@bompus/house-rules 0.11.0 → 0.13.0

package/skills/hr-pr-followup/scripts/check-landing.py

@@ -0,0 +1,204 @@
+#!/usr/bin/env python3
+"""Report whether a checkout's work has landed in the base branch.
+
+Squash-aware: a session branch whose commits were squash-merged is never an
+ancestor of the base, so ancestry alone would cry unlanded forever. The check
+therefore compares content: files unique to the checkout must be identical in
+the base. Read-only; never fetches — the caller fetches first.
+
+It also lists live processes whose working directory is inside the checkout
+(Linux /proc only), excluding the checker's ancestors and its pipeline. Each listed process
+blocks worktree removal unless its PID is one you recorded when you started it. `own_session`
+is true only for a process that descends from the nearest agent CLI above the checker (a
+process whose comm is one of AGENT_COMMS); a process under another session of the same agent
+host's server, or any process when the checker has no agent ancestor, is false. A process
+reparented to init after its parent exited is false too.
+
+Usage:
+    python3 scripts/check-landing.py [--path <checkout>] [--base <ref>]
+    python3 scripts/check-landing.py --path <checkout> --fail-on-unlanded
+
+Without --base the base is origin/HEAD (the remote's default branch, which
+need not be main), falling back to origin/main when origin/HEAD is unset.
+"""
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+
+
+def git(path, *args):
+    return subprocess.run(
+        ["git", *args],
+        cwd=path,
+        capture_output=True,
+        text=True,
+        timeout=60,
+    )
+
+
+def default_base(path):
+    """origin/HEAD's target (e.g. origin/fork/consolidated), else origin/main."""
+    r = git(path, "symbolic-ref", "--quiet", "--short",
+            "refs/remotes/origin/HEAD")
+    return r.stdout.strip() if r.returncode == 0 and r.stdout.strip() \
+        else "origin/main"
+
+
+def _ppid(pid):
+    try:
+        with open(f"/proc/{pid}/stat", encoding="utf-8", errors="replace") as f:
+            return int(f.read().rsplit(")", 1)[1].split()[1])
+    except (OSError, ValueError, IndexError):
+        return 0
+
+
+# comm names of the agent CLIs. "opencode.exe" is matched without its suffix.
+AGENT_COMMS = {"claude", "codex", "cursor-agent", "opencode", "grok", "devin", "agy"}
+
+
+def _comm(pid):
+    try:
+        with open(f"/proc/{pid}/comm", encoding="utf-8", errors="replace") as f:
+            return f.read().strip()
+    except OSError:
+        return ""
+
+
+def _chain(pid):
+    """pid and its parents up to, but excluding, PID 1."""
+    chain = []
+    while pid > 1 and pid not in chain:
+        chain.append(pid)
+        pid = _ppid(pid)
+    return chain
+
+
+def nearest_agent(chain, read_comm=_comm):
+    """First PID in chain whose comm is an agent CLI, else None."""
+    for pid in chain:
+        name = read_comm(pid)
+        if name.endswith(".exe"):
+            name = name[:-4]
+        if name in AGENT_COMMS:
+            return pid
+    return None
+
+
+def checkout_processes(path):
+    """Processes whose cwd is inside path, or None without /proc."""
+    if not os.path.isdir("/proc/self"):
+        return None
+    root = os.path.realpath(path)
+    mine = _chain(os.getpid())
+    ancestors = set(mine)
+    agent = nearest_agent(mine)
+    own_group = os.getpgid(0)
+    found = []
+    for entry in os.listdir("/proc"):
+        if not entry.isdigit() or int(entry) in ancestors:
+            continue
+        try:
+            if os.getpgid(int(entry)) == own_group:
+                continue
+            cwd = os.readlink(f"/proc/{entry}/cwd")
+            with open(f"/proc/{entry}/comm", encoding="utf-8", errors="replace") as f:
+                comm = f.read().strip()
+        except (OSError, ProcessLookupError):
+            continue
+        if cwd != root and not cwd.startswith(root + os.sep):
+            continue
+        own = agent is not None and agent in _chain(int(entry))
+        found.append({"pid": int(entry), "own_session": own,
+                      "comm": comm})
+    return found
+
+
+def landing_state(path, base):
+    """Return a JSON-serializable report dict for the checkout at path."""
