refactor(skill): simplify metadata validation phases

[kojiwakayama]

Skill frontmatter validation repeats untrusted-record admission and mixes naming/description checks, allowed-tool array admission, and metadata descriptor validation inside complex functions. Extract private phases shared by legacy and strict modes while preserving their different bounds, coercion, omission, alias, and error-precedence contracts. Use private regex literals for the unchanged naming patterns and clarify two small string/descriptor decisions.

Validation:

• Full-file local Sonar findings reduced from 13 to 2, clearing 11 findings including all six HIGH complexity findings. No new local findings or suppressions. Indexed metadata loops retain protection from ambient iterators.
• Repository test runner: 87 tests with 109 steps passed across parser/document parsing, provenance, registry, allowed tools, runtime skill metadata/default parser, and agent-scoped discovery. The focused 59-step suite passed before editing.
• All 219,278 before/after comparisons matched: 199,038 naming-regex cases across all UTF-16 units and bounded names, 20,000 metadata cases (19,155 rejected), and 240 hostile input/descriptor/proxy cases. Returned property order, serialized metadata, error fields, strict/legacy bounds, hidden fields, symbols, sparse arrays, aliases, and iterator rejection agree.
• Full typecheck, API-reference check (49 files), affected lint/format checks, anti-slop and await audits, and git diff --check passed.
• Complete branch diff, captured reflection/regex/string intrinsics, strict/legacy validation order, discovery/runtime parser callers, canonical identity, display metadata, and own-data property handling reviewed.

Public APIs and asynchronous parsing paths are unchanged. All current-commit CI workflows pass. Sonar Cloud quality gate passes with 83.9% new-code coverage, zero new open issues, and 0.0% new duplication.

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	65	362 KiB	✅ 0
src/react/components/Head.tsx	5	74 KiB	✅ 0
src/react/router/index.tsx	5	74 KiB	✅ 0
src/react/context/index.tsx	5	74 KiB	✅ 0
src/react/fonts/index.ts	6	81 KiB	✅ 0
src/react/components/ui/index.ts	111	717 KiB	✅ 0
src/react/components/ui/adapter/contract.ts	1	18 KiB	✅ 0
src/react/components/ui/icons/index.ts	3	17 KiB	✅ 0
src/chat/index.ts	301	2017 KiB	✅ 0
src/chat/ag-ui.ts	61	457 KiB	✅ 0
src/chat/protocol.ts	1	11 KiB	✅ 0
src/chat/types.ts	45	242 KiB	✅ 0
src/chat/message-prep.ts	65	509 KiB	✅ 0
src/markdown/index.ts	6	30 KiB	✅ 0
src/mdx/index.ts	2	2 KiB	✅ 0
src/agent/identity-contracts.ts	1	2 KiB	✅ 0
src/schemas/index.ts	42	216 KiB	✅ 0
src/platform/env.ts	5	53 KiB	✅ 0
src/workflow/claude-code/react/index.ts	9	91 KiB	✅ 0
src/events/index.ts	31	568 KiB	✅ 0
src/events/ag-ui/public.ts	30	561 KiB	✅ 0
src/run-events/index.ts	53	317 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[codecov]

Codecov Report

❌ Patch coverage is 79.04762% with 44 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/skill/parser.ts	79.04%	29 Missing and 15 partials ⚠️

📢 Thoughts on this report? Let us know!

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T03:31:55.031139Z	bd0966b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: bd0966b099

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
83.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud