Spike: registry-drift vocab from the projected MCP schema (#27)

[bdelanghe]

Spike seeding #27 (harden the registry-drift vocab).

Why

Production vocabFromRegistry reads Zod internals (verb.input._def.shape(), field._def.entries) inside a swallowing try/catch. A zod/verbspec bump that changes those internals silently degrades the vocab to {help, version} → valid --flag/--store copy then false-positives as error-level drift and breaks the gate.

What this shows

spikes/vocab-from-schema.mjs (zero-dep, runnable, drives the real prose.mjs registryDrift):

• vocabFromToolset(toMcpToolset(registry)) — builds the vocab from verbspec's public JSON-schema projection (properties → flags, properties[x].enum → enum values, tool name → verb id). No _def access; this is the surface test.mjs already pins.
• vocabIsDegraded(vocab) — the fail-safe registryDrift should adopt: an extraction failure → no findings, not false errors.

verbs: audit, extract
flags: catalog, file, grounding, help, store, vale, version
store: fs|cas|socket
“Use the --cache flag; set STORE=redis; run `string-audit lint`.”
  ✗ registry-drift: --cache — not a flag of any verb
  ✗ registry-drift: store=redis — not a valid value (fs|cas|socket)
  ✗ registry-drift: `lint` — verb not in registry (known: audit, extract)
degraded vocab guard: vocabIsDegraded → true (production should no-op here)

Pure spike under spikes/ — not wired into the pipeline. Promotion path is in #27: swap vocabFromRegistry's internals for this, add the degraded-vocab no-op, and test real-registry extraction.

Refs #27.

🤖 Generated with Claude Code

---

Generated by Claude Code