@agentsfleet/orly 0.10.13 → 0.11.0

package/schemas/profile.schema.json

@@ -1,12 +1,55 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
-  "required": ["schema_version", "name", "packs", "commands"],
+  "required": ["schema_version"],
   "properties": {
     "schema_version": {"const": 1},
-    "name": {"type": "string"},
-    "packs": {"type": "array", "items": {"type": "string"}},
-    "commands": {"type": "object"}
+    "orly_version": {"type": "string", "pattern": "^$|^\\d+\\.\\d+\\.\\d+(?:-[a-zA-Z0-9.-]+)?(?:\\+[a-zA-Z0-9.-]+)?$"},
+    "packs": {"type": "array", "items": {"$ref": "#/$defs/nonempty"}},
+    "managed": {"type": "array", "items": {"$ref": "#/$defs/nonempty"}},
+    "digests": {
+      "type": "object", "propertyNames": {"$ref": "#/$defs/nonempty"},
+      "additionalProperties": {"type": "string", "pattern": "^(?:sha256:)?[a-f0-9]{64}$"}
+    },
+    "commands": {
+      "type": "object", "propertyNames": {"$ref": "#/$defs/nonempty"},
+      "additionalProperties": {
+        "type": "array", "minItems": 1,
+        "items": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/nonempty"}}
+      }
+    },
+    "surfaces": {
+      "type": "object", "additionalProperties": false,
+      "properties": {
+        "user": {"type": "array", "items": {"$ref": "#/$defs/nonempty"}},
+        "docs": {"type": "array", "items": {"$ref": "#/$defs/nonempty"}}
+      }
+    },
+    "limits": {
+      "type": "object", "propertyNames": {"$ref": "#/$defs/nonempty"},
+      "additionalProperties": {
+        "type": "object", "additionalProperties": false,
+        "properties": {
+          "timeout_ms": {"type": "integer", "minimum": 1, "maximum": 2147478647},
+          "output_bytes": {"type": "integer", "minimum": 1, "maximum": 9007199254740991}
+        }
+      }
+    },
+    "execution": {
+      "type": "object", "required": ["remote"], "additionalProperties": false,
+      "properties": {
+        "remote": {
+          "type": "object", "required": ["mode"], "additionalProperties": false,
+          "properties": {
+            "mode": {"const": "disabled"},
+            "launcher": {"type": "array", "minItems": 1, "maxItems": 32, "items": {"allOf": [{"$ref": "#/$defs/nonempty"}, {"maxLength": 1024}]}}
+          }
+        }
+      }
+    }
   },
-  "additionalProperties": false
+  "additionalProperties": false,
+  "$defs": {
+    "nonempty": {"type": "string", "minLength": 1, "pattern": "^[^\\u0000]+$"}
+  }
 }

package/skills/orly-babysit-prs/SKILL.md

@@ -15,7 +15,7 @@ At invocation start, record the consent-gated usage signal without blocking the
 command -v orly >/dev/null 2>&1 && ORLY_INVOCATION=skill orly skill-event orly-babysit-prs >/dev/null 2>&1 || true
 ```
 
-Review bots (greptile on GitHub; greptile or another review bot on GitLab)
+Greptile reviews on GitHub and GitLab
 post auto-reviews **asynchronously**. They land as PR review comments / MR
 discussion threads, not check runs, so `gh pr checks --watch` (or the glab
 equivalent) doesn't observe them. Without explicit polling on a backoff
@@ -42,8 +42,8 @@ Then walk it section by section:
 | Triage section | What this skill triggers |
 |---|---|
 | `## Fetch` | Run per detected review thread (multi-thread loop below), via the forge layer |
-| `## Suppressions Check` | Read `$HOME/.gstack/projects/<slug>/greptile-history.md`; skip lines tagged `fp` matching `repo + file-pattern + category` |
-| `## Classify` | Read file ±10 lines around each comment's `path:line`; classify VALID & ACTIONABLE / VALID BUT ALREADY FIXED / FALSE POSITIVE / SUPPRESSED |
+| `## Suppressions Check` | Read history as context; a prior `fp` label never suppresses a current finding. Dismissal requires the owner's item-specific decision and recorded reason. |
+| `## Classify` | Read the finding's code and evidence; classify actionable, already fixed or disputed. A disputed finding stays open for the owner. |
 | `## Reply APIs` | Tier 1 first response, Tier 2 on re-flag — via the forge layer |
 | `## Reply Templates` | Use Tier 1 / Tier 2 template verbatim — do not invent new wording |
 | `## Severity Assessment & Re-ranking` | Re-rank the bot's severity against the project's actual risk profile |
@@ -74,9 +74,8 @@ echo "BABYSIT: forge=$FORGE origin=$ORIGIN"
 | "walk every…" | every review id | every discussion thread id |
 | Reply | reply to the review comment | post a note to the discussion |
 
-Both forges' bots are filtered by author name matching `greptile` (or the
-project's configured review bot — see the per-project history `bot:` note if
-present).
+Both forges filter bot authors by a case-insensitive `greptile` match.
+Completion, review threads and summaries use that same selection.
 
 ## STEP 0.75 — CI checks must go green (poll + fix)
 
@@ -93,27 +92,42 @@ Each cycle, after the review-thread walk, poll CI and act by cause:
 ### GitHub
 