+    report = {"path": str(path), "base": base, "ok": False, "reason": ""}
+    r = git(path, "rev-parse", "--verify", "--quiet", base)
+    if r.returncode != 0:
+        report["reason"] = f"base ref missing: {base}"
+        return report
+    report["base_head"] = r.stdout.strip()
+    r = git(path, "rev-parse", "HEAD")
+    if r.returncode != 0:
+        report["reason"] = "not a git checkout (no HEAD)"
+        return report
+    report["head"] = r.stdout.strip()
+    r = git(path, "symbolic-ref", "--quiet", "--short", "HEAD")
+    report["branch"] = r.stdout.strip() if r.returncode == 0 else None
+    r = git(path, "status", "--porcelain")
+    if r.returncode != 0:
+        report["reason"] = "git status failed"
+        return report
+    report["clean"] = r.stdout.strip() == ""
+    report["processes"] = checkout_processes(path)
+    r = git(path, "merge-base", "--is-ancestor", "HEAD", base)
+    report["ancestor"] = r.returncode == 0
+    if report["ancestor"]:
+        report["content_landed"] = True
+    else:
+        r = git(path, "merge-base", base, "HEAD")
+        if r.returncode != 0:
+            report["reason"] = "no merge base with base ref"
+            return report
+        mb = r.stdout.strip()
+        r = git(path, "diff", "--name-only", "--no-renames", "-z", mb, "HEAD")
+        if r.returncode != 0:
+            report["reason"] = "git diff failed"
+            return report
+        files = [f for f in r.stdout.split("\0") if f]
+        report["unique_files"] = len(files)
+        if not files:
+            report["content_landed"] = True
+        else:
+            r = git(path, "diff", "--quiet", "HEAD", base, "--", *files)
+            report["content_landed"] = r.returncode == 0
+            report["indeterminate"] = False
+            if not report["content_landed"]:
+                # Base may have advanced on the same files after the merge
+                # base: then a diff is expected even for landed content.
+                r = git(path, "diff", "--name-only", "--no-renames", "-z", mb, base,
+                         "--", *files)
+                if r.returncode == 0 and any(
+                        f for f in r.stdout.split("\0") if f):
+                    report["indeterminate"] = True
+    landed = bool(report["content_landed"])
+    if landed and report["clean"]:
+        report["ok"] = True
+        report["reason"] = "landed and clean"
+    elif landed:
+        report["reason"] = "content landed but tree is dirty"
+    elif report.get("indeterminate"):
+        report["reason"] = ("indeterminate - base advanced on touched "
+                            "files, confirm PR")
+    else:
+        report["reason"] = "unlanded content vs base"
+    return report
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--path", default=".", help="checkout to inspect")
+    ap.add_argument(
+        "--base", help="base ref (default: origin/HEAD, else origin/main)"
+    )
+    ap.add_argument(
+        "--fail-on-unlanded",
+        action="store_true",
+        help="exit 1 unless the checkout is clean and landed",
+    )
+    args = ap.parse_args(argv)
+    report = landing_state(args.path, args.base or default_base(args.path))
+    print(json.dumps(report, indent=2))
+    if args.fail_on_unlanded and not report["ok"]:
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/hr-pr-followup/scripts/merge-pr.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Squash-merge a pull request (or, with --merge, merge-commit it), delete its remote head, and verify the landing, without gh's
+# --delete-branch. Since gh 2.98 that flag runs `git worktree remove` on any linked worktree that
+# has the head branch checked out, another session's included when it is clean, and switches the
+# current checkout to the base when the head is checked out here. This script never removes a
+# worktree or local branch: it lists the worktrees still on the head so their owners clean up.
+#
+# Refuses a PR that is not open, one with open review feedback (check-pr-review.ts: an unresolved
+# thread, a review bot still running, unanswered findings in a bot's review body), or one another
+# open PR targets (deleting the head would close that PR; retarget it first with
+# `gh pr edit <n> --base <base>`). The merge passes
+# --match-head-commit, so a push after the head was read fails the merge instead of landing it.
+#
+# Refuses, after those checks, a repository listed in HR_PUSH_LANDED (space-separated owner/repo names;
+# empty by default): its own guidance lands by fast-forwarding the base to the head, because a GitHub
+# merge writes the account's profile name into public history. It prints that push instead.
+#
+# Before merging, verifies that the local default can be synchronized, even if it is current.
+# Refuses a dirty/diverged target or a default held in another checkout without --idle-primary.
