📦 deps(thirdparty): update snapshots
This commit is contained in:
@@ -39,11 +39,8 @@ This document summarizes the repository coherence audit performed after the `app
|
||||
- missing examples and missing limitations sections,
|
||||
- overly long `SKILL.md` files that should probably be split into `references/`,
|
||||
- plus the existing structural/safety checks (frontmatter, risk, `When to Use`, offensive disclaimer, dangling links).
|
||||
- The report also includes a non-blocking `suggested_risk` for skills that are still marked `unknown` or appear to be misclassified, so maintainers can resolve risk classification during PR review without changing the contributor gate.
|
||||
- Added `tools/scripts/sync_risk_labels.py` (also exposed as `npm run sync:risk-labels`) for conservative legacy cleanup: it only rewrites `risk: unknown` when the suggestion is high-confidence enough to be safely automated.
|
||||
- The sync now covers explicit high-confidence `safe`, `critical`, `offensive`, and `none` patterns. When a skill is promoted to `offensive`, the sync also inserts the canonical `AUTHORIZED USE ONLY` notice so the label and content guardrail stay aligned.
|
||||
- The intended maintainer loop is: `audit:skills` to inspect `suggested_risk`, `sync:risk-labels` for the safe automated subset, then manual review for the ambiguous tail that should not be batch-classified.
|
||||
- Use `npm run audit:skills` for the maintainer view and `npm run audit:skills -- --json-out ... --markdown-out ...` when you want artifacts for triage or cleanup tracking.
|
||||
- Risk inference from isolated words was removed because it produced widespread false positives. The audit validates declared metadata; ambiguous labels require semantic review.
|
||||
- Use `npm run audit:skills` for the maintainer view and `npm run audit:skills -- --json-out ... --markdown-out ...` when you want objective structural artifacts for triage or cleanup tracking.
|
||||
|
||||
### 3. Cross references
|
||||
|
||||
@@ -79,8 +76,6 @@ This document summarizes the repository coherence audit performed after the `app
|
||||
npm run validate # skill validation (soft)
|
||||
npm run validate:strict # hardening / diagnostic pass
|
||||
npm run audit:skills # full skill audit with finding codes and status
|
||||
npm run sync:risk-labels # conservative sync for high-confidence legacy risk labels
|
||||
npm run sync:risk-labels -- --dry-run # preview legacy risk rewrites before touching files
|
||||
npm run validate:references # workflow, bundle, and docs/users/bundles.md references
|
||||
npm run security:docs # documentation command-risk scan (required for security-sensitive guidance)
|
||||
npm run build # chain + catalog
|
||||
@@ -90,5 +85,5 @@ npm test # suite test
|
||||
## Open issues / follow-up
|
||||
|
||||
- Gradual cleanup of legacy skills so `npm run validate:strict` can become a hard CI gate in the future.
|
||||
- Continue reducing the remaining `risk: unknown` tail with conservative sync passes plus manual maintainer review for ambiguous cases.
|
||||
- Continue reducing the remaining `risk: unknown` tail through semantic maintainer review.
|
||||
- Keep translated docs aligned in a separate pass after the canonical English docs are stable.
|
||||
|
||||
Reference in New Issue
Block a user