) or a
+published finding (docs/findings/), name it. Otherwise: N/A. -->
+
+## Test plan
+
+- [ ] Unit tests added/updated
+- [ ] Integration tests added (where applicable)
+- [ ] `pytest -q` green locally
+- [ ] Manual verification (describe):
+
+## Breaking change?
+
+- [ ] No
+- [ ] Yes (describe migration path in body below)
+
+## Notes for the reviewer
+
+<!-- Edge cases, alternative designs considered, follow-up work. -->

skill_harness-0.2.1/.github/dependabot.yml

@@ -0,0 +1,60 @@
+version: 2
+
+updates:
+  # Python dependencies (pyproject.toml)
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - python
+    commit-message:
+      prefix: "chore(deps)"
+      include: scope
+    groups:
+      anthropic-stack:
+        patterns:
+          - "anthropic"
+          - "httpx"
+          - "httpcore"
+          - "anyio"
+          - "h11"
+      pydantic-stack:
+        patterns:
+          - "pydantic"
+          - "pydantic-core"
+          - "annotated-types"
+          - "typing-extensions"
+      dev-tooling:
+        dependency-type: development
+        patterns:
+          - "pytest*"
+          - "ruff"
+          - "mypy"
+          - "mypy_extensions"
+          - "hypothesis"
+          - "coverage"
+
+  # GitHub Actions
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: "ci(deps)"
+      include: scope
+    groups:
+      actions:
+        patterns: ["*"]

skill_harness-0.2.1/.github/workflows/ci.yml

@@ -0,0 +1,134 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint + format
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: |
+            pyproject.toml
+            requirements-ci.txt
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -c requirements-ci.txt -e ".[dev]"
+      - name: ruff check
+        run: ruff check src tests
+      - name: ruff format --check
+        run: ruff format --check src tests
+
+  typecheck:
+    name: mypy --strict
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: |
+            pyproject.toml
+            requirements-ci.txt
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -c requirements-ci.txt -e ".[dev]"
+      - name: mypy
+        # Full strict scope (src + tests) restored 2026-07-10 — repo issue #2
+        # burn-down; the tests/ override relaxation of 2026-07-09 is removed.
+        run: mypy --strict src/ tests/
+
+  test:
+    name: Test (${{ matrix.os }} · py${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    # PYTHONHASHSEED=0 required by tests/oracles/tier1 autouse fixture for
+    # A33 mechanical-validity bit-equality discipline.
+    env:
+      PYTHONHASHSEED: "0"
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: |
+            pyproject.toml
+            requirements-ci.txt
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -c requirements-ci.txt -e ".[dev]"
+      - name: pytest
+        # `-m "not live"` mirrors local gate; live tests require ANTHROPIC_API_KEY
+        # (not provisioned in CI). Live test surface = tests/extractor/test_live.py.
+        run: pytest -q -m "not live" --cov=src/skill_harness --cov-report=term-missing
+      - name: Upload coverage
+        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-report
+          path: .coverage
+          if-no-files-found: ignore
+
+  structural-bans:
+    name: Structural bans (raw sqlite3.connect / oracle_verdicts / timestamp ORDER BY)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      # S5: pinned — see depersonalization-gate.yml's identical step for the
+      # rationale (any future release runs immediately in this job otherwise).
+      - run: python -m pip install pre-commit==4.6.0
+      - name: sqlite3.connect() ban (A23 Sec.3 PRAGMA/FK discipline, PRD.md #17a)
+        run: pre-commit run ban-raw-sqlite-connect --all-files
+      - name: oracle_verdicts raw-access allowlist (A29, PRD.md #17)
+        run: pre-commit run ban-raw-oracle-verdicts --all-files
+      - name: timestamp-final ORDER BY ban (deterministic tie-break on append-only tables)
+        run: pre-commit run ban-timestamp-final-order-by --all-files
+
+  all-green:
+    name: All checks green
+    needs: [lint, typecheck, test, structural-bans]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Verify all dependent jobs succeeded
+        run: |
+          if [[ "${{ needs.lint.result }}" != "success" ]] || \
+             [[ "${{ needs.typecheck.result }}" != "success" ]] || \
+             [[ "${{ needs.test.result }}" != "success" ]] || \
+             [[ "${{ needs.structural-bans.result }}" != "success" ]]; then
+            echo "One or more required checks failed."
+            exit 1
+          fi
+          echo "All checks passed."

skill_harness-0.2.1/.github/workflows/depersonalization-gate.yml

@@ -0,0 +1,51 @@
+# De-personalization gate — CI enforcement at the public boundary.
+#
+# The local pre-commit hooks (.pre-commit-config.yaml) only protect a clone where
+# `pre-commit install` has been run; git hooks are not version-controlled, so a fresh
+# clone is dormant. This workflow re-runs the residue check on every push/PR to main —
+# committed, always enforced, independent of anyone's local setup. Belt to the local
+# hooks' suspenders.
+#
+# It runs ONLY the residue-* hooks (language: pygrep, zero external deps) so it stays
+# fast and does not duplicate the heavier ruff/mypy work that ci.yml covers
+# (gitleaks runs as a local pre-commit hook only, not in CI).
+# The .pre-commit-config.yaml is the single source of truth for the patterns.
+name: de-personalization gate
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  residue-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      # S5: pinned (was a floating install — any future pre-commit release
+      # would execute in this job on the next run, and this job IS the
+      # residue-gate security control; a compromised release could silently
+      # neuter it). NOTE: this inline `pip install` is NOT covered by
+      # Dependabot's pip ecosystem (it only parses manifest files, not
+      # workflow run: steps) — bumping this pin is a manual PR, same as any
+      # other CI-only tool version. (pre-commit's OWN transitive deps —
+      # cfgv/identify/nodeenv/pyyaml/virtualenv — are still unpinned here;
+      # this closes the top-level "any new release runs immediately" gap,
+      # not the full transitive supply chain.)
+      - run: python -m pip install pre-commit==4.6.0
+      - name: Residue sweep (private-provenance identifiers in *.md)
+        run: |
+          rc=0
+          for hook in residue-writ residue-sec-id residue-wi-id \
+                      residue-research-dir residue-private-repo-dir \
+                      residue-private-repo-link; do
+            pre-commit run "$hook" --all-files || rc=1
+          done
+          exit $rc

skill_harness-0.2.1/.github/workflows/publish.yml

@@ -0,0 +1,35 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install build
+      - run: python -m build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # OIDC trusted publishing — no API token
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      # SHA-pinned pypi-publish v1.14.1 — paste the full SHA from the
+      # Marketplace snippet's `uses:` line (starts ba38b8e...)
+      - uses: pypa/gh-action-pypi-publish@release/v1

skill_harness-0.2.1/.gitignore

@@ -0,0 +1,70 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+dist/
+*.egg-info/
+*.egg
+.eggs/
+
+# Virtual envs
+.venv/
+uv.lock
+venv/
+env/
+ENV/
+
+# Test / type / lint caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.cache/
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+*.cover
+
+# SQLite
+*.db
+*.db-wal
+*.db-shm
+*.sqlite
+*.sqlite3
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Claude state (kept locally, not committed)
+.claude/state/
+.claude/cache/
+.claude/worktrees/
+
+# Logs
+*.log
+logs/
+
+# Local config / secrets
+.env
+.env.*
+!.env.example
+# Internal scan reports (local-only)
+.supply-chain-risk-auditor/
+
+# Claire tool worktree remnants (stale, local-only)
+.claire/
+
+# Internal process records + agent config (removed from public HEAD 2026-07-08)
+.private/
+.claude/
+/CLAUDE.md