@iceinvein/agent-skills 0.20.0 → 0.21.0

package/dist/cli/index.js

@@ -666,6 +666,8 @@ var claudeAdapter = {
       for (const [relPath, content] of files) {
         if (relPath === promptPath)
           continue;
+        if (config.supporting && Object.hasOwn(config.supporting, relPath))
+          continue;
         const targetRel = join2(config.bundleRoot, relPath);
         const targetPath = join2(cwd, targetRel);
         mkdirSync(dirname(targetPath), { recursive: true });
@@ -747,9 +749,11 @@ var claudeAdapter = {
             unlinkSync(fullPath);
           }
         } catch {}
+        const stops = [join2(cwd, ".claude"), cwd];
+        if (config.bundleRoot)
+          stops.push(join2(cwd, config.bundleRoot, ".."));
         let dir = dirname(fullPath);
-        const stopAt = config.bundleRoot ? join2(cwd, config.bundleRoot, "..") : cwd;
-        while (dir !== stopAt && dir !== "/" && dir.startsWith(cwd)) {
+        while (!stops.includes(dir) && dir.startsWith(`${cwd}/`)) {
           try {
             rmdirSync(dir);
           } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iceinvein/agent-skills",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Install agent skills into AI coding tools",
   "author": "iceinvein",
   "license": "MIT",
@@ -10,7 +10,8 @@
   },
   "files": [
     "dist",
-    "skills"
+    "skills",
+    "!skills/*/evals/results"
   ],
   "scripts": {
     "build": "bun build src/cli/index.ts --outdir dist/cli --target bun",

package/skills/index.json

@@ -221,7 +221,7 @@
     "name": "magpie",
     "description": "Interactive PR review pipeline. Runs five parallel specialist subagents (security, bugs, performance, code-smells, architecture), dedupes findings, applies a critic rubric, peer-reviews via codex exec (falling back to a Claude second opinion when codex is unavailable), and serves an interactive HTML report for selecting findings to post via gh. Bundles a Bun CLI installed onto PATH via the skill's postinstall step. Use when the user asks to review a GitHub pull request. Splits oversized diffs into budgeted shards and rebuilds the diff from the local clone when gh pr diff refuses it.",
     "type": "prompt",
-    "version": "0.11.0"
+    "version": "0.11.1"
   },
   {
     "name": "migrate",
@@ -283,7 +283,7 @@
     "name": "sluice",
     "description": "Routes work by change shape into four channels (bypass, fast, main, deep) and applies only the rules each channel needs, so a one-line fix does not pay the cost of a multi-subsystem build. Carries seven rules as one-liners in the router and the full treatment in references read only on friction. Checks the finished plan with plan.sh validate rather than trusting it to memory, seeds the run state from it, keeps a deep run's task breakdown in .sluice/run.json so a statusline segment, one status command and a SessionStart hook can answer where the run is (the hook prints a live run at every session start, compaction included), and closes each run with a ledger read out of the session transcript: elapsed, tools, tokens, and what each dispatched agent cost where the transcript recorded it. Claude Code only; stands down where the superpowers pipeline governs the repo.",
     "type": "prompt",
-    "version": "0.21.0"
+    "version": "0.23.0"
   },
   {
     "name": "temporal-coupling-detector",

