@bompus/house-rules 0.11.0 → 0.14.0

package/skills/hr-pr-followup/scripts/check-landing.py

@@ -0,0 +1,204 @@
+#!/usr/bin/env python3
+"""Report whether a checkout's work has landed in the base branch.
+
+Squash-aware: a session branch whose commits were squash-merged is never an
+ancestor of the base, so ancestry alone would cry unlanded forever. The check
+therefore compares content: files unique to the checkout must be identical in
+the base. Read-only; never fetches — the caller fetches first.
+
+It also lists live processes whose working directory is inside the checkout
+(Linux /proc only), excluding the checker's ancestors and its pipeline. Each listed process
+blocks worktree removal unless its PID is one you recorded when you started it. `own_session`
+is true only for a process that descends from the nearest agent CLI above the checker (a
+process whose comm is one of AGENT_COMMS); a process under another session of the same agent
+host's server, or any process when the checker has no agent ancestor, is false. A process
+reparented to init after its parent exited is false too.
+
+Usage:
+    python3 scripts/check-landing.py [--path <checkout>] [--base <ref>]
+    python3 scripts/check-landing.py --path <checkout> --fail-on-unlanded
+
+Without --base the base is origin/HEAD (the remote's default branch, which
+need not be main), falling back to origin/main when origin/HEAD is unset.
+"""
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+
+
+def git(path, *args):
+    return subprocess.run(
+        ["git", *args],
+        cwd=path,
+        capture_output=True,
+        text=True,
+        timeout=60,
+    )
+
+
+def default_base(path):
+    """origin/HEAD's target (e.g. origin/fork/consolidated), else origin/main."""
+    r = git(path, "symbolic-ref", "--quiet", "--short",
+            "refs/remotes/origin/HEAD")
+    return r.stdout.strip() if r.returncode == 0 and r.stdout.strip() \
+        else "origin/main"
+
+
+def _ppid(pid):
+    try:
+        with open(f"/proc/{pid}/stat", encoding="utf-8", errors="replace") as f:
+            return int(f.read().rsplit(")", 1)[1].split()[1])
+    except (OSError, ValueError, IndexError):
+        return 0
+
+
+# comm names of the agent CLIs. "opencode.exe" is matched without its suffix.
+AGENT_COMMS = {"claude", "codex", "cursor-agent", "opencode", "grok", "devin", "agy"}
+
+
+def _comm(pid):
+    try:
+        with open(f"/proc/{pid}/comm", encoding="utf-8", errors="replace") as f:
+            return f.read().strip()
+    except OSError:
+        return ""
+
+
+def _chain(pid):
+    """pid and its parents up to, but excluding, PID 1."""
+    chain = []
+    while pid > 1 and pid not in chain:
+        chain.append(pid)
+        pid = _ppid(pid)
+    return chain
+
+
+def nearest_agent(chain, read_comm=_comm):
+    """First PID in chain whose comm is an agent CLI, else None."""
+    for pid in chain:
+        name = read_comm(pid)
+        if name.endswith(".exe"):
+            name = name[:-4]
+        if name in AGENT_COMMS:
+            return pid
+    return None
+
+
+def checkout_processes(path):
+    """Processes whose cwd is inside path, or None without /proc."""
+    if not os.path.isdir("/proc/self"):
+        return None
+    root = os.path.realpath(path)
+    mine = _chain(os.getpid())
+    ancestors = set(mine)
+    agent = nearest_agent(mine)
+    own_group = os.getpgid(0)
+    found = []
+    for entry in os.listdir("/proc"):
+        if not entry.isdigit() or int(entry) in ancestors:
+            continue
+        try:
+            if os.getpgid(int(entry)) == own_group:
+                continue
+            cwd = os.readlink(f"/proc/{entry}/cwd")
+            with open(f"/proc/{entry}/comm", encoding="utf-8", errors="replace") as f:
+                comm = f.read().strip()
+        except (OSError, ProcessLookupError):
+            continue
+        if cwd != root and not cwd.startswith(root + os.sep):
+            continue
+        own = agent is not None and agent in _chain(int(entry))
+        found.append({"pid": int(entry), "own_session": own,
+                      "comm": comm})
+    return found
+
+
+def landing_state(path, base):
+    """Return a JSON-serializable report dict for the checkout at path."""
