@1aboveio/skills 1.0.18 → 1.0.20

package/skills/engineering/resolve-issues/scripts/review-verdict.mjs

@@ -28,8 +28,8 @@
 // codes below for one release (DEPRECATED: read `verdict` instead). Old exit codes:
 //   0  pass: no P0/P1 on --head (or a confirmed skip); record `reviewedHead`; ready
 //      once CI is green
-//   1  fix: the printed `fixBrief` file holds the P0/P1 findings only; it is
-//      the fix worker's whole finding list. `action` says how to fix, from a
+//   1  fix: the printed `fixBrief` file holds the P0/P1 blocker list. The coordinator
+//      may also name supporting P2 work selected in the plan. `action` says how to fix, from a
 //      comparison with the previous round's file (`<unit>-r<N-1>.json` beside
 //      it, or --prior):
 //        fix         first blocking round: fix each finding's rule across its
@@ -39,8 +39,8 @@
 //                    focused cases for missing proof, see the open cases fail,
 //                    then fix until all pass, with the
 //                    escalation model
-//        one-by-one  only new P0/P1, introduced by the last fix: one finding
-//                    per fix worker, in turn, the smallest change that closes
+//        one-by-one  only new P0/P1, introduced by the last fix: the owner fixes
+//                    findings in turn, the smallest change that closes
 //                    every row across the applicable paths
 //   5  wait: no P0/P1 is open, but a GitHub reviewer whose changes request a fix brief
 //      already carried has not re-reviewed (`awaiting`, from github-reviews.mjs merge);
@@ -66,7 +66,7 @@
 // on a skip record too, which carries only the reviewer's approval.
 
 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { basename, dirname, join } from 'node:path'
+import { basename, dirname, isAbsolute, join } from 'node:path'
 
 import { execFileSync } from 'node:child_process'
 
@@ -101,10 +101,26 @@ const isCarry = (review) => reviewTier(review) === 'skip' && review?.carry === A
 // A blocking finding names its rule and every path that must hold it, at least one open; a P0/P1
 // with every row closed is resolved and belongs out of the file. Checked on the current review
 // only, so earlier records written without the fields stay readable as priors.
+function reproducerProblems(repro, label) {
+  const problems = []
+  if (!isRecord(repro) || !isText(repro.command) || !isText(repro.expected)) {
+    problems.push(`${label}.reproducer needs a command and expected result`)
+  }
+  if (!isText(repro?.cwd) || isAbsolute(repro.cwd) || repro.cwd.startsWith('\\') || /^[A-Za-z]:/.test(repro.cwd)
+    || repro.cwd.replaceAll('\\', '/').split('/').includes('..')) {
+    problems.push(`${label}.reproducer.cwd must be relative to the candidate workspace, without parent traversal`)
+  }
+  if (isRecord(repro) && Object.hasOwn(repro, 'evidence') && !isText(repro.evidence)) {
+    problems.push(`${label}.reproducer.evidence must name retained evidence when present`)
+  }
+  return problems
+}
+
 function blockingShapeProblems(f, label) {
   const problems = []
   if (!isText(f?.trigger)) problems.push(`${label} (P0/P1) has no trigger`)
   if (!isText(f?.rule)) problems.push(`${label} (P0/P1) has no rule`)
+  if (Object.hasOwn(f, 'reproducer')) problems.push(...reproducerProblems(f.reproducer, label))
   if (!Array.isArray(f?.paths) || f.paths.length === 0) return [...problems, `${label} (P0/P1) has no paths rows`]
   for (const [j, row] of f.paths.entries()) {
     if (!isText(row?.path)) problems.push(`${label}.paths[${j}] has no path`)
@@ -213,6 +229,35 @@ export function roundsWithoutNewLow(review, history = []) {
   return since
 }
 