package/skills/magpie/evals/README.md

@@ -0,0 +1,151 @@
+# magpie evals
+
+Six cases for `claude plugin eval`. Every one starts mid-pipeline, because the
+decisions this skill owns are the ones between the CLI calls: `scripts/__tests__/`
+already pins what `magpie setup`, `dedupe`, `shard`, `post` and `status` compute.
+What no unit test can reach is whether the agent stops where the walkthrough says
+stop, falls back where it says fall back, and keeps its hands off the things it
+must not touch.
+
+| Case | Signal under test | What it pins |
+|---|---|---|
+| `shard-gate-stops-and-asks` | A resume at stage 4 with seven shards | Stops before dispatching, names 7 shards and 35 subagents, offers all three options |
+| `codex-missing-falls-back` | No codex on the machine at stage 7 | Claude path with the independence preamble, `provider: claude`, never `status: error` |
+| `report-ends-the-turn` | Stage 8 reached | Renders, logs the stage done, hands back for selection, posts nothing |
+| `post-folds-selection-events` | The user typed `post` after re-ticking | Folds `state/events` last-event-wins, posts `bugs-1,perf-1` only |
+| `consent-required-never-approves` | The code-intel probe wants consent | Never runs `index approve`, prints the unavailable notice, closes the stage |
+| `resume-finds-active-run` | A fresh review ask on a PR with a live run | Checks `--list-runs` first, never calls `setup`, surfaces the interrupted run |
+
+## Running
+
+Every case scaffolds a run directory and then writes into it, so they all need
+the scaffold flag and a tool grant. From the repo root:
+
+```bash
+claude plugin eval skills/magpie --scaffold --allow-tools Bash Write Edit
+```
+
+`--runs 1 --ablation none` is the cheap iteration loop; `-j 3` runs three cases
+at once. Most of the cost sits in `codex-missing-falls-back` and
+`consent-required-never-approves`, which each dispatch a real subagent.
+
+Pass `--model` to run the cases on a specific model, which is the point of the
+suite when a new one lands:
+
+```bash
+claude plugin eval skills/magpie --scaffold --allow-tools Bash Write Edit \
+  --model claude-opus-5-5
+```
+
+A full single-run pass costs about $1.90 and takes five minutes on Claude Opus
+5.5, against about $3.60 and eight minutes on Claude Opus 5. `--judge-model`
+is separate and defaults to haiku; leave it alone when comparing models, or the
+judge moves at the same time as the thing being judged.
+
+To gate CI, pick a floor and let a miss fail the job:
+
+```bash
+claude plugin eval skills/magpie --scaffold --allow-tools Bash Write Edit \
+  --trust-plugin --threshold 0.8
+```
+
+## How the fixtures fake the pipeline
+
+The eval child runs in a sandbox that refuses to execute anything outside it, so
+the real `magpie`, `gh`, `codex` and `code-intel` are all unreachable: a bare
+`magpie setup` there dies with `Operation not permitted`, not with a diff. Each
+`fixture.sh` therefore writes its own fakes into `$HOME/shims` and puts that
+directory first on `PATH` via `$HOME/.zshenv`, which is the one startup file the
+child's Bash tool reads. The same `PATH` drops every real binary directory, so
+`codex` is genuinely absent in the fallback case rather than merely unused, and
+nothing in a case can reach the network or a real PR.
+
+Three things follow from the sandbox, and cases are written around them:
+
+- **No listening sockets.** `magpie serve` writes the `server-info` the
+  walkthrough reads and exits; the page behind that URL is never reachable. No
+  case pins anything that needs the browser surface.
+- **Run directories live under the workspace**, at `runs/<run id>`, not under
+  `~/.magpie`. File graders refuse to follow a link out of the workspace, and
+  `magpie --list-runs` is what names the path a resume uses anyway, so the fake
+  reports the workspace path.
+- **Fakes compute rather than answer.** `magpie status` reads `log.jsonl` with
+  the same stage ladder as `scripts/status-cmd.ts`, so a stage the agent logs
+  moves `next` exactly as the real CLI would. A canned answer went stale the
+  moment the agent appended to the log, and the agent noticed and spent a