 ```bash
-gh pr checks "$PR_NUMBER" --json name,state,bucket,link 2>/dev/null \
-  | jq -r '.[] | "\(.bucket)\t\(.state)\t\(.name)\t\(.link)"'   # bucket ∈ pass|fail|pending|skipping|cancel
+set -euo pipefail
+CHECKS=$(gh pr checks "$PR_NUMBER" --json name,state,bucket,link) \
+  || { echo "BABYSIT: check fetch incomplete; reset quiet polls" >&2; exit 1; }
+printf '%s' "$CHECKS" | jq -e 'type == "array" and length > 0 and all(.[]; .bucket == "pass" or .bucket == "skipping")' >/dev/null \
+  || { echo "BABYSIT: checks empty or not green; reset quiet polls" >&2; exit 1; }
+CHECK_HEAD=$(gh pr view "$PR_NUMBER" --json headRefOid --jq '.headRefOid')
+[ "$CHECK_HEAD" = "$POLL_HEAD" ] \
+  || { echo "BABYSIT: revision changed during checks; reset quiet polls" >&2; exit 1; }
+echo "BABYSIT: ci=green revision=$CHECK_HEAD"
 ```
 
 ### GitLab
 
 ```bash
-glab ci status 2>/dev/null \
-  || glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/pipelines" \
-       | jq -r '.[0] | "\(.status)\t\(.web_url)"'               # status ∈ success|failed|running|canceled|pending
+set -euo pipefail
+PIPELINES=$(glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/pipelines" --paginate | jq -sc 'add') \
+  || { echo "BABYSIT: pipeline fetch incomplete; reset quiet polls" >&2; exit 1; }
+printf '%s' "$PIPELINES" | jq -e --arg revision "$POLL_HEAD" \
+  '[.[] | select(.sha == $revision)] | sort_by(.id) | last | .status == "success"' >/dev/null \
+  || { echo "BABYSIT: current revision has no successful pipeline; reset quiet polls" >&2; exit 1; }
+CHECK_HEAD=$(glab mr view -F json | jq -er '.sha // .diff_refs.head_sha')
+[ "$CHECK_HEAD" = "$POLL_HEAD" ] \
+  || { echo "BABYSIT: revision changed during check fetch; reset quiet polls" >&2; exit 1; }
+printf 'ci=green revision=%s\n' "$CHECK_HEAD"
 ```
 
 | CI state | Action |
 |---|---|
-| all `pass`/`skipping` (GitLab `success`) | Record `ci=green`. A done-declaration is now allowed (if greptile is also quiet). |
+| nonempty, completely fetched checks all `pass`/`skipping` (GitLab current-revision `success`) | Record `ci=green` for the unchanged pushed revision. |
+| fetch failed, malformed response, or no checks found | Record `ci=incomplete`; reset quiet polls and retry. An empty response is never green. |
 | any `pending`/`running` | Record `ci=pending`; re-poll on the cadence. **Never declare done while a check is still running.** |
 | any `fail`/`cancel` **from your changes** | In-scope finding you OWN — treat like a greptile fix. Fetch the failing log (`gh run view <run-id> --log-failed`, run id from the check `link`; GitLab `glab ci trace <job-id>`), fix the code, re-verify with the relevant `make` target, commit, push, re-poll. |
 | any `fail` **NOT from your changes** (pre-existing red, infra flake, unrelated job) | Surface to the user with job name + link. Do **not** fix blindly, do **not** edit CI config. Pause the done-declaration until they decide. |
 
 CI failures caused by your commit are not "surface and wait" — they are the
-same contract as a greptile P0: diagnose, fix the code (never the CI config),
+same repair duty as a greptile P0: diagnose, fix the code (never the CI config),
 push, and re-poll until green.
 
 ## Triggers
@@ -123,7 +137,7 @@ push, and re-poll until green.
 - User says: "babysit", "watch greptile", "poll the PR", "poll the MR",
   "watch reviews", "follow up on review feedback", "what did greptile say".
 
-## Output contract
+## Output rules
 
 Per cycle, print one line (`PR` on GitHub, `MR` on GitLab):
 
@@ -152,17 +166,38 @@ via the agent's native cron/wakeup mechanism.
 ### GitHub (`FORGE=github`)
 