+    report = {"path": str(path), "base": base, "ok": False, "reason": ""}
+    r = git(path, "rev-parse", "--verify", "--quiet", base)
+    if r.returncode != 0:
+        report["reason"] = f"base ref missing: {base}"
+        return report
+    report["base_head"] = r.stdout.strip()
+    r = git(path, "rev-parse", "HEAD")
+    if r.returncode != 0:
+        report["reason"] = "not a git checkout (no HEAD)"
+        return report
+    report["head"] = r.stdout.strip()
+    r = git(path, "symbolic-ref", "--quiet", "--short", "HEAD")
+    report["branch"] = r.stdout.strip() if r.returncode == 0 else None
+    r = git(path, "status", "--porcelain")
+    if r.returncode != 0:
+        report["reason"] = "git status failed"
+        return report
+    report["clean"] = r.stdout.strip() == ""
+    report["processes"] = checkout_processes(path)
+    r = git(path, "merge-base", "--is-ancestor", "HEAD", base)
+    report["ancestor"] = r.returncode == 0
+    if report["ancestor"]:
+        report["content_landed"] = True
+    else:
+        r = git(path, "merge-base", base, "HEAD")
+        if r.returncode != 0:
+            report["reason"] = "no merge base with base ref"
+            return report
+        mb = r.stdout.strip()
+        r = git(path, "diff", "--name-only", "--no-renames", "-z", mb, "HEAD")
+        if r.returncode != 0:
+            report["reason"] = "git diff failed"
+            return report
+        files = [f for f in r.stdout.split("\0") if f]
+        report["unique_files"] = len(files)
+        if not files:
+            report["content_landed"] = True
+        else:
+            r = git(path, "diff", "--quiet", "HEAD", base, "--", *files)
+            report["content_landed"] = r.returncode == 0
+            report["indeterminate"] = False
+            if not report["content_landed"]:
+                # Base may have advanced on the same files after the merge
+                # base: then a diff is expected even for landed content.
+                r = git(path, "diff", "--name-only", "--no-renames", "-z", mb, base,
+                         "--", *files)
+                if r.returncode == 0 and any(
+                        f for f in r.stdout.split("\0") if f):
+                    report["indeterminate"] = True
+    landed = bool(report["content_landed"])
+    if landed and report["clean"]:
+        report["ok"] = True
+        report["reason"] = "landed and clean"
+    elif landed:
+        report["reason"] = "content landed but tree is dirty"
+    elif report.get("indeterminate"):
+        report["reason"] = ("indeterminate - base advanced on touched "
+                            "files, confirm PR")
+    else:
+        report["reason"] = "unlanded content vs base"
+    return report
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--path", default=".", help="checkout to inspect")
+    ap.add_argument(
+        "--base", help="base ref (default: origin/HEAD, else origin/main)"
+    )
+    ap.add_argument(
+        "--fail-on-unlanded",
+        action="store_true",
+        help="exit 1 unless the checkout is clean and landed",
+    )
+    args = ap.parse_args(argv)
+    report = landing_state(args.path, args.base or default_base(args.path))
+    print(json.dumps(report, indent=2))
+    if args.fail_on_unlanded and not report["ok"]:
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/hr-pr-followup/scripts/check-pr-review.ts

@@ -1,16 +1,22 @@
 #!/usr/bin/env bun