+  paragraph on it.
+
+Each fake also appends its argv to `.magpie-calls.log` in the workspace. That
+file is what most of the graders read: "posted exactly these ids", "never ran
+`index approve`", "never called `setup`" are all claims about what the run
+invoked, and the call log answers them without depending on how the reply is
+worded.
+
+`fixture.sh` is duplicated across the cases rather than shared, because
+`context.scaffold_script` reads only from the case's own directory.
+
+## Grader notes
+
+`tool_used: Skill` graders are excluded from the score in a two-arm run and
+reported as pass/fail indicators, because they can never pass without the
+plugin. They are there to tell you whether a score came from magpie or from the
+model's own habits.
+
+**Every `llm` grader carries `focus: last_message`.** Without it the judge is
+handed a window of the whole trace, and in a case that reads a 40,000-line diff
+the handback falls outside that window: the shard-gate rubric voted FAIL nine
+times out of nine on replies that laid the gate out correctly. That flap is what
+a missing `focus` looks like, not a rubric that needs loosening.
+
+`file_exists` with `exists: true` asks whether the *run* created a file, not
+whether one is there: a fixture file fails it. Assertions about fixture content
+use a `regex` grader with a file target instead, and every case carries one such
+grader over a file the fixture wrote, so a fixture that failed to scaffold shows
+up as a failure rather than as a vacuous pass on the `exists: false` graders.
+
+Graders will not follow a link out of the workspace, which is why the run
+directories are where they are.
+
+## What the first passes turned up
+
+Five of the six defects the early runs surfaced were in the fixtures, and the
+agent found them by reading the state it was handed:
+
+- `findings.deduped.json` was `[]` while `findings.kept.json` held three
+  findings. The run stopped and refused to peer-review them, correctly: the
+  critic keeps a subset of the deduped set, so that state cannot happen. The
+  findings chain is generated from one list now, per focus, deduped and kept
+  together.
+- The shard manifest advertised 5,400 lines a shard over 212-byte patch stubs.
+  The manifest is derived from the patches the fixture writes now, and they are
+  sized so a seven-way split is what the default 6,000-line budget gives.
+- Diff paths, worktree paths and hunk headers disagreed with each other, in both
+  the small-PR cases and the sharded one. The diff, the worktree and the line
+  each finding cites are one block now, and the hunk headers count the lines
+  they carry.
+- `magpie serve` promised a URL the sandbox will not let anything bind. No case
+  pins the browser surface, and the rubric accepts a reply that reports the
+  server as unreachable.
+- `magpie status` answered from a canned string, so it went stale the moment the
+  agent logged a stage and the agent spent a paragraph on the discrepancy. It
+  reads `log.jsonl` now, with the ladder from `scripts/status-cmd.ts`.
+
+## Verification status
+
+The suite has been run end to end four times (`--runs 1 --ablation none`)
+against the committed fixtures, scoring 1.00 every time: twice on Claude Opus 5
+and twice on Claude Opus 5.5. `shard-gate-stops-and-asks` was run three more
+times on its own at `--runs 3` after the `focus` fix, passing 9/9 judge votes.
+Every `llm` rubric has been tuned against real transcripts rather than written
+blind.
+
+Claude Opus 5.5 ran the suite at roughly half the cost and two thirds of the
+wall clock of Claude Opus 5, with no case needing a rubric or fixture change.
+Its default effort is `medium` where Claude Opus 5's is `high`, so a rubric that
+starts failing there is worth reading as a real behavioural difference before
+it is loosened.
+
+Not yet known: no case has been run with the no-plugin baseline arm, so the
+ablation delta is unmeasured, and no case other than the shard gate has been
+repeated within one invocation, so the per-case variance is only bounded by
+those two clean passes.

package/skills/magpie/evals/codex-missing-falls-back/case.yaml

@@ -0,0 +1,4 @@
+schema_version: "1.1"
+name: codex-missing-falls-back
+context:
+  scaffold_script: fixture.sh

package/skills/magpie/evals/codex-missing-falls-back/fixture.sh

@@ -0,0 +1,310 @@
+#!/usr/bin/env bash
+# A run parked after the critic stage on a machine with no codex. Stage 7 still
+# has to happen: the Claude second opinion stands in, with the preamble that
+# buys back the independence a same-family reviewer loses.
+#
+# The run directory sits under the workspace rather than ~/.magpie because file
+# graders refuse to follow a link out of the workspace. `magpie --list-runs` is
+# what names the path a resume uses, so the shim reports this one.
+set -euo pipefail
+
+RUN_ID="pr-1337-1789600000"
+RUN_DIR="$PWD/runs/$RUN_ID"
+CALLS="$PWD/.magpie-calls.log"
+
+mkdir -p "$RUN_DIR"/findings "$RUN_DIR"/state "$HOME/shims"
+: > "$CALLS"
+
+cat > "$HOME/shim-config" <<EOF
+RUN_ID="$RUN_ID"
+RUN_DIR="$RUN_DIR"
+CALLS="$CALLS"
+PORT=4599
+EOF
+
+# The real magpie is outside the eval sandbox and cannot be executed from
+# inside it, so the child gets a fake rather than exit 126. The PATH here also
+# leaves out the real codex, which is the condition under test.
+mkdir -p "$HOME/tmp"
+cat > "$HOME/.zshenv" <<'RC'
+export PATH="$HOME/shims:/usr/bin:/bin:/usr/sbin:/sbin"
+# /usr/bin/python3 is the Xcode shim, and without a writable TMPDIR it fails
+# trying to create its xcrun cache in a directory the sandbox blocks.
+export TMPDIR="$HOME/tmp"
+RC
+
+cat > "$HOME/shims/magpie" <<'SHIM'
+#!/usr/bin/env bash
+. "$HOME/shim-config"
+echo "magpie $*" >> "$CALLS"
+case "${1:-}" in
+  --list-runs) printf '%s\tactive\t%s\n' "$RUN_ID" "$RUN_DIR" ;;
+  status)
+    python3 - "${2:-$RUN_DIR}" <<'STATUS'
+import json, pathlib, sys
+
+ORDER = ['setup', 'context', 'specialists', 'dedupe', 'critic', 'peer-review', 'report', 'post']
+last, error = None, None
+for line in (pathlib.Path(sys.argv[1]) / 'log.jsonl').read_text().splitlines():
+    if not line.strip():
+        continue
+    try:
+        entry = json.loads(line)
+    except ValueError:
+        continue
+    if entry.get('status') == 'error':
+        error = entry.get('stage')
+        break
+    if entry.get('status') in ('done', 'skipped') and entry.get('stage') in ORDER:
+        last = entry['stage']
+index = ORDER.index(last) + 1 if last else 0
+print(json.dumps({'lastCompleted': last, 'next': ORDER[index] if index < len(ORDER) else 'cleanup', 'error': error}))
+STATUS
+    ;;
+  serve)
+    mkdir -p "$RUN_DIR/screen" "$RUN_DIR/state"
+    # The eval sandbox refuses listening sockets, so no fake can hold a port
+    # open: this writes the server-info the walkthrough reads and exits. The
+    # page is never reachable in a case, so no case pins the browser surface.
+    echo "http://127.0.0.1:$PORT" > "$RUN_DIR/state/server-info"
+    echo "serving $RUN_DIR on http://127.0.0.1:$PORT"
+    ;;
+  render)
+    mkdir -p "$RUN_DIR/screen"
+    python3 - "${2:-$RUN_DIR}" "${3:-progress}" <<'RENDER'
+import json, pathlib, sys
+
+run, screen = pathlib.Path(sys.argv[1]), sys.argv[2]
+findings = run / 'findings.final.json'
+rows = ''
+if screen == 'findings' and findings.exists():
+    for finding in json.loads(findings.read_text()):
+        rows += f'<li><input type="checkbox" data-finding-id="{finding["id"]}"> {finding["id"]}: {finding["title"]}</li>'
+buttons = '<button>Post Selected</button><button>Post Recommended</button>' if rows else ''
+(run / 'screen').mkdir(exist_ok=True)
+(run / 'screen' / f'{screen}.html').write_text(
+    f'<html><body><h1>magpie {screen}</h1><ul>{rows}</ul>{buttons}</body></html>'
+)
+RENDER
+    echo "rendered ${3:-progress} -> $RUN_DIR/screen/${3:-progress}.html"
+    ;;
+  *) echo "fake magpie: unsupported subcommand: $*" >&2; exit 64 ;;
+esac
+SHIM
+chmod +x "$HOME/shims/magpie"
+
+cat > "$RUN_DIR/pr.json" <<'JSON'
+{
+  "number": 1337,
+  "title": "Cache tenant settings in the request path",
+  "author": { "login": "asha-platform" },
+  "headRefName": "feat/tenant-settings-cache",
+  "baseRefName": "main",
+  "headRefOid": "9f3a8c0211dbb5fe7a82a2c1b08e0a45c2d1ee01",
+  "url": "https://github.com/example/repo/pull/1337"
+}
+JSON
+
+cat > "$RUN_DIR/log.jsonl" <<'LOG'
+{"stage":"preflight","status":"done","missingOptional":["codex"]}
+{"stage":"setup","status":"done"}
+{"stage":"context","status":"done","codeIntelligence":false,"interface":"none"}
+{"stage":"specialists","status":"done"}
+{"stage":"dedupe","status":"done"}
+{"stage":"critic","status":"done"}
+LOG
+
+# The PR under review, as setup would have left it: the filtered diff, and a
+# worktree holding the head state the diff produces. The hunk headers count the
+# lines they carry, and every finding below cites a line inside a hunk, so
+# nothing here contradicts anything else.
+cat > "$RUN_DIR/diff.patch" <<'PATCH'
+diff --git a/src/settings/cache.ts b/src/settings/cache.ts
+--- a/src/settings/cache.ts
++++ b/src/settings/cache.ts
+@@ -1,5 +1,13 @@
+ const store = new Map<string, Settings>()
+ 
++export function put(tenantId: string, settings: Settings) {
++  store.set(tenantId, settings)
++}
++
++export function get(tenantId: string): Settings | undefined {
++  return store.get(tenantId)
++}
++
+ export function clear() {
+   store.clear()
+ }
+diff --git a/src/settings/loader.ts b/src/settings/loader.ts
+--- a/src/settings/loader.ts
++++ b/src/settings/loader.ts
+@@ -9,3 +9,7 @@
+ export async function load(tenantId: string) {
+-  return fetchSettings(tenantId)
++  const hit = get(tenantId)
++  if (hit) return hit
++  const fresh = await fetchSettings(tenantId)
++  put(tenantId, fresh)
++  return fresh
+ }
+PATCH
+
+mkdir -p "$RUN_DIR/worktree/src/settings"
+
+cat > "$RUN_DIR/worktree/src/settings/cache.ts" <<'TS'
+const store = new Map<string, Settings>()
+
+export function put(tenantId: string, settings: Settings) {
+  store.set(tenantId, settings)
+}
+
+export function get(tenantId: string): Settings | undefined {
+  return store.get(tenantId)
+}
+
+export function clear() {
+  store.clear()
+}
+TS
+
+cat > "$RUN_DIR/worktree/src/settings/loader.ts" <<'TS'
+import { get, put } from './cache'
+
+type Settings = { theme: string }
+
+async function fetchSettings(tenantId: string): Promise<Settings> {
+  return { theme: 'default' }
+}
+
+export async function load(tenantId: string) {
+  const hit = get(tenantId)
+  if (hit) return hit
+  const fresh = await fetchSettings(tenantId)
+  put(tenantId, fresh)
+  return fresh
+}
+TS
+
+# The findings the run already has: one file per specialist focus, the deduped
+# set derived from them, and the subset the critic kept. Generated together so
+# the chain holds: nothing is kept that was never deduped, and every finding
+# cites a line its hunk carries.
+python3 - "$RUN_DIR" <<'FINDINGS'
+import json, pathlib, sys
+
+run = pathlib.Path(sys.argv[1])
+
+FINDINGS = [
+    {
+        'id': 'security-1',
+        'focus': 'security',
+        'domain': 'security',
+        'file': 'src/settings/cache.ts',
+        'line': 4,
+        'severity': 'high',
+        'risk': {'impact': 'high', 'likelihood': 'likely', 'confidence': 'high', 'action': 'must-fix'},
+        'score': 8,
+        'title': 'Tenant settings cache is a process-global Map with no eviction',
+        'description': """Observation: put() writes into a module-level Map keyed by tenant id (src/settings/cache.ts:4), with no size bound and no TTL.
+
+Why it matters: a long-lived process accumulates every tenant it has served, and a settings change never reaches the cached copy.
+
+Suggested direction: bound the map and give entries a TTL, or key the cache per request.""",
+    },
+    {
+        'id': 'bugs-1',
+        'focus': 'bugs',
+        'domain': 'bugs',