+# After merging, fast-forwards the confirmed local default and fails if it is still stale.
+# To update the primary checkout from a task worktree, pass --idle-primary <path>
+# using existing ownership evidence or the operator's standing idle direction, unless current
+# evidence contradicts it; keep it idle through landing.
+# If verification
+# fails after "merged", rerun verify-landed.sh with the printed commit, not this script.
+#
+# --merge lands with a merge commit instead of a squash. Use it only for a PR whose second parent
+# must stay in history, such as an `-s ours` merge that records an upstream reconcile; a squash
+# would drop that parent. Every other PR is squashed.
+#
+# Usage: bash scripts/merge-pr.sh <pr> [--merge] [--remote <name>] [--idle-primary <path>]
+set -euo pipefail
+
+PUSH_LANDED=" ${HR_PUSH_LANDED:-} "
+
+PR="${1:?usage: merge-pr.sh <pr> [--merge] [--remote <name>] [--idle-primary <path>]}"
+shift
+REMOTE=origin
+STRATEGY=--squash
+SYNC_ARGS=(--ff)
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --merge) STRATEGY=--merge; shift;;
+    --remote) REMOTE="${2:?}"; shift 2;;
+    --idle-primary) SYNC_ARGS+=(--idle-primary "${2:?}"); shift 2;;
+    *) echo "unknown argument: $1" >&2; exit 2;;
+  esac
+done
+
+IFS=$'\t' read -r HEAD OID BASE STATE FORK < <(gh pr view "$PR" \
+  --json headRefName,headRefOid,baseRefName,state,isCrossRepository \
+  --jq '[.headRefName, .headRefOid, .baseRefName, .state, .isCrossRepository] | @tsv')
+[ "$STATE" = OPEN ] || { echo "PR $PR is $STATE, not OPEN" >&2; exit 1; }
+
+DEPENDENTS="$(gh pr list --state open --base "$HEAD" --json number --jq '.[].number' | tr '\n' ' ')"
+if [ -n "${DEPENDENTS// /}" ]; then
+  echo "open PRs target $HEAD: ${DEPENDENTS% }; retarget them first: gh pr edit <n> --base $BASE" >&2
+  exit 1
+fi
+
+bun "$(dirname "${BASH_SOURCE[0]}")/check-pr-review.ts" "$PR"
+
+REPO="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"
+if [[ "$PUSH_LANDED" == *" $REPO "* ]]; then
+  echo "$REPO lands by fast-forward push, not a GitHub merge (see its AGENTS.md). Run:" >&2
+  echo "  git push $REMOTE $HEAD:$BASE && git push $REMOTE --delete $HEAD" >&2
+  exit 1
+fi
+
+bash "$(dirname "${BASH_SOURCE[0]}")/verify-landed.sh" --preflight \
+  --default "$BASE" --remote "$REMOTE" "${SYNC_ARGS[@]}"
+
+gh pr merge "$PR" "$STRATEGY" --match-head-commit "$OID"
+SHA="$(gh pr view "$PR" --json mergeCommit --jq '.mergeCommit.oid // empty')"
+if ! [[ "$SHA" =~ ^([0-9a-f]{40}|[0-9a-f]{64})$ ]]; then
+  echo "PR $PR has no merge commit yet (a merge queue may still hold it); leaving its head branch alone" >&2
+  exit 1
+fi
+echo "merged: PR $PR as $SHA"
+
+# A fork's head lives in another repository; a repository may also delete merged heads itself.
+# Delete only a branch that still sits at the pull request's head commit, so a same-named branch on
+# an unrelated remote survives.
+if [ "$FORK" != true ]; then
+  REMOTE_HEAD="$(git ls-remote --heads "$REMOTE" "refs/heads/$HEAD" | awk '{print $1}')"
+  if [ "$REMOTE_HEAD" = "$OID" ]; then
+    git push --quiet --force-with-lease="refs/heads/$HEAD:$OID" "$REMOTE" --delete "$HEAD"
+    echo "deleted: $REMOTE/$HEAD"
+  elif [ -n "$REMOTE_HEAD" ]; then
+    echo "kept: $REMOTE/$HEAD is at $REMOTE_HEAD, not the pull request head $OID" >&2
+  fi
+fi
+
+bash "$(dirname "${BASH_SOURCE[0]}")/verify-landed.sh" --commit "$SHA" --branch "$HEAD" \
+  --default "$BASE" --remote "$REMOTE" "${SYNC_ARGS[@]}"
+
+git worktree list --porcelain | awk -v want="branch refs/heads/$HEAD" '
+  /^worktree / { path = substr($0, 10) }
+  $0 == want { print "still on " substr(want, 19) ": " path " (its owner retires it)" }
+'

package/skills/hr-pr-followup/scripts/verify-landed.sh

@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# Post-merge landing checks: containment, local-default state, leftover remote branches.