 // Refuses to land a pull request while review feedback is open: an unresolved review thread, a
-// review bot (CodeRabbit) whose check is still running, or a bot review whose body carries findings
+// review bot (CodeRabbit or cubic) whose check is still running, or a bot review whose body carries findings
 // GitHub cannot show as threads ("Outside diff range comments", "Nitpick comments", "Duplicate comments") with no human
 // explicit acknowledgement for that review and the current head. Run only when the repository
 // selects this gate. It also refuses when CodeRabbit's status on the
 // head commit says anything but "Review completed": CodeRabbit marks a skipped review (for example
 // on a non-default base) as success with "Review skipped: …". When the head commit has
-// `.coderabbit.yaml` but no CodeRabbit check, it refuses too. Missing or incomplete reviews
+// `.coderabbit.yaml` but no CodeRabbit check, it refuses too. A cubic check ("cubic · AI code
+// reviewer") on the head commit must also complete with SUCCESS: a running one refuses, and so does
+// any other conclusion, NEUTRAL and skipped included, because NEUTRAL means cubic did not review the
+// head ("Incremental review could not start", "AI review line limit reached"). That PR stays blocked
+// until someone comments `@cubic review` or the limit clears. A head commit with no cubic check is
+// not blocked, since cubic's `cubic.yaml` is optional and its absence does not show that cubic
+// is expected, and --wait does not wait for one to appear. Missing or incomplete reviews
 // require inspection of the review integration and the repository's selected review policy.
 //   bun scripts/check-pr-review.ts <pr> [--repo <owner>/<name>] [--wait [--timeout <minutes>]]
 // Exit 1 while feedback is open, 2 when gh fails. Without --repo, gh resolves the repository from
-// the current checkout. --wait polls every 30 s while CodeRabbit's review is still running, and for
+// the current checkout. --wait polls every 30 s while CodeRabbit's or cubic's review is still running, and for
 // up to 3 minutes while the head commit has no CodeRabbit check yet (CodeRabbit posts it a little
 // after a push), then reports as usual; after --timeout minutes (default 30) it reports what is
 // still open.
@@ -30,13 +36,17 @@
 import { spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
 
-const REVIEW_BOTS = /coderabbit/i;
+const CODERABBIT = /coderabbit/i;
+const CUBIC = /^cubic · AI code reviewer$/i;
+const isReviewBot = (name: string) => CODERABBIT.test(name) || CUBIC.test(name);
 const REVIEW_BOT_CONFIG = ".coderabbit.yaml";
 const BODY_FINDINGS = /Outside diff range comments|Nitpick comments|Duplicate comments/;
 const REVIEWED = /^Review completed/;
 const FOLLOW_UP = "check the review integration and repository review policy";
 const RUNNING = "review still running: ";
 const NO_CHECK = "no CodeRabbit check on the head commit";
+// A neutral cubic result means it did not review the head; a person has to ask again.
+const CUBIC_RETRY = "comment `@cubic review` or wait for its limit to clear";
 const POLL_MS = 30_000;
 const NO_CHECK_GRACE_MS = 180_000;
 
@@ -364,25 +374,26 @@ export function openFeedback(pr: ReviewState): string[] {
   const head = pr.commits.nodes[0]?.commit;
   const contexts = head?.statusCheckRollup?.contexts.nodes ?? [];
   const hasConfig = head?.tree.entries.some((e) => e.name === REVIEW_BOT_CONFIG) ?? false;
-  if (hasConfig && !contexts.some((ctx) => REVIEW_BOTS.test(ctx.context ?? ctx.name ?? ""))) {
+  if (hasConfig && !contexts.some((ctx) => CODERABBIT.test(ctx.context ?? ctx.name ?? ""))) {
     open.push(`${NO_CHECK}: ${FOLLOW_UP}`);
   }
   for (const ctx of contexts) {
     const name = ctx.context ?? ctx.name ?? "";
     const running =
       ctx.state === "PENDING" || (ctx.status !== undefined && ctx.status !== "COMPLETED");
-    if (!REVIEW_BOTS.test(name)) {
+    if (!isReviewBot(name)) {
       continue;
     }
     if (running) {
       open.push(`${RUNNING}${name}`);
     } else if (ctx.name !== undefined && ctx.conclusion !== "SUCCESS") {
+      const retry = CUBIC.test(name) ? `; ${CUBIC_RETRY}` : "";
       open.push(
-        `${name} review concluded ${ctx.conclusion ?? "(missing conclusion)"}: ${FOLLOW_UP}`,
+        `${name} review concluded ${ctx.conclusion ?? "(missing conclusion)"}: ${FOLLOW_UP}${retry}`,
       );
     } else if (
       ctx.context !== undefined &&
-      (ctx.state !== "SUCCESS" || !REVIEWED.test(ctx.description ?? ""))
+      (ctx.state !== "SUCCESS" || (CODERABBIT.test(name) && !REVIEWED.test(ctx.description ?? "")))
     ) {
       open.push(
         `${name} did not review the head commit ("${ctx.description ?? ""}"): ${FOLLOW_UP}`,

package/skills/hr-pr-followup/scripts/merge-pr.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Squash-merge a pull request (or, with --merge, merge-commit it), delete its remote head, and verify the landing, without gh's
+# --delete-branch. Since gh 2.98 that flag runs `git worktree remove` on any linked worktree that
+# has the head branch checked out, another session's included when it is clean, and switches the
+# current checkout to the base when the head is checked out here. This script never removes a
+# worktree or local branch: it lists the worktrees still on the head so their owners clean up.
+#
+# Refuses a PR that is not open, one with open review feedback (check-pr-review.ts: an unresolved
+# thread, a review bot still running, unanswered findings in a bot's review body), or one another
+# open PR targets (deleting the head would close that PR; retarget it first with
+# `gh pr edit <n> --base <base>`). The merge passes
+# --match-head-commit, so a push after the head was read fails the merge instead of landing it.
+#
+# Refuses, after those checks, a repository listed in HR_PUSH_LANDED (space-separated owner/repo names;
+# empty by default): its own guidance lands by fast-forwarding the base to the head, because a GitHub
+# merge writes the account's profile name into public history. It prints that push instead.
+#
+# Before merging, verifies that the local default can be synchronized, even if it is current.
+# Refuses a dirty/diverged target or a default held in another checkout without --idle-primary.
+# After merging, fast-forwards the confirmed local default and fails if it is still stale.
+# To update the primary checkout from a task worktree, pass --idle-primary <path>
+# using existing ownership evidence or the operator's standing idle direction, unless current
+# evidence contradicts it; keep it idle through landing.
+# If verification
+# fails after "merged", rerun verify-landed.sh with the printed commit, not this script.
+#
+# --merge lands with a merge commit instead of a squash. Use it only for a PR whose second parent
+# must stay in history, such as an `-s ours` merge that records an upstream reconcile; a squash
+# would drop that parent. Every other PR is squashed.