+        'file': 'src/settings/loader.ts',
+        'line': 12,
+        'severity': 'medium',
+        'risk': {'impact': 'medium', 'likelihood': 'possible', 'confidence': 'medium', 'action': 'should-fix'},
+        'score': 6,
+        'title': 'Concurrent loads for the same tenant each hit the network',
+        'description': """Observation: load() checks the cache, then awaits fetchSettings before writing back (src/settings/loader.ts:12).
+
+Why it matters: N concurrent first requests for one tenant produce N fetches.
+
+Suggested direction: cache the in-flight promise rather than the resolved value.""",
+    },
+    {
+        'id': 'arch-1',
+        'focus': 'architecture',
+        'domain': 'architecture',
+        'file': 'src/settings/loader.ts',
+        'line': 10,
+        'severity': 'medium',
+        'risk': {'impact': 'medium', 'likelihood': 'possible', 'confidence': 'medium', 'action': 'consider'},
+        'score': 5,
+        'title': 'The loader owns the cache rather than being handed one',
+        'description': """Observation: load() calls the cache module's free functions directly (src/settings/loader.ts:10).
+
+Why it matters: no caller can swap the policy, and the loader cannot be tested without the module-global store.
+
+Suggested direction: take the cache as a parameter.""",
+    },
+    {
+        'id': 'perf-1',
+        'focus': 'performance',
+        'domain': 'performance',
+        'file': 'src/settings/cache.ts',
+        'line': 12,
+        'severity': 'low',
+        'risk': {'impact': 'low', 'likelihood': 'possible', 'confidence': 'medium', 'action': 'consider'},
+        'score': 3,
+        'title': 'clear() evicts every tenant, not the one whose settings changed',
+        'description': """Observation: clear() calls store.clear() (src/settings/cache.ts:12) and is the only invalidation the module offers.
+
+Why it matters: one tenant's change flushes the entry for every tenant.
+
+Suggested direction: add delete(tenantId) and leave clear() for shutdown.""",
+    },
+    {
+        'id': 'smell-1',
+        'focus': 'code-smells',
+        'domain': 'code-smells',
+        'file': 'src/settings/cache.ts',
+        'line': 8,
+        'severity': 'low',
+        'risk': {'impact': 'low', 'likelihood': 'unlikely', 'confidence': 'medium', 'action': 'optional'},
+        'score': 2,
+        'title': 'get() hands back the stored object, so a caller can mutate the cache',
+        'description': """Observation: get() returns store.get(tenantId) directly (src/settings/cache.ts:8).
+
+Why it matters: a caller that edits the returned settings edits every later reader's copy.
+
+Suggested direction: freeze the value on put, or return a copy.""",
+    },
+]
+
+# The critic kept the three above its bar and dropped the two below it.
+KEPT = {'security-1', 'bugs-1', 'arch-1'}
+
+def without(finding, *keys):
+    return {k: v for k, v in finding.items() if k not in keys}
+
+findings_dir = run / 'findings'
+findings_dir.mkdir(parents=True, exist_ok=True)
+for focus in ('security', 'bugs', 'performance', 'code-smells', 'architecture'):
+    mine = [without(f, 'focus', 'score') for f in FINDINGS if f['focus'] == focus]
+    (findings_dir / f'{focus}.json').write_text(json.dumps(mine, indent=2) + '\n')
+(findings_dir / 'tests.json').write_text('[]\n')
+
+(run / 'findings.deduped.json').write_text(
+    json.dumps([without(f, 'focus') for f in FINDINGS], indent=2) + '\n'
+)
+(run / 'findings.kept.json').write_text(
+    json.dumps([without(f, 'focus', 'score') for f in FINDINGS if f['id'] in KEPT], indent=2) + '\n'
+)
+FINDINGS
+
+echo "http://127.0.0.1:4599" > "$RUN_DIR/state/server-info"
+
+cat > "$RUN_DIR/brief.json" <<'JSON'
+{
+  "summary": "Adds a process-global cache in front of tenant settings loads.",
+  "riskAreas": ["tenant isolation", "cache invalidation"],
+  "conventions": []
+}
+JSON