+# Fetches and verifies both remote containment and local-default equality. A stale local default
+# fails even when the remote contains the commit. Never resets, switches or deletes.
+# With --ff it updates a default checked out nowhere or here with a clean tree.
+# --idle-primary <path> additionally permits a fast-forward of this repository's primary checkout:
+# use existing ownership evidence or the operator's standing idle direction, unless current
+# evidence contradicts it. Git preserves
+# unrelated local edits and refuses a fast-forward that would overwrite them. It moves the
+# primary to the verified remote commit with `merge --ff-only <sha>` rather than `pull`, because
+# `pull` re-fetches into the shared FETCH_HEAD, which a concurrent fetch in the same checkout can
+# overwrite ("Cannot fast-forward to multiple branches"). Other linked worktrees
+# remain their owners' responsibility. After a blocked post-merge check, rerun this script,
+# not merge-pr.sh: the PR is already merged.
+# --preflight checks synchronization eligibility before landing, without moving local branches.
+# It requires --ff and rejects dirty or diverged targets and unconfirmed checkout ownership,
+# even when the local default is current. The caller must keep the target idle until landing
+# finishes; this check cannot establish session ownership or prevent another process starting.
+# Usage:
+#   bash scripts/verify-landed.sh --commit <sha> [--default <branch>]
+#     [--branch <merged-head>] [--remote <name>] [--ff [--idle-primary <path>]]
+#   bash scripts/verify-landed.sh --preflight --ff [--default <branch>]
+#     [--remote <name>] [--idle-primary <path>]
+set -euo pipefail
+
+REMOTE=origin
+DEFAULT=""
+COMMIT=""
+BRANCH=""
+FF=0
+IDLE_PRIMARY=""
+PREFLIGHT=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --commit) COMMIT="${2:?}"; shift 2;;
+    --default) DEFAULT="${2:?}"; shift 2;;
+    --branch) BRANCH="${2:?}"; shift 2;;
+    --remote) REMOTE="${2:?}"; shift 2;;
+    --ff) FF=1; shift;;
+    --idle-primary) IDLE_PRIMARY="${2:?}"; shift 2;;
+    --preflight) PREFLIGHT=1; shift;;
+    *) echo "unknown argument: $1" >&2; exit 2;;
+  esac
+done
+if [ "$PREFLIGHT" = 1 ]; then
+  [ "$FF" = 1 ] && [ -z "$COMMIT$BRANCH" ] \
+    || { echo "--preflight requires --ff and excludes --commit/--branch" >&2; exit 2; }
+else
+  [ -n "$COMMIT" ] || { echo "missing --commit <sha>" >&2; exit 2; }
+fi
+if [ -n "$IDLE_PRIMARY" ]; then
+  [ "$FF" = 1 ] || { echo "--idle-primary requires --ff" >&2; exit 2; }
+  PRIMARY="$(git worktree list --porcelain | sed -n '1s/^worktree //p')"
+  IDLE_PRIMARY="$(git -C "$IDLE_PRIMARY" rev-parse --show-toplevel)"
+  [ "$IDLE_PRIMARY" = "$PRIMARY" ] \
+    || { echo "--idle-primary is not this repository's primary checkout: $IDLE_PRIMARY" >&2; exit 2; }
+fi
+
+if [ -z "$DEFAULT" ]; then
+  # The remote's own answer wins; the cached origin/HEAD goes stale when the default branch changes.