+#
+# Usage: bash scripts/merge-pr.sh <pr> [--merge] [--remote <name>] [--idle-primary <path>]
+set -euo pipefail
+
+PUSH_LANDED=" ${HR_PUSH_LANDED:-} "
+
+PR="${1:?usage: merge-pr.sh <pr> [--merge] [--remote <name>] [--idle-primary <path>]}"
+shift
+REMOTE=origin
+STRATEGY=--squash
+SYNC_ARGS=(--ff)
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --merge) STRATEGY=--merge; shift;;
+    --remote) REMOTE="${2:?}"; shift 2;;
+    --idle-primary) SYNC_ARGS+=(--idle-primary "${2:?}"); shift 2;;
+    *) echo "unknown argument: $1" >&2; exit 2;;
+  esac
+done
+
+IFS=$'\t' read -r HEAD OID BASE STATE FORK < <(gh pr view "$PR" \
+  --json headRefName,headRefOid,baseRefName,state,isCrossRepository \
+  --jq '[.headRefName, .headRefOid, .baseRefName, .state, .isCrossRepository] | @tsv')
+[ "$STATE" = OPEN ] || { echo "PR $PR is $STATE, not OPEN" >&2; exit 1; }
+
+DEPENDENTS="$(gh pr list --state open --base "$HEAD" --json number --jq '.[].number' | tr '\n' ' ')"
+if [ -n "${DEPENDENTS// /}" ]; then
+  echo "open PRs target $HEAD: ${DEPENDENTS% }; retarget them first: gh pr edit <n> --base $BASE" >&2
+  exit 1
+fi
+
+bun "$(dirname "${BASH_SOURCE[0]}")/check-pr-review.ts" "$PR"
+
+REPO="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"
+if [[ "$PUSH_LANDED" == *" $REPO "* ]]; then
+  echo "$REPO lands by fast-forward push, not a GitHub merge (see its AGENTS.md). Run:" >&2
+  echo "  git push $REMOTE $HEAD:$BASE && git push $REMOTE --delete $HEAD" >&2
+  exit 1
+fi
+
+bash "$(dirname "${BASH_SOURCE[0]}")/verify-landed.sh" --preflight \
+  --default "$BASE" --remote "$REMOTE" "${SYNC_ARGS[@]}"
+
+gh pr merge "$PR" "$STRATEGY" --match-head-commit "$OID"
+SHA="$(gh pr view "$PR" --json mergeCommit --jq '.mergeCommit.oid // empty')"
+if ! [[ "$SHA" =~ ^([0-9a-f]{40}|[0-9a-f]{64})$ ]]; then
+  echo "PR $PR has no merge commit yet (a merge queue may still hold it); leaving its head branch alone" >&2
+  exit 1
+fi
+echo "merged: PR $PR as $SHA"
+
+# A fork's head lives in another repository; a repository may also delete merged heads itself.
+# Delete only a branch that still sits at the pull request's head commit, so a same-named branch on
+# an unrelated remote survives.
+if [ "$FORK" != true ]; then
+  REMOTE_HEAD="$(git ls-remote --heads "$REMOTE" "refs/heads/$HEAD" | awk '{print $1}')"
+  if [ "$REMOTE_HEAD" = "$OID" ]; then
+    git push --quiet --force-with-lease="refs/heads/$HEAD:$OID" "$REMOTE" --delete "$HEAD"
+    echo "deleted: $REMOTE/$HEAD"
+  elif [ -n "$REMOTE_HEAD" ]; then
+    echo "kept: $REMOTE/$HEAD is at $REMOTE_HEAD, not the pull request head $OID" >&2
+  fi
+fi
+
+bash "$(dirname "${BASH_SOURCE[0]}")/verify-landed.sh" --commit "$SHA" --branch "$HEAD" \
+  --default "$BASE" --remote "$REMOTE" "${SYNC_ARGS[@]}"
+
+git worktree list --porcelain | awk -v want="branch refs/heads/$HEAD" '
+  /^worktree / { path = substr($0, 10) }
+  $0 == want { print "still on " substr(want, 19) ": " path " (its owner retires it)" }
+'

package/skills/hr-pr-followup/scripts/verify-landed.sh

@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# Post-merge landing checks: containment, local-default state, leftover remote branches.
+# Fetches and verifies both remote containment and local-default equality. A stale local default
+# fails even when the remote contains the commit. Never resets, switches or deletes.
+# With --ff it updates a default checked out nowhere or here with a clean tree.
+# --idle-primary <path> additionally permits a fast-forward of this repository's primary checkout:
+# use existing ownership evidence or the operator's standing idle direction, unless current
+# evidence contradicts it. Git preserves
+# unrelated local edits and refuses a fast-forward that would overwrite them. It moves the
+# primary to the verified remote commit with `merge --ff-only <sha>` rather than `pull`, because
+# `pull` re-fetches into the shared FETCH_HEAD, which a concurrent fetch in the same checkout can
+# overwrite ("Cannot fast-forward to multiple branches"). Other linked worktrees
+# remain their owners' responsibility. After a blocked post-merge check, rerun this script,
+# not merge-pr.sh: the PR is already merged.