 ```bash
+set -euo pipefail
 REPO=$(gh repo view --json nameWithOwner --jq '.nameWithOwner')
 PR_NUMBER=$(gh pr view --json number --jq '.number')
+POLL_HEAD=$(gh pr view "$PR_NUMBER" --json headRefOid --jq '.headRefOid')
+[ "$POLL_HEAD" = "$(git rev-parse HEAD)" ] \
+  || { echo "BABYSIT: local and pushed revisions differ; reset quiet polls" >&2; exit 1; }
+
+REVIEWS=$(gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" --paginate --slurp | jq -c 'add')
+COMMENTS=$(gh api "repos/$REPO/pulls/$PR_NUMBER/comments" --paginate --slurp | jq -c 'add')
+SUMMARIES=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments" --paginate --slurp | jq -c 'add')
+for payload in "$REVIEWS" "$COMMENTS" "$SUMMARIES"; do
+  printf '%s' "$payload" | jq -e 'type == "array" and all(.[]; (.id | type == "number") and (.user.login | type == "string"))' >/dev/null \
+    || { echo "BABYSIT: malformed review response; reset quiet polls" >&2; exit 1; }
+done
+printf '%s' "$REVIEWS" | jq -e --arg revision "$POLL_HEAD" --arg bot "greptile" \
+  'any(.[]; (.user.login | test($bot; "i")) and .commit_id == $revision and (.state == "COMMENTED" or .state == "APPROVED" or .state == "CHANGES_REQUESTED"))' >/dev/null \
+  || { echo "BABYSIT: current revision review pending; reset quiet polls" >&2; exit 1; }
+END_HEAD=$(gh pr view "$PR_NUMBER" --json headRefOid --jq '.headRefOid')
+[ "$POLL_HEAD" = "$END_HEAD" ] \
+  || { echo "BABYSIT: revision changed during review fetch; reset quiet polls" >&2; exit 1; }
+jq -n --arg revision "$POLL_HEAD" --argjson reviews "$REVIEWS" \
+  --argjson comments "$COMMENTS" --argjson summaries "$SUMMARIES" \
+  '{revision:$revision,reviews:$reviews,comments:$comments,summaries:$summaries}'
 
 # Walk EVERY review id — greptile may post more than one review per push.
-REVIEW_IDS=$(gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" \
-              --jq '.[] | select(.user.login | test("greptile"; "i")) | .id')
+REVIEW_IDS=$(printf '%s' "$REVIEWS" | jq -r \
+              '.[] | select(.user.login | test("greptile"; "i")) | .id')
 
 for rid in $REVIEW_IDS; do
   # Follow greptile-triage.md (STEP 0): fetch line+top-level comments for THIS
   # review id; Suppressions Check; Classify; Reply (Tier 1/Tier 2); history write.
-  # Fetch: gh api "repos/$REPO/pulls/$PR_NUMBER/reviews/$rid/comments"
+  # Fetch from the complete COMMENTS snapshot by pull_request_review_id.
   # Reply: gh api -X POST "repos/$REPO/pulls/$PR_NUMBER/comments/<cid>/replies" -f body="..."
   :
 done
@@ -173,26 +208,32 @@ done
 #   (2) the top-level PR issue comment (greptile's "description reply" / summary,
 #       often with collapsible per-file sections listing concerns inline).
 # Run each through greptile-triage.md exactly like a line comment.
-gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" \
-  --jq '.[] | select(.user.login|test("greptile";"i")) | select(.body != "") | .body'
-gh api "repos/$REPO/issues/$PR_NUMBER/comments" \
-  --jq '.[] | select(.user.login|test("greptile";"i")) | {id, body}'
+printf '%s' "$REVIEWS" | jq -r '.[] | select(.user.login|test("greptile";"i")) | select(.body != "") | .body'
+printf '%s' "$SUMMARIES" | jq -c '.[] | select(.user.login|test("greptile";"i")) | {id, body}'
 # Reply to a summary issue comment: gh api -X POST "repos/$REPO/issues/$PR_NUMBER/comments" -f body="..."
 ```
 
 ### GitLab (`FORGE=gitlab`)
 
 ```bash
+set -euo pipefail
 # Project full path (e.g. gpu/console), URL-encoded for the API.
-PROJECT_PATH=$(glab repo view -F json 2>/dev/null | jq -r '.path_with_namespace' \
-               || git remote get-url origin | sed -E 's#.*[:/]([^:/]+/[^/]+)$#\1#; s#\.git$##')
-PROJ_ENC=$(printf '%s' "$PROJECT_PATH" | sed 's#/#%2F#g')
-MR_IID=$(glab mr view -F json | jq -r '.iid')
+PROJECT_PATH=$(glab repo view -F json | jq -er '.path_with_namespace | strings | select(length > 0)')
+PROJ_ENC=$(printf '%s' "$PROJECT_PATH" | jq -sRr '@uri')
+MR_IID=$(glab mr view -F json | jq -er '.iid | numbers')
+POLL_HEAD=$(glab mr view -F json | jq -er '.sha // .diff_refs.head_sha')
+[ "$POLL_HEAD" = "$(git rev-parse HEAD)" ] \
+  || { echo "BABYSIT: local and pushed revisions differ; reset quiet polls" >&2; exit 1; }
 
 # Walk EVERY discussion thread from the review bot. GitLab has no "review"
 # object — a bot posts discussion threads (each with notes[]).
-THREAD_IDS=$(glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/discussions" --paginate \
-             | jq -r '.[] | select(any(.notes[]; .author.username | test("greptile"; "i"))) | .id')
+DISCUSSIONS=$(glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/discussions" --paginate | jq -sc 'add')
+NOTES=$(glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/notes" --paginate | jq -sc 'add')
+printf '%s' "$DISCUSSIONS" | jq -e 'type == "array" and all(.[]; (.id | type == "string") and (.notes | type == "array") and all(.notes[]; (.author.username | type == "string")))' >/dev/null \
+  || { echo "BABYSIT: malformed discussion evidence; reset quiet polls" >&2; exit 1; }
+printf '%s' "$NOTES" | jq -e 'type == "array" and all(.[]; (.id | type == "number") and (.author.username | type == "string"))' >/dev/null \
+  || { echo "BABYSIT: malformed summary evidence; reset quiet polls" >&2; exit 1; }
+THREAD_IDS=$(printf '%s' "$DISCUSSIONS" | jq -r '.[] | select(any(.notes[]; .author.username | test("greptile"; "i"))) | .id')
 
 for tid in $THREAD_IDS; do
   # Follow greptile-triage.md (STEP 0): fetch the thread's notes (body +
@@ -206,9 +247,13 @@ done
 # ALSO triage greptile's SUMMARY feedback — the MR-level notes greptile posts
 # outside a positioned discussion thread (the "description reply" / overview
 # note, often with inline per-file concerns). Run each through greptile-triage.md.
-glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/notes" \
-  --jq '.[] | select(.author.username|test("greptile";"i")) | select(.type == null) | {id, body}'
+printf '%s' "$NOTES" | jq -c '.[] | select(.author.username|test("greptile";"i")) | select(.type == null) | {id, body}'
 # Reply to a summary note: glab api -X POST "projects/$PROJ_ENC/merge_requests/$MR_IID/notes" -f body="..."
+END_HEAD=$(glab mr view -F json | jq -er '.sha // .diff_refs.head_sha')
+[ "$POLL_HEAD" = "$END_HEAD" ] \
+  || { echo "BABYSIT: revision changed during review fetch; reset quiet polls" >&2; exit 1; }
+jq -n --arg revision "$POLL_HEAD" --argjson discussions "$DISCUSSIONS" --argjson summaries "$NOTES" \
+  '{revision: $revision, discussions: $discussions, summaries: $summaries}'
 ```
 
 ### History paths (forge-independent)
@@ -232,16 +277,18 @@ Every triaged comment writes one line to BOTH:
 
 | File | Purpose |
 |---|---|
-| `$HOME/.gstack/projects/<slug>/greptile-history.md` | Per-project. Drives Suppressions Check on next cycle — `fp` lines suppress matching comments forever. |
+| `$HOME/.gstack/projects/<slug>/greptile-history.md` | Per-project context; no historical label automatically dismisses a finding. |
 | `$HOME/.gstack/greptile-history.md` | Global aggregate. Cross-project retro / pattern-mining. |
 
 Line format (from the triage helper's "History File Writes" section):
 