+  DEFAULT="$(git ls-remote --symref "$REMOTE" HEAD 2>/dev/null | sed -n 's#^ref: refs/heads/\([^[:space:]]*\).*#\1#p' || true)"
+  if [ -z "$DEFAULT" ]; then
+    DEFAULT="$(git symbolic-ref "refs/remotes/$REMOTE/HEAD" 2>/dev/null | sed "s#^refs/remotes/$REMOTE/##" || true)"
+  fi
+  [ -n "$DEFAULT" ] || { echo "cannot resolve remote default branch; pass --default" >&2; exit 2; }
+fi
+
+git fetch "$REMOTE" "+refs/heads/$DEFAULT:refs/remotes/$REMOTE/$DEFAULT" >/dev/null 2>&1 \
+  || { echo "fetch failed: $REMOTE $DEFAULT" >&2; exit 1; }
+
+WTLS="$(git worktree list --porcelain)"
+HOLDER="$(printf '%s\n' "$WTLS" | awk -v want="branch refs/heads/$DEFAULT" '
+  /^worktree / { path = substr($0, 10) }
+  $0 == want { print path; exit }
+')"
+HERE="$(git rev-parse --show-toplevel)"
+
+if [ "$PREFLIGHT" = 1 ]; then
+  # A rebase or bisect detaches HEAD while still reserving its original branch.
+  if [ -z "$HOLDER" ]; then
+    while IFS= read -r RECORD; do
+      case "$RECORD" in worktree\ *) CHECKOUT="${RECORD#worktree }";; *) continue;; esac
+      [ -d "$CHECKOUT" ] || continue
+      for ASSOCIATION in rebase-merge/head-name rebase-apply/head-name BISECT_START; do
+        ASSOCIATION_PATH="$(git -C "$CHECKOUT" rev-parse --path-format=absolute --git-path "$ASSOCIATION")"
+        if [ -f "$ASSOCIATION_PATH" ]; then
+          IFS= read -r ASSOCIATED_BRANCH < "$ASSOCIATION_PATH"
+          if [ "$ASSOCIATED_BRANCH" = "refs/heads/$DEFAULT" ] || [ "$ASSOCIATED_BRANCH" = "$DEFAULT" ]; then
+            HOLDER="$CHECKOUT"
+            break 2
+          fi
+        fi
+      done
+    done <<< "$WTLS"
+  fi
+  if [ -n "$HOLDER" ]; then
+    if [ "$HOLDER" != "$HERE" ] && [ "$HOLDER" != "$IDLE_PRIMARY" ]; then
+      echo "sync blocked at $HOLDER: that checkout has the default branch. If nothing is using it, rerun with --idle-primary <primary-path>" >&2
+      exit 1
+    fi
+    STATUS="$(git -C "$HOLDER" status --porcelain)" \
+      || { echo "sync blocked at $HOLDER: cannot inspect working tree" >&2; exit 1; }
+    [ -z "$STATUS" ] \
+      || { echo "sync blocked at $HOLDER: working tree dirty; leave it for its owner" >&2; exit 1; }
+    for OPERATION in MERGE_HEAD CHERRY_PICK_HEAD REVERT_HEAD rebase-merge rebase-apply sequencer BISECT_START; do
+      OPERATION_PATH="$(git -C "$HOLDER" rev-parse --path-format=absolute --git-path "$OPERATION")"
+      [ ! -e "$OPERATION_PATH" ] \
+        || { echo "sync blocked at $HOLDER: unfinished Git operation: $OPERATION" >&2; exit 1; }
+    done
+  fi
+  if git show-ref --verify --quiet "refs/heads/$DEFAULT"; then
+    git merge-base --is-ancestor "$DEFAULT" "$REMOTE/$DEFAULT" \
+      || { echo "sync blocked: $DEFAULT cannot fast-forward to $REMOTE/$DEFAULT" >&2; exit 1; }
+  fi
+  echo "synchronization preflight passed: $DEFAULT (${HOLDER:-not checked out})"
+  exit 0
+fi
+
+FAIL=0
+
+if git merge-base --is-ancestor "$COMMIT" "$REMOTE/$DEFAULT" 2>/dev/null; then
+  echo "contained: $COMMIT in $REMOTE/$DEFAULT"
+else
+  echo "NOT CONTAINED: $COMMIT missing from $REMOTE/$DEFAULT" >&2
+  FAIL=1
+fi
+
+if git show-ref --verify --quiet "refs/heads/$DEFAULT"; then
+  LOCAL="$(git rev-parse "$DEFAULT")"
+  UPSTREAM="$(git rev-parse "$REMOTE/$DEFAULT")"
+  if [ "$LOCAL" = "$UPSTREAM" ]; then
+    echo "local $DEFAULT: current ($LOCAL)"
+  elif git merge-base --is-ancestor "$LOCAL" "$UPSTREAM" 2>/dev/null; then
+    BEHIND="$(git rev-list --count "$LOCAL..$UPSTREAM")"
+    if [ -z "${HOLDER:-}" ]; then
+      if [ "$FF" = 1 ] && [ "$FAIL" = 0 ]; then