+# --preflight checks synchronization eligibility before landing, without moving local branches.
+# It requires --ff and rejects dirty or diverged targets and unconfirmed checkout ownership,
+# even when the local default is current. The caller must keep the target idle until landing
+# finishes; this check cannot establish session ownership or prevent another process starting.
+# Usage:
+#   bash scripts/verify-landed.sh --commit <sha> [--default <branch>]
+#     [--branch <merged-head>] [--remote <name>] [--ff [--idle-primary <path>]]
+#   bash scripts/verify-landed.sh --preflight --ff [--default <branch>]
+#     [--remote <name>] [--idle-primary <path>]
+set -euo pipefail
+
+REMOTE=origin
+DEFAULT=""
+COMMIT=""
+BRANCH=""
+FF=0
+IDLE_PRIMARY=""
+PREFLIGHT=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --commit) COMMIT="${2:?}"; shift 2;;
+    --default) DEFAULT="${2:?}"; shift 2;;
+    --branch) BRANCH="${2:?}"; shift 2;;
+    --remote) REMOTE="${2:?}"; shift 2;;
+    --ff) FF=1; shift;;
+    --idle-primary) IDLE_PRIMARY="${2:?}"; shift 2;;
+    --preflight) PREFLIGHT=1; shift;;
+    *) echo "unknown argument: $1" >&2; exit 2;;
+  esac
+done
+if [ "$PREFLIGHT" = 1 ]; then
+  [ "$FF" = 1 ] && [ -z "$COMMIT$BRANCH" ] \
+    || { echo "--preflight requires --ff and excludes --commit/--branch" >&2; exit 2; }
+else
+  [ -n "$COMMIT" ] || { echo "missing --commit <sha>" >&2; exit 2; }
+fi
+if [ -n "$IDLE_PRIMARY" ]; then
+  [ "$FF" = 1 ] || { echo "--idle-primary requires --ff" >&2; exit 2; }
+  PRIMARY="$(git worktree list --porcelain | sed -n '1s/^worktree //p')"
+  IDLE_PRIMARY="$(git -C "$IDLE_PRIMARY" rev-parse --show-toplevel)"
+  [ "$IDLE_PRIMARY" = "$PRIMARY" ] \
+    || { echo "--idle-primary is not this repository's primary checkout: $IDLE_PRIMARY" >&2; exit 2; }
+fi
+
+if [ -z "$DEFAULT" ]; then
+  # The remote's own answer wins; the cached origin/HEAD goes stale when the default branch changes.
+  DEFAULT="$(git ls-remote --symref "$REMOTE" HEAD 2>/dev/null | sed -n 's#^ref: refs/heads/\([^[:space:]]*\).*#\1#p' || true)"
+  if [ -z "$DEFAULT" ]; then
+    DEFAULT="$(git symbolic-ref "refs/remotes/$REMOTE/HEAD" 2>/dev/null | sed "s#^refs/remotes/$REMOTE/##" || true)"
+  fi
+  [ -n "$DEFAULT" ] || { echo "cannot resolve remote default branch; pass --default" >&2; exit 2; }
+fi
+
+git fetch "$REMOTE" "+refs/heads/$DEFAULT:refs/remotes/$REMOTE/$DEFAULT" >/dev/null 2>&1 \
+  || { echo "fetch failed: $REMOTE $DEFAULT" >&2; exit 1; }
+
+WTLS="$(git worktree list --porcelain)"
+HOLDER="$(printf '%s\n' "$WTLS" | awk -v want="branch refs/heads/$DEFAULT" '
+  /^worktree / { path = substr($0, 10) }
+  $0 == want { print path; exit }
+')"
+HERE="$(git rev-parse --show-toplevel)"
+
+if [ "$PREFLIGHT" = 1 ]; then
+  # A rebase or bisect detaches HEAD while still reserving its original branch.
