fix(skill): defer semantic-extraction backend to detect_backend() (#2513)

[curtisgray]

Fixes #2513.

Step 3 of the skill hardcoded a Gemini-only key check ("graphify does not read … any other provider key") while graphify/llm.py ships detect_backend() covering gemini→kimi→claude→openai→deepseek→azure→bedrock→ollama plus the #1084 custom-provider registry. Anyone with only OPENAI_API_KEY, MOONSHOT_API_KEY, etc. — or a registered custom provider — got host-agent extraction even though the CLI supports their backend.

The skill now asks detect_backend() which backend the CLI would use and passes that name to extract_corpus_parallel. Image chunks still go to subagents when the detected backend lacks vision support, so pixel data isn't silently dropped, and the never-prompt/never-block-on-a-key rules are unchanged. Only tools/skillgen/fragments/core/core.md is edited by hand; the other 28 files are python -m tools.skillgen + --bless output.

All skillgen guards pass (--check, --audit-coverage, --schema-singleton, --monolith-roundtrip, --always-on-roundtrip); pytest tests/test_skillgen.py tests/test_install.py tests/test_install_references.py tests/test_codebuddy.py: 205 passed, 1 skipped. The detection→extract_corpus_parallel path was exercised against a registered custom provider (OpenRouter, graphify provider add per #1084): auto-detected and extracted a docs corpus correctly.

https://claude.ai/code/session_0115RXPvhNCHAnc7AFn1ud3H

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 5 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

Rewrites the semantic-extraction step across all skill variants to detect the LLM backend via graphify.llm.detect_backend() — the same auto-detection graphify extract uses — instead of only checking GEMINI_API_KEY/GOOGLE_API_KEY, so any registered backend or custom provider with a key already in the environment is used. When a backend is found, extraction runs through extract_corpus_parallel(files, backend="NAME") with that backend's default model and model env var; when none is found it prints the tip once and falls back to the host agent as the LLM without ever prompting for a key. Adds a vision guard: backends whose BACKENDS["NAME"].get("vision") is falsy still route image chunks to subagents so pixel data isn't silently dropped.

Worth a look

• Workspace-controlled interpreter file is executed by shell snippet — graphify/skill-claw.md:161 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Workspace-controlled interpreter file is executed during backend detection — graphify/skill-copilot.md:163 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Executes interpreter path read from workspace file — graphify/skill-trae.md:162 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Executes interpreter path read from workspace file — graphify/skill-vscode.md:162 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Windows skill now auto-uses non-Gemini API keys despite prior no-other-keys contract — graphify/skill-windows.md:184 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 730 functions depend on the 730 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 730 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 730 function(s) in the blast radius were not formally verified this run