 ```
-<YYYY-MM-DD> | <owner/repo> | <type:fp|fix|already-fixed> | <file-pattern> | <category>
+<YYYY-MM-DD> | <owner/repo> | <type:fp|fix|already-fixed|disputed> | <file-pattern> | <category>
 ```
 
-- **`fp`** — false positive. Suppressed on future polls.
+- **`fp`** — owner-confirmed dismissal for a named finding, with its quote,
+  reason and reviewed revision recorded in Session Notes. Reassess on later revisions.
+- **`disputed`** — awaiting the owner's decision; remains open and blocks done.
 - **`fix`** — real issue, fixed in this cycle. Not suppressed.
 - **`already-fixed`** — real issue, fixed in a prior commit on this branch. Not suppressed.
 
@@ -263,10 +310,16 @@ The categories are a fixed set: `race-condition`, `null-check`, `error-handling`
 
 ## Stop conditions
 
-- **Done = two consecutive empty polls AND CI green.** Both must hold: no new
+- **Done = two complete, consecutive empty polls AND CI green on the same pushed revision.** Both must hold: no new
   reviews/threads/summary findings for two polls **and** STEP 0.75 reports
   `ci=green`. A quiet bot with a still-`pending` or red CI is NOT done — keep
   polling on the cadence.
+- Every cycle fetches all pages of reviews, line comments and summaries.
+  Fetch failure, missing checks, a disputed finding or a changed revision resets
+  the quiet counter; compare the remote revision again after check collection.
+- Missing review completion for the current pushed revision is `review=pending`,
+  even when all fetches succeed. Surface it after the recorded retry cadence;
+  two empty responses alone cannot prove the reviewer completed its work.
 - **PR/MR merged or closed** → stop, report.
 - **CI red FROM your changes** → fix it (STEP 0.75): diagnose, fix the code,
   push, re-poll. Not a stop condition — it's work to do.
@@ -320,7 +373,7 @@ BABYSIT REPORT — <PR|MR> #<n> @ <SHA>
 - `docs/greptile-learnings/RULES.md` — project-level named rules
   (durable principles). New rule added here only when the finding
   generalizes; per-incident rows go to greptile-history.md.
-- this repository's `AGENTS.md` / `AGENTS.orly.md` — CHORE(close) skill
+- this repository's `AGENTS.md` / `.orly/AGENTS.md` — CHORE(close) skill
   chain step 4 cites this skill.
 - `gh api` docs: https://cli.github.com/manual/gh_api
 - `glab api` docs: https://gitlab.com/gitlab-org/cli (`glab api --help`)

package/skills/orly-spec-new/SKILL.md

@@ -60,6 +60,13 @@ Determinism starts here. Before copying the template:
 
 ## Step 2 — Lock review-readiness (so the PR ships clean)
 
+**Optional Jev advice:** After capturing one concrete requirement, prepare a
+`plan` manifest for `plan.prerequisites` or `plan.observable_result`.
+Use `orly judge plan --input <manifest>` for exact offline replay. Add
+`--refresh` only when selected source upload is authorized; use
+`orly judge --help` for the manifest and limits. Inspect uncertain or adverse answers before accepting
+the plan. Advice never replaces this skill's checklist or owner decisions.
+
 This is the step that prevents greptile findings — the spec becomes a pre-commitment to the rules its code must obey:
 
 - **Applicable Rules** — name the *specific* `docs/greptile-learnings/RULES.md` rule IDs the diff will trip (e.g. NDC, NLR, NLG, UFS), plus the per-surface dispatch façades / rule files: `dispatch/write_zig.md` (`*.zig`), `docs/REST_API_DESIGN_GUIDELINES.md` (`src/http/handlers/**`), `docs/SCHEMA_CONVENTIONS.md` (`schema/*`), `dispatch/write_ts_adhere_bun.md`, `docs/LOGGING_STANDARD.md`, `docs/LIFECYCLE_PATTERNS.md`. Generic "follow RULES.md" earns a greptile finding; named IDs the implementer obeys by construction do not. Cite rule docs by their repo-local `docs/…` paths — the selected packs materialise them into every repository; cite only files that exist here (`test -f` each).
@@ -88,7 +95,8 @@ Now the file. Pick the ID and copy the template:
 # next free M{N}_{WS}
 ls docs/v*/pending/ docs/v*/active/ docs/v*/done/ 2>/dev/null \
   | grep -oE 'M[0-9]+_[0-9]+' | sort -u | tail -5
-cp docs/TEMPLATE.md docs/v{N}/pending/M{N}_{WS}_P{P}_{CATEGORIES}_{NAME}.md
+sed -n '/^# Spec Body — Copy Everything Below This Line/,$p' docs/TEMPLATE.md \
+  | sed '1d' > docs/v{N}/pending/M{N}_{WS}_P{P}_{CATEGORIES}_{NAME}.md
 ```
 
 
@@ -125,17 +133,22 @@ Before the spec leaves `pending/`, it must pass this checklist — the determini
 - [ ] reporting sections present (Discovery; Acceptance Rubric with Graded column empty)
 - [ ] `bash audits/spec-template.sh --staged` is clean (it BLOCKs missing required sections and unfilled `{placeholders}`)
 
-Then commit in the current authoring context:
+Commit a new milestone spec on the repository's default branch, as the
+operating model requires. Check the remote and branch before authoring;
+do not infer the default branch name.
 
-- If the skill is running inside an existing branch/worktree, author and commit the spec there.
-- If there is no branch/worktree context, use the repo's `main` branch as the fallback.
+- Inside an active stream, revise its existing spec on the active branch.
+- A new, separate milestone inside an active stream needs the owner's decision
+  before creating another worktree or changing branches.
+- Never move the active stream's uncommitted work to the default branch.
 
 ```bash
 git add docs/v{N}/pending/M{N}_{WS}_*_{NAME}.md
 git commit -m "docs(m{N}): add spec — {short title}"
 ```
 
-The spec lands in `pending/` on the branch/worktree where the skill was invoked. CHORE(open) moves it to `active/` and creates any needed worktree — handled by the lifecycle, not this skill.
+The new spec lands in `pending/` on the default branch.
+CHORE(open) moves it to `active/` and creates the implementation worktree.
 
 ---
 
@@ -143,7 +156,7 @@ The spec lands in `pending/` on the branch/worktree where the skill was invoked.
 
 - It does **not** start coding, create a worktree, or move the spec to `active/`. That's CHORE(open), when implementation begins.
 - It does **not** modify any rule file, ARCHITECTURE doc, or changelog.
-- It does **not** create a branch just to author a spec. Spec creation uses the current branch/worktree, falling back to `main` only when no branch/worktree exists.
+- It does not create an implementation branch or silently switch an active stream.
 