+        git update-ref -m "verify-landed: fast-forward $DEFAULT" "refs/heads/$DEFAULT" "$UPSTREAM" "$LOCAL"
+        echo "local $DEFAULT: fast-forwarded $BEHIND commit(s) to $UPSTREAM (not checked out anywhere)"
+      else
+        echo "local $DEFAULT: $BEHIND behind, not checked out anywhere — safe: git fetch $REMOTE $DEFAULT:$DEFAULT"
+      fi
+    elif [ "$HOLDER" != "$HERE" ]; then
+      if [ "$FF" = 1 ] && [ "$FAIL" = 0 ] && [ "$HOLDER" = "$IDLE_PRIMARY" ]; then
+        [ "$(git -C "$HOLDER" symbolic-ref --quiet --short HEAD)" = "$DEFAULT" ] \
+          || { echo "primary checkout changed branches; refusing update" >&2; exit 1; }
+        git -C "$HOLDER" merge --quiet --ff-only "$UPSTREAM"
+        echo "local $DEFAULT: fast-forwarded $BEHIND commit(s) in confirmed idle primary $HOLDER"
+      else
+        echo "local $DEFAULT: $BEHIND behind, checked out at $HOLDER (not here) — leave for its owner; if you know it is idle: git -C $HOLDER merge --ff-only $UPSTREAM"
+        echo "If nothing is using that checkout, rerun verify-landed.sh with --ff --idle-primary <primary-path>." >&2
+      fi
+    elif [ -n "$(git status --porcelain)" ]; then
+      echo "local $DEFAULT: $BEHIND behind but working tree dirty — report, do not touch"
+    elif [ "$FF" = 1 ] && [ "$FAIL" = 0 ]; then
+      git merge --quiet --ff-only "$UPSTREAM"
+      echo "local $DEFAULT: fast-forwarded $BEHIND commit(s) to $UPSTREAM (checked out here)"
+    else
+      echo "local $DEFAULT: $BEHIND behind, clean, checked out here — safe to fast-forward"
+    fi
+  else
+    echo "local $DEFAULT: diverged from $REMOTE/$DEFAULT — report, do not touch"
+  fi
+  if [ "$(git rev-parse "$DEFAULT")" != "$(git rev-parse "$REMOTE/$DEFAULT")" ]; then
+    echo "LOCAL DEFAULT NOT CURRENT: $DEFAULT differs from $REMOTE/$DEFAULT; landing incomplete" >&2
+    FAIL=1
+  fi
+else
+  echo "local $DEFAULT: no local branch (nothing to update)"
+fi
+
+if [ -n "$BRANCH" ]; then
+  if ! REMOTE_REFS="$(git ls-remote --heads "$REMOTE" "$BRANCH" 2>/dev/null)"; then
+    echo "remote branch lookup failed: $REMOTE $BRANCH" >&2
+    FAIL=1
+  elif [ -n "$REMOTE_REFS" ]; then
+    echo "leftover branch: $REMOTE/$BRANCH still exists after merge" >&2
+    FAIL=1
+  else
+    echo "no leftover branch: $REMOTE/$BRANCH gone"
+  fi
+fi
+
+exit "$FAIL"

package/skills/hr-read-reddit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: hr-read-reddit
-description: Read Reddit threads (post plus comments) and search subreddits in full text, with links kept inline. Use whenever a task needs Reddit content or needs to collect links posted on Reddit; generic web fetch and reddit.com JSON are blocked for agents.
+description: Read Reddit posts and comments from Reddit's public feeds (output can omit comments) and search subreddits, with links kept inline. Use whenever a task needs Reddit content or needs to collect links posted on Reddit; generic web fetch and reddit.com JSON are blocked for agents. Reddit's RSS support ends November 13, 2026; a partial search fallback remains.
 ---
 
 # Read Reddit

package/skills/hr-research-shared-links/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: hr-research-shared-links
+description: "Research a shared link or repo in depth, compare it with the user's setup and rate each idea. Use when a session opens with a link or asks for thoughts or what to borrow. Not for factual lookups, and not for implementing or fixing things the link describes."
+---
+
+# Research shared links
+
+A shared link asks "is this worth anything to us?", not "what does it say?".