+  if [ -z "$HOLDER" ]; then
+    while IFS= read -r RECORD; do
+      case "$RECORD" in worktree\ *) CHECKOUT="${RECORD#worktree }";; *) continue;; esac
+      [ -d "$CHECKOUT" ] || continue
+      for ASSOCIATION in rebase-merge/head-name rebase-apply/head-name BISECT_START; do
+        ASSOCIATION_PATH="$(git -C "$CHECKOUT" rev-parse --path-format=absolute --git-path "$ASSOCIATION")"
+        if [ -f "$ASSOCIATION_PATH" ]; then
+          IFS= read -r ASSOCIATED_BRANCH < "$ASSOCIATION_PATH"
+          if [ "$ASSOCIATED_BRANCH" = "refs/heads/$DEFAULT" ] || [ "$ASSOCIATED_BRANCH" = "$DEFAULT" ]; then
+            HOLDER="$CHECKOUT"
+            break 2
+          fi
+        fi
+      done
+    done <<< "$WTLS"
+  fi
+  if [ -n "$HOLDER" ]; then
+    if [ "$HOLDER" != "$HERE" ] && [ "$HOLDER" != "$IDLE_PRIMARY" ]; then
+      echo "sync blocked at $HOLDER: that checkout has the default branch. If nothing is using it, rerun with --idle-primary <primary-path>" >&2
+      exit 1
+    fi
+    STATUS="$(git -C "$HOLDER" status --porcelain)" \
+      || { echo "sync blocked at $HOLDER: cannot inspect working tree" >&2; exit 1; }
+    [ -z "$STATUS" ] \
+      || { echo "sync blocked at $HOLDER: working tree dirty; leave it for its owner" >&2; exit 1; }
+    for OPERATION in MERGE_HEAD CHERRY_PICK_HEAD REVERT_HEAD rebase-merge rebase-apply sequencer BISECT_START; do
+      OPERATION_PATH="$(git -C "$HOLDER" rev-parse --path-format=absolute --git-path "$OPERATION")"
+      [ ! -e "$OPERATION_PATH" ] \
+        || { echo "sync blocked at $HOLDER: unfinished Git operation: $OPERATION" >&2; exit 1; }
+    done
+  fi
+  if git show-ref --verify --quiet "refs/heads/$DEFAULT"; then
+    git merge-base --is-ancestor "$DEFAULT" "$REMOTE/$DEFAULT" \
+      || { echo "sync blocked: $DEFAULT cannot fast-forward to $REMOTE/$DEFAULT" >&2; exit 1; }
+  fi
+  echo "synchronization preflight passed: $DEFAULT (${HOLDER:-not checked out})"
+  exit 0
+fi
+
+FAIL=0
+
+if git merge-base --is-ancestor "$COMMIT" "$REMOTE/$DEFAULT" 2>/dev/null; then
+  echo "contained: $COMMIT in $REMOTE/$DEFAULT"
+else
+  echo "NOT CONTAINED: $COMMIT missing from $REMOTE/$DEFAULT" >&2
+  FAIL=1
+fi
+
+if git show-ref --verify --quiet "refs/heads/$DEFAULT"; then
+  LOCAL="$(git rev-parse "$DEFAULT")"
+  UPSTREAM="$(git rev-parse "$REMOTE/$DEFAULT")"
+  if [ "$LOCAL" = "$UPSTREAM" ]; then
+    echo "local $DEFAULT: current ($LOCAL)"
+  elif git merge-base --is-ancestor "$LOCAL" "$UPSTREAM" 2>/dev/null; then
+    BEHIND="$(git rev-list --count "$LOCAL..$UPSTREAM")"
+    if [ -z "${HOLDER:-}" ]; then
+      if [ "$FF" = 1 ] && [ "$FAIL" = 0 ]; then
+        git update-ref -m "verify-landed: fast-forward $DEFAULT" "refs/heads/$DEFAULT" "$UPSTREAM" "$LOCAL"
+        echo "local $DEFAULT: fast-forwarded $BEHIND commit(s) to $UPSTREAM (not checked out anywhere)"
+      else
