fix: address Copilot review round 10 on #2248

Round 10 raised no new inline comments; three suppressed findings, two fixed
and one declined with a reason.

**`Object.is` held `0` and `-0` distinct**, so a listing carrying JSON `0`
against a served YAML `-0` produced a mismatch — reported as "the listing
says 0 but the served SKILL.md says 0", a false finding with an
unintelligible explanation. JSON does not distinguish them, so neither may
this: `===` for finite numbers, `Object.is` kept only for the non-finite
cases it was introduced for.

**Browsing a supporting file erased an observed failure.** The frontmatter
check ran off whatever the viewer was showing, so opening a second file made
`showingSkillMd` false and dropped the finding and its error count, with the
skill unchanged. The entry's text is skill-scoped now, written by whichever
read produces it first — the on-selection preview or a verification — and
invalidated only with `manifestKey`. That also subsumes the earlier
same-fetch requirement rather than sitting beside it.

**Declined: the second stderr line on exit 7.** `--verify` writes its summary
and then the ordinary `ErrorEnvelope` that EVERY non-zero exit writes, which
is the documented contract and exactly what `--strict` does. Suppressing it
would make this one command's failure output unparseable by a caller
branching on `.code`. What was wrong is the README, which implied stderr
carries only the summary; it now states both lines and why.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ND46Ci64DC3tzBy9aG81Nc
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-07 21:33:34 -04:00
commit 50441f4d85

View file

@ -364,8 +364,13 @@ Stdout is **NDJSON, one report per skill**, in listing order:
```
Stderr gets a one-line summary, so a reader who piped stdout into `jq` still
sees the verdict. `--method skills/get --uri <skill>` verifies exactly one
skill, in the same shape.
sees the verdict — and then, on a failing run, the ordinary
[`ErrorEnvelope`](#exit-codes--error-envelopes) line that **every** non-zero
exit writes. Two stderr lines on failure, one on success, which is the same
shape `--strict` produces and is why the envelope is not suppressed here: a
caller branching on `.code` should not have to special-case this command.
`--method skills/get --uri <skill>` verifies exactly one skill, in the same
shape.
**What fails the run.** `ok` is false — and the exit code is `7` — for anything
SEP-2640 makes a MUST: an error-severity conformance finding, a digest or size