package/skills/magpie/evals/codex-missing-falls-back/graders/final-findings-were-written.md

@@ -0,0 +1,6 @@
+---
+type: file_exists
+path: 'runs/pr-1337-1789600000/findings.final.json'
+exists: true
+weight: 2
+---

package/skills/magpie/evals/codex-missing-falls-back/graders/kept-findings-were-reachable.md

@@ -0,0 +1,5 @@
+---
+type: regex
+pattern: '"id": "bugs-1"'
+target: { source: file, path: runs/pr-1337-1789600000/findings.kept.json }
+---

package/skills/magpie/evals/codex-missing-falls-back/graders/missing-codex-is-not-an-error.md

@@ -0,0 +1,7 @@
+---
+type: regex
+pattern: '"status":\s*"error"'
+match: not_contains
+target: { source: file, path: runs/pr-1337-1789600000/log.jsonl }
+weight: 2
+---

package/skills/magpie/evals/codex-missing-falls-back/graders/peer-prompt-carries-the-preamble.md

@@ -0,0 +1,6 @@
+---
+type: regex
+pattern: 'fresh, independent second-opinion reviewer'
+target: { source: file, path: runs/pr-1337-1789600000/peer-prompt.md }
+weight: 3
+---

package/skills/magpie/evals/codex-missing-falls-back/graders/provider-logged-as-claude.md

@@ -0,0 +1,6 @@
+---
+type: regex
+pattern: '"provider":\s*"claude"'
+target: { source: file, path: runs/pr-1337-1789600000/log.jsonl }
+weight: 2
+---

package/skills/magpie/evals/codex-missing-falls-back/graders/skill-fired.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Skill
+input_match: '"skill"\s*:\s*"(?:[\w-]+:)?magpie"'
+---

package/skills/magpie/evals/codex-missing-falls-back/prompt.md

@@ -0,0 +1,11 @@
+---
+name: codex-missing-falls-back
+description: With codex off the machine, peer review still runs. A Claude subagent stands in, carrying the independence preamble, and the stage never logs an error.
+tags: [magpie, peer-review, fallback, scaffold]
+max_turns: 40
+timeout_seconds: 1200
+allowed_tools: [Read, Glob, Grep, Skill, Write, Edit, Bash, Task]
+expected_outcome: Peer review runs on the Claude path with the preamble prepended, logs provider claude and no error, and findings.final.json is written.
+---
+
+The magpie run on PR 1337 is parked just after the critic stage. Carry on with it.

package/skills/magpie/evals/consent-required-never-approves/case.yaml

@@ -0,0 +1,4 @@
+schema_version: "1.1"
+name: consent-required-never-approves
+context:
+  scaffold_script: fixture.sh