+        echo "local $DEFAULT: $BEHIND behind, not checked out anywhere — safe: git fetch $REMOTE $DEFAULT:$DEFAULT"
+      fi
+    elif [ "$HOLDER" != "$HERE" ]; then
+      if [ "$FF" = 1 ] && [ "$FAIL" = 0 ] && [ "$HOLDER" = "$IDLE_PRIMARY" ]; then
+        [ "$(git -C "$HOLDER" symbolic-ref --quiet --short HEAD)" = "$DEFAULT" ] \
+          || { echo "primary checkout changed branches; refusing update" >&2; exit 1; }
+        git -C "$HOLDER" merge --quiet --ff-only "$UPSTREAM"
+        echo "local $DEFAULT: fast-forwarded $BEHIND commit(s) in confirmed idle primary $HOLDER"
+      else
+        echo "local $DEFAULT: $BEHIND behind, checked out at $HOLDER (not here) — leave for its owner; if you know it is idle: git -C $HOLDER merge --ff-only $UPSTREAM"
+        echo "If nothing is using that checkout, rerun verify-landed.sh with --ff --idle-primary <primary-path>." >&2
+      fi
+    elif [ -n "$(git status --porcelain)" ]; then
+      echo "local $DEFAULT: $BEHIND behind but working tree dirty — report, do not touch"
+    elif [ "$FF" = 1 ] && [ "$FAIL" = 0 ]; then
+      git merge --quiet --ff-only "$UPSTREAM"
+      echo "local $DEFAULT: fast-forwarded $BEHIND commit(s) to $UPSTREAM (checked out here)"
+    else
+      echo "local $DEFAULT: $BEHIND behind, clean, checked out here — safe to fast-forward"
+    fi
+  else
+    echo "local $DEFAULT: diverged from $REMOTE/$DEFAULT — report, do not touch"
+  fi
+  if [ "$(git rev-parse "$DEFAULT")" != "$(git rev-parse "$REMOTE/$DEFAULT")" ]; then
+    echo "LOCAL DEFAULT NOT CURRENT: $DEFAULT differs from $REMOTE/$DEFAULT; landing incomplete" >&2
+    FAIL=1
+  fi
+else
+  echo "local $DEFAULT: no local branch (nothing to update)"
+fi
+
+if [ -n "$BRANCH" ]; then
+  if ! REMOTE_REFS="$(git ls-remote --heads "$REMOTE" "$BRANCH" 2>/dev/null)"; then
+    echo "remote branch lookup failed: $REMOTE $BRANCH" >&2
+    FAIL=1
+  elif [ -n "$REMOTE_REFS" ]; then
+    echo "leftover branch: $REMOTE/$BRANCH still exists after merge" >&2
+    FAIL=1
+  else
+    echo "no leftover branch: $REMOTE/$BRANCH gone"
+  fi
+fi
+
+exit "$FAIL"

package/skills/hr-read-reddit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: hr-read-reddit
-description: Read Reddit threads (post plus comments) and search subreddits in full text, with links kept inline. Use whenever a task needs Reddit content or needs to collect links posted on Reddit; generic web fetch and reddit.com JSON are blocked for agents.
+description: Read Reddit posts and comments from Reddit's public feeds (output can omit comments) and search subreddits, with links kept inline. Use whenever a task needs Reddit content or needs to collect links posted on Reddit; generic web fetch and reddit.com JSON are blocked for agents. Reddit's RSS support ends November 13, 2026; a partial search fallback remains.
 ---
 
 # Read Reddit