+// Preserve concrete witnesses for the still-broken rule, including earlier triggers.
+// These are source references, not claims that the candidate has passed them.
+function fixReproducers(blocking, records) {
+  const ids = new Set(blocking.map((finding) => finding.id))
+  const lastPass = records.findLastIndex((record) => isRecord(record)
+    && Array.isArray(record.findings) && reviewCompletionProblems(record).length === 0
+    && !record.findings.some((finding) => BLOCKING.includes(finding?.severity)))
+  const seen = new Set()
+  const out = []
+  const gaps = []
+  for (const record of records.slice(lastPass + 1)) {
+    for (const finding of Array.isArray(record?.findings) ? record.findings : []) {
+      if (!ids.has(finding?.id) || !BLOCKING.includes(finding.severity) || !Object.hasOwn(finding, 'reproducer')) continue
+      const key = JSON.stringify([finding.id, finding.trigger, finding.reproducer])
+      if (seen.has(key)) continue
+      seen.add(key)
+      const problems = reproducerProblems(finding.reproducer, finding.id)
+      if (problems.length) {
+        gaps.push({ finding: finding.id, round: record.round, head: record.head,
+          trigger: finding.trigger, reason: problems.join('; ') })
+        continue
+      }
+      out.push({ finding: finding.id, round: record.round, head: record.head,
+        trigger: finding.trigger, reproducer: structuredClone(finding.reproducer) })
+    }
+  }
+  return { reproducers: out, reproducerGaps: gaps }
+}
+
 // How to act on a blocking round. better-review keeps a still-open finding's id across
 // rounds, so a shared id means the last fix did not resolve it.
 // `history` is every record before `prior`, oldest first, or a function that reads them; it is
@@ -294,7 +339,12 @@ export function reviewVerdict(review, head, prior = null, { confirmSkip, earlier
     return awaiting.length ? { verdict: 'wait', ...base, ...skipped } : { verdict: 'pass', reviewedHead: head, ...base, ...skipped }
   }
   if (skip && blocking.some((f) => !GITHUB_ID.test(String(f.id)))) throw new ReviewIncomplete('a skip record cannot hold findings; spawn the reviewer')
-  return { ...fixAction(review, blocking, prior, history, { decision }), ...base, fix: blocking }
+  let retainedHistory
+  const readHistoryOnce = () => retainedHistory ??= typeof history === 'function' ? history() : history
+  const action = fixAction(review, blocking, prior, readHistoryOnce, { decision })
+  const witnesses = action.verdict === 'fix'
+    ? fixReproducers(blocking, [...readHistoryOnce(), prior, review]) : {}
+  return { ...action, ...base, fix: blocking, ...witnesses }
 }
 
 // The record --carry writes for `head`: the previous round's approval, carried with no
@@ -333,12 +383,13 @@ export function carryRecord(prior, head, identity = {}) {
 }
 
 const INSTRUCTIONS = {
-  'fix': 'Fix only these findings. For each, make the smallest complete fix for its `rule` across the applicable paths and close every row in its `paths`. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable.',
+  'fix': 'Fix these blocking findings. For each, make the smallest complete fix for its `rule` across the applicable paths and close every row in its `paths`. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable.',
   'test-first': 'The findings listed in `recurring` survived a fix: the last fix closed one path and missed others. For each, before changing code: name the rule the bug breaks; list every code path that can break it, including the trigger of this finding id in each earlier round\'s review file beside this one; reuse sufficient tests and add focused cases from the concrete triggers, then run them to see it fail on each open path. One table-driven test may cover several paths. Then make the smallest complete fix across the applicable paths until every test passes. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable. "Fixed" is every path\'s test passing. Fix the rest as usual.',
-  'one-by-one': 'The last fix introduced these findings. Fix them one at a time, one fix worker each, with the smallest complete change that closes every row of its `paths`. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable. Touch nothing else.',
+  'one-by-one': 'The last fix introduced these findings. Fix them sequentially in this assignment, with the smallest complete change that closes every row of its `paths`. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable.',
 }
 
-// The fix worker's brief carries only P0/P1 findings; P2/P3 never reach it.
+// The generated blocker list stays P0/P1. Supporting P2 selections come from the
+// coordinator's plan decision and accompanying brief; P3 is always skipped.
 export function fixBriefOf(result) {
   const fixRound = hasFixRound(result) ? result.fixRound : result.round
   if (!isCounter(result.round) || !isCounter(fixRound) || fixRound > result.round) {
@@ -350,9 +401,11 @@ export function fixBriefOf(result) {
     fixRound,
     head: result.head,
     action: result.action,
-    instruction: `${INSTRUCTIONS[result.action]}${result.decision ? ` Decision ${result.decision} in the plan's \`decisions\` settles what the recurring spec finding requires: fix it as that decision reads.` : ''} Every other finding is out of scope: a P2 is deferred to the dropbox or a follow-up issue, and a P3 is skipped.`,
+    instruction: `${INSTRUCTIONS[result.action]}${result.decision ? ` Decision ${result.decision} in the plan's \`decisions\` settles what the recurring spec finding requires: fix it as that decision reads.` : ''} Read each retained reproducer before using it; run against the candidate workspace at its workspace-relative cwd, preserving the recorded trigger and expected contract. Earlier results are baseline evidence, not candidate passes. A reproducerGaps entry is a source reference, not a runnable command: inspect its original review and establish a valid candidate-local case, retaining the original evidence and reporting any remaining gap. Keep subsequent failures of the affected operation in this repair until its existing criteria pass or an existing stop condition applies. Also perform only supporting P2 work explicitly selected by the coordinator in the plan and accompanying brief, naming the existing authorized outcome, verification or delivery it enables. P2 remains nonblocking; defer unselected P2 to the dropbox or a follow-up issue. Skip P3. Preserve the acceptance bar and existing authorization boundaries.`,
     ...(result.decision ? { decision: result.decision } : {}),
     recurring: result.recurring,
+    reproducers: result.reproducers ?? [],
+    reproducerGaps: result.reproducerGaps ?? [],
     fix: result.fix,
   }
 }

package/skills/engineering/resolve-release/SKILL.md

@@ -4,7 +4,7 @@ description: "Slash/explicit-only (/resolve-release). Full GitHub Flow release f
 disable-model-invocation: true
 metadata:
   workflow-role: coordinator
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve release

package/skills/engineering/rush-issues/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-issues
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush issues (shortcut of resolve-issues)

package/skills/engineering/rush-release/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-release
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush release (shortcut of resolve-release)

package/skills/engineering/test-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-quality
 description: "Seven principles for tests that catch real bugs, and an audit that reports weak, redundant, and not-coverage tests without fixing them. Use when writing, changing, or reviewing tests, or when asked whether tests are useful, redundant, over-mocked, flaky, only assert static text, or test config files, or asked to make a slow test suite faster without losing coverage, or when the user asks to write the testing conventions into a repo's CONTRIBUTING.md. NOT defining what a spec must prove (ensure-coverage) or authoring browser tests (e2e-test)."
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Test Quality

package/skills/risk-compliance/compliance-audit/SKILL.md

@@ -2,7 +2,7 @@
 name: compliance-audit
 version: 2.9.0
 description: "Audit operations against financial-compliance checklists (AML/KYC, VARS, PCI-DSS, TPA oversight, onboarding, transaction monitoring). Produces tracker.md (with a tracker.xlsx export) and phase-trail.md with layered validation; cites evidence by original filename. Input: reg-parser or the built-in VARS checklist."
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Compliance Audit

package/skills/risk-compliance/contract-compare/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-compare
 description: "Compare two or more contracts side-by-side for structured diff, gap analysis, and benchmarking. Use when: comparing contracts or agreements, contract diff, compare terms, vendor-vs-vendor, compare our template vs theirs, compliance gap between contracts. NOT for single-contract risk review — use contract-review for that."
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Compare

package/skills/risk-compliance/contract-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-review
 description: "Review contracts for legal, commercial, and compliance risks via convert → chunk review → merge → validate (+ optional mandate preprocessing). Use for reviewing, auditing, or checking any contract, agreement, NDA, MSA, or SLA; input a file path (PDF/DOCX/TXT) or pasted text."
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Review

package/skills/risk-compliance/doc-authenticity/SKILL.md

@@ -3,7 +3,7 @@ name: doc-authenticity
 version: 0.4.1
 description: "Screen PDF documents and raster images for fabrication, tampering, Photoshop or other image-editor use, and content validity. Detects file type, runs format-specific authenticity forensics, classifies bank statements, conversation logs, invoices, agreements, and other documents, then applies type-specific validity checks. Produces separate authenticity (NO_EVIDENCE_OF_MODIFICATION / SUSPICIOUS / LIKELY_MODIFIED / INCONCLUSIVE) and validity (VALID / INVALID / INCONCLUSIVE) verdicts. Use whenever a user asks whether a document, screenshot, scan, statement, invoice, contract, chat log, receipt, or payment evidence is genuine, original, edited, Photoshopped, manipulated, fake, or valid."
 disable-model-invocation: true
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Document and Image Authenticity

package/skills/risk-compliance/fraud-detection/SKILL.md

@@ -12,7 +12,7 @@ description: >
   impact, and a business report. Use for fraud, scam, mule, account-takeover,
   chargeback, dispute, transfer, collection, or payout risk analysis even when the
   user does not name this skill.
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Fraud Detection

package/skills/risk-compliance/payment-analysis/SKILL.md

@@ -14,7 +14,7 @@ description: >
   transactions" — even if they do not say payment-analysis. Do NOT use for
   fraud rule discovery (fraud-detection) or TLD / MCC-miscoding
   clusters (tld-detection).
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Payment Analysis

package/skills/risk-compliance/portfolio-payment-analysis/SKILL.md

@@ -5,7 +5,7 @@ description: >
   and investigate selected merchants' authorization, settlement and disputes,
   including descriptor mapping and overlapping exports. Portfolio-level payment
   overviews belong to payment-analysis; fraud rule discovery belongs to fraud-detection.
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Portfolio payment analysis

package/skills/risk-compliance/similar-domain/SKILL.md

@@ -8,7 +8,7 @@ description: >
   links, an entity chain, and a watchlist for the operator's next domains.
   Not transaction data (tld-detection) or fraud rules (fraud-detection).
 disable-model-invocation: true
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Similar Domain

package/skills/risk-compliance/tld-detection/SKILL.md

@@ -6,7 +6,7 @@ description: >
   patterns, with USD and BIN-country currency views, group profiles and priorities.
   Not payment-analysis, fraud-detection, or website research.
 disable-model-invocation: true
-release-version: 0.49.0
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # TLD detection