 ## Failure modes
 

package/skills/orly-write-integration-test/SKILL.md

@@ -68,7 +68,7 @@ Spec asserts "503 on Redis down", code returns 200 → test the spec, flag the c
 
 1. **Read the spec** — Failure Modes, Error Contracts, Concurrency Contracts, Resource Limits, Streaming Contracts tables are authoritative.
 2. **Read `docs/greptile-learnings/RULES.md`** — every rule maps to a regression test.
-3. **Bring up real deps** — `make up` (or stack equivalent). Verify health before writing tests.
+3. **Bring up real deps** — use the repository's declared local dependency startup command. Verify health before writing tests; do not add a datastore the application does not use.
 4. **Follow lifecycle timing** — record the comparison revision at opening; measure full unit and integration baselines before the Pull Request. Run focused reproduction and Section proofs while implementing; first application hydration occurs at Section verification. `dispatch/lifecycle.md` owns the sequence.
 5. **Map the ordered request path** — list every dependency interaction in execution order, including repeated acquisitions of the same resource, plus every `catch`/`orelse`/`except`/`Err` in the chain. That list seeds T4 and its partial-completion matrix.
 
@@ -80,7 +80,7 @@ Spec asserts "503 on Redis down", code returns 200 → test the spec, flag the c
 | **Standard** | New service method, new Redis stream/key, schema change with logic | + T4 + T5 + T6 |
 | **Hardening** | Auth / payment / lease / migration / streaming / anything in the data-loss radius | + T7 (if applicable) + T8 + chaos pass |
 
-Auto-detect from diff: `src/auth/**`, `src/agent/leases/**`, `src/runner/**` + `rustd/crates/afd_fleet/**` (the lease/reclaim/fence + client-daemon surface → T9), schema migrations, streaming handlers → Hardening. CRUD-only against existing schema → Smoke. Default → Standard.
+Auto-detect from the repository's actual authentication, lease/reclaim/fence and client-daemon surfaces, schema migrations and streaming handlers → Hardening. The client-daemon surface also requires T9. CRUD-only against existing schema → Smoke. Default → Standard.
 
 Any operation that touches multiple systems or acquires the same resource more than once is **Standard at minimum** and must run T4, even when the endpoint is otherwise CRUD-only.
 
@@ -201,7 +201,7 @@ idempotency, compensation, reconciliation, and failure tests for each residual s
 **Parallelism at scale (≥100 connections) — proves there's no hidden global lock.**
 A single global `Thread.Mutex` keeps every correctness test green while serialising
 every request; this is the regression that proof exists to catch.
-- **≥100 concurrent connections** against real PG + Redis, released together off a
+- **≥100 concurrent connections** against the application's real dependencies, released together off a
   **barrier** so contention is real and reproducible (not staggered by spawn latency).
 - **Correctness invariant (deterministic hard gate):** same row / idempotency key / lease
   under the 100-way race → **exactly one effect**, no lost update.
@@ -393,7 +393,7 @@ Cross-stack failure-injection tools:
 
 Stack-specific must-knows:
 
-- **Zig** — `conn.query()` paired with `.drain()` in the same fn before `deinit()`; verify with the project's drain-audit target. Per-request arena, not per-app. `std.testing.allocator` over the full request lifecycle, not just handler unit, to catch cross-thread leaks. If integration tests share the binary with unit tests, an env var / build flag should gate live-deps mode — assert that gate is set in CI, not assumed. Cross-compile (`x86_64-linux`, `aarch64-linux`) before declaring done.
+- **Zig** — drain every query result before releasing its connection, including early exits. Use wrapper-owned draining where the repository provides it. Review the owner's cleanup path and run any actually declared cleanup check. Use a per-request arena for request ownership. Exercise `std.testing.allocator` over the full request lifecycle to catch cross-thread leaks. If integration tests share the binary with unit tests, assert the live-dependency setting in Continuous Integration (CI). Cross-compile the repository's declared platform matrix before declaring done.
 - **Python** — `pytest-asyncio` event loop scope = `function`, not `session` (avoid leakage). `respx`/`responses` for external HTTP only.
 - **Rust** — `#[sqlx::test]` for per-test schema; `tokio::test(flavor = "multi_thread")` for real concurrency. `loom` for races, not raw threads.
 - **Node** — `--isolate` per test if framework supports; otherwise reset module registry.

package/skills/orly-write-unit-test/SKILL.md

@@ -83,6 +83,15 @@ codebase, and it's the artifact that makes "is the skill applied?" auditable.
 
 ## Three execution modes
 
+**Optional Jev advice:** Before accepting a linked test as proof, describe its
+required behavior in a `verify.assertion` manifest with complete implementation
+and test evidence. Use `orly judge verify --input <manifest>` for exact replay;
+`--refresh` explicitly permits scanned source upload. Use `orly judge --help`
+for the manifest and limits.
+A weak assertion answer suggests an exact-result assertion. Run that assertion
+against correct and controlled incorrect behavior. Jev advice never supplies
+test results, waives missing coverage or changes a deterministic gate.
+
 Pick one. Don't run all categories on every file.
 
