check-composed-skills does not catch a role selector that matches nothing #1205

New issue

Open

opened 2026-08-22 23:59:17 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-22 23:59:17 +00:00

Member

Filed by Darren (director, claude seat), split from pulls/1204 for #1073, which asked for two directions and shipped both.

The third direction

check-composed-skills now asserts that every role selects at least one source and every source is selected by at least one role. The mirror failure is not covered: a selector that matches nothing.

A role naming coding-rust in a repo whose catalogue does not carry it composes less than its author believes, and the role still passes both new checks because it has a selector and every source is claimed.

Why it was deliberately left out, and why that is right

From #1204:

a consumer repo whose roles.kdl names a skill its catalogue does not carry would start failing on a hook bump, and that is a rollout decision rather than this change's.

Correct, and it is the reason this is not urgent. The hook ships to five repos, and turning a passing tree red on a version bump is the rollout failure mode the catalog suite tries hardest to avoid.

What a fix needs to settle first

Measure before enforcing. Run the check across every consumer's roles.kdl and count the selectors that match nothing today. Zero makes this a free gate. A non-zero number decides whether it lands as a warning first, behind an opt-in, or with a per-repo exemption list.
Distinguish a typo from an intentional forward reference. A selector for a skill a repo intends to add is a different thing from a misspelling, and only the second is a defect.
Whatever the exemption mechanism is, give it a staleness check. The unselected list added in #1204 does not have one, so do not add a second unvalidated allowlist beside the first.

Priority

P3, outside the #1177 lane. #1073 is complete on its own terms.

**Filed by Darren (director, claude seat)**, split from `pulls/1204` for #1073, which asked for two directions and shipped both. ## The third direction `check-composed-skills` now asserts that every role selects at least one source and every source is selected by at least one role. The mirror failure is not covered: **a selector that matches nothing**. A role naming `coding-rust` in a repo whose catalogue does not carry it composes less than its author believes, and the role still passes both new checks because it has a selector and every source is claimed. ## Why it was deliberately left out, and why that is right From #1204: > a consumer repo whose `roles.kdl` names a skill its catalogue does not carry would start failing on a hook bump, and that is a rollout decision rather than this change's. Correct, and it is the reason this is not urgent. The hook ships to five repos, and turning a passing tree red on a version bump is the rollout failure mode the catalog suite tries hardest to avoid. ## What a fix needs to settle first * **Measure before enforcing.** Run the check across every consumer's `roles.kdl` and count the selectors that match nothing today. Zero makes this a free gate. A non-zero number decides whether it lands as a warning first, behind an opt-in, or with a per-repo exemption list. * **Distinguish a typo from an intentional forward reference.** A selector for a skill a repo intends to add is a different thing from a misspelling, and only the second is a defect. * **Whatever the exemption mechanism is, give it a staleness check.** The `unselected` list added in #1204 does not have one, so do not add a second unvalidated allowlist beside the first. ## Priority P3, outside the #1177 lane. #1073 is complete on its own terms.

coilyco-ops added the

labels

2026-08-22 23:59:17 +00:00

coilyco-ops referenced this issue

2026-08-23 00:00:03 +00:00

feat(pre-commit): pair roles.kdl and the composed catalogue both ways (#1073) #1204