fix(skill): share code extension source

[zrh805]

Summary

• make every shipped --update runbook import graphify.detect.CODE_EXTENSIONS
• keep split-platform and Aider/Devin runbooks aligned as new extractors are added
• guard the generated output and explicitly sanction the monolith baseline update

Verification

• uv run --frozen pytest tests/test_skillgen.py
• uv run --frozen python -m tools.skillgen --check
• uv run --frozen python -m tools.skillgen --audit-coverage
• uv run --frozen python -m tools.skillgen --schema-singleton
• uv run --frozen python -m tools.skillgen --monolith-roundtrip
• uv run --frozen python -m tools.skillgen --always-on-roundtrip
• uv run --frozen ruff check tools/skillgen/gen.py tests/test_skillgen.py

Fixes #2227

[graphify-labs]

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

---

Graphify review — findings

This PR replaces hardcoded inline sets of code file extensions (code_exts = {...}) across the graphify skill documentation files and generated skill outputs with an import of a shared CODE_EXTENSIONS constant from graphify.detect. The change spans the embedded Python snippets in numerous per-agent update.md reference files and the main skill markdown files (aider, devin, etc.), plus corresponding skillgen generator fragments, expected outputs, and tests. The surface area is broad but the edits are repetitive and mechanical, touching the code-file detection logic in each skill's incremental-update flow along with the skillgen tooling that produces these files.

Worth a look

• CODE_EXTENSIONS refactor may drop or alter recognized extensions per skill variant — graphify/skill-aider.md:786 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 530 functions depend on the 530 functions this change touches.

Health — grade A; 5 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):

• audit_coverage() — 8 callers, 6 callees (high)
• render() — 12 callers, 4 callees (high)
• main() — 2 callers, 11 callees (medium)
• monolith_roundtrip() — 3 callers, 5 callees (medium)
• test_audit_catches_a_dropped_non_allowlisted_heading() — 0 callers, 6 callees (medium)

Verification — 530 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 530 function(s) in the blast radius were not formally verified this run

[zrh805]

Follow-up on the automated review note: this is intentional and uses the same classification source as the runtime extractor. Every affected snippet runs through graphify-out/.graphify_python, so from graphify.detect import CODE_EXTENSIONS resolves against the installed graphify package that performs Step 3A. The predicate remains Path(f).suffix.lower() in CODE_EXTENSIONS; it is not platform-specific.

Validation included tests/test_skillgen.py (all shipped Aider, Devin, and split-platform runbooks import and use that shared constant), plus a direct classification check: .sql, .ps1, and .R are code-only while a mixed .sql + .md set is not. This prevents the existing literals from silently lagging new extractor support.

[zrh805]

Follow-up: pushed db34a83, which turns the classification evidence into a regression test. It now asserts that .sql, .ps1, and .R are code-only through the exact Path(...).suffix.lower() in CODE_EXTENSIONS predicate shipped by every runbook, while a mixed .sql + .md batch remains non-code-only.

[graphify-labs]

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

---

Graphify review — findings

This PR replaces inlined hardcoded code_exts sets across the graphify skill markdown files (skill-aider, skill-devin, and numerous per-agent references/update.md files) with an import of a shared CODE_EXTENSIONS constant from graphify.detect. Corresponding generator/fragment tooling and expected-output fixtures under tools/skillgen/ and their tests appear to be updated to match this change. The surface area is broad but the edits are largely repetitive, applying the same substitution pattern consistently across many files.

No blocking issues surfaced. 2 lower-confidence candidates did not survive cross-model review.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 530 functions depend on the 530 functions this change touches.

Health — grade A; 5 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):

• audit_coverage() — 8 callers, 6 callees (high)
• render() — 12 callers, 4 callees (high)
• main() — 2 callers, 11 callees (medium)
• monolith_roundtrip() — 3 callers, 5 callees (medium)
• test_audit_catches_a_dropped_non_allowlisted_heading() — 0 callers, 6 callees (medium)

Verification — 530 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 530 function(s) in the blast radius were not formally verified this run

[graphify-labs]

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

---

Graphify review — findings

This PR replaces the inline code_exts set literals (used to determine whether all changed files are code files during incremental updates) with an imported CODE_EXTENSIONS constant from graphify.detect, applied across the generated agent skill files (skill-aider.md, skill-devin.md) and the many per-agent references/update.md files. It also touches the skillgen tooling fragments, generator helpers, and expected/reference fixtures, along with numerous test files (rationale snapshots and skillgen assertions) that correspond to these generated outputs. The change is broad in surface area but appears to be a single mechanical refactor centralizing the code-extension list, propagated through the skillgen generation system and its expected fixtures/tests.

No blocking issues surfaced. 3 lower-confidence candidates did not survive cross-model review.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 530 functions depend on the 530 functions this change touches.

Health — grade A; 5 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):

• audit_coverage() — 8 callers, 6 callees (high)
• render() — 12 callers, 4 callees (high)
• main() — 2 callers, 11 callees (medium)
• monolith_roundtrip() — 3 callers, 5 callees (medium)
• test_audit_catches_a_dropped_non_allowlisted_heading() — 0 callers, 6 callees (medium)

Verification — 530 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 530 function(s) in the blast radius were not formally verified this run