 | Mode | When | Required categories |
@@ -275,7 +284,7 @@ When a spec exists with these tables, treat them as authoritative test sources:
 
 | Spec table | Generates |
 |---|---|
-| Test Specification | One test per row, name = `dim X.Y: <name>` |
+| Test Specification | One behavior-named test per row; the spec maps Dimension numbers to test names. Keep planning identifiers out of source test names and filenames. |
 | Error Contracts | One negative test per row asserting exact error |
 | Failure Modes | One integration test per row with deterministic injection |
 | Partial Completion | One row per ordered failure point with workflow-ordinal and boundary-call-ordinal injection plus residual-state assertions |

package/src/cli.test.ts

@@ -32,7 +32,7 @@ describe("orly command", () => {
   });
 
   // Adversarial review found recordOptIn running before the --dry-run branch,
-  // so a preview created .oracle/orly.json — and on an installed repository
+  // so a preview created .orly/orly.json — and on an installed repository
   // permanently added the pack. A dry run changes nothing, opt-in included.
   test("--dry-run records no pack", () => {
     const repo = mkdtempSync(join(tmpdir(), "orly-dry-"));
@@ -44,7 +44,7 @@ describe("orly command", () => {
 
       expect(result.exitCode).toBe(0);
       expect(result.stdout.toString()).toContain("Generated by");
-      expect(existsSync(join(repo, ".oracle/orly.json"))).toBe(false);
+      expect(existsSync(join(repo, ".orly/orly.json"))).toBe(false);
       expect(existsSync(join(repo, "AGENTS.orly.md"))).toBe(false);
     } finally {
       rmSync(repo, { recursive: true, force: true });

package/src/cli.ts

@@ -2,8 +2,11 @@
 import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
 
-import { CONFIG_PATH, localSelection, managedDrift, readConfig, RepoConfig, seedConfig, selectPacks, staleVersion, writeConfig } from "./config";
+import { printHelp } from "./cli_help";
+import { selectPacks } from "./config_discovery";
+import { CONFIG_PATH, managedDrift, readConfig, RepoConfig, staleVersion, writeConfig } from "./config";
 import { GateReport, isGateName, recordOverride, runGate, runGates } from "./gates";
+import { readInstallConfig } from "./installation/migration";
 import { install, InstallResult } from "./install";
 import { isString, OrlyError, readJsonObject, RulesModel } from "./model";
 import { Renderer } from "./render";
@@ -33,9 +36,6 @@ const PR_GATE = "pr";
 const ENGINE_MARKER = "evals/install/run.sh";
 const VERIFY_COMMAND = "verify";
 const SKILL_EVENT_COMMAND = "skill-event";
-const TELEMETRY_CONFIG_KEY = "telemetry";
-const ANONYMOUS_TELEMETRY_CONFIG = JSON.stringify({ [TELEMETRY_CONFIG_KEY]: "anonymous" });
-const OFF_TELEMETRY_CONFIG = JSON.stringify({ [TELEMETRY_CONFIG_KEY]: "off" });
 
 const { root, arguments: commandArguments } = parseRoot(Bun.argv.slice(2));
 const startedAt = performance.now();
@@ -75,6 +75,16 @@ async function run(model: RulesModel, args: string[]): Promise<CliResult> {
   if (command === "init") return cliResult(await materialise(model, rest, true));
   if (command === "update") return cliResult(await materialise(model, rest, false));
   if (command === VERIFY_COMMAND) return cliResult(await verify(model, rest));
+  if (command === "judge") {
+    const { judgmentCommand } = await import("./judgments/command");
+    return cliResult(await judgmentCommand(rest));
+  }
+  if (command === "lifecycle") {
+    if (rest.some((argument) => argument !== JSON_FLAG)) throw new OrlyError("usage: orly lifecycle [--json]");
+    const { lifecyclePlan } = await import("./execution/plan");
+    console.log(JSON.stringify(lifecyclePlan(projectRoot()), undefined, JSON_INDENT));
+    return cliResult(0);
+  }
   if (command === "gate") return gate(model, rest);
   if (command === "override") return cliResult(override(rest));
   if (command === SKILL_EVENT_COMMAND) {
@@ -131,12 +141,12 @@ async function packageVersion(model: RulesModel): Promise<string> {
   return manifest.version;
 }
 