+The failure to avoid is a first answer built from the page that was shared,
+so the user has to ask again to "look closer", "compare it to ours" or "find
+the hidden gems". Do that work the first time.
+
+## Before reading
+
+1. If the link looks unrelated to the session's work or carries stray
+   characters, say what you think it is and confirm before a long analysis.
+2. For several links, give each its own verdict and add one synthesis.
+3. Tell the user in one line what you will do: read the primary source, compare
+   with their setup, rate each idea.
+
+## Read the source, not the pointer
+
+1. Use the reader for the site when one is available (X posts, Reddit threads);
+   generic fetch truncates them.
+2. Follow an article, post or video to what it is about: the repository, paper,
+   docs or data. The shared page is a claim; the source is the evidence.
+3. For a repository, read past the README: agent guidance files, skills, docs,
+   tests and the code behind any headline feature. These hold the transferable
+   ideas. Search its open issues and security disclosures for the shared claim
+   and for each idea you may recommend, check every hit against the current
+   code, and read the latest release notes. Record the terms you searched. The
+   README says what the maintainer wants to be true; the tracker shows what
+   users and reviewers found, and a fix may already have landed.
+4. Say what you did not read: videos, images, earlier posts in a thread,
+   private or login-gated pages, source behind a README claim. Do not rate what
+   you did not see.
+5. Check headline claims against the project's own data. Recompute a cost or
+   speed figure, compare the README with the results file, and name each claim
+   that has no evidence behind it.
+6. A license does not stop you borrowing an idea. If it bars an AI from reading
+   the material, flag that and offer another reader.
+
+## Compare with what the user has
+
+1. Search their rules, skills, docs and settings for the same idea before judging
+   it. "We lack this" needs a search showing the gap; "we have this" needs the
+   path.
+2. Search the earlier sessions and decisions you can reach for standing
+   constraints and options already rejected. Name any records you could not
+   reach, and do not read their absence as "never decided". Do not recommend
+   what was ruled out without saying so and saying what changed.
+3. State exactly what the comparison ran against: which fork or version of ours,
+   which release of theirs, the competitor's real name.
+
+## Rate each idea
+
+Give each idea one row: source path, the technique in one to three lines, what it
+would change here and what that is worth (faster, cheaper, safer, clearer),
+the evidence on both sides (their file and line, our search), and a verdict.
+
+- **Adopt**: clear gain, fits a stated need, small to carry.
+- **Consider**: real idea, unproven here or costly. Say what would settle it.
+- **Skip**: already covered, ruled out, or tied to the vendor's model or product.
+
+Separate the idea that transfers from the vendor and model details around it.
+Weigh build against buy against borrow: a maintained tool that is good enough
+beats building, and an idea is often worth taking without the tool. List the
+ideas you dropped and why, so the recommended set and the table agree.
+
+## Route what is worth keeping
+
+1. Name the layer that owns each kept idea: shared portable rules, host or
+   machine setup, one project, or a portfolio-level record. Use the user's own
+   ownership map when they have one.
+2. A deferred idea gets the condition that reopens it and a proposed home in
+   the owning repository; offer to save it there rather than leaving it only in
+   this reply.
+3. If an idea means adopting something vendored, offer to record where it came
+   from so upstream changes are noticed. If evaluating it exposed an upstream
+   bug, offer to file it.
+4. Wording adopted into rules describes behavior and carries no "borrowed from"
+   history. Provenance belongs in the research record.
+
+## Answer
+
+1. Lead with a table, one row per link or repository: what it is, its status in
+   the user's setup (have, partly, missing, ruled out) with the evidence, and the
+   verdict.
+2. Then the ranked ideas, then what is not worth borrowing and why.
+3. Explain jargon in plain words or a small diagram. Before changing anything
+   from this research, show the exact before and after wording or real sample
+   output.
+4. End with offers under the user's offer rules. Candidates: write a research
+   note; test it against what they use on quality, speed or cost (give the
+   expected wall-clock time and check host load first); get independent opinions
+   from other models or a review panel, with a brief that includes your findings
+   and the candidates you rejected, choosing the reviewers yourself; build or
+   adopt one idea, saying which steps that option includes (file changes,
+   installing the tool, a pull request, landing) and which it leaves for a later
+   offer; stop here.
+
+"Tell me more" and "thoughts?" authorize research and nothing else. Changing
+files, installing the tool or opening a pull request needs the user's selection.