-// Both verbs materialise the same way: the repository's own `.oracle/orly.json`
+// Both verbs materialise the same way: the repository's own `.orly/orly.json`
 // names its packs and commands, so neither asks the caller who this repo is.
 async function materialise(model: RulesModel, args: string[], isInit: boolean): Promise<number> {
   model.validate();
   const targetRoot = projectRoot();
-  const existing = await readConfig(targetRoot);
+  const existing = await readInstallConfig(targetRoot);
   if (!isInit && !existing) throw new OrlyError(`no ${CONFIG_PATH} here — run \`orly init\` first`);
   const requested = optionalValues(args, WITH_FLAG);
   // --dry-run changes nothing, and recording an opt-in pack is a change. It
@@ -146,9 +156,9 @@ async function materialise(model: RulesModel, args: string[], isInit: boolean):
   // Otherwise the pack is a property of the repository, recorded before the
   // render rather than passed through it: the next `orly update` in a
   // teammate's clone selects the same set with no flag to remember.
-  await recordOptIn(model, targetRoot, existing, requested);
   const result = await install(model, {
     targetRoot,
+    requestedPacks: requested,
     force: args.includes(FORCE_FLAG),
     installHooks: !args.includes(NO_HOOKS_FLAG),
     orlyVersion: await packageVersion(model),
@@ -210,7 +220,8 @@ async function doctorInstall(model: RulesModel): Promise<string[]> {
 // What init would write, without writing it. Replaces the `render` verb: the
 // preview belongs on the command you are about to run, not beside it.
 async function preview(model: RulesModel, targetRoot: string, requested: string[] = []): Promise<number> {
-  const local = await localSelection(model, targetRoot);
+  const config = await readInstallConfig(targetRoot);
+  const local = { packs: selectPacks(model, targetRoot, config?.packs ?? [], new Set(config?.managed ?? [])), commands: config?.commands ?? {} };
   // selectPacks validates the requested names and unions them with what the
   // repository's own sources select — the same call the real run makes, minus
   // the write.
@@ -220,20 +231,6 @@ async function preview(model: RulesModel, targetRoot: string, requested: string[
   return 0;
 }
 
-// Opt-in packs never auto-select from file extensions, so naming one is the
-// only way it lands. Validated against the registry here, before anything is
-// recorded, so a typo names the available set instead of writing a config the
-// next command rejects.
-async function recordOptIn(model: RulesModel, targetRoot: string, existing: RepoConfig | undefined, requested: string[]): Promise<void> {
-  if (requested.length === 0) return;
-  const config = existing ?? await seedConfig(targetRoot);
-  const packs = new Set(config.packs);
-  for (const name of requested) packs.add(name);
-  // selectPacks throws OrlyError on an unknown name, listing what is available.
-  selectPacks(model, targetRoot, [...packs]);
-  await writeConfig(targetRoot, { ...config, packs: [...packs].sort() });
-}
-
 async function verify(model: RulesModel, args: string[]): Promise<number> {
   requireEngineCheckout(model, VERIFY_COMMAND);
   const checks = await verifyRenders(model);
@@ -290,56 +287,3 @@ function optionalValues(args: string[], name: string): string[] {
 function cliResult(exitCode: number): CliResult {
   return { exitCode };
 }
-
-function printHelp(): void {
-  console.log(`orly — prove the boundary; carry the rules
-
-Gates (read-only; no PR without every criterion green or a recorded override):
-  orly gate [--accept-dirty]        run work → verify → pr; stop at first red
-  orly gate <work|verify|pr>        run one gate
-      work    does this commit conform? the declared conform command; no git
-              state, so a commit hook's own dirty tree never blocks it
-      verify  does the work hold up? configuration, docs language, and the
-              non-test verify.* set; unfinished Sections may be pushed
-      pr      can this ship? branch, tree, pushed, every spec criterion, and
-              every declared verify.* command
-  orly override <CRITERION> --reason <REASON>
-                                    empty commit with an Orly-Override trailer
-
-Install (the repository is the unit — no checkout of this package required):
-  orly init [--force] [--no-hooks] [--with <PACK>] [--dry-run] [--json]
-                                    materialise rules, gates, hooks, and a
-                                    seeded .oracle/orly.json. A repository that
-                                    already has an AGENTS.md keeps it: orly's
-                                    rules land as AGENTS.orly.md, reached by a
-                                    pointer block in the file you own. One
-                                    import line lands per runtime that needs
-                                    one (CLAUDE.md, opencode.json), so the
-                                    rules load rather than wait to be noticed;
-                                    a loader you wrote yourself is left alone.
-  orly update [--force] [--with <PACK>] [--dry-run] [--json]
-                                    re-materialise at the installed engine version
-
-  --with <PACK>                     record an opt-in pack (repeatable) in
-                                    .oracle/orly.json, so every clone selects it
-  --dry-run                         show what would be written; change nothing
-
-  orly doctor                       check this repository's installed rules
-                                    against what orly would write today
-  orly --version                    the installed package version
-
-Usage telemetry (off by default):
-  Consent file:                     ~/.config/agentsfleet/orly/.orly.json
-  State-root override:              AGENTSFLEET_STATE_DIR
-  Set ${ANONYMOUS_TELEMETRY_CONFIG} to send command, gate, and packaged Orly skill
-  names, outcome, failed criterion, duration, Orly version, operating system, architecture,
-  invocation type, timestamps, and random event, session, and installation IDs.
-  Set ${OFF_TELEMETRY_CONFIG} to write and send nothing.
-  ORLY_TELEMETRY=off|anonymous changes one process; ORLY_TELEMETRY_OFF=1 wins.
-  Orly never collects source, paths, repositories, branches, arguments, prompts,
-  output, environment values, raw errors, or personal and account details.
-
-Ruleset authoring (an orly checkout only — refused from an installed package):
-  orly verify                       the rules render the same twice, and the
-                                    committed copy matches